Azure Functions and Windows Containers GCPN Practice Questions (Page 8)

Questions 36–37

1. 36foundation · easy

   An Azure Function has a managed identity assigned with permissions to read secrets from Azure Key Vault. How could an attacker abuse this to escalate privileges?

   • ABy using the function's public IP address to directly access Key Vault
   • BBy exploiting a vulnerability in the function to obtain the managed identity token and then using it to access Key Vault
   • CBy using the function's connection string to connect to Key Vault
   • DBy sending a crafted HTTP request to the function's endpoint to change its permissions
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An Azure Function with an HTTP trigger is behind Azure API Management (APIM). The function uses a system-assigned managed identity to access a storage account. A penetration tester wants to test for SSRF by sending a request to the function with a URL parameter. The function fetches the URL and returns the response. Which control would most effectively prevent the tester from accessing internal resources?

   • AConfigure a network security group on the function's subnet to block outbound traffic to private IP ranges.
   • BDisable the function's managed identity to reduce the impact of SSRF.
   • CUse APIM policies to validate the URL parameter and block requests to internal IP addresses.
   • DModify the function code to validate the URL and reject requests to private IP addresses or non-HTTP schemes.
   Reveal Solution Discussion Select an answer first