GPEN Azure Apps and Attacks — All Questions With Answers

Question 1

An attacker has compromised an Azure AD application with the 'User.Read.All' delegated permission. They seek to elevate privileges by abusing the 'onBehalfOf' flow. What is the primary requirement for this attack to succeed?

Accepted Answer

The initial token must contain a valid 'oid' claim and have sufficient scopes for the downstream request.. The on-behalf-of flow allows a middle-tier application to exchange a user's token for a new token to access downstream services. Attackers exploit this by tricking a user into authenticating to a malicious app, which then uses the captured token to impersonate the user against sensitive APIs. Understanding this flow is critical for assessing how delegated permissions can be escalated beyond the initial scope intended by the service principal.

Answer

The application must be configured with a client secret that matches the user's password.

Answer

The resource application must explicitly trust the client application's Application ID.

Answer

The target API must be configured to use Managed Identities instead of Service Principals.

Question 2

Which TWO of the following actions are necessary for an attacker to perform a 'Consent Phishing' attack against an Azure AD tenant?

Accepted Answer

Registering a multi-tenant Azure AD application.. Consent phishing involves tricking users into granting malicious applications permissions to their data. The attacker must register an application in an Azure tenant and then convince users to authorize it. This bypasses conditional access policies if the attacker uses an app that users are permitted to consent to, making it a highly effective technique for persistent access in cloud environments without requiring administrative credentials.

Answer

Gaining Global Administrator privileges on the target tenant.

Answer

Modifying the tenant's Conditional Access policies to allow guest users.

Answer

Disabling Multi-Factor Authentication for the target users.

Question 3

Refer to the exhibit. Which security implication does this application configuration have regarding access control?

Accepted Answer

It enforces that users must have an explicit assignment to use the application.. The setting 'AppRoleAssignmentRequired' set to true forces the application to verify that a user has been explicitly assigned to the application via an AppRoleAssignment. This is a critical security control that prevents any user in the tenant from accessing the application by default, mitigating unauthorized access even if the application is multi-tenant and the user is authenticated.

Answer

It allows any user in the tenant to access the application without explicit assignment.

Answer

It automatically grants the User.Read scope to all users in the tenant.

Answer

It disables the need for OAuth2 consent for all users.

Question 4

An attacker finds an Azure Function with an improperly secured HTTP trigger. They want to enumerate the environment variables of the function. Which path is the most likely target for this enumeration?

Accepted Answer

/proc/self/environ. Azure Functions store configuration as environment variables, which are accessible to the process running the code. In vulnerable implementations where the function exposes sensitive data or allows for arbitrary code execution, an attacker can use the Kudu API or local environment inspection to read these variables, often uncovering database connection strings, API keys, or Managed Identity tokens that facilitate further lateral movement.

Answer

/admin/environment

Answer

/etc/azure/config

Answer

/api/config/secrets

Question 5

A developer has assigned a User-Assigned Managed Identity to an Azure App Service. The attacker successfully gains local file access to the App Service instance. How can they obtain an OAuth token for the Azure Resource Manager (ARM) API?

Accepted Answer

By invoking the Identity endpoint at 169.254.169.254/metadata/identity/oauth2/token.. Managed Identities provide an IMDS (Instance Metadata Service) endpoint at 169.254.169.254. By making a crafted request to this endpoint with the correct identity headers, an attacker can retrieve a valid OAuth access token for any resource, including ARM. This is a common post-exploitation technique where the attacker pivots from the App Service identity to perform management actions against the broader Azure subscription.

Answer

By querying the Kudu API with the App Service's 'WEBSITE_AUTH_TOKEN'.

Answer

By decrypting the 'appsettings.json' file in the root directory.

Answer

By brute-forcing the application's client secret from the environment variables.

Question 6

Which THREE of the following are common misconfigurations in Azure AD application registrations that lead to potential privilege escalation?

Accepted Answer

Granting 'Directory.ReadWrite.All' delegated permissions.. Microsoft Entra ID apps are frequent targets for attackers. Over-privileged scopes, unnecessary multi-tenancy, and exposed client secrets are the most common vectors. Attackers look for these misconfigurations to move from low-privileged application contexts to high-privileged directory roles or to gain unauthorized access to sensitive user data, bypassing standard tenant security controls.

Answer

Hardcoding the Application ID in the source code.

Answer

Using a self-signed certificate for the application's manifest.

Question 7

Refer to the exhibit. An Azure storage account has this policy applied to its blob container. What is the most significant security impact of this configuration?

Accepted Answer

It allows any identity assigned this policy to perform any operation on the storage account.. The policy grants full administrative 'Allow' access to all actions on all resources, which is essentially a 'super-user' wildcard permission. This effectively bypasses the Principle of Least Privilege and allows anyone with the identity associated with this policy to perform any destructive action, including deleting containers or modifying access control lists, leading to a total compromise of the data storage layer.

Answer

It enables anonymous read access to all blob data.

Answer

It forces the use of HTTPS for all incoming connections.

Answer

It restricts access to a specific VNet range.

Question 8

An attacker has compromised an Azure AD user account with MFA enabled. What is the most likely technique they will use to maintain access without constantly triggering MFA?

Accepted Answer

Generating a new OAuth refresh token to extend the session.. Attackers focus on stealing session cookies or using OAuth refresh tokens to bypass MFA. Once a session is established and the MFA challenge is completed, the resulting session token or refresh token can be used to authenticate the user session without re-prompting, effectively allowing the attacker to persist without needing further MFA interaction.

Answer

Disabling the user's MFA settings in the Azure Portal.

Answer

Registering a new MFA device on the user's account.

Answer

Injecting a malicious password hash into the directory.

Question 9

Which TWO of the following are valid methods to identify Azure AD applications that have excessive permissions in a production environment?

Accepted Answer

Reviewing the 'OAuth2Permissions' and 'AppRoles' in the application manifest.. Auditing application permissions is crucial for security. Using the Microsoft Graph API to programmatically review permissions or running Microsoft Entra ID identity protection reports helps identify over-privileged service principals. These methods allow security teams to proactively reduce the blast radius of a potential application compromise by revoking unused or overly broad delegated and application permissions.

Answer

Scanning the 'AppService' source code for hardcoded passwords.

Answer

Analyzing the Azure Activity Logs for login events.

Answer

Checking the storage account's access keys for the application.

Question 10

An attacker has gained access to an Azure VM with a System-Assigned Managed Identity. They find the IMDS endpoint is accessible. What prevents them from simply requesting a token for the Microsoft Graph API?

Accepted Answer

The Managed Identity lacks the necessary permissions assigned in the target API.. While the IMDS endpoint is accessible, the Managed Identity must still be granted specific RBAC or API permissions within the target resource (like Microsoft Graph). If the administrator has not granted the identity 'User.Read' or other Graph permissions, the token exchange will be successful, but the resulting token will be denied by the Graph API for any actual operations, effectively neutralizing the attack.

Answer

The IMDS endpoint requires a client secret to validate the request.

Answer

The IMDS endpoint is only reachable from within a VNet.

Answer

The Azure AD tenant disables Managed Identity by default.

Question 11

An attacker compromises a web application hosted in Azure App Service that utilizes a system-assigned managed identity to connect to an Azure SQL Database. How can the attacker pivot from the compromised web app to extract secrets or access backend resources?

Accepted Answer

Querying the Azure Instance Metadata Service (IMDS) local endpoint at http://169.254.169.254/metadata/identity/oauth2/token using an injected script or command execution shell.. Compromised Azure workloads hosting managed identities allow attackers to query the local Instance Metadata Service endpoint to retrieve OAuth access tokens. Recognizing this attack path is vital for penetration testers demonstrating the risk of server-side request forgery or remote code execution vulnerabilities.

Answer

Decrypting the application's Web.config file to retrieve the plaintext password associated with the system-assigned managed identity principal.

Answer

Extracting the master certificate from the local machine certificate store to forge administrative Kerberos tickets for the Azure domain.

Answer

Initiating a brute-force attack against the Azure Resource Manager public API using the public application ID found in the portal overview.

Question 12

An attacker has compromised an Azure App Service that uses a system-assigned managed identity. They want to use the managed identity to access an Azure Key Vault. Which two of the following steps are required to obtain and use the managed identity token from within the App Service? (Choose two.)

Accepted Answer

Query the IDENTITY_ENDPOINT and IDENTITY_HEADER environment variables to obtain the token endpoint and secret.. In Azure App Service, managed identity tokens are obtained by reading the IDENTITY_ENDPOINT and IDENTITY_HEADER environment variables, then making an HTTP GET request to the endpoint with the header and a resource parameter. This allows an attacker with code execution to get a token for the managed identity without Microsoft Entra ID credentials. The token can then be used to access resources like Key Vault that the identity has permissions for.

Answer

Retrieve the managed identity's client secret from the App Service configuration settings.

Answer

Call the Microsoft Graph API to generate an access token for the managed identity.

Answer

Use the Azure CLI command 'az login --identity' to authenticate and retrieve the token.

Question 13

During an Azure penetration test, you obtain an access token for a managed identity attached to an Azure VM. You want to use this token to access an Azure Key Vault that stores secrets. Which Azure CLI command correctly attempts to retrieve a secret from the Key Vault using the managed identity's token?

Accepted Answer

curl -H "Authorization: Bearer " https://.vault.azure.net/secrets/?api-version=7.2. Using a managed identity token to access Key Vault via the REST API with curl is a direct and effective method. The token must be obtained from the Instance Metadata Service (IMDS) and have the correct audience. This allows an attacker to retrieve secrets without needing Azure CLI authentication, making it a stealthy and powerful technique.

Answer

az keyvault secret show --vault-name --name --subscription

Answer

Invoke-RestMethod -Uri "https://.vault.azure.net/secrets/?api-version=7.2" -Headers @{Authorization="Bearer "}

Answer

az login --identity --username && az keyvault secret show --vault-name --name

Question 14

A penetration tester is assessing an Azure subscription where a web application is deployed to Azure App Service. The tester discovers that the App Service's system-assigned managed identity has been granted the 'Storage Blob Data Contributor' role on a storage account. The tester can execute arbitrary code on the App Service via a web shell. What is the most direct method to exfiltrate data from the storage account?

Accepted Answer

Use the Azure Instance Metadata Service (IMDS) to retrieve an access token for the managed identity, then call the Azure Storage REST API with that token.. The managed identity assigned to the App Service has the 'Storage Blob Data Contributor' role on the storage account, granting direct access. The most direct way to use that identity from within the App Service is to query the Instance Metadata Service (IMDS) for an OAuth2 token. That token can then be used to call the Azure Storage REST API. This avoids needing separate credentials or tools.

Answer

Extract the storage account key from the App Service's application settings and use it to access the storage account.

Answer

Retrieve the storage account's connection string from the Azure Key Vault that the App Service is configured to access.

Answer

Use the Azure CLI command 'az storage blob download' from the App Service's Kudu console, authenticating with the managed identity.

Question 15

A penetration tester is reviewing an Azure App Service configuration and notices that the application has a managed identity enabled. The tester wants to leverage this identity to access an Azure SQL Database. Which of the following is the most appropriate way to authenticate to the database using the managed identity?

Accepted Answer

Retrieve an access token from the Instance Metadata Service and use it in the connection string with 'Authentication=Active Directory Managed Identity'.. To authenticate to Azure SQL Database with a managed identity, the application must obtain an access token from the Instance Metadata Service (IMDS) and present it. The connection string can specify 'Authentication=Active Directory Managed Identity', which instructs the SQL client to fetch the token from IMDS automatically. This is the standard method for using managed identities with Azure SQL.

Answer

Use the managed identity's client ID and client secret to connect to the database.

Answer

Assign the managed identity to an Azure AD group that has access to the database, then use the group's credentials.

Answer

Configure the database firewall to allow the App Service's outbound IP address and use SQL authentication with a username and password.

Question 16

During a penetration test of an Azure environment, you obtain a low-privileged user account. You discover the user can read the properties of a managed identity attached to an Azure VM. You want to leverage this managed identity to access an Azure Key Vault that stores secrets. Which of the following steps is the most direct way to obtain an access token for the managed identity?

Accepted Answer

Query the Azure Instance Metadata Service (IMDS) endpoint from the VM to request a token for the Key Vault resource.. Managed identities in Azure authenticate by requesting tokens from the Instance Metadata Service (IMDS) available at a link-local address. When an attacker gains code execution on a VM with a managed identity, they can query IMDS to obtain access tokens for resources like Key Vault. This is a common privilege escalation path. The other options either require being on the VM, involve non-existent secrets, or misuse APIs.

Answer

Use the Azure CLI command 'az login --identity' from the attacker's workstation to authenticate as the managed identity.

Answer

Call the Microsoft Graph API endpoint '/servicePrincipals' to generate an access token for the managed identity.

Answer

Retrieve the managed identity's client secret from the Azure AD application registration and use it with the OAuth 2.0 client credentials flow.

Question 17

A penetration tester is assessing an Azure App Service web application. The application uses an App Service Environment (ASE) and has a system-assigned managed identity. The tester discovers that the application has an SSRF vulnerability that allows making HTTP requests to internal endpoints. Which of the following internal endpoints could the tester target to retrieve an access token for the managed identity?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token. The Instance Metadata Service (IMDS) is accessible at the link-local IP 169.254.169.254. In Azure App Service, the same endpoint is used to obtain managed identity tokens. An SSRF vulnerability can be exploited to make a request to this endpoint with the appropriate parameters, such as resource=https://vault.azure.net, to retrieve a token. This token can then be used to access Azure resources. The other endpoints are either incorrect paths or non-existent.

Answer

http://169.254.169.254/metadata/v1/identity/oauth2/token

Answer

http://localhost:8080/msi/token

Answer

http://[::ffff:169.254.169.254]/metadata/identity/oauth2/token

Question 18

An attacker has gained access to an Azure AD application with the 'Directory.Read.All' permission. They want to escalate privileges by adding a new credential to a highly privileged service principal. Which two of the following steps are necessary to achieve this? (Choose two.)

Accepted Answer

Authenticate as the target service principal using the newly added credential.. To escalate privileges by adding a credential to a service principal, the attacker must first add a new password credential using the Microsoft Graph API (or similar), and then authenticate as that service principal using the new credential. This allows them to obtain tokens with the service principal's permissions. The other actions are either not necessary or would require higher privileges than the attacker has.

Answer

Use the Azure CLI 'az ad sp credential reset' command to reset the service principal's credentials.

Answer

Assign the 'Global Administrator' role to the attacker's user account.

Answer

Modify the service principal's application registration to add a new redirect URI.

Question 19

An attacker is performing reconnaissance on an Azure AD tenant and notices that 'Guest' users can enumerate the directory. Which specific setting should be checked to remediate this?

Accepted Answer

External collaboration settings for Guest user access restrictions.. By default, Microsoft Entra ID allows guest users to see other users and groups in the directory. This is a common reconnaissance vector for attackers to map the organization's structure. Restricting this access is a critical step in hardening the tenant, ensuring that guest identities have limited visibility into the internal organizational structure during an initial compromise.

Answer

Conditional Access policy for guest users.

Answer

The 'Enable Global Reader' role for guests.

Answer

The 'AppRoleAssignmentRequired' property of the tenant.

Question 20

When conducting a penetration test on an Azure App Service, you discover an 'environment.js' file in the public directory containing a 'CLIENT_ID'. What is the risk associated with this finding?

Accepted Answer

The attacker can use the Client ID to construct a tailored consent-phishing URL.. Client IDs are public and not secrets in themselves. However, exposing them can reveal the application's configuration and identifier, which an attacker can then use to craft malicious authorization requests. If the application is misconfigured to allow unauthorized consent or has other vulnerabilities, the Client ID acts as the starting point for a targeted phishing or consent-based attack against the organization's users.

Answer

The attacker can use the Client ID to authenticate as the application.

Answer

The attacker can use the Client ID to reset the application's password.

Answer

The attacker can use the Client ID to bypass MFA for the application.

GPEN Azure Apps and Attacks — All Questions With Answers

An attacker has compromised an Azure AD application with the 'User.Read.All' delegated permission. They seek to elevate privileges by abusing the 'onBehalfOf' flow. What is the primary requirement for this attack to succeed?

Which TWO of the following actions are necessary for an attacker to perform a 'Consent Phishing' attack against an Azure AD tenant?

Refer to the exhibit. Which security implication does this application configuration have regarding access control?

Exhibit

An attacker finds an Azure Function with an improperly secured HTTP trigger. They want to enumerate the environment variables of the function. Which path is the most likely target for this enumeration?

A developer has assigned a User-Assigned Managed Identity to an Azure App Service. The attacker successfully gains local file access to the App Service instance. How can they obtain an OAuth token for the Azure Resource Manager (ARM) API?

Which THREE of the following are common misconfigurations in Azure AD application registrations that lead to potential privilege escalation?

Refer to the exhibit. An Azure storage account has this policy applied to its blob container. What is the most significant security impact of this configuration?

Exhibit

An attacker has compromised an Azure AD user account with MFA enabled. What is the most likely technique they will use to maintain access without constantly triggering MFA?

Which TWO of the following are valid methods to identify Azure AD applications that have excessive permissions in a production environment?

An attacker has gained access to an Azure VM with a System-Assigned Managed Identity. They find the IMDS endpoint is accessible. What prevents them from simply requesting a token for the Microsoft Graph API?

An attacker compromises a web application hosted in Azure App Service that utilizes a system-assigned managed identity to connect to an Azure SQL Database. How can the attacker pivot from the compromised web app to extract secrets or access backend resources?

An attacker has compromised an Azure App Service that uses a system-assigned managed identity. They want to use the managed identity to access an Azure Key Vault. Which two of the following steps are required to obtain and use the managed identity token from within the App Service? (Choose two.)

An attacker has gained access to an Azure AD application with the 'Directory.Read.All' permission. They want to escalate privileges by adding a new credential to a highly privileged service principal. Which two of the following steps are necessary to achieve this? (Choose two.)

An attacker is performing reconnaissance on an Azure AD tenant and notices that 'Guest' users can enumerate the directory. Which specific setting should be checked to remediate this?

When conducting a penetration test on an Azure App Service, you discover an 'environment.js' file in the public directory containing a 'CLIENT_ID'. What is the risk associated with this finding?

Which of the following describes the risk of 'App Role' over-assignment in Azure AD?

During an Azure penetration test, you discover an App Registration with an expired client secret that still has active refresh tokens issued prior to expiration. The application holds high-privilege directory roles. How do these leaked refresh tokens behave regarding Azure AD security boundaries?

Refer to the exhibit. During an Azure engagement, you query a service principal via the Microsoft Graph API and notice that 'appRoleAssignmentRequired' is set to 'false'. What security implication does this setting present for enterprise applications?

A penetration tester is assessing an Azure environment and discovers a function app with an HTTP trigger that does not require authentication. The function app has a system-assigned managed identity with Contributor role on the subscription. What is the most immediate risk?

GPEN Azure Apps and Attacks — All Questions With Answers

An attacker has compromised an Azure AD application with the 'User.Read.All' delegated permission. They seek to elevate privileges by abusing the 'onBehalfOf' flow. What is the primary requirement for this attack to succeed?

Which TWO of the following actions are necessary for an attacker to perform a 'Consent Phishing' attack against an Azure AD tenant?

Refer to the exhibit. Which security implication does this application configuration have regarding access control?

Exhibit

An attacker finds an Azure Function with an improperly secured HTTP trigger. They want to enumerate the environment variables of the function. Which path is the most likely target for this enumeration?

A developer has assigned a User-Assigned Managed Identity to an Azure App Service. The attacker successfully gains local file access to the App Service instance. How can they obtain an OAuth token for the Azure Resource Manager (ARM) API?

Which THREE of the following are common misconfigurations in Azure AD application registrations that lead to potential privilege escalation?

Refer to the exhibit. An Azure storage account has this policy applied to its blob container. What is the most significant security impact of this configuration?

Exhibit

An attacker has compromised an Azure AD user account with MFA enabled. What is the most likely technique they will use to maintain access without constantly triggering MFA?

Which TWO of the following are valid methods to identify Azure AD applications that have excessive permissions in a production environment?

An attacker has gained access to an Azure VM with a System-Assigned Managed Identity. They find the IMDS endpoint is accessible. What prevents them from simply requesting a token for the Microsoft Graph API?

An attacker compromises a web application hosted in Azure App Service that utilizes a system-assigned managed identity to connect to an Azure SQL Database. How can the attacker pivot from the compromised web app to extract secrets or access backend resources?

An attacker has compromised an Azure App Service that uses a system-assigned managed identity. They want to use the managed identity to access an Azure Key Vault. Which two of the following steps are required to obtain and use the managed identity token from within the App Service? (Choose two.)

An attacker has gained access to an Azure AD application with the 'Directory.Read.All' permission. They want to escalate privileges by adding a new credential to a highly privileged service principal. Which two of the following steps are necessary to achieve this? (Choose two.)

An attacker is performing reconnaissance on an Azure AD tenant and notices that 'Guest' users can enumerate the directory. Which specific setting should be checked to remediate this?

When conducting a penetration test on an Azure App Service, you discover an 'environment.js' file in the public directory containing a 'CLIENT_ID'. What is the risk associated with this finding?

Which of the following describes the risk of 'App Role' over-assignment in Azure AD?

During an Azure penetration test, you discover an App Registration with an expired client secret that still has active refresh tokens issued prior to expiration. The application holds high-privilege directory roles. How do these leaked refresh tokens behave regarding Azure AD security boundaries?

Refer to the exhibit. During an Azure engagement, you query a service principal via the Microsoft Graph API and notice that 'appRoleAssignmentRequired' is set to 'false'. What security implication does this setting present for enterprise applications?

A penetration tester is assessing an Azure environment and discovers a function app with an HTTP trigger that does not require authentication. The function app has a system-assigned managed identity with Contributor role on the subscription. What is the most immediate risk?