Microsoft AZ-500 Practice Test 16
Question 150
An enterprise API receives a token with too few scopes after an administrator assumed adding the permission request meant it was approved. A review identifies this consequence: An app can appear configured while its token lacks the authorized permission and calls fail. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to apply authorized least-privilege consent and reissue a token to verify the claims.
- The controlled remediation is to give the app subscription Contributor to authorize Graph directory data access.
- The controlled remediation is to disable all consent governance and approve every requested app permission.
- The controlled remediation is to assume code changes alone grant tenant consent to privileged Microsoft Graph APIs.
Explanation
Correct Answer
A:Test using these records: App API permission list, tenant consent grants, access token roles or scopes and audit log. Declaring a requested API permission does not automatically create tenant-wide consent.
Incorrect Answers
B:Give the app subscription Contributor to authorize Graph directory data access. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
C:Disable all consent governance and approve every requested app permission. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
D:Assume code changes alone grant tenant consent to privileged Microsoft Graph APIs. This would not reliably restore the intended security boundary. An app can appear configured while its token lacks the authorized permission and calls fail. The appropriate controlled recovery is: Apply authorized least-privilege consent and reissue a token to verify the claims.
Question 151
An application exposes a custom API but clients cannot request the intended delegated operation. What is the most defensible Azure security action?
- Use a storage account key as the delegated API scope identifier.
- Declare a scope but skip consent and token validation.
- Replace the OAuth scope with an Azure VM network security group.
- Expose a well-defined API scope and align client requests, consent and token validation.
Explanation
Correct Answer
D:Confirm the change against these records: API scope definition, requested scope parameter, consent state and token scp claim. Custom exposed API scopes define delegated permissions that clients can request for an API.
Incorrect Answers
A:A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims.
B:Declare a scope but skip consent and token validation. The proposed change targets the wrong mechanism or lacks essential validation. Custom exposed API scopes define delegated permissions that clients can request for an API. Relevant evidence is API scope definition, requested scope parameter, consent state and token scp claim.
C:A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The intended action is: Expose a well-defined API scope and align client requests, consent and token validation.
Question 152
An application exposes a custom API but clients cannot request the intended delegated operation. Which diagnostic record would most strongly confirm the result?
- A user display name without the access-token claims or authorization decision.
- A successful login to another unrelated cloud application.
- An old tenant role export without a current role scope or effective assignment.
- API scope definition, requested scope parameter, consent state and token scp claim.
Explanation
Correct Answer
D:These records test the actual OAuth custom scope exposure behavior rather than an unrelated dashboard state. Custom exposed API scopes define delegated permissions that clients can request for an API.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Custom exposed API scopes define delegated permissions that clients can request for an API.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: API scope definition, requested scope parameter, consent state and token scp claim.
C:On its own, that evidence does not prove the specified security control works. In the given case, an application exposes a custom API but clients cannot request the intended delegated operation.
Question 153
An application exposes a custom API but clients cannot request the intended delegated operation. Which platform concept should guide the engineer’s assessment?
- Custom exposed API scopes define delegated permissions that clients can request for an API.
- Long-lived shared application secrets are always more secure than managed identities.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- A valid sign-in eliminates all requirements for scoped authorization.
Explanation
Correct Answer
A:Confirmation depends on API scope definition, requested scope parameter, consent state and token scp claim. This principle supports the security response: Expose a well-defined API scope and align client requests, consent and token validation.
Incorrect Answers
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for OAuth custom scope exposure. The relevant security behavior is: Custom exposed API scopes define delegated permissions that clients can request for an API. Check evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
C:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for OAuth custom scope exposure. The relevant security behavior is: Custom exposed API scopes define delegated permissions that clients can request for an API. Check evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
D:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for OAuth custom scope exposure. The relevant security behavior is: Custom exposed API scopes define delegated permissions that clients can request for an API. Check evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
Question 154
An application exposes a custom API but clients cannot request the intended delegated operation. Suppose the operator instead follows this unsafe shortcut: Use a storage account key as the delegated API scope identifier. Which root-cause observation follows from that incorrect change?
- A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims.
- Removing excessive admin permissions caused the original unauthorized elevation.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
- The only harm is a cosmetic app display-name difference.
Explanation
Correct Answer
A:The suitable control is: Expose a well-defined API scope and align client requests, consent and token validation. Custom exposed API scopes define delegated permissions that clients can request for an API.
Incorrect Answers
B:This does not explain the real OAuth custom scope exposure weakness after the shortcut. The material failure is: A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims.
C:This does not explain the real OAuth custom scope exposure weakness after the shortcut. Inspect evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
D:This does not explain the real OAuth custom scope exposure weakness after the shortcut. The only harm is a cosmetic app display-name difference.
Question 155
An application exposes a custom API but clients cannot request the intended delegated operation. A review identifies this consequence: A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. Which recovery action addresses the underlying technical fault?
- Declare a scope but skip consent and token validation.
- Replace the OAuth scope with an Azure VM network security group.
- Align scope definitions and client consent and test the resource API authorization.
- Use a storage account key as the delegated API scope identifier.
Explanation
Correct Answer
C:Test using these records: API scope definition, requested scope parameter, consent state and token scp claim. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Declare a scope but skip consent and token validation. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
B:Replace the OAuth scope with an Azure VM network security group. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
D:Use a storage account key as the delegated API scope identifier. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
Question 156
A developer changes an API scope identifier without updating the client permission request and consent grant. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should declare a scope but skip consent and token validation.
- For this Azure workload, the team should expose a well-defined API scope and align client requests, consent and token validation.
- For this Azure workload, the team should replace the OAuth scope with an Azure VM network security group.
- For this Azure workload, the team should use a storage account key as the delegated API scope identifier.
Explanation
Correct Answer
B:Confirm the change against these records: API scope definition, requested scope parameter, consent state and token scp claim.
Incorrect Answers
A:Declare a scope but skip consent and token validation. The proposed change targets the wrong mechanism or lacks essential validation. Custom exposed API scopes define delegated permissions that clients can request for an API. Relevant evidence is API scope definition, requested scope parameter, consent state and token scp claim.
C:A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims.
D:A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. Use a storage account key as the delegated API scope identifier.
Question 157
A developer changes an API scope identifier without updating the client permission request and consent grant. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine a user display name without the access-token claims or authorization decision.
- In this security review, examine API scope definition, requested scope parameter, consent state and token scp claim.
- In this security review, examine a successful login to another unrelated cloud application.
Explanation
Correct Answer
C:These records test the actual OAuth custom scope exposure behavior rather than an unrelated dashboard state. The intended action is: Expose a well-defined API scope and align client requests, consent and token validation.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a developer changes an API scope identifier without updating the client permission request and consent grant.
B:Custom exposed API scopes define delegated permissions that clients can request for an API.
D:The more relevant observations are: API scope definition, requested scope parameter, consent state and token scp claim.
Question 158
A developer changes an API scope identifier without updating the client permission request and consent grant. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that custom exposed API scopes define delegated permissions that clients can request for an API.
Explanation
Correct Answer
D:Confirmation depends on API scope definition, requested scope parameter, consent state and token scp claim.
Incorrect Answers
A:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for OAuth custom scope exposure. The relevant security behavior is: Custom exposed API scopes define delegated permissions that clients can request for an API. Check evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for OAuth custom scope exposure. The relevant security behavior is: Custom exposed API scopes define delegated permissions that clients can request for an API. Check evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
C:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for OAuth custom scope exposure. The relevant security behavior is: Custom exposed API scopes define delegated permissions that clients can request for an API. Check evidence such as API scope definition, requested scope parameter, consent state and token scp claim.
Question 159
A developer changes an API scope identifier without updating the client permission request and consent grant. Suppose the operator instead follows this unsafe shortcut: Use a storage account key as the delegated API scope identifier. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
- The resulting security weakness is that a missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims.
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
Explanation
Correct Answer
C:The suitable control is: Expose a well-defined API scope and align client requests, consent and token validation. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real OAuth custom scope exposure weakness after the shortcut. In the given case, a developer changes an API scope identifier without updating the client permission request and consent grant.
B:The material failure is: A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims.
D:This does not explain the real OAuth custom scope exposure weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
Question 160
A developer changes an API scope identifier without updating the client permission request and consent grant. A review identifies this consequence: A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to replace the OAuth scope with an Azure VM network security group.
- The controlled remediation is to use a storage account key as the delegated API scope identifier.
- The controlled remediation is to align scope definitions and client consent and test the resource API authorization.
- The controlled remediation is to declare a scope but skip consent and token validation.
Explanation
Correct Answer
C:Test using these records: API scope definition, requested scope parameter, consent state and token scp claim. Custom exposed API scopes define delegated permissions that clients can request for an API.
Incorrect Answers
A:Replace the OAuth scope with an Azure VM network security group. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
B:Use a storage account key as the delegated API scope identifier. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
D:Declare a scope but skip consent and token validation. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
