Free Preparation Discussions
MENU
The SecOps Group CCPenX-Az Exam - Topic 3 Question 6 Discussion
Topic #: 3
Using the previously gained access to the Azure environment, extract an access token from the Web App's environment and use it to impersonate its Managed Identity. Which of the following roles is assigned to the Web App's Security Principal?
Detailed Solution:
First identify the managed identity attached to the Web App.
az webapp identity show
--name RnD-Tools
--resource-group Excalibur-Resources
--output json
You should see a user-assigned managed identity similar to:
{
'userAssignedIdentities': {
'/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity': {
'clientId': 'cf3664d4-5cec-4feb-b0ef-88b7958809df',
'principalId': 'efe89e83-010f-42f6-9576-30531fa47af7'
}
}
}
Now query the role assignments for the managed identity's principal ID:
az role assignment list
--assignee efe89e83-010f-42f6-9576-30531fa47af7
--all
--output table
The returned custom role is:
AppService-Auditor
That makes option D correct.
Final Answer:
Currently there are no comments in this discussion, be the first to comment!