Microsoft AZ-500 Practice Test 63
Question 620
A sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees. A review identifies this consequence: Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to configure the supported confidential VM encryption mode and verify secure boot and key access.
- The controlled remediation is to publish the disk key in the VM custom data to bypass key release.
- The controlled remediation is to treat an Azure NSG as the confidential VM disk key.
- The controlled remediation is to assume any VM can enable confidential disk encryption without compatible hardware.
Explanation
Correct Answer
A:Test using these records: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
Incorrect Answers
B:Publish the disk key in the VM custom data to bypass key release. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
C:Treat an Azure NSG as the confidential VM disk key. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
D:Assume any VM can enable confidential disk encryption without compatible hardware. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
Question 621
An Azure storage account is configured to deny all but selected VNets yet one required subnet was never added. Which operator action best meets this technical requirement?
- Set the intended storage account network access default and explicit trusted network exceptions.
- Make all storage networks trusted by default to avoid private endpoint setup.
- Assume a Reader role assignment changes storage firewall network defaults.
- Use a container image signing rule to restrict blob network access.
Explanation
Correct Answer
A:Confirm the change against these records: Storage network default action, virtual network rules, public endpoint state and authorized path tests. Storage firewalls restrict network access separately from storage data authorization.
Incorrect Answers
B:An account protected only by access keys may still be reachable from unintended public networks. In the given case, an Azure storage account is configured to deny all but selected VNets yet one required subnet was never added.
C:Assume a Reader role assignment changes storage firewall network defaults. The proposed change targets the wrong mechanism or lacks essential validation. Storage firewalls restrict network access separately from storage data authorization. Relevant evidence is Storage network default action, virtual network rules, public endpoint state and authorized path tests.
D:An account protected only by access keys may still be reachable from unintended public networks. The intended action is: Set the intended storage account network access default and explicit trusted network exceptions.
Question 622
An Azure storage account is configured to deny all but selected VNets yet one required subnet was never added. Which collection of observations most directly tests the suspected cause?
- A powered-on VM status without the actual guest or data-plane security state.
- The identity name without a corresponding workload data authorization test.
- Storage network default action, virtual network rules, public endpoint state and authorized path tests.
- A database online indicator without a log of the protected operation.
Explanation
Correct Answer
C:These records test the actual Storage account network firewall restriction behavior rather than an unrelated dashboard state. Storage firewalls restrict network access separately from storage data authorization.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Storage network default action, virtual network rules, public endpoint state and authorized path tests.
B:On its own, that evidence does not prove the specified security control works. Storage firewalls restrict network access separately from storage data authorization.
D:On its own, that evidence does not prove the specified security control works. In the given case, an Azure storage account is configured to deny all but selected VNets yet one required subnet was never added.
Question 623
An Azure storage account is configured to deny all but selected VNets yet one required subnet was never added. Which statement most accurately explains this scenario?
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- Setting a registry image tag guarantees security monitoring of the running workload.
- Storage firewalls restrict network access separately from storage data authorization.
- A valid Azure management role always gives full access to every blob object and SQL row.
Explanation
Correct Answer
C:Confirmation depends on Storage network default action, virtual network rules, public endpoint state and authorized path tests. This principle supports the security response: Set the intended storage account network access default and explicit trusted network exceptions.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for Storage account network firewall restriction. The relevant security behavior is: Storage firewalls restrict network access separately from storage data authorization. Check evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
B:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Storage account network firewall restriction. The relevant security behavior is: Storage firewalls restrict network access separately from storage data authorization. Check evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
D:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Storage account network firewall restriction. The relevant security behavior is: Storage firewalls restrict network access separately from storage data authorization. Check evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
Question 624
An Azure storage account is configured to deny all but selected VNets yet one required subnet was never added. Suppose the operator instead follows this unsafe shortcut: Make all storage networks trusted by default to avoid private endpoint setup. What is the principal technical consequence of the mistaken choice?
- The observed issue is fully explained by the service display name.
- An account protected only by access keys may still be reachable from unintended public networks.
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
Explanation
Correct Answer
B:The suitable control is: Set the intended storage account network access default and explicit trusted network exceptions.
Incorrect Answers
A:This does not explain the real Storage account network firewall restriction weakness after the shortcut. The material failure is: An account protected only by access keys may still be reachable from unintended public networks.
C:This does not explain the real Storage account network firewall restriction weakness after the shortcut. Inspect evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
D:This does not explain the real Storage account network firewall restriction weakness after the shortcut. In the given case, an Azure storage account is configured to deny all but selected VNets yet one required subnet was never added.
Question 625
An Azure storage account is configured to deny all but selected VNets yet one required subnet was never added. A review identifies this consequence: An account protected only by access keys may still be reachable from unintended public networks. Which recovery action restores the intended control and validates its effect?
- Apply minimal network exceptions and verify both permitted and denied source paths.
- Assume a Reader role assignment changes storage firewall network defaults.
- Use a container image signing rule to restrict blob network access.
- Make all storage networks trusted by default to avoid private endpoint setup.
Explanation
Correct Answer
A:Test using these records: Storage network default action, virtual network rules, public endpoint state and authorized path tests. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Assume a Reader role assignment changes storage firewall network defaults. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
C:Use a container image signing rule to restrict blob network access. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
D:Make all storage networks trusted by default to avoid private endpoint setup. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
Question 626
A business-critical blob account is publicly reachable because its network default action remains Allow. What is the most defensible Azure security action?
- For this Azure workload, the team should assume a Reader role assignment changes storage firewall network defaults.
- For this Azure workload, the team should set the intended storage account network access default and explicit trusted network exceptions.
- For this Azure workload, the team should use a container image signing rule to restrict blob network access.
- For this Azure workload, the team should make all storage networks trusted by default to avoid private endpoint setup.
Explanation
Correct Answer
B:Confirm the change against these records: Storage network default action, virtual network rules, public endpoint state and authorized path tests.
Incorrect Answers
A:Assume a Reader role assignment changes storage firewall network defaults. The proposed change targets the wrong mechanism or lacks essential validation. Storage firewalls restrict network access separately from storage data authorization. Relevant evidence is Storage network default action, virtual network rules, public endpoint state and authorized path tests.
C:An account protected only by access keys may still be reachable from unintended public networks. In the given case, a business-critical blob account is publicly reachable because its network default action remains Allow.
D:An account protected only by access keys may still be reachable from unintended public networks. Make all storage networks trusted by default to avoid private endpoint setup.
Question 627
A business-critical blob account is publicly reachable because its network default action remains Allow. Which diagnostic record would most strongly confirm the result?
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine Storage network default action, virtual network rules, public endpoint state and authorized path tests.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine the identity name without a corresponding workload data authorization test.
Explanation
Correct Answer
B:These records test the actual Storage account network firewall restriction behavior rather than an unrelated dashboard state. The intended action is: Set the intended storage account network access default and explicit trusted network exceptions.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a business-critical blob account is publicly reachable because its network default action remains Allow.
C:The more relevant observations are: Storage network default action, virtual network rules, public endpoint state and authorized path tests.
D:In the given case, a business-critical blob account is publicly reachable because its network default action remains Allow.
Question 628
A business-critical blob account is publicly reachable because its network default action remains Allow. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
- The applicable security principle is that Storage firewalls restrict network access separately from storage data authorization.
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
Explanation
Correct Answer
B:Confirmation depends on Storage network default action, virtual network rules, public endpoint state and authorized path tests.
Incorrect Answers
A:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Storage account network firewall restriction. The relevant security behavior is: Storage firewalls restrict network access separately from storage data authorization. Check evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
C:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for Storage account network firewall restriction. The relevant security behavior is: Storage firewalls restrict network access separately from storage data authorization. Check evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
D:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for Storage account network firewall restriction. The relevant security behavior is: Storage firewalls restrict network access separately from storage data authorization. Check evidence such as Storage network default action, virtual network rules, public endpoint state and authorized path tests.
Question 629
A business-critical blob account is publicly reachable because its network default action remains Allow. Suppose the operator instead follows this unsafe shortcut: Make all storage networks trusted by default to avoid private endpoint setup. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that an account protected only by access keys may still be reachable from unintended public networks.
Explanation
Correct Answer
D:Storage firewalls restrict network access separately from storage data authorization.
Incorrect Answers
A:This does not explain the real Storage account network firewall restriction weakness after the shortcut. In the given case, a business-critical blob account is publicly reachable because its network default action remains Allow.
B:This does not explain the real Storage account network firewall restriction weakness after the shortcut. The security flaw is that the team retained a tested database backup.
C:This does not explain the real Storage account network firewall restriction weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
Question 630
A business-critical blob account is publicly reachable because its network default action remains Allow. A review identifies this consequence: An account protected only by access keys may still be reachable from unintended public networks. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to use a container image signing rule to restrict blob network access.
- The controlled remediation is to apply minimal network exceptions and verify both permitted and denied source paths.
- The controlled remediation is to make all storage networks trusted by default to avoid private endpoint setup.
- The controlled remediation is to assume a Reader role assignment changes storage firewall network defaults.
Explanation
Correct Answer
B:Test using these records: Storage network default action, virtual network rules, public endpoint state and authorized path tests. Storage firewalls restrict network access separately from storage data authorization.
Incorrect Answers
A:Use a container image signing rule to restrict blob network access. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
C:Make all storage networks trusted by default to avoid private endpoint setup. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
D:Assume a Reader role assignment changes storage firewall network defaults. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
