During a penetration test of an Azure-hosted web app, you discover that the app's authentication is configured to accept any valid Azure AD token from your test tenant, not just tokens issued for the app's own tenant. You successfully authenticate using a test user from your tenant. What is the most likely root cause of this vulnerability?

The app is using OAuth 2.0 implicit grant flow, which does not validate the token issuer by default.

The app's manifest has 'acceptMappedClaims' set to true, allowing claims from any tenant to be accepted.

The app's redirect URI is set to a wildcard, allowing tokens from any tenant to be exchanged.

The app is configured as a multi-tenant application without proper issuer validation in its code.

A developer at your company created an Azure Function app that processes sensitive HR data. The function uses a connection string stored in the application settings to access a storage account. During a security review, you discover the connection string is also hardcoded in the function's source code, which is stored in a public GitHub repository. What is the most immediate and effective action to mitigate the exposure?

Delete the GitHub repository immediately to prevent further exposure of the connection string.

Enable Azure Defender for Storage to monitor for anomalous access to the storage account.

Rotate the storage account key, remove the hardcoded string from the repository, and configure the function to use a managed identity for storage access.

Change the connection string in the Azure Function application settings to a new value and update the source code in GitHub with the new string.

After compromising a service principal used by an Azure Function app, you want to maintain persistent access. The service principal has 'Application.ReadWrite.All' permission in Azure AD. Which of the following is the most stealthy persistence technique that leverages this permission?

Modify the service principal's app role assignments to include a new application role.

Add a new password credential to the service principal.

Create a new service principal and assign it the same roles as the compromised one.

Add a new certificate credential to the service principal.

GIAC Penetration Tester (GPEN)

Domain 5Objective 2

Azure Applications and Attack Strategies GPEN Practice Questions (Page 6)

Part of the Cloud and Azure Attacks domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 26–30

26application · medium
During a penetration test of an Azure-hosted web app, you discover that the app's authentication is configured to accept any valid Azure AD token from your test tenant, not just tokens issued for the app's own tenant. You successfully authenticate using a test user from your tenant. What is the most likely root cause of this vulnerability?
Select an answer first
27application · medium
A developer at your company created an Azure Function app that processes sensitive HR data. The function uses a connection string stored in the application settings to access a storage account. During a security review, you discover the connection string is also hardcoded in the function's source code, which is stored in a public GitHub repository. What is the most immediate and effective action to mitigate the exposure?
Select an answer first
28foundation · easy
An Azure web app is found to have anonymous access enabled to an administrative endpoint. Which type of misconfiguration does this represent?
Select an answer first
29application · medium
After compromising a service principal used by an Azure Function app, you want to maintain persistent access. The service principal has 'Application.ReadWrite.All' permission in Azure AD. Which of the following is the most stealthy persistence technique that leverages this permission?
Select an answer first
30foundation · easy
Which Azure service is specifically designed to securely store and manage application secrets such as connection strings, API keys, and certificates?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Azure Applications and Attack Strategies GPEN Practice Questions (Page 6)

Questions 26–30

An Azure web app is found to have anonymous access enabled to an administrative endpoint. Which type of misconfiguration does this represent?

After compromising a service principal used by an Azure Function app, you want to maintain persistent access. The service principal has 'Application.ReadWrite.All' permission in Azure AD. Which of the following is the most stealthy persistence technique that leverages this permission?

Which Azure service is specifically designed to securely store and manage application secrets such as connection strings, API keys, and certificates?

Keep studying — Cloud and Azure Attacks