What is a key consideration when conducting pen testing from the cloud?

• A. You must follow the provider's terms of service; inbound IP allowances may apply
• B. You must not use any inbound IPs from the CSP
• C. Inbound IPs are always banned
• D. The cloud environment hides all traffic from logging

Answer: (A)

When testing from the cloud, the key factor is staying within the provider’s rules and testing scope. Cloud vendors typically require explicit permission and specify how traffic can originate from the test, which often means inbound IPs must be whitelisted or drawn from allowed ranges. This prevents your activity from being mistaken for abuse, ensures you’re operating within the agreed-upon boundaries, and helps avoid triggering protections that could block the test or affect other tenants. In practice, you’ll need to coordinate with the provider, confirm the permitted IPs or ranges, and document the scope and timing of the test. Inbound IP allowances aren’t universally forbidden; they’re a controlled mechanism to enable legitimate testing. The cloud environment does not inherently hide traffic from logging, so ensure logging is enabled and evidence is preserved as part of the engagement.