GPEN Azure AD Integration — Timed 10 Questions

Question 1

An organization uses Azure AD Connect to synchronize on-premises identities. A security auditor discovers that password hash synchronization is enabled. What is the primary security implication of this feature in a hybrid environment?

10 minute time limit — choose an answer to begin.

Accepted Answer

It provides a mechanism for cloud-based authentication if the on-premises environment is offline.. Password hash synchronization (PHS) stores hashes in Microsoft Entra ID, allowing cloud-based authentication. While secure against plaintext exposure, it expands the attack surface to the cloud. If an attacker gains global administrator privileges in Azure, they could potentially extract or manipulate these hashes. This mechanism is critical for penetration testers to evaluate as it provides a pathway for persistent access across the hybrid identity boundary.

Answer

It stores plaintext passwords in the Azure AD cloud repository.

Answer

It requires the on-premises domain controller to be directly accessible from the internet.

Answer

It forces all cloud users to reset their passwords every 90 days.

Question 2

Which TWO of the following configurations are considered best practices to secure the Azure AD Connect synchronization server?

Accepted Answer

Apply Tier 0 administrative boundaries to the server running the synchronization service.. Securing the sync server is vital because it holds the keys to the hybrid kingdom. Implementing Tier 0 administrative boundaries and restricting server access prevents attackers from using the sync agent to escalate privileges into the cloud. By treating the server as an extension of the domain controller, organizations significantly reduce the risk of lateral movement from the on-premises environment into the cloud tenant.

Answer

Grant the Azure AD Connect service account Global Administrator permissions.

Answer

Disable all logging to prevent attackers from viewing synchronization activity.

Answer

Use a standard domain user account to run the Azure AD Connect local database.

Question 3

Refer to the exhibit. What is the primary security risk associated with the current configuration of the Conditional Access policy?

Accepted Answer

The exclusion of the break-glass account provides a potential bypass if credentials are compromised.. The policy displays a configuration that includes all users and all applications but explicitly excludes the 'Break Glass' account without any further constraints. While emergency access is necessary, failing to apply MFA requirements or specific location controls to this account makes it a high-value target. If an attacker identifies this account, it may bypass all secondary authentication, leading to complete tenant compromise.

Answer

The policy is currently in report-only mode and is not enforcing security.

Answer

Applying the policy to 'All Users' is a configuration error that blocks all authentication.

Answer

The policy requires a specific location constraint that is missing from the JSON.

Question 4

What is the security significance of the 'Domain Admin' group synchronization from on-premises to Azure AD?

Accepted Answer

It facilitates the movement of on-premises compromise to the cloud tenant.. Synchronizing highly privileged on-premises groups to the cloud often results in them being mapped to high-privilege roles within Microsoft Entra ID. If an attacker gains control over a Domain Admin account on-premises, they gain equivalent privileges in the cloud environment. This 'privilege escalation by design' is a dangerous consequence of poor directory synchronization scoping, making it a primary focus for auditors evaluating hybrid security.

Answer

It automatically assigns the Domain Admins the Global Administrator role.

Answer

It is required for the Azure AD Connect synchronization service to function correctly.

Answer

It allows cloud users to reset the passwords of on-premises Domain Admins.

Question 5

Refer to the exhibit. What is the most likely cause of this authentication failure?

Accepted Answer

The client application is using a legacy authentication protocol.. The error message contains two distinct pieces of information: a standard password failure and a Conditional Access trigger. The presence of 'Block_Legacy_Auth' indicates the user is attempting to authenticate using an outdated protocol that is explicitly disallowed by the security policy. Even if the credentials were correct, the policy would have blocked the request, highlighting the effectiveness of disabling legacy authentication.

Answer

The user is using an incorrect password.

Answer

The account has been locked due to excessive failed attempts.

Answer

The Azure AD Connect synchronization server is offline.

Question 6

Which TWO of the following are potential indicators of an Azure AD identity-based attack?

Accepted Answer

A user authenticating from two geographically distant locations in an impossible timeframe.. Detecting identity attacks requires monitoring for anomalous behavior that deviates from baseline activity. Impossible travel alerts and unusual user-agent strings are classic indicators of automated attacks. By maintaining robust logging and monitoring via tools like Microsoft Entra ID Protection, security teams can detect these patterns and respond to credential misuse before an attacker establishes a foothold in the environment.

Answer

A user logging in from their usual home office IP address during business hours.

Answer

A user performing a standard, scheduled task using a service account.

Answer

A successful login from a new device that was previously registered in the domain.

Question 7

During an internal penetration test against an organization utilizing hybrid identity, you compromise an on-premises Active Directory service account with DCSync privileges. You want to leverage this access to establish persistent access to Microsoft Entra ID (formerly Azure AD) without triggering standard on-premises password change alerts. Which method provides the most effective persistence mechanism leveraging hybrid synchronization mechanics?

Accepted Answer

Leverage synchronization account credentials to manipulate directory objects or establish a shadow administrator relationship via hybrid sync abuse. Extracting the on-premises password hash of the synchronization account or creating a malicious federation trust allows an attacker to forge tokens or manipulate directory objects. Because hybrid environments rely on synchronization services, compromising the sync account or establishing rogue federation bypasses traditional cloud password resets and integrates deeply into cloud authentication pipelines, making detection difficult for security operations teams monitoring standard user accounts.

Answer

Create a standard cloud-only Global Administrator account directly in the Azure portal using stolen credentials

Answer

Modify the on-premises user account password and force an immediate Azure AD Connect synchronization cycle

Answer

Inject a malicious application or service principal with high-privileged API permissions directly into the Microsoft Entra ID tenant

Question 8

You have gained execution on a workstation where a global administrator previously ran Azure CLI commands, leaving residual authentication tokens in the local user profile cache. You locate the refresh token files. What is the primary operational security limitation an attacker faces when attempting to replay these stolen Microsoft Entra ID refresh tokens from an external infrastructure IP address?

Accepted Answer

Microsoft Entra ID enforces token binding and conditional access policies that invalidate tokens used from anomalous IP addresses or untrusted devices. Microsoft Entra ID implements robust token binding and continuous access evaluation alongside IP restriction policies. When a refresh token is presented from an unrecognised IP address or external infrastructure lacking the expected device compliance markers or bound cryptographic material, the identity provider frequently rejects the request or triggers step-up multi-factor authentication, defeating simple replay attacks from attacker-controlled servers.

Answer

Refresh tokens lack cryptographic signatures and are immediately rejected by the token endpoint upon any modification

Answer

Refresh tokens expire strictly after exactly fifteen minutes regardless of activity or sliding window configurations

Answer

Azure CLI securely encrypts refresh tokens using the local user's plaintext password, making offline decryption mandatory before replay

Question 9

During a penetration test of a Microsoft Entra ID environment, you compromise a user account that has the 'Application Administrator' role. You aim to escalate privileges to Global Administrator by abusing this role. Which of the following actions would BEST achieve this objective?

Accepted Answer

Modify an existing application's required resource access to include the 'RoleManagement.ReadWrite.Directory' permission and grant admin consent.. An Application Administrator can manage application registrations, including their API permissions and admin consent. By adding the highly privileged 'RoleManagement.ReadWrite.Directory' permission to an application they control and granting consent, they can leverage that application's service principal to assign the Global Administrator role to a principal they control, effectively escalating privileges.

Answer

Assign the Global Administrator role to a managed identity and then use that identity to perform actions.

Answer

Use the Azure AD Connect synchronization account to create a new user with Global Administrator privileges.

Answer

Add a new credential to an existing application and use it to authenticate as a service principal with high privileges.

Question 10

You are assessing a Microsoft Entra ID environment integrated with on-premises Active Directory. You have obtained credentials for a user who is a member of the 'Azure AD Joined Device Local Administrator' role. Which TWO of the following actions can this user perform that could aid in further compromising the environment? (Choose two.)

Accepted Answer

Retrieve the local administrator password from Windows LAPS for Azure AD joined devices.. The 'Microsoft Entra ID Joined Device Local Administrator' role grants local administrator rights on Microsoft Entra ID joined devices. This allows the user to read BitLocker recovery keys stored in Entra ID and retrieve Windows LAPS passwords, both of which can provide access to encrypted drives and privileged local accounts, enabling further compromise. Other listed actions require different roles.

Answer

Add new devices to the Azure AD tenant.

Answer

Reset passwords for other users in the organization.

Answer

Modify conditional access policies.