I85PREP
⌘ K
CAP-PC ENS study materials
CAP-PC ENS study resources

CAP-PC ENS: Cloud Security Assessment

CAP-PC ENS · Work through your exam, one topic at a time.

All guide sections

Cloud Security Assessment

What this domain tests

Cloud Security Assessment asks you to compute effective permissions and real reachability from configuration, then produce evidence. Typical targets are identity policy evaluation, storage exposure, network paths and audit coverage across AWS, Azure and GCP.

Policy evaluation rules

  • Explicit deny always wins. Permission boundaries and service control policies cap permissions but never grant them.
  • Same-account resource access can be granted by either an identity policy or a resource policy; cross-account access needs an allow on both sides plus a matching trust policy for role assumption.
  • A role has two separate documents: the trust policy decides who may assume it, the permission policy decides what it can do. Findings often live in the trust policy alone.
  • Storage exposure is a policy question, not an ACL question. Check account-level and bucket-level public access blocks, blob anonymous access settings, and GCP allUsers or allAuthenticatedUsers bindings inherited from organisation or folder level.

Worked example

A bucket has no public ACL and the ACL public access block is enabled, so it reads as private. The bucket policy contains:

Effect: Allow, Principal: "*", Action: s3:GetObject,
Resource: arn:aws:s3:::reports/*,
Condition: StringLike aws:Referer = https://portal.example.com/*

No public ACL exists, yet the resource policy grants every principal read access, and aws:Referer is a header the client sets freely. The bucket is effectively public for that prefix. Evidence should quote the statement, name the client-controlled condition key, and offer remediation: drop the wildcard principal, serve through CloudFront with origin access control, or grant a specific role, and enable account-level blocking of public policies.

Traps that cost marks

  • Equating public subnet with internet-reachable; a route to an internet gateway and a public address are also required.
  • Mixing security groups and network ACLs: ACLs are stateless and evaluated first, security groups are stateful and have no deny rule.
  • Assuming CloudTrail records object-level reads; data events are off by default and only management events are captured.
  • Forgetting that a presigned URL is delegated public access for its lifetime.
  • Ignoring instance metadata settings: IMDSv2 token requirement and hop limit determine SSRF impact.