Cloud Pentest Quiz: Can You Break The Cloud?

1. Which of these is NOT a typical cloud threat actor motivation?

Data theft

Cryptomining

Hardware manufacturing

Ransomware deployment

2. What is the primary objective of cloud threat modeling?

Increase cloud service subscriptions

Identify potential attack paths and security gaps

Monitor user login activity

Improve internet speed

3. Which cloud-native service logs API calls and cloud resource changes?

CloudTrail (AWS) or equivalent

VPC Flow Logs

Security groups

Network ACLs

4. What is the main risk of hardcoded secrets in cloud infrastructure code?

Slower application performance

Exposure if code is committed to public repositories

Increased cloud service costs

Network latency issues

5. Which of the following best describes a zero-trust security model in cloud?

Trust all traffic by default

Verify every access request regardless of location

No security controls needed

Firewall-only protection

6. What does a lateral movement attack in cloud environments typically target?

Internet-facing web servers only

Other cloud instances or services within the same account

Physical data center hardware

Cloud provider headquarters

7. Which cloud security tool is used to detect and remediate identity-based threats?

WAF (Web Application Firewall)

CASB (Cloud Access Security Broker)

DLP (Data Loss Prevention)

IDS (Intrusion Detection System)

8. What is the primary benefit of using Infrastructure as Code (IaC) scanning in cloud pentesting?

Faster deployment of resources

Identifying misconfigurations before deployment

Reducing cloud costs

Improving application performance

9. Which vulnerability allows an attacker to access resources outside their assigned permissions?

Cross-tenant data leakage

Broken authentication

Insecure deserialization

Insufficient logging

10. What is the purpose of a cloud security assessment before penetration testing?

To document all cloud expenses

To understand architecture and identify test scope

To purchase additional cloud resources

To disable security controls

11. Which cloud service model provides the least responsibility for security patching to the customer?

Infrastructure as a Service (IaaS)

Platform as a Service (PaaS)

Software as a Service (SaaS)

Function as a Service (FaaS)

12. What does the shared responsibility model define in cloud security?

Which party owns the data

Security obligations divided between provider and customer

How to split costs

Backup schedule requirements

13. Which technique involves sending malicious requests to cloud APIs to discover vulnerabilities?

Fuzzing

Packet sniffing

Port scanning

VLAN hopping

14. What is a shadow IT risk in cloud environments?

Unauthorized cloud services used by employees

Cloud provider outages

DDoS attacks on cloud infrastructure

Encryption key loss

15. Which cloud provider security feature restricts access based on resource tags?

Network ACLs

Security groups

Identity and Access Management (IAM) policies

VPN connections

16. What is privilege escalation in the context of cloud penetration testing?

Increasing cloud service capacity

Moving from low-privilege to high-privilege account access

Upgrading cloud service tiers

Adding more users to an account

17. Which of the following is a common misconfiguration in cloud storage buckets?

Encryption enabled by default

Public read access without authentication

Versioning disabled

Lifecycle policies configured

18. What does CSPM stand for in cloud security?

Cloud Security Policy Management

Cloud Service Provider Management

Cloud Security Posture Management

Cloud Service Platform Monitoring

19. Which authentication mechanism is most commonly targeted in cloud environments?

Biometric authentication

API keys and credentials

Physical security cards

Retinal scanning

20. What is the primary goal of a cloud penetration test?

Permanently disable cloud services

Identify vulnerabilities and security gaps before malicious actors do

Steal sensitive data from the cloud

Test network bandwidth and latency

Cloud Pentest Quiz: Can You Break the Cloud?