Microsoft Azure Cloud Services and Attacks GCPN Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is assessing an Azure DevOps pipeline. The tester discovers that the pipeline uses a service connection to an Azure subscription with 'Contributor' rights. The tester can modify the pipeline definition. Which of the following is the MOST effective way to compromise the subscription?

   • AModify the pipeline to run a script that downloads the service connection's credentials and uses them to access the Azure Resource Manager API.
   • BInject a malicious task into the pipeline that uses the service connection to run Azure CLI commands that create a new service principal with 'Owner' rights.
   • CUse the service connection to directly access the Azure Key Vault and read all secrets.
   • DChange the pipeline's agent pool to a self-hosted agent that you control, then run commands on that agent.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A penetration tester is assessing an Azure environment with a hub-spoke network topology. The hub contains an Azure Firewall, and the spokes contain VMs with NSGs. The tester has compromised a VM in a spoke and wants to reach a VM in another spoke. The Azure Firewall has a rule that allows traffic between spokes, but the NSG on the target VM only allows traffic from the hub's IP range. What is the most effective way to reach the target VM?

   • AUse the compromised VM to send traffic through the Azure Firewall to the target VM, as the firewall will forward traffic and the NSG will see the firewall's IP as the source
   • BModify the NSG on the target VM to allow traffic from the compromised VM's IP address
   • CUse Azure Bastion to connect to the target VM through the hub
   • DCreate a VPN gateway in the spoke to route traffic directly to the target VM
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which Azure networking component acts as a distributed firewall that filters traffic to and from Azure resources based on rules you define?

   • AAzure Load Balancer
   • BNetwork security group (NSG)
   • CAzure VPN Gateway
   • DAzure Virtual Network
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A penetration tester has compromised an Azure DevOps pipeline that deploys a web application to Azure App Service. The pipeline uses a variable group that contains a connection string to a database. The tester wants to exfiltrate the connection string without being detected. What is the most stealthy method?

   • AAdd a malicious task to the pipeline that reads the variable group and sends the connection string to an external server
   • BModify the pipeline to output the connection string to the build logs
   • CAccess the variable group directly from the Azure DevOps API
   • DUse the pipeline's service connection to access the database directly
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which file in a Kubernetes cluster contains the information needed to authenticate to the cluster API server, and is a high-value target for attackers if it is exposed?

   • Akubeconfig
   • BPod manifest
   • CDockerfile
   • DService account token
   Reveal Solution Discussion Select an answer first