Using the previously retrieved credentials, authenticate as the App Registration within the tenant and enumerate potential lateral movement vectors. Which of the following roles is assigned to the App Registration?
Correct Answer: A
Detailed Solution:
Use the app registration credentials recovered from blob storage.
az login –service-principal \
-u ” \
-p ” \
–tenant f015f36d-c07f-41fb-9bde-fffc3a22ee8b
Confirm that you are authenticated as a service principal:
az account show
Now enumerate role assignments for the app registration.
az role assignment list \
–assignee ” \
–all \
–output table
If the –assignee lookup fails, first resolve the service principal object ID:
az ad sp show \
–id ” \
–query id \
–output tsv
Then query role assignments by object ID:
SP_OBJECT_ID=$(az ad sp show –id ” –query id -o tsv)
az role assignment list \
–assignee ‘$SP_OBJECT_ID’ \
–all \
–output table
The assigned role is:
Key Vault Secrets User
This role allows the principal to read secret values from Azure Key Vault. That is the lateral movement path into the final flag.
Final Answer:
A . Key Vault Secrets User
Using the previously gained access to the Azure environment, extract an access token from the Web App’s environment and use it to impersonate its Managed Identity. Which of the following roles is assigned to the Web App’s Security Principal?
Correct Answer: D
SIMULATION
You’ve discovered that the compromised user holds directory-level privileges. Enumerate how this role can be abused to compromise another user in the directory. What is the Job Title attribute of the compromised target user?
Correct Answer: A
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Detailed Solution:
As the second compromised user, enumerate directory users:
az ad user list –output table
Use a cleaner query to show names, UPNs, and job titles:
az ad user list \
–query ‘[].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle}’ \
–output table
You should identify a target user whose profile contains a flag in the jobTitle attribute.
The important target is:
lila.nguyen@azuresecops.onmicrosoft.com
Her jobTitle field contains:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Because the compromised user has User Administrator, you can reset this target user’s password and later authenticate as her.
Final Answer:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Prep2Certsis a premium service offering a comprehensive collection of exam questions and answers for over 1400 certification exams. It is regularly updated and designed to help users pass their certification exams confidently.
Please contact info@Prep2Certs.com and we will provide you with alternative payment options.
You can by Contacting our sales team.