Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An Azure Function app is configured with an anonymous HTTP trigger. The function processes sensitive data and uses a managed identity to access a storage account. A penetration tester discovers that the function's code contains a SQL injection vulnerability in a query parameter. What is the most significant risk associated with this vulnerability?

   • AThe tester can modify the function's application settings to disable authentication
   • BThe tester can execute arbitrary code in the function's execution context and use the managed identity to access the storage account
   • CThe tester can read the function's source code from the Azure portal
   • DThe tester can access the function's deployment credentials stored in the function's environment variables
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which Azure App Service feature allows you to create separate environments for different stages of your application, such as development, staging, and production, and can be a target for attackers if misconfigured?

   • AApplication settings
   • BApp Service plan
   • CDeployment slots
   • DAuthentication/Authorization
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security auditor discovers that an Azure Storage account has a container with the access level set to 'Container (anonymous read access for containers and blobs)'. The container holds a backup file that contains connection strings to other resources. Which of the following is the MOST likely immediate risk?

   • AAn attacker can modify or delete the blobs in the container because anonymous access allows write operations.
   • BAn attacker can escalate privileges to the subscription level by exploiting the anonymous access.
   • CAn attacker can use the storage account key from the backup file to access other containers in the same storage account.
   • DAn attacker can enumerate the blobs in the container and download the backup file without authentication.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a penetration test, you gain command execution on an Azure VM through a vulnerable web application. The VM has a system-assigned managed identity enabled. You need to pivot to access secrets in Azure Key Vault. The Key Vault's access policy only grants 'Get' and 'List' permissions to the VM's managed identity. What is the most direct method to retrieve a secret from the Key Vault?

   • ACreate a new network security group rule to allow direct access to the Key Vault's private IP
   • BExtract the Key Vault's master key from the VM's memory and decrypt secrets locally
   • CUse the VM's local administrator account to reset the Key Vault's access policy and add yourself
   • DQuery the IMDS endpoint at 169.254.169.254 to obtain an access token for the managed identity, then call the Key Vault REST API with that token
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which Azure Storage feature allows a user to grant time-limited, delegated access to a specific blob or container without sharing the account key?

   • AAzure AD role assignment
   • BStorage account access key
   • CAzure Firewall rule
   • DShared access signature (SAS)
   Reveal Solution Discussion Select an answer first