Microsoft AZ-500 Practice Test 3
Question 20
A subscription Contributor can configure Key Vault properties but lacks permission to read secrets after vault RBAC was enabled. A review identifies this consequence: Changing the ARM management role alone may leave a data read denied or grant unrelated administration. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to assume management Contributor always includes blob data read.
- The controlled remediation is to assign the smallest correct data role and verify a successful authorized data operation.
- The controlled remediation is to grant subscription Owner without checking the specific storage data role.
- The controlled remediation is to use a network security group to grant object-level RBAC permissions.
Explanation
Correct Answer
B:Test using these records: Effective management and data role assignments and an authenticated operation against the target data. Azure control-plane permissions do not automatically imply every resource's data-plane permissions.
Incorrect Answers
A:Assume management Contributor always includes blob data read. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
C:Grant subscription Owner without checking the specific storage data role. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
D:Use a network security group to grant object-level RBAC permissions. This would not reliably restore the intended security boundary. Changing the ARM management role alone may leave a data read denied or grant unrelated administration. The appropriate controlled recovery is: Assign the smallest correct data role and verify a successful authorized data operation.
Question 21
A platform team needs a custom role that can restart a VM but must not delete resources. Which operator action best meets this technical requirement?
- Define and test a custom role with only the required Actions or DataActions and assignable scopes.
- Use wildcard permissions for every provider namespace.
- Change the role display name without examining Actions.
- Create a user group and assume it automatically grants Azure control-plane rights.
Explanation
Correct Answer
A:Confirm the change against these records: Role definition JSON, denied operations, positive action test and role scope. This directly addresses Azure custom role Actions and DataActions.
Incorrect Answers
B:An overly broad wildcard action can create destructive powers not justified by the task. In the given case, a platform team needs a custom role that can restart a VM but must not delete resources.
C:Change the role display name without examining Actions. The proposed change targets the wrong mechanism or lacks essential validation. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Relevant evidence is role definition JSON, denied operations, positive action test and role scope.
D:An overly broad wildcard action can create destructive powers not justified by the task. The intended action is: Define and test a custom role with only the required Actions or DataActions and assignable scopes.
Question 22
A platform team needs a custom role that can restart a VM but must not delete resources. Which collection of observations most directly tests the suspected cause?
- An old tenant role export without a current role scope or effective assignment.
- A user display name without the access-token claims or authorization decision.
- Role definition JSON, denied operations, positive action test and role scope.
- A historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
C:These records test the actual Azure custom role Actions and DataActions behavior rather than an unrelated dashboard state. The intended action is: Define and test a custom role with only the required Actions or DataActions and assignable scopes.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Role definition JSON, denied operations, positive action test and role scope.
B:On its own, that evidence does not prove the specified security control works. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
D:On its own, that evidence does not prove the specified security control works. In the given case, a platform team needs a custom role that can restart a VM but must not delete resources.
Question 23
A platform team needs a custom role that can restart a VM but must not delete resources. Which statement most accurately explains this scenario?
- A valid sign-in eliminates all requirements for scoped authorization.
- Adding a requested API scope automatically grants tenant-wide consent.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
Explanation
Correct Answer
D:This principle supports the security response: Define and test a custom role with only the required Actions or DataActions and assignable scopes. Confirmation depends on Role definition JSON, denied operations, positive action test and role scope.
Incorrect Answers
A:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for Azure custom role Actions and DataActions. The relevant security behavior is: Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Check evidence such as role definition JSON, denied operations, positive action test and role scope.
B:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Azure custom role Actions and DataActions. The relevant security behavior is: Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Check evidence such as role definition JSON, denied operations, positive action test and role scope.
C:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Azure custom role Actions and DataActions. The relevant security behavior is: Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Check evidence such as role definition JSON, denied operations, positive action test and role scope.
Question 24
A platform team needs a custom role that can restart a VM but must not delete resources. Suppose the operator instead follows this unsafe shortcut: Use wildcard permissions for every provider namespace. What is the principal technical consequence of the mistaken choice?
- Testing a least-privilege login disables the normal authentication platform.
- An overly broad wildcard action can create destructive powers not justified by the task.
- Removing excessive admin permissions caused the original unauthorized elevation.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
Explanation
Correct Answer
B:The suitable control is: Define and test a custom role with only the required Actions or DataActions and assignable scopes. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Azure custom role Actions and DataActions weakness after the shortcut. The material failure is: An overly broad wildcard action can create destructive powers not justified by the task.
C:This does not explain the real Azure custom role Actions and DataActions weakness after the shortcut. Inspect evidence such as role definition JSON, denied operations, positive action test and role scope.
D:This does not explain the real Azure custom role Actions and DataActions weakness after the shortcut. In the given case, a platform team needs a custom role that can restart a VM but must not delete resources.
Question 25
A platform team needs a custom role that can restart a VM but must not delete resources. A review identifies this consequence: An overly broad wildcard action can create destructive powers not justified by the task. Which recovery action restores the intended control and validates its effect?
- Change the role display name without examining Actions.
- Remove unnecessary role permissions and validate both allowed and denied operations.
- Create a user group and assume it automatically grants Azure control-plane rights.
- Use wildcard permissions for every provider namespace.
Explanation
Correct Answer
B:Test using these records: Role definition JSON, denied operations, positive action test and role scope. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Change the role display name without examining Actions. This would not reliably restore the intended security boundary. An overly broad wildcard action can create destructive powers not justified by the task. The appropriate controlled recovery is: Remove unnecessary role permissions and validate both allowed and denied operations.
C:Create a user group and assume it automatically grants Azure control-plane rights. This would not reliably restore the intended security boundary. An overly broad wildcard action can create destructive powers not justified by the task. The appropriate controlled recovery is: Remove unnecessary role permissions and validate both allowed and denied operations.
D:Use wildcard permissions for every provider namespace. This would not reliably restore the intended security boundary. An overly broad wildcard action can create destructive powers not justified by the task. The appropriate controlled recovery is: Remove unnecessary role permissions and validate both allowed and denied operations.
Question 26
An engineering role should read selected blob data while having no access to storage account management configuration. What is the most defensible Azure security action?
- For this Azure workload, the team should change the role display name without examining Actions.
- For this Azure workload, the team should define and test a custom role with only the required Actions or DataActions and assignable scopes.
- For this Azure workload, the team should create a user group and assume it automatically grants Azure control-plane rights.
- For this Azure workload, the team should use wildcard permissions for every provider namespace.
Explanation
Correct Answer
B:Confirm the change against these records: Role definition JSON, denied operations, positive action test and role scope. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
Incorrect Answers
A:Change the role display name without examining Actions. The proposed change targets the wrong mechanism or lacks essential validation. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Relevant evidence is role definition JSON, denied operations, positive action test and role scope.
C:An overly broad wildcard action can create destructive powers not justified by the task. Create a user group and assume it automatically grants Azure control-plane rights.
D:An overly broad wildcard action can create destructive powers not justified by the task. In the given case, an engineering role should read selected blob data while having no access to storage account management configuration.
Question 27
An engineering role should read selected blob data while having no access to storage account management configuration. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine role definition JSON, denied operations, positive action test and role scope.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine a user display name without the access-token claims or authorization decision.
Explanation
Correct Answer
B:These records test the actual Azure custom role Actions and DataActions behavior rather than an unrelated dashboard state. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an engineering role should read selected blob data while having no access to storage account management configuration.
C:The more relevant observations are: Role definition JSON, denied operations, positive action test and role scope.
D:Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
Question 28
An engineering role should read selected blob data while having no access to storage account management configuration. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
Explanation
Correct Answer
A:This principle supports the security response: Define and test a custom role with only the required Actions or DataActions and assignable scopes.
Incorrect Answers
B:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Azure custom role Actions and DataActions. The relevant security behavior is: Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Check evidence such as role definition JSON, denied operations, positive action test and role scope.
C:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for Azure custom role Actions and DataActions. The relevant security behavior is: Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Check evidence such as role definition JSON, denied operations, positive action test and role scope.
D:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for Azure custom role Actions and DataActions. The relevant security behavior is: Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes. Check evidence such as role definition JSON, denied operations, positive action test and role scope.
Question 29
An engineering role should read selected blob data while having no access to storage account management configuration. Suppose the operator instead follows this unsafe shortcut: Use wildcard permissions for every provider namespace. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that an overly broad wildcard action can create destructive powers not justified by the task.
Explanation
Correct Answer
D:The suitable control is: Define and test a custom role with only the required Actions or DataActions and assignable scopes. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
Incorrect Answers
A:This does not explain the real Azure custom role Actions and DataActions weakness after the shortcut. In the given case, an engineering role should read selected blob data while having no access to storage account management configuration.
B:This does not explain the real Azure custom role Actions and DataActions weakness after the shortcut. The only harm is a cosmetic app display-name difference.
C:This does not explain the real Azure custom role Actions and DataActions weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
Question 30
An engineering role should read selected blob data while having no access to storage account management configuration. A review identifies this consequence: An overly broad wildcard action can create destructive powers not justified by the task. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to remove unnecessary role permissions and validate both allowed and denied operations.
- The controlled remediation is to create a user group and assume it automatically grants Azure control-plane rights.
- The controlled remediation is to use wildcard permissions for every provider namespace.
- The controlled remediation is to change the role display name without examining Actions.
Explanation
Correct Answer
A:Test using these records: Role definition JSON, denied operations, positive action test and role scope. Azure custom roles distinguish control-plane Actions from data-plane DataActions and support explicit assignable scopes.
Incorrect Answers
B:Create a user group and assume it automatically grants Azure control-plane rights. This would not reliably restore the intended security boundary. An overly broad wildcard action can create destructive powers not justified by the task. The appropriate controlled recovery is: Remove unnecessary role permissions and validate both allowed and denied operations.
C:Use wildcard permissions for every provider namespace. This would not reliably restore the intended security boundary. An overly broad wildcard action can create destructive powers not justified by the task. The appropriate controlled recovery is: Remove unnecessary role permissions and validate both allowed and denied operations.
D:Change the role display name without examining Actions. This would not reliably restore the intended security boundary. An overly broad wildcard action can create destructive powers not justified by the task. The appropriate controlled recovery is: Remove unnecessary role permissions and validate both allowed and denied operations.
