Microsoft AZ-500 Practice Test 52
Question 510
An API Management endpoint refuses client TLS handshakes because the configured certificate chain does not match the service hostname. A review identifies this consequence: A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to keep a mismatched certificate because the web application's IP address did not change.
- The controlled remediation is to install the correct certificate binding and verify trusted client connections and renewal controls.
- The controlled remediation is to disable certificate validation for all clients instead of fixing the server certificate.
- The controlled remediation is to use a storage SAS token as the web server TLS certificate.
Explanation
Correct Answer
B:TLS endpoint authentication requires a trusted and matching certificate for the hostname clients actually use. Test using these records: Certificate subject and SAN, expiry, binding details and TLS handshake results.
Incorrect Answers
A:Keep a mismatched certificate because the web application's IP address did not change. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
C:Disable certificate validation for all clients instead of fixing the server certificate. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
D:Use a storage SAS token as the web server TLS certificate. This would not reliably restore the intended security boundary. A reachable HTTPS port with an invalid certificate still fails secure authenticated service access. The appropriate controlled recovery is: Install the correct certificate binding and verify trusted client connections and renewal controls.
Question 511
An Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port. What is the most defensible Azure security action?
- Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion.
- Use a storage account SAS token to authorize Windows Remote Desktop.
- Deploy Azure Bastion in the supported VNet architecture and connect through its managed administrative path.
- Assume Azure Bastion requires a public IP assigned to each target VM.
Explanation
Correct Answer
C:Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Confirm the change against these records: Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
Incorrect Answers
A:Directly opening management ports to the Internet increases exposure beyond Bastion's private path. In the given case, an Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port.
B:That option would use a storage account SAS token to authorize Windows Remote Desktop, but it addresses a different concern. Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP.
D:Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The intended action is: Deploy Azure Bastion in the supported VNet architecture and connect through its managed administrative path.
Question 512
An Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port. Which diagnostic record would most strongly confirm the result?
- A storage account resource name without its encryption or retention configuration.
- A database online indicator without a log of the protected operation.
- An outdated deployment template without current effective settings.
- Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
Explanation
Correct Answer
D:These records test the actual Azure Bastion secure VM administration behavior rather than an unrelated dashboard state. Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
C:On its own, that evidence does not prove the specified security control works. In the given case, an Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port.
Question 513
An Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port. Which platform concept should guide the engineer’s assessment?
- Setting a registry image tag guarantees security monitoring of the running workload.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A protected storage account is immune to every accidental deletion and overwrite.
- Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP.
Explanation
Correct Answer
D:Confirmation depends on Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session. This principle supports the security response: Deploy Azure Bastion in the supported VNet architecture and connect through its managed administrative path.
Incorrect Answers
A:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Azure Bastion secure VM administration. The relevant security behavior is: Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Check evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for Azure Bastion secure VM administration. The relevant security behavior is: Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Check evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
C:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Azure Bastion secure VM administration. The relevant security behavior is: Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Check evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
Question 514
An Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port. Suppose the operator instead follows this unsafe shortcut: Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion. Which root-cause observation follows from that incorrect change?
- Directly opening management ports to the Internet increases exposure beyond Bastion's private path.
- The security flaw is that the team retained a tested database backup.
- Inspecting encryption settings itself disables a healthy disk.
- The observed issue is fully explained by the service display name.
Explanation
Correct Answer
A:Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Azure Bastion secure VM administration weakness after the shortcut. The material failure is: Directly opening management ports to the Internet increases exposure beyond Bastion's private path.
C:This does not explain the real Azure Bastion secure VM administration weakness after the shortcut. Inspect evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
D:This does not explain the real Azure Bastion secure VM administration weakness after the shortcut. In the given case, an Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port.
Question 515
An Azure VM exposes RDP on a public IP although administrators are expected to connect without a public guest port. A review identifies this consequence: Directly opening management ports to the Internet increases exposure beyond Bastion's private path. Which recovery action addresses the underlying technical fault?
- Use a storage account SAS token to authorize Windows Remote Desktop.
- Assume Azure Bastion requires a public IP assigned to each target VM.
- Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion.
- Close unintended public management access and verify authorized Bastion sessions.
Explanation
Correct Answer
D:Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Use a storage account SAS token to authorize Windows Remote Desktop. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.
B:Assume Azure Bastion requires a public IP assigned to each target VM. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.
C:Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.
Question 516
An operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should use a storage account SAS token to authorize Windows Remote Desktop.
- For this Azure workload, the team should assume Azure Bastion requires a public IP assigned to each target VM.
- For this Azure workload, the team should open TCP 3389 to the entire internet and call it equivalent to Azure Bastion.
- For this Azure workload, the team should deploy Azure Bastion in the supported VNet architecture and connect through its managed administrative path.
Explanation
Correct Answer
D:Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. In the given case, an operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity.
Incorrect Answers
A:Use a storage account SAS token to authorize Windows Remote Desktop. The proposed change targets the wrong mechanism or lacks essential validation. Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Relevant evidence is bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
B:Directly opening management ports to the Internet increases exposure beyond Bastion's private path. Assume Azure Bastion requires a public IP assigned to each target VM.
C:Directly opening management ports to the Internet increases exposure beyond Bastion's private path. In the given case, an operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity.
Question 517
An operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine a database online indicator without a log of the protected operation.
Explanation
Correct Answer
A:These records test the actual Azure Bastion secure VM administration behavior rather than an unrelated dashboard state. The intended action is: Deploy Azure Bastion in the supported VNet architecture and connect through its managed administrative path.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. A powered-on VM status without the actual guest or data-plane security state.
C:On its own, that evidence does not prove the specified security control works. A storage account resource name without its encryption or retention configuration.
D:On its own, that evidence does not prove the specified security control works. A database online indicator without a log of the protected operation.
Question 518
An operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
- The applicable security principle is that Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP.
Explanation
Correct Answer
D:Confirmation depends on Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
Incorrect Answers
A:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Azure Bastion secure VM administration. The relevant security behavior is: Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Check evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
B:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Azure Bastion secure VM administration. The relevant security behavior is: Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Check evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
C:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Azure Bastion secure VM administration. The relevant security behavior is: Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Check evidence such as bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
Question 519
An operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity. Suppose the operator instead follows this unsafe shortcut: Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that directly opening management ports to the Internet increases exposure beyond Bastion's private path.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
C:Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. The suitable control is: Deploy Azure Bastion in the supported VNet architecture and connect through its managed administrative path.
Incorrect Answers
A:This does not explain the real Azure Bastion secure VM administration weakness after the shortcut. In the given case, an operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity.
B:Collecting VM diagnostic data caused the original unauthorized storage read.
D:The material failure is: Directly opening management ports to the Internet increases exposure beyond Bastion's private path.
Question 520
An operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity. A review identifies this consequence: Directly opening management ports to the Internet increases exposure beyond Bastion's private path. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to assume Azure Bastion requires a public IP assigned to each target VM.
- The controlled remediation is to close unintended public management access and verify authorized Bastion sessions.
- The controlled remediation is to open TCP 3389 to the entire internet and call it equivalent to Azure Bastion.
- The controlled remediation is to use a storage account SAS token to authorize Windows Remote Desktop.
Explanation
Correct Answer
B:Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Test using these records: Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.
Incorrect Answers
A:Assume Azure Bastion requires a public IP assigned to each target VM. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.
C:Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.
D:Use a storage account SAS token to authorize Windows Remote Desktop. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.
