Azure Applications and Attack Strategies GPEN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Logic App is configured with an HTTP trigger that calls a Microsoft Graph API to read user profiles. The Logic App uses a system-assigned managed identity. You discover that the Logic App's managed identity has been granted the 'User.Read.All' application permission. The Logic App's HTTP trigger is publicly accessible without authentication. What is the primary risk you should report?

   • AThe managed identity can be used to authenticate to Azure Resource Manager and modify resources.
   • BThe managed identity's client secret can be extracted from the Logic App's definition.
   • CAn attacker can invoke the Logic App to read any user's profile via the Graph API.
   • DThe Logic App's connection to Graph API is not encrypted.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your company has a web app on Azure App Service that calls an API on a separate App Service. The API is protected by Azure AD. You want to ensure the web app can authenticate to the API without storing credentials. What is the best way to configure this?

   • AEnable the web app's managed identity and grant it access to the API's Azure AD application.
   • BCreate a service principal for the web app and store its password in the API's app settings.
   • CUse the web app's client secret from Azure AD and store it in the web app's configuration.
   • DConfigure the API to allow anonymous access and rely on network security groups to restrict access.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your company is migrating a legacy web app to Azure App Service. The app currently uses a username/password database for authentication. You want to modernize it to use Azure AD while minimizing changes to the app code. What is the best approach?

   • AUse Azure App Service's built-in authentication (EasyAuth) to handle Azure AD authentication, and update the app to trust the injected headers.
   • BUse Azure AD Application Proxy to publish the app and handle authentication externally.
   • CKeep the existing database authentication and sync users to Azure AD using Azure AD Connect.
   • DRewrite the app to use the Microsoft Authentication Library (MSAL) for authentication.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An Azure App Service uses a system-assigned managed identity to access a Key Vault. The Key Vault's access policy grants the managed identity 'Get' and 'List' on secrets. The App Service's application settings use a Key Vault reference for a database password. During a penetration test, you compromise the App Service's code execution. What is the most direct way to retrieve the database password?

   • AAccess the Key Vault directly using the managed identity's token from the App Service's environment.
   • BRead the application settings from the App Service's configuration, which will contain the plaintext password.
   • CUse the App Service's managed identity to reset the database password.
   • DUse the App Service's publishing credentials to access the Key Vault.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In an Azure application, which identity mechanism allows a compute resource (such as a virtual machine or an App Service) to authenticate to Azure services without storing credentials in code or configuration files?

   • AManaged identity
   • BService principal with a client secret
   • CShared access signature (SAS) token
   • DAzure AD application registration
   Reveal Solution Discussion Select an answer first