Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

CCPenX-Az The SecOps Group Certified Cloud Pentesting eXpert - Azure

  • The SecOps Group
  • 6 free sample questions

About this exam

CCPenX-Az is the The SecOps Group exam The SecOps Group Certified Cloud Pentesting eXpert - Azure. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
CCPenX-Az
Vendor
The SecOps Group
Practice questions
Not available yet
Free sample questions
6
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for CCPenX-Az.

Question 1

During network reconnaissance of an Azure VM, you inspect its Network Security Group. Which inbound rule creates the highest risk?

  1. Option A:

    Allow TCP 443 from Internet

  2. Option B:

    Allow TCP 22 from Internet

  3. Option C:

    Deny all inbound from Internet

  4. Option D:

    Allow TCP 1433 from private subnet only

Show answer and explanation

Correct answer: B

Detailed Solution:

List NSG rules:

az network nsg rule list \

--resource-group rg-prod-apps-eastus \

--nsg-name nsg-prod-linux01 \

--output table

Expected risky rule:

Name Priority Direction Access Protocol Source DestinationPortRange

------------ -------- --------- ------ -------- ------------ --------------------

Allow-SSH 100 Inbound Allow Tcp Internet 22

SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.

Correct answer:

B. Allow TCP 22 from Internet

================

Question 2

Inside the public blob container, a file named backup-config.json contains service principal credentials. What field contains the App Registration client ID?

  1. Option A:

    tenantId

  2. Option B:

    clientSecret

  3. Option C:

    clientId

  4. Option D:

    objectId

Show answer and explanation

Correct answer: C

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" clientId " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" clientSecret " : " REDACTED "

}

The App Registration application/client ID is stored in:

clientId

================

See all 6 free sample questions