Microsoft AZ-500 Practice Test 64
Question 630
A business-critical blob account is publicly reachable because its network default action remains Allow. A review identifies this consequence: An account protected only by access keys may still be reachable from unintended public networks. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to use a container image signing rule to restrict blob network access.
- The controlled remediation is to apply minimal network exceptions and verify both permitted and denied source paths.
- The controlled remediation is to make all storage networks trusted by default to avoid private endpoint setup.
- The controlled remediation is to assume a Reader role assignment changes storage firewall network defaults.
Explanation
Correct Answer
B:Test using these records: Storage network default action, virtual network rules, public endpoint state and authorized path tests. Storage firewalls restrict network access separately from storage data authorization.
Incorrect Answers
A:Use a container image signing rule to restrict blob network access. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
C:Make all storage networks trusted by default to avoid private endpoint setup. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
D:Assume a Reader role assignment changes storage firewall network defaults. This would not reliably restore the intended security boundary. An account protected only by access keys may still be reachable from unintended public networks. The appropriate controlled recovery is: Apply minimal network exceptions and verify both permitted and denied source paths.
Question 631
A user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID. What is the most defensible Azure security action?
- Grant subscription Owner and treat it as the minimal blob data role.
- Change blob firewall rules to create Microsoft Entra role claims.
- Assign a suitable scoped Storage Blob Data role to the intended identity.
- Assume storage account Contributor always includes complete Blob Data Owner privileges.
Explanation
Correct Answer
C:Confirm the change against these records: Effective role assignment, token identity, blob read or write operation and role scope. Azure Blob data-plane RBAC permissions differ from storage account management permissions.
Incorrect Answers
A:Management-plane role elevation may not grant the required blob data action or may overprivilege the caller.
B:Change blob firewall rules to create Microsoft Entra role claims. The proposed change targets the wrong mechanism or lacks essential validation. Azure Blob data-plane RBAC permissions differ from storage account management permissions. Relevant evidence is effective role assignment, token identity, blob read or write operation and role scope.
D:Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The intended action is: Assign a suitable scoped Storage Blob Data role to the intended identity.
Question 632
A user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID. Which diagnostic record would most strongly confirm the result?
- An outdated deployment template without current effective settings.
- A storage account resource name without its encryption or retention configuration.
- Effective role assignment, token identity, blob read or write operation and role scope.
- The identity name without a corresponding workload data authorization test.
Explanation
Correct Answer
C:These records test the actual blob data RBAC permissions behavior rather than an unrelated dashboard state. Azure Blob data-plane RBAC permissions differ from storage account management permissions.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Effective role assignment, token identity, blob read or write operation and role scope.
B:On its own, that evidence does not prove the specified security control works. Azure Blob data-plane RBAC permissions differ from storage account management permissions.
D:On its own, that evidence does not prove the specified security control works. In the given case, a user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID.
Question 633
A user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID. Which platform concept should guide the engineer’s assessment?
- Azure Blob data-plane RBAC permissions differ from storage account management permissions.
- A protected storage account is immune to every accidental deletion and overwrite.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
Explanation
Correct Answer
A:Confirmation depends on Effective role assignment, token identity, blob read or write operation and role scope. This principle supports the security response: Assign a suitable scoped Storage Blob Data role to the intended identity.
Incorrect Answers
B:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for blob data RBAC permissions. The relevant security behavior is: Azure Blob data-plane RBAC permissions differ from storage account management permissions. Check evidence such as effective role assignment, token identity, blob read or write operation and role scope.
C:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for blob data RBAC permissions. The relevant security behavior is: Azure Blob data-plane RBAC permissions differ from storage account management permissions. Check evidence such as effective role assignment, token identity, blob read or write operation and role scope.
D:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for blob data RBAC permissions. The relevant security behavior is: Azure Blob data-plane RBAC permissions differ from storage account management permissions. Check evidence such as effective role assignment, token identity, blob read or write operation and role scope.
Question 634
A user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID. Suppose the operator instead follows this unsafe shortcut: Grant subscription Owner and treat it as the minimal blob data role. Which root-cause observation follows from that incorrect change?
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- Management-plane role elevation may not grant the required blob data action or may overprivilege the caller.
- The security flaw is that the team retained a tested database backup.
- Inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
B:The suitable control is: Assign a suitable scoped Storage Blob Data role to the intended identity. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real blob data RBAC permissions weakness after the shortcut. The material failure is: Management-plane role elevation may not grant the required blob data action or may overprivilege the caller.
C:This does not explain the real blob data RBAC permissions weakness after the shortcut. Inspect evidence such as effective role assignment, token identity, blob read or write operation and role scope.
D:This does not explain the real blob data RBAC permissions weakness after the shortcut. In the given case, a user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID.
Question 635
A user can edit a storage account's ARM properties but cannot enumerate private blobs through Microsoft Entra ID. A review identifies this consequence: Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. Which recovery action addresses the underlying technical fault?
- Change blob firewall rules to create Microsoft Entra role claims.
- Assume storage account Contributor always includes complete Blob Data Owner privileges.
- Grant subscription Owner and treat it as the minimal blob data role.
- Grant the correct limited blob data role and validate a data-plane operation.
Explanation
Correct Answer
D:Test using these records: Effective role assignment, token identity, blob read or write operation and role scope. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Change blob firewall rules to create Microsoft Entra role claims. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
B:Assume storage account Contributor always includes complete Blob Data Owner privileges. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
C:Grant subscription Owner and treat it as the minimal blob data role. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
Question 636
An app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should change blob firewall rules to create Microsoft Entra role claims.
- For this Azure workload, the team should assign a suitable scoped Storage Blob Data role to the intended identity.
- For this Azure workload, the team should assume storage account Contributor always includes complete Blob Data Owner privileges.
- For this Azure workload, the team should grant subscription Owner and treat it as the minimal blob data role.
Explanation
Correct Answer
B:Confirm the change against these records: Effective role assignment, token identity, blob read or write operation and role scope.
Incorrect Answers
A:Change blob firewall rules to create Microsoft Entra role claims. The proposed change targets the wrong mechanism or lacks essential validation. Azure Blob data-plane RBAC permissions differ from storage account management permissions. Relevant evidence is effective role assignment, token identity, blob read or write operation and role scope.
C:Management-plane role elevation may not grant the required blob data action or may overprivilege the caller.
D:Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. Grant subscription Owner and treat it as the minimal blob data role.
Question 637
An app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine effective role assignment, token identity, blob read or write operation and role scope.
- In this security review, examine a database online indicator without a log of the protected operation.
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
Explanation
Correct Answer
A:These records test the actual blob data RBAC permissions behavior rather than an unrelated dashboard state. The intended action is: Assign a suitable scoped Storage Blob Data role to the intended identity.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, an app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth.
C:The more relevant observations are: Effective role assignment, token identity, blob read or write operation and role scope.
D:In the given case, an app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth.
Question 638
An app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that Azure Blob data-plane RBAC permissions differ from storage account management permissions.
Explanation
Correct Answer
D:Confirmation depends on Effective role assignment, token identity, blob read or write operation and role scope.
Incorrect Answers
A:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for blob data RBAC permissions. The relevant security behavior is: Azure Blob data-plane RBAC permissions differ from storage account management permissions. Check evidence such as effective role assignment, token identity, blob read or write operation and role scope.
B:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for blob data RBAC permissions. The relevant security behavior is: Azure Blob data-plane RBAC permissions differ from storage account management permissions. Check evidence such as effective role assignment, token identity, blob read or write operation and role scope.
C:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for blob data RBAC permissions. The relevant security behavior is: Azure Blob data-plane RBAC permissions differ from storage account management permissions. Check evidence such as effective role assignment, token identity, blob read or write operation and role scope.
Question 639
An app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth. Suppose the operator instead follows this unsafe shortcut: Grant subscription Owner and treat it as the minimal blob data role. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that management-plane role elevation may not grant the required blob data action or may overprivilege the caller.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
Explanation
Correct Answer
B:The suitable control is: Assign a suitable scoped Storage Blob Data role to the intended identity. Azure Blob data-plane RBAC permissions differ from storage account management permissions.
Incorrect Answers
A:This does not explain the real blob data RBAC permissions weakness after the shortcut. In the given case, an app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth.
C:This does not explain the real blob data RBAC permissions weakness after the shortcut. The observed issue is fully explained by the service display name.
D:This does not explain the real blob data RBAC permissions weakness after the shortcut. The security flaw is that the team retained a tested database backup.
Question 640
An app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth. A review identifies this consequence: Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to assume storage account Contributor always includes complete Blob Data Owner privileges.
- The controlled remediation is to grant the correct limited blob data role and validate a data-plane operation.
- The controlled remediation is to grant subscription Owner and treat it as the minimal blob data role.
- The controlled remediation is to change blob firewall rules to create Microsoft Entra role claims.
Explanation
Correct Answer
B:Test using these records: Effective role assignment, token identity, blob read or write operation and role scope. Azure Blob data-plane RBAC permissions differ from storage account management permissions.
Incorrect Answers
A:Assume storage account Contributor always includes complete Blob Data Owner privileges. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
C:Grant subscription Owner and treat it as the minimal blob data role. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
D:Change blob firewall rules to create Microsoft Entra role claims. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
