CCPenX-Az Exam Preparation Material | Certified Cloud Pentesting eXpert - Azure

Explanation:
Detailed Solution:
From Q7, you should recover a limited-access SAS token or storage access information.
Set the storage account name and SAS token:
ACCOUNTSASList containers:
az storage container list \
--account-name "$ACCOUNT" \
--sas-token "$SAS" \
--output table
The available container is:
sensitive-files
You can also confirm directly:
az storage blob list \
--account-name "$ACCOUNT" \
--container-name sensitive-files \
--sas-token "$SAS" \
--output table
Final Answer
C. sensitive-files

Explanation:
Detailed Solution:
Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.
Test secret read:
az keyvault secret show \
--vault-name kv-finance-prod \
--name db-password \
--query value \
--output tsv
Expected failure:
Forbidden
Correct Answer B. No, Contributor does not automatically grant Key Vault secret data-plane read
Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

Explanation:
Detailed Solution:
First identify the managed identity attached to the Web App.
az webapp identity show \
--name RnD-Tools \
--resource-group Excalibur-Resources \
--output json
You should see a user-assigned managed identity similar to:
{
"userAssignedIdentities": {
"/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity": {
"clientId": "cf3664d4-5cec-4feb-b0ef-88b7958809df" , "principalId": "efe89e83-010f-42f6-9576-30531fa47af7"
}
}
}
Now query the role assignments for the managed identity’s principal ID:
az role assignment list \
--assignee efe89e83-010f-42f6-9576-30531fa47af7 \
--all \
--output table
The returned custom role is:
AppService-Auditor
That makes option D correct.
Final Answer
D. AppService-Auditor