312-50 Question 443
Single answer▪ Cloud Computing ThreatsA company hosts a customer-facing web application in a public cloud environment. During a security assessment, an ethical hacker discovers that one virtual machine can query the cloud instance metadata service and retrieve temporary credentials associated with the VM's attached role. Those credentials allow listing objects in a storage bucket that contains sensitive customer exports. The application itself was vulnerable to server-side request forgery (SSRF), which made the metadata query possible. Which mitigation would MOST directly reduce the risk of this cloud-specific attack path while preserving the application's need to access cloud resources?
- A
Require the use of the cloud provider's hardened metadata service configuration that blocks unauthenticated metadata retrieval from simple HTTP requests, and limit the instance role to only the required storage actions
- B
Move the application from a public cloud virtual machine to an on-premises server so the metadata service is no longer exposed
- C
Disable TLS on the application temporarily to inspect outbound requests and identify SSRF payloads more easily
- D
Assign the virtual machine a broader administrative role so that access attempts can be logged centrally across more services
Show answer and explanation
Correct answer: A
Explanation
This scenario reflects a well-known cloud computing threat: SSRF used to access an instance metadata service and steal temporary credentials. In cloud platforms, workloads often receive short-lived credentials through metadata endpoints so they can access storage, databases, or other managed services without embedded secrets. If an attacker can induce the application to make requests to the metadata endpoint, they may obtain those credentials and pivot into cloud resources.
The best mitigation is defense in depth: first, harden metadata access so simple unauthenticated HTTP retrieval is not possible from exploitable application paths; second, enforce least-privilege IAM so any exposed credentials have minimal value. This mirrors best practices from major cloud providers, such as securing instance metadata services and tightly scoping attached roles. Additional controls like fixing the SSRF vulnerability, applying network egress restrictions where feasible, and monitoring cloud API calls are also important, but the option given in choice 1 most directly addresses the cloud-specific attack path described.
- A. Correct.
Correct. This answer addresses the actual cloud threat chain: SSRF was used to reach the instance metadata service and obtain temporary credentials. Requiring the provider's more secure metadata access mechanism, such as a hardened metadata service mode that resists trivial SSRF-based retrieval, directly reduces exposure. Combining that with least-privilege IAM for the instance role limits the impact even if credentials are exposed. This is aligned with major cloud-provider guidance on securing instance metadata access and minimizing role permissions.
- B. Incorrect.
Incorrect. Moving workloads on-premises may remove this specific cloud metadata path, but it is not the most direct or practical mitigation for the identified attack path. CEH-style questions typically favor targeted controls over disruptive architectural changes. Also, SSRF can still be dangerous in non-cloud environments; the root issue is not simply that the application runs in the cloud.
- C. Incorrect.
Incorrect. Disabling TLS would weaken security and does not mitigate SSRF-to-metadata attacks. Outbound request inspection can be useful in some contexts, but turning off transport encryption is not an accepted best practice and would expose other risks, including interception of sensitive traffic.
- D. Incorrect.
Incorrect. Granting broader administrative permissions violates least privilege and would make the compromise significantly worse. Although broader roles may produce more events in logs, they also increase the blast radius if credentials are stolen. The correct security approach is to reduce privileges, not expand them.