312-50 Question 335
Single answer▪ Attack Shared EnvironmentsA company hires an ethical hacker to assess the risk of its public cloud deployment. During reconnaissance, the tester identifies a Linux virtual machine in a multi-tenant IaaS environment that exposes a metadata service to any local process without requiring additional authentication. The engagement rules prohibit denial-of-service, hypervisor exploitation, and attacks against other tenants. Which action would be the MOST appropriate way to demonstrate a realistic attack against this shared environment while staying within scope?
- A
Query the instance metadata service from the compromised VM to obtain temporary IAM credentials and use them only to enumerate the organization's own cloud resources
- B
Attempt a VM-escape exploit against the hypervisor to prove that neighboring tenants could be accessed from the target instance
- C
Launch a noisy cross-tenant side-channel test against co-resident VMs to measure cache timing differences and confirm multi-tenant leakage
- D
Run a packet capture on the virtual switch to collect traffic from all tenants sharing the same physical host
Show answer and explanation
Correct answer: A
Explanation
The best answer is to demonstrate abuse of the cloud instance metadata service from within the authorized VM and limit all follow-on actions to the customer's own assets. In multi-tenant cloud environments, ethical hackers must distinguish between attacking assets the customer controls and attacking the provider's shared infrastructure or other tenants. Major cloud providers document metadata services and temporary role credentials as legitimate instance features that can become attack vectors when workloads are compromised or when applications expose server-side request forgery paths. Best practice during an assessment is to use least-impact validation: obtain the temporary credentials, confirm their permissions, and enumerate only in-scope resources. By contrast, hypervisor escape attempts, cross-tenant side-channel testing, and interception of other tenants' traffic generally violate acceptable-use policies, exceed normal customer authorization, and risk impacting third parties. This question tests whether the candidate understands how to attack shared environments responsibly: focus on realistic tenant-level weaknesses such as metadata abuse, misconfigured identity roles, and overly permissive cloud permissions rather than provider-layer exploitation.
- A. Correct.
Correct. In shared cloud environments, a common and realistic attack path is abusing an exposed instance metadata service to retrieve temporary credentials assigned to the instance role. If those credentials are overprivileged, the tester can demonstrate impact by enumerating only the customer's own resources, which stays aligned with scope and avoids targeting other tenants. This reflects real-world cloud attack techniques and is an appropriate test of shared-environment risk without violating provider boundaries.
- B. Incorrect.
Incorrect. A VM escape targets the hypervisor layer and could affect the cloud provider or other tenants, which is typically out of scope in standard authorized cloud assessments unless explicitly approved by the provider and the customer. It also violates the stated engagement rules. Choosing this option reflects the misconception that the most technically severe attack is automatically the best test, even when it is prohibited and unsafe.
- C. Incorrect.
Incorrect. Cross-tenant side-channel testing in a public cloud can impact or target systems belonging to other customers and usually requires very specific authorization from the cloud provider. It is also difficult to conduct safely and reliably in a normal enterprise penetration test. This option is plausible because side channels are a known risk in shared environments, but it is not the most appropriate in this scoped engagement.
- D. Incorrect.
Incorrect. Capturing traffic from a virtual switch to observe other tenants' traffic would require access that the tenant VM normally should not have, and attempting to obtain such access would cross provider and tenant boundaries. Even if technically possible in some misconfigured environments, collecting traffic from other tenants would be outside scope and inappropriate. This distractor reflects a common misunderstanding that shared infrastructure allows broad layer-2 visibility across tenants.