Your organization uses Azure Logic Apps to automate business processes. A Logic App has a managed identity that has 'Contributor' access to a storage account. An attacker has compromised the Logic App. What is the most likely way the attacker can exfiltrate data?

Use the managed identity to delete the storage account, causing data loss.

Modify the Logic App's workflow to add an action that uploads blobs from the storage account to an external location.

Use the managed identity to read the storage account's access keys and use them to access the data.

Use the managed identity to assign itself a new role on the storage account to gain 'Owner' access.

A company uses Azure Front Door to expose an App Service to the internet. The App Service is configured to require Azure AD authentication. The Front Door is configured to pass the 'X-Forwarded-Host' header. An attacker discovers that the App Service trusts the 'X-Forwarded-Host' header to generate redirect URIs for OAuth 2.0. What is the most likely attack?

SQL injection through the X-Forwarded-Host header.

Denial of service by sending a large X-Forwarded-Host header.

Host header injection to redirect the user to a malicious site during OAuth flow.

Cross-site scripting via the X-Forwarded-Host header.

Your team is building a new microservices architecture on Azure Functions. Each function needs to authenticate to Azure SQL Database and Azure Storage. You want to avoid storing any credentials in code or configuration. What is the recommended approach?

Use a shared service principal for all functions and store its password in Key Vault.

Use connection strings for SQL and Storage and encrypt them with Azure Key Vault.

Create a user-assigned managed identity for each function and store the client secret in the function's application settings.

Assign each function a system-assigned managed identity and grant that identity the necessary permissions on SQL and Storage.

GIAC Penetration Tester (GPEN)

Domain 5Objective 2

Azure Applications and Attack Strategies GPEN Practice Questions (Page 1)

Part of the Cloud and Azure Attacks domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 1–5

1application · medium
Your organization uses Azure Logic Apps to automate business processes. A Logic App has a managed identity that has 'Contributor' access to a storage account. An attacker has compromised the Logic App. What is the most likely way the attacker can exfiltrate data?
Select an answer first
2expert · hard
A company uses Azure Front Door to expose an App Service to the internet. The App Service is configured to require Azure AD authentication. The Front Door is configured to pass the 'X-Forwarded-Host' header. An attacker discovers that the App Service trusts the 'X-Forwarded-Host' header to generate redirect URIs for OAuth 2.0. What is the most likely attack?
Select an answer first
3foundation · easy
In an Azure application architecture, which component is a serverless compute service that runs event-driven code without requiring you to manage the underlying infrastructure?
Select an answer first
4foundation · easy
An attacker discovers that an Azure App Service has the 'Client Certificates' setting disabled, allowing requests without a valid client certificate. Which misconfiguration is the attacker exploiting?
Select an answer first
5application · medium
Your team is building a new microservices architecture on Azure Functions. Each function needs to authenticate to Azure SQL Database and Azure Storage. You want to avoid storing any credentials in code or configuration. What is the recommended approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Azure Applications and Attack Strategies GPEN Practice Questions (Page 1)

Questions 1–5

Your organization uses Azure Logic Apps to automate business processes. A Logic App has a managed identity that has 'Contributor' access to a storage account. An attacker has compromised the Logic App. What is the most likely way the attacker can exfiltrate data?

In an Azure application architecture, which component is a serverless compute service that runs event-driven code without requiring you to manage the underlying infrastructure?

An attacker discovers that an Azure App Service has the 'Client Certificates' setting disabled, allowing requests without a valid client certificate. Which misconfiguration is the attacker exploiting?

Your team is building a new microservices architecture on Azure Functions. Each function needs to authenticate to Azure SQL Database and Azure Storage. You want to avoid storing any credentials in code or configuration. What is the recommended approach?

Keep studying — Cloud and Azure Attacks