GPEN Azure AD Integration Practice Test 2 — 15 Questions

Question 1

During a penetration test of a Microsoft Entra ID environment, you discover that the tenant has self-service password reset (SSPR) enabled for all users. You have compromised a standard user account. Which of the following methods could you use to attempt to reset the password of a more privileged user via SSPR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploit a misconfiguration where the privileged user has registered a weak authentication method, such as a phone number that you control, and use it to reset their password.. SSPR can be abused if a privileged user has registered an authentication method that an attacker can control, such as a phone number. By initiating a password reset for the privileged user and intercepting the verification code, the attacker can reset the password. This highlights the risk of weak or compromised authentication methods in SSPR-enabled environments.

Answer

Enumerate the authentication methods registered for the privileged user and attempt to answer their security questions by guessing common answers.

Answer

Use the compromised user's access to read the privileged user's registered authentication methods via Microsoft Graph, then attempt to reset the password by satisfying those methods.

Answer

Leverage the compromised user's session to access the Azure AD SSPR portal and attempt to reset the privileged user's password by answering their security questions.

Question 2

You are performing a penetration test on a Microsoft Entra ID tenant that uses federated authentication with Active Directory Federation Services (AD FS). You have compromised a user account in the on-premises domain. Which of the following actions would allow you to authenticate as a different user in the cloud without knowing their password?

Accepted Answer

Extract the AD FS token-signing certificate from the AD FS server and forge SAML tokens for any user in the domain.. In a federated authentication setup with AD FS, Microsoft Entra ID trusts SAML tokens signed by the AD FS token-signing certificate. If an attacker extracts the private key of this certificate, they can forge tokens for any user, enabling authentication as privileged users without their passwords. This is a well-known attack path and highlights the importance of protecting the token-signing certificate.

Answer

Use the compromised user's credentials to access the AD FS server and modify the claim rules to include a claim that grants administrative access in Microsoft Entra ID.

Answer

Perform a pass-the-hash attack using the compromised user's NTLM hash to authenticate to the AD FS server, then request a SAML token for a privileged user.

Answer

Modify the on-premises user's 'msDS-KeyCredentialLink' attribute to add a rogue key credential, then authenticate to Microsoft Entra ID using the corresponding private key.

Question 3

During an assessment, you discover a federated identity setup using AD FS. What is a common security risk associated with the reliance on the token-signing certificate in this architecture?

Accepted Answer

Compromise of the private signing key allows for the creation of unauthorized authentication tokens.. The token-signing certificate is the foundation of trust in a federated environment. If an attacker compromises the private key of this certificate, they can forge SAML tokens for any user in the directory. This bypasses Multi-Factor Authentication and allows for complete identity impersonation, making the protection of the AD FS server and its associated secrets a critical objective for both defenders and attackers.

Answer

The certificate is public knowledge and can be used to decrypt all cloud traffic.

Answer

AD FS requires the certificate to be stored in an unsecured plaintext file on the web server.

Answer

The relying party cannot verify the identity if the certificate expires.

Question 4

When analyzing a hybrid identity environment, you notice the use of 'Seamless Single Sign-On'. What is the potential impact if the 'AZUREADSSOACC' computer object in the on-premises Active Directory is compromised?

Accepted Answer

The attacker can generate valid Kerberos tickets to facilitate cloud authentication.. The AZUREADSSOACC object is a computer account created in AD with a Kerberos service principal name. If compromised, an attacker can request Kerberos tickets to impersonate users or potentially extract the decryption key. This allows the attacker to silently authenticate as others to the cloud, bypassing the need for secondary checks, making it a critical pivot point in hybrid identity attacks.

Answer

The attacker can directly modify the Azure AD tenant settings.

Answer

The attacker can permanently disable synchronization between on-premises and cloud.

Answer

All password hash synchronization processes will immediately cease.

Question 5

Which of the following describes the risk of 'Guest User' accounts in an Azure AD integration scenario?

Accepted Answer

Guest users can potentially enumerate directory objects unless restricted.. Guest accounts in Microsoft Entra ID often have default permissions that allow them to enumerate directory objects. If these guests are not properly scoped using 'External Collaboration Settings', an attacker can use a compromised guest account to map the internal organizational structure, identify high-value targets, and find misconfigured applications. This reconnaissance is often the first step in a broader, more successful targeted attack against the internal environment.

Answer

Guest users are automatically granted Global Administrator privileges.

Answer

Guest accounts can only be created by the Global Administrator.

Answer

Guest users are exempt from Conditional Access policies.

Question 6

Which THREE of the following are valid methods to mitigate the risk of password spray attacks in an integrated Azure AD environment?

Accepted Answer

Enforce Multi-Factor Authentication for all users.. Password spray attacks target common passwords across many accounts. Protecting against this requires a layered approach: enforcing MFA to render weak passwords useless, blocking legacy authentication to prevent bypasses, and utilizing identity protection to detect anomalous logins. These controls are essential for modernizing identity security and protecting against high-volume, low-effort credential attacks that plague hybrid environments.

Answer

Increase the minimum password length to 50 characters.

Answer

Require all users to use the same password for both on-premises and cloud.

Question 7

Why is 'Password Writeback' considered a significant security risk in hybrid identity integrations?

Accepted Answer

It allows cloud-based compromise to escalate into the on-premises domain.. Password Writeback enables the cloud to update passwords on-premises. While convenient, it creates a bidirectional path. If an attacker gains control of a cloud-based administrator account, they can reset the password of any on-premises user, including sensitive accounts. This effectively elevates the cloud's influence over the on-premises environment, turning a cloud-only compromise into a full-scale domain-wide security disaster.

Answer

It stores plaintext passwords on the Azure AD Connect server.

Answer

It requires the on-premises firewall to allow inbound connections from the internet.

Answer

It automatically disables the on-premises password policy.

Question 8

During an assessment, you find that 'Device Writeback' is enabled. What is the security concern regarding the registration of these devices in Azure AD?

Accepted Answer

It allows untrusted devices to satisfy Conditional Access requirements.. Device Writeback registers on-premises devices in Microsoft Entra ID. If an attacker manages to join an unauthorized device to the domain, it is automatically synchronized to the cloud. Once in the cloud, this device might satisfy Conditional Access requirements, allowing an attacker to bypass device-based security controls. This expands the trusted device pool, which is a major security loophole if device registration is not tightly controlled.

Answer

It allows the cloud to push malware to on-premises devices.

Answer

It automatically grants the devices administrative access to the cloud tenant.

Answer

It requires all devices to be hardware-encrypted with TPM 2.0.

Question 9

Which of the following is a primary benefit of using Managed Identities for Azure resources?

Accepted Answer

It removes the need to store and manage credentials in application code.. Managed Identities eliminate the need for developers to manage credentials (like service principal secrets) within their application code. By having Azure handle the identity, the risk of credential leakage via hardcoded strings or insecure configuration files is virtually eliminated. This is a critical security improvement for cloud-native applications, as it relies on the platform to rotate secrets automatically and securely.

Answer

It allows the resource to access any other resource in the tenant by default.

Answer

It provides a mechanism to impersonate any user in the directory.

Answer

It bypasses the need for MFA when accessing sensitive databases.

Question 10

During an internal penetration test, an attacker compromises a standard user account in a hybrid Azure AD environment. The organization synchronizes on-premises identities using Azure AD Connect with Pass-Through Authentication enabled. Which technique allows the attacker to compromise additional cloud and on-premises identities without triggering standard cloud MFA prompts?

Accepted Answer

Abusing compromised credentials against legacy authentication endpoints or poorly secured client applications that bypass modern conditional access and MFA controls.. Pass-Through Authentication validates user credentials directly against the on-premises Active Directory by passing the raw credentials through the authentication agent. When an attacker compromises an active session or abuses legacy authentication protocols that bypass conditional access and multi-factor authentication requirements, they can pivot between cloud and on-premises domains seamlessly without triggering supplementary challenges.

Answer

Injecting malicious golden tickets into Azure AD Connect sync engine database tables to forge valid cloud security tokens.

Answer

Exploiting seamless single sign-on kerberos ticket requests to harvest master keys directly from the Azure AD service bus.

Answer

Modifying the cloud synchronization agent configuration file to downgrade password hashing algorithms from PBKDF2 to plain text.

Question 11

A penetration tester gains Global Administrator privileges in a Microsoft Entra ID tenant and needs to establish persistent access that survives credential resets and standard administrative remediation. Which TWO methods can the tester implement to maintain covert administrative access?

Accepted Answer

Registering a new multi-tenant application with Graph API application permissions such as Directory.AccessAsUser.All or RoleManagement.ReadWrite.Directory.. Persistent access in Microsoft Entra ID often relies on abusing application permissions and service principals rather than traditional user accounts. By creating a malicious application registration with high-privilege Microsoft Graph API permissions or injecting a rogue federated domain trust, an attacker ensures long-term access that remains unaffected by standard user password resets or typical admin auditing.

Answer

Creating a new custom user account with an elevated administrative role and a static password that never expires.

Answer

Injecting unauthorized security group membership changes directly into the on-premises Active Directory synchronized container.

Answer

Enabling device registration writeback to push malicious device objects from the cloud directory into local organizational units.

Question 12

You are conducting an internal penetration test for a client that uses Microsoft Entra ID (Azure AD) with on-premises Active Directory. You have obtained a low-privileged domain user's credentials. You want to enumerate Entra ID users and groups without triggering sign-in logs on the compromised user. Which of the following techniques would be MOST effective for this goal?

Accepted Answer

Query the on-premises Active Directory for objects synchronized to Entra ID using the user's existing domain access.. The objective is to enumerate Entra ID objects without creating sign-in logs on the compromised user. Querying on-premises Active Directory leverages the existing domain session and does not generate cloud authentication events. This method can reveal synchronized users and groups, providing valuable intelligence while maintaining operational security.

Answer

Authenticate to Microsoft Graph with the compromised user's credentials and enumerate users and groups.

Answer

Use the Azure AD Connect synchronization account to query the Microsoft Graph API.

Answer

Use the Microsoft Entra admin center with the compromised user's credentials to browse users and groups.

Question 13

During an internal penetration test of a hybrid Microsoft Entra ID environment, you compromise a standard on-premises user account. You notice that the account's on-premises userPrincipalName is jdoe@corp.local, but the corresponding cloud account has the userPrincipalName jdoe@corp.com. Which attribute should you modify on-premises to change the cloud sign-in address for this synchronized user?

Accepted Answer

userPrincipalName. In a hybrid Microsoft Entra ID environment, the on-premises userPrincipalName attribute is synchronized to the cloud as the user's sign-in name, provided the domain is verified. Changing this attribute to the desired cloud UPN will update the cloud sign-in address after synchronization. Other attributes like proxyAddresses, mail, and sAMAccountName do not control the cloud UPN.

Answer

sAMAccountName

Answer

proxyAddresses

Answer

mail

Question 14

During a penetration test of a Microsoft Entra ID environment, you discover that the tenant has self-service password reset (SSPR) enabled for all users. You have compromised a standard user account. Which of the following methods could you use to attempt to reset the password of a more privileged user via SSPR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It allows the on-premises user to authenticate to the cloud as the privileged user.. The ms-DS-ConsistencyGuid attribute is used as the source anchor when Microsoft Entra Connect is configured to use it. If an attacker can modify this attribute on an on-premises user to match the ImmutableID of a privileged cloud user, the next synchronization will link the on-premises account to the cloud account. The attacker can then authenticate to the cloud as the privileged user, achieving privilege escalation.

Answer

It allows the on-premises user to reset the privileged user's password.

Answer

It enables password hash synchronization for the privileged user.

Answer

It causes a synchronization error that prevents the user from logging in.

Question 15

You are conducting an internal penetration test for a client that uses Microsoft Entra ID with on-premises Active Directory. You have obtained Domain Admin credentials in the on-premises domain. The client has deployed Microsoft Entra Connect with Seamless Single Sign-On (SSO) enabled. Which of the following actions would allow you to authenticate as any synchronized user to cloud services like Microsoft 365 WITHOUT knowing their password?

Accepted Answer

Extract the AZUREADSSOACC computer account password hash from the on-premises Active Directory and forge Kerberos service tickets for the cloud service principal.. With Domain Admin privileges, an attacker can extract the password hash of the AZUREADSSOACC computer account, which is used for Seamless Single Sign-On. This hash allows forging Kerberos service tickets for the Microsoft Entra ID service principal, enabling authentication as any synchronized user without their password. This is a critical risk in hybrid identity configurations where Seamless SSO is enabled.

Answer

Retrieve the on-premises user's password hash from the domain controller and use it to authenticate to Microsoft Entra ID via password hash synchronization.

Answer

Leverage the Seamless SSO computer account to perform a Silver Ticket attack against the on-premises domain controller and then access cloud resources.

Answer

Use the Directory Synchronization Account credentials to modify the source anchor attribute of a targeted user to point to a new on-premises object.