Microsoft AZ-500 Practice Test 57
Question 560
A cluster service account must call an Azure API but its federated identity subject does not match the configured trust. A review identifies this consequence: Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to repair service account and federated credential mapping and verify scoped Key Vault access.
- The controlled remediation is to store a permanent global admin secret in every namespace.
- The controlled remediation is to give all pods the node's broad subscription Owner credential.
- The controlled remediation is to configure a pod label but omit its federated identity trust.
Explanation
Correct Answer
A:Test using these records: Service account annotations, OIDC issuer and subject, federated credential and token acquisition. AKS workload identity supports secretless access from properly bound Kubernetes service accounts to Azure resources.
Incorrect Answers
B:Store a permanent global admin secret in every namespace. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
C:Give all pods the node's broad subscription Owner credential. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
D:Configure a pod label but omit its federated identity trust. This would not reliably restore the intended security boundary. Copying a client secret into every pod creates rotation and exposure risks and bypasses the intended federation. The appropriate controlled recovery is: Repair service account and federated credential mapping and verify scoped Key Vault access.
Question 561
A compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced. What is the BEST supported implementation or corrective action?
- Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically.
- Delete all namespaces to prevent lateral movement.
- Enable a supported AKS network-policy enforcement system and author precise pod or namespace rules.
- Create NetworkPolicy YAML and assume it is enforced regardless of cluster networking.
Explanation
Correct Answer
C:Confirm the change against these records: Network policy engine, pod labels, namespace selectors and allowed versus denied flows. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
Incorrect Answers
A:Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted.
B:Delete all namespaces to prevent lateral movement. The proposed change targets the wrong mechanism or lacks essential validation. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Relevant evidence is network policy engine, pod labels, namespace selectors and allowed versus denied flows.
D:Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The intended action is: Enable a supported AKS network-policy enforcement system and author precise pod or namespace rules.
Question 562
A compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced. Which evidence BEST verifies the intended technical behavior?
- Network policy engine, pod labels, namespace selectors and allowed versus denied flows.
- A storage account resource name without its encryption or retention configuration.
- A database online indicator without a log of the protected operation.
- An outdated deployment template without current effective settings.
Explanation
Correct Answer
A:These records test the actual AKS network policy microsegmentation behavior rather than an unrelated dashboard state. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Network policy engine, pod labels, namespace selectors and allowed versus denied flows.
C:On its own, that evidence does not prove the specified security control works. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
D:On its own, that evidence does not prove the specified security control works. In the given case, a compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced.
Question 563
A compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced. Which principle BEST explains why the recommended solution is appropriate?
- Setting a registry image tag guarantees security monitoring of the running workload.
- Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A protected storage account is immune to every accidental deletion and overwrite.
Explanation
Correct Answer
B:Confirmation depends on Network policy engine, pod labels, namespace selectors and allowed versus denied flows. This principle supports the security response: Enable a supported AKS network-policy enforcement system and author precise pod or namespace rules.
Incorrect Answers
A:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for AKS network policy microsegmentation. The relevant security behavior is: Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Check evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
C:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for AKS network policy microsegmentation. The relevant security behavior is: Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Check evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
D:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for AKS network policy microsegmentation. The relevant security behavior is: Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Check evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
Question 564
A compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced. Suppose the operator instead follows this unsafe shortcut: Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically. What is the MOST significant failure introduced by that shortcut?
- The security flaw is that the team retained a tested database backup.
- Inspecting encryption settings itself disables a healthy disk.
- Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted.
- The observed issue is fully explained by the service display name.
Explanation
Correct Answer
C:The suitable control is: Enable a supported AKS network-policy enforcement system and author precise pod or namespace rules. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real AKS network policy microsegmentation weakness after the shortcut. The material failure is: Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted.
B:This does not explain the real AKS network policy microsegmentation weakness after the shortcut. Inspect evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
D:This does not explain the real AKS network policy microsegmentation weakness after the shortcut. In the given case, a compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced.
Question 565
A compromised pod can contact every namespace because no egress or ingress NetworkPolicy is enforced. A review identifies this consequence: Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. What is the BEST controlled recovery once this failure is recognized?
- Delete all namespaces to prevent lateral movement.
- Create NetworkPolicy YAML and assume it is enforced regardless of cluster networking.
- Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
- Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically.
Explanation
Correct Answer
C:Test using these records: Network policy engine, pod labels, namespace selectors and allowed versus denied flows. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Delete all namespaces to prevent lateral movement. This would not reliably restore the intended security boundary. Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The appropriate controlled recovery is: Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
B:Create NetworkPolicy YAML and assume it is enforced regardless of cluster networking. This would not reliably restore the intended security boundary. Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The appropriate controlled recovery is: Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
D:Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically. This would not reliably restore the intended security boundary. Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The appropriate controlled recovery is: Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
Question 566
A payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should delete all namespaces to prevent lateral movement.
- For this Azure workload, the team should enable a supported AKS network-policy enforcement system and author precise pod or namespace rules.
- For this Azure workload, the team should create NetworkPolicy YAML and assume it is enforced regardless of cluster networking.
- For this Azure workload, the team should assume an Azure VNet NSG expresses every Kubernetes pod selector automatically.
Explanation
Correct Answer
B:Confirm the change against these records: Network policy engine, pod labels, namespace selectors and allowed versus denied flows.
Incorrect Answers
A:Delete all namespaces to prevent lateral movement. The proposed change targets the wrong mechanism or lacks essential validation. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Relevant evidence is network policy engine, pod labels, namespace selectors and allowed versus denied flows.
C:Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted.
D:Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically.
Question 567
A payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted. What evidence most directly confirms the intended security behavior?
- In this security review, examine network policy engine, pod labels, namespace selectors and allowed versus denied flows.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine a database online indicator without a log of the protected operation.
Explanation
Correct Answer
A:These records test the actual AKS network policy microsegmentation behavior rather than an unrelated dashboard state. The intended action is: Enable a supported AKS network-policy enforcement system and author precise pod or namespace rules.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted.
C:The more relevant observations are: Network policy engine, pod labels, namespace selectors and allowed versus denied flows.
D:Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
Question 568
A payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted. Which security principle best explains the intended decision?
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
Explanation
Correct Answer
C:Confirmation depends on Network policy engine, pod labels, namespace selectors and allowed versus denied flows.
Incorrect Answers
A:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for AKS network policy microsegmentation. The relevant security behavior is: Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Check evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
B:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for AKS network policy microsegmentation. The relevant security behavior is: Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Check evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
D:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for AKS network policy microsegmentation. The relevant security behavior is: Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them. Check evidence such as network policy engine, pod labels, namespace selectors and allowed versus denied flows.
Question 569
A payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted. Suppose the operator instead follows this unsafe shortcut: Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
A:The suitable control is: Enable a supported AKS network-policy enforcement system and author precise pod or namespace rules. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
Incorrect Answers
B:This does not explain the real AKS network policy microsegmentation weakness after the shortcut. In the given case, a payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted.
C:This does not explain the real AKS network policy microsegmentation weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
D:The material failure is: Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted.
Question 570
A payment service in AKS must accept calls only from the API tier but pod-to-pod connectivity is unrestricted. A review identifies this consequence: Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. Which remediation most directly restores the intended behavior?
- The controlled remediation is to create NetworkPolicy YAML and assume it is enforced regardless of cluster networking.
- The controlled remediation is to assume an Azure VNet NSG expresses every Kubernetes pod selector automatically.
- The controlled remediation is to delete all namespaces to prevent lateral movement.
- The controlled remediation is to correct the effective policy and validate allowed service connectivity and blocked lateral paths.
Explanation
Correct Answer
D:Test using these records: Network policy engine, pod labels, namespace selectors and allowed versus denied flows. Kubernetes network policies constrain eligible pod traffic when a supported enforcement engine implements them.
Incorrect Answers
A:Create NetworkPolicy YAML and assume it is enforced regardless of cluster networking. This would not reliably restore the intended security boundary. Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The appropriate controlled recovery is: Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
B:Assume an Azure VNet NSG expresses every Kubernetes pod selector automatically. This would not reliably restore the intended security boundary. Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The appropriate controlled recovery is: Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
C:Delete all namespaces to prevent lateral movement. This would not reliably restore the intended security boundary. Creating a policy object without an enforcement mechanism or matching selectors can leave traffic unrestricted. The appropriate controlled recovery is: Correct the effective policy and validate allowed service connectivity and blocked lateral paths.
