Free GCPN Practice Questions

Question 1

A release identity can update an existing Lambda function's code and invoke its unqualified ARN. It has neither s3:GetObject nor iam:PassRole. The function's current execution role trusts Lambda and can read a designated S3 canary object; no signing, network, or other policy control blocks the stated operations. The attached role will remain unchanged. What access path does this create?

Accepted Answer

Changed code can read the canary using the function's existing execution role.

Answer

Without iam:PassRole, updated code cannot read the canary.

Answer

The invocation cannot succeed until the release identity gains its own s3:GetObject grant.

Answer

The code update adds the function role's permissions to the release identity's later API calls.

Question 2

An unsigned list request against a client's S3 bucket returns 403 AccessDenied. Written scope permits that check and one unsigned GET for a named, harmless canary object; other object reads are excluded. The exact canary key is available, service health is normal, and no stop condition has been met. How should anonymous object-read exposure be checked?

Accepted Answer

Issue the authorized unsigned GET for the supplied canary key.

Answer

Suspend testing until fresh authorization explicitly permits the canary read.

Answer

Read neighboring object keys to compare their access responses.

Answer

Classify anonymous reads as blocked by the listing denial.

Question 3

In the build namespace, a test identity can create Pods and read Pod logs but cannot get, list, or watch Secrets through the API. It knows the name of a canary Secret in build. Admission requires non-root containers and prohibits privileged containers and host mounts; it permits the canary to be mounted with file permissions readable by the container process. An access reviewer concludes that the Secret's contents are inaccessible to this identity. Which assessment is justified?

Accepted Answer

The conclusion fails: a permitted Pod can read the Secret and expose it through its logs.

Answer

The conclusion holds: mounting the Secret requires the Pod creator's direct Secret-read permission.

Answer

The conclusion holds: a non-root container needs node privileges to read a Secret volume.

Answer

The conclusion fails: creating Pods automatically grants direct Secret-read access across the cluster.

Question 4

Two Azure vaults give a test identity only the Key Vault Contributor role. Vault P uses legacy access policies; Vault R uses Azure RBAC. The identity can update vault settings but initially cannot retrieve either canary secret. Self-grant validation is authorized, changing authorization models is excluded, and no additional restrictions apply. In which vault can the identity grant itself secret-read access?

Accepted Answer

Vault P only, by adding a legacy access policy.

Answer

Both vaults, by adding data-role assignments.

Answer

Vault R only, because an Azure management role also grants its data-plane roles.

Answer

Neither vault, because the initial secret-read denial blocks later permission changes.

Question 5

An inventory script runs this command:
aws ec2 describe-instances --profile audit --region eu-west-1 --no-paginate --query 'Reservations[].Instances[].InstanceId' --output json
The underlying AWS response includes a NextToken, but the saved inventory contains only the first page's instance IDs. The account, Region, and permissions are correct. Which single edit restores automatic retrieval of the remaining pages?

Accepted Answer

Remove --no-paginate.

Answer

Add --no-cli-pager.

Answer

Replace --output json with --output text.

Answer

Remove --query.

Question 6

A multi-tenant invoice API validates the caller's session and uses a parameterized query to retrieve invoices by unpredictable identifiers. Signed in as a Tenant A user, an authorized tester supplies a synthetic Tenant B invoice's identifier and receives that invoice from the database. The user may use the endpoint but has no access to Tenant B; no shared cache is involved. Which server-side change addresses the defect?

Accepted Answer

Check the caller's tenant and object permissions before returning the invoice.

Answer

Reject SQL metacharacters from invoice identifiers before issuing the parameterized query.

Answer

Regenerate the invoice identifiers using a cryptographically secure random generator.

Answer

Require another authentication factor before accepting invoice identifiers from signed-in users.

Question 7

An Azure function app exposes Quote and Reconcile, both with HTTP authorization level function. Its two callers are a supplier that should invoke only Quote and an internal client using Reconcile's own function key. The supplier was given a host key and can invoke both functions. Routes and downstream access must stay intact. What correction gives each caller only the invocation access it needs?

Accepted Answer

Revoke the supplier's host key and issue Quote's function-specific key.

Answer

Retain the host key and assign the supplier Reader on the function app.

Answer

Rotate the host key and redistribute it to both clients.

Answer

Retain the host key and remove the function app's managed identity.

Question 8

External pull-request tests receive no secrets, but they share a persistent self-hosted runner with approved releases. A controlled test leaves a helper outside the Git checkout; the next release job executes it with deployment credentials available. The release commit was reviewed and its checkout was clean. How can the team close this path while continuing to test external contributions?

Accepted Answer

Run untrusted tests and credentialed releases in separate fresh VMs, destroyed after each job.

Answer

Reset the Git checkout before releases while retaining the runner's remaining filesystem.

Answer

Disable external-contributor tests and reserve the persistent runner exclusively for approved release jobs.

Answer

Mask deployment credentials in logs and expose them only during the release job.

Question 9

A password-spraying plan assumes that repeating an identical wrong password will not advance Microsoft Entra's lockout counters. The tenant uses pass-through authentication, with password validation in on-premises Active Directory. Cloud and on-premises lockout controls are both enabled. Which premise must be discarded?

Accepted Answer

Entra's recent-bad-password hash tracking will suppress the repeated failures.

Answer

Cloud lockout can block a request before the on-premises threshold is reached.

Answer

Different cloud and on-premises lockout settings can affect the observed result.

Answer

The on-premises lockout policy remains relevant to test safety.

Question 10

During an authorized cloud API test, the production 5xx error rate rises to 6% and stays there for 90 seconds. The engagement's stop rule requires immediate suspension of active probes if that rate exceeds 2% for 60 seconds, followed by notification of the named operations contact. Errors also affect endpoints the tester has not touched, so the cause is uncertain. What must the tester do immediately?

Accepted Answer

Suspend active probes and notify the operations contact.

Answer

Reduce probe concurrency and continue correlating the errors.

Answer

Complete the current scan before notifying the operations contact.

Answer

Continue probing until the test is confirmed to be the cause.

Free GCPN Practice Questions

Domain 1: AWS Authentication and Cloud Services

Question 1

Domain 2: Azure Functions and Windows Containers

Question 2

Domain 3: Cloud CLI and Application Mapping

Question 3

Domain 4: Cloud Native Applications and CI/CD Pipelines

Question 4

Domain 5: Cloud Penetration Testing Fundamentals

Question 5

Domain 6: Containers and Kubernetes Structure

Question 6

Domain 7: Discovering Cloud Services and Data

Question 7

Domain 8: Microsoft Azure Cloud Services and Attacks

Question 8

Domain 9: Password Attacks on Cloud Environments

Question 9

Domain 12: Web Application Attacks

Question 10

The rest of the GCPN blueprint

That's 10 of 1,030