Microsoft AZ-500 Practice Test 2
Question 10
A contractor should inspect one storage account but a team proposes granting Owner across the entire subscription. A review identifies this consequence: A broad subscription role grants unnecessary write capabilities outside the analyst's responsibility. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assign Owner at every subscription and rely on verbal limits.
- The controlled remediation is to grant Contributor at the tenant root to make read access easy.
- The controlled remediation is to apply a resource lock as a replacement for appropriate RBAC.
- The controlled remediation is to remove the broad grant and verify the least privileged Reader assignment at the intended scope.
Explanation
Correct Answer
D:Test using these records: Effective role assignment, principal identity, inheritance tree and tested read versus write operations. Azure RBAC roles inherit downward from management group, subscription, resource group or resource scopes.
Incorrect Answers
A:Assign Owner at every subscription and rely on verbal limits. This would not reliably restore the intended security boundary. A broad subscription role grants unnecessary write capabilities outside the analyst's responsibility. The appropriate controlled recovery is: Remove the broad grant and verify the least privileged Reader assignment at the intended scope.
B:Grant Contributor at the tenant root to make read access easy. This would not reliably restore the intended security boundary. A broad subscription role grants unnecessary write capabilities outside the analyst's responsibility. The appropriate controlled recovery is: Remove the broad grant and verify the least privileged Reader assignment at the intended scope.
C:Apply a resource lock as a replacement for appropriate RBAC. This would not reliably restore the intended security boundary. A broad subscription role grants unnecessary write capabilities outside the analyst's responsibility. The appropriate controlled recovery is: Remove the broad grant and verify the least privileged Reader assignment at the intended scope.
Question 11
A storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials. Which configuration decision MOST directly resolves the issue?
- Grant subscription Owner without checking the specific storage data role.
- Use a network security group to grant object-level RBAC permissions.
- Assume management Contributor always includes blob data read.
- Grant the required scoped data-plane role while keeping management permissions separate.
Explanation
Correct Answer
D:Confirm the change against these records: Effective management and data role assignments and an authenticated operation against the target data. This directly addresses Azure RBAC data plane versus management plane.
Incorrect Answers
A:Changing the ARM management role alone may leave a data read denied or grant unrelated administration. Grant subscription Owner without checking the specific storage data role.
B:Use a network security group to grant object-level RBAC permissions. The proposed change targets the wrong mechanism or lacks essential validation. Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Relevant evidence is effective management and data role assignments and an authenticated operation against the target data.
C:Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The intended action is: Grant the required scoped data-plane role while keeping management permissions separate.
Question 12
A storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials. What evidence most directly confirms the intended security behavior?
- Effective management and data role assignments and an authenticated operation against the target data.
- The expected access policy written in a design note but not assigned.
- A historical sign-in screenshot with no target resource or principal ID.
- A successful login to another unrelated cloud application.
Explanation
Correct Answer
A:These records test the actual Azure RBAC data plane versus management plane behavior rather than an unrelated dashboard state. Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Effective management and data role assignments and an authenticated operation against the target data.
D:On its own, that evidence does not prove the specified security control works. In the given case, a storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials.
Question 13
A storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials. Which security principle best explains the intended decision?
- Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
- Adding a requested API scope automatically grants tenant-wide consent.
- Long-lived shared application secrets are always more secure than managed identities.
- Assigning a role to a group means every resource ignores its narrower permissions.
Explanation
Correct Answer
A:This principle supports the security response: Grant the required scoped data-plane role while keeping management permissions separate. Confirmation depends on Effective management and data role assignments and an authenticated operation against the target data.
Incorrect Answers
B:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Azure RBAC data plane versus management plane. The relevant security behavior is: Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Check evidence such as effective management and data role assignments and an authenticated operation against the target data.
C:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for Azure RBAC data plane versus management plane. The relevant security behavior is: Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Check evidence such as effective management and data role assignments and an authenticated operation against the target data.
D:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for Azure RBAC data plane versus management plane. The relevant security behavior is: Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Check evidence such as effective management and data role assignments and an authenticated operation against the target data.
Question 14
A storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials. Suppose the operator instead follows this unsafe shortcut: Grant subscription Owner without checking the specific storage data role. Which resulting risk or fault should the reviewer identify?
- The only harm is a cosmetic app display-name difference.
- Reviewing current access tokens creates missing authorization scopes.
- Testing a least-privilege login disables the normal authentication platform.
- Changing the ARM management role alone may leave a data read denied or grant unrelated administration.
Explanation
Correct Answer
D:The suitable control is: Grant the required scoped data-plane role while keeping management permissions separate. Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
Incorrect Answers
A:This does not explain the real Azure RBAC data plane versus management plane weakness after the shortcut. The material failure is: Changing the ARM management role alone may leave a data read denied or grant unrelated administration.
B:This does not explain the real Azure RBAC data plane versus management plane weakness after the shortcut. Inspect evidence such as effective management and data role assignments and an authenticated operation against the target data.
C:This does not explain the real Azure RBAC data plane versus management plane weakness after the shortcut. In the given case, a storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials.
Question 15
A storage analyst can edit the storage account resource but cannot read blob objects with Microsoft Entra credentials. A review identifies this consequence: Changing the ARM management role alone may leave a data read denied or grant unrelated administration. Which remediation most directly restores the intended behavior?
- Use a network security group to grant object-level RBAC permissions.
- Assume management Contributor always includes blob data read.
- Grant subscription Owner without checking the specific storage data role.
- Assign the smallest correct data role and verify a successful authorized data operation.
Explanation
Correct Answer
D:Test using these records: Effective management and data role assignments and an authenticated operation against the target data. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Use a network security group to grant object-level RBAC permissions. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
B:Assume management Contributor always includes blob data read. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
C:Grant subscription Owner without checking the specific storage data role. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
Question 16
A subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled. Which operator action best meets this technical requirement?
- For this Azure workload, the team should grant the required scoped data-plane role while keeping management permissions separate.
- For this Azure workload, the team should use a network security group to grant object-level RBAC permissions.
- For this Azure workload, the team should assume management Contributor always includes blob data read.
- For this Azure workload, the team should grant subscription Owner without checking the specific storage data role.
Explanation
Correct Answer
A:Confirm the change against these records: Effective management and data role assignments and an authenticated operation against the target data. Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
Incorrect Answers
B:Use a network security group to grant object-level RBAC permissions. The proposed change targets the wrong mechanism or lacks essential validation. Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Relevant evidence is effective management and data role assignments and an authenticated operation against the target data.
C:Changing the ARM management role alone may leave a data read denied or grant unrelated administration.
D:In the given case, a subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled.
Question 17
A subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled. Which collection of observations most directly tests the suspected cause?
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine effective management and data role assignments and an authenticated operation against the target data.
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
B:These records test the actual Azure RBAC data plane versus management plane behavior rather than an unrelated dashboard state. The intended action is: Grant the required scoped data-plane role while keeping management permissions separate.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled.
C:The more relevant observations are: Effective management and data role assignments and an authenticated operation against the target data.
D:On its own, that evidence does not prove the specified security control works. A historical sign-in screenshot with no target resource or principal ID.
Question 18
A subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled. Which statement most accurately explains this scenario?
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
Explanation
Correct Answer
D:This principle supports the security response: Grant the required scoped data-plane role while keeping management permissions separate.
Incorrect Answers
A:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for Azure RBAC data plane versus management plane. The relevant security behavior is: Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Check evidence such as effective management and data role assignments and an authenticated operation against the target data.
B:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Azure RBAC data plane versus management plane. The relevant security behavior is: Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Check evidence such as effective management and data role assignments and an authenticated operation against the target data.
C:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Azure RBAC data plane versus management plane. The relevant security behavior is: Azure control-plane permissions do not automatically imply every resource's data-plane permissions. Check evidence such as effective management and data role assignments and an authenticated operation against the target data.
Question 19
A subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled. Suppose the operator instead follows this unsafe shortcut: Grant subscription Owner without checking the specific storage data role. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that changing the ARM management role alone may leave a data read denied or grant unrelated administration.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
Explanation
Correct Answer
A:The suitable control is: Grant the required scoped data-plane role while keeping management permissions separate. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Azure RBAC data plane versus management plane weakness after the shortcut. In the given case, a subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled.
C:This does not explain the real Azure RBAC data plane versus management plane weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
D:The material failure is: Changing the ARM management role alone may leave a data read denied or grant unrelated administration.
Question 20
A subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled. A review identifies this consequence: Changing the ARM management role alone may leave a data read denied or grant unrelated administration. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to assume management Contributor always includes blob data read.
- The controlled remediation is to assign the smallest correct data role and verify a successful authorized data operation.
- The controlled remediation is to grant subscription Owner without checking the specific storage data role.
- The controlled remediation is to use a network security group to grant object-level RBAC permissions.
Explanation
Correct Answer
B:Test using these records: Effective management and data role assignments and an authenticated operation against the target data. Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
Incorrect Answers
A:Assume management Contributor always includes blob data read. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
C:Grant subscription Owner without checking the specific storage data role. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
D:Use a network security group to grant object-level RBAC permissions. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
