An attacker discovers that a user account has been granted the 'Owner' role on a resource group. Which ARM management-plane action can this attacker perform without needing additional permissions?

Read secrets from an Azure Key Vault in the same resource group

Modify data inside an Azure Storage account in the resource group

Delete the entire resource group and all resources within it

Access the operating system of a virtual machine in the resource group

A penetration tester has write access to a GitHub repository that is used as a source for an Azure DevOps build pipeline. The pipeline uses a service connection to deploy artifacts to an Azure subscription. What is the most effective way to compromise the deployment process?

Access the Azure DevOps service connection's secret directly from the GitHub repository

Create a new branch and submit a pull request to trigger the pipeline with malicious code

Modify the pipeline YAML to add a malicious task that runs after the build and uses the service connection to deploy a backdoored artifact

Use the GitHub repository's webhooks to inject malicious code into the build agent

GIAC Cloud Penetration Tester

Domain 3Objective 2

Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 5)

Part of the Cloud Platform Attacks domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

Questions 21–25

21foundation · easy
An attacker discovers that a user account has been granted the 'Owner' role on a resource group. Which ARM management-plane action can this attacker perform without needing additional permissions?
Select an answer first
22foundation · easy
In the Azure Resource Manager (ARM) model, which component is the top-level container that holds all resources and is used to manage access, policies, and compliance across an entire organization?
Select an answer first
23foundation · easy
Which Azure service provides a centralized log management and querying solution that is often used for security monitoring and incident response, and can be targeted by attackers to delete or alter logs?
Select an answer first
24application · medium
A penetration tester has write access to a GitHub repository that is used as a source for an Azure DevOps build pipeline. The pipeline uses a service connection to deploy artifacts to an Azure subscription. What is the most effective way to compromise the deployment process?
Select an answer first
25foundation · easy
Which Azure Storage service is specifically designed for storing and retrieving large amounts of unstructured data, such as images, videos, and documents, and is often targeted due to misconfigured public access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 5)

Questions 21–25

An attacker discovers that a user account has been granted the 'Owner' role on a resource group. Which ARM management-plane action can this attacker perform without needing additional permissions?

In the Azure Resource Manager (ARM) model, which component is the top-level container that holds all resources and is used to manage access, policies, and compliance across an entire organization?

Which Azure service provides a centralized log management and querying solution that is often used for security monitoring and incident response, and can be targeted by attackers to delete or alter logs?

A penetration tester has write access to a GitHub repository that is used as a source for an Azure DevOps build pipeline. The pipeline uses a service connection to deploy artifacts to an Azure subscription. What is the most effective way to compromise the deployment process?

Which Azure Storage service is specifically designed for storing and retrieving large amounts of unstructured data, such as images, videos, and documents, and is often targeted due to misconfigured public access?

Keep studying — Cloud Platform Attacks