Microsoft AZ-500 Practice Test 107
Question 1060
A web app is already protected by WAF but Defender for Cloud app-specific threat monitoring is not configured. A review identifies this consequence: A WAF policy alone does not establish coverage for every supported app security detection. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to treat a passing TLS certificate check as proof no web application attack occurs.
- The controlled remediation is to disable all application access logs and assume threat findings remain complete.
- The controlled remediation is to assume enabling an NSG at a VM automatically installs Defender on App Service.
- The controlled remediation is to validate the Defender app plan and tune alert response alongside existing WAF.
Explanation
Correct Answer
D:Test using these records: App Service protection plan, app resource ID, supported detections and alert delivery. WAF request filtering and Defender for App Service threat protection address different monitoring and prevention layers.
Incorrect Answers
A:Treat a passing TLS certificate check as proof no web application attack occurs. This would not reliably restore the intended security boundary. A WAF policy alone does not establish coverage for every supported app security detection. The appropriate controlled recovery is: Validate the Defender app plan and tune alert response alongside existing WAF.
B:Disable all application access logs and assume threat findings remain complete. This would not reliably restore the intended security boundary. A WAF policy alone does not establish coverage for every supported app security detection. The appropriate controlled recovery is: Validate the Defender app plan and tune alert response alongside existing WAF.
C:Assume enabling an NSG at a VM automatically installs Defender on App Service. This would not reliably restore the intended security boundary. A WAF policy alone does not establish coverage for every supported app security detection. The appropriate controlled recovery is: Validate the Defender app plan and tune alert response alongside existing WAF.
Question 1061
A subscription experiences suspicious ARM deployment actions after a stolen automation token is used. Which operator action best meets this technical requirement?
- Assume encryption at rest prevents misuse of authorized ARM APIs.
- Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions.
- Use a storage account SAS as the management-plane incident identity.
- Ignore anomalous ARM deployment actions when network traffic is low.
Explanation
Correct Answer
B:Confirm the change against these records: ARM activity logs, principal identity, suspicious deployment events and Defender alerts. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
Incorrect Answers
A:Monitoring only VM process events can miss harmful ARM API activity. Assume encryption at rest prevents misuse of authorized ARM APIs.
C:Use a storage account SAS as the management-plane incident identity. The proposed change targets the wrong mechanism or lacks essential validation. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Relevant evidence is aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
D:Monitoring only VM process events can miss harmful ARM API activity. The intended action is: Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions.
Question 1062
A subscription experiences suspicious ARM deployment actions after a stolen automation token is used. Which collection of observations most directly tests the suspected cause?
- An incident title without its actual source telemetry and detection results.
- ARM activity logs, principal identity, suspicious deployment events and Defender alerts.
- An inventory item list from a different subscription or connected cloud account.
- A connected agent indicator without a matching data collection rule or event record.
Explanation
Correct Answer
B:These records test the actual Defender for Resource Manager anomalous operations behavior rather than an unrelated dashboard state. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: ARM activity logs, principal identity, suspicious deployment events and Defender alerts.
D:On its own, that evidence does not prove the specified security control works. In the given case, a subscription experiences suspicious ARM deployment actions after a stolen automation token is used.
Question 1063
A subscription experiences suspicious ARM deployment actions after a stolen automation token is used. Which statement most accurately explains this scenario?
- A published security standard alone grants managed identities permission to change resources.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
- Turning off an alert source is equivalent to remediating the underlying threat.
Explanation
Correct Answer
C:This principle supports the security response: Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions. Confirmation depends on ARM activity logs, principal identity, suspicious deployment events and Defender alerts.
Incorrect Answers
A:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Defender for Resource Manager anomalous operations. The relevant security behavior is: Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Check evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
B:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Defender for Resource Manager anomalous operations. The relevant security behavior is: Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Check evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
D:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Defender for Resource Manager anomalous operations. The relevant security behavior is: Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Check evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
Question 1064
A subscription experiences suspicious ARM deployment actions after a stolen automation token is used. Suppose the operator instead follows this unsafe shortcut: Assume encryption at rest prevents misuse of authorized ARM APIs. What is the principal technical consequence of the mistaken choice?
- Maintaining the required incident log is itself the unauthorized API request.
- Monitoring only VM process events can miss harmful ARM API activity.
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
Explanation
Correct Answer
B:The suitable control is: Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
Incorrect Answers
A:This does not explain the real Defender for Resource Manager anomalous operations weakness after the shortcut. The material failure is: Monitoring only VM process events can miss harmful ARM API activity.
C:This does not explain the real Defender for Resource Manager anomalous operations weakness after the shortcut. Inspect evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
D:This does not explain the real Defender for Resource Manager anomalous operations weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
Question 1065
A subscription experiences suspicious ARM deployment actions after a stolen automation token is used. A review identifies this consequence: Monitoring only VM process events can miss harmful ARM API activity. Which recovery action restores the intended control and validates its effect?
- Use a storage account SAS as the management-plane incident identity.
- Ignore anomalous ARM deployment actions when network traffic is low.
- Assume encryption at rest prevents misuse of authorized ARM APIs.
- Investigate the management event, revoke compromised credentials and confirm protection coverage.
Explanation
Correct Answer
D:Test using these records: ARM activity logs, principal identity, suspicious deployment events and Defender alerts. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Use a storage account SAS as the management-plane incident identity. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
B:Ignore anomalous ARM deployment actions when network traffic is low. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
C:Assume encryption at rest prevents misuse of authorized ARM APIs. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
Question 1066
A security team sees abnormal template execution events but no relevant management-plane threat protection is available. What is the most defensible Azure security action?
- For this Azure workload, the team should enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions.
- For this Azure workload, the team should use a storage account SAS as the management-plane incident identity.
- For this Azure workload, the team should ignore anomalous ARM deployment actions when network traffic is low.
- For this Azure workload, the team should assume encryption at rest prevents misuse of authorized ARM APIs.
Explanation
Correct Answer
A:Confirm the change against these records: ARM activity logs, principal identity, suspicious deployment events and Defender alerts. This directly addresses Defender for Resource Manager anomalous operations.
Incorrect Answers
B:Use a storage account SAS as the management-plane incident identity. The proposed change targets the wrong mechanism or lacks essential validation. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Relevant evidence is aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
C:Monitoring only VM process events can miss harmful ARM API activity. In the given case, a security team sees abnormal template execution events but no relevant management-plane threat protection is available.
D:In the given case, a security team sees abnormal template execution events but no relevant management-plane threat protection is available.
Question 1067
A security team sees abnormal template execution events but no relevant management-plane threat protection is available. Which diagnostic record would most strongly confirm the result?
- In this security review, examine aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
- In this security review, examine an incident title without its actual source telemetry and detection results.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
Explanation
Correct Answer
A:These records test the actual Defender for Resource Manager anomalous operations behavior rather than an unrelated dashboard state. The intended action is: Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a security team sees abnormal template execution events but no relevant management-plane threat protection is available.
C:Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
D:The more relevant observations are: ARM activity logs, principal identity, suspicious deployment events and Defender alerts.
Question 1068
A security team sees abnormal template execution events but no relevant management-plane threat protection is available. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
Explanation
Correct Answer
C:This principle supports the security response: Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions.
Incorrect Answers
A:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Defender for Resource Manager anomalous operations. The relevant security behavior is: Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Check evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
B:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Defender for Resource Manager anomalous operations. The relevant security behavior is: Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Check evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
D:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Defender for Resource Manager anomalous operations. The relevant security behavior is: Control-plane activity can indicate malicious resource manipulation even without direct guest workload access. Check evidence such as aRM activity logs, principal identity, suspicious deployment events and Defender alerts.
Question 1069
A security team sees abnormal template execution events but no relevant management-plane threat protection is available. Suppose the operator instead follows this unsafe shortcut: Assume encryption at rest prevents misuse of authorized ARM APIs. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that monitoring only VM process events can miss harmful ARM API activity.
Explanation
Correct Answer
D:The suitable control is: Enable supported Defender for Resource Manager protections and investigate anomalous control-plane actions. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Defender for Resource Manager anomalous operations weakness after the shortcut. In the given case, a security team sees abnormal template execution events but no relevant management-plane threat protection is available.
B:This does not explain the real Defender for Resource Manager anomalous operations weakness after the shortcut. Preserving a security alert audit trail is what caused the risky configuration.
C:This does not explain the real Defender for Resource Manager anomalous operations weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
Question 1070
A security team sees abnormal template execution events but no relevant management-plane threat protection is available. A review identifies this consequence: Monitoring only VM process events can miss harmful ARM API activity. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to ignore anomalous ARM deployment actions when network traffic is low.
- The controlled remediation is to investigate the management event, revoke compromised credentials and confirm protection coverage.
- The controlled remediation is to assume encryption at rest prevents misuse of authorized ARM APIs.
- The controlled remediation is to use a storage account SAS as the management-plane incident identity.
Explanation
Correct Answer
B:Test using these records: ARM activity logs, principal identity, suspicious deployment events and Defender alerts. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
Incorrect Answers
A:Ignore anomalous ARM deployment actions when network traffic is low. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
C:Assume encryption at rest prevents misuse of authorized ARM APIs. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
D:Use a storage account SAS as the management-plane incident identity. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
