CCPenX-Az Questions and Answers

Detailed Solution:

For Azure Resource Manager API calls, the token audience/resource must be:

https://management.azure.com/

Inside App Service Kudu/console, request the token:

curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ " \

-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "

The response contains:

{

" access_token " : " < jwt-token > " ,

" resource " : " https://management.azure.com/ " ,

" token_type " : " Bearer "

}

Correct option:

B. https://management.azure.com/

================

Detailed Solution:

From Q7, you should recover a limited-access SAS token or storage access information.

Set the storage account name and SAS token:

ACCOUNT= " excaliburstore "

SAS= " < recovered-sas-token > "

List containers:

az storage container list \

--account-name " $ACCOUNT " \

--sas-token " $SAS " \

--output table

The available container is:

sensitive-files

You can also confirm directly:

az storage blob list \

--account-name " $ACCOUNT " \

--container-name sensitive-files \

--sas-token " $SAS " \

--output table

Final Answer:

C. sensitive-files

================

Detailed Solution:

In Azure Storage SAS tokens, sp means signed permissions.

For blob/container access:

r = read

l = list

w = write

d = delete

c = create

a = add

Given:

sp=rl

The permissions are:

Read + List

Correct answer:

A. Read and List

SAS tokens grant delegated access to Azure Storage resources and must be handled like secrets.

================

b72a4c19-92f6-47f3-b3dd-9db5a31831d1

Detailed Solution:

Run:

az webapp identity show \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Expected output:

{

" principalId " : " b72a4c19-92f6-47f3-b3dd-9db5a31831d1 " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" type " : " SystemAssigned "

}

The principalId is the service principal object ID of the managed identity.

Microsoft documents that managed identities provide Azure-managed identities for applications and eliminate the need to manage application secrets directly.

================