Your team is developing an Azure Logic App that needs to send emails via Microsoft Graph. You want to authenticate without storing user credentials. What is the recommended approach?

Use a system-assigned managed identity and grant it the 'Mail.Send' permission in Microsoft Graph.

Create an app registration and store its client secret in the Logic App's configuration.

Use the Logic App's built-in 'Send an email' connector with a shared mailbox credentials.

Use a user's OAuth 2.0 refresh token and store it in Key Vault.

Which security control is most effective in preventing an attacker from using a stolen OAuth token to access an Azure application's APIs?

Encrypting the application's data at rest

Enabling Azure AD conditional access policies

Implementing network security groups (NSGs)

Using short-lived tokens and token revocation

Your organization is deploying a new Azure Function app that handles sensitive data. You want to ensure that only authorized users can invoke the function, and you want to avoid managing API keys. What is the best way to secure the function's HTTP endpoint?

Enable Azure AD authentication on the function app and require users to authenticate with OAuth 2.0.

Use a shared access signature (SAS) token for the function's endpoint.

Use function-level API keys and distribute them only to authorized users.

Restrict access to the function's IP address range using access restrictions.

During an engagement, you find an Azure Function app that processes files uploaded to a Blob Storage container. The function uses a connection string in its application settings to access the storage account. The connection string belongs to a storage account that also hosts a 'backup' container with sensitive data. The function's managed identity is not used. What is the most direct way to exfiltrate the backup data?

Use the connection string to authenticate to the storage account and download the backup container's blobs.

Use the function's 'scm' endpoint to read the application settings and then use the storage account key from the settings.

Modify the function's code to copy the backup container to a public container.

Escalate the function's managed identity to a Contributor role on the storage account.

GIAC Penetration Tester (GPEN)

Domain 5Objective 2

Azure Applications and Attack Strategies GPEN Practice Questions (Page 2)

Part of the Cloud and Azure Attacks domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 6–10

6foundation · easy
After compromising an Azure VM, an attacker uses the VM's managed identity to request a token for the Azure Resource Manager API and then enumerates other resources in the subscription. Which post-exploitation technique is this?
Select an answer first
7application · medium
Your team is developing an Azure Logic App that needs to send emails via Microsoft Graph. You want to authenticate without storing user credentials. What is the recommended approach?
Select an answer first
8foundation · easy
Which security control is most effective in preventing an attacker from using a stolen OAuth token to access an Azure application's APIs?
Select an answer first
9application · medium
Your organization is deploying a new Azure Function app that handles sensitive data. You want to ensure that only authorized users can invoke the function, and you want to avoid managing API keys. What is the best way to secure the function's HTTP endpoint?
Select an answer first
10application · medium
During an engagement, you find an Azure Function app that processes files uploaded to a Blob Storage container. The function uses a connection string in its application settings to access the storage account. The connection string belongs to a storage account that also hosts a 'backup' container with sensitive data. The function's managed identity is not used. What is the most direct way to exfiltrate the backup data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Azure Applications and Attack Strategies GPEN Practice Questions (Page 2)

Questions 6–10

After compromising an Azure VM, an attacker uses the VM's managed identity to request a token for the Azure Resource Manager API and then enumerates other resources in the subscription. Which post-exploitation technique is this?

Your team is developing an Azure Logic App that needs to send emails via Microsoft Graph. You want to authenticate without storing user credentials. What is the recommended approach?

Which security control is most effective in preventing an attacker from using a stolen OAuth token to access an Azure application's APIs?

Your organization is deploying a new Azure Function app that handles sensitive data. You want to ensure that only authorized users can invoke the function, and you want to avoid managing API keys. What is the best way to secure the function's HTTP endpoint?

Keep studying — Cloud and Azure Attacks