Microsoft AZ-500 Practice Test 17
Question 160
A developer changes an API scope identifier without updating the client permission request and consent grant. A review identifies this consequence: A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to replace the OAuth scope with an Azure VM network security group.
- The controlled remediation is to use a storage account key as the delegated API scope identifier.
- The controlled remediation is to align scope definitions and client consent and test the resource API authorization.
- The controlled remediation is to declare a scope but skip consent and token validation.
Explanation
Correct Answer
C:Test using these records: API scope definition, requested scope parameter, consent state and token scp claim. Custom exposed API scopes define delegated permissions that clients can request for an API.
Incorrect Answers
A:Replace the OAuth scope with an Azure VM network security group. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
B:Use a storage account key as the delegated API scope identifier. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
D:Declare a scope but skip consent and token validation. This would not reliably restore the intended security boundary. A missing or inconsistent scope prevents the resource API from receiving expected delegated authorization claims. The appropriate controlled recovery is: Align scope definitions and client consent and test the resource API authorization.
Question 161
A web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission. What is the BEST supported implementation or corrective action?
- Use an Azure Firewall policy to inject app roles into OAuth tokens.
- Make all app callers administrators because they have valid tokens.
- Define least-privilege app roles and assign approved clients so role claims appear in resource tokens.
- Assume an app registration alone automatically grants every client every app role.
Explanation
Correct Answer
C:Confirm the change against these records: App role definitions, enterprise app role assignments, token roles claim and API authorization logs. App roles describe application permissions or user role memberships that resource APIs can authorize.
Incorrect Answers
A:A token missing the required app role must not be treated as privileged just because it is signed. In the given case, a web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission.
B:Make all app callers administrators because they have valid tokens. The proposed change targets the wrong mechanism or lacks essential validation. App roles describe application permissions or user role memberships that resource APIs can authorize. Relevant evidence is app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
D:A token missing the required app role must not be treated as privileged just because it is signed. The intended action is: Define least-privilege app roles and assign approved clients so role claims appear in resource tokens.
Question 162
A web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission. Which evidence BEST verifies the intended technical behavior?
- The expected access policy written in a design note but not assigned.
- App role definitions, enterprise app role assignments, token roles claim and API authorization logs.
- A historical sign-in screenshot with no target resource or principal ID.
- A successful login to another unrelated cloud application.
Explanation
Correct Answer
B:These records test the actual app role claim authorization behavior rather than an unrelated dashboard state. App roles describe application permissions or user role memberships that resource APIs can authorize.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. App roles describe application permissions or user role memberships that resource APIs can authorize.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: App role definitions, enterprise app role assignments, token roles claim and API authorization logs.
D:On its own, that evidence does not prove the specified security control works. In the given case, a web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission.
Question 163
A web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission. Which principle BEST explains why the recommended solution is appropriate?
- Adding a requested API scope automatically grants tenant-wide consent.
- Long-lived shared application secrets are always more secure than managed identities.
- App roles describe application permissions or user role memberships that resource APIs can authorize.
- Assigning a role to a group means every resource ignores its narrower permissions.
Explanation
Correct Answer
C:Confirmation depends on App role definitions, enterprise app role assignments, token roles claim and API authorization logs. This principle supports the security response: Define least-privilege app roles and assign approved clients so role claims appear in resource tokens.
Incorrect Answers
A:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for app role claim authorization. The relevant security behavior is: App roles describe application permissions or user role memberships that resource APIs can authorize. Check evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for app role claim authorization. The relevant security behavior is: App roles describe application permissions or user role memberships that resource APIs can authorize. Check evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
D:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for app role claim authorization. The relevant security behavior is: App roles describe application permissions or user role memberships that resource APIs can authorize. Check evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
Question 164
A web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission. Suppose the operator instead follows this unsafe shortcut: Use an Azure Firewall policy to inject app roles into OAuth tokens. What is the MOST significant failure introduced by that shortcut?
- The only harm is a cosmetic app display-name difference.
- A token missing the required app role must not be treated as privileged just because it is signed.
- Reviewing current access tokens creates missing authorization scopes.
- Testing a least-privilege login disables the normal authentication platform.
Explanation
Correct Answer
B:The suitable control is: Define least-privilege app roles and assign approved clients so role claims appear in resource tokens. App roles describe application permissions or user role memberships that resource APIs can authorize.
Incorrect Answers
A:This does not explain the real app role claim authorization weakness after the shortcut. The material failure is: A token missing the required app role must not be treated as privileged just because it is signed.
C:This does not explain the real app role claim authorization weakness after the shortcut. Inspect evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
D:This does not explain the real app role claim authorization weakness after the shortcut. In the given case, a web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission.
Question 165
A web API needs to distinguish read-only application clients from privileged automation but assigns them one generic permission. A review identifies this consequence: A token missing the required app role must not be treated as privileged just because it is signed. What is the BEST controlled recovery once this failure is recognized?
- Make all app callers administrators because they have valid tokens.
- Assume an app registration alone automatically grants every client every app role.
- Correct role assignments and validate API enforcement for each authorized client.
- Use an Azure Firewall policy to inject app roles into OAuth tokens.
Explanation
Correct Answer
C:Test using these records: App role definitions, enterprise app role assignments, token roles claim and API authorization logs. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Make all app callers administrators because they have valid tokens. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
B:Assume an app registration alone automatically grants every client every app role. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
D:Use an Azure Firewall policy to inject app roles into OAuth tokens. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
Question 166
A daemon receives an access token with no app roles after its enterprise application assignment was missed. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should make all app callers administrators because they have valid tokens.
- For this Azure workload, the team should assume an app registration alone automatically grants every client every app role.
- For this Azure workload, the team should define least-privilege app roles and assign approved clients so role claims appear in resource tokens.
- For this Azure workload, the team should use an Azure Firewall policy to inject app roles into OAuth tokens.
Explanation
Correct Answer
C:Confirm the change against these records: App role definitions, enterprise app role assignments, token roles claim and API authorization logs.
Incorrect Answers
A:Make all app callers administrators because they have valid tokens. The proposed change targets the wrong mechanism or lacks essential validation. App roles describe application permissions or user role memberships that resource APIs can authorize. Relevant evidence is app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
B:A token missing the required app role must not be treated as privileged just because it is signed. Assume an app registration alone automatically grants every client every app role.
D:A token missing the required app role must not be treated as privileged just because it is signed. Use an Azure Firewall policy to inject app roles into OAuth tokens.
Question 167
A daemon receives an access token with no app roles after its enterprise application assignment was missed. What evidence most directly confirms the intended security behavior?
- In this security review, examine app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
A:These records test the actual app role claim authorization behavior rather than an unrelated dashboard state. The intended action is: Define least-privilege app roles and assign approved clients so role claims appear in resource tokens.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a daemon receives an access token with no app roles after its enterprise application assignment was missed.
C:App roles describe application permissions or user role memberships that resource APIs can authorize.
D:The more relevant observations are: App role definitions, enterprise app role assignments, token roles claim and API authorization logs.
Question 168
A daemon receives an access token with no app roles after its enterprise application assignment was missed. Which security principle best explains the intended decision?
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that app roles describe application permissions or user role memberships that resource APIs can authorize.
Explanation
Correct Answer
D:Confirmation depends on App role definitions, enterprise app role assignments, token roles claim and API authorization logs. App roles describe application permissions or user role memberships that resource APIs can authorize.
Incorrect Answers
A:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for app role claim authorization. The relevant security behavior is: App roles describe application permissions or user role memberships that resource APIs can authorize. Check evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
B:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for app role claim authorization. The relevant security behavior is: App roles describe application permissions or user role memberships that resource APIs can authorize. Check evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
C:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for app role claim authorization. The relevant security behavior is: App roles describe application permissions or user role memberships that resource APIs can authorize. Check evidence such as app role definitions, enterprise app role assignments, token roles claim and API authorization logs.
Question 169
A daemon receives an access token with no app roles after its enterprise application assignment was missed. Suppose the operator instead follows this unsafe shortcut: Use an Azure Firewall policy to inject app roles into OAuth tokens. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
- The resulting security weakness is that a token missing the required app role must not be treated as privileged just because it is signed.
Explanation
Correct Answer
D:The suitable control is: Define least-privilege app roles and assign approved clients so role claims appear in resource tokens. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real app role claim authorization weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
B:This does not explain the real app role claim authorization weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
C:This does not explain the real app role claim authorization weakness after the shortcut. In the given case, a daemon receives an access token with no app roles after its enterprise application assignment was missed.
Question 170
A daemon receives an access token with no app roles after its enterprise application assignment was missed. A review identifies this consequence: A token missing the required app role must not be treated as privileged just because it is signed. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume an app registration alone automatically grants every client every app role.
- The controlled remediation is to use an Azure Firewall policy to inject app roles into OAuth tokens.
- The controlled remediation is to make all app callers administrators because they have valid tokens.
- The controlled remediation is to correct role assignments and validate API enforcement for each authorized client.
Explanation
Correct Answer
D:Test using these records: App role definitions, enterprise app role assignments, token roles claim and API authorization logs. App roles describe application permissions or user role memberships that resource APIs can authorize.
Incorrect Answers
A:Assume an app registration alone automatically grants every client every app role. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
B:Use an Azure Firewall policy to inject app roles into OAuth tokens. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
C:Make all app callers administrators because they have valid tokens. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
