Microsoft AZ-500 Practice Test 24
Question 230
A vendor integration has privileged API grants but its assigned owners and usage history no longer justify them. A review identifies this consequence: Dormant high-privilege app consent may remain exploitable even after human role cleanup. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to increase all app permissions to prevent future consent prompts.
- The controlled remediation is to remove unneeded grants and validate the remaining legitimate integration calls.
- The controlled remediation is to disable audit logging to avoid seeing application permission drift.
- The controlled remediation is to assume user account offboarding revokes every existing app-only permission.
Explanation
Correct Answer
B:Test using these records: Service principal grants, app owners, sign-in activity and consent audit trail. An enterprise application's effective permission grants should be periodically reviewed and minimized.
Incorrect Answers
A:Increase all app permissions to prevent future consent prompts. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.
C:Disable audit logging to avoid seeing application permission drift. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.
D:Assume user account offboarding revokes every existing app-only permission. This would not reliably restore the intended security boundary. Dormant high-privilege app consent may remain exploitable even after human role cleanup. The appropriate controlled recovery is: Remove unneeded grants and validate the remaining legitimate integration calls.
Question 231
A privileged Azure role group retains departed contractors because no periodic review is performed. What is the most defensible Azure security action?
- Keep all approved memberships permanently regardless of role changes.
- Run a scoped access review with accountable approvers and remove unjustified memberships.
- Treat the existence of a review campaign as proof that removals happened.
- Move the group to a different subscription to avoid entitlement review.
Explanation
Correct Answer
B:Confirm the change against these records: Review decisions, group membership, entitlement usage and removal audit entries. Periodic access reviews help reconcile granted privileges with continuing business need.
Incorrect Answers
A:Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. Keep all approved memberships permanently regardless of role changes.
C:Treat the existence of a review campaign as proof that removals happened. The proposed change targets the wrong mechanism or lacks essential validation. Periodic access reviews help reconcile granted privileges with continuing business need. Relevant evidence is review decisions, group membership, entitlement usage and removal audit entries.
D:Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The intended action is: Run a scoped access review with accountable approvers and remove unjustified memberships.
Question 232
A privileged Azure role group retains departed contractors because no periodic review is performed. Which diagnostic record would most strongly confirm the result?
- A successful login to another unrelated cloud application.
- The expected access policy written in a design note but not assigned.
- A user display name without the access-token claims or authorization decision.
- Review decisions, group membership, entitlement usage and removal audit entries.
Explanation
Correct Answer
D:These records test the actual access review for privileged groups behavior rather than an unrelated dashboard state. Periodic access reviews help reconcile granted privileges with continuing business need.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Review decisions, group membership, entitlement usage and removal audit entries.
B:On its own, that evidence does not prove the specified security control works. Periodic access reviews help reconcile granted privileges with continuing business need.
C:On its own, that evidence does not prove the specified security control works. In the given case, a privileged Azure role group retains departed contractors because no periodic review is performed.
Question 233
A privileged Azure role group retains departed contractors because no periodic review is performed. Which platform concept should guide the engineer’s assessment?
- Assigning a role to a group means every resource ignores its narrower permissions.
- A valid sign-in eliminates all requirements for scoped authorization.
- Long-lived shared application secrets are always more secure than managed identities.
- Periodic access reviews help reconcile granted privileges with continuing business need.
Explanation
Correct Answer
D:This principle supports the security response: Run a scoped access review with accountable approvers and remove unjustified memberships. Confirmation depends on Review decisions, group membership, entitlement usage and removal audit entries.
Incorrect Answers
A:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for access review for privileged groups. The relevant security behavior is: Periodic access reviews help reconcile granted privileges with continuing business need. Check evidence such as review decisions, group membership, entitlement usage and removal audit entries.
B:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for access review for privileged groups. The relevant security behavior is: Periodic access reviews help reconcile granted privileges with continuing business need. Check evidence such as review decisions, group membership, entitlement usage and removal audit entries.
C:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for access review for privileged groups. The relevant security behavior is: Periodic access reviews help reconcile granted privileges with continuing business need. Check evidence such as review decisions, group membership, entitlement usage and removal audit entries.
Question 234
A privileged Azure role group retains departed contractors because no periodic review is performed. Suppose the operator instead follows this unsafe shortcut: Keep all approved memberships permanently regardless of role changes. Which root-cause observation follows from that incorrect change?
- Recording a sign-in audit trail is the reason the identity was overprivileged.
- The only harm is a cosmetic app display-name difference.
- Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean.
- Reviewing current access tokens creates missing authorization scopes.
Explanation
Correct Answer
C:The suitable control is: Run a scoped access review with accountable approvers and remove unjustified memberships. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real access review for privileged groups weakness after the shortcut. The material failure is: Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean.
B:This does not explain the real access review for privileged groups weakness after the shortcut. Inspect evidence such as review decisions, group membership, entitlement usage and removal audit entries.
D:This does not explain the real access review for privileged groups weakness after the shortcut. In the given case, a privileged Azure role group retains departed contractors because no periodic review is performed.
Question 235
A privileged Azure role group retains departed contractors because no periodic review is performed. A review identifies this consequence: Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. Which recovery action addresses the underlying technical fault?
- Treat the existence of a review campaign as proof that removals happened.
- Complete the review and verify revoked access no longer appears in effective role assignments.
- Move the group to a different subscription to avoid entitlement review.
- Keep all approved memberships permanently regardless of role changes.
Explanation
Correct Answer
B:This addresses the observed security problem while providing a verifiable outcome. Test using these records: Review decisions, group membership, entitlement usage and removal audit entries.
Incorrect Answers
A:Treat the existence of a review campaign as proof that removals happened. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
C:Move the group to a different subscription to avoid entitlement review. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
D:Keep all approved memberships permanently regardless of role changes. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
Question 236
A sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should run a scoped access review with accountable approvers and remove unjustified memberships.
- For this Azure workload, the team should treat the existence of a review campaign as proof that removals happened.
- For this Azure workload, the team should move the group to a different subscription to avoid entitlement review.
- For this Azure workload, the team should keep all approved memberships permanently regardless of role changes.
Explanation
Correct Answer
A:Confirm the change against these records: Review decisions, group membership, entitlement usage and removal audit entries.
Incorrect Answers
B:Treat the existence of a review campaign as proof that removals happened. The proposed change targets the wrong mechanism or lacks essential validation. Periodic access reviews help reconcile granted privileges with continuing business need. Relevant evidence is review decisions, group membership, entitlement usage and removal audit entries.
C:Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean.
D:In the given case, a sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier.
Question 237
A sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine review decisions, group membership, entitlement usage and removal audit entries.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine the expected access policy written in a design note but not assigned.
Explanation
Correct Answer
A:These records test the actual access review for privileged groups behavior rather than an unrelated dashboard state. The intended action is: Run a scoped access review with accountable approvers and remove unjustified memberships.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier.
C:The more relevant observations are: Review decisions, group membership, entitlement usage and removal audit entries.
D:The expected access policy written in a design note but not assigned.
Question 238
A sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that periodic access reviews help reconcile granted privileges with continuing business need.
Explanation
Correct Answer
D:This principle supports the security response: Run a scoped access review with accountable approvers and remove unjustified memberships.
Incorrect Answers
A:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for access review for privileged groups. The relevant security behavior is: Periodic access reviews help reconcile granted privileges with continuing business need. Check evidence such as review decisions, group membership, entitlement usage and removal audit entries.
B:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for access review for privileged groups. The relevant security behavior is: Periodic access reviews help reconcile granted privileges with continuing business need. Check evidence such as review decisions, group membership, entitlement usage and removal audit entries.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for access review for privileged groups. The relevant security behavior is: Periodic access reviews help reconcile granted privileges with continuing business need. Check evidence such as review decisions, group membership, entitlement usage and removal audit entries.
Question 239
A sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier. Suppose the operator instead follows this unsafe shortcut: Keep all approved memberships permanently regardless of role changes. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
- The resulting security weakness is that stale group membership keeps permissions beyond the access purpose even when direct assignments look clean.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
Explanation
Correct Answer
B:The suitable control is: Run a scoped access review with accountable approvers and remove unjustified memberships. Periodic access reviews help reconcile granted privileges with continuing business need.
Incorrect Answers
A:This does not explain the real access review for privileged groups weakness after the shortcut. In the given case, a sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier.
C:This does not explain the real access review for privileged groups weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
D:This does not explain the real access review for privileged groups weakness after the shortcut. The only harm is a cosmetic app display-name difference.
Question 240
A sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier. A review identifies this consequence: Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to move the group to a different subscription to avoid entitlement review.
- The controlled remediation is to complete the review and verify revoked access no longer appears in effective role assignments.
- The controlled remediation is to keep all approved memberships permanently regardless of role changes.
- The controlled remediation is to treat the existence of a review campaign as proof that removals happened.
Explanation
Correct Answer
B:This addresses the observed security problem while providing a verifiable outcome. Periodic access reviews help reconcile granted privileges with continuing business need.
Incorrect Answers
A:Move the group to a different subscription to avoid entitlement review. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
C:Keep all approved memberships permanently regardless of role changes. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
D:Treat the existence of a review campaign as proof that removals happened. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
