Microsoft AZ-500 Practice Test 61
Question 600
A developer has registry-wide write privileges when their production application requires read-only image access. A review identifies this consequence: Giving a deployment consumer push rights may allow unauthorized image modification. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to replace broad access with appropriate pull-only permissions and verify image acquisition.
- The controlled remediation is to make the registry anonymous and public without considering content sensitivity.
- The controlled remediation is to use the registry admin account across every production host.
- The controlled remediation is to grant every AKS workload ACR push rights to avoid authentication failures.
Explanation
Correct Answer
A:Test using these records: ACR role assignments, repository scope, image pull test and denied push operation. Registry management and image data permissions should be scoped to the tasks of publishers and consumers.
Incorrect Answers
B:Make the registry anonymous and public without considering content sensitivity. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.
C:Use the registry admin account across every production host. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.
D:Grant every AKS workload ACR push rights to avoid authentication failures. This would not reliably restore the intended security boundary. Giving a deployment consumer push rights may allow unauthorized image modification. The appropriate controlled recovery is: Replace broad access with appropriate pull-only permissions and verify image acquisition.
Question 601
A VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest. What is the BEST supported implementation or corrective action?
- Install a SQL firewall rule as a replacement for host disk encryption.
- Assume Azure managed disk encryption and host encryption are always the same control.
- Enable and validate encryption at host on supported virtual machines according to the security requirement.
- Disable encryption on temporary storage to avoid performance testing.
Explanation
Correct Answer
C:Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. This directly addresses disk encryption at host versus guest encryption.
Incorrect Answers
A:That option would install a SQL firewall rule as a replacement for host disk encryption, but it addresses a different concern. Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
B:That option would assume Azure managed disk encryption and host encryption are always the same control, but it addresses a different concern. Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
D:Disable encryption on temporary storage to avoid performance testing. This leaves the security requirement unresolved. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The intended action is: Enable and validate encryption at host on supported virtual machines according to the security requirement.
Question 602
A VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest. Which evidence BEST verifies the intended technical behavior?
- VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
- The identity name without a corresponding workload data authorization test.
- An outdated deployment template without current effective settings.
- A powered-on VM status without the actual guest or data-plane security state.
Explanation
Correct Answer
A:These records test the actual disk encryption at host versus guest encryption behavior rather than an unrelated dashboard state. Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
D:On its own, that evidence does not prove the specified security control works. In the given case, a VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest.
Question 603
A VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest. Which principle BEST explains why the recommended solution is appropriate?
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A valid Azure management role always gives full access to every blob object and SQL row.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
Explanation
Correct Answer
D:Confirmation depends on VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status. This principle supports the security response: Enable and validate encryption at host on supported virtual machines according to the security requirement.
Incorrect Answers
A:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for disk encryption at host versus guest encryption. The relevant security behavior is: Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Check evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
B:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for disk encryption at host versus guest encryption. The relevant security behavior is: Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Check evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
C:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for disk encryption at host versus guest encryption. The relevant security behavior is: Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Check evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Question 604
A VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest. Suppose the operator instead follows this unsafe shortcut: Install a SQL firewall rule as a replacement for host disk encryption. What is the MOST significant failure introduced by that shortcut?
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- The security flaw is that the team retained a tested database backup.
- Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap.
Explanation
Correct Answer
D:The suitable control is: Enable and validate encryption at host on supported virtual machines according to the security requirement.
Incorrect Answers
A:This does not explain the real disk encryption at host versus guest encryption weakness after the shortcut. The material failure is: Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap.
B:This does not explain the real disk encryption at host versus guest encryption weakness after the shortcut. Inspect evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
C:This does not explain the real disk encryption at host versus guest encryption weakness after the shortcut. In the given case, a VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest.
Question 605
A VM requires encryption of temporary disks and host-side cache in addition to managed disk encryption at rest. A review identifies this consequence: Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. What is the BEST controlled recovery once this failure is recognized?
- Assume Azure managed disk encryption and host encryption are always the same control.
- Deploy compatible host encryption and verify the VM and disk state.
- Disable encryption on temporary storage to avoid performance testing.
- Install a SQL firewall rule as a replacement for host disk encryption.
Explanation
Correct Answer
B:Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume Azure managed disk encryption and host encryption are always the same control. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
C:Disable encryption on temporary storage to avoid performance testing. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
D:Install a SQL firewall rule as a replacement for host disk encryption. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
Question 606
A platform uses storage service encryption but its security requirements also cover data handled on the virtualization host. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should assume Azure managed disk encryption and host encryption are always the same control.
- For this Azure workload, the team should enable and validate encryption at host on supported virtual machines according to the security requirement.
- For this Azure workload, the team should disable encryption on temporary storage to avoid performance testing.
- For this Azure workload, the team should install a SQL firewall rule as a replacement for host disk encryption.
Explanation
Correct Answer
B:Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Confirm the change against these records: VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Incorrect Answers
A:Assume Azure managed disk encryption and host encryption are always the same control. The proposed change targets the wrong mechanism or lacks essential validation. Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Relevant evidence is VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
C:Disable encryption on temporary storage to avoid performance testing. This leaves the security requirement unresolved. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The intended action is: Enable and validate encryption at host on supported virtual machines according to the security requirement.
D:Install a SQL firewall rule as a replacement for host disk encryption. This is not a valid substitute for the specified security control. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The correct targeted action is: Enable and validate encryption at host on supported virtual machines according to the security requirement.
Question 607
A platform uses storage service encryption but its security requirements also cover data handled on the virtualization host. What evidence most directly confirms the intended security behavior?
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
- In this security review, examine the identity name without a corresponding workload data authorization test.
- In this security review, examine an outdated deployment template without current effective settings.
Explanation
Correct Answer
B:These records test the actual disk encryption at host versus guest encryption behavior rather than an unrelated dashboard state. The intended action is: Enable and validate encryption at host on supported virtual machines according to the security requirement.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a platform uses storage service encryption but its security requirements also cover data handled on the virtualization host.
C:Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
D:The more relevant observations are: VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Question 608
A platform uses storage service encryption but its security requirements also cover data handled on the virtualization host. Which security principle best explains the intended decision?
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption.
Explanation
Correct Answer
D:Confirmation depends on VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for disk encryption at host versus guest encryption. The relevant security behavior is: Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Check evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for disk encryption at host versus guest encryption. The relevant security behavior is: Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Check evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
C:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for disk encryption at host versus guest encryption. The relevant security behavior is: Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. Check evidence such as VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Question 609
A platform uses storage service encryption but its security requirements also cover data handled on the virtualization host. Suppose the operator instead follows this unsafe shortcut: Install a SQL firewall rule as a replacement for host disk encryption. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
Explanation
Correct Answer
A:Encryption at host adds protection for eligible host and temporary disk data beyond default managed disk at-rest encryption. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real disk encryption at host versus guest encryption weakness after the shortcut. In the given case, a platform uses storage service encryption but its security requirements also cover data handled on the virtualization host.
C:The material failure is: Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap.
D:This does not explain the real disk encryption at host versus guest encryption weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
Question 610
A platform uses storage service encryption but its security requirements also cover data handled on the virtualization host. A review identifies this consequence: Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. Which remediation most directly restores the intended behavior?
- The controlled remediation is to disable encryption on temporary storage to avoid performance testing.
- The controlled remediation is to install a SQL firewall rule as a replacement for host disk encryption.
- The controlled remediation is to assume Azure managed disk encryption and host encryption are always the same control.
- The controlled remediation is to deploy compatible host encryption and verify the VM and disk state.
Explanation
Correct Answer
D:Test using these records: VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Incorrect Answers
A:Disable encryption on temporary storage to avoid performance testing. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
B:Install a SQL firewall rule as a replacement for host disk encryption. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
C:Assume Azure managed disk encryption and host encryption are always the same control. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
