A penetration tester has compromised an Azure AD account with 'Security Reader' role. The tester wants to disable a specific Azure Monitor alert rule without being detected. Which of the following is the MOST effective approach?

Use the Azure REST API to update the alert rule's condition to a non-matching query, so it never triggers.

Modify the diagnostic settings of the resource to stop sending logs to the Log Analytics workspace that the alert uses.

Send a crafted request to the Azure Monitor API to suppress the alert without changing the rule.

Use a separate compromised account with 'Monitoring Contributor' role to disable the alert rule, then revert the change after the attack.

Which Azure AD attack technique involves trying a small set of common passwords against many user accounts to avoid account lockout?

Privilege escalation via role assignments

Which Azure VM feature is commonly abused by attackers to execute arbitrary scripts or commands on a VM after compromising the management plane?

Instance metadata service (IMDS)

A penetration tester has obtained a kubeconfig file from a developer's workstation that has 'cluster-admin' privileges on an AKS cluster. The cluster uses Azure AD integration for authentication. What is the most significant risk if the kubeconfig file is compromised?

The attacker can access the Azure AD tenant and reset passwords for all users

The attacker can create new pods with hostPath mounts to access the underlying node's filesystem

The attacker can modify the AKS cluster's network security group to allow external access

The attacker can access the Azure Key Vault directly using the kubeconfig's embedded credentials

A security auditor discovers that an Azure Storage account has a blob container with 'Container' level anonymous read access. The container holds backup files that include configuration scripts with embedded credentials. The company's compliance policy requires that storage accounts be private by default. What is the most appropriate remediation action?

Set the container's public access level to 'Private' and rotate all credentials found in the exposed files

Enable Azure Defender for Storage to alert on future anonymous access

Delete the container and recreate it with a new name

Generate a new storage account key and update the connection strings in the configuration scripts

GIAC Cloud Penetration Tester

Domain 3Objective 2

Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 3)

Part of the Cloud Platform Attacks domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

Questions 11–15

11expert · hard
A penetration tester has compromised an Azure AD account with 'Security Reader' role. The tester wants to disable a specific Azure Monitor alert rule without being detected. Which of the following is the MOST effective approach?
Select an answer first
12foundation · easy
Which Azure AD attack technique involves trying a small set of common passwords against many user accounts to avoid account lockout?
Select an answer first
13foundation · easy
Which Azure VM feature is commonly abused by attackers to execute arbitrary scripts or commands on a VM after compromising the management plane?
Select an answer first
14application · medium
A penetration tester has obtained a kubeconfig file from a developer's workstation that has 'cluster-admin' privileges on an AKS cluster. The cluster uses Azure AD integration for authentication. What is the most significant risk if the kubeconfig file is compromised?
Select an answer first
15application · medium
A security auditor discovers that an Azure Storage account has a blob container with 'Container' level anonymous read access. The container holds backup files that include configuration scripts with embedded credentials. The company's compliance policy requires that storage accounts be private by default. What is the most appropriate remediation action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.