Microsoft AZ-500 Practice Test 108
Question 1070
A security team sees abnormal template execution events but no relevant management-plane threat protection is available. A review identifies this consequence: Monitoring only VM process events can miss harmful ARM API activity. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to ignore anomalous ARM deployment actions when network traffic is low.
- The controlled remediation is to investigate the management event, revoke compromised credentials and confirm protection coverage.
- The controlled remediation is to assume encryption at rest prevents misuse of authorized ARM APIs.
- The controlled remediation is to use a storage account SAS as the management-plane incident identity.
Explanation
Correct Answer
B:Test using these records: ARM activity logs, principal identity, suspicious deployment events and Defender alerts. Control-plane activity can indicate malicious resource manipulation even without direct guest workload access.
Incorrect Answers
A:Ignore anomalous ARM deployment actions when network traffic is low. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
C:Assume encryption at rest prevents misuse of authorized ARM APIs. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
D:Use a storage account SAS as the management-plane incident identity. This would not reliably restore the intended security boundary. Monitoring only VM process events can miss harmful ARM API activity. The appropriate controlled recovery is: Investigate the management event, revoke compromised credentials and confirm protection coverage.
Question 1071
An application suddenly requests many Key Vault secrets from unfamiliar patterns after its workload identity is abused. What is the most defensible Azure security action?
- Disable Key Vault logging when many reads occur in a short window.
- Enable supported Defender for Key Vault protections and investigate unusual vault operations.
- Assume a successfully authorized secret read is always benign.
- Give every service principal Vault Administrator to reduce access failures.
Explanation
Correct Answer
B:Confirm the change against these records: Vault resource coverage, secret or key audit logs, source identity and Defender alert details. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Incorrect Answers
A:A valid credential can still be misused for anomalous secret or key access. Disable Key Vault logging when many reads occur in a short window.
C:Assume a successfully authorized secret read is always benign. The proposed change targets the wrong mechanism or lacks essential validation. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Relevant evidence is vault resource coverage, secret or key audit logs, source identity and Defender alert details.
D:A valid credential can still be misused for anomalous secret or key access. The intended action is: Enable supported Defender for Key Vault protections and investigate unusual vault operations.
Question 1072
An application suddenly requests many Key Vault secrets from unfamiliar patterns after its workload identity is abused. Which diagnostic record would most strongly confirm the result?
- A historical Secure Score screenshot without the relevant resource-level finding.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
- Vault resource coverage, secret or key audit logs, source identity and Defender alert details.
- An inventory item list from a different subscription or connected cloud account.
Explanation
Correct Answer
C:These records test the actual Defender for Key Vault suspicious access behavior rather than an unrelated dashboard state. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Vault resource coverage, secret or key audit logs, source identity and Defender alert details.
D:On its own, that evidence does not prove the specified security control works. In the given case, an application suddenly requests many Key Vault secrets from unfamiliar patterns after its workload identity is abused.
Question 1073
An application suddenly requests many Key Vault secrets from unfamiliar patterns after its workload identity is abused. Which platform concept should guide the engineer’s assessment?
- Assigning a policy automatically remediates all existing resources under every effect.
- A published security standard alone grants managed identities permission to change resources.
- A high Secure Score certifies that every relevant cloud resource is secure.
- Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Explanation
Correct Answer
D:Confirmation depends on Vault resource coverage, secret or key audit logs, source identity and Defender alert details. This principle supports the security response: Enable supported Defender for Key Vault protections and investigate unusual vault operations.
Incorrect Answers
A:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Defender for Key Vault suspicious access. The relevant security behavior is: Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Check evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
B:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Defender for Key Vault suspicious access. The relevant security behavior is: Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Check evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
C:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Defender for Key Vault suspicious access. The relevant security behavior is: Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Check evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
Question 1074
An application suddenly requests many Key Vault secrets from unfamiliar patterns after its workload identity is abused. Suppose the operator instead follows this unsafe shortcut: Disable Key Vault logging when many reads occur in a short window. Which root-cause observation follows from that incorrect change?
- A valid credential can still be misused for anomalous secret or key access.
- Documenting an approved policy assignment is the cause of its earlier absence.
- Preserving a security alert audit trail is what caused the risky configuration.
- Running a scoped compliance assessment automatically deletes protected resources.
Explanation
Correct Answer
A:The suitable control is: Enable supported Defender for Key Vault protections and investigate unusual vault operations. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Incorrect Answers
B:This does not explain the real Defender for Key Vault suspicious access weakness after the shortcut. The material failure is: A valid credential can still be misused for anomalous secret or key access.
C:This does not explain the real Defender for Key Vault suspicious access weakness after the shortcut. Inspect evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
D:This does not explain the real Defender for Key Vault suspicious access weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
Question 1075
An application suddenly requests many Key Vault secrets from unfamiliar patterns after its workload identity is abused. A review identifies this consequence: A valid credential can still be misused for anomalous secret or key access. Which recovery action addresses the underlying technical fault?
- Contain the affected principal, review vault access and validate alerting and recovery.
- Assume a successfully authorized secret read is always benign.
- Give every service principal Vault Administrator to reduce access failures.
- Disable Key Vault logging when many reads occur in a short window.
Explanation
Correct Answer
A:Test using these records: Vault resource coverage, secret or key audit logs, source identity and Defender alert details. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Assume a successfully authorized secret read is always benign. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
C:Give every service principal Vault Administrator to reduce access failures. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
D:Disable Key Vault logging when many reads occur in a short window. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
Question 1076
A Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should assume a successfully authorized secret read is always benign.
- For this Azure workload, the team should give every service principal Vault Administrator to reduce access failures.
- For this Azure workload, the team should disable Key Vault logging when many reads occur in a short window.
- For this Azure workload, the team should enable supported Defender for Key Vault protections and investigate unusual vault operations.
Explanation
Correct Answer
D:Confirm the change against these records: Vault resource coverage, secret or key audit logs, source identity and Defender alert details. This directly addresses Defender for Key Vault suspicious access.
Incorrect Answers
A:Assume a successfully authorized secret read is always benign. The proposed change targets the wrong mechanism or lacks essential validation. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Relevant evidence is vault resource coverage, secret or key audit logs, source identity and Defender alert details.
B:A valid credential can still be misused for anomalous secret or key access. In the given case, a Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence.
C:In the given case, a Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence.
Question 1077
A Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine vault resource coverage, secret or key audit logs, source identity and Defender alert details.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
Explanation
Correct Answer
B:These records test the actual Defender for Key Vault suspicious access behavior rather than an unrelated dashboard state. The intended action is: Enable supported Defender for Key Vault protections and investigate unusual vault operations.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence.
C:Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
D:The more relevant observations are: Vault resource coverage, secret or key audit logs, source identity and Defender alert details.
Question 1078
A Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Explanation
Correct Answer
D:Confirmation depends on Vault resource coverage, secret or key audit logs, source identity and Defender alert details.
Incorrect Answers
A:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Defender for Key Vault suspicious access. The relevant security behavior is: Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Check evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
B:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Defender for Key Vault suspicious access. The relevant security behavior is: Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Check evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
C:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Defender for Key Vault suspicious access. The relevant security behavior is: Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization. Check evidence such as vault resource coverage, secret or key audit logs, source identity and Defender alert details.
Question 1079
A Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence. Suppose the operator instead follows this unsafe shortcut: Disable Key Vault logging when many reads occur in a short window. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that a valid credential can still be misused for anomalous secret or key access.
Explanation
Correct Answer
D:The suitable control is: Enable supported Defender for Key Vault protections and investigate unusual vault operations. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Defender for Key Vault suspicious access weakness after the shortcut. In the given case, a Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence.
B:This does not explain the real Defender for Key Vault suspicious access weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
C:This does not explain the real Defender for Key Vault suspicious access weakness after the shortcut. Preserving a security alert audit trail is what caused the risky configuration.
Question 1080
A Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence. A review identifies this consequence: A valid credential can still be misused for anomalous secret or key access. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to give every service principal Vault Administrator to reduce access failures.
- The controlled remediation is to contain the affected principal, review vault access and validate alerting and recovery.
- The controlled remediation is to disable Key Vault logging when many reads occur in a short window.
- The controlled remediation is to assume a successfully authorized secret read is always benign.
Explanation
Correct Answer
B:Test using these records: Vault resource coverage, secret or key audit logs, source identity and Defender alert details. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Incorrect Answers
A:Give every service principal Vault Administrator to reduce access failures. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
C:Disable Key Vault logging when many reads occur in a short window. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
D:Assume a successfully authorized secret read is always benign. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
