Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester has compromised an Azure AD user account that has 'Key Vault Contributor' role on a specific Key Vault. The Key Vault's access policy grants the user 'Get', 'List', and 'Set' permissions on secrets. What is the most significant risk to the organization?

   • AThe tester can delete the Key Vault and all its contents
   • BThe tester can modify the Key Vault's access policy to grant themselves 'Delete' permissions
   • CThe tester can export the Key Vault's HSM keys to their own machine
   • DThe tester can retrieve all secrets stored in the Key Vault and use them to access other systems
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester has obtained valid credentials for a standard Azure AD user account through a phishing campaign. The user has no administrative roles, but the tester discovers the account has the 'Global Reader' role. During enumeration, the tester finds a custom RBAC role assignment at the subscription scope that grants the 'Microsoft.Authorization/roleAssignments/write' permission to a service principal owned by the same user. What is the most likely privilege escalation path the tester should pursue?

   • ACreate a new role assignment granting the user's service principal 'Owner' at the subscription scope
   • BModify the custom role definition to include 'Microsoft.Authorization/roleAssignments/delete' and then remove all other admins
   • CUse the Global Reader role to read all secrets from Azure Key Vault and extract credentials
   • DExploit the Global Reader role to access the Azure AD tenant's global admin password hash
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester is assessing a client's Azure environment. The tester discovers that a user account with the 'Global Administrator' role has a weak password and no multi-factor authentication (MFA). The tester successfully password-sprays this account and signs in. Which of the following actions would be the MOST effective way to maintain persistent access while minimizing the chance of immediate detection?

   • ARegister a new application in Azure AD and grant it the 'User.Read.All' permission, then use the application's client credentials to read user profiles.
   • BCreate a new user account and assign it the 'Security Administrator' role, then use that account for future administrative actions.
   • CCreate a new service principal and assign it the 'Global Administrator' role, then use its credentials for future access.
   • DAdd the user account to the 'Conditional Access' policy exclusion list to bypass MFA requirements for that account.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester has compromised an Azure AD account with 'Security Administrator' rights. The tester wants to avoid detection by security monitoring. Which of the following actions is the MOST effective way to evade detection?

   • ADisable the Azure AD audit log collection for the tenant.
   • BModify the diagnostic settings of the Log Analytics workspace to stop exporting activity logs to the SIEM.
   • CCreate a new conditional access policy that excludes the compromised account from MFA and sign-in risk policies.
   • DUse the 'Azure AD Connect' tool to synchronize a new user account and then use that account for malicious activities.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is assessing an Azure DevOps pipeline that deploys to a production environment. The pipeline uses a variable group that references a secret from Azure Key Vault. The tester has 'Contributor' rights on the Azure DevOps project. Which of the following is the MOST effective way to exfiltrate the secret without triggering immediate alerts?

   • AUse the Azure DevOps REST API to directly retrieve the secret from the variable group.
   • BModify the variable group to change the secret's value to a known value, then use that value to access the Key Vault.
   • CModify the pipeline to add a task that outputs the secret to the build log, then access the logs.
   • DCreate a new pipeline that uses the same variable group and runs a script to write the secret to an external endpoint.
   Reveal Solution Discussion Select an answer first