Microsoft AZ-500 Practice Test 15
Question 140
An interactive admin portal needs to act on behalf of its user but receives broad app-only directory permissions. A review identifies this consequence: Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to change an NSG rule to convert delegated tokens into application permissions.
- The controlled remediation is to give every daemon delegated permissions and expect it to work without a user.
- The controlled remediation is to grant all Microsoft Graph application permissions to every interactive app.
- The controlled remediation is to fix the permission type and least-privilege consent then inspect actual access-token claims.
Explanation
Correct Answer
D:Test using these records: Configured Graph permission types, token claims, consent state and actual API behavior. Delegated scopes reflect a signed-in user context while application permissions authorize supported app identities.
Incorrect Answers
A:Change an NSG rule to convert delegated tokens into application permissions. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
B:Give every daemon delegated permissions and expect it to work without a user. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
C:Grant all Microsoft Graph application permissions to every interactive app. This would not reliably restore the intended security boundary. Choosing the wrong permission model causes denied calls or grants excessive app-wide authority. The appropriate controlled recovery is: Fix the permission type and least-privilege consent then inspect actual access-token claims.
Question 141
A line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked. Which operator action best meets this technical requirement?
- Obtain approved admin consent only for the necessary permissions and verify the effective grant.
- Disable all consent governance and approve every requested app permission.
- Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs.
- Give the app subscription Contributor to authorize Graph directory data access.
Explanation
Correct Answer
A:Confirm the change against these records: App API permission list, tenant consent grants, access token roles or scopes and audit log. Declaring a requested API permission does not automatically create tenant-wide consent.
Incorrect Answers
B:An app can appear configured while its token lacks the authorized permission and calls fail. In the given case, a line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked.
C:Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs. The proposed change targets the wrong mechanism or lacks essential validation. Declaring a requested API permission does not automatically create tenant-wide consent. Relevant evidence is app API permission list, tenant consent grants, access token roles or scopes and audit log.
D:An app can appear configured while its token lacks the authorized permission and calls fail. The intended action is: Obtain approved admin consent only for the necessary permissions and verify the effective grant.
Question 142
A line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked. Which collection of observations most directly tests the suspected cause?
- App API permission list, tenant consent grants, access token roles or scopes and audit log.
- A historical sign-in screenshot with no target resource or principal ID.
- An old tenant role export without a current role scope or effective assignment.
- The expected access policy written in a design note but not assigned.
Explanation
Correct Answer
A:These records test the actual admin consent to API permissions behavior rather than an unrelated dashboard state. Declaring a requested API permission does not automatically create tenant-wide consent.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: App API permission list, tenant consent grants, access token roles or scopes and audit log.
C:On its own, that evidence does not prove the specified security control works. Declaring a requested API permission does not automatically create tenant-wide consent.
D:On its own, that evidence does not prove the specified security control works. In the given case, a line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked.
Question 143
A line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked. Which statement most accurately explains this scenario?
- Declaring a requested API permission does not automatically create tenant-wide consent.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- Assigning a role to a group means every resource ignores its narrower permissions.
- Adding a requested API scope automatically grants tenant-wide consent.
Explanation
Correct Answer
A:This principle supports the security response: Obtain approved admin consent only for the necessary permissions and verify the effective grant. Confirmation depends on App API permission list, tenant consent grants, access token roles or scopes and audit log.
Incorrect Answers
B:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for admin consent to API permissions. The relevant security behavior is: Declaring a requested API permission does not automatically create tenant-wide consent. Check evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
C:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for admin consent to API permissions. The relevant security behavior is: Declaring a requested API permission does not automatically create tenant-wide consent. Check evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
D:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for admin consent to API permissions. The relevant security behavior is: Declaring a requested API permission does not automatically create tenant-wide consent. Check evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
Question 144
A line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked. Suppose the operator instead follows this unsafe shortcut: Disable all consent governance and approve every requested app permission. What is the principal technical consequence of the mistaken choice?
- Reviewing current access tokens creates missing authorization scopes.
- An app can appear configured while its token lacks the authorized permission and calls fail.
- Testing a least-privilege login disables the normal authentication platform.
- Removing excessive admin permissions caused the original unauthorized elevation.
Explanation
Correct Answer
B:The suitable control is: Obtain approved admin consent only for the necessary permissions and verify the effective grant. Declaring a requested API permission does not automatically create tenant-wide consent.
Incorrect Answers
A:This does not explain the real admin consent to API permissions weakness after the shortcut. The material failure is: An app can appear configured while its token lacks the authorized permission and calls fail.
C:This does not explain the real admin consent to API permissions weakness after the shortcut. Inspect evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
D:This does not explain the real admin consent to API permissions weakness after the shortcut. In the given case, a line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked.
Question 145
A line-of-business app requests a privileged Microsoft Graph permission but user consent is blocked. A review identifies this consequence: An app can appear configured while its token lacks the authorized permission and calls fail. Which recovery action restores the intended control and validates its effect?
- Apply authorized least-privilege consent and reissue a token to verify the claims.
- Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs.
- Give the app subscription Contributor to authorize Graph directory data access.
- Disable all consent governance and approve every requested app permission.
Explanation
Correct Answer
A:Test using these records: App API permission list, tenant consent grants, access token roles or scopes and audit log. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
C:Give the app subscription Contributor to authorize Graph directory data access. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
D:Disable all consent governance and approve every requested app permission. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
Question 146
An enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved. What is the most defensible Azure security action?
- For this Azure workload, the team should assume code changes alone grant tenant consent to privileged Microsoft Graph APIs.
- For this Azure workload, the team should give the app subscription Contributor to authorize Graph directory data access.
- For this Azure workload, the team should obtain approved admin consent only for the necessary permissions and verify the effective grant.
- For this Azure workload, the team should disable all consent governance and approve every requested app permission.
Explanation
Correct Answer
C:Confirm the change against these records: App API permission list, tenant consent grants, access token roles or scopes and audit log. Obtain approved admin consent only for the necessary permissions and verify the effective grant.
Incorrect Answers
A:Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs. The proposed change targets the wrong mechanism or lacks essential validation. Declaring a requested API permission does not automatically create tenant-wide consent. Relevant evidence is app API permission list, tenant consent grants, access token roles or scopes and audit log.
B:An app can appear configured while its token lacks the authorized permission and calls fail. Give the app subscription Contributor to authorize Graph directory data access.
D:An app can appear configured while its token lacks the authorized permission and calls fail. Disable all consent governance and approve every requested app permission.
Question 147
An enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a user display name without the access-token claims or authorization decision.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine app API permission list, tenant consent grants, access token roles or scopes and audit log.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
Explanation
Correct Answer
C:These records test the actual admin consent to API permissions behavior rather than an unrelated dashboard state. The intended action is: Obtain approved admin consent only for the necessary permissions and verify the effective grant.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved.
B:The more relevant observations are: App API permission list, tenant consent grants, access token roles or scopes and audit log.
D:An old tenant role export without a current role scope or effective assignment. On its own, that evidence does not prove the specified security control works. The more relevant observations are: App API permission list, tenant consent grants, access token roles or scopes and audit log. Declaring a requested API permission does not automatically create tenant-wide consent.
Question 148
An enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that declaring a requested API permission does not automatically create tenant-wide consent.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
Explanation
Correct Answer
C:This principle supports the security response: Obtain approved admin consent only for the necessary permissions and verify the effective grant. Declaring a requested API permission does not automatically create tenant-wide consent.
Incorrect Answers
A:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for admin consent to API permissions. The relevant security behavior is: Declaring a requested API permission does not automatically create tenant-wide consent. Check evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
B:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for admin consent to API permissions. The relevant security behavior is: Declaring a requested API permission does not automatically create tenant-wide consent. Check evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
D:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for admin consent to API permissions. The relevant security behavior is: Declaring a requested API permission does not automatically create tenant-wide consent. Check evidence such as app API permission list, tenant consent grants, access token roles or scopes and audit log.
Question 149
An enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved. Suppose the operator instead follows this unsafe shortcut: Disable all consent governance and approve every requested app permission. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that an app can appear configured while its token lacks the authorized permission and calls fail.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
Explanation
Correct Answer
C:The suitable control is: Obtain approved admin consent only for the necessary permissions and verify the effective grant. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real admin consent to API permissions weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
B:This does not explain the real admin consent to API permissions weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
D:This does not explain the real admin consent to API permissions weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
Question 150
An enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved. A review identifies this consequence: An app can appear configured while its token lacks the authorized permission and calls fail. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to apply authorized least-privilege consent and reissue a token to verify the claims.
- The controlled remediation is to give the app subscription Contributor to authorize Graph directory data access.
- The controlled remediation is to disable all consent governance and approve every requested app permission.
- The controlled remediation is to assume code changes alone grant tenant consent to privileged Microsoft Graph APIs.
Explanation
Correct Answer
A:Test using these records: App API permission list, tenant consent grants, access token roles or scopes and audit log. Declaring a requested API permission does not automatically create tenant-wide consent.
Incorrect Answers
B:Give the app subscription Contributor to authorize Graph directory data access. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
C:Disable all consent governance and approve every requested app permission. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
D:Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
