A company wants to implement a phishing-resistant authentication method for their Azure AD users. They currently use passwords and SMS-based MFA. Which of the following should they implement?

Use Azure AD Multi-Factor Authentication with phone call verification

Enable password hash sync with Seamless SSO

Deploy FIDO2 security keys for all users

Configure conditional access to require a hybrid Azure AD joined device

During an Azure penetration test, you discover that a user account has the 'Contributor' role on a subscription. The user does not have any other Azure AD roles. You want to gain access to the Azure AD tenant. Which technique is most likely to achieve this?

Assign the 'Global Administrator' role to the user account using the Azure AD admin center.

Create a new Azure AD application and grant it the 'Directory.Read.All' permission, then authenticate as the application.

Use the Contributor role to modify the properties of an existing Azure AD application and add a new client secret.

Create a new Azure AD user with the 'Global Administrator' role and authenticate as that user.

What is the primary purpose of an Azure Active Directory tenant?

To provide a dedicated and isolated instance of Azure AD for an organization

To store virtual machine images

To manage network security groups

To define the physical location of Azure resources

GIAC Penetration Tester (GPEN)

Domain 5Objective 1

Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 8)

Part of the Cloud and Azure Attacks domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

Questions 36–39

36application · medium
A company wants to implement a phishing-resistant authentication method for their Azure AD users. They currently use passwords and SMS-based MFA. Which of the following should they implement?
Select an answer first
37foundation · easy
Which Azure Resource Manager attack involves an attacker exploiting overly broad permissions on a resource group to create additional resources or modify existing ones?
Select an answer first
38application · hard
During an Azure penetration test, you discover that a user account has the 'Contributor' role on a subscription. The user does not have any other Azure AD roles. You want to gain access to the Azure AD tenant. Which technique is most likely to achieve this?
Select an answer first
39foundation · easy
What is the primary purpose of an Azure Active Directory tenant?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Azure Overview, Attacks, and AD Integration GPEN Practice Questions (Page 8)

Questions 36–39

A company wants to implement a phishing-resistant authentication method for their Azure AD users. They currently use passwords and SMS-based MFA. Which of the following should they implement?

Which Azure Resource Manager attack involves an attacker exploiting overly broad permissions on a resource group to create additional resources or modify existing ones?

During an Azure penetration test, you discover that a user account has the 'Contributor' role on a subscription. The user does not have any other Azure AD roles. You want to gain access to the Azure AD tenant. Which technique is most likely to achieve this?

What is the primary purpose of an Azure Active Directory tenant?

Keep studying — Cloud and Azure Attacks