Microsoft AZ-500 Practice Test 65
Question 640
An app has Storage Account Contributor but receives authorization errors when reading blob contents using OAuth. A review identifies this consequence: Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to assume storage account Contributor always includes complete Blob Data Owner privileges.
- The controlled remediation is to grant the correct limited blob data role and validate a data-plane operation.
- The controlled remediation is to grant subscription Owner and treat it as the minimal blob data role.
- The controlled remediation is to change blob firewall rules to create Microsoft Entra role claims.
Explanation
Correct Answer
B:Test using these records: Effective role assignment, token identity, blob read or write operation and role scope. Azure Blob data-plane RBAC permissions differ from storage account management permissions.
Incorrect Answers
A:Assume storage account Contributor always includes complete Blob Data Owner privileges. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
C:Grant subscription Owner and treat it as the minimal blob data role. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
D:Change blob firewall rules to create Microsoft Entra role claims. This would not reliably restore the intended security boundary. Management-plane role elevation may not grant the required blob data action or may overprivilege the caller. The appropriate controlled recovery is: Grant the correct limited blob data role and validate a data-plane operation.
Question 641
Several applications use one long-lived storage account key that has never been rotated. What is the BEST supported implementation or corrective action?
- Store regenerated keys in public application settings files.
- Rotate both account keys simultaneously before checking dependencies.
- Rotate storage account keys using staged dependency migration and approved key management.
- Assume a shared account key can be individually revoked for one application without affecting others.
Explanation
Correct Answer
C:Confirm the change against these records: Active key usage, dependent application configuration, access audit and regenerated key status. Storage account keys confer broad account-level access and require controlled rotation.
Incorrect Answers
A:Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk.
B:Rotate both account keys simultaneously before checking dependencies. The proposed change targets the wrong mechanism or lacks essential validation. Storage account keys confer broad account-level access and require controlled rotation. Relevant evidence is active key usage, dependent application configuration, access audit and regenerated key status.
D:Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The intended action is: Rotate storage account keys using staged dependency migration and approved key management.
Question 642
Several applications use one long-lived storage account key that has never been rotated. Which evidence BEST verifies the intended technical behavior?
- A database online indicator without a log of the protected operation.
- A powered-on VM status without the actual guest or data-plane security state.
- A storage account resource name without its encryption or retention configuration.
- Active key usage, dependent application configuration, access audit and regenerated key status.
Explanation
Correct Answer
D:These records test the actual Storage account access key rotation behavior rather than an unrelated dashboard state. Storage account keys confer broad account-level access and require controlled rotation.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Active key usage, dependent application configuration, access audit and regenerated key status.
B:On its own, that evidence does not prove the specified security control works. Storage account keys confer broad account-level access and require controlled rotation.
C:On its own, that evidence does not prove the specified security control works. In the given case, several applications use one long-lived storage account key that has never been rotated.
Question 643
Several applications use one long-lived storage account key that has never been rotated. Which principle BEST explains why the recommended solution is appropriate?
- Storage account keys confer broad account-level access and require controlled rotation.
- A valid Azure management role always gives full access to every blob object and SQL row.
- A protected storage account is immune to every accidental deletion and overwrite.
- Setting a registry image tag guarantees security monitoring of the running workload.
Explanation
Correct Answer
A:Confirmation depends on Active key usage, dependent application configuration, access audit and regenerated key status. This principle supports the security response: Rotate storage account keys using staged dependency migration and approved key management.
Incorrect Answers
B:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Storage account access key rotation. The relevant security behavior is: Storage account keys confer broad account-level access and require controlled rotation. Check evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
C:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Storage account access key rotation. The relevant security behavior is: Storage account keys confer broad account-level access and require controlled rotation. Check evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
D:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Storage account access key rotation. The relevant security behavior is: Storage account keys confer broad account-level access and require controlled rotation. Check evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
Question 644
Several applications use one long-lived storage account key that has never been rotated. Suppose the operator instead follows this unsafe shortcut: Store regenerated keys in public application settings files. What is the MOST significant failure introduced by that shortcut?
- Inspecting encryption settings itself disables a healthy disk.
- The observed issue is fully explained by the service display name.
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk.
Explanation
Correct Answer
D:The suitable control is: Rotate storage account keys using staged dependency migration and approved key management. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Storage account access key rotation weakness after the shortcut. The material failure is: Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk.
B:This does not explain the real Storage account access key rotation weakness after the shortcut. Inspect evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
C:This does not explain the real Storage account access key rotation weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
Question 645
Several applications use one long-lived storage account key that has never been rotated. A review identifies this consequence: Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. What is the BEST controlled recovery once this failure is recognized?
- Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
- Rotate both account keys simultaneously before checking dependencies.
- Assume a shared account key can be individually revoked for one application without affecting others.
- Store regenerated keys in public application settings files.
Explanation
Correct Answer
A:Test using these records: Active key usage, dependent application configuration, access audit and regenerated key status. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Rotate both account keys simultaneously before checking dependencies. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
C:Assume a shared account key can be individually revoked for one application without affecting others. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
D:Store regenerated keys in public application settings files. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
Question 646
A storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should rotate both account keys simultaneously before checking dependencies.
- For this Azure workload, the team should assume a shared account key can be individually revoked for one application without affecting others.
- For this Azure workload, the team should store regenerated keys in public application settings files.
- For this Azure workload, the team should rotate storage account keys using staged dependency migration and approved key management.
Explanation
Correct Answer
D:Confirm the change against these records: Active key usage, dependent application configuration, access audit and regenerated key status.
Incorrect Answers
A:Rotate both account keys simultaneously before checking dependencies. The proposed change targets the wrong mechanism or lacks essential validation. Storage account keys confer broad account-level access and require controlled rotation. Relevant evidence is active key usage, dependent application configuration, access audit and regenerated key status.
B:Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. Assume a shared account key can be individually revoked for one application without affecting others.
C:Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk.
Question 647
A storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications. What evidence most directly confirms the intended security behavior?
- In this security review, examine the identity name without a corresponding workload data authorization test.
- In this security review, examine a database online indicator without a log of the protected operation.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine active key usage, dependent application configuration, access audit and regenerated key status.
Explanation
Correct Answer
D:These records test the actual Storage account access key rotation behavior rather than an unrelated dashboard state. The intended action is: Rotate storage account keys using staged dependency migration and approved key management.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications.
B:The more relevant observations are: Active key usage, dependent application configuration, access audit and regenerated key status.
C:A powered-on VM status without the actual guest or data-plane security state.
Question 648
A storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications. Which security principle best explains the intended decision?
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that Storage account keys confer broad account-level access and require controlled rotation.
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
Explanation
Correct Answer
B:Confirmation depends on Active key usage, dependent application configuration, access audit and regenerated key status.
Incorrect Answers
A:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Storage account access key rotation. The relevant security behavior is: Storage account keys confer broad account-level access and require controlled rotation. Check evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
C:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Storage account access key rotation. The relevant security behavior is: Storage account keys confer broad account-level access and require controlled rotation. Check evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
D:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for Storage account access key rotation. The relevant security behavior is: Storage account keys confer broad account-level access and require controlled rotation. Check evidence such as active key usage, dependent application configuration, access audit and regenerated key status.
Question 649
A storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications. Suppose the operator instead follows this unsafe shortcut: Store regenerated keys in public application settings files. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
Explanation
Correct Answer
B:The suitable control is: Rotate storage account keys using staged dependency migration and approved key management. Storage account keys confer broad account-level access and require controlled rotation.
Incorrect Answers
A:This does not explain the real Storage account access key rotation weakness after the shortcut. In the given case, a storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications.
C:This does not explain the real Storage account access key rotation weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
D:This does not explain the real Storage account access key rotation weakness after the shortcut. The observed issue is fully explained by the service display name.
Question 650
A storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications. A review identifies this consequence: Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume a shared account key can be individually revoked for one application without affecting others.
- The controlled remediation is to store regenerated keys in public application settings files.
- The controlled remediation is to move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
- The controlled remediation is to rotate both account keys simultaneously before checking dependencies.
Explanation
Correct Answer
C:Test using these records: Active key usage, dependent application configuration, access audit and regenerated key status. Storage account keys confer broad account-level access and require controlled rotation.
Incorrect Answers
A:Assume a shared account key can be individually revoked for one application without affecting others. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
B:Store regenerated keys in public application settings files. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
D:Rotate both account keys simultaneously before checking dependencies. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
