Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   During an Azure AD penetration test, you compromise a service principal that has the 'Application.ReadWrite.All' directory permission. The organization uses Azure AD Connect with password hash sync. Which of the following is the most effective and stealthy way to achieve persistent global admin access?

   • AModify an existing application's service principal to add a password credential and assign it the 'Global Administrator' role
   • BCreate a new application with delegated permissions for 'User.Read.All' and consent it
   • CAdd a new password credential to an existing highly privileged application and use its permissions to grant yourself the Global Administrator role
   • DAdd the service principal to the Global Administrator role
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team wants to detect password spraying attacks against their Azure AD environment. They have enabled Azure AD Identity Protection. Which of the following is the most effective detection method?

   • AUse Azure AD Identity Protection's risk detections to identify password spraying
   • BReview Azure AD audit logs for role changes
   • CMonitor sign-in logs for multiple failed sign-ins from the same IP across many users
   • DEnable smart lockout to block the attacking IP
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team wants to detect backdoor accounts created in Azure AD. They have enabled audit logging. Which of the following is the most effective detection method?

   • AMonitor audit logs for new user creation and role assignments
   • BUse conditional access to require MFA for all users
   • CMonitor sign-in logs for unusual IP addresses
   • DEnable Azure AD Identity Protection to detect risky sign-ins
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An attacker has compromised a user's Azure AD account and is using a stolen refresh token to obtain new access tokens. The organization has enabled MFA and conditional access. Which of the following is the most effective way to stop the attacker from using the refresh token?

   • ADisable the user's account
   • BChange the user's password
   • CRevoke the user's sessions in Azure AD
   • DRequire MFA on every sign-in
   Reveal Solution Discussion Select an answer first
6. 35application · hard

   A company uses Azure AD with federation configured with an on-premises Active Directory Federation Services (AD FS) server. An attacker compromises the AD FS server and forges a token for a Global Administrator. Which of the following is the most effective mitigation to prevent this attack?

   • AUse certificate-based authentication with AD FS.
   • BImplement Azure AD Seamless Single Sign-On (SSO) instead of federation.
   • CConfigure Azure AD to reject tokens with a short lifetime.
   • DEnable Azure AD Identity Protection for all users.
   Reveal Solution Discussion Select an answer first