Microsoft AZ-500 Practice Test 71
Question 700
A storage client uploads multiple versions of a policy document without preserving a historical object snapshot. A review identifies this consequence: Without version history an overwrite may destroy the immediate prior blob content unless other protection exists. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to enable controlled versioning and test retrieval and restoration of an older blob.
- The controlled remediation is to rely only on a single current blob URL with no version selection.
- The controlled remediation is to assume a change in object metadata always generates a full backup of all containers.
- The controlled remediation is to enable container anonymous access as a replacement for overwrite recovery.
Explanation
Correct Answer
A:Test using these records: Version identifiers, account versioning setting, previous blob content and restoration log. Blob versioning maintains historical versions after supported create or overwrite operations.
Incorrect Answers
B:Rely only on a single current blob URL with no version selection. This would not reliably restore the intended security boundary. Without version history an overwrite may destroy the immediate prior blob content unless other protection exists. The appropriate controlled recovery is: Enable controlled versioning and test retrieval and restoration of an older blob.
C:Assume a change in object metadata always generates a full backup of all containers. This would not reliably restore the intended security boundary. Without version history an overwrite may destroy the immediate prior blob content unless other protection exists. The appropriate controlled recovery is: Enable controlled versioning and test retrieval and restoration of an older blob.
D:Enable container anonymous access as a replacement for overwrite recovery. This would not reliably restore the intended security boundary. Without version history an overwrite may destroy the immediate prior blob content unless other protection exists. The appropriate controlled recovery is: Enable controlled versioning and test retrieval and restoration of an older blob.
Question 701
A compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period. Which operator action best meets this technical requirement?
- Use blob versioning alone as proof every retained version is legally immutable.
- Turn off soft delete and assume audit objects become tamper proof.
- Apply appropriate time-based immutability or legal hold controls for the protected data set.
- Grant all users Storage Blob Data Owner to enforce retention.
Explanation
Correct Answer
C:Confirm the change against these records: Retention policy state, lock status, protected blob operation test and compliance authorization. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
Incorrect Answers
A:Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. In the given case, a compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period.
B:Turn off soft delete and assume audit objects become tamper proof. The proposed change targets the wrong mechanism or lacks essential validation. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Relevant evidence is retention policy state, lock status, protected blob operation test and compliance authorization.
D:Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The intended action is: Apply appropriate time-based immutability or legal hold controls for the protected data set.
Question 702
A compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period. Which collection of observations most directly tests the suspected cause?
- The identity name without a corresponding workload data authorization test.
- Retention policy state, lock status, protected blob operation test and compliance authorization.
- An outdated deployment template without current effective settings.
- A powered-on VM status without the actual guest or data-plane security state.
Explanation
Correct Answer
B:These records test the actual immutable Blob WORM retention behavior rather than an unrelated dashboard state. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Retention policy state, lock status, protected blob operation test and compliance authorization.
C:On its own, that evidence does not prove the specified security control works. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
D:On its own, that evidence does not prove the specified security control works. In the given case, a compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period.
Question 703
A compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period. Which statement most accurately explains this scenario?
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A valid Azure management role always gives full access to every blob object and SQL row.
- Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
Explanation
Correct Answer
C:Confirmation depends on Retention policy state, lock status, protected blob operation test and compliance authorization. This principle supports the security response: Apply appropriate time-based immutability or legal hold controls for the protected data set.
Incorrect Answers
A:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for immutable Blob WORM retention. The relevant security behavior is: Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Check evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
B:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for immutable Blob WORM retention. The relevant security behavior is: Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Check evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
D:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for immutable Blob WORM retention. The relevant security behavior is: Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Check evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
Question 704
A compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period. Suppose the operator instead follows this unsafe shortcut: Use blob versioning alone as proof every retained version is legally immutable. What is the principal technical consequence of the mistaken choice?
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- The security flaw is that the team retained a tested database backup.
Explanation
Correct Answer
B:The suitable control is: Apply appropriate time-based immutability or legal hold controls for the protected data set. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real immutable Blob WORM retention weakness after the shortcut. The material failure is: Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention.
C:This does not explain the real immutable Blob WORM retention weakness after the shortcut. Inspect evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
D:This does not explain the real immutable Blob WORM retention weakness after the shortcut. In the given case, a compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period.
Question 705
A compliance archive requires protected retention that ordinary administrators should not shorten during the mandated period. A review identifies this consequence: Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. Which recovery action restores the intended control and validates its effect?
- Configure the intended immutable policy and verify unauthorized modifications fail.
- Turn off soft delete and assume audit objects become tamper proof.
- Grant all users Storage Blob Data Owner to enforce retention.
- Use blob versioning alone as proof every retained version is legally immutable.
Explanation
Correct Answer
A:Test using these records: Retention policy state, lock status, protected blob operation test and compliance authorization. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Turn off soft delete and assume audit objects become tamper proof. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.
C:Grant all users Storage Blob Data Owner to enforce retention. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.
D:Use blob versioning alone as proof every retained version is legally immutable. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.
Question 706
An attacker with write privileges can remove audit documents because the storage container has no immutability policy. What is the most defensible Azure security action?
- For this Azure workload, the team should turn off soft delete and assume audit objects become tamper proof.
- For this Azure workload, the team should apply appropriate time-based immutability or legal hold controls for the protected data set.
- For this Azure workload, the team should grant all users Storage Blob Data Owner to enforce retention.
- For this Azure workload, the team should use blob versioning alone as proof every retained version is legally immutable.
Explanation
Correct Answer
B:Confirm the change against these records: Retention policy state, lock status, protected blob operation test and compliance authorization.
Incorrect Answers
A:Turn off soft delete and assume audit objects become tamper proof. The proposed change targets the wrong mechanism or lacks essential validation. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Relevant evidence is retention policy state, lock status, protected blob operation test and compliance authorization.
C:Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. In the given case, an attacker with write privileges can remove audit documents because the storage container has no immutability policy.
D:Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. Use blob versioning alone as proof every retained version is legally immutable.
Question 707
An attacker with write privileges can remove audit documents because the storage container has no immutability policy. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine retention policy state, lock status, protected blob operation test and compliance authorization.
- In this security review, examine the identity name without a corresponding workload data authorization test.
- In this security review, examine an outdated deployment template without current effective settings.
Explanation
Correct Answer
B:These records test the actual immutable Blob WORM retention behavior rather than an unrelated dashboard state. The intended action is: Apply appropriate time-based immutability or legal hold controls for the protected data set.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an attacker with write privileges can remove audit documents because the storage container has no immutability policy.
C:The more relevant observations are: Retention policy state, lock status, protected blob operation test and compliance authorization.
D:Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
Question 708
An attacker with write privileges can remove audit documents because the storage container has no immutability policy. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
Explanation
Correct Answer
C:Confirmation depends on Retention policy state, lock status, protected blob operation test and compliance authorization.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for immutable Blob WORM retention. The relevant security behavior is: Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Check evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for immutable Blob WORM retention. The relevant security behavior is: Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Check evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
D:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for immutable Blob WORM retention. The relevant security behavior is: Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention. Check evidence such as retention policy state, lock status, protected blob operation test and compliance authorization.
Question 709
An attacker with write privileges can remove audit documents because the storage container has no immutability policy. Suppose the operator instead follows this unsafe shortcut: Use blob versioning alone as proof every retained version is legally immutable. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
Explanation
Correct Answer
A:The suitable control is: Apply appropriate time-based immutability or legal hold controls for the protected data set. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
Incorrect Answers
B:This does not explain the real immutable Blob WORM retention weakness after the shortcut. In the given case, an attacker with write privileges can remove audit documents because the storage container has no immutability policy.
C:The material failure is: Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention.
D:This does not explain the real immutable Blob WORM retention weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
Question 710
An attacker with write privileges can remove audit documents because the storage container has no immutability policy. A review identifies this consequence: Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to grant all users Storage Blob Data Owner to enforce retention.
- The controlled remediation is to use blob versioning alone as proof every retained version is legally immutable.
- The controlled remediation is to configure the intended immutable policy and verify unauthorized modifications fail.
- The controlled remediation is to turn off soft delete and assume audit objects become tamper proof.
Explanation
Correct Answer
C:Test using these records: Retention policy state, lock status, protected blob operation test and compliance authorization. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.
Incorrect Answers
A:Grant all users Storage Blob Data Owner to enforce retention. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.
B:Use blob versioning alone as proof every retained version is legally immutable. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.
D:Turn off soft delete and assume audit objects become tamper proof. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.
