Q. What does Azure's Metadata service provide information about, and how might it be utilized by attackers?

View solution

Q. What is one of the most common misconfigurations in cloud services that can lead to security issues?

View solution

Q. What is a common area where penetration testers may find valuable data due to misconfigurations in cloud services?

View solution

Q. When assessing an object store, what are some common things to look for?

View solution

Q. In AWS, how can you check the permissions of an S3 bucket using the command line?

View solution

Q. What type of attack focuses on secret keys and credentials to gain access to object storage buckets?

View solution

Q. In a federation scenario between on-site Active Directory environments and Azure AD, what is commonly used for authentication and authorization?

View solution

Q. What does federation allow organizations to do in the context of services?

View solution

Q. Which type of cloud attack involves injecting malicious code into service or code pipelines or adding malicious tools into existing cloud infrastructure?

View solution

Q. What is the primary goal of direct-to-origin (D2O) attacks in a cloud environment?

View solution

Q. Why are penetration testers less likely to be asked to perform denial-of-service and resource exhaustion attacks in cloud environments?

View solution

Q. What do side-channel attacks in cloud environments rely on?

View solution

Q. What is ScoutSuite, and how does it gather configuration data for cloud penetration testing?

View solution

Q. What is the primary purpose of CloudBrute in cloud penetration testing?

View solution

Q. What is Pacu, and what specific capabilities does it offer for Amazon AWS penetration testing?

View solution

Q. How does Cloud Custodian contribute to penetration testing, despite not being intended as a pentesting tool?

View solution

Q. What role do native cloud software development kits (SDKs) play in cloud penetration testing?

View solution

Q. What is the significance of mobile devices in network security, considering their place between organizationally owned and personally owned devices?

View solution

Q. When scoping a penetration test involving mobile devices, why is it crucial to examine the organization's policies on mobile device ownership?

View solution

Q. What is the primary purpose of reverse engineering processes in the context of mobile device attacks?

View solution