cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 60

Question 590

A short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs. A review identifies this consequence: Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. Which recovery action addresses the underlying technical fault?

  1. The controlled remediation is to correct telemetry collection and verify new log records reach the authorized destination.
  2. The controlled remediation is to use a VM guest event log policy without any container diagnostic integration.
  3. The controlled remediation is to assume an ACR image scan automatically records every container execution event.
  4. The controlled remediation is to disable logs to avoid storing data from short-running jobs.

Explanation

Correct Answer

A:

Test using these records: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

Incorrect Answers

B:

Use a VM guest event log policy without any container diagnostic integration. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

C:

Assume an ACR image scan automatically records every container execution event. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

D:

Disable logs to avoid storing data from short-running jobs. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

Question 591

A deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images. What is the most defensible Azure security action?

  1. Use the registry admin account across every production host.
  2. Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.
  3. Grant every AKS workload ACR push rights to avoid authentication failures.
  4. Make the registry anonymous and public without considering content sensitivity.

Explanation

Correct Answer

B:

Confirm the change against these records: ACR role assignments, repository scope, image pull test and denied push operation. Registry management and image data permissions should be scoped to the tasks of publishers and consumers.

Incorrect Answers

A:

Use the registry admin account across every production host. This is not a valid substitute for the specified security control. Giving a deployment consumer push rights may allow unauthorized image modification. The correct targeted action is: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

C:

Registry management and image data permissions should be scoped to the tasks of publishers and consumers. The proposed change targets the wrong mechanism or lacks essential validation.

D:

Make the registry anonymous and public without considering content sensitivity. This leaves the security requirement unresolved. Giving a deployment consumer push rights may allow unauthorized image modification. The intended action is: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

Question 592

A deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images. Which diagnostic record would most strongly confirm the result?

  1. ACR role assignments, repository scope, image pull test and denied push operation.
  2. A database online indicator without a log of the protected operation.
  3. A powered-on VM status without the actual guest or data-plane security state.
  4. A storage account resource name without its encryption or retention configuration.

Explanation

Correct Answer

A:

These records test the actual Azure Container Registry least privilege behavior rather than an unrelated dashboard state. Registry management and image data permissions should be scoped to the tasks of publishers and consumers.

Incorrect Answers

B:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: ACR role assignments, repository scope, image pull test and denied push operation.

C:

On its own, that evidence does not prove the specified security control works. Registry management and image data permissions should be scoped to the tasks of publishers and consumers.

D:

On its own, that evidence does not prove the specified security control works. In the given case, a deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images.

Question 593

A deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images. Which platform concept should guide the engineer’s assessment?

  1. A valid Azure management role always gives full access to every blob object and SQL row.
  2. A protected storage account is immune to every accidental deletion and overwrite.
  3. Registry management and image data permissions should be scoped to the tasks of publishers and consumers.
  4. Setting a registry image tag guarantees security monitoring of the running workload.

Explanation

Correct Answer

C:

Confirmation depends on ACR role assignments, repository scope, image pull test and denied push operation. This principle supports the security response: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

Incorrect Answers

A:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Azure Container Registry least privilege. The relevant security behavior is: Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Check evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

B:

A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Azure Container Registry least privilege. The relevant security behavior is: Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Check evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

D:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Azure Container Registry least privilege. The relevant security behavior is: Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Check evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

Question 594

A deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images. Suppose the operator instead follows this unsafe shortcut: Use the registry admin account across every production host. Which root-cause observation follows from that incorrect change?

  1. Inspecting encryption settings itself disables a healthy disk.
  2. The observed issue is fully explained by the service display name.
  3. Giving a deployment consumer push rights may allow unauthorized image modification.
  4. Collecting VM diagnostic data caused the original unauthorized storage read.

Explanation

Correct Answer

C:

Registry management and image data permissions should be scoped to the tasks of publishers and consumers. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real Azure Container Registry least privilege weakness after the shortcut. The material failure is: Giving a deployment consumer push rights may allow unauthorized image modification.

B:

This does not explain the real Azure Container Registry least privilege weakness after the shortcut. Inspect evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

D:

This does not explain the real Azure Container Registry least privilege weakness after the shortcut. In the given case, a deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images.

Question 595

A deployment pipeline can push images to ACR but a runtime workload only needs to pull signed or approved images. A review identifies this consequence: Giving a deployment consumer push rights may allow unauthorized image modification. Which recovery action addresses the underlying technical fault?

  1. Grant every AKS workload ACR push rights to avoid authentication failures.
  2. Replace broad access with appropriate pull-only permissions and verify image acquisition.
  3. Make the registry anonymous and public without considering content sensitivity.
  4. Use the registry admin account across every production host.

Explanation

Correct Answer

B:

Test using these records: ACR role assignments, repository scope, image pull test and denied push operation. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Grant every AKS workload ACR push rights to avoid authentication failures. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.

C:

Make the registry anonymous and public without considering content sensitivity. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.

D:

Use the registry admin account across every production host. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.

Question 596

A developer has registry-wide write privileges when their production application requires read-only image access. What is the BEST supported implementation or corrective action?

  1. For this Azure workload, the team should grant every AKS workload ACR push rights to avoid authentication failures.
  2. For this Azure workload, the team should make the registry anonymous and public without considering content sensitivity.
  3. For this Azure workload, the team should use the registry admin account across every production host.
  4. For this Azure workload, the team should grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

Explanation

Correct Answer

D:

Confirm the change against these records: ACR role assignments, repository scope, image pull test and denied push operation.

Incorrect Answers

A:

Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Relevant evidence is aCR role assignments, repository scope, image pull test and denied push operation.

B:

Make the registry anonymous and public without considering content sensitivity. This leaves the security requirement unresolved. Giving a deployment consumer push rights may allow unauthorized image modification. The intended action is: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

C:

Use the registry admin account across every production host. This is not a valid substitute for the specified security control. Giving a deployment consumer push rights may allow unauthorized image modification. The correct targeted action is: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

Question 597

A developer has registry-wide write privileges when their production application requires read-only image access. Which evidence BEST verifies the intended technical behavior?

  1. In this security review, examine the identity name without a corresponding workload data authorization test.
  2. In this security review, examine a database online indicator without a log of the protected operation.
  3. In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
  4. In this security review, examine aCR role assignments, repository scope, image pull test and denied push operation.

Explanation

Correct Answer

D:

These records test the actual Azure Container Registry least privilege behavior rather than an unrelated dashboard state. The intended action is: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, a developer has registry-wide write privileges when their production application requires read-only image access.

B:

The more relevant observations are: ACR role assignments, repository scope, image pull test and denied push operation.

C:

Registry management and image data permissions should be scoped to the tasks of publishers and consumers.

Question 598

A developer has registry-wide write privileges when their production application requires read-only image access. Which principle BEST explains why the recommended solution is appropriate?

  1. The applicable security principle is that registry management and image data permissions should be scoped to the tasks of publishers and consumers.
  2. The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
  3. The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
  4. The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.

Explanation

Correct Answer

A:

Confirmation depends on ACR role assignments, repository scope, image pull test and denied push operation.

Incorrect Answers

B:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Azure Container Registry least privilege. The relevant security behavior is: Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Check evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

C:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Azure Container Registry least privilege. The relevant security behavior is: Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Check evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

D:

Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for Azure Container Registry least privilege. The relevant security behavior is: Registry management and image data permissions should be scoped to the tasks of publishers and consumers. Check evidence such as aCR role assignments, repository scope, image pull test and denied push operation.

Question 599

A developer has registry-wide write privileges when their production application requires read-only image access. Suppose the operator instead follows this unsafe shortcut: Use the registry admin account across every production host. What is the MOST significant failure introduced by that shortcut?

  1. The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
  2. The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
  3. The resulting security weakness is that the observed issue is fully explained by the service display name.
  4. The resulting security weakness is that giving a deployment consumer push rights may allow unauthorized image modification.

Explanation

Correct Answer

D:

Registry management and image data permissions should be scoped to the tasks of publishers and consumers. The suitable control is: Grant the smallest appropriate Azure Container Registry pull or repository-level role according to supported access mode.

Incorrect Answers

A:

This does not explain the real Azure Container Registry least privilege weakness after the shortcut. In the given case, a developer has registry-wide write privileges when their production application requires read-only image access.

B:

This does not explain the real Azure Container Registry least privilege weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.

C:

This does not explain the real Azure Container Registry least privilege weakness after the shortcut. The observed issue is fully explained by the service display name.

Question 600

A developer has registry-wide write privileges when their production application requires read-only image access. A review identifies this consequence: Giving a deployment consumer push rights may allow unauthorized image modification. What is the BEST controlled recovery once this failure is recognized?

  1. The controlled remediation is to replace broad access with appropriate pull-only permissions and verify image acquisition.
  2. The controlled remediation is to make the registry anonymous and public without considering content sensitivity.
  3. The controlled remediation is to use the registry admin account across every production host.
  4. The controlled remediation is to grant every AKS workload ACR push rights to avoid authentication failures.

Explanation

Correct Answer

A:

Test using these records: ACR role assignments, repository scope, image pull test and denied push operation. Registry management and image data permissions should be scoped to the tasks of publishers and consumers.

Incorrect Answers

B:

Make the registry anonymous and public without considering content sensitivity. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.

C:

Use the registry admin account across every production host. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.

D:

Grant every AKS workload ACR push rights to avoid authentication failures. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.

Microsoft Azure Security Technologies (AZ-500) Practice Tests