Azure Applications and Attack Strategies GPEN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which OAuth 2.0 grant type is most commonly used by a public client (such as a single-page application) to obtain an access token on behalf of a user who has already signed in?

   • AResource owner password credentials (ROPC)
   • BClient credentials
   • CImplicit grant
   • DAuthorization code with PKCE
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An attacker compromises a low-privileged user account in an Azure AD tenant and then exploits a misconfigured app role assignment to gain Global Administrator rights. Which attack strategy does this represent?

   • ADenial of service
   • BPrivilege escalation
   • CCredential theft
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are testing an Azure App Service that uses Azure AD for authentication. The app has an endpoint that accepts a 'code' parameter and exchanges it for a token. You notice that the app does not validate the 'state' parameter in the OAuth flow. What is the most likely attack?

   • AOpen redirect via the 'code' parameter.
   • BSQL injection via the 'code' parameter.
   • CToken theft via the 'code' parameter.
   • DCross-site request forgery (CSRF) to force a user to authenticate to the attacker's account.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which attack strategy against an Azure application involves an attacker using a stolen OAuth token to access the application's APIs and then copying sensitive data to an external location?

   • ACredential theft
   • BPrivilege escalation
   • CDenial of service
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During an engagement, you find an App Service that has 'Access restrictions' configured to allow only a specific IP range. However, you successfully access the app from an IP outside that range. The app uses Azure AD authentication. What is the most likely reason for this bypass?

   • AThe access restriction is configured on the wrong slot (e.g., staging instead of production).
   • BThe Azure AD authentication is misconfigured to accept tokens from any tenant, allowing you to authenticate regardless of IP.
   • CThe access restriction is set to 'Allow all' by default, and the specific IP range is only a recommendation, not an enforcement.
   • DThe app is behind Azure Front Door, and the access restriction is set to allow Front Door's IP ranges, but the 'X-Forwarded-For' header is not being validated.
   Reveal Solution Discussion Select an answer first