The SecOps Group CCPenX-Az - Certified Cloud Pentesting eXpert - Azure
You’ve gained access to the Azure environment, now dig deeper. One of the accessible resources contains a hidden flag.
You find a SAS token in a table entity. The token starts with:
?sv=2025-01-05 & ss=b & srt=sco & sp=rl & se=2026-08-01T00:00:00Z
Which permissions does sp=rl grant?
A compromised principal has permission to list role assignments. Identify which user has the User Access Administrator role at the resource group scope.
Using a discovered SAS token with read/list permissions, enumerate blobs inside the sensitive-exports container. Which file contains credentials?
You have been given a breached Azure user credential for an authorized lab tenant:
james.ward@cloudcorpsec.onmicrosoft.com
After logging in, identify the Azure Tenant ID and Subscription ID associated with the account.
Using the previously gained access to the Azure environment, extract an access token from the Web App’s environment and use it to impersonate its Managed Identity. Which of the following roles is assigned to the Web App’s Security Principal?
From inside the App Service environment, request an Azure Resource Manager token using the managed identity endpoint. Which resource value should be requested for Azure Resource Manager access?
After gaining access to the Azure tenant, enumerate all resource groups available to the compromised user. One resource group contains the word prod. What is the name of that resource group?
A managed identity has Key Vault Secrets User access to kv-finance-prod. Enumerate secrets and retrieve the hidden flag.
