Vce CCPenX-Az Questions Latest

Detailed Solution:

In an Entra ID abuse path, a privileged user such as User Administrator may reset another user’s password. In logs, this appears as a user update operation involving the password profile.

Check audit logs in the portal:

Microsoft Entra ID → Monitoring → Audit logs

Or query via Microsoft Graph/Azure tooling depending on permissions.

The activity to look for is generally:

Update user

Modified property: passwordProfile

The other options represent different activities:

Microsoft.Authorization/roleAssignments/write = RBAC role assignment change

Microsoft.Storage/storageAccounts/listKeys/action = storage account key retrieval

Microsoft.KeyVault/vaults/secrets/read = Key Vault secret read

Correct answer:

B. Update user / password profile modification

Detailed Solution:

List NSG rules:

az network nsg rule list \

--resource-group rg-prod-apps-eastus \

--nsg-name nsg-prod-linux01 \

--output table

Expected risky rule:

Name Priority Direction Access Protocol Source DestinationPortRange

------------ -------- --------- ------ -------- ------------ --------------------

Allow-SSH 100 Inbound Allow Tcp Internet 22

SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.

Correct answer:

B. Allow TCP 22 from Internet

================

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

Expected exposed container:

public-backups

Final answer:

public-backups

================

Detailed Solution:

In Azure Storage SAS tokens, sp means signed permissions.

For blob/container access:

r = read

l = list

w = write

d = delete

c = create

a = add

Given:

sp=rl

The permissions are:

Read + List

Correct answer:

A. Read and List

SAS tokens grant delegated access to Azure Storage resources and must be handled like secrets.

================