Which Azure AD privilege escalation technique involves an attacker abusing an application's permissions to grant themselves a higher role?

Abusing application permissions

A red team has compromised an on-premises Active Directory domain controller and wants to establish persistent access to Azure AD without triggering alerts. The organization uses Azure AD Connect with password hash sync. Which of the following persistence techniques is most likely to evade detection while providing long-term access?

Disable password hash sync and enable pass-through authentication to create a backdoor

Modify the Azure AD Connect service account to have Global Administrator privileges

Add a new password credential to the Azure AD Connect service principal

Create a new on-premises user and sync it to Azure AD with Global Administrator role

GIAC Penetration Tester (GPEN)

Domain 5Objective 1

Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 3)

Part of the Cloud and Azure Attacks domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

Questions 11–15

11foundation · easy
Which Azure AD authentication method validates the user's password directly against on-premises Active Directory without storing password hashes in Azure AD?
Select an answer first
12foundation · easy
Which Azure AD privilege escalation technique involves an attacker abusing an application's permissions to grant themselves a higher role?
Select an answer first
13foundation · easy
In Microsoft Azure, which component is the fundamental unit of management and billing that contains all resources for an organization, and can have multiple instances to separate environments or departments?
Select an answer first
14expert · hard
A red team has compromised an on-premises Active Directory domain controller and wants to establish persistent access to Azure AD without triggering alerts. The organization uses Azure AD Connect with password hash sync. Which of the following persistence techniques is most likely to evade detection while providing long-term access?
Select an answer first
15foundation · easy
Which attack against Azure AD involves an attacker sending a large number of sign-in attempts using a small set of common passwords across many user accounts to avoid account lockout?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 3)

Questions 11–15

Which Azure AD authentication method validates the user's password directly against on-premises Active Directory without storing password hashes in Azure AD?

Which Azure AD privilege escalation technique involves an attacker abusing an application's permissions to grant themselves a higher role?

In Microsoft Azure, which component is the fundamental unit of management and billing that contains all resources for an organization, and can have multiple instances to separate environments or departments?

Which attack against Azure AD involves an attacker sending a large number of sign-in attempts using a small set of common passwords across many user accounts to avoid account lockout?

Keep studying — Cloud and Azure Attacks