GPEN Azure Apps and Attacks Practice Test 1 — 15 Questions

Question 1

An attacker has compromised an Azure AD application with the 'User.Read.All' delegated permission. They seek to elevate privileges by abusing the 'onBehalfOf' flow. What is the primary requirement for this attack to succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The initial token must contain a valid 'oid' claim and have sufficient scopes for the downstream request.. The on-behalf-of flow allows a middle-tier application to exchange a user's token for a new token to access downstream services. Attackers exploit this by tricking a user into authenticating to a malicious app, which then uses the captured token to impersonate the user against sensitive APIs. Understanding this flow is critical for assessing how delegated permissions can be escalated beyond the initial scope intended by the service principal.

Answer

The application must be configured with a client secret that matches the user's password.

Answer

The resource application must explicitly trust the client application's Application ID.

Answer

The target API must be configured to use Managed Identities instead of Service Principals.

Question 2

Which TWO of the following actions are necessary for an attacker to perform a 'Consent Phishing' attack against an Azure AD tenant?

Accepted Answer

Registering a multi-tenant Azure AD application.. Consent phishing involves tricking users into granting malicious applications permissions to their data. The attacker must register an application in an Azure tenant and then convince users to authorize it. This bypasses conditional access policies if the attacker uses an app that users are permitted to consent to, making it a highly effective technique for persistent access in cloud environments without requiring administrative credentials.

Answer

Gaining Global Administrator privileges on the target tenant.

Answer

Modifying the tenant's Conditional Access policies to allow guest users.

Answer

Disabling Multi-Factor Authentication for the target users.

Question 3

Refer to the exhibit. Which security implication does this application configuration have regarding access control?

Accepted Answer

It enforces that users must have an explicit assignment to use the application.. The setting 'AppRoleAssignmentRequired' set to true forces the application to verify that a user has been explicitly assigned to the application via an AppRoleAssignment. This is a critical security control that prevents any user in the tenant from accessing the application by default, mitigating unauthorized access even if the application is multi-tenant and the user is authenticated.

Answer

It allows any user in the tenant to access the application without explicit assignment.

Answer

It automatically grants the User.Read scope to all users in the tenant.

Answer

It disables the need for OAuth2 consent for all users.

Question 4

An attacker finds an Azure Function with an improperly secured HTTP trigger. They want to enumerate the environment variables of the function. Which path is the most likely target for this enumeration?

Accepted Answer

/proc/self/environ. Azure Functions store configuration as environment variables, which are accessible to the process running the code. In vulnerable implementations where the function exposes sensitive data or allows for arbitrary code execution, an attacker can use the Kudu API or local environment inspection to read these variables, often uncovering database connection strings, API keys, or Managed Identity tokens that facilitate further lateral movement.

Answer

/admin/environment

Answer

/etc/azure/config

Answer

/api/config/secrets

Question 5

A developer has assigned a User-Assigned Managed Identity to an Azure App Service. The attacker successfully gains local file access to the App Service instance. How can they obtain an OAuth token for the Azure Resource Manager (ARM) API?

Accepted Answer

By invoking the Identity endpoint at 169.254.169.254/metadata/identity/oauth2/token.. Managed Identities provide an IMDS (Instance Metadata Service) endpoint at 169.254.169.254. By making a crafted request to this endpoint with the correct identity headers, an attacker can retrieve a valid OAuth access token for any resource, including ARM. This is a common post-exploitation technique where the attacker pivots from the App Service identity to perform management actions against the broader Azure subscription.

Answer

By querying the Kudu API with the App Service's 'WEBSITE_AUTH_TOKEN'.

Answer

By decrypting the 'appsettings.json' file in the root directory.

Answer

By brute-forcing the application's client secret from the environment variables.

Question 6

Which THREE of the following are common misconfigurations in Azure AD application registrations that lead to potential privilege escalation?

Accepted Answer

Granting 'Directory.ReadWrite.All' delegated permissions.. Microsoft Entra ID apps are frequent targets for attackers. Over-privileged scopes, unnecessary multi-tenancy, and exposed client secrets are the most common vectors. Attackers look for these misconfigurations to move from low-privileged application contexts to high-privileged directory roles or to gain unauthorized access to sensitive user data, bypassing standard tenant security controls.

Answer

Hardcoding the Application ID in the source code.

Answer

Using a self-signed certificate for the application's manifest.

Question 7

Refer to the exhibit. An Azure storage account has this policy applied to its blob container. What is the most significant security impact of this configuration?

Accepted Answer

It allows any identity assigned this policy to perform any operation on the storage account.. The policy grants full administrative 'Allow' access to all actions on all resources, which is essentially a 'super-user' wildcard permission. This effectively bypasses the Principle of Least Privilege and allows anyone with the identity associated with this policy to perform any destructive action, including deleting containers or modifying access control lists, leading to a total compromise of the data storage layer.

Answer

It enables anonymous read access to all blob data.

Answer

It forces the use of HTTPS for all incoming connections.

Answer

It restricts access to a specific VNet range.

Question 8

An attacker has compromised an Azure AD user account with MFA enabled. What is the most likely technique they will use to maintain access without constantly triggering MFA?

Accepted Answer

Generating a new OAuth refresh token to extend the session.. Attackers focus on stealing session cookies or using OAuth refresh tokens to bypass MFA. Once a session is established and the MFA challenge is completed, the resulting session token or refresh token can be used to authenticate the user session without re-prompting, effectively allowing the attacker to persist without needing further MFA interaction.

Answer

Disabling the user's MFA settings in the Azure Portal.

Answer

Registering a new MFA device on the user's account.

Answer

Injecting a malicious password hash into the directory.

Question 9

Which TWO of the following are valid methods to identify Azure AD applications that have excessive permissions in a production environment?

Accepted Answer

Reviewing the 'OAuth2Permissions' and 'AppRoles' in the application manifest.. Auditing application permissions is crucial for security. Using the Microsoft Graph API to programmatically review permissions or running Microsoft Entra ID identity protection reports helps identify over-privileged service principals. These methods allow security teams to proactively reduce the blast radius of a potential application compromise by revoking unused or overly broad delegated and application permissions.

Answer

Scanning the 'AppService' source code for hardcoded passwords.

Answer

Analyzing the Azure Activity Logs for login events.

Answer

Checking the storage account's access keys for the application.

Question 10

An attacker has gained access to an Azure VM with a System-Assigned Managed Identity. They find the IMDS endpoint is accessible. What prevents them from simply requesting a token for the Microsoft Graph API?

Accepted Answer

The Managed Identity lacks the necessary permissions assigned in the target API.. While the IMDS endpoint is accessible, the Managed Identity must still be granted specific RBAC or API permissions within the target resource (like Microsoft Graph). If the administrator has not granted the identity 'User.Read' or other Graph permissions, the token exchange will be successful, but the resulting token will be denied by the Graph API for any actual operations, effectively neutralizing the attack.

Answer

The IMDS endpoint requires a client secret to validate the request.

Answer

The IMDS endpoint is only reachable from within a VNet.

Answer

The Azure AD tenant disables Managed Identity by default.

Question 11

An attacker compromises a web application hosted in Azure App Service that utilizes a system-assigned managed identity to connect to an Azure SQL Database. How can the attacker pivot from the compromised web app to extract secrets or access backend resources?

Accepted Answer

Querying the Azure Instance Metadata Service (IMDS) local endpoint at http://169.254.169.254/metadata/identity/oauth2/token using an injected script or command execution shell.. Compromised Azure workloads hosting managed identities allow attackers to query the local Instance Metadata Service endpoint to retrieve OAuth access tokens. Recognizing this attack path is vital for penetration testers demonstrating the risk of server-side request forgery or remote code execution vulnerabilities.

Answer

Decrypting the application's Web.config file to retrieve the plaintext password associated with the system-assigned managed identity principal.

Answer

Extracting the master certificate from the local machine certificate store to forge administrative Kerberos tickets for the Azure domain.

Answer

Initiating a brute-force attack against the Azure Resource Manager public API using the public application ID found in the portal overview.

Question 12

An attacker has compromised an Azure App Service that uses a system-assigned managed identity. They want to use the managed identity to access an Azure Key Vault. Which two of the following steps are required to obtain and use the managed identity token from within the App Service? (Choose two.)

Accepted Answer

Query the IDENTITY_ENDPOINT and IDENTITY_HEADER environment variables to obtain the token endpoint and secret.. In Azure App Service, managed identity tokens are obtained by reading the IDENTITY_ENDPOINT and IDENTITY_HEADER environment variables, then making an HTTP GET request to the endpoint with the header and a resource parameter. This allows an attacker with code execution to get a token for the managed identity without Microsoft Entra ID credentials. The token can then be used to access resources like Key Vault that the identity has permissions for.

Answer

Retrieve the managed identity's client secret from the App Service configuration settings.

Answer

Call the Microsoft Graph API to generate an access token for the managed identity.

Answer

Use the Azure CLI command 'az login --identity' to authenticate and retrieve the token.

Question 13

During an Azure penetration test, you obtain an access token for a managed identity attached to an Azure VM. You want to use this token to access an Azure Key Vault that stores secrets. Which Azure CLI command correctly attempts to retrieve a secret from the Key Vault using the managed identity's token?

Accepted Answer

curl -H "Authorization: Bearer " https://.vault.azure.net/secrets/?api-version=7.2. Using a managed identity token to access Key Vault via the REST API with curl is a direct and effective method. The token must be obtained from the Instance Metadata Service (IMDS) and have the correct audience. This allows an attacker to retrieve secrets without needing Azure CLI authentication, making it a stealthy and powerful technique.

Answer

az keyvault secret show --vault-name --name --subscription

Answer

Invoke-RestMethod -Uri "https://.vault.azure.net/secrets/?api-version=7.2" -Headers @{Authorization="Bearer "}

Answer

az login --identity --username && az keyvault secret show --vault-name --name

Question 14

A penetration tester is assessing an Azure subscription where a web application is deployed to Azure App Service. The tester discovers that the App Service's system-assigned managed identity has been granted the 'Storage Blob Data Contributor' role on a storage account. The tester can execute arbitrary code on the App Service via a web shell. What is the most direct method to exfiltrate data from the storage account?

Accepted Answer

Use the Azure Instance Metadata Service (IMDS) to retrieve an access token for the managed identity, then call the Azure Storage REST API with that token.. The managed identity assigned to the App Service has the 'Storage Blob Data Contributor' role on the storage account, granting direct access. The most direct way to use that identity from within the App Service is to query the Instance Metadata Service (IMDS) for an OAuth2 token. That token can then be used to call the Azure Storage REST API. This avoids needing separate credentials or tools.

Answer

Extract the storage account key from the App Service's application settings and use it to access the storage account.

Answer

Retrieve the storage account's connection string from the Azure Key Vault that the App Service is configured to access.

Answer

Use the Azure CLI command 'az storage blob download' from the App Service's Kudu console, authenticating with the managed identity.

Question 15

A penetration tester is reviewing an Azure App Service configuration and notices that the application has a managed identity enabled. The tester wants to leverage this identity to access an Azure SQL Database. Which of the following is the most appropriate way to authenticate to the database using the managed identity?

Accepted Answer

Retrieve an access token from the Instance Metadata Service and use it in the connection string with 'Authentication=Active Directory Managed Identity'.. To authenticate to Azure SQL Database with a managed identity, the application must obtain an access token from the Instance Metadata Service (IMDS) and present it. The connection string can specify 'Authentication=Active Directory Managed Identity', which instructs the SQL client to fetch the token from IMDS automatically. This is the standard method for using managed identities with Azure SQL.

Answer

Use the managed identity's client ID and client secret to connect to the database.

Answer

Assign the managed identity to an Azure AD group that has access to the database, then use the group's credentials.

Answer

Configure the database firewall to allow the App Service's outbound IP address and use SQL authentication with a username and password.