Which Azure AD authentication method stores a hash of the user's password in Azure AD, allowing users to use the same password for on-premises and cloud resources?

Certificate-based authentication

An organization uses Azure AD Connect to sync identities from on-premises Active Directory. A penetration tester discovers that the Azure AD Connect service account has been granted the 'Global Administrator' role in Azure AD. The tester wants to use this to gain persistent access to the on-premises environment. Which of the following is the most effective technique?

Modify the Azure AD Connect configuration to sync a new malicious user with Global Administrator role

Use the service account to reset the password of an on-premises admin user

Create a new service principal in Azure AD and grant it the Global Administrator role

Extract the Azure AD Connect database credentials and use them to access the on-premises AD

A penetration tester is assessing an Azure subscription. The tester finds that a user account has the 'Contributor' role on a resource group that contains a virtual machine. The tester wants to gain access to the VM's managed identity token. What is the most direct method?

Create a new role assignment granting the tester 'Owner' on the subscription

Reset the VM's local administrator password via the portal

Extract the VM's managed identity token from the Azure Resource Manager API

Run a command on the VM using the VM Access extension

A company has an on-premises Active Directory domain and uses Azure AD Connect to sync users to Azure AD. A penetration tester has compromised an on-premises user account that is synced to Azure AD. The tester wants to move laterally to Azure AD and gain Global Administrator. Which of the following is the most effective approach?

Exploit the Azure AD Connect service account to gain Global Administrator

Use the synced user's password to sign in to Azure AD and attempt to escalate privileges

Modify the on-premises user's attributes to grant them Azure AD roles

Use the on-premises user's token to access Azure AD

A company has a single Azure subscription with multiple resource groups. A user has the 'Reader' role on the subscription. Which of the following actions can the user perform?

Delete a virtual machine in a resource group.

View the properties of all resources in all resource groups.

Assign the 'Contributor' role to another user on a specific resource group.

Create a new resource group in the subscription.

GIAC Penetration Tester (GPEN)

Domain 5Objective 1

Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 5)

Part of the Cloud and Azure Attacks domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

Questions 21–25

21foundation · easy
Which Azure AD authentication method stores a hash of the user's password in Azure AD, allowing users to use the same password for on-premises and cloud resources?
Select an answer first
22expert · hard
An organization uses Azure AD Connect to sync identities from on-premises Active Directory. A penetration tester discovers that the Azure AD Connect service account has been granted the 'Global Administrator' role in Azure AD. The tester wants to use this to gain persistent access to the on-premises environment. Which of the following is the most effective technique?
Select an answer first
23application · medium
A penetration tester is assessing an Azure subscription. The tester finds that a user account has the 'Contributor' role on a resource group that contains a virtual machine. The tester wants to gain access to the VM's managed identity token. What is the most direct method?
Select an answer first
24expert · hard
A company has an on-premises Active Directory domain and uses Azure AD Connect to sync users to Azure AD. A penetration tester has compromised an on-premises user account that is synced to Azure AD. The tester wants to move laterally to Azure AD and gain Global Administrator. Which of the following is the most effective approach?
Select an answer first
25application · easy
A company has a single Azure subscription with multiple resource groups. A user has the 'Reader' role on the subscription. Which of the following actions can the user perform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 5)

Questions 21–25

Which Azure AD authentication method stores a hash of the user's password in Azure AD, allowing users to use the same password for on-premises and cloud resources?

A penetration tester is assessing an Azure subscription. The tester finds that a user account has the 'Contributor' role on a resource group that contains a virtual machine. The tester wants to gain access to the VM's managed identity token. What is the most direct method?

A company has a single Azure subscription with multiple resource groups. A user has the 'Reader' role on the subscription. Which of the following actions can the user perform?

Keep studying — Cloud and Azure Attacks