Authentic The SecOps Group Certification Exam CCPenX-Az Questions Answers

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

" userAssignedIdentities " : {

" /subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity " : {

" clientId " : " cf3664d4-5cec-4feb-b0ef-88b7958809df " ,

" principalId " : " efe89e83-010f-42f6-9576-30531fa47af7 "

}

}

}

Now query the role assignments for the managed identity’s principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

D. AppService-Auditor

================

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" clientId " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" clientSecret " : " REDACTED "

}

The App Registration application/client ID is stored in:

clientId

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================