Microsoft AZ-500 Practice Test 12
Question 110
A branch office's public egress address changed and a location restriction misclassifies corporate sessions. A review identifies this consequence: Incorrect egress IP lists can grant trust to an unintended location or block the intended office. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to disable location sign-in telemetry after changing a named location.
- The controlled remediation is to trust every unknown public IPv4 address as a corporate office.
- The controlled remediation is to use the VM private IP as proof of the user's external sign-in location.
- The controlled remediation is to correct the named location and test access from trusted and untrusted networks.
Explanation
Correct Answer
D:Test using these records: Public egress IP, named-location configuration, sign-in IP, policy evaluation and trust flags. Conditional Access location evaluation uses observable sign-in network context and configured named locations.
Incorrect Answers
A:Disable location sign-in telemetry after changing a named location. This would not reliably restore the intended security boundary. Incorrect egress IP lists can grant trust to an unintended location or block the intended office. The appropriate controlled recovery is: Correct the named location and test access from trusted and untrusted networks.
B:Trust every unknown public IPv4 address as a corporate office. This would not reliably restore the intended security boundary. Incorrect egress IP lists can grant trust to an unintended location or block the intended office. The appropriate controlled recovery is: Correct the named location and test access from trusted and untrusted networks.
C:Use the VM private IP as proof of the user's external sign-in location. This would not reliably restore the intended security boundary. Incorrect egress IP lists can grant trust to an unintended location or block the intended office. The appropriate controlled recovery is: Correct the named location and test access from trusted and untrusted networks.
Question 111
A SaaS enterprise application is available to all tenant employees but should permit only an approved finance group. What is the most defensible Azure security action?
- Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins.
- Assume a registered app's display name controls which employees can sign in.
- Grant all users Global Administrator and rely on the SaaS vendor to filter them.
- Require user assignment for the enterprise application and assign only authorized groups or principals.
Explanation
Correct Answer
D:Confirm the change against these records: Enterprise application assignment setting, app role membership and access tests with allowed and denied users. Entra enterprise application assignment can restrict who can access a particular integrated application.
Incorrect Answers
A:Authentication without required assignment restrictions may grant access beyond the intended user population.
B:Assume a registered app's display name controls which employees can sign in. The proposed change targets the wrong mechanism or lacks essential validation. Entra enterprise application assignment can restrict who can access a particular integrated application. Relevant evidence is enterprise application assignment setting, app role membership and access tests with allowed and denied users.
C:Authentication without required assignment restrictions may grant access beyond the intended user population. The intended action is: Require user assignment for the enterprise application and assign only authorized groups or principals.
Question 112
A SaaS enterprise application is available to all tenant employees but should permit only an approved finance group. Which diagnostic record would most strongly confirm the result?
- The expected access policy written in a design note but not assigned.
- A historical sign-in screenshot with no target resource or principal ID.
- A successful login to another unrelated cloud application.
- Enterprise application assignment setting, app role membership and access tests with allowed and denied users.
Explanation
Correct Answer
D:These records test the actual enterprise application user assignment behavior rather than an unrelated dashboard state. Entra enterprise application assignment can restrict who can access a particular integrated application.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Entra enterprise application assignment can restrict who can access a particular integrated application.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Enterprise application assignment setting, app role membership and access tests with allowed and denied users.
C:On its own, that evidence does not prove the specified security control works. In the given case, a SaaS enterprise application is available to all tenant employees but should permit only an approved finance group.
Question 113
A SaaS enterprise application is available to all tenant employees but should permit only an approved finance group. Which platform concept should guide the engineer’s assessment?
- Adding a requested API scope automatically grants tenant-wide consent.
- Long-lived shared application secrets are always more secure than managed identities.
- Entra enterprise application assignment can restrict who can access a particular integrated application.
- Assigning a role to a group means every resource ignores its narrower permissions.
Explanation
Correct Answer
C:This principle supports the security response: Require user assignment for the enterprise application and assign only authorized groups or principals. Confirmation depends on Enterprise application assignment setting, app role membership and access tests with allowed and denied users.
Incorrect Answers
A:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for enterprise application user assignment. The relevant security behavior is: Entra enterprise application assignment can restrict who can access a particular integrated application. Check evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for enterprise application user assignment. The relevant security behavior is: Entra enterprise application assignment can restrict who can access a particular integrated application. Check evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
D:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for enterprise application user assignment. The relevant security behavior is: Entra enterprise application assignment can restrict who can access a particular integrated application. Check evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
Question 114
A SaaS enterprise application is available to all tenant employees but should permit only an approved finance group. Suppose the operator instead follows this unsafe shortcut: Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins. Which root-cause observation follows from that incorrect change?
- The only harm is a cosmetic app display-name difference.
- Authentication without required assignment restrictions may grant access beyond the intended user population.
- Reviewing current access tokens creates missing authorization scopes.
- Testing a least-privilege login disables the normal authentication platform.
Explanation
Correct Answer
B:The suitable control is: Require user assignment for the enterprise application and assign only authorized groups or principals. Entra enterprise application assignment can restrict who can access a particular integrated application.
Incorrect Answers
A:This does not explain the real enterprise application user assignment weakness after the shortcut. The material failure is: Authentication without required assignment restrictions may grant access beyond the intended user population.
C:This does not explain the real enterprise application user assignment weakness after the shortcut. Inspect evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
D:This does not explain the real enterprise application user assignment weakness after the shortcut. In the given case, a SaaS enterprise application is available to all tenant employees but should permit only an approved finance group.
Question 115
A SaaS enterprise application is available to all tenant employees but should permit only an approved finance group. A review identifies this consequence: Authentication without required assignment restrictions may grant access beyond the intended user population. Which recovery action addresses the underlying technical fault?
- Assume a registered app's display name controls which employees can sign in.
- Grant all users Global Administrator and rely on the SaaS vendor to filter them.
- Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins.
- Enforce assignment and verify excluded users are denied while authorized roles work.
Explanation
Correct Answer
D:Test using these records: Enterprise application assignment setting, app role membership and access tests with allowed and denied users. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume a registered app's display name controls which employees can sign in. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
B:Grant all users Global Administrator and rely on the SaaS vendor to filter them. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
C:Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
Question 116
An Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should assume a registered app's display name controls which employees can sign in.
- For this Azure workload, the team should require user assignment for the enterprise application and assign only authorized groups or principals.
- For this Azure workload, the team should grant all users Global Administrator and rely on the SaaS vendor to filter them.
- For this Azure workload, the team should change a subscription-level Reader assignment to restrict the SaaS application's sign-ins.
Explanation
Correct Answer
B:Confirm the change against these records: Enterprise application assignment setting, app role membership and access tests with allowed and denied users. Require user assignment for the enterprise application and assign only authorized groups or principals.
Incorrect Answers
A:Assume a registered app's display name controls which employees can sign in. The proposed change targets the wrong mechanism or lacks essential validation. Entra enterprise application assignment can restrict who can access a particular integrated application. Relevant evidence is enterprise application assignment setting, app role membership and access tests with allowed and denied users.
C:Authentication without required assignment restrictions may grant access beyond the intended user population. Grant all users Global Administrator and rely on the SaaS vendor to filter them.
D:Authentication without required assignment restrictions may grant access beyond the intended user population. Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins.
Question 117
An Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine enterprise application assignment setting, app role membership and access tests with allowed and denied users.
Explanation
Correct Answer
D:These records test the actual enterprise application user assignment behavior rather than an unrelated dashboard state. The intended action is: Require user assignment for the enterprise application and assign only authorized groups or principals.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement.
B:Entra enterprise application assignment can restrict who can access a particular integrated application.
C:The more relevant observations are: Enterprise application assignment setting, app role membership and access tests with allowed and denied users.
Question 118
An Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that Entra enterprise application assignment can restrict who can access a particular integrated application.
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
Explanation
Correct Answer
A:This principle supports the security response: Require user assignment for the enterprise application and assign only authorized groups or principals. Entra enterprise application assignment can restrict who can access a particular integrated application.
Incorrect Answers
B:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for enterprise application user assignment. The relevant security behavior is: Entra enterprise application assignment can restrict who can access a particular integrated application. Check evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for enterprise application user assignment. The relevant security behavior is: Entra enterprise application assignment can restrict who can access a particular integrated application. Check evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
D:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for enterprise application user assignment. The relevant security behavior is: Entra enterprise application assignment can restrict who can access a particular integrated application. Check evidence such as enterprise application assignment setting, app role membership and access tests with allowed and denied users.
Question 119
An Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement. Suppose the operator instead follows this unsafe shortcut: Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that authentication without required assignment restrictions may grant access beyond the intended user population.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
Explanation
Correct Answer
A:The suitable control is: Require user assignment for the enterprise application and assign only authorized groups or principals. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real enterprise application user assignment weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
C:This does not explain the real enterprise application user assignment weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
D:This does not explain the real enterprise application user assignment weakness after the shortcut. In the given case, an Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement.
Question 120
An Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement. A review identifies this consequence: Authentication without required assignment restrictions may grant access beyond the intended user population. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to grant all users Global Administrator and rely on the SaaS vendor to filter them.
- The controlled remediation is to enforce assignment and verify excluded users are denied while authorized roles work.
- The controlled remediation is to change a subscription-level Reader assignment to restrict the SaaS application's sign-ins.
- The controlled remediation is to assume a registered app's display name controls which employees can sign in.
Explanation
Correct Answer
B:Test using these records: Enterprise application assignment setting, app role membership and access tests with allowed and denied users. Entra enterprise application assignment can restrict who can access a particular integrated application.
Incorrect Answers
A:Grant all users Global Administrator and rely on the SaaS vendor to filter them. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
C:Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
D:Assume a registered app's display name controls which employees can sign in. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
