Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to detect password spraying attacks against their Azure AD tenant. Which of the following configurations is most effective?

   • AConfigure conditional access to block sign-ins from unknown IP addresses.
   • BEnable Azure AD Identity Protection and configure a risk policy for 'Unfamiliar sign-in properties'.
   • CEnable MFA for all users and require it for all sign-ins.
   • DConfigure Azure AD sign-in logs to be exported to a SIEM and create a rule for multiple failed sign-ins from the same IP address.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which Azure AD persistence technique involves creating a new user account with administrative privileges that is not subject to normal monitoring?

   • ABackdoor account
   • BService principal modification
   • CToken theft
   • DPassword spraying
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Azure AD monitoring feature provides a report of sign-in attempts that can be used to detect password spraying or token replay attacks?

   • AAudit logs
   • BResource logs
   • CSign-in logs
   • DProvisioning logs
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   According to the shared responsibility model in Microsoft Azure, which of the following is the customer responsible for when using an Azure virtual machine?

   • AMaintaining the underlying hypervisor
   • BEnsuring network connectivity between Azure data centers
   • CPhysical security of the data center
   • DPatching the guest operating system
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An attacker has compromised a Global Administrator account in Azure AD. They want to maintain access even if the account is disabled or the password is changed. Which of the following is the most effective persistence technique?

   • ACreate a new user account and add it to the Global Administrator role
   • BCreate a new service principal and assign it the Global Administrator role
   • CRegister a new device and enroll it in Azure AD
   • DAdd a password credential to an existing application that has Global Administrator permissions
   Reveal Solution Discussion Select an answer first