Microsoft AZ-500 Practice Test 18
Question 170
A daemon receives an access token with no app roles after its enterprise application assignment was missed. A review identifies this consequence: A token missing the required app role must not be treated as privileged just because it is signed. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume an app registration alone automatically grants every client every app role.
- The controlled remediation is to use an Azure Firewall policy to inject app roles into OAuth tokens.
- The controlled remediation is to make all app callers administrators because they have valid tokens.
- The controlled remediation is to correct role assignments and validate API enforcement for each authorized client.
Explanation
Correct Answer
D:Test using these records: App role definitions, enterprise app role assignments, token roles claim and API authorization logs. App roles describe application permissions or user role memberships that resource APIs can authorize.
Incorrect Answers
A:Assume an app registration alone automatically grants every client every app role. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
B:Use an Azure Firewall policy to inject app roles into OAuth tokens. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
C:Make all app callers administrators because they have valid tokens. This would not reliably restore the intended security boundary. A token missing the required app role must not be treated as privileged just because it is signed. The appropriate controlled recovery is: Correct role assignments and validate API enforcement for each authorized client.
Question 171
A build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource. Which configuration decision MOST directly resolves the issue?
- Publish the client secret in the repository to avoid missing deployments.
- Grant permanent Global Administrator to the build app without assessing permissions.
- Delete the active certificate before testing the replacement.
- Rotate or replace credentials securely with overlap and update authorized consuming workloads.
Explanation
Correct Answer
D:Confirm the change against these records: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition. Service principal application credentials must be valid and protected for noninteractive authentication.
Incorrect Answers
A:An expired or leaked credential can break automation or expose broad app authority. In the given case, a build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource.
B:Grant permanent Global Administrator to the build app without assessing permissions. The proposed change targets the wrong mechanism or lacks essential validation. Service principal application credentials must be valid and protected for noninteractive authentication. Relevant evidence is credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
C:An expired or leaked credential can break automation or expose broad app authority. The intended action is: Rotate or replace credentials securely with overlap and update authorized consuming workloads.
Question 172
A build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource. What evidence most directly confirms the intended security behavior?
- Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
- An old tenant role export without a current role scope or effective assignment.
- A user display name without the access-token claims or authorization decision.
- A historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
A:These records test the actual service principal credential rotation behavior rather than an unrelated dashboard state. Service principal application credentials must be valid and protected for noninteractive authentication.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Service principal application credentials must be valid and protected for noninteractive authentication.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
D:On its own, that evidence does not prove the specified security control works. In the given case, a build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource.
Question 173
A build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource. Which security principle best explains the intended decision?
- A valid sign-in eliminates all requirements for scoped authorization.
- Adding a requested API scope automatically grants tenant-wide consent.
- Service principal application credentials must be valid and protected for noninteractive authentication.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
Explanation
Correct Answer
C:Confirmation depends on Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition. This principle supports the security response: Rotate or replace credentials securely with overlap and update authorized consuming workloads.
Incorrect Answers
A:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for service principal credential rotation. The relevant security behavior is: Service principal application credentials must be valid and protected for noninteractive authentication. Check evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
B:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for service principal credential rotation. The relevant security behavior is: Service principal application credentials must be valid and protected for noninteractive authentication. Check evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
D:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for service principal credential rotation. The relevant security behavior is: Service principal application credentials must be valid and protected for noninteractive authentication. Check evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
Question 174
A build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource. Suppose the operator instead follows this unsafe shortcut: Publish the client secret in the repository to avoid missing deployments. Which resulting risk or fault should the reviewer identify?
- Testing a least-privilege login disables the normal authentication platform.
- An expired or leaked credential can break automation or expose broad app authority.
- Removing excessive admin permissions caused the original unauthorized elevation.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
Explanation
Correct Answer
B:The suitable control is: Rotate or replace credentials securely with overlap and update authorized consuming workloads. Service principal application credentials must be valid and protected for noninteractive authentication.
Incorrect Answers
A:This does not explain the real service principal credential rotation weakness after the shortcut. The material failure is: An expired or leaked credential can break automation or expose broad app authority.
C:This does not explain the real service principal credential rotation weakness after the shortcut. Inspect evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
D:This does not explain the real service principal credential rotation weakness after the shortcut. In the given case, a build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource.
Question 175
A build pipeline authenticates with an expired client secret and can no longer deploy a controlled Azure resource. A review identifies this consequence: An expired or leaked credential can break automation or expose broad app authority. Which remediation most directly restores the intended behavior?
- Introduce the approved new credential, validate consumers and revoke the old one after migration.
- Grant permanent Global Administrator to the build app without assessing permissions.
- Delete the active certificate before testing the replacement.
- Publish the client secret in the repository to avoid missing deployments.
Explanation
Correct Answer
A:Test using these records: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Grant permanent Global Administrator to the build app without assessing permissions. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
C:Delete the active certificate before testing the replacement. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
D:Publish the client secret in the repository to avoid missing deployments. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
Question 176
A service principal uses a long-lived shared certificate that expires during a scheduled production rollout. Which operator action best meets this technical requirement?
- For this Azure workload, the team should grant permanent Global Administrator to the build app without assessing permissions.
- For this Azure workload, the team should delete the active certificate before testing the replacement.
- For this Azure workload, the team should publish the client secret in the repository to avoid missing deployments.
- For this Azure workload, the team should rotate or replace credentials securely with overlap and update authorized consuming workloads.
Explanation
Correct Answer
D:Confirm the change against these records: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
Incorrect Answers
A:Grant permanent Global Administrator to the build app without assessing permissions. The proposed change targets the wrong mechanism or lacks essential validation. Service principal application credentials must be valid and protected for noninteractive authentication. Relevant evidence is credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
B:An expired or leaked credential can break automation or expose broad app authority. In the given case, a service principal uses a long-lived shared certificate that expires during a scheduled production rollout.
C:An expired or leaked credential can break automation or expose broad app authority. Publish the client secret in the repository to avoid missing deployments.
Question 177
A service principal uses a long-lived shared certificate that expires during a scheduled production rollout. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine a user display name without the access-token claims or authorization decision.
Explanation
Correct Answer
B:These records test the actual service principal credential rotation behavior rather than an unrelated dashboard state. The intended action is: Rotate or replace credentials securely with overlap and update authorized consuming workloads.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a service principal uses a long-lived shared certificate that expires during a scheduled production rollout.
C:Service principal application credentials must be valid and protected for noninteractive authentication.
D:The more relevant observations are: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
Question 178
A service principal uses a long-lived shared certificate that expires during a scheduled production rollout. Which statement most accurately explains this scenario?
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that service principal application credentials must be valid and protected for noninteractive authentication.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
Explanation
Correct Answer
B:Confirmation depends on Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition. Service principal application credentials must be valid and protected for noninteractive authentication.
Incorrect Answers
A:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for service principal credential rotation. The relevant security behavior is: Service principal application credentials must be valid and protected for noninteractive authentication. Check evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
C:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for service principal credential rotation. The relevant security behavior is: Service principal application credentials must be valid and protected for noninteractive authentication. Check evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
D:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for service principal credential rotation. The relevant security behavior is: Service principal application credentials must be valid and protected for noninteractive authentication. Check evidence such as credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition.
Question 179
A service principal uses a long-lived shared certificate that expires during a scheduled production rollout. Suppose the operator instead follows this unsafe shortcut: Publish the client secret in the repository to avoid missing deployments. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that an expired or leaked credential can break automation or expose broad app authority.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
Explanation
Correct Answer
B:The suitable control is: Rotate or replace credentials securely with overlap and update authorized consuming workloads. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real service principal credential rotation weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
C:This does not explain the real service principal credential rotation weakness after the shortcut. The only harm is a cosmetic app display-name difference.
D:This does not explain the real service principal credential rotation weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
Question 180
A service principal uses a long-lived shared certificate that expires during a scheduled production rollout. A review identifies this consequence: An expired or leaked credential can break automation or expose broad app authority. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to delete the active certificate before testing the replacement.
- The controlled remediation is to publish the client secret in the repository to avoid missing deployments.
- The controlled remediation is to introduce the approved new credential, validate consumers and revoke the old one after migration.
- The controlled remediation is to grant permanent Global Administrator to the build app without assessing permissions.
Explanation
Correct Answer
C:Test using these records: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition. Service principal application credentials must be valid and protected for noninteractive authentication.
Incorrect Answers
A:Delete the active certificate before testing the replacement. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
B:Publish the client secret in the repository to avoid missing deployments. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
D:Grant permanent Global Administrator to the build app without assessing permissions. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
