Microsoft AZ-500 Practice Test 21
Question 200
A Function App is recreated and its former identity loses access to a required storage data role. A review identifies this consequence: Recreating a resource can produce a different principal and invalidate grants attached to the old identity. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to grant subscription Owner instead of the narrow Key Vault access role.
- The controlled remediation is to copy the VM's local administrator password into the vault access policy.
- The controlled remediation is to assign the new resource principal correctly and verify access without application secrets.
- The controlled remediation is to assume a system-assigned identity persists as the same principal after deleting its resource.
Explanation
Correct Answer
C:Test using these records: Managed identity principal ID, target RBAC, token acquisition and successful least-privileged access. A system-assigned managed identity is tied to its Azure resource lifecycle.
Incorrect Answers
A:Grant subscription Owner instead of the narrow Key Vault access role. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
B:Copy the VM's local administrator password into the vault access policy. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
D:Assume a system-assigned identity persists as the same principal after deleting its resource. This would not reliably restore the intended security boundary. Recreating a resource can produce a different principal and invalidate grants attached to the old identity. The appropriate controlled recovery is: Assign the new resource principal correctly and verify access without application secrets.
Question 201
Two container apps need a stable approved identity for a shared deployment role even when individual apps are replaced. What is the BEST supported implementation or corrective action?
- Create one global administrator user account to act as every workload identity.
- Assume user-assigned managed identities can never be shared between supported Azure resources.
- Attach a separately managed user-assigned identity and scope its role assignments appropriately.
- Place the identity's client secret in every host configuration file.
Explanation
Correct Answer
C:Confirm the change against these records: User-assigned identity resource ID, attached workloads, role assignments and token identity. A user-assigned managed identity has its own lifecycle and may be attached to supported resources.
Incorrect Answers
A:Using only disposable system-assigned identities may require repeated role changes after application replacements. Create one global administrator user account to act as every workload identity.
B:A user-assigned managed identity has its own lifecycle and may be attached to supported resources. The proposed change targets the wrong mechanism or lacks essential validation.
D:Using only disposable system-assigned identities may require repeated role changes after application replacements. The intended action is: Attach a separately managed user-assigned identity and scope its role assignments appropriately.
Question 202
Two container apps need a stable approved identity for a shared deployment role even when individual apps are replaced. Which evidence BEST verifies the intended technical behavior?
- A user display name without the access-token claims or authorization decision.
- User-assigned identity resource ID, attached workloads, role assignments and token identity.
- A successful login to another unrelated cloud application.
- An old tenant role export without a current role scope or effective assignment.
Explanation
Correct Answer
B:These records test the actual user-assigned managed identity reuse behavior rather than an unrelated dashboard state. A user-assigned managed identity has its own lifecycle and may be attached to supported resources.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: User-assigned identity resource ID, attached workloads, role assignments and token identity.
C:On its own, that evidence does not prove the specified security control works. A user-assigned managed identity has its own lifecycle and may be attached to supported resources.
D:On its own, that evidence does not prove the specified security control works. In the given case, two container apps need a stable approved identity for a shared deployment role even when individual apps are replaced.
Question 203
Two container apps need a stable approved identity for a shared deployment role even when individual apps are replaced. Which principle BEST explains why the recommended solution is appropriate?
- A user-assigned managed identity has its own lifecycle and may be attached to supported resources.
- Long-lived shared application secrets are always more secure than managed identities.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- A valid sign-in eliminates all requirements for scoped authorization.
Explanation
Correct Answer
A:This principle supports the security response: Attach a separately managed user-assigned identity and scope its role assignments appropriately. Confirmation depends on User-assigned identity resource ID, attached workloads, role assignments and token identity.
Incorrect Answers
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for user-assigned managed identity reuse. The relevant security behavior is: A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Check evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
C:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for user-assigned managed identity reuse. The relevant security behavior is: A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Check evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
D:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for user-assigned managed identity reuse. The relevant security behavior is: A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Check evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
Question 204
Two container apps need a stable approved identity for a shared deployment role even when individual apps are replaced. Suppose the operator instead follows this unsafe shortcut: Create one global administrator user account to act as every workload identity. What is the MOST significant failure introduced by that shortcut?
- Removing excessive admin permissions caused the original unauthorized elevation.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
- The only harm is a cosmetic app display-name difference.
- Using only disposable system-assigned identities may require repeated role changes after application replacements.
Explanation
Correct Answer
D:A user-assigned managed identity has its own lifecycle and may be attached to supported resources. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real user-assigned managed identity reuse weakness after the shortcut. The material failure is: Using only disposable system-assigned identities may require repeated role changes after application replacements.
B:This does not explain the real user-assigned managed identity reuse weakness after the shortcut. Inspect evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
C:This does not explain the real user-assigned managed identity reuse weakness after the shortcut. The only harm is a cosmetic app display-name difference.
Question 205
Two container apps need a stable approved identity for a shared deployment role even when individual apps are replaced. A review identifies this consequence: Using only disposable system-assigned identities may require repeated role changes after application replacements. What is the BEST controlled recovery once this failure is recognized?
- Bind the approved user-assigned identity and verify its continuity and scoped permissions.
- Assume user-assigned managed identities can never be shared between supported Azure resources.
- Place the identity's client secret in every host configuration file.
- Create one global administrator user account to act as every workload identity.
Explanation
Correct Answer
A:Test using these records: User-assigned identity resource ID, attached workloads, role assignments and token identity. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Assume user-assigned managed identities can never be shared between supported Azure resources. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.
C:Place the identity's client secret in every host configuration file. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.
D:Create one global administrator user account to act as every workload identity. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.
Question 206
A service migrates between Azure compute resources and its identity should not be destroyed with one VM. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should assume user-assigned managed identities can never be shared between supported Azure resources.
- For this Azure workload, the team should place the identity's client secret in every host configuration file.
- For this Azure workload, the team should create one global administrator user account to act as every workload identity.
- For this Azure workload, the team should attach a separately managed user-assigned identity and scope its role assignments appropriately.
Explanation
Correct Answer
D:Confirm the change against these records: User-assigned identity resource ID, attached workloads, role assignments and token identity.
Incorrect Answers
A:A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Relevant evidence is user-assigned identity resource ID, attached workloads, role assignments and token identity.
B:Using only disposable system-assigned identities may require repeated role changes after application replacements.
C:In the given case, a service migrates between Azure compute resources and its identity should not be destroyed with one VM.
Question 207
A service migrates between Azure compute resources and its identity should not be destroyed with one VM. What evidence most directly confirms the intended security behavior?
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine user-assigned identity resource ID, attached workloads, role assignments and token identity.
- In this security review, examine a user display name without the access-token claims or authorization decision.
- In this security review, examine a successful login to another unrelated cloud application.
Explanation
Correct Answer
B:These records test the actual user-assigned managed identity reuse behavior rather than an unrelated dashboard state. The intended action is: Attach a separately managed user-assigned identity and scope its role assignments appropriately.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a service migrates between Azure compute resources and its identity should not be destroyed with one VM.
C:The more relevant observations are: User-assigned identity resource ID, attached workloads, role assignments and token identity.
D:A user-assigned managed identity has its own lifecycle and may be attached to supported resources.
Question 208
A service migrates between Azure compute resources and its identity should not be destroyed with one VM. Which security principle best explains the intended decision?
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
- The applicable security principle is that a user-assigned managed identity has its own lifecycle and may be attached to supported resources.
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
Explanation
Correct Answer
C:This principle supports the security response: Attach a separately managed user-assigned identity and scope its role assignments appropriately.
Incorrect Answers
A:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for user-assigned managed identity reuse. The relevant security behavior is: A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Check evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
B:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for user-assigned managed identity reuse. The relevant security behavior is: A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Check evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
D:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for user-assigned managed identity reuse. The relevant security behavior is: A user-assigned managed identity has its own lifecycle and may be attached to supported resources. Check evidence such as user-assigned identity resource ID, attached workloads, role assignments and token identity.
Question 209
A service migrates between Azure compute resources and its identity should not be destroyed with one VM. Suppose the operator instead follows this unsafe shortcut: Create one global administrator user account to act as every workload identity. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that using only disposable system-assigned identities may require repeated role changes after application replacements.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
Explanation
Correct Answer
A:A user-assigned managed identity has its own lifecycle and may be attached to supported resources. The suitable control is: Attach a separately managed user-assigned identity and scope its role assignments appropriately.
Incorrect Answers
B:This does not explain the real user-assigned managed identity reuse weakness after the shortcut. In the given case, a service migrates between Azure compute resources and its identity should not be destroyed with one VM.
C:The material failure is: Using only disposable system-assigned identities may require repeated role changes after application replacements.
D:This does not explain the real user-assigned managed identity reuse weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
Question 210
A service migrates between Azure compute resources and its identity should not be destroyed with one VM. A review identifies this consequence: Using only disposable system-assigned identities may require repeated role changes after application replacements. Which remediation most directly restores the intended behavior?
- The controlled remediation is to place the identity's client secret in every host configuration file.
- The controlled remediation is to create one global administrator user account to act as every workload identity.
- The controlled remediation is to bind the approved user-assigned identity and verify its continuity and scoped permissions.
- The controlled remediation is to assume user-assigned managed identities can never be shared between supported Azure resources.
Explanation
Correct Answer
C:Test using these records: User-assigned identity resource ID, attached workloads, role assignments and token identity. A user-assigned managed identity has its own lifecycle and may be attached to supported resources.
Incorrect Answers
A:Place the identity's client secret in every host configuration file. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.
B:Create one global administrator user account to act as every workload identity. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.
D:Assume user-assigned managed identities can never be shared between supported Azure resources. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.
