GIAC GCPN Cloud Penetration Tester Practice Test
Gana confianza para GIAC GCPN Cloud Penetration Tester. Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
The GIAC Cloud Penetration Tester (GCPN) certification is a premier, vendor-neutral credential that validates a professional's ability to conduct authorized, ethical penetration testing and security assessments of cloud environments. Administered by the Global Information Assurance Certification (GIAC) and developed in conjunction with the SANS Institute, the GCPN focuses on offensive security methodologies specific to cloud infrastructure, platforms, and services. It rigorously assesses a candidate's practical skills in identifying, exploiting, and documenting vulnerabilities across major cloud service providers (CSPs) like AWS, Azure, and Google Cloud Platform. The certification bridges the critical gap between traditional network penetration testing and the unique architectural, identity, and service models of modern cloud deployments. Earning the GCPN demonstrates proven, hands-on competency in cloud attack vectors, post-exploitation techniques, and the legal frameworks governing cloud security assessments, positioning holders as experts in securing the modern enterprise attack surface.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
An authorized engagement reveals a cross-account role assumption setup: account A (the client, in scope) has a role "AnalyticsRole" with trust policy allowing arn:aws:iam::222233334444:root (vendor account, OUT of scope per RoE). Through the vendor relationship the client uploads CSVs to vendor-owned buckets. Mid-test, you obtain credentials in account A that allow you to call iam:UpdateAssumeRolePolicy on AnalyticsRole. What is the correct authorized-engagement action?
An authorized AWS pentest scope letter specifies "all resources within AWS account 111122223333". Mid-test, you discover this account is the management account of an AWS Organizations tree with 14 member accounts. The client did not list the member accounts. What is the correct interpretation of scope?
Your authorized GCP penetration test scope letter names a specific GCP project ID "client-prod-7a2b". During recon, you find this project is a child of a Folder containing two other projects with similar names. Which boundary control should govern your testing decision?
Your engagement uncovered an exposed AWS access key with AdministratorAccess privileges. Per NIST SP 800-115 reporting guidance and standard pentest ethics, what should the IMMEDIATE post-discovery action be (before formal report delivery)?
Which document defines the formal authorization, scope boundaries, allowed techniques, escalation contacts, and stop conditions for an authorized cloud penetration test?
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.