Microsoft AZ-500 Practice Test 109
Question 1080
A Key Vault reports unusual key operations but analysts expect only network firewall logs to explain the sequence. A review identifies this consequence: A valid credential can still be misused for anomalous secret or key access. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to give every service principal Vault Administrator to reduce access failures.
- The controlled remediation is to contain the affected principal, review vault access and validate alerting and recovery.
- The controlled remediation is to disable Key Vault logging when many reads occur in a short window.
- The controlled remediation is to assume a successfully authorized secret read is always benign.
Explanation
Correct Answer
B:Test using these records: Vault resource coverage, secret or key audit logs, source identity and Defender alert details. Key Vault threat monitoring can help identify suspicious data-plane usage beyond ordinary authorization.
Incorrect Answers
A:Give every service principal Vault Administrator to reduce access failures. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
C:Disable Key Vault logging when many reads occur in a short window. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
D:Assume a successfully authorized secret read is always benign. This would not reliably restore the intended security boundary. A valid credential can still be misused for anomalous secret or key access. The appropriate controlled recovery is: Contain the affected principal, review vault access and validate alerting and recovery.
Question 1081
A GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists. What is the BEST supported implementation or corrective action?
- Connect the approved GitHub organization or repositories to Defender for Cloud DevOps Security.
- Copy personal GitHub passwords into the cloud portal for permanent authentication.
- Connect every unrelated personal repository without owner approval.
- Assume enabling Defender for Servers scans all private GitHub IaC files automatically.
Explanation
Correct Answer
A:Confirm the change against these records: GitHub app installation, selected repository access, discovered findings and connector health. Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments.
Incorrect Answers
B:Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories.
C:Connect every unrelated personal repository without owner approval. The proposed change targets the wrong mechanism or lacks essential validation. Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Relevant evidence is GitHub app installation, selected repository access, discovered findings and connector health.
D:Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The intended action is: Connect the approved GitHub organization or repositories to Defender for Cloud DevOps Security.
Question 1082
A GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists. Which evidence BEST verifies the intended technical behavior?
- A connected agent indicator without a matching data collection rule or event record.
- An incident title without its actual source telemetry and detection results.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
- GitHub app installation, selected repository access, discovered findings and connector health.
Explanation
Correct Answer
D:Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. These records test the actual Defender for Cloud DevOps GitHub connection behavior rather than an unrelated dashboard state.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: GitHub app installation, selected repository access, discovered findings and connector health.
C:On its own, that evidence does not prove the specified security control works. In the given case, a GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists.
Question 1083
A GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists. Which principle BEST explains why the recommended solution is appropriate?
- Turning off an alert source is equivalent to remediating the underlying threat.
- Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments.
- Assigning a policy automatically remediates all existing resources under every effect.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
Explanation
Correct Answer
B:Confirmation depends on GitHub app installation, selected repository access, discovered findings and connector health.
Incorrect Answers
A:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Defender for Cloud DevOps GitHub connection. The relevant security behavior is: Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Check evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Defender for Cloud DevOps GitHub connection. The relevant security behavior is: Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Check evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
D:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Defender for Cloud DevOps GitHub connection. The relevant security behavior is: Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Check evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
Question 1084
A GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists. Suppose the operator instead follows this unsafe shortcut: Copy personal GitHub passwords into the cloud portal for permanent authentication. What is the MOST significant failure introduced by that shortcut?
- Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories.
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- A successful remediation test was the original reason the plan was disabled.
Explanation
Correct Answer
A:Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Defender for Cloud DevOps GitHub connection weakness after the shortcut. The material failure is: Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories.
C:This does not explain the real Defender for Cloud DevOps GitHub connection weakness after the shortcut. Inspect evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
D:This does not explain the real Defender for Cloud DevOps GitHub connection weakness after the shortcut. In the given case, a GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists.
Question 1085
A GitHub repository contains an unsafe infrastructure-as-code rule but Defender for Cloud does not see the organization because no DevOps connection exists. A review identifies this consequence: Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. What is the BEST controlled recovery once this failure is recognized?
- Configure the connector and verify intended repository assessment coverage.
- Connect every unrelated personal repository without owner approval.
- Assume enabling Defender for Servers scans all private GitHub IaC files automatically.
- Copy personal GitHub passwords into the cloud portal for permanent authentication.
Explanation
Correct Answer
A:Test using these records: GitHub app installation, selected repository access, discovered findings and connector health. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Connect every unrelated personal repository without owner approval. This would not reliably restore the intended security boundary. Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The appropriate controlled recovery is: Configure the connector and verify intended repository assessment coverage.
C:Assume enabling Defender for Servers scans all private GitHub IaC files automatically. This would not reliably restore the intended security boundary. Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The appropriate controlled recovery is: Configure the connector and verify intended repository assessment coverage.
D:Copy personal GitHub passwords into the cloud portal for permanent authentication. This would not reliably restore the intended security boundary. Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The appropriate controlled recovery is: Configure the connector and verify intended repository assessment coverage.
Question 1086
A security team wants centrally visible code security recommendations for supported GitHub repositories with limited app permissions. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should connect every unrelated personal repository without owner approval.
- For this Azure workload, the team should connect the approved GitHub organization or repositories to Defender for Cloud DevOps Security.
- For this Azure workload, the team should assume enabling Defender for Servers scans all private GitHub IaC files automatically.
- For this Azure workload, the team should copy personal GitHub passwords into the cloud portal for permanent authentication.
Explanation
Correct Answer
B:Confirm the change against these records: GitHub app installation, selected repository access, discovered findings and connector health. This directly addresses Defender for Cloud DevOps GitHub connection.
Incorrect Answers
A:Connect every unrelated personal repository without owner approval. The proposed change targets the wrong mechanism or lacks essential validation. Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Relevant evidence is GitHub app installation, selected repository access, discovered findings and connector health.
C:Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. Assume enabling Defender for Servers scans all private GitHub IaC files automatically.
D:Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. Copy personal GitHub passwords into the cloud portal for permanent authentication.
Question 1087
A security team wants centrally visible code security recommendations for supported GitHub repositories with limited app permissions. What evidence most directly confirms the intended security behavior?
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine GitHub app installation, selected repository access, discovered findings and connector health.
- In this security review, examine an incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
C:These records test the actual Defender for Cloud DevOps GitHub connection behavior rather than an unrelated dashboard state.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a security team wants centrally visible code security recommendations for supported GitHub repositories with limited app permissions.
B:Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments.
D:The more relevant observations are: GitHub app installation, selected repository access, discovered findings and connector health.
Question 1088
A security team wants centrally visible code security recommendations for supported GitHub repositories with limited app permissions. Which security principle best explains the intended decision?
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
B:This principle supports the security response: Connect the approved GitHub organization or repositories to Defender for Cloud DevOps Security.
Incorrect Answers
A:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Defender for Cloud DevOps GitHub connection. The relevant security behavior is: Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Check evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
C:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Defender for Cloud DevOps GitHub connection. The relevant security behavior is: Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Check evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Defender for Cloud DevOps GitHub connection. The relevant security behavior is: Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments. Check evidence such as GitHub app installation, selected repository access, discovered findings and connector health.
Question 1089
A security team wants centrally visible code security recommendations for supported GitHub repositories with limited app permissions. Suppose the operator instead follows this unsafe shortcut: Copy personal GitHub passwords into the cloud portal for permanent authentication. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
Explanation
Correct Answer
C:The suitable control is: Connect the approved GitHub organization or repositories to Defender for Cloud DevOps Security.
Incorrect Answers
A:This does not explain the real Defender for Cloud DevOps GitHub connection weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
B:This does not explain the real Defender for Cloud DevOps GitHub connection weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
D:This does not explain the real Defender for Cloud DevOps GitHub connection weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
Question 1090
A security team wants centrally visible code security recommendations for supported GitHub repositories with limited app permissions. A review identifies this consequence: Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. Which remediation most directly restores the intended behavior?
- The controlled remediation is to configure the connector and verify intended repository assessment coverage.
- The controlled remediation is to assume enabling Defender for Servers scans all private GitHub IaC files automatically.
- The controlled remediation is to copy personal GitHub passwords into the cloud portal for permanent authentication.
- The controlled remediation is to connect every unrelated personal repository without owner approval.
Explanation
Correct Answer
A:Test using these records: GitHub app installation, selected repository access, discovered findings and connector health. Defender for Cloud DevOps Security requires an authorized source-control connector for applicable repository assessments.
Incorrect Answers
B:Assume enabling Defender for Servers scans all private GitHub IaC files automatically. This would not reliably restore the intended security boundary. Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The appropriate controlled recovery is: Configure the connector and verify intended repository assessment coverage.
C:Copy personal GitHub passwords into the cloud portal for permanent authentication. This would not reliably restore the intended security boundary. Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The appropriate controlled recovery is: Configure the connector and verify intended repository assessment coverage.
D:Connect every unrelated personal repository without owner approval. This would not reliably restore the intended security boundary. Cloud runtime posture alone cannot provide complete code and pipeline findings from unconnected repositories. The appropriate controlled recovery is: Configure the connector and verify intended repository assessment coverage.
