CCPenX-Az 시험 - The SecOps Group실제시험문제와 답 - 31문항

Question No : 1

You are reviewing Azure Activity Logs after a lab compromise.
Which operation indicates that an attacker reset another user’s password through Microsoft Entra ID?

A.Microsoft.Authorization/roleAssignments/write
B.Update user / password profile modification
C.Microsoft.Storage/storageAccounts/listKeys/action
D.Microsoft.KeyVault/vaults/secrets/read

정답:
Explanation:
Detailed Solution:
In an Entra ID abuse path, a privileged user such as User Administrator may reset another user’s password. In logs, this appears as a user update operation involving the password profile.
Check audit logs in the portal:
Microsoft Entra ID → Monitoring → Audit logs
Or query via Microsoft Graph/Azure tooling depending on permissions.
The activity to look for is generally:
Update user
Modified property: passwordProfile
The other options represent different activities:
Microsoft.Authorization/roleAssignments/write Microsoft.KeyVault/vaults/secrets/read Correct Answer B. Update user / password profile modification

Question No : 2

During network reconnaissance of an Azure VM, you inspect its Network Security Group.
Which inbound rule creates the highest risk?

A.Allow TCP 443 from Internet
B.Allow TCP 22 from Internet
C.Deny all inbound from Internet
D.Allow TCP 1433 from private subnet only

정답:
Explanation:
Detailed Solution:
List NSG rules:
az network nsg rule list \
--resource-group rg-prod-apps-eastus \
--nsg-name nsg-prod-linux01 \
--output table
Expected risky rule:
Name Priority Direction Access Protocol Source DestinationPortRange ------------ -------- --------- ------ -------- ------------ -------------------- Allow-SSH 100 Inbound Allow Tcp Internet 22
SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.
Correct Answer B. Allow TCP 22 from Internet

Question No : 3

A virtual machine has a system-assigned managed identity .
From the VM shell, which Azure CLI command authenticates using that identity?

A.az login --service-principal
B.az login --identity
C.az account get-access-token --tenant
D.az ad signed-in-user show

정답:
Explanation:
Detailed Solution:
On an Azure VM with a system-assigned managed identity, run:
az login --identity
Then verify:
az account show
For a user-assigned managed identity, specify the client ID:
az login --identity --client-id <client-id>
Microsoft’s Azure CLI documentation confirms az login --identity for system-assigned managed identities and --client-id, --object-id, or --resource-id for user-assigned identities.
Correct Answer B. az login --identity

Question No : 4

SIMULATION
Using a discovered SAS token with read/list permissions, enumerate blobs inside the sensitive-exports container.
Which file contains credentials?

정답: service-principal-creds.json
Detailed Solution:
Set variables:
ACCOUNTCONTAINERSASList blobs:
az storage blob list \
--account-name "$ACCOUNT" \
--container-name "$CONTAINER" \
--sas-token "$SAS" \
--query "[].name" \
--output table
Expected output:
Name
----------------------------
monthly-report.csv service-principal-creds.json readme.txt
The credential file is:
service-principal-creds.json

Question No : 5

You find a SAS token in a table entity. The token starts with: ?svWhich permissions does sp

A.Read and List
B.Read and Write
C.Write and Delete
D.List and Delete

정답:
Explanation:
Detailed Solution:
In Azure Storage SAS tokens, sp means signed permissions.
For blob/container access:
r Given:
spThe permissions are:
Read + List
Correct Answer A. Read and List
SAS tokens grant delegated access to Azure Storage resources and must be handled like secrets.

Question No : 6

SIMULATION
A compromised principal has permission to list role assignments. Identify which user has the User Access Administrator role at the resource group scope.

정답: [email protected]
Detailed Solution:
Run:
az role assignment list \
--resource-group rg-prod-apps-eastus \
--all \
--output table
Or filter by role:
az role assignment list \
--resource-group rg-prod-apps-eastus \
--role "User Access Administrator" \
--query "[].{Principal: principalName, Role: roleDefinitionName, Scope: scope}" \ --output table
Expected output:
Principal Role Scope
------------------------------------- ------------------------- ----------------------------
[email protected] User Access Administrator /subscriptions/.../rg-prod-apps-eastus
Final Answer
[email protected]

Question No : 7

The compromised service principal has Contributor access to a resource group but no direct Key Vault data-plane role .
Can it immediately read Key Vault secret values?

A.Yes, Contributor includes secret read permissions
B.No, Contributor does not automatically grant Key Vault secret data-plane read
C.Yes, if the vault is in the same resource group
D.No, service principals cannot access Key Vault

정답:
Explanation:
Detailed Solution:
Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.
Test secret read:
az keyvault secret show \
--vault-name kv-finance-prod \
--name db-password \
--query value \
--output tsv
Expected failure:
Forbidden
Correct Answer B. No, Contributor does not automatically grant Key Vault secret data-plane read
Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

Question No : 8

After authenticating as the service principal, enumerate its assigned Azure RBAC role.
Which role does it have?

A.Reader
B.Contributor
C.Storage Account Contributor
D.Owner

정답:
Explanation:
Detailed Solution:
Resolve the service principal object ID:
az ad sp show \
--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \
--query id \
--output tsv
Then list role assignments:
SP_OBJECT_ID--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \
--query id \
--output tsv)
az role assignment list \
--assignee "$SP_OBJECT_ID" \
--all \
--output table
Expected output:
Principal Role Scope
------------------------------------ ----------- ----------------------------------------
<sp-object-id> Contributor /subscriptions/5d8e44ac-...
Correct Answer B. Contributor

Question No : 9

SIMULATION
Authenticate to Azure as a service principal using the credentials found in backup-config.json.

정답: Use az login --service-principal
Detailed Solution:
Command:
az login --service-principal \
-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \
-p '<client-secret>' \
--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a
Verify:
az account show --output json
Expected important field:
{
"user": {
"name": "c5fba7db-5e61-45bc-8944-3cd457bb19c2" , "type": "servicePrincipal"
}
}
This confirms you are authenticated as the App Registration/service principal.

Question No : 10

Inside the public blob container, a file named backup-config.json contains service principal credentials.
What field contains the App Registration client ID?

A.tenantId
B.clientSecret
C.clientId
D.objectId

정답:
Explanation:
Detailed Solution:
Download the blob:
az storage blob download \
--account-name prodreportstore01 \
--container-name public-backups \
--name backup-config.json \
--file backup-config.json \
--auth-mode login
Read the file:
cat backup-config.json
Expected structure:
{
"tenantId": "8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a" , "clientId": "c5fba7db-5e61-45bc-8944-3cd457bb19c2" , "clientSecret": "REDACTED"
}
The App Registration application/client ID is stored in:
clientId

Question No : 11

SIMULATION
A storage account allows public blob access. Enumerate containers and identify the public container that exposes backup files.

정답: public-backups
Detailed Solution:
Try listing containers using Azure CLI:
az storage container list \
--account-name prodreportstore01 \
--auth-mode login \
--output table
If anonymous access is allowed, test via blob endpoint:
az storage blob list \
--account-name prodreportstore01 \
--container-name public-backups \
--auth-mode key \
--output table
In a lab, you can also test the public URL pattern:
https://prodreportstore01.blob.core.windows.net/public-backups/
Expected exposed container:
public-backups
Final Answer
public-backups

Question No : 12

SIMULATION
You discover a storage account named prodreportstore01. Determine whether public blob access is enabled on the storage account.

정답: allowBlobPublicAccess: true
Detailed Solution:
Run:
az storage account show \
--name prodreportstore01 \
--resource-group rg-prod-apps-eastus \
--query "{Name: name, AllowBlobPublicAccess: allowBlobPublicAccess}" \ --output json
Expected output:
{
"Name": "prodreportstore01" , "AllowBlobPublicAccess": true
}
This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

Question No : 13

SIMULATION
A managed identity has Key Vault Secrets User access to kv-finance-prod. Enumerate secrets and retrieve the hidden flag.

정답: Flag{managed_identity_can_read_keyvault_secrets}
Detailed Solution:
List Key Vaults:
az keyvault list --output table
List secrets:
az keyvault secret list \
--vault-name kv-finance-prod \
--output table
Expected output:
Name Enabled
---------------- --------
db-password True api-token True internal-flag True
Retrieve the flag secret:
az keyvault secret show \
--vault-name kv-finance-prod \
--name internal-flag \
--query value \
--output tsv
Expected value:
Flag{managed_identity_can_read_keyvault_secrets}
Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

Question No : 14

From inside the App Service environment, request an Azure Resource Manager token using the managed identity endpoint.
Which resource value should be requested for Azure Resource Manager access?

A.https://graph.microsoft.com/
B.https://management.azure.com/
C.https://vault.azure.net/
D.https://storage.azure.com/

정답:
Explanation:
Detailed Solution:
For Azure Resource Manager API calls, the token audience/resource must be:
https://management.azure.com/
Inside App Service Kudu/console, request the token:
curl "$IDENTITY_ENDPOINT?api-versionThe response contains:
{
"access_token": "<jwt-token>" , "resource": "https://management.azure.com/" , "token_type": "Bearer"
}
Correct option: B. https://management.azure.com/

Question No : 15

Using the managed identity principal ID discovered in the previous task, identify which Azure RBAC role is assigned to it.

A.Reader
B.Storage Blob Data Reader
C.Key Vault Secrets User
D.Contributor

정답:
Explanation:
Detailed Solution:
Query role assignments for the managed identity principal:
az role assignment list \
--assignee b72a4c19-92f6-47f3-b3dd-9db5a31831d1 \ --all \
--output table
Expected output:
Principal Role Scope
------------------------------------ ---------------------- ----------------------------------------------
b72a4c19-92f6-47f3-b3dd-9db5a31831d1 Key Vault Secrets User /subscriptions/.../resourceGroups/rg-prod-apps-eastus
The assigned role is:
Key Vault Secrets User
Azure RBAC role assignments can be granted to users, groups, service principals, and managed identities.

The SecOps Group CCPenX-Az 시험