Microsoft AZ-500 Practice Test 56
Question 550
A platform team assigns Azure subscription Owner and assumes that necessarily creates appropriate Kubernetes namespace RBAC. A review identifies this consequence: An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to replace Kubernetes role bindings with a storage account network ACL.
- The controlled remediation is to grant cluster-admin to every authenticated user.
- The controlled remediation is to correct cluster authorization mappings and verify namespace and resource access boundaries.
- The controlled remediation is to assume Azure subscription Reader can administer every Kubernetes namespace.
Explanation
Correct Answer
C:Test using these records: AKS authentication configuration, role bindings, identity claims and allow and deny kubectl tests. AKS cluster authentication and data-plane Kubernetes authorization require appropriate integration and role scoping.
Incorrect Answers
A:Replace Kubernetes role bindings with a storage account network ACL. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.
B:Grant cluster-admin to every authenticated user. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.
D:Assume Azure subscription Reader can administer every Kubernetes namespace. This would not reliably restore the intended security boundary. An Entra login alone does not grant only the intended Kubernetes actions without correct authorization policy. The appropriate controlled recovery is: Correct cluster authorization mappings and verify namespace and resource access boundaries.
Question 551
A Kubernetes pod stores a Key Vault client secret in an environment variable even though it runs under an approved workload identity. What is the most defensible Azure security action?
- Configure AKS workload identity federation for the Kubernetes service account and target Azure principal.
- Give all pods the node's broad subscription Owner credential.
- Configure a pod label but omit its federated identity trust.
- Store a permanent global admin secret in every namespace.
Explanation
Correct Answer
A:Confirm the change against these records: Service account annotations, OIDC issuer and subject, federated credential and token acquisition. This directly addresses AKS workload identity to Key Vault.
Incorrect Answers
B:Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. Give all pods the node's broad subscription Owner credential.
C:Configure a pod label but omit its federated identity trust. The proposed change targets the wrong mechanism or lacks essential validation. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Relevant evidence is service account annotations, OIDC issuer and subject, federated credential and token acquisition.
D:Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The intended action is: Configure AKS workload identity federation for the Kubernetes service account and target Azure principal.
Question 552
A Kubernetes pod stores a Key Vault client secret in an environment variable even though it runs under an approved workload identity. Which diagnostic record would most strongly confirm the result?
- The identity name without a corresponding workload data authorization test.
- Service account annotations, OIDC issuer and subject, federated credential and token acquisition.
- An outdated deployment template without current effective settings.
- A powered-on VM status without the actual guest or data-plane security state.
Explanation
Correct Answer
B:These records test the actual AKS workload identity to Key Vault behavior rather than an unrelated dashboard state. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Service account annotations, OIDC issuer and subject, federated credential and token acquisition.
C:On its own, that evidence does not prove the specified security control works. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
D:On its own, that evidence does not prove the specified security control works. In the given case, a Kubernetes pod stores a Key Vault client secret in an environment variable even though it runs under an approved workload identity.
Question 553
A Kubernetes pod stores a Key Vault client secret in an environment variable even though it runs under an approved workload identity. Which platform concept should guide the engineer’s assessment?
- AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A valid Azure management role always gives full access to every blob object and SQL row.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
Explanation
Correct Answer
A:Confirmation depends on Service account annotations, OIDC issuer and subject, federated credential and token acquisition. This principle supports the security response: Configure AKS workload identity federation for the Kubernetes service account and target Azure principal.
Incorrect Answers
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for AKS workload identity to Key Vault. The relevant security behavior is: AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Check evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
C:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for AKS workload identity to Key Vault. The relevant security behavior is: AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Check evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
D:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for AKS workload identity to Key Vault. The relevant security behavior is: AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Check evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
Question 554
A Kubernetes pod stores a Key Vault client secret in an environment variable even though it runs under an approved workload identity. Suppose the operator instead follows this unsafe shortcut: Give all pods the node's broad subscription Owner credential. Which root-cause observation follows from that incorrect change?
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- The security flaw is that the team retained a tested database backup.
Explanation
Correct Answer
B:AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real AKS workload identity to Key Vault weakness after the shortcut. The material failure is: Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation.
C:This does not explain the real AKS workload identity to Key Vault weakness after the shortcut. Inspect evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
D:This does not explain the real AKS workload identity to Key Vault weakness after the shortcut. The security flaw is that the team retained a tested database backup.
Question 555
A Kubernetes pod stores a Key Vault client secret in an environment variable even though it runs under an approved workload identity. A review identifies this consequence: Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. Which recovery action addresses the underlying technical fault?
- Configure a pod label but omit its federated identity trust.
- Store a permanent global admin secret in every namespace.
- Give all pods the node's broad subscription Owner credential.
- Repair service account and federated credential mapping and verify scoped Key Vault access.
Explanation
Correct Answer
D:Test using these records: Service account annotations, OIDC issuer and subject, federated credential and token acquisition. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:That option would configure a pod label but omit its federated identity trust, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
B:Store a permanent global admin secret in every namespace. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
C:Give all pods the node's broad subscription Owner credential. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
Question 556
A cluster service account must call an Azure API but its federated identity subject does not match the configured trust. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should configure a pod label but omit its federated identity trust.
- For this Azure workload, the team should store a permanent global admin secret in every namespace.
- For this Azure workload, the team should configure AKS workload identity federation for the Kubernetes service account and target Azure principal.
- For this Azure workload, the team should give all pods the node's broad subscription Owner credential.
Explanation
Correct Answer
C:Confirm the change against these records: Service account annotations, OIDC issuer and subject, federated credential and token acquisition. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
Incorrect Answers
A:Configure a pod label but omit its federated identity trust. The proposed change targets the wrong mechanism or lacks essential validation. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Relevant evidence is service account annotations, OIDC issuer and subject, federated credential and token acquisition.
B:Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation.
D:In the given case, a cluster service account must call an Azure API but its federated identity subject does not match the configured trust.
Question 557
A cluster service account must call an Azure API but its federated identity subject does not match the configured trust. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine the identity name without a corresponding workload data authorization test.
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine service account annotations, OIDC issuer and subject, federated credential and token acquisition.
Explanation
Correct Answer
D:These records test the actual AKS workload identity to Key Vault behavior rather than an unrelated dashboard state. The intended action is: Configure AKS workload identity federation for the Kubernetes service account and target Azure principal.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a cluster service account must call an Azure API but its federated identity subject does not match the configured trust.
B:The more relevant observations are: Service account annotations, OIDC issuer and subject, federated credential and token acquisition.
C:AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
Question 558
A cluster service account must call an Azure API but its federated identity subject does not match the configured trust. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
Explanation
Correct Answer
D:Confirmation depends on Service account annotations, OIDC issuer and subject, federated credential and token acquisition.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for AKS workload identity to Key Vault. The relevant security behavior is: AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Check evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for AKS workload identity to Key Vault. The relevant security behavior is: AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Check evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
C:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for AKS workload identity to Key Vault. The relevant security behavior is: AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. Check evidence such as service account annotations, OIDC issuer and subject, federated credential and token acquisition.
Question 559
A cluster service account must call an Azure API but its federated identity subject does not match the configured trust. Suppose the operator instead follows this unsafe shortcut: Give all pods the node's broad subscription Owner credential. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
Explanation
Correct Answer
C:AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources. The suitable control is: Configure AKS workload identity federation for the Kubernetes service account and target Azure principal.
Incorrect Answers
A:This does not explain the real AKS workload identity to Key Vault weakness after the shortcut. In the given case, a cluster service account must call an Azure API but its federated identity subject does not match the configured trust.
B:The material failure is: Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation.
D:This does not explain the real AKS workload identity to Key Vault weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
Question 560
A cluster service account must call an Azure API but its federated identity subject does not match the configured trust. A review identifies this consequence: Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to repair service account and federated credential mapping and verify scoped Key Vault access.
- The controlled remediation is to store a permanent global admin secret in every namespace.
- The controlled remediation is to give all pods the node's broad subscription Owner credential.
- The controlled remediation is to configure a pod label but omit its federated identity trust.
Explanation
Correct Answer
A:Test using these records: Service account annotations, OIDC issuer and subject, federated credential and token acquisition. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
Incorrect Answers
B:Store a permanent global admin secret in every namespace. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
C:Give all pods the node's broad subscription Owner credential. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
D:Configure a pod label but omit its federated identity trust. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
