cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 55

Question 540

A regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet. A review identifies this consequence: Using only Kubernetes RBAC does not remove an unintended public API server endpoint. Which recovery action restores the intended control and validates its effect?

  1. The controlled remediation is to correct the AKS private endpoint and management DNS path and test authorized API access.
  2. The controlled remediation is to ignore DNS resolution when private endpoint traffic cannot reach the API server.
  3. The controlled remediation is to add a pod NetworkPolicy and assume it makes the Kubernetes API server private.
  4. The controlled remediation is to publish an admin kubeconfig in a public repository so operators can connect.

Explanation

Correct Answer

A:

A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Test using these records: AKS private cluster state, API server FQDN resolution, network path and kubectl connection.

Incorrect Answers

B:

Ignore DNS resolution when private endpoint traffic cannot reach the API server. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.

C:

Add a pod NetworkPolicy and assume it makes the Kubernetes API server private. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.

D:

Publish an admin kubeconfig in a public repository so operators can connect. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.

Question 541

An AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges. Which operator action best meets this technical requirement?

  1. Grant cluster-admin to every authenticated user.
  2. Configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions.
  3. Assume Azure subscription Reader can administer every Kubernetes namespace.
  4. Replace Kubernetes role bindings with a storage account network ACL.

Explanation

Correct Answer

B:

Confirm the change against these records: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests. This directly addresses AKS Microsoft Entra authentication and authorization.

Incorrect Answers

A:

An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy.

C:

Assume Azure subscription Reader can administer every Kubernetes namespace. The proposed change targets the wrong mechanism or lacks essential validation. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Relevant evidence is AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

D:

An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The intended action is: Configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions.

Question 542

An AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges. Which collection of observations most directly tests the suspected cause?

  1. A database online indicator without a log of the protected operation.
  2. A powered-on VM status without the actual guest or data-plane security state.
  3. A storage account resource name without its encryption or retention configuration.
  4. AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

Explanation

Correct Answer

D:

These records test the actual AKS Microsoft Entra authentication and authorization behavior rather than an unrelated dashboard state. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

B:

On its own, that evidence does not prove the specified security control works. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

C:

On its own, that evidence does not prove the specified security control works. In the given case, an AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges.

Question 543

An AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges. Which statement most accurately explains this scenario?

  1. A valid Azure management role always gives full access to every blob object and SQL row.
  2. A protected storage account is immune to every accidental deletion and overwrite.
  3. Setting a registry image tag guarantees security monitoring of the running workload.
  4. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

Explanation

Correct Answer

D:

Confirmation depends on AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests. This principle supports the security response: Configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions.

Incorrect Answers

A:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for AKS Microsoft Entra authentication and authorization. The relevant security behavior is: AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Check evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

B:

A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for AKS Microsoft Entra authentication and authorization. The relevant security behavior is: AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Check evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

C:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for AKS Microsoft Entra authentication and authorization. The relevant security behavior is: AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Check evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

Question 544

An AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges. Suppose the operator instead follows this unsafe shortcut: Grant cluster-admin to every authenticated user. What is the principal technical consequence of the mistaken choice?

  1. Inspecting encryption settings itself disables a healthy disk.
  2. The observed issue is fully explained by the service display name.
  3. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy.
  4. Collecting VM diagnostic data caused the original unauthorized storage read.

Explanation

Correct Answer

C:

The suitable control is: Configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real AKS Microsoft Entra authentication and authorization weakness after the shortcut. The material failure is: An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy.

B:

This does not explain the real AKS Microsoft Entra authentication and authorization weakness after the shortcut. Inspect evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

D:

This does not explain the real AKS Microsoft Entra authentication and authorization weakness after the shortcut. In the given case, an AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges.

Question 545

An AKS user authenticates successfully with Entra but can perform actions outside their intended Kubernetes privileges. A review identifies this consequence: An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. Which recovery action restores the intended control and validates its effect?

  1. Assume Azure subscription Reader can administer every Kubernetes namespace.
  2. Correct cluster authorization mappings and verify namespace and resource access boundaries.
  3. Replace Kubernetes role bindings with a storage account network ACL.
  4. Grant cluster-admin to every authenticated user.

Explanation

Correct Answer

B:

Test using these records: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Assume Azure subscription Reader can administer every Kubernetes namespace. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.

C:

Replace Kubernetes role bindings with a storage account network ACL. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.

D:

Grant cluster-admin to every authenticated user. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.

Question 546

A platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC. What is the most defensible Azure security action?

  1. For this Azure workload, the team should assume Azure subscription Reader can administer every Kubernetes namespace.
  2. For this Azure workload, the team should configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions.
  3. For this Azure workload, the team should replace Kubernetes role bindings with a storage account network ACL.
  4. For this Azure workload, the team should grant cluster-admin to every authenticated user.

Explanation

Correct Answer

B:

Confirm the change against these records: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

Incorrect Answers

A:

Assume Azure subscription Reader can administer every Kubernetes namespace. The proposed change targets the wrong mechanism or lacks essential validation. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Relevant evidence is AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

C:

An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy.

D:

In the given case, a platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC.

Question 547

A platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC. Which diagnostic record would most strongly confirm the result?

  1. In this security review, examine the identity name without a corresponding workload data authorization test.
  2. In this security review, examine AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.
  3. In this security review, examine a database online indicator without a log of the protected operation.
  4. In this security review, examine a powered-on VM status without the actual guest or data-plane security state.

Explanation

Correct Answer

B:

These records test the actual AKS Microsoft Entra authentication and authorization behavior rather than an unrelated dashboard state. The intended action is: Configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, a platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC.

C:

The more relevant observations are: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

D:

AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

Question 548

A platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC. Which platform concept should guide the engineer’s assessment?

  1. The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
  2. The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
  3. The applicable security principle is that AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.
  4. The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.

Explanation

Correct Answer

C:

Confirmation depends on AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

Incorrect Answers

A:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for AKS Microsoft Entra authentication and authorization. The relevant security behavior is: AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Check evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

B:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for AKS Microsoft Entra authentication and authorization. The relevant security behavior is: AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Check evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

D:

Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for AKS Microsoft Entra authentication and authorization. The relevant security behavior is: AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping. Check evidence such as AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests.

Question 549

A platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC. Suppose the operator instead follows this unsafe shortcut: Grant cluster-admin to every authenticated user. Which root-cause observation follows from that incorrect change?

  1. The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
  2. The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
  3. The resulting security weakness is that an Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy.
  4. The resulting security weakness is that the observed issue is fully explained by the service display name.

Explanation

Correct Answer

C:

The suitable control is: Configure supported Entra-integrated AKS authentication and narrowly scoped Kubernetes or Azure RBAC permissions. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

Incorrect Answers

A:

This does not explain the real AKS Microsoft Entra authentication and authorization weakness after the shortcut. In the given case, a platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC.

B:

This does not explain the real AKS Microsoft Entra authentication and authorization weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.

D:

This does not explain the real AKS Microsoft Entra authentication and authorization weakness after the shortcut. The observed issue is fully explained by the service display name.

Question 550

A platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC. A review identifies this consequence: An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. Which recovery action addresses the underlying technical fault?

  1. The controlled remediation is to replace Kubernetes role bindings with a storage account network ACL.
  2. The controlled remediation is to grant cluster-admin to every authenticated user.
  3. The controlled remediation is to correct cluster authorization mappings and verify namespace and resource access boundaries.
  4. The controlled remediation is to assume Azure subscription Reader can administer every Kubernetes namespace.

Explanation

Correct Answer

C:

Test using these records: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.

Incorrect Answers

A:

Replace Kubernetes role bindings with a storage account network ACL. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.

B:

Grant cluster-admin to every authenticated user. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.

D:

Assume Azure subscription Reader can administer every Kubernetes namespace. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.

Microsoft Azure Security Technologies (AZ-500) Practice Tests