2026 Updated Verified CCPenX-Az Downloadable Printable Exam Dumps [Q18-Q33]

Q18. The compromised service principal has Contributor access to a resource group but no direct Key Vault data- plane role. Can it immediately read Key Vault secret values?

Q19. Inside the public blob container, a file named backup-config.json contains service principal credentials. What field contains the App Registration client ID?

Q20. During network reconnaissance of an Azure VM, you inspect its Network Security Group. Which inbound rule creates the highest risk?

Q21. A storage account allows public blob access. Enumerate containers and identify the public container that exposes backup files.

Q22. Using the managed identity principal ID discovered in the previous task, identify which Azure RBAC role is assigned to it.

Q23. You discover a storage account named prodreportstore01. Determine whether public blob access is enabled on the storage account.

Q24. While exploring the table storage, you’ve uncovered information that provides limited access to a storage account. Using this access, enumerate the blob containers. Which of the following containers is available?

Q25. A managed identity has Key Vault Secrets User access to kv-finance-prod. Enumerate secrets and retrieve the hidden flag.

Q26. The App Service has a system-assigned managed identity enabled. Identify the managed identity principal ID.

Q27. Authenticate to Azure as a service principal using the credentials found in backup-config.json.

Q28. A compromised principal has permission to list role assignments. Identify which user has the User Access Administrator role at the resource group scope.

Q29. A compromised developer account has Reader access to a resource group. Enumerate all Azure resources in that resource group and identify the exposed App Service name.

Q30. From inside the App Service environment, request an Azure Resource Manager token using the managed identity endpoint. Which resource value should be requested for Azure Resource Manager access?