cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 23

Question 220

An Azure App Service application cannot get an Azure access token because its SDK is not configured to use the assigned managed identity. A review identifies this consequence: An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. Which recovery action restores the intended control and validates its effect?

  1. The controlled remediation is to correct the managed identity credential configuration and verify target API authorization.
  2. The controlled remediation is to copy a developer's interactive refresh token onto production servers.
  3. The controlled remediation is to send the Key Vault URI as a password instead of requesting an access token.
  4. The controlled remediation is to assume all Azure API audiences accept the same token regardless of scope.

Explanation

Correct Answer

A:

Test using these records: Assigned identity, SDK credential chain, token audience and target resource response. Managed identity authentication supplies scoped workload tokens without storing application secrets.

Incorrect Answers

B:

Copy a developer's interactive refresh token onto production servers. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

C:

Send the Key Vault URI as a password instead of requesting an access token. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

D:

Assume all Azure API audiences accept the same token regardless of scope. This would not reliably restore the intended security boundary. An identity attached to a host does not make arbitrary application code automatically obtain the required audience token. The appropriate controlled recovery is: Correct the managed identity credential configuration and verify target API authorization.

Question 221

An old enterprise app still holds tenant-wide Graph permissions after its business purpose was reduced. Which operator action best meets this technical requirement?

  1. Review and revoke unnecessary enterprise application permissions and document approved access.
  2. Disable audit logging to avoid seeing application permission drift.
  3. Assume user account offboarding revokes every existing app-only permission.
  4. Increase all app permissions to prevent future consent prompts.

Explanation

Correct Answer

A:

Confirm the change against these records: Service principal grants, app owners, sign-in activity and consent audit trail. An enterprise application's effective permission grants should be periodically reviewed and minimized.

Incorrect Answers

B:

Disable audit logging to avoid seeing application permission drift. This is not a valid substitute for the specified security control. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The correct targeted action is: Review and revoke unnecessary enterprise application permissions and document approved access.

C:

Assume user account offboarding revokes every existing app-only permission. The proposed change targets the wrong mechanism or lacks essential validation. An enterprise application's effective permission grants should be periodically reviewed and minimized. Relevant evidence is service principal grants, app owners, sign-in activity and consent audit trail.

D:

Increase all app permissions to prevent future consent prompts. This leaves the security requirement unresolved. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The intended action is: Review and revoke unnecessary enterprise application permissions and document approved access.

Question 222

An old enterprise app still holds tenant-wide Graph permissions after its business purpose was reduced. Which collection of observations most directly tests the suspected cause?

  1. An old tenant role export without a current role scope or effective assignment.
  2. Service principal grants, app owners, sign-in activity and consent audit trail.
  3. A user display name without the access-token claims or authorization decision.
  4. A historical sign-in screenshot with no target resource or principal ID.

Explanation

Correct Answer

B:

These records test the actual application permission consent review behavior rather than an unrelated dashboard state. An enterprise application's effective permission grants should be periodically reviewed and minimized.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: Service principal grants, app owners, sign-in activity and consent audit trail.

C:

On its own, that evidence does not prove the specified security control works. An enterprise application's effective permission grants should be periodically reviewed and minimized.

D:

On its own, that evidence does not prove the specified security control works. In the given case, an old enterprise app still holds tenant-wide Graph permissions after its business purpose was reduced.

Question 223

An old enterprise app still holds tenant-wide Graph permissions after its business purpose was reduced. Which statement most accurately explains this scenario?

  1. An enterprise application's effective permission grants should be periodically reviewed and minimized.
  2. A valid sign-in eliminates all requirements for scoped authorization.
  3. Adding a requested API scope automatically grants tenant-wide consent.
  4. An Azure resource role automatically grants all Microsoft Entra directory privileges.

Explanation

Correct Answer

A:

This principle supports the security response: Review and revoke unnecessary enterprise application permissions and document approved access. Confirmation depends on Service principal grants, app owners, sign-in activity and consent audit trail.

Incorrect Answers

B:

A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for application permission consent review. The relevant security behavior is: An enterprise application's effective permission grants should be periodically reviewed and minimized. Check evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

C:

Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for application permission consent review. The relevant security behavior is: An enterprise application's effective permission grants should be periodically reviewed and minimized. Check evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

D:

An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for application permission consent review. The relevant security behavior is: An enterprise application's effective permission grants should be periodically reviewed and minimized. Check evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

Question 224

An old enterprise app still holds tenant-wide Graph permissions after its business purpose was reduced. Suppose the operator instead follows this unsafe shortcut: Disable audit logging to avoid seeing application permission drift. What is the principal technical consequence of the mistaken choice?

  1. Testing a least-privilege login disables the normal authentication platform.
  2. Dormant high-privilege app consent may remain exploitable even after human role cleanup.
  3. Removing excessive admin permissions caused the original unauthorized elevation.
  4. Recording a sign-in audit trail is the reason the identity was overprivileged.

Explanation

Correct Answer

B:

The suitable control is: Review and revoke unnecessary enterprise application permissions and document approved access. An enterprise application's effective permission grants should be periodically reviewed and minimized.

Incorrect Answers

A:

This does not explain the real application permission consent review weakness after the shortcut. Inspect evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

C:

This does not explain the real application permission consent review weakness after the shortcut. The material failure is: Dormant high-privilege app consent may remain exploitable even after human role cleanup.

D:

This does not explain the real application permission consent review weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.

Question 225

An old enterprise app still holds tenant-wide Graph permissions after its business purpose was reduced. A review identifies this consequence: Dormant high-privilege app consent may remain exploitable even after human role cleanup. Which recovery action restores the intended control and validates its effect?

  1. Assume user account offboarding revokes every existing app-only permission.
  2. Remove unneeded grants and validate the remaining legitimate integration calls.
  3. Increase all app permissions to prevent future consent prompts.
  4. Disable audit logging to avoid seeing application permission drift.

Explanation

Correct Answer

B:

Test using these records: Service principal grants, app owners, sign-in activity and consent audit trail. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Assume user account offboarding revokes every existing app-only permission. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.

C:

Increase all app permissions to prevent future consent prompts. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.

D:

Disable audit logging to avoid seeing application permission drift. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.

Question 226

A vendor integration has privileged API grants but its assigned owners and usage history no longer justify them. What is the most defensible Azure security action?

  1. For this Azure workload, the team should assume user account offboarding revokes every existing app-only permission.
  2. For this Azure workload, the team should increase all app permissions to prevent future consent prompts.
  3. For this Azure workload, the team should review and revoke unnecessary enterprise application permissions and document approved access.
  4. For this Azure workload, the team should disable audit logging to avoid seeing application permission drift.

Explanation

Correct Answer

C:

Confirm the change against these records: Service principal grants, app owners, sign-in activity and consent audit trail.

Incorrect Answers

A:

Assume user account offboarding revokes every existing app-only permission. The proposed change targets the wrong mechanism or lacks essential validation. An enterprise application's effective permission grants should be periodically reviewed and minimized. Relevant evidence is service principal grants, app owners, sign-in activity and consent audit trail.

B:

Increase all app permissions to prevent future consent prompts. This leaves the security requirement unresolved. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The intended action is: Review and revoke unnecessary enterprise application permissions and document approved access.

D:

Disable audit logging to avoid seeing application permission drift. This is not a valid substitute for the specified security control. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The correct targeted action is: Review and revoke unnecessary enterprise application permissions and document approved access.

Question 227

A vendor integration has privileged API grants but its assigned owners and usage history no longer justify them. Which diagnostic record would most strongly confirm the result?

  1. In this security review, examine a successful login to another unrelated cloud application.
  2. In this security review, examine service principal grants, app owners, sign-in activity and consent audit trail.
  3. In this security review, examine an old tenant role export without a current role scope or effective assignment.
  4. In this security review, examine a user display name without the access-token claims or authorization decision.

Explanation

Correct Answer

B:

These records test the actual application permission consent review behavior rather than an unrelated dashboard state. The intended action is: Review and revoke unnecessary enterprise application permissions and document approved access.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, a vendor integration has privileged API grants but its assigned owners and usage history no longer justify them.

C:

The more relevant observations are: Service principal grants, app owners, sign-in activity and consent audit trail.

D:

An enterprise application's effective permission grants should be periodically reviewed and minimized.

Question 228

A vendor integration has privileged API grants but its assigned owners and usage history no longer justify them. Which platform concept should guide the engineer’s assessment?

  1. The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
  2. The applicable security principle is that an enterprise application's effective permission grants should be periodically reviewed and minimized.
  3. The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
  4. The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.

Explanation

Correct Answer

B:

This principle supports the security response: Review and revoke unnecessary enterprise application permissions and document approved access.

Incorrect Answers

A:

An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for application permission consent review. The relevant security behavior is: An enterprise application's effective permission grants should be periodically reviewed and minimized. Check evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

C:

A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for application permission consent review. The relevant security behavior is: An enterprise application's effective permission grants should be periodically reviewed and minimized. Check evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

D:

Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for application permission consent review. The relevant security behavior is: An enterprise application's effective permission grants should be periodically reviewed and minimized. Check evidence such as service principal grants, app owners, sign-in activity and consent audit trail.

Question 229

A vendor integration has privileged API grants but its assigned owners and usage history no longer justify them. Suppose the operator instead follows this unsafe shortcut: Disable audit logging to avoid seeing application permission drift. Which root-cause observation follows from that incorrect change?

  1. The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
  2. The resulting security weakness is that the only harm is a cosmetic app display-name difference.
  3. The resulting security weakness is that dormant high-privilege app consent may remain exploitable even after human role cleanup.
  4. The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.

Explanation

Correct Answer

C:

The suitable control is: Review and revoke unnecessary enterprise application permissions and document approved access. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real application permission consent review weakness after the shortcut. In the given case, a vendor integration has privileged API grants but its assigned owners and usage history no longer justify them.

B:

This does not explain the real application permission consent review weakness after the shortcut. The only harm is a cosmetic app display-name difference.

D:

This does not explain the real application permission consent review weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.

Question 230

A vendor integration has privileged API grants but its assigned owners and usage history no longer justify them. A review identifies this consequence: Dormant high-privilege app consent may remain exploitable even after human role cleanup. Which recovery action addresses the underlying technical fault?

  1. The controlled remediation is to increase all app permissions to prevent future consent prompts.
  2. The controlled remediation is to remove unneeded grants and validate the remaining legitimate integration calls.
  3. The controlled remediation is to disable audit logging to avoid seeing application permission drift.
  4. The controlled remediation is to assume user account offboarding revokes every existing app-only permission.

Explanation

Correct Answer

B:

Test using these records: Service principal grants, app owners, sign-in activity and consent audit trail. An enterprise application's effective permission grants should be periodically reviewed and minimized.

Incorrect Answers

A:

Increase all app permissions to prevent future consent prompts. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.

C:

Disable audit logging to avoid seeing application permission drift. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.

D:

Assume user account offboarding revokes every existing app-only permission. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.

Microsoft Azure Security Technologies (AZ-500) Practice Tests