GPEN Azure AD Integration — Timed 20 Questions

Question 1

An organization uses Azure AD Connect to synchronize on-premises identities. A security auditor discovers that password hash synchronization is enabled. What is the primary security implication of this feature in a hybrid environment?

20 minute time limit — choose an answer to begin.

Accepted Answer

It provides a mechanism for cloud-based authentication if the on-premises environment is offline.. Password hash synchronization (PHS) stores hashes in Microsoft Entra ID, allowing cloud-based authentication. While secure against plaintext exposure, it expands the attack surface to the cloud. If an attacker gains global administrator privileges in Azure, they could potentially extract or manipulate these hashes. This mechanism is critical for penetration testers to evaluate as it provides a pathway for persistent access across the hybrid identity boundary.

Answer

It stores plaintext passwords in the Azure AD cloud repository.

Answer

It requires the on-premises domain controller to be directly accessible from the internet.

Answer

It forces all cloud users to reset their passwords every 90 days.

Question 2

Which TWO of the following configurations are considered best practices to secure the Azure AD Connect synchronization server?

Accepted Answer

Apply Tier 0 administrative boundaries to the server running the synchronization service.. Securing the sync server is vital because it holds the keys to the hybrid kingdom. Implementing Tier 0 administrative boundaries and restricting server access prevents attackers from using the sync agent to escalate privileges into the cloud. By treating the server as an extension of the domain controller, organizations significantly reduce the risk of lateral movement from the on-premises environment into the cloud tenant.

Answer

Grant the Azure AD Connect service account Global Administrator permissions.

Answer

Disable all logging to prevent attackers from viewing synchronization activity.

Answer

Use a standard domain user account to run the Azure AD Connect local database.

Question 3

Refer to the exhibit. What is the primary security risk associated with the current configuration of the Conditional Access policy?

Accepted Answer

The exclusion of the break-glass account provides a potential bypass if credentials are compromised.. The policy displays a configuration that includes all users and all applications but explicitly excludes the 'Break Glass' account without any further constraints. While emergency access is necessary, failing to apply MFA requirements or specific location controls to this account makes it a high-value target. If an attacker identifies this account, it may bypass all secondary authentication, leading to complete tenant compromise.

Answer

The policy is currently in report-only mode and is not enforcing security.

Answer

Applying the policy to 'All Users' is a configuration error that blocks all authentication.

Answer

The policy requires a specific location constraint that is missing from the JSON.

Question 4

What is the security significance of the 'Domain Admin' group synchronization from on-premises to Azure AD?

Accepted Answer

It facilitates the movement of on-premises compromise to the cloud tenant.. Synchronizing highly privileged on-premises groups to the cloud often results in them being mapped to high-privilege roles within Microsoft Entra ID. If an attacker gains control over a Domain Admin account on-premises, they gain equivalent privileges in the cloud environment. This 'privilege escalation by design' is a dangerous consequence of poor directory synchronization scoping, making it a primary focus for auditors evaluating hybrid security.

Answer

It automatically assigns the Domain Admins the Global Administrator role.

Answer

It is required for the Azure AD Connect synchronization service to function correctly.

Answer

It allows cloud users to reset the passwords of on-premises Domain Admins.

Question 5

Refer to the exhibit. What is the most likely cause of this authentication failure?

Accepted Answer

The client application is using a legacy authentication protocol.. The error message contains two distinct pieces of information: a standard password failure and a Conditional Access trigger. The presence of 'Block_Legacy_Auth' indicates the user is attempting to authenticate using an outdated protocol that is explicitly disallowed by the security policy. Even if the credentials were correct, the policy would have blocked the request, highlighting the effectiveness of disabling legacy authentication.

Answer

The user is using an incorrect password.

Answer

The account has been locked due to excessive failed attempts.

Answer

The Azure AD Connect synchronization server is offline.

Question 6

Which TWO of the following are potential indicators of an Azure AD identity-based attack?

Accepted Answer

A user authenticating from two geographically distant locations in an impossible timeframe.. Detecting identity attacks requires monitoring for anomalous behavior that deviates from baseline activity. Impossible travel alerts and unusual user-agent strings are classic indicators of automated attacks. By maintaining robust logging and monitoring via tools like Microsoft Entra ID Protection, security teams can detect these patterns and respond to credential misuse before an attacker establishes a foothold in the environment.

Answer

A user logging in from their usual home office IP address during business hours.

Answer

A user performing a standard, scheduled task using a service account.

Answer

A successful login from a new device that was previously registered in the domain.

Question 7

During an internal penetration test against an organization utilizing hybrid identity, you compromise an on-premises Active Directory service account with DCSync privileges. You want to leverage this access to establish persistent access to Microsoft Entra ID (formerly Azure AD) without triggering standard on-premises password change alerts. Which method provides the most effective persistence mechanism leveraging hybrid synchronization mechanics?

Accepted Answer

Leverage synchronization account credentials to manipulate directory objects or establish a shadow administrator relationship via hybrid sync abuse. Extracting the on-premises password hash of the synchronization account or creating a malicious federation trust allows an attacker to forge tokens or manipulate directory objects. Because hybrid environments rely on synchronization services, compromising the sync account or establishing rogue federation bypasses traditional cloud password resets and integrates deeply into cloud authentication pipelines, making detection difficult for security operations teams monitoring standard user accounts.

Answer

Create a standard cloud-only Global Administrator account directly in the Azure portal using stolen credentials

Answer

Modify the on-premises user account password and force an immediate Azure AD Connect synchronization cycle

Answer

Inject a malicious application or service principal with high-privileged API permissions directly into the Microsoft Entra ID tenant

Question 8

You have gained execution on a workstation where a global administrator previously ran Azure CLI commands, leaving residual authentication tokens in the local user profile cache. You locate the refresh token files. What is the primary operational security limitation an attacker faces when attempting to replay these stolen Microsoft Entra ID refresh tokens from an external infrastructure IP address?

Accepted Answer

Microsoft Entra ID enforces token binding and conditional access policies that invalidate tokens used from anomalous IP addresses or untrusted devices. Microsoft Entra ID implements robust token binding and continuous access evaluation alongside IP restriction policies. When a refresh token is presented from an unrecognised IP address or external infrastructure lacking the expected device compliance markers or bound cryptographic material, the identity provider frequently rejects the request or triggers step-up multi-factor authentication, defeating simple replay attacks from attacker-controlled servers.

Answer

Refresh tokens lack cryptographic signatures and are immediately rejected by the token endpoint upon any modification

Answer

Refresh tokens expire strictly after exactly fifteen minutes regardless of activity or sliding window configurations

Answer

Azure CLI securely encrypts refresh tokens using the local user's plaintext password, making offline decryption mandatory before replay

Question 9

During a penetration test of a Microsoft Entra ID environment, you compromise a user account that has the 'Application Administrator' role. You aim to escalate privileges to Global Administrator by abusing this role. Which of the following actions would BEST achieve this objective?

Accepted Answer

Modify an existing application's required resource access to include the 'RoleManagement.ReadWrite.Directory' permission and grant admin consent.. An Application Administrator can manage application registrations, including their API permissions and admin consent. By adding the highly privileged 'RoleManagement.ReadWrite.Directory' permission to an application they control and granting consent, they can leverage that application's service principal to assign the Global Administrator role to a principal they control, effectively escalating privileges.

Answer

Assign the Global Administrator role to a managed identity and then use that identity to perform actions.

Answer

Use the Azure AD Connect synchronization account to create a new user with Global Administrator privileges.

Answer

Add a new credential to an existing application and use it to authenticate as a service principal with high privileges.

Question 10

You are assessing a Microsoft Entra ID environment integrated with on-premises Active Directory. You have obtained credentials for a user who is a member of the 'Azure AD Joined Device Local Administrator' role. Which TWO of the following actions can this user perform that could aid in further compromising the environment? (Choose two.)

Accepted Answer

Retrieve the local administrator password from Windows LAPS for Azure AD joined devices.. The 'Microsoft Entra ID Joined Device Local Administrator' role grants local administrator rights on Microsoft Entra ID joined devices. This allows the user to read BitLocker recovery keys stored in Entra ID and retrieve Windows LAPS passwords, both of which can provide access to encrypted drives and privileged local accounts, enabling further compromise. Other listed actions require different roles.

Answer

Add new devices to the Azure AD tenant.

Answer

Reset passwords for other users in the organization.

Answer

Modify conditional access policies.

Question 11

You have obtained a refresh token for a user via a compromised device in a Microsoft Entra ID integrated environment. You want to maintain persistent access to Microsoft Graph even after the user's password is changed. Which of the following actions should you take?

Accepted Answer

Register a new application with high privileges and grant it admin consent.. Registering a new application with high privileges and granting admin consent creates a service principal that can access Microsoft Graph with permissions that do not expire with the user's password. This is a stealthy persistence method because the application can be configured to have long-lived credentials or use certificate-based authentication, and it may not be immediately noticed.

Answer

Add a new credential to an existing application.

Answer

Use the refresh token to request a new access token.

Answer

Create a new user account with Global Administrator role.

Question 12

You are conducting a penetration test against a Microsoft Entra ID tenant that has Seamless Single Sign-On (SSO) enabled with Azure AD Connect. You have obtained a valid domain user's cleartext credentials. You need to obtain a Kerberos service ticket for the Azure AD Connect computer account to abuse the Seamless SSO feature. Which tool and command should you use?

Accepted Answer

Use Rubeus with the command `Rubeus.exe asktgs /service:AZUREADSSOACC$ /user:user /password:password` to request a service ticket.. Abusing Seamless SSO requires obtaining a Kerberos service ticket for the AZUREADSSOACC computer account, which holds the decryption key for the Seamless SSO trust. Rubeus with the asktgs command can request such a ticket using valid domain user credentials. Once obtained, the ticket can be used to forge Silver Tickets and impersonate any user in the Entra ID tenant, leading to privilege escalation.

Answer

Use Mimikatz with the command `sekurlsa::pth /user:user /domain:domain /ntlm:hash` to inject credentials.

Answer

Use Impacket's GetUserSPNs.py to request a service ticket for the AZUREADSSOACC account.

Answer

Use Rubeus with the command `Rubeus.exe tgtdeleg` to request a delegation ticket.

Question 13

During a penetration test of a Microsoft Entra ID environment, you discover that a custom domain (e.g., corp.com) is not verified in the tenant. However, an on-premises user has a userPrincipalName that uses this unverified domain. What is the effect on the synchronized cloud userPrincipalName for this user?

Accepted Answer

The cloud userPrincipalName will be set to the user's primary SMTP address.. When an on-premises userPrincipalName uses an unverified domain, Microsoft Entra Connect automatically sets the cloud userPrincipalName to the user's primary SMTP address. This ensures that the cloud UPN uses a verified domain. This behavior is important for penetration testers to understand because it can affect how accounts are identified and potentially targeted.

Answer

The cloud userPrincipalName will be set to the user's on-premises userPrincipalName with the unverified domain.

Answer

The cloud userPrincipalName will be set to a random string followed by the default domain.

Answer

The synchronization will fail, and the user will not be created in Microsoft Entra ID.

Question 14

A penetration tester is assessing a Microsoft Entra ID environment that uses Password Hash Synchronization (PHS) with Azure AD Connect. The tester has obtained the hash of a user's password from the on-premises Active Directory. Which attack can the tester perform to authenticate as the user in Entra ID without cracking the hash?

Accepted Answer

Pass-the-Hash attack using the user's NTLM hash.. Password Hash Synchronization synchronizes the on-premises NTLM hash to Entra ID, enabling Pass-the-Hash attacks. An attacker with the NTLM hash can authenticate as the user to Entra ID services that accept NTLM, such as Exchange Online via legacy protocols. This bypasses the need to crack the hash and demonstrates a significant risk of PHS.

Answer

Golden Ticket attack using the KRBTGT hash.

Answer

Pass-the-Ticket attack using the user's Kerberos TGT.

Answer

Kerberoasting attack to request a service ticket for the user.

Question 15

During a penetration test of a Microsoft Entra ID environment integrated with on-premises Active Directory, you have compromised a workstation and extracted credentials of a user who is a member of the 'Azure AD Joined Device Local Administrator' role. You now want to escalate privileges to Global Administrator. Which TWO of the following methods could you use to achieve this? (Choose two.)

Accepted Answer

Use the user's credentials to access the Azure AD Connect server and extract the credentials of the AD DS Connector account, then use those to perform a DCSync attack and obtain the KRBTGT hash.. Privilege escalation from 'Microsoft Entra ID Joined Device Local Administrator' to Global Administrator can be achieved by compromising the Microsoft Entra Connect server to extract the AD DS Connector account and perform DCSync, or by abusing application permissions to grant 'Directory.ReadWrite.All' and assign roles. These methods exploit the trust between on-premises and cloud environments and the permissions model in Entra ID.

Answer

Exploit the user's ability to reset the password of a Global Administrator account through the Azure AD Connect synchronization service.

Answer

Abuse the user's membership in the 'Azure AD Joined Device Local Administrator' role to add a new device to Entra ID and then use that device to request a Primary Refresh Token (PRT) for a Global Administrator.

Answer

Use the compromised user's credentials to authenticate to Azure AD Graph API and modify the role assignment of the user to Global Administrator.

Question 16

During a penetration test of a Microsoft Entra ID environment, you discover that the tenant has self-service password reset (SSPR) enabled for all users. You have compromised a standard user account. Which of the following methods could you use to attempt to reset the password of a more privileged user via SSPR?

Accepted Answer

Exploit a misconfiguration where the privileged user has registered a weak authentication method, such as a phone number that you control, and use it to reset their password.. SSPR can be abused if a privileged user has registered an authentication method that an attacker can control, such as a phone number. By initiating a password reset for the privileged user and intercepting the verification code, the attacker can reset the password. This highlights the risk of weak or compromised authentication methods in SSPR-enabled environments.

Answer

Enumerate the authentication methods registered for the privileged user and attempt to answer their security questions by guessing common answers.

Answer

Use the compromised user's access to read the privileged user's registered authentication methods via Microsoft Graph, then attempt to reset the password by satisfying those methods.

Answer

Leverage the compromised user's session to access the Azure AD SSPR portal and attempt to reset the privileged user's password by answering their security questions.

Question 17

You are performing a penetration test on a Microsoft Entra ID tenant that uses federated authentication with Active Directory Federation Services (AD FS). You have compromised a user account in the on-premises domain. Which of the following actions would allow you to authenticate as a different user in the cloud without knowing their password?

Accepted Answer

Extract the AD FS token-signing certificate from the AD FS server and forge SAML tokens for any user in the domain.. In a federated authentication setup with AD FS, Microsoft Entra ID trusts SAML tokens signed by the AD FS token-signing certificate. If an attacker extracts the private key of this certificate, they can forge tokens for any user, enabling authentication as privileged users without their passwords. This is a well-known attack path and highlights the importance of protecting the token-signing certificate.

Answer

Use the compromised user's credentials to access the AD FS server and modify the claim rules to include a claim that grants administrative access in Microsoft Entra ID.

Answer

Perform a pass-the-hash attack using the compromised user's NTLM hash to authenticate to the AD FS server, then request a SAML token for a privileged user.

Answer

Modify the on-premises user's 'msDS-KeyCredentialLink' attribute to add a rogue key credential, then authenticate to Microsoft Entra ID using the corresponding private key.

Question 18

During an assessment, you discover a federated identity setup using AD FS. What is a common security risk associated with the reliance on the token-signing certificate in this architecture?

Accepted Answer

Compromise of the private signing key allows for the creation of unauthorized authentication tokens.. The token-signing certificate is the foundation of trust in a federated environment. If an attacker compromises the private key of this certificate, they can forge SAML tokens for any user in the directory. This bypasses Multi-Factor Authentication and allows for complete identity impersonation, making the protection of the AD FS server and its associated secrets a critical objective for both defenders and attackers.

Answer

The certificate is public knowledge and can be used to decrypt all cloud traffic.

Answer

AD FS requires the certificate to be stored in an unsecured plaintext file on the web server.

Answer

The relying party cannot verify the identity if the certificate expires.

Question 19

When analyzing a hybrid identity environment, you notice the use of 'Seamless Single Sign-On'. What is the potential impact if the 'AZUREADSSOACC' computer object in the on-premises Active Directory is compromised?

Accepted Answer

The attacker can generate valid Kerberos tickets to facilitate cloud authentication.. The AZUREADSSOACC object is a computer account created in AD with a Kerberos service principal name. If compromised, an attacker can request Kerberos tickets to impersonate users or potentially extract the decryption key. This allows the attacker to silently authenticate as others to the cloud, bypassing the need for secondary checks, making it a critical pivot point in hybrid identity attacks.

Answer

The attacker can directly modify the Azure AD tenant settings.

Answer

The attacker can permanently disable synchronization between on-premises and cloud.

Answer

All password hash synchronization processes will immediately cease.

Question 20

Which of the following describes the risk of 'Guest User' accounts in an Azure AD integration scenario?

Accepted Answer

Guest users can potentially enumerate directory objects unless restricted.. Guest accounts in Microsoft Entra ID often have default permissions that allow them to enumerate directory objects. If these guests are not properly scoped using 'External Collaboration Settings', an attacker can use a compromised guest account to map the internal organizational structure, identify high-value targets, and find misconfigured applications. This reconnaissance is often the first step in a broader, more successful targeted attack against the internal environment.

Answer

Guest users are automatically granted Global Administrator privileges.

Answer

Guest accounts can only be created by the Global Administrator.

Answer

Guest users are exempt from Conditional Access policies.