Azure Functions and Windows Containers GCPN Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An Azure Function app is configured with an Event Grid trigger. The function processes events from a custom topic. The security team is concerned about an attacker publishing malicious events to the topic. Which control would most effectively prevent unauthorized event publishing?

   • AUse a shared access signature (SAS) token for the topic and include it in the function's code.
   • BUse managed identity authentication for the Event Grid topic and assign only necessary publishers the 'EventGrid Data Sender' role.
   • CDisable the Event Grid trigger and use a manual invocation instead.
   • DAdd input validation in the function to filter out malicious events.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a unique characteristic of the Azure Functions execution environment that a penetration tester should consider when assessing the attack surface?

   • AFunctions have no network access to other Azure services
   • BFunctions can only be triggered by HTTP requests
   • CFunctions always run on dedicated VMs that the customer must patch
   • DFunctions run in a managed, serverless environment where the underlying host OS is patched by Microsoft
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team is reviewing a Windows container running on an AKS node. The container runs as a non-admin user but has the SeDebugPrivilege enabled. The container shares the host's process namespace. Which statement best describes the security risk?

   • AThe non-admin user prevents any privilege escalation, so the risk is limited to the container itself.
   • BThe container is isolated by Windows sandboxing, so host processes are not visible.
   • CThe SeDebugPrivilege could allow the container process to inject code into host processes because the process namespace is shared.
   • DThe risk is only to other containers, not the host, because Windows containers use Hyper-V isolation.
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   A penetration tester is attempting to escape a Windows container running on AKS. The container is running with process isolation and has a non-admin user. The tester discovers that the container has the 'SeDebugPrivilege' enabled and the host's process namespace is shared. Which sequence of actions would most likely lead to successful host compromise?

   • AExploit a kernel vulnerability to directly execute code on the host.
   • BUse the container's service account token to create a privileged pod on the same node.
   • CUse SeDebugPrivilege to inject code into a host process, then use that process to write a file to the host's filesystem.
   • DAttempt to mount the host's C:\ drive using the container's privileges.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A developer creates an Azure Function with an HTTP trigger that uses a third-party NuGet package. The package is known to have a remote code execution vulnerability. The function runs on a Consumption plan. Which action would most effectively mitigate the risk while maintaining functionality?

   • ADisable the HTTP trigger and use a timer trigger instead.
   • BMove the function to an App Service plan to use a more secure sandbox.
   • CAdd input validation to the HTTP trigger to block malicious payloads.
   • DUpdate the NuGet package to a patched version and redeploy the function.
   Reveal Solution Discussion Select an answer first