Microsoft AZ-500 Practice Test 13
Question 120
An Entra-integrated vendor portal authenticates users successfully despite an intended assignment requirement. A review identifies this consequence: Authentication without required assignment restrictions may grant access beyond the intended user population. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to grant all users Global Administrator and rely on the SaaS vendor to filter them.
- The controlled remediation is to enforce assignment and verify excluded users are denied while authorized roles work.
- The controlled remediation is to change a subscription-level Reader assignment to restrict the SaaS application's sign-ins.
- The controlled remediation is to assume a registered app's display name controls which employees can sign in.
Explanation
Correct Answer
B:Test using these records: Enterprise application assignment setting, app role membership and access tests with allowed and denied users. Entra enterprise application assignment can restrict who can access a particular integrated application.
Incorrect Answers
A:Grant all users Global Administrator and rely on the SaaS vendor to filter them. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
C:Change a subscription-level Reader assignment to restrict the SaaS application's sign-ins. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
D:Assume a registered app's display name controls which employees can sign in. This would not reliably restore the intended security boundary. Authentication without required assignment restrictions may grant access beyond the intended user population. The appropriate controlled recovery is: Enforce assignment and verify excluded users are denied while authorized roles work.
Question 121
An OAuth web app sign-in fails because its actual callback URL does not match the registered reply address. What is the BEST supported implementation or corrective action?
- Disable redirect validation by assigning Azure subscription Owner.
- Add a generic unrelated domain as the sole redirect target.
- Register the exact approved redirect URI and maintain the right platform configuration.
- Assume a token audience setting replaces exact reply URI validation.
Explanation
Correct Answer
C:Confirm the change against these records: Registered redirect URIs, application client type, authorization failure and returned callback URL. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Incorrect Answers
A:Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. In the given case, an OAuth web app sign-in fails because its actual callback URL does not match the registered reply address.
B:Add a generic unrelated domain as the sole redirect target. The proposed change targets the wrong mechanism or lacks essential validation. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Relevant evidence is registered redirect URIs, application client type, authorization failure and returned callback URL.
D:Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The intended action is: Register the exact approved redirect URI and maintain the right platform configuration.
Question 122
An OAuth web app sign-in fails because its actual callback URL does not match the registered reply address. Which evidence BEST verifies the intended technical behavior?
- An old tenant role export without a current role scope or effective assignment.
- Registered redirect URIs, application client type, authorization failure and returned callback URL.
- A user display name without the access-token claims or authorization decision.
- A historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
B:These records test the actual application registration redirect URI validation behavior rather than an unrelated dashboard state. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Registered redirect URIs, application client type, authorization failure and returned callback URL.
D:On its own, that evidence does not prove the specified security control works. In the given case, an OAuth web app sign-in fails because its actual callback URL does not match the registered reply address.
Question 123
An OAuth web app sign-in fails because its actual callback URL does not match the registered reply address. Which principle BEST explains why the recommended solution is appropriate?
- A valid sign-in eliminates all requirements for scoped authorization.
- Adding a requested API scope automatically grants tenant-wide consent.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Explanation
Correct Answer
D:Confirmation depends on Registered redirect URIs, application client type, authorization failure and returned callback URL. This principle supports the security response: Register the exact approved redirect URI and maintain the right platform configuration.
Incorrect Answers
A:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for application registration redirect URI validation. The relevant security behavior is: OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Check evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
B:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for application registration redirect URI validation. The relevant security behavior is: OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Check evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
C:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for application registration redirect URI validation. The relevant security behavior is: OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Check evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
Question 124
An OAuth web app sign-in fails because its actual callback URL does not match the registered reply address. Suppose the operator instead follows this unsafe shortcut: Disable redirect validation by assigning Azure subscription Owner. What is the MOST significant failure introduced by that shortcut?
- Testing a least-privilege login disables the normal authentication platform.
- Removing excessive admin permissions caused the original unauthorized elevation.
- Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
Explanation
Correct Answer
C:The suitable control is: Register the exact approved redirect URI and maintain the right platform configuration. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Incorrect Answers
A:This does not explain the real application registration redirect URI validation weakness after the shortcut. The material failure is: Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls.
B:This does not explain the real application registration redirect URI validation weakness after the shortcut. Inspect evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
D:This does not explain the real application registration redirect URI validation weakness after the shortcut. In the given case, an OAuth web app sign-in fails because its actual callback URL does not match the registered reply address.
Question 125
An OAuth web app sign-in fails because its actual callback URL does not match the registered reply address. A review identifies this consequence: Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. What is the BEST controlled recovery once this failure is recognized?
- Correct the trusted redirect list and test the authorization code flow without broad wildcards.
- Add a generic unrelated domain as the sole redirect target.
- Assume a token audience setting replaces exact reply URI validation.
- Disable redirect validation by assigning Azure subscription Owner.
Explanation
Correct Answer
A:Test using these records: Registered redirect URIs, application client type, authorization failure and returned callback URL. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Add a generic unrelated domain as the sole redirect target. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
C:Assume a token audience setting replaces exact reply URI validation. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
D:Disable redirect validation by assigning Azure subscription Owner. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
Question 126
A development client moves to a new HTTPS host and Entra refuses the redirect target during authorization. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should add a generic unrelated domain as the sole redirect target.
- For this Azure workload, the team should assume a token audience setting replaces exact reply URI validation.
- For this Azure workload, the team should disable redirect validation by assigning Azure subscription Owner.
- For this Azure workload, the team should register the exact approved redirect URI and maintain the right platform configuration.
Explanation
Correct Answer
D:Confirm the change against these records: Registered redirect URIs, application client type, authorization failure and returned callback URL.
Incorrect Answers
A:Add a generic unrelated domain as the sole redirect target. The proposed change targets the wrong mechanism or lacks essential validation. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Relevant evidence is registered redirect URIs, application client type, authorization failure and returned callback URL.
B:Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. Assume a token audience setting replaces exact reply URI validation.
C:Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. In the given case, a development client moves to a new HTTPS host and Entra refuses the redirect target during authorization.
Question 127
A development client moves to a new HTTPS host and Entra refuses the redirect target during authorization. What evidence most directly confirms the intended security behavior?
- In this security review, examine registered redirect URIs, application client type, authorization failure and returned callback URL.
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine a user display name without the access-token claims or authorization decision.
Explanation
Correct Answer
A:These records test the actual application registration redirect URI validation behavior rather than an unrelated dashboard state. The intended action is: Register the exact approved redirect URI and maintain the right platform configuration.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a development client moves to a new HTTPS host and Entra refuses the redirect target during authorization.
C:OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
D:The more relevant observations are: Registered redirect URIs, application client type, authorization failure and returned callback URL.
Question 128
A development client moves to a new HTTPS host and Entra refuses the redirect target during authorization. Which security principle best explains the intended decision?
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
Explanation
Correct Answer
B:Confirmation depends on Registered redirect URIs, application client type, authorization failure and returned callback URL. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Incorrect Answers
A:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for application registration redirect URI validation. The relevant security behavior is: OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Check evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
C:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for application registration redirect URI validation. The relevant security behavior is: OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Check evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
D:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for application registration redirect URI validation. The relevant security behavior is: OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations. Check evidence such as registered redirect URIs, application client type, authorization failure and returned callback URL.
Question 129
A development client moves to a new HTTPS host and Entra refuses the redirect target during authorization. Suppose the operator instead follows this unsafe shortcut: Disable redirect validation by assigning Azure subscription Owner. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
- The resulting security weakness is that using a wildcard or mismatched reply address can break sign-in or weaken redirect controls.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
Explanation
Correct Answer
C:The suitable control is: Register the exact approved redirect URI and maintain the right platform configuration. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real application registration redirect URI validation weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
B:This does not explain the real application registration redirect URI validation weakness after the shortcut. The only harm is a cosmetic app display-name difference.
D:This does not explain the real application registration redirect URI validation weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
Question 130
A development client moves to a new HTTPS host and Entra refuses the redirect target during authorization. A review identifies this consequence: Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. Which remediation most directly restores the intended behavior?
- The controlled remediation is to correct the trusted redirect list and test the authorization code flow without broad wildcards.
- The controlled remediation is to assume a token audience setting replaces exact reply URI validation.
- The controlled remediation is to disable redirect validation by assigning Azure subscription Owner.
- The controlled remediation is to add a generic unrelated domain as the sole redirect target.
Explanation
Correct Answer
A:Test using these records: Registered redirect URIs, application client type, authorization failure and returned callback URL. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Incorrect Answers
B:Assume a token audience setting replaces exact reply URI validation. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
C:Disable redirect validation by assigning Azure subscription Owner. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
D:Add a generic unrelated domain as the sole redirect target. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
