Certified Ethical Hacker (CEH) Practice Question

The AWS Instance Metadata Service version 2 (IMDSv2) requires every caller to obtain and present a session-oriented token retrieved with an HTTP PUT request; the token is valid only from the instance itself and can be further constrained with a hop limit of 1. Disabling IMDSv1 or enforcing IMDSv2 therefore prevents external SSRF payloads from directly querying the metadata endpoint. Merely removing public IPs, enabling AWS Shield Advanced, or denying specific S3 actions does not stop an attacker who has already induced the backend to make internal HTTP calls on their behalf, so those options do not mitigate this vector.