Azure Functions and Windows Containers GCPN Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer creates an Azure Function with an HTTP trigger that uses a third-party library to parse XML. The library is known to have a vulnerability that allows XXE (XML External Entity) attacks. The function is publicly accessible. What is the most effective way to mitigate this risk?

   • AAdd a network security group (NSG) to restrict access to the function's IP address.
   • BUse a different trigger type, such as a queue trigger, to avoid direct exposure.
   • CUpdate the library to a patched version that disables external entity processing by default.
   • DValidate the XML input to reject any DOCTYPE declarations.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer deploys an Azure Function with an HTTP trigger that accepts a URL parameter and fetches that URL using an HttpClient. The function runs under a system-assigned managed identity. During a security review, you notice the function does not validate the URL and the managed identity has Contributor rights on a storage account containing sensitive data. Which combination of issues is the most immediate security concern?

   • AThe function is vulnerable to SSRF, and the managed identity's excessive permissions could be abused to access the storage account.
   • BThe function uses a system-assigned managed identity, which is less secure than a user-assigned identity.
   • CThe HttpClient is not disposed properly, leading to socket exhaustion and denial of service.
   • DThe function's HTTP trigger is publicly accessible, which allows anyone to invoke it and consume resources.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common vulnerability in Azure Functions that arises from using outdated or malicious open-source packages?

   • AManaged identity abuse
   • BInsecure code
   • CMisconfigured triggers
   • DDependency risks
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which component of an Azure Functions app is responsible for connecting the function to external services such as Azure Storage queues or HTTP endpoints?

   • AHost configuration
   • BFunction keys
   • CBindings
   • DTriggers
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which misconfiguration could allow a process inside a Windows container to gain elevated privileges on the host?

   • ASetting a memory limit
   • BUsing a read-only file system
   • CRunning the container with the '--privileged' flag (or equivalent)
   • DUsing a non-root user
   Reveal Solution Discussion Select an answer first