cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 22

Question 210

A service migrates between Azure compute resources and its identity should not be destroyed with one VM. A review identifies this consequence: Using only disposable system-assigned identities may require repeated role changes after application replacements. Which remediation most directly restores the intended behavior?

  1. The controlled remediation is to place the identity's client secret in every host configuration file.
  2. The controlled remediation is to create one global administrator user account to act as every workload identity.
  3. The controlled remediation is to bind the approved user-assigned identity and verify its continuity and scoped permissions.
  4. The controlled remediation is to assume user-assigned managed identities can never be shared between supported Azure resources.

Explanation

Correct Answer

C:

Test using these records: User-assigned identity resource ID, attached workloads, role assignments and token identity. A user-assigned managed identity has its own lifecycle and may be attached to supported resources.

Incorrect Answers

A:

Place the identity's client secret in every host configuration file. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.

B:

Create one global administrator user account to act as every workload identity. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.

D:

Assume user-assigned managed identities can never be shared between supported Azure resources. This would not reliably restore the intended security boundary. Using only disposable system-assigned identities may require repeated role changes after application replacements. The appropriate controlled recovery is: Bind the approved user-assigned identity and verify its continuity and scoped permissions.

Question 211

A VM application has a valid managed identity but still sends username and password to Azure Key Vault. Which configuration decision MOST directly resolves the issue?

  1. Send the Key Vault URI as a password instead of requesting an access token.
  2. Assume all Azure API audiences accept the same token regardless of scope.
  3. Copy a developer's interactive refresh token onto production servers.
  4. Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource.

Explanation

Correct Answer

D:

Confirm the change against these records: Assigned identity, SDK credential chain, token audience and target resource response. Managed identity authentication supplies scoped workload tokens without storing application secrets.

Incorrect Answers

A:

An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. Send the Key Vault URI as a password instead of requesting an access token.

B:

Assume all Azure API audiences accept the same token regardless of scope. The proposed change targets the wrong mechanism or lacks essential validation. Managed identity authentication supplies scoped workload tokens without storing application secrets. Relevant evidence is assigned identity, SDK credential chain, token audience and target resource response.

C:

An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The intended action is: Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource.

Question 212

A VM application has a valid managed identity but still sends username and password to Azure Key Vault. What evidence most directly confirms the intended security behavior?

  1. Assigned identity, SDK credential chain, token audience and target resource response.
  2. The expected access policy written in a design note but not assigned.
  3. A historical sign-in screenshot with no target resource or principal ID.
  4. A successful login to another unrelated cloud application.

Explanation

Correct Answer

A:

These records test the actual managed identity token endpoint access behavior rather than an unrelated dashboard state. Managed identity authentication supplies scoped workload tokens without storing application secrets.

Incorrect Answers

B:

On its own, that evidence does not prove the specified security control works. Managed identity authentication supplies scoped workload tokens without storing application secrets.

C:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: Assigned identity, SDK credential chain, token audience and target resource response.

D:

On its own, that evidence does not prove the specified security control works. In the given case, a VM application has a valid managed identity but still sends username and password to Azure Key Vault.

Question 213

A VM application has a valid managed identity but still sends username and password to Azure Key Vault. Which security principle best explains the intended decision?

  1. Adding a requested API scope automatically grants tenant-wide consent.
  2. Long-lived shared application secrets are always more secure than managed identities.
  3. Managed identity authentication supplies scoped workload tokens without storing application secrets.
  4. Assigning a role to a group means every resource ignores its narrower permissions.

Explanation

Correct Answer

C:

This principle supports the security response: Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource. Confirmation depends on Assigned identity, SDK credential chain, token audience and target resource response.

Incorrect Answers

A:

Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for managed identity token endpoint access. The relevant security behavior is: Managed identity authentication supplies scoped workload tokens without storing application secrets. Check evidence such as assigned identity, SDK credential chain, token audience and target resource response.

B:

Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for managed identity token endpoint access. The relevant security behavior is: Managed identity authentication supplies scoped workload tokens without storing application secrets. Check evidence such as assigned identity, SDK credential chain, token audience and target resource response.

D:

Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for managed identity token endpoint access. The relevant security behavior is: Managed identity authentication supplies scoped workload tokens without storing application secrets. Check evidence such as assigned identity, SDK credential chain, token audience and target resource response.

Question 214

A VM application has a valid managed identity but still sends username and password to Azure Key Vault. Suppose the operator instead follows this unsafe shortcut: Send the Key Vault URI as a password instead of requesting an access token. Which resulting risk or fault should the reviewer identify?

  1. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token.
  2. The only harm is a cosmetic app display-name difference.
  3. Reviewing current access tokens creates missing authorization scopes.
  4. Testing a least-privilege login disables the normal authentication platform.

Explanation

Correct Answer

A:

The suitable control is: Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource. Managed identity authentication supplies scoped workload tokens without storing application secrets.

Incorrect Answers

B:

This does not explain the real managed identity token endpoint access weakness after the shortcut. The material failure is: An identity attached to a host does not make arbitrary application code automatically obtain the required audience token.

C:

This does not explain the real managed identity token endpoint access weakness after the shortcut. Inspect evidence such as assigned identity, SDK credential chain, token audience and target resource response.

D:

This does not explain the real managed identity token endpoint access weakness after the shortcut. In the given case, a VM application has a valid managed identity but still sends username and password to Azure Key Vault.

Question 215

A VM application has a valid managed identity but still sends username and password to Azure Key Vault. A review identifies this consequence: An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. Which remediation most directly restores the intended behavior?

  1. Assume all Azure API audiences accept the same token regardless of scope.
  2. Copy a developer's interactive refresh token onto production servers.
  3. Send the Key Vault URI as a password instead of requesting an access token.
  4. Correct the managed identity credential configuration and verify target API authorization.

Explanation

Correct Answer

D:

Test using these records: Assigned identity, SDK credential chain, token audience and target resource response. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Assume all Azure API audiences accept the same token regardless of scope. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

B:

Copy a developer's interactive refresh token onto production servers. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

C:

Send the Key Vault URI as a password instead of requesting an access token. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

Question 216

An Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity. Which operator action best meets this technical requirement?

  1. For this Azure workload, the team should assume all Azure API audiences accept the same token regardless of scope.
  2. For this Azure workload, the team should copy a developer's interactive refresh token onto production servers.
  3. For this Azure workload, the team should send the Key Vault URI as a password instead of requesting an access token.
  4. For this Azure workload, the team should use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource.

Explanation

Correct Answer

D:

Confirm the change against these records: Assigned identity, SDK credential chain, token audience and target resource response.

Incorrect Answers

A:

Assume all Azure API audiences accept the same token regardless of scope. The proposed change targets the wrong mechanism or lacks essential validation. Managed identity authentication supplies scoped workload tokens without storing application secrets. Relevant evidence is assigned identity, SDK credential chain, token audience and target resource response.

B:

An identity attached to a host does not make arbitrary application code automatically obtain the required audience token.

C:

Send the Key Vault URI as a password instead of requesting an access token.

Question 217

An Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity. Which collection of observations most directly tests the suspected cause?

  1. In this security review, examine assigned identity, SDK credential chain, token audience and target resource response.
  2. In this security review, examine an old tenant role export without a current role scope or effective assignment.
  3. In this security review, examine the expected access policy written in a design note but not assigned.
  4. In this security review, examine a historical sign-in screenshot with no target resource or principal ID.

Explanation

Correct Answer

A:

These records test the actual managed identity token endpoint access behavior rather than an unrelated dashboard state. The intended action is: Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource.

Incorrect Answers

B:

On its own, that evidence does not prove the specified security control works. In the given case, an Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity.

C:

The more relevant observations are: Assigned identity, SDK credential chain, token audience and target resource response.

D:

In the given case, an Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity.

Question 218

An Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity. Which statement most accurately explains this scenario?

  1. The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
  2. The applicable security principle is that managed identity authentication supplies scoped workload tokens without storing application secrets.
  3. The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
  4. The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.

Explanation

Correct Answer

B:

This principle supports the security response: Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource.

Incorrect Answers

A:

Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for managed identity token endpoint access. The relevant security behavior is: Managed identity authentication supplies scoped workload tokens without storing application secrets. Check evidence such as assigned identity, SDK credential chain, token audience and target resource response.

C:

Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for managed identity token endpoint access. The relevant security behavior is: Managed identity authentication supplies scoped workload tokens without storing application secrets. Check evidence such as assigned identity, SDK credential chain, token audience and target resource response.

D:

An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for managed identity token endpoint access. The relevant security behavior is: Managed identity authentication supplies scoped workload tokens without storing application secrets. Check evidence such as assigned identity, SDK credential chain, token audience and target resource response.

Question 219

An Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity. Suppose the operator instead follows this unsafe shortcut: Send the Key Vault URI as a password instead of requesting an access token. What is the principal technical consequence of the mistaken choice?

  1. The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
  2. The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
  3. The resulting security weakness is that an identity attached to a host does not make arbitrary application code automatically obtain the required audience token.
  4. The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.

Explanation

Correct Answer

C:

The suitable control is: Use a supported Azure identity SDK or managed identity endpoint and request a token for the correct resource. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real managed identity token endpoint access weakness after the shortcut. In the given case, an Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity.

B:

This does not explain the real managed identity token endpoint access weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.

D:

The material failure is: An identity attached to a host does not make arbitrary application code automatically obtain the required audience token.

Question 220

An Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity. A review identifies this consequence: An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. Which recovery action restores the intended control and validates its effect?

  1. The controlled remediation is to correct the managed identity credential configuration and verify target API authorization.
  2. The controlled remediation is to copy a developer's interactive refresh token onto production servers.
  3. The controlled remediation is to send the Key Vault URI as a password instead of requesting an access token.
  4. The controlled remediation is to assume all Azure API audiences accept the same token regardless of scope.

Explanation

Correct Answer

A:

Test using these records: Assigned identity, SDK credential chain, token audience and target resource response. Managed identity authentication supplies scoped workload tokens without storing application secrets.

Incorrect Answers

B:

Copy a developer's interactive refresh token onto production servers. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

C:

Send the Key Vault URI as a password instead of requesting an access token. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

D:

Assume all Azure API audiences accept the same token regardless of scope. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

Microsoft Azure Security Technologies (AZ-500) Practice Tests