Microsoft AZ-500 Practice Test 25
Question 240
A sensitive Microsoft Entra group grants administrative access to users whose project ended months earlier. A review identifies this consequence: Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to move the group to a different subscription to avoid entitlement review.
- The controlled remediation is to complete the review and verify revoked access no longer appears in effective role assignments.
- The controlled remediation is to keep all approved memberships permanently regardless of role changes.
- The controlled remediation is to treat the existence of a review campaign as proof that removals happened.
Explanation
Correct Answer
B:This addresses the observed security problem while providing a verifiable outcome. Periodic access reviews help reconcile granted privileges with continuing business need.
Incorrect Answers
A:Move the group to a different subscription to avoid entitlement review. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
C:Keep all approved memberships permanently regardless of role changes. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
D:Treat the existence of a review campaign as proof that removals happened. This would not reliably restore the intended security boundary. Stale group membership keeps permissions beyond the access purpose even when direct assignments look clean. The appropriate controlled recovery is: Complete the review and verify revoked access no longer appears in effective role assignments.
Question 241
A subnet NSG contains a broad Allow at priority 100 that overrides a more specific Deny at priority 300. What is the BEST supported implementation or corrective action?
- Add the intended Deny at a larger numeric priority than the current broad Allow.
- Change an ASG display name to alter NSG evaluation order.
- Reorder the security rules so the intended restrictive rule takes precedence for that flow.
- Use a route table as a replacement for a matching inbound NSG deny.
Explanation
Correct Answer
C:Confirm the change against these records: Effective NSG rules, source and destination, direction, port and evaluated priority. This directly addresses NSG rule priority and default deny.
Incorrect Answers
A:A lower-priority number Allow can render a later Deny ineffective. Add the intended Deny at a larger numeric priority than the current broad Allow.
B:Network security group rules are processed from lower numeric priority to higher until a matching rule is found. The proposed change targets the wrong mechanism or lacks essential validation.
D:A lower-priority number Allow can render a later Deny ineffective. The intended action is: Reorder the security rules so the intended restrictive rule takes precedence for that flow.
Question 242
A subnet NSG contains a broad Allow at priority 100 that overrides a more specific Deny at priority 300. Which evidence BEST verifies the intended technical behavior?
- The name of a firewall policy without its applied match and request logs.
- Effective NSG rules, source and destination, direction, port and evaluated priority.
- A healthy network interface without the evaluated NSG, route or private endpoint.
- A successful connection to a different address and different service port.
Explanation
Correct Answer
B:These records test the actual NSG rule priority and default deny behavior rather than an unrelated dashboard state. Network security group rules are processed from lower numeric priority to higher until a matching rule is found.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Effective NSG rules, source and destination, direction, port and evaluated priority.
C:On its own, that evidence does not prove the specified security control works. Network security group rules are processed from lower numeric priority to higher until a matching rule is found.
D:On its own, that evidence does not prove the specified security control works. A successful connection to a different address and different service port.
Question 243
A subnet NSG contains a broad Allow at priority 100 that overrides a more specific Deny at priority 300. Which principle BEST explains why the recommended solution is appropriate?
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- Network security group rules are processed from lower numeric priority to higher until a matching rule is found.
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- A network appliance presence guarantees the effective route traverses it.
Explanation
Correct Answer
B:This principle supports the security response: Reorder the security rules so the intended restrictive rule takes precedence for that flow. Confirmation depends on Effective NSG rules, source and destination, direction, port and evaluated priority.
Incorrect Answers
A:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for NSG rule priority and default deny. The relevant security behavior is: Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Check evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
C:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for NSG rule priority and default deny. The relevant security behavior is: Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Check evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
D:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for NSG rule priority and default deny. The relevant security behavior is: Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Check evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
Question 244
A subnet NSG contains a broad Allow at priority 100 that overrides a more specific Deny at priority 300. Suppose the operator instead follows this unsafe shortcut: Add the intended Deny at a larger numeric priority than the current broad Allow. What is the MOST significant failure introduced by that shortcut?
- Changing a resource description fixes every underlying transport rule.
- A lower-priority number Allow can render a later Deny ineffective.
- The root problem was using a permitted endpoint reachability test.
- The investigation itself created the pre-existing private DNS or route mismatch.
Explanation
Correct Answer
B:Network security group rules are processed from lower numeric priority to higher until a matching rule is found. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real NSG rule priority and default deny weakness after the shortcut. The material failure is: A lower-priority number Allow can render a later Deny ineffective.
C:This does not explain the real NSG rule priority and default deny weakness after the shortcut. Inspect evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
D:This does not explain the real NSG rule priority and default deny weakness after the shortcut. The investigation itself created the pre-existing private DNS or route mismatch.
Question 245
A subnet NSG contains a broad Allow at priority 100 that overrides a more specific Deny at priority 300. A review identifies this consequence: A lower-priority number Allow can render a later Deny ineffective. What is the BEST controlled recovery once this failure is recognized?
- Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
- Change an ASG display name to alter NSG evaluation order.
- Use a route table as a replacement for a matching inbound NSG deny.
- Add the intended Deny at a larger numeric priority than the current broad Allow.
Explanation
Correct Answer
A:Test using these records: Effective NSG rules, source and destination, direction, port and evaluated priority. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Change an ASG display name to alter NSG evaluation order. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
C:Use a route table as a replacement for a matching inbound NSG deny. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
D:Add the intended Deny at a larger numeric priority than the current broad Allow. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
Question 246
A VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should change an ASG display name to alter NSG evaluation order.
- For this Azure workload, the team should use a route table as a replacement for a matching inbound NSG deny.
- For this Azure workload, the team should add the intended Deny at a larger numeric priority than the current broad Allow.
- For this Azure workload, the team should reorder the security rules so the intended restrictive rule takes precedence for that flow.
Explanation
Correct Answer
D:Confirm the change against these records: Effective NSG rules, source and destination, direction, port and evaluated priority. Network security group rules are processed from lower numeric priority to higher until a matching rule is found.
Incorrect Answers
A:Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Relevant evidence is effective NSG rules, source and destination, direction, port and evaluated priority.
B:A lower-priority number Allow can render a later Deny ineffective. In the given case, a VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic.
C:In the given case, a VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic.
Question 247
A VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic. What evidence most directly confirms the intended security behavior?
- In this security review, examine effective NSG rules, source and destination, direction, port and evaluated priority.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
A:These records test the actual NSG rule priority and default deny behavior rather than an unrelated dashboard state. The intended action is: Reorder the security rules so the intended restrictive rule takes precedence for that flow.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. A public DNS response that does not show the intended private service path.
C:On its own, that evidence does not prove the specified security control works. The name of a firewall policy without its applied match and request logs.
D:On its own, that evidence does not prove the specified security control works. A healthy network interface without the evaluated NSG, route or private endpoint.
Question 248
A VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic. Which security principle best explains the intended decision?
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
- The applicable security principle is that network security group rules are processed from lower numeric priority to higher until a matching rule is found.
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
Explanation
Correct Answer
B:This principle supports the security response: Reorder the security rules so the intended restrictive rule takes precedence for that flow.
Incorrect Answers
A:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for NSG rule priority and default deny. The relevant security behavior is: Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Check evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
C:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for NSG rule priority and default deny. The relevant security behavior is: Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Check evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
D:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for NSG rule priority and default deny. The relevant security behavior is: Network security group rules are processed from lower numeric priority to higher until a matching rule is found. Check evidence such as effective NSG rules, source and destination, direction, port and evaluated priority.
Question 249
A VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic. Suppose the operator instead follows this unsafe shortcut: Add the intended Deny at a larger numeric priority than the current broad Allow. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that a lower-priority number Allow can render a later Deny ineffective.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
Explanation
Correct Answer
C:Network security group rules are processed from lower numeric priority to higher until a matching rule is found. The suitable control is: Reorder the security rules so the intended restrictive rule takes precedence for that flow.
Incorrect Answers
A:This does not explain the real NSG rule priority and default deny weakness after the shortcut. In the given case, a VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic.
B:The failure consists only of retaining valid network flow logs.
D:This does not explain the real NSG rule priority and default deny weakness after the shortcut. The root problem was using a permitted endpoint reachability test.
Question 250
A VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic. A review identifies this consequence: A lower-priority number Allow can render a later Deny ineffective. Which remediation most directly restores the intended behavior?
- The controlled remediation is to use a route table as a replacement for a matching inbound NSG deny.
- The controlled remediation is to add the intended Deny at a larger numeric priority than the current broad Allow.
- The controlled remediation is to change an ASG display name to alter NSG evaluation order.
- The controlled remediation is to apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
Explanation
Correct Answer
D:Test using these records: Effective NSG rules, source and destination, direction, port and evaluated priority. Network security group rules are processed from lower numeric priority to higher until a matching rule is found.
Incorrect Answers
A:Use a route table as a replacement for a matching inbound NSG deny. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
B:Add the intended Deny at a larger numeric priority than the current broad Allow. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
C:Change an ASG display name to alter NSG evaluation order. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
