A company uses a cloud provider with shared network bandwidth to host a web application on dedicated servers. The company's contact with the cloud provider prevents any activities that would…

Crawling a web application's URLs for vulnerabilities, while resource-intensive, is typically focused on the target application's logic and content, not designed to saturate shared network bandwidth or disrupt underlying cloud infrastructure.

Fingerprinting IP addresses of the application's servers involves passive or active reconnaissance to identify system types and services, which usually has a minimal impact on shared network resources and is unlikely to affect other cloud customers.

Brute forcing application passwords targets the authentication mechanism of the specific web application and, while generating requests, is generally at a much lower volume and intensity than a DDoS test, thus less likely to overwhelm shared network infrastructure.

Sending many web requests per second to test DDoS protection is a form of load or stress testing that can consume significant network bandwidth and server resources. In a shared cloud environment, this activity is highly likely to interfere with the performance and availability of services for other cloud provider customers, directly violating the company's contract.