Azure Functions and Windows Containers GCPN Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An AKS cluster runs Windows containers. A pod is configured with a service account that has permissions to create pods in the cluster. An attacker who compromises the container obtains the service account token. Which attack is the attacker most likely to perform?

   • ACreate a new privileged pod that mounts the host's filesystem and uses it to access the node.
   • BUse the token to authenticate to the Azure API and modify AKS cluster settings.
   • CUse the token to access the container registry and pull private images.
   • DDecode the token to extract the service account's private key.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common attack vector against Azure Kubernetes Service (AKS) when running Windows containers?

   • AChanging the container's IP address to match the API server
   • BDeleting the AKS node's operating system files
   • CUsing the Windows container's built-in firewall to block the host
   • DExploiting a misconfigured Kubernetes RBAC to gain unauthorized access to the cluster
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's Azure Function app uses a timer trigger to run a data-processing job every hour. The function code includes a hardcoded connection string to a SQL database. During a code review, the connection string is found in the function's source code repository. Which remediation is most effective?

   • AMove the function to an App Service plan to use a more secure execution environment.
   • BUse environment variables in the function app's configuration to store the connection string.
   • CRotate the SQL database password and update the connection string in the code.
   • DMove the connection string to Azure Key Vault and reference it using a managed identity.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An Azure Function uses an HTTP trigger with authorization level 'anonymous'. What is the primary security risk of this configuration?

   • AThe function will be automatically deleted after a period of inactivity
   • BAnyone who can reach the endpoint can invoke the function without authentication
   • CThe function will require a managed identity to be invoked
   • DThe function will be exposed only to the same virtual network
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is assessing an Azure Function that uses a queue trigger. The function deserializes a JSON message and passes a property directly to a PowerShell script invoked with Invoke-Expression. The function's managed identity has access to a Key Vault. Which technique would be most effective for the tester to demonstrate full impact of the vulnerability?

   • AModify the queue message to include a different queue name to redirect processing.
   • BReplace the JSON property with a URL to trigger an SSRF to the Key Vault's management endpoint.
   • CSend a large number of messages to the queue to cause denial of service on the function app.
   • DInject a malicious payload into the JSON property to execute arbitrary PowerShell commands that read the Key Vault secret using the managed identity.
   Reveal Solution Discussion Select an answer first