Exam ECSAv10 topic 1 question 25 discussion

Actual exam question from ECCouncil's ECSAv10

Question #: 25
Topic #: 1

SecGlobal Corporation hired Michael, a penetration tester. Management asked Michael to perform cloud penetration testing on the company's cloud infrastructure.
As a part of his task, he started checking all the agreements with cloud service provider and came to a conclusion that it is not possible to perform penetration testing on the cloud services that are being used by the organization due to the level of responsibilities between company and the Cloud Service Provider (CSP).
Identify the type of cloud service deployed by the organization?

A. Platform as a service (PaaS)
B. Software as a service (SaaS)
C. Anything as a service (XaaS)
D. Infrastructure as a service (IaaS)

Show Suggested Answer

Suggested Answer: D 🗳️

by ccie_cbap at Jan. 7, 2022, 3:15 p.m.

Comments

Submit Cancel

boohoo

2 years, 11 months ago

Basically, anything from the virtual machine and below is off limit - for example https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement?rtc=1. Then, the remaining layers (bottom to top) are OS, apps, data, IAM. It only makes sense to do a cloud pen test if provider owns some of the layers and you own the others as in the case of SaaS (provider owns OS & apps) or PaaS (provider owns OS). In the case of IaaS, you own OS, apps, data, IAM and you can't test the other layers that provider owns then launching a cloud pen-test campaign does not make sense and not economical since you can totally set up a clone of OS, apps, data, IAM on prem and pen test the heck out of it.

upvoted 1 times

...

ccie_cbap

3 years, 6 months ago

can anyone validate answer.. shouldn't it be b

upvoted 2 times

...