Microsoft AZ-500 Practice Test 14
Question 130
A development client moves to a new HTTPS host and Entra refuses the redirect target during authorization. A review identifies this consequence: Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. Which remediation most directly restores the intended behavior?
- The controlled remediation is to correct the trusted redirect list and test the authorization code flow without broad wildcards.
- The controlled remediation is to assume a token audience setting replaces exact reply URI validation.
- The controlled remediation is to disable redirect validation by assigning Azure subscription Owner.
- The controlled remediation is to add a generic unrelated domain as the sole redirect target.
Explanation
Correct Answer
A:Test using these records: Registered redirect URIs, application client type, authorization failure and returned callback URL. OAuth redirect URI validation prevents authorization results from being sent to unapproved callback locations.
Incorrect Answers
B:Assume a token audience setting replaces exact reply URI validation. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
C:Disable redirect validation by assigning Azure subscription Owner. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
D:Add a generic unrelated domain as the sole redirect target. This would not reliably restore the intended security boundary. Using a wildcard or mismatched reply address can break sign-in or weaken redirect controls. The appropriate controlled recovery is: Correct the trusted redirect list and test the authorization code flow without broad wildcards.
Question 131
A daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes. Which configuration decision MOST directly resolves the issue?
- Give every daemon delegated permissions and expect it to work without a user.
- Choose delegated permissions for user-context flows or application permissions for authorized app-only access.
- Grant all Microsoft Graph application permissions to every interactive app.
- Change an NSG rule to convert delegated tokens into application permissions.
Explanation
Correct Answer
B:Confirm the change against these records: Configured Graph permission types, token claims, consent state and actual API behavior. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
Incorrect Answers
A:Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. Give every daemon delegated permissions and expect it to work without a user.
C:Grant all Microsoft Graph application permissions to every interactive app. The proposed change targets the wrong mechanism or lacks essential validation. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Relevant evidence is configured Graph permission types, token claims, consent state and actual API behavior.
D:Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The intended action is: Choose delegated permissions for user-context flows or application permissions for authorized app-only access.
Question 132
A daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes. What evidence most directly confirms the intended security behavior?
- Configured Graph permission types, token claims, consent state and actual API behavior.
- A successful login to another unrelated cloud application.
- The expected access policy written in a design note but not assigned.
- A user display name without the access-token claims or authorization decision.
Explanation
Correct Answer
A:These records test the actual delegated versus application API permissions behavior rather than an unrelated dashboard state. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Configured Graph permission types, token claims, consent state and actual API behavior.
D:On its own, that evidence does not prove the specified security control works. In the given case, a daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes.
Question 133
A daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes. Which security principle best explains the intended decision?
- Assigning a role to a group means every resource ignores its narrower permissions.
- Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
- A valid sign-in eliminates all requirements for scoped authorization.
- Long-lived shared application secrets are always more secure than managed identities.
Explanation
Correct Answer
B:This principle supports the security response: Choose delegated permissions for user-context flows or application permissions for authorized app-only access. Confirmation depends on Configured Graph permission types, token claims, consent state and actual API behavior.
Incorrect Answers
A:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for delegated versus application API permissions. The relevant security behavior is: Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Check evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
C:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for delegated versus application API permissions. The relevant security behavior is: Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Check evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
D:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for delegated versus application API permissions. The relevant security behavior is: Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Check evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
Question 134
A daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes. Suppose the operator instead follows this unsafe shortcut: Give every daemon delegated permissions and expect it to work without a user. Which resulting risk or fault should the reviewer identify?
- Choosing the wrong permission model causes denied calls or grants excessive app-wide authority.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
- The only harm is a cosmetic app display-name difference.
- Reviewing current access tokens creates missing authorization scopes.
Explanation
Correct Answer
A:The suitable control is: Choose delegated permissions for user-context flows or application permissions for authorized app-only access. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
Incorrect Answers
B:This does not explain the real delegated versus application API permissions weakness after the shortcut. The material failure is: Choosing the wrong permission model causes denied calls or grants excessive app-wide authority.
C:This does not explain the real delegated versus application API permissions weakness after the shortcut. Inspect evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
D:This does not explain the real delegated versus application API permissions weakness after the shortcut. In the given case, a daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes.
Question 135
A daemon reads Microsoft Graph without a signed-in user but was granted only delegated permission scopes. A review identifies this consequence: Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. Which remediation most directly restores the intended behavior?
- Grant all Microsoft Graph application permissions to every interactive app.
- Change an NSG rule to convert delegated tokens into application permissions.
- Fix the permission type and least-privilege consent then inspect actual access-token claims.
- Give every daemon delegated permissions and expect it to work without a user.
Explanation
Correct Answer
C:Test using these records: Configured Graph permission types, token claims, consent state and actual API behavior. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Grant all Microsoft Graph application permissions to every interactive app. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
B:Change an NSG rule to convert delegated tokens into application permissions. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
D:Give every daemon delegated permissions and expect it to work without a user. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
Question 136
An interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions. Which operator action best meets this technical requirement?
- For this Azure workload, the team should choose delegated permissions for user-context flows or application permissions for authorized app-only access.
- For this Azure workload, the team should grant all Microsoft Graph application permissions to every interactive app.
- For this Azure workload, the team should change an NSG rule to convert delegated tokens into application permissions.
- For this Azure workload, the team should give every daemon delegated permissions and expect it to work without a user.
Explanation
Correct Answer
A:Confirm the change against these records: Configured Graph permission types, token claims, consent state and actual API behavior.
Incorrect Answers
B:Grant all Microsoft Graph application permissions to every interactive app. The proposed change targets the wrong mechanism or lacks essential validation. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Relevant evidence is configured Graph permission types, token claims, consent state and actual API behavior.
C:Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. In the given case, an interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions.
D:Give every daemon delegated permissions and expect it to work without a user.
Question 137
An interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine configured Graph permission types, token claims, consent state and actual API behavior.
Explanation
Correct Answer
D:These records test the actual delegated versus application API permissions behavior rather than an unrelated dashboard state. The intended action is: Choose delegated permissions for user-context flows or application permissions for authorized app-only access.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions.
B:Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
C:The more relevant observations are: Configured Graph permission types, token claims, consent state and actual API behavior.
Question 138
An interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions. Which statement most accurately explains this scenario?
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
Explanation
Correct Answer
D:This principle supports the security response: Choose delegated permissions for user-context flows or application permissions for authorized app-only access.
Incorrect Answers
A:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for delegated versus application API permissions. The relevant security behavior is: Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Check evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
B:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for delegated versus application API permissions. The relevant security behavior is: Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Check evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for delegated versus application API permissions. The relevant security behavior is: Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities. Check evidence such as configured Graph permission types, token claims, consent state and actual API behavior.
Question 139
An interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions. Suppose the operator instead follows this unsafe shortcut: Give every daemon delegated permissions and expect it to work without a user. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that choosing the wrong permission model causes denied calls or grants excessive app-wide authority.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
Explanation
Correct Answer
A:The suitable control is: Choose delegated permissions for user-context flows or application permissions for authorized app-only access. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real delegated versus application API permissions weakness after the shortcut. In the given case, an interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions.
C:This does not explain the real delegated versus application API permissions weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
D:This does not explain the real delegated versus application API permissions weakness after the shortcut. The only harm is a cosmetic app display-name difference.
Question 140
An interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions. A review identifies this consequence: Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to change an NSG rule to convert delegated tokens into application permissions.
- The controlled remediation is to give every daemon delegated permissions and expect it to work without a user.
- The controlled remediation is to grant all Microsoft Graph application permissions to every interactive app.
- The controlled remediation is to fix the permission type and least-privilege consent then inspect actual access-token claims.
Explanation
Correct Answer
D:Test using these records: Configured Graph permission types, token claims, consent state and actual API behavior. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
Incorrect Answers
A:Change an NSG rule to convert delegated tokens into application permissions. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
B:Give every daemon delegated permissions and expect it to work without a user. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
C:Grant all Microsoft Graph application permissions to every interactive app. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
