NEW QUESTION 14
A storage account allows public blob access. Enumerate containers and identify the public container that exposes backup files.

NEW QUESTION 15
After gaining access to the Azure tenant, enumerate all resource groups available to the compromised user.
One resource group contains the word prod. What is the name of that resource group?

NEW QUESTION 16
You’ve discovered that the compromised user holds directory-level privileges. Enumerate how this role can be abused to compromise another user in the directory. What is the Job Title attribute of the compromised target user?

NEW QUESTION 17
Carefully enumerate the accessible Azure Blob Container to locate a file containing credentials for an App Registration within the tenant. What is the Application/Client ID of the discovered App Registration?

NEW QUESTION 18
ExcaliburCorp has recently migrated part of its infrastructure to Microsoft Azure. Shortly after the migration, the company suffered a security breach resulting in the exposure of sensitive internal data. Their investigation revealed that the attack originated from a disgruntled developer who has since disappeared. To assess and mitigate further risks, ExcaliburCorp has granted you access to a replica Azure environment with the same permissions the developer had at the time of the incident. Your task is to simulate the attacker’s actions, uncover the full extent of the compromise, and identify vulnerable configurations or services that enabled the breach.
Using the provided Azure login credentials, perform OSINT and reconnaissance to identify the Azure Active Directory/AAD Tenant ID associated with the environment.

NEW QUESTION 19
A compromised developer account has Reader access to a resource group. Enumerate all Azure resources in that resource group and identify the exposed App Service name.

NEW QUESTION 20
Inside the public blob container, a file named backup-config.json contains service principal credentials. What field contains the App Registration client ID?

NEW QUESTION 21
From inside the App Service environment, request an Azure Resource Manager token using the managed identity endpoint. Which resource value should be requested for Azure Resource Manager access?

NEW QUESTION 22
Using the privileges of the previously compromised App Registration, explore the Azure environment to identify and access sensitive information. What is the final flag retrieved from the tenant?

NEW QUESTION 23
Using a discovered SAS token with read/list permissions, enumerate blobs inside the sensitive-exports container. Which file contains credentials?

NEW QUESTION 24
The compromised service principal has Contributor access to a resource group but no direct Key Vault data- plane role. Can it immediately read Key Vault secret values?

NEW QUESTION 25
A managed identity has Key Vault Secrets User access to kv-finance-prod. Enumerate secrets and retrieve the hidden flag.

NEW QUESTION 26
A compromised principal has permission to list role assignments. Identify which user has the User Access Administrator role at the resource group scope.