Microsoft AZ-500 Practice Test 67
Question 660
A workflow needs time-limited read access to a single blob without granting a caller the account's shared key. A review identifies this consequence: An overly broad or long-lived SAS permits more access than the temporary workload needs. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to assume a public blob URL is equivalent to a delegated SAS.
- The controlled remediation is to replace the shared-key SAS with a narrow delegation SAS and verify expiry.
- The controlled remediation is to grant the application permanent storage account key access for a one-time file read.
- The controlled remediation is to set an unlimited expiry and all permissions to avoid future renewal.
Explanation
Correct Answer
B:User delegation SAS uses Microsoft Entra authorization for Blob service delegation rather than exposing an account key. Test using these records: SAS signed resource, start and expiry, permissions, delegated identity and access tests.
Incorrect Answers
A:Assume a public blob URL is equivalent to a delegated SAS. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
C:Grant the application permanent storage account key access for a one-time file read. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
D:Set an unlimited expiry and all permissions to avoid future renewal. This would not reliably restore the intended security boundary. An overly broad or long-lived SAS permits more access than the temporary workload needs. The appropriate controlled recovery is: Replace the shared-key SAS with a narrow delegation SAS and verify expiry.
Question 661
Windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection. Which operator action best meets this technical requirement?
- Grant the storage account key to every desktop user to avoid directory integration.
- Assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL.
- Disable all share permissions when users report access denied.
- Configure supported identity-based Azure Files SMB authentication and share and filesystem permissions.
Explanation
Correct Answer
D:Confirm the change against these records: Azure Files authentication method, share-level role, NTFS ACLs and SMB access result. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
Incorrect Answers
A:A valid SMB network session does not automatically grant the user's intended directory rights. In the given case, windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection.
B:Assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL. The proposed change targets the wrong mechanism or lacks essential validation. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Relevant evidence is Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
C:A valid SMB network session does not automatically grant the user's intended directory rights. The intended action is: Configure supported identity-based Azure Files SMB authentication and share and filesystem permissions.
Question 662
Windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection. Which collection of observations most directly tests the suspected cause?
- A storage account resource name without its encryption or retention configuration.
- Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
- A database online indicator without a log of the protected operation.
- An outdated deployment template without current effective settings.
Explanation
Correct Answer
B:These records test the actual Azure Files identity-based SMB access behavior rather than an unrelated dashboard state. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
D:On its own, that evidence does not prove the specified security control works. In the given case, windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection.
Question 663
Windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection. Which statement most accurately explains this scenario?
- Setting a registry image tag guarantees security monitoring of the running workload.
- Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A protected storage account is immune to every accidental deletion and overwrite.
Explanation
Correct Answer
B:Confirmation depends on Azure Files authentication method, share-level role, NTFS ACLs and SMB access result. This principle supports the security response: Configure supported identity-based Azure Files SMB authentication and share and filesystem permissions.
Incorrect Answers
A:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Azure Files identity-based SMB access. The relevant security behavior is: Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Check evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
C:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for Azure Files identity-based SMB access. The relevant security behavior is: Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Check evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
D:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Azure Files identity-based SMB access. The relevant security behavior is: Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Check evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
Question 664
Windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection. Suppose the operator instead follows this unsafe shortcut: Grant the storage account key to every desktop user to avoid directory integration. What is the principal technical consequence of the mistaken choice?
- The security flaw is that the team retained a tested database backup.
- Inspecting encryption settings itself disables a healthy disk.
- A valid SMB network session does not automatically grant the user's intended directory rights.
- The observed issue is fully explained by the service display name.
Explanation
Correct Answer
C:The suitable control is: Configure supported identity-based Azure Files SMB authentication and share and filesystem permissions. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
Incorrect Answers
A:This does not explain the real Azure Files identity-based SMB access weakness after the shortcut. The material failure is: A valid SMB network session does not automatically grant the user's intended directory rights.
B:This does not explain the real Azure Files identity-based SMB access weakness after the shortcut. Inspect evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
D:This does not explain the real Azure Files identity-based SMB access weakness after the shortcut. In the given case, windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection.
Question 665
Windows users can reach an Azure Files share by SMB but receive access denied despite successful network connection. A review identifies this consequence: A valid SMB network session does not automatically grant the user's intended directory rights. Which recovery action restores the intended control and validates its effect?
- Assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL.
- Disable all share permissions when users report access denied.
- Grant the storage account key to every desktop user to avoid directory integration.
- Correct identity integration and least-privilege file/share grants then validate file access.
Explanation
Correct Answer
D:Test using these records: Azure Files authentication method, share-level role, NTFS ACLs and SMB access result. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL. This would not reliably restore the intended security boundary. A valid SMB network session does not automatically grant the user's intended directory rights. The appropriate controlled recovery is: Correct identity integration and least-privilege file/share grants then validate file access.
B:Disable all share permissions when users report access denied. This would not reliably restore the intended security boundary. A valid SMB network session does not automatically grant the user's intended directory rights. The appropriate controlled recovery is: Correct identity integration and least-privilege file/share grants then validate file access.
C:Grant the storage account key to every desktop user to avoid directory integration. This would not reliably restore the intended security boundary. A valid SMB network session does not automatically grant the user's intended directory rights. The appropriate controlled recovery is: Correct identity integration and least-privilege file/share grants then validate file access.
Question 666
A domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured. What is the most defensible Azure security action?
- For this Azure workload, the team should configure supported identity-based Azure Files SMB authentication and share and filesystem permissions.
- For this Azure workload, the team should assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL.
- For this Azure workload, the team should disable all share permissions when users report access denied.
- For this Azure workload, the team should grant the storage account key to every desktop user to avoid directory integration.
Explanation
Correct Answer
A:Confirm the change against these records: Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
Incorrect Answers
B:Assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL. The proposed change targets the wrong mechanism or lacks essential validation. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Relevant evidence is Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
C:A valid SMB network session does not automatically grant the user's intended directory rights. In the given case, a domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured.
D:A valid SMB network session does not automatically grant the user's intended directory rights. Grant the storage account key to every desktop user to avoid directory integration.
Question 667
A domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured. Which diagnostic record would most strongly confirm the result?
- In this security review, examine Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine a database online indicator without a log of the protected operation.
Explanation
Correct Answer
A:These records test the actual Azure Files identity-based SMB access behavior rather than an unrelated dashboard state. The intended action is: Configure supported identity-based Azure Files SMB authentication and share and filesystem permissions.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured.
C:Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
D:The more relevant observations are: Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
Question 668
A domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
Explanation
Correct Answer
B:Confirmation depends on Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
Incorrect Answers
A:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Azure Files identity-based SMB access. The relevant security behavior is: Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Check evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
C:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Azure Files identity-based SMB access. The relevant security behavior is: Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Check evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
D:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for Azure Files identity-based SMB access. The relevant security behavior is: Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs. Check evidence such as Azure Files authentication method, share-level role, NTFS ACLs and SMB access result.
Question 669
A domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured. Suppose the operator instead follows this unsafe shortcut: Grant the storage account key to every desktop user to avoid directory integration. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that a valid SMB network session does not automatically grant the user's intended directory rights.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
A:The suitable control is: Configure supported identity-based Azure Files SMB authentication and share and filesystem permissions. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Azure Files identity-based SMB access weakness after the shortcut. In the given case, a domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured.
C:This does not explain the real Azure Files identity-based SMB access weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
D:The material failure is: A valid SMB network session does not automatically grant the user's intended directory rights.
Question 670
A domain-joined client is expected to use identity-based authorization but the file share has only key-based access configured. A review identifies this consequence: A valid SMB network session does not automatically grant the user's intended directory rights. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to disable all share permissions when users report access denied.
- The controlled remediation is to grant the storage account key to every desktop user to avoid directory integration.
- The controlled remediation is to assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL.
- The controlled remediation is to correct identity integration and least-privilege file/share grants then validate file access.
Explanation
Correct Answer
D:Test using these records: Azure Files authentication method, share-level role, NTFS ACLs and SMB access result. Azure Files SMB access can require both an allowed share-level entitlement and filesystem ACLs.
Incorrect Answers
A:Disable all share permissions when users report access denied. This would not reliably restore the intended security boundary. A valid SMB network session does not automatically grant the user's intended directory rights. The appropriate controlled recovery is: Correct identity integration and least-privilege file/share grants then validate file access.
B:Grant the storage account key to every desktop user to avoid directory integration. This would not reliably restore the intended security boundary. A valid SMB network session does not automatically grant the user's intended directory rights. The appropriate controlled recovery is: Correct identity integration and least-privilege file/share grants then validate file access.
C:Assume Blob data RBAC roles automatically map to every Azure Files NTFS ACL. This would not reliably restore the intended security boundary. A valid SMB network session does not automatically grant the user's intended directory rights. The appropriate controlled recovery is: Correct identity integration and least-privilege file/share grants then validate file access.
