CCPenX-Az Certified Cloud Pentesting eXpert - Azure Questions and Answers

b72a4c19-92f6-47f3-b3dd-9db5a31831d1

Detailed Solution:

Run:

az webapp identity show \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Expected output:

{

" principalId " : " b72a4c19-92f6-47f3-b3dd-9db5a31831d1 " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" type " : " SystemAssigned "

}

The principalId is the service principal object ID of the managed identity.

Microsoft documents that managed identities provide Azure-managed identities for applications and eliminate the need to manage application secrets directly.

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p ' < client-secret > ' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

" user " : {

" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" type " : " servicePrincipal "

}

}

This confirms you are authenticated as the App Registration/service principal.

================

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query " {Name:name,AllowBlobPublicAccess:allowBlobPublicAccess} " \

--output json

Expected output:

{

" Name " : " prodreportstore01 " ,

" AllowBlobPublicAccess " : true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT= " prodreportstore01 "

CONTAINER= " sensitive-exports "

SAS= " ?sv=2025-01-05 & ss=b & srt=sco & sp=rl & se=2026-08-01T00:00:00Z & sig= < signature > "

List blobs:

az storage blob list \

--account-name " $ACCOUNT " \

--container-name " $CONTAINER " \

--sas-token " $SAS " \

--query " [].name " \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

================

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

" userAssignedIdentities " : {

" /subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity " : {

" clientId " : " cf3664d4-5cec-4feb-b0ef-88b7958809df " ,

" principalId " : " efe89e83-010f-42f6-9576-30531fa47af7 "

}

}

}

Now query the role assignments for the managed identity’s principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

D. AppService-Auditor

================

Tenant ID: 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Subscription ID: 5d8e44ac-24a9-43d9-9cb5-71b227a58021

Detailed Solution:

Log in with the supplied account:

az login -u james.ward@cloudcorpsec.onmicrosoft.com -p ' < password > '

Show the active Azure context:

az account show --output json

Expected relevant output:

{

" id " : " 5d8e44ac-24a9-43d9-9cb5-71b227a58021 " ,

" name " : " CloudCorp Security Lab " ,

" tenantDefaultDomain " : " cloudcorpsec.onmicrosoft.com " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a "

}

The tenantId is the Microsoft Entra tenant ID. The id field is the subscription ID.

================