Microsoft AZ-500 Practice Test 66
Question 650
A storage account key may be compromised but a team proposes regenerating it immediately without switching dependent applications. A review identifies this consequence: Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume a shared account key can be individually revoked for one application without affecting others.
- The controlled remediation is to store regenerated keys in public application settings files.
- The controlled remediation is to move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
- The controlled remediation is to rotate both account keys simultaneously before checking dependencies.
Explanation
Correct Answer
C:Test using these records: Active key usage, dependent application configuration, access audit and regenerated key status. Storage account keys confer broad account-level access and require controlled rotation.
Incorrect Answers
A:Assume a shared account key can be individually revoked for one application without affecting others. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
B:Store regenerated keys in public application settings files. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
D:Rotate both account keys simultaneously before checking dependencies. This would not reliably restore the intended security boundary. Regenerating an in-use key without updating applications causes outages and leaving leaked keys active prolongs risk. The appropriate controlled recovery is: Move consumers to the alternative key or identity-based access and safely regenerate exposed keys.
Question 651
A service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials. Which configuration decision MOST directly resolves the issue?
- Grant the application permanent storage account key access for a one-time file read.
- Set an unlimited expiry and all permissions to avoid future renewal.
- Assume a public blob URL is equivalent to a delegated SAS.
- Issue a narrow user delegation SAS signed through a properly authorized Microsoft Entra principal.
Explanation
Correct Answer
D:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Confirm the change against these records: SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Incorrect Answers
A:An overly broad or long-lived SAS permits more access than the temporary workload needs. In the given case, a service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials.
B:That option would set an unlimited expiry and all permissions to avoid future renewal, but it addresses a different concern. User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key.
C:An overly broad or long-lived SAS permits more access than the temporary workload needs. The intended action is: Issue a narrow user delegation SAS signed through a properly authorized Microsoft Entra principal.
Question 652
A service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials. What evidence most directly confirms the intended security behavior?
- The identity name without a corresponding workload data authorization test.
- An outdated deployment template without current effective settings.
- A powered-on VM status without the actual guest or data-plane security state.
- SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Explanation
Correct Answer
D:These records test the actual user delegation SAS for Blob Storage behavior rather than an unrelated dashboard state. User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: SAS signed resource, start and expiry, permissions, delegated identity and access tests.
C:On its own, that evidence does not prove the specified security control works. In the given case, a service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials.
Question 653
A service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials. Which security principle best explains the intended decision?
- User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A valid Azure management role always gives full access to every blob object and SQL row.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
Explanation
Correct Answer
A:Confirmation depends on SAS signed resource, start and expiry, permissions, delegated identity and access tests. This principle supports the security response: Issue a narrow user delegation SAS signed through a properly authorized Microsoft Entra principal.
Incorrect Answers
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for user delegation SAS for Blob Storage. The relevant security behavior is: User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Check evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
C:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for user delegation SAS for Blob Storage. The relevant security behavior is: User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Check evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
D:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for user delegation SAS for Blob Storage. The relevant security behavior is: User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Check evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Question 654
A service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials. Suppose the operator instead follows this unsafe shortcut: Grant the application permanent storage account key access for a one-time file read. Which resulting risk or fault should the reviewer identify?
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- An overly broad or long-lived SAS permits more access than the temporary workload needs.
- The security flaw is that the team retained a tested database backup.
Explanation
Correct Answer
C:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real user delegation SAS for Blob Storage weakness after the shortcut. The material failure is: An overly broad or long-lived SAS permits more access than the temporary workload needs.
B:This does not explain the real user delegation SAS for Blob Storage weakness after the shortcut. Inspect evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
D:This does not explain the real user delegation SAS for Blob Storage weakness after the shortcut. In the given case, a service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials.
Question 655
A service issues long-lived SAS URLs signed with a storage account key even though it can use Microsoft Entra credentials. A review identifies this consequence: An overly broad or long-lived SAS permits more access than the temporary workload needs. Which remediation most directly restores the intended behavior?
- Set an unlimited expiry and all permissions to avoid future renewal.
- Assume a public blob URL is equivalent to a delegated SAS.
- Grant the application permanent storage account key access for a one-time file read.
- Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
Explanation
Correct Answer
D:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Set an unlimited expiry and all permissions to avoid future renewal. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
B:Assume a public blob URL is equivalent to a delegated SAS. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
C:Grant the application permanent storage account key access for a one-time file read. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
Question 656
A workflow needs time-limited read access to a single blob without granting a caller the account's shared key. Which operator action best meets this technical requirement?
- For this Azure workload, the team should set an unlimited expiry and all permissions to avoid future renewal.
- For this Azure workload, the team should assume a public blob URL is equivalent to a delegated SAS.
- For this Azure workload, the team should issue a narrow user delegation SAS signed through a properly authorized Microsoft Entra principal.
- For this Azure workload, the team should grant the application permanent storage account key access for a one-time file read.
Explanation
Correct Answer
C:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. This directly addresses user delegation SAS for Blob Storage.
Incorrect Answers
A:Set an unlimited expiry and all permissions to avoid future renewal. The proposed change targets the wrong mechanism or lacks essential validation. User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Relevant evidence is SAS signed resource, start and expiry, permissions, delegated identity and access tests.
B:An overly broad or long-lived SAS permits more access than the temporary workload needs. In the given case, a workflow needs time-limited read access to a single blob without granting a caller the account's shared key.
D:An overly broad or long-lived SAS permits more access than the temporary workload needs. Grant the application permanent storage account key access for a one-time file read.
Question 657
A workflow needs time-limited read access to a single blob without granting a caller the account's shared key. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine SAS signed resource, start and expiry, permissions, delegated identity and access tests.
- In this security review, examine the identity name without a corresponding workload data authorization test.
- In this security review, examine an outdated deployment template without current effective settings.
Explanation
Correct Answer
B:These records test the actual user delegation SAS for Blob Storage behavior rather than an unrelated dashboard state. The intended action is: Issue a narrow user delegation SAS signed through a properly authorized Microsoft Entra principal.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a workflow needs time-limited read access to a single blob without granting a caller the account's shared key.
C:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key.
D:The more relevant observations are: SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Question 658
A workflow needs time-limited read access to a single blob without granting a caller the account's shared key. Which statement most accurately explains this scenario?
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that user delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key.
Explanation
Correct Answer
D:Confirmation depends on SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for user delegation SAS for Blob Storage. The relevant security behavior is: User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Check evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for user delegation SAS for Blob Storage. The relevant security behavior is: User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Check evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
C:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for user delegation SAS for Blob Storage. The relevant security behavior is: User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Check evidence such as SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Question 659
A workflow needs time-limited read access to a single blob without granting a caller the account's shared key. Suppose the operator instead follows this unsafe shortcut: Grant the application permanent storage account key access for a one-time file read. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that an overly broad or long-lived SAS permits more access than the temporary workload needs.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
Explanation
Correct Answer
A:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. The suitable control is: Issue a narrow user delegation SAS signed through a properly authorized Microsoft Entra principal.
Incorrect Answers
B:This does not explain the real user delegation SAS for Blob Storage weakness after the shortcut. In the given case, a workflow needs time-limited read access to a single blob without granting a caller the account's shared key.
C:The material failure is: An overly broad or long-lived SAS permits more access than the temporary workload needs.
D:This does not explain the real user delegation SAS for Blob Storage weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
Question 660
A workflow needs time-limited read access to a single blob without granting a caller the account's shared key. A review identifies this consequence: An overly broad or long-lived SAS permits more access than the temporary workload needs. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to assume a public blob URL is equivalent to a delegated SAS.
- The controlled remediation is to replace the shared-key SAS with a narrow delegation SAS and verify expiry.
- The controlled remediation is to grant the application permanent storage account key access for a one-time file read.
- The controlled remediation is to set an unlimited expiry and all permissions to avoid future renewal.
Explanation
Correct Answer
B:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Test using these records: SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Incorrect Answers
A:Assume a public blob URL is equivalent to a delegated SAS. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
C:Grant the application permanent storage account key access for a one-time file read. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
D:Set an unlimited expiry and all permissions to avoid future renewal. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
