PenTest Cloud Quiz: Can You Master Misconfig & IAM Abuse?

1. What does the principle of least privilege require in cloud IAM policies?

All users receive admin access by default

Users get only the minimum permissions needed for their role

Permissions are reviewed once per year

All cloud resources share the same policy

2. What is the primary mitigation for preventing unauthorized cloud API calls in pentesting scenarios?

Implement strict IAM policies with detailed resource conditions

Disable all API access

Use only root account credentials

Avoid encryption

3. True or False: Logging and monitoring are optional for non-production cloud resources.

True

False

4. In cloud pentesting, which tool is commonly used to enumerate S3 bucket misconfigurations?

Nessus

S3Scanner and Burp Suite

Wireshark

Hashcat

5. True or False: Cloud storage buckets should have public access blocked by default at the account level.

True

False

6. In cloud pentesting, what does CSPM stand for?

Cloud Security Posture Management

Cloud Service Provider Monitoring

Credential Storage Policy Module

Centralized Security Policy Module

7. What is a common misconfiguration in cloud key management services?

Keys are rotated too frequently

Overly permissive key policies allowing broad decrypt access

Encryption is always enabled

Keys are stored in the same region

8. Which AWS service configuration error most commonly leads to public exposure of sensitive data?

S3 bucket permissions set to public read/write

EC2 security group rules allowing all traffic

Lambda function memory allocation

RDS encryption key rotation

9. Which cloud storage misconfiguration allows unauthenticated users to list bucket contents?

Bucket versioning enabled

Public read permissions on bucket policy

Server-side encryption enabled

MFA delete protection disabled

10. True or False: Temporary security credentials in cloud environments should never be logged.

True

False

11. What is the primary risk of an overly permissive cross-account IAM role trust relationship?

Unauthorized access from another AWS account

Increased API latency

Higher data transfer costs

Slower encryption performance

12. Which cloud service is most commonly targeted for credential theft via metadata exploitation?

Azure Blob Storage

AWS EC2 instance metadata service

Google Cloud Load Balancer

Alibaba Object Storage Service

13. True or False: MFA is optional for cloud administrative accounts in production environments.

True

False

14. In cloud pentesting, what is the primary purpose of service control policies (SCPs)?

Encrypt data at rest

Set maximum permissions guardrails across accounts

Monitor network traffic

Authenticate users

15. Which misconfiguration allows attackers to escalate from a guest user to admin in Azure?

Overly permissive conditional access policies

Disabled multi-factor authentication

Default app registration permissions

All of the above

16. What does IAM abuse typically exploit in cloud environments?

Overly permissive policies and role assumption flaws

Network bandwidth limitations

CPU throttling

Storage quota limits

17. Which attack vector allows an attacker to assume a cloud service role without proper credentials?

SSRF (Server-Side Request Forgery)

Cross-site scripting

Metadata service exploitation

DDoS amplification

18. In cloud penetration testing, privilege escalation typically involves exploiting which vulnerability?

Overly permissive IAM role assumptions

Weak password policies alone

Network latency issues

API rate limiting

19. Which AWS identity is most vulnerable to credential exposure in EC2 instances?

Root account credentials

IAM user access keys

Temporary security credentials from instance roles

SSH key pairs

20. True or False: Cloud IAM policies should grant wildcard (*) permissions to simplify management.

True

False

Pentest Cloud Quiz: Can You Master Misconfig & IAM Abuse?

1. What does the principle of least privilege require in cloud IAM policies?

2.

What first name or nickname would you like us to use?

2. What is the primary mitigation for preventing unauthorized cloud API calls in pentesting scenarios?

3. True or False: Logging and monitoring are optional for non-production cloud resources.

4. In cloud pentesting, which tool is commonly used to enumerate S3 bucket misconfigurations?

5. True or False: Cloud storage buckets should have public access blocked by default at the account level.

6. In cloud pentesting, what does CSPM stand for?

7. What is a common misconfiguration in cloud key management services?

8. Which AWS service configuration error most commonly leads to public exposure of sensitive data?

9. Which cloud storage misconfiguration allows unauthenticated users to list bucket contents?

10. True or False: Temporary security credentials in cloud environments should never be logged.

11. What is the primary risk of an overly permissive cross-account IAM role trust relationship?

12. Which cloud service is most commonly targeted for credential theft via metadata exploitation?

13. True or False: MFA is optional for cloud administrative accounts in production environments.

14. In cloud pentesting, what is the primary purpose of service control policies (SCPs)?

15. Which misconfiguration allows attackers to escalate from a guest user to admin in Azure?

16. What does IAM abuse typically exploit in cloud environments?

17. Which attack vector allows an attacker to assume a cloud service role without proper credentials?

18. In cloud penetration testing, privilege escalation typically involves exploiting which vulnerability?

19. Which AWS identity is most vulnerable to credential exposure in EC2 instances?

20. True or False: Cloud IAM policies should grant wildcard (*) permissions to simplify management.