Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A penetration tester has discovered that an Azure Storage account has a shared access signature (SAS) token that grants 'read' and 'write' permissions on a blob container. The SAS token was created with a start time of one hour ago and an expiry time of one year from now. The tester wants to use this SAS token to access the storage account. What is the most significant limitation of this SAS token?

   • AThe SAS token will expire after one year, so the tester has limited time to use it
   • BThe SAS token is only valid for the blob container, not the entire storage account
   • CThe SAS token can only be used with the storage account key that was used to create it
   • DThe SAS token can only be used from the IP address that was specified when it was created
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which Azure DevOps component is the actual machine (virtual or physical) that executes the jobs defined in a pipeline, and can be targeted by attackers to inject malicious code into the build process?

   • AService connection
   • BRelease pipeline
   • CPipeline definition
   • DBuild agent
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Azure Key Vault component defines which users or applications can perform specific operations on secrets, keys, and certificates?

   • AFirewall rules
   • BSoft delete
   • CManaged identity
   • DAccess policies
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an Azure penetration test, you compromise a service principal that has the 'Key Vault Contributor' role on a specific key vault. Which of the following actions can you perform to retrieve secrets from that key vault?

   • AUse the Azure REST API to call the 'Get Secret' operation without any additional permissions.
   • BDirectly read the secrets because the 'Key Vault Contributor' role includes read access to secrets.
   • CGrant yourself the 'Key Vault Secrets Officer' role on the vault, then read the secrets.
   • DExport the vault's access policies to a file and then import them to a new vault you control.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A penetration tester is assessing an Azure environment where a VM is behind an Azure Load Balancer. The load balancer has a backend pool of two VMs, and the health probe is set to TCP port 3389. The tester discovers that one of the VMs has a misconfigured NSG that allows inbound RDP from the internet. Which of the following is the MOST likely attack vector?

   • AExploit the load balancer to redirect traffic to the misconfigured VM and bypass the NSG.
   • BUse the load balancer's frontend IP to access the Azure Instance Metadata Service (IMDS) from the internet.
   • CUse the health probe to send malicious packets to the VM and gain code execution.
   • DDirectly access the VM's public IP (if it has one) or use the load balancer's frontend IP to reach the VM via RDP.
   Reveal Solution Discussion Select an answer first