CCSP Practice Question: Is a cloud-specific vulnerability that can lead…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection manipulates database queries through unsanitised input, exposing data held in the database rather than IAM credentials served by the instance metadata endpoint. It is tempting because it is a classic injection flaw, but it would be correct for a question about database compromise, not cloud metadata service credential exposure.

• ✓

  SSRF to metadata endpoint

  Why this is correct

  Server-side request forgery tricks an application into requesting the cloud instance metadata endpoint, which returns temporary IAM credentials to any process that reaches it. This satisfies the stem's cloud-specific requirement: the metadata service is unique to cloud platforms, and SSRF is the documented vector for credential exposure.

• ✗

  Insecure deserialization

  Why it's wrong here

  Insecure deserialization exploits untrusted serialised object reconstruction in application code, yielding remote code execution or data tampering, not credential theft from the instance metadata endpoint. It is tempting because it is a recognised cloud application risk, but it would be the answer for a question about vulnerable object handling, not metadata service abuse.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting executes attacker script in a victim's browser session, enabling session theft or client-side actions, not retrieval of IAM credentials from the instance metadata endpoint. It is tempting as a common web vulnerability, but it would be the answer for browser-side compromise, not server-side metadata service credential exposure.