312-50 Question 434
Single answer▪ Cloud Computing ConceptsDuring an authorized assessment of a company's cloud-hosted web application, you discover that an Amazon S3 bucket used to store application backups is publicly accessible. The bucket contains old database exports with customer information. The client asks which issue most directly explains the exposure from a cloud computing perspective and should be prioritized in remediation.
- A
A vulnerability in the hypervisor allowed cross-tenant data leakage from another customer's virtual machine
- B
A cloud storage misconfiguration exposed data because the bucket permissions or policy allowed unintended public access
- C
A failure of the cloud provider's physical data center security allowed attackers to remove backup drives
- D
A weak TLS cipher suite on the web application's login page caused the S3 bucket to become publicly readable
Show answer and explanation
Correct answer: B
Explanation
This scenario tests understanding of cloud computing concepts, especially the shared responsibility model and common cloud storage exposure patterns. In AWS, Amazon S3 buckets can become exposed through misconfigured bucket policies, ACLs, access points, or by failing to enforce S3 Block Public Access. For ethical hackers, identifying whether a finding is caused by customer-side misconfiguration versus provider-side failure is critical when reporting risk and recommending remediation. The most direct explanation is cloud storage misconfiguration, not a hypervisor issue, physical intrusion, or TLS weakness. Relevant best-practice references include AWS documentation on S3 security, S3 Block Public Access, IAM least privilege, and cloud shared responsibility guidance.
- A. Incorrect.
Incorrect. Hypervisor escape or cross-tenant leakage is a cloud-related risk, but it does not match the scenario. The data was found in a publicly accessible S3 bucket, which points to access control or bucket policy misconfiguration rather than virtualization-layer compromise.
- B. Correct.
Correct. Publicly accessible object storage is a classic cloud misconfiguration issue. In AWS S3, exposure commonly results from overly permissive bucket policies, ACLs, or disabled Block Public Access settings. From a CEH perspective, this is a practical cloud security finding tied to the shared responsibility model: the customer is generally responsible for securely configuring access to their cloud resources.
- C. Incorrect.
Incorrect. Physical security failures are part of the provider's responsibility in most IaaS and storage services, but the scenario specifically indicates logical public accessibility over the cloud service, not theft of hardware or media from a data center.
- D. Incorrect.
Incorrect. Weak TLS settings on the application's login page would affect transport security for that page, not object storage authorization. Even if TLS were poorly configured, it would not by itself make an S3 bucket publicly readable. This distractor reflects a common mistake of confusing network encryption issues with cloud access-control configuration errors.