Microsoft AZ-500 Practice Test 20
Question 190
An Azure DevOps job receives a mismatched subject assertion after its federated credential subject was configured incorrectly. A review identifies this consequence: Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to add a long-lived tenant root password to the CI YAML.
- The controlled remediation is to accept OIDC tokens from any repository subject without restriction.
- The controlled remediation is to disable signature verification to make federated assertions work.
- The controlled remediation is to correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
Explanation
Correct Answer
D:Workload identity federation can exchange trusted external OIDC assertions for Azure tokens without storing a client secret. Test using these records: OIDC token issuer and subject, app federated credential mapping, sign-in error and role scope.
Incorrect Answers
A:Add a long-lived tenant root password to the CI YAML. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
B:Accept OIDC tokens from any repository subject without restriction. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
C:Disable signature verification to make federated assertions work. This would not reliably restore the intended security boundary. Broad or mismatched federation trusts can allow unintended identities or deny the expected pipeline. The appropriate controlled recovery is: Correct claim matching and test a secretless deployment with least-privilege Azure RBAC.
Question 191
An Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity. What is the most defensible Azure security action?
- Copy the VM's local administrator password into the vault access policy.
- Assume a system-assigned identity persists as the same principal after deleting its resource.
- Grant subscription Owner instead of the narrow Key Vault access role.
- Enable the resource's system-assigned managed identity and grant only the necessary target resource role.
Explanation
Correct Answer
D:Confirm the change against these records: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access. A system-assigned managed identity is tied to its Azure resource lifecycle.
Incorrect Answers
A:Recreating a resource can produce a different principal and invalidate grants attached to the old identity.
B:Assume a system-assigned identity persists as the same principal after deleting its resource. The proposed change targets the wrong mechanism or lacks essential validation. A system-assigned managed identity is tied to its Azure resource lifecycle. Relevant evidence is managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
C:Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The intended action is: Enable the resource's system-assigned managed identity and grant only the necessary target resource role.
Question 192
An Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity. Which diagnostic record would most strongly confirm the result?
- A historical sign-in screenshot with no target resource or principal ID.
- An old tenant role export without a current role scope or effective assignment.
- Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
- The expected access policy written in a design note but not assigned.
Explanation
Correct Answer
C:These records test the actual system-assigned managed identity lifecycle behavior rather than an unrelated dashboard state. The intended action is: Enable the resource's system-assigned managed identity and grant only the necessary target resource role.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
B:On its own, that evidence does not prove the specified security control works. A system-assigned managed identity is tied to its Azure resource lifecycle.
D:On its own, that evidence does not prove the specified security control works. In the given case, an Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity.
Question 193
An Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity. Which platform concept should guide the engineer’s assessment?
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- Assigning a role to a group means every resource ignores its narrower permissions.
- Adding a requested API scope automatically grants tenant-wide consent.
- A system-assigned managed identity is tied to its Azure resource lifecycle.
Explanation
Correct Answer
D:This principle supports the security response: Enable the resource's system-assigned managed identity and grant only the necessary target resource role. Confirmation depends on Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
Incorrect Answers
A:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for system-assigned managed identity lifecycle. The relevant security behavior is: A system-assigned managed identity is tied to its Azure resource lifecycle. Check evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
B:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for system-assigned managed identity lifecycle. The relevant security behavior is: A system-assigned managed identity is tied to its Azure resource lifecycle. Check evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for system-assigned managed identity lifecycle. The relevant security behavior is: A system-assigned managed identity is tied to its Azure resource lifecycle. Check evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
Question 194
An Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity. Suppose the operator instead follows this unsafe shortcut: Copy the VM's local administrator password into the vault access policy. Which root-cause observation follows from that incorrect change?
- Reviewing current access tokens creates missing authorization scopes.
- Recreating a resource can produce a different principal and invalidate grants attached to the old identity.
- Testing a least-privilege login disables the normal authentication platform.
- Removing excessive admin permissions caused the original unauthorized elevation.
Explanation
Correct Answer
B:The suitable control is: Enable the resource's system-assigned managed identity and grant only the necessary target resource role. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real system-assigned managed identity lifecycle weakness after the shortcut. The material failure is: Recreating a resource can produce a different principal and invalidate grants attached to the old identity.
C:This does not explain the real system-assigned managed identity lifecycle weakness after the shortcut. Inspect evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
D:This does not explain the real system-assigned managed identity lifecycle weakness after the shortcut. In the given case, an Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity.
Question 195
An Azure VM must read a Key Vault secret but the code embeds a stored application secret instead of using its own identity. A review identifies this consequence: Recreating a resource can produce a different principal and invalidate grants attached to the old identity. Which recovery action addresses the underlying technical fault?
- Assume a system-assigned identity persists as the same principal after deleting its resource.
- Grant subscription Owner instead of the narrow Key Vault access role.
- Assign the new resource principal correctly and verify access without application secrets.
- Copy the VM's local administrator password into the vault access policy.
Explanation
Correct Answer
C:Test using these records: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:That option would assume a system-assigned identity persists as the same principal after deleting its resource, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
B:That option would grant subscription Owner instead of the narrow Key Vault access role, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
D:Copy the VM's local administrator password into the vault access policy. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
Question 196
A Function App is recreated and its former identity loses access to a required storage data role. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should assume a system-assigned identity persists as the same principal after deleting its resource.
- For this Azure workload, the team should grant subscription Owner instead of the narrow Key Vault access role.
- For this Azure workload, the team should copy the VM's local administrator password into the vault access policy.
- For this Azure workload, the team should enable the resource's system-assigned managed identity and grant only the necessary target resource role.
Explanation
Correct Answer
D:Confirm the change against these records: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access. Enable the resource's system-assigned managed identity and grant only the necessary target resource role.
Incorrect Answers
A:Assume a system-assigned identity persists as the same principal after deleting its resource. The proposed change targets the wrong mechanism or lacks essential validation. A system-assigned managed identity is tied to its Azure resource lifecycle. Relevant evidence is managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
B:Recreating a resource can produce a different principal and invalidate grants attached to the old identity. Grant subscription Owner instead of the narrow Key Vault access role.
C:Recreating a resource can produce a different principal and invalidate grants attached to the old identity. Copy the VM's local administrator password into the vault access policy.
Question 197
A Function App is recreated and its former identity loses access to a required storage data role. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a user display name without the access-token claims or authorization decision.
- In this security review, examine managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
Explanation
Correct Answer
B:These records test the actual system-assigned managed identity lifecycle behavior rather than an unrelated dashboard state. A system-assigned managed identity is tied to its Azure resource lifecycle.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a Function App is recreated and its former identity loses access to a required storage data role.
C:The more relevant observations are: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
D:An old tenant role export without a current role scope or effective assignment. On its own, that evidence does not prove the specified security control works. The more relevant observations are: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access. A system-assigned managed identity is tied to its Azure resource lifecycle.
Question 198
A Function App is recreated and its former identity loses access to a required storage data role. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that a system-assigned managed identity is tied to its Azure resource lifecycle.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
Explanation
Correct Answer
C:This principle supports the security response: Enable the resource's system-assigned managed identity and grant only the necessary target resource role.
Incorrect Answers
A:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for system-assigned managed identity lifecycle. The relevant security behavior is: A system-assigned managed identity is tied to its Azure resource lifecycle. Check evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
B:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for system-assigned managed identity lifecycle. The relevant security behavior is: A system-assigned managed identity is tied to its Azure resource lifecycle. Check evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
D:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for system-assigned managed identity lifecycle. The relevant security behavior is: A system-assigned managed identity is tied to its Azure resource lifecycle. Check evidence such as managed identity principal ID, target RBAC, token acquisition and successful least-privileged access.
Question 199
A Function App is recreated and its former identity loses access to a required storage data role. Suppose the operator instead follows this unsafe shortcut: Copy the VM's local administrator password into the vault access policy. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that recreating a resource can produce a different principal and invalidate grants attached to the old identity.
Explanation
Correct Answer
D:The suitable control is: Enable the resource's system-assigned managed identity and grant only the necessary target resource role. Recreating a resource can produce a different principal and invalidate grants attached to the old identity.
Incorrect Answers
A:This does not explain the real system-assigned managed identity lifecycle weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
B:This does not explain the real system-assigned managed identity lifecycle weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
C:This does not explain the real system-assigned managed identity lifecycle weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
Question 200
A Function App is recreated and its former identity loses access to a required storage data role. A review identifies this consequence: Recreating a resource can produce a different principal and invalidate grants attached to the old identity. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to grant subscription Owner instead of the narrow Key Vault access role.
- The controlled remediation is to copy the VM's local administrator password into the vault access policy.
- The controlled remediation is to assign the new resource principal correctly and verify access without application secrets.
- The controlled remediation is to assume a system-assigned identity persists as the same principal after deleting its resource.
Explanation
Correct Answer
C:Test using these records: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access. A system-assigned managed identity is tied to its Azure resource lifecycle.
Incorrect Answers
A:Grant subscription Owner instead of the narrow Key Vault access role. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
B:Copy the VM's local administrator password into the vault access policy. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
D:Assume a system-assigned identity persists as the same principal after deleting its resource. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
