Microsoft AZ-500 Practice Test 51
Question 500
An outbound HTTPS request is rejected and a subnet policy change may be responsible. A review identifies this consequence: Testing ping alone does not identify the rule responsible for a different port and protocol. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to change the VM operating system hostname to resolve an NSG rule denial.
- The controlled remediation is to delete every security group before running a specific flow-verification test.
- The controlled remediation is to correct the blocking rule and repeat the same flow test with a least-privilege change.
- The controlled remediation is to assume a successful TCP connection to a different host proves the requested flow is permitted.
Explanation
Correct Answer
C:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Test using these records: IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
Incorrect Answers
A:Change the VM operating system hostname to resolve an NSG rule denial. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
B:Delete every security group before running a specific flow-verification test. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
D:Assume a successful TCP connection to a different host proves the requested flow is permitted. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
Question 501
An HTTPS custom domain presents an expired or wrong-host certificate after rotating its App Service binding. Which operator action best meets this technical requirement?
- Disable certificate validation for all clients instead of fixing the server certificate.
- Use a storage SAS token as the web server TLS certificate.
- Bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol.
- Keep a mismatched certificate because the web application's IP address did not change.
Explanation
Correct Answer
C:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Confirm the change against these records: Certificate subject and SAN, expiry, binding details and TLS handshake results.
Incorrect Answers
A:A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. Disable certificate validation for all clients instead of fixing the server certificate.
B:Use a storage SAS token as the web server TLS certificate. The proposed change targets the wrong mechanism or lacks essential validation. TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Relevant evidence is certificate subject and SAN, expiry, binding details and TLS handshake results.
D:A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The intended action is: Bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol.
Question 502
An HTTPS custom domain presents an expired or wrong-host certificate after rotating its App Service binding. Which collection of observations most directly tests the suspected cause?
- A public DNS response that does not show the intended private service path.
- Certificate subject and SAN, expiry, binding details and TLS handshake results.
- A static virtual network diagram with no effective route or packet observation.
- A healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
B:These records test the actual tLS certificate for App Service behavior rather than an unrelated dashboard state. TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Certificate subject and SAN, expiry, binding details and TLS handshake results.
D:On its own, that evidence does not prove the specified security control works. In the given case, an HTTPS custom domain presents an expired or wrong-host certificate after rotating its App Service binding.
Question 503
An HTTPS custom domain presents an expired or wrong-host certificate after rotating its App Service binding. Which statement most accurately explains this scenario?
- Creating a virtual network peering link makes all other Azure VNets transitively reachable.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use.
- Successful public name resolution proves that all traffic uses Private Link.
Explanation
Correct Answer
C:This principle supports the security response: Bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol. Confirmation depends on Certificate subject and SAN, expiry, binding details and TLS handshake results.
Incorrect Answers
A:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for tLS certificate for App Service. The relevant security behavior is: TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Check evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
B:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for tLS certificate for App Service. The relevant security behavior is: TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Check evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
D:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for tLS certificate for App Service. The relevant security behavior is: TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Check evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
Question 504
An HTTPS custom domain presents an expired or wrong-host certificate after rotating its App Service binding. Suppose the operator instead follows this unsafe shortcut: Disable certificate validation for all clients instead of fixing the server certificate. What is the principal technical consequence of the mistaken choice?
- A reachable HTTPS port with an invalid certificate still fails secure authenticated service access.
- The investigation itself created the pre-existing private DNS or route mismatch.
- The failure consists only of retaining valid network flow logs.
- A VNet diagram label alone explains the blocked or uninspected traffic.
Explanation
Correct Answer
A:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real tLS certificate for App Service weakness after the shortcut. The material failure is: A reachable HTTPS port with an invalid certificate still fails secure authenticated service access.
C:This does not explain the real tLS certificate for App Service weakness after the shortcut. Inspect evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
D:This does not explain the real tLS certificate for App Service weakness after the shortcut. A VNet diagram label alone explains the blocked or uninspected traffic.
Question 505
An HTTPS custom domain presents an expired or wrong-host certificate after rotating its App Service binding. A review identifies this consequence: A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. Which recovery action restores the intended control and validates its effect?
- Use a storage SAS token as the web server TLS certificate.
- Install the correct certificate binding and verify trusted client connections and renewal controls.
- Keep a mismatched certificate because the web application's IP address did not change.
- Disable certificate validation for all clients instead of fixing the server certificate.
Explanation
Correct Answer
B:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Use a storage SAS token as the web server TLS certificate. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
C:Keep a mismatched certificate because the web application's IP address did not change. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
D:Disable certificate validation for all clients instead of fixing the server certificate. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
Question 506
An API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname. What is the most defensible Azure security action?
- For this Azure workload, the team should use a storage SAS token as the web server TLS certificate.
- For this Azure workload, the team should bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol.
- For this Azure workload, the team should keep a mismatched certificate because the web application's IP address did not change.
- For this Azure workload, the team should disable certificate validation for all clients instead of fixing the server certificate.
Explanation
Correct Answer
B:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use.
Incorrect Answers
A:Use a storage SAS token as the web server TLS certificate. The proposed change targets the wrong mechanism or lacks essential validation. TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Relevant evidence is certificate subject and SAN, expiry, binding details and TLS handshake results.
C:A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. Keep a mismatched certificate because the web application's IP address did not change.
D:A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. In the given case, an API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname.
Question 507
An API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a successful connection to a different address and different service port.
- In this security review, examine certificate subject and SAN, expiry, binding details and TLS handshake results.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
Explanation
Correct Answer
B:These records test the actual tLS certificate for App Service behavior rather than an unrelated dashboard state. The intended action is: Bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname.
C:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use.
D:The more relevant observations are: Certificate subject and SAN, expiry, binding details and TLS handshake results.
Question 508
An API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
- The applicable security principle is that tLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use.
Explanation
Correct Answer
D:This principle supports the security response: Bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol.
Incorrect Answers
A:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for tLS certificate for App Service. The relevant security behavior is: TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Check evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
B:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for tLS certificate for App Service. The relevant security behavior is: TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Check evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
C:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for tLS certificate for App Service. The relevant security behavior is: TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Check evidence such as certificate subject and SAN, expiry, binding details and TLS handshake results.
Question 509
An API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname. Suppose the operator instead follows this unsafe shortcut: Disable certificate validation for all clients instead of fixing the server certificate. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that changing a resource description fixes every underlying transport rule.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that a reachable HTTPS port with an invalid certificate still fails secure authenticated service access.
Explanation
Correct Answer
D:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. The suitable control is: Bind a valid trusted TLS certificate and confirm the correct hostname, renewal and minimum required protocol.
Incorrect Answers
A:This does not explain the real tLS certificate for App Service weakness after the shortcut. In the given case, an API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname.
B:This does not explain the real tLS certificate for App Service weakness after the shortcut. Changing a resource description fixes every underlying transport rule.
C:This does not explain the real tLS certificate for App Service weakness after the shortcut. The failure consists only of retaining valid network flow logs.
Question 510
An API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname. A review identifies this consequence: A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to keep a mismatched certificate because the web application's IP address did not change.
- The controlled remediation is to install the correct certificate binding and verify trusted client connections and renewal controls.
- The controlled remediation is to disable certificate validation for all clients instead of fixing the server certificate.
- The controlled remediation is to use a storage SAS token as the web server TLS certificate.
Explanation
Correct Answer
B:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Test using these records: Certificate subject and SAN, expiry, binding details and TLS handshake results.
Incorrect Answers
A:Keep a mismatched certificate because the web application's IP address did not change. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
C:Disable certificate validation for all clients instead of fixing the server certificate. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
D:Use a storage SAS token as the web server TLS certificate. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
