Microsoft AZ-500 Practice Test 19
Question 180
A service principal uses a long-lived shared certificate that expires during a scheduled production rollout. A review identifies this consequence: An expired or leaked credential can break automation or expose broad app authority. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to delete the active certificate before testing the replacement.
- The controlled remediation is to publish the client secret in the repository to avoid missing deployments.
- The controlled remediation is to introduce the approved new credential, validate consumers and revoke the old one after migration.
- The controlled remediation is to grant permanent Global Administrator to the build app without assessing permissions.
Explanation
Correct Answer
C:Test using these records: Credential expiry, service principal sign-in logs, secret or certificate reference and successful token acquisition. Service principal application credentials must be valid and protected for noninteractive authentication.
Incorrect Answers
A:Delete the active certificate before testing the replacement. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
B:Publish the client secret in the repository to avoid missing deployments. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
D:Grant permanent Global Administrator to the build app without assessing permissions. This would not reliably restore the intended security boundary. An expired or leaked credential can break automation or expose broad app authority. The appropriate controlled recovery is: Introduce the approved new credential, validate consumers and revoke the old one after migration.
Question 181
A GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern. Which operator action best meets this technical requirement?
- Accept OIDC tokens from any repository subject without restriction.
- Disable signature verification to make federated assertions work.
- Configure the precise issuer, subject and audience trust for an approved workload identity federation.
- Add a long-lived tenant root password to the CI YAML.
Explanation
Correct Answer
C:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Confirm the change against these records: OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Incorrect Answers
A:Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. Accept OIDC tokens from any repository subject without restriction.
B:Disable signature verification to make federated assertions work. The proposed change targets the wrong mechanism or lacks essential validation. Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Relevant evidence is oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
D:Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The intended action is: Configure the precise issuer, subject and audience trust for an approved workload identity federation.
Question 182
A GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern. Which collection of observations most directly tests the suspected cause?
- A successful login to another unrelated cloud application.
- The expected access policy written in a design note but not assigned.
- OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
- A user display name without the access-token claims or authorization decision.
Explanation
Correct Answer
C:These records test the actual federated identity credential for CI behavior rather than an unrelated dashboard state. Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
D:On its own, that evidence does not prove the specified security control works. In the given case, a GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern.
Question 183
A GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern. Which statement most accurately explains this scenario?
- Assigning a role to a group means every resource ignores its narrower permissions.
- Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
- A valid sign-in eliminates all requirements for scoped authorization.
- Long-lived shared application secrets are always more secure than managed identities.
Explanation
Correct Answer
B:Confirmation depends on OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope. This principle supports the security response: Configure the precise issuer, subject and audience trust for an approved workload identity federation.
Incorrect Answers
A:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for federated identity credential for CI. The relevant security behavior is: Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Check evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
C:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for federated identity credential for CI. The relevant security behavior is: Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Check evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
D:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for federated identity credential for CI. The relevant security behavior is: Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Check evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Question 184
A GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern. Suppose the operator instead follows this unsafe shortcut: Accept OIDC tokens from any repository subject without restriction. What is the principal technical consequence of the mistaken choice?
- Recording a sign-in audit trail is the reason the identity was overprivileged.
- Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline.
- The only harm is a cosmetic app display-name difference.
- Reviewing current access tokens creates missing authorization scopes.
Explanation
Correct Answer
B:The suitable control is: Configure the precise issuer, subject and audience trust for an approved workload identity federation.
Incorrect Answers
A:This does not explain the real federated identity credential for CI weakness after the shortcut. The material failure is: Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline.
C:This does not explain the real federated identity credential for CI weakness after the shortcut. Inspect evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
D:This does not explain the real federated identity credential for CI weakness after the shortcut. In the given case, a GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern.
Question 185
A GitHub Actions workflow uses a stored Azure client secret despite an available workload identity federation pattern. A review identifies this consequence: Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. Which recovery action restores the intended control and validates its effect?
- Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
- Disable signature verification to make federated assertions work.
- Add a long-lived tenant root password to the CI YAML.
- Accept OIDC tokens from any repository subject without restriction.
Explanation
Correct Answer
A:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Disable signature verification to make federated assertions work. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
C:Add a long-lived tenant root password to the CI YAML. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
D:Accept OIDC tokens from any repository subject without restriction. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
Question 186
An Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly. What is the most defensible Azure security action?
- For this Azure workload, the team should configure the precise issuer, subject and audience trust for an approved workload identity federation.
- For this Azure workload, the team should disable signature verification to make federated assertions work.
- For this Azure workload, the team should add a long-lived tenant root password to the CI YAML.
- For this Azure workload, the team should accept OIDC tokens from any repository subject without restriction.
Explanation
Correct Answer
A:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
Incorrect Answers
B:Disable signature verification to make federated assertions work. The proposed change targets the wrong mechanism or lacks essential validation. Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Relevant evidence is oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
C:Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. Add a long-lived tenant root password to the CI YAML.
D:Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline.
Question 187
An Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Explanation
Correct Answer
D:These records test the actual federated identity credential for CI behavior rather than an unrelated dashboard state. The intended action is: Configure the precise issuer, subject and audience trust for an approved workload identity federation.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly.
B:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
C:The more relevant observations are: OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Question 188
An Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
Explanation
Correct Answer
A:Confirmation depends on OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope. Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret.
Incorrect Answers
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for federated identity credential for CI. The relevant security behavior is: Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Check evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
C:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for federated identity credential for CI. The relevant security behavior is: Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Check evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
D:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for federated identity credential for CI. The relevant security behavior is: Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Check evidence such as oIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Question 189
An Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly. Suppose the operator instead follows this unsafe shortcut: Accept OIDC tokens from any repository subject without restriction. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
Explanation
Correct Answer
A:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real federated identity credential for CI weakness after the shortcut. In the given case, an Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly.
C:This does not explain the real federated identity credential for CI weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
D:This does not explain the real federated identity credential for CI weakness after the shortcut. The only harm is a cosmetic app display-name difference.
Question 190
An Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly. A review identifies this consequence: Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to add a long-lived tenant root password to the CI YAML.
- The controlled remediation is to accept OIDC tokens from any repository subject without restriction.
- The controlled remediation is to disable signature verification to make federated assertions work.
- The controlled remediation is to correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
Explanation
Correct Answer
D:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Test using these records: OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Incorrect Answers
A:Add a long-lived tenant root password to the CI YAML. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
B:Accept OIDC tokens from any repository subject without restriction. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
C:Disable signature verification to make federated assertions work. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
