The SecOps Group Certified Cloud Pentesting eXpert - Azure CCPenX-Az Exam Questions

Answer : A

Detailed Solution:

In Azure Storage SAS tokens, sp means signed permissions.

For blob/container access:

r = read l = list w = write d = delete c = create a = add

Given:

sp=rl

The permissions are:

Read + List

Correct answer:

Answer : A

Detailed Solution:

Use the app registration credentials recovered from blob storage.

az login --service-principal \

-u '<client-id>' \

-p '<client-secret>' \

--tenant f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Confirm that you are authenticated as a service principal:

az account show

Now enumerate role assignments for the app registration.

az role assignment list \

--assignee '<client-id>' \

--all \

--output table

If the --assignee lookup fails, first resolve the service principal object ID:

az ad sp show \

--id '<client-id>' \

--query id \

--output tsv

Then query role assignments by object ID:

SP_OBJECT_ID=$(az ad sp show --id '<client-id>' --query id -o tsv)

az role assignment list \

--assignee '$SP_OBJECT_ID' \

--all \

--output table

The assigned role is:

Key Vault Secrets User

This role allows the principal to read secret values from Azure Key Vault. That is the lateral movement path into the final flag.

Final Answer:

A . Key Vault Secrets User

================

Answer : B

Detailed Solution:

On an Azure VM with a system-assigned managed identity, run:

az login --identity

Then verify:

az account show

For a user-assigned managed identity, specify the client ID:

az login --identity --client-id <client-id>

Microsoft's Azure CLI documentation confirms az login --identity for system-assigned managed identities and --client-id, --object-id, or --resource-id for user-assigned identities.

Correct answer:

Answer : B

Detailed Solution:

List NSG rules:

az network nsg rule list \ --resource-group rg-prod-apps-eastus \ --nsg-name nsg-prod-linux01 \ --output table

Expected risky rule:

Name Priority Direction Access Protocol Source DestinationPortRange ------------ -------- --------- ------ -------- ------------ -------------------- Allow-SSH 100 Inbound Allow Tcp Internet 22

SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.

Correct answer:

Answer : A

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query '{Name:name,AllowBlobPublicAccess:allowBlobPublicAccess}' \

--output json

Expected output:

{

'Name': 'prodreportstore01',

'AllowBlobPublicAccess': true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================

Answer : B

Detailed Solution:

For Azure Resource Manager API calls, the token audience/resource must be:

https://management.azure.com/

Inside App Service Kudu/console, request the token:

curl '$IDENTITY_ENDPOINT?api-version=2019-08-01&resource=https://management.azure.com/' \ -H 'X-IDENTITY-HEADER: $IDENTITY_HEADER'

The response contains:

{ 'access_token': '<jwt-token>', 'resource': 'https://management.azure.com/', 'token_type': 'Bearer' }

Correct option:

Answer : A

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

https://prodreportstore01.blob.core.windows.net/public-backups/

Expected exposed container:

public-backups

Final answer:

public-backups

================