Microsoft AZ-500 Practice Test 80
Question 790
An operator expects an Azure Policy Deny assignment to remove already-deployed noncompliant storage accounts automatically. A review identifies this consequence: Using only Audit does not block new deployments and Deny does not automatically delete existing resources. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
- The controlled remediation is to treat Deny as a universal automatic cleanup of all existing noncompliant resources.
- The controlled remediation is to assume Audit automatically prevents any matching ARM deployment.
- The controlled remediation is to use a management group Reader grant to deny resource creation by all other principals.
Explanation
Correct Answer
A:Test using these records: Policy definition, assignment scope, evaluated effect, denied deployment or recorded compliance state. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Treat Deny as a universal automatic cleanup of all existing noncompliant resources. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
C:Assume Audit automatically prevents any matching ARM deployment. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
D:Use a management group Reader grant to deny resource creation by all other principals. This would not reliably restore the intended security boundary. Using only Audit does not block new deployments and Deny does not automatically delete existing resources. The appropriate controlled recovery is: Deploy the intended preventive effect and address existing noncompliance through separately approved remediation.
Question 791
A regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership. What is the most defensible Azure security action?
- Assume one initiative is a network security group and directly filters packets.
- Group relevant policy definitions in an initiative and assign it at an appropriate management scope.
- Deploy an initiative only to a test resource and claim entire tenant compliance.
- Replace policy definitions with an Azure Monitor workbook chart.
Explanation
Correct Answer
B:Confirm the change against these records: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
Incorrect Answers
A:Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. In the given case, a regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership.
C:Deploy an initiative only to a test resource and claim entire tenant compliance. The proposed change targets the wrong mechanism or lacks essential validation. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Relevant evidence is initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
D:Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The intended action is: Group relevant policy definitions in an initiative and assign it at an appropriate management scope.
Question 792
A regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership. Which diagnostic record would most strongly confirm the result?
- An inventory item list from a different subscription or connected cloud account.
- Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
- A historical Secure Score screenshot without the relevant resource-level finding.
- An incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
B:These records test the actual Azure Policy initiative assignment behavior rather than an unrelated dashboard state. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
C:On its own, that evidence does not prove the specified security control works. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
D:On its own, that evidence does not prove the specified security control works. In the given case, a regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership.
Question 793
A regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership. Which platform concept should guide the engineer’s assessment?
- A high Secure Score certifies that every relevant cloud resource is secure.
- Turning off an alert source is equivalent to remediating the underlying threat.
- An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
- A published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
C:This principle supports the security response: Group relevant policy definitions in an initiative and assign it at an appropriate management scope. Confirmation depends on Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
Incorrect Answers
A:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Azure Policy initiative assignment. The relevant security behavior is: An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Check evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Policy initiative assignment. The relevant security behavior is: An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Check evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure Policy initiative assignment. The relevant security behavior is: An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Check evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
Question 794
A regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership. Suppose the operator instead follows this unsafe shortcut: Assume one initiative is a network security group and directly filters packets. Which root-cause observation follows from that incorrect change?
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
- Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting.
- Preserving a security alert audit trail is what caused the risky configuration.
Explanation
Correct Answer
C:The suitable control is: Group relevant policy definitions in an initiative and assign it at an appropriate management scope. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Azure Policy initiative assignment weakness after the shortcut. The material failure is: Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting.
B:This does not explain the real Azure Policy initiative assignment weakness after the shortcut. Inspect evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
D:This does not explain the real Azure Policy initiative assignment weakness after the shortcut. In the given case, a regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership.
Question 795
A regulated organization must evaluate many configuration controls as one baseline but assigns scattered independent policies without ownership. A review identifies this consequence: Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. Which recovery action addresses the underlying technical fault?
- Create a governed initiative and validate which subscriptions and resources are in scope.
- Deploy an initiative only to a test resource and claim entire tenant compliance.
- Replace policy definitions with an Azure Monitor workbook chart.
- Assume one initiative is a network security group and directly filters packets.
Explanation
Correct Answer
A:Test using these records: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Deploy an initiative only to a test resource and claim entire tenant compliance. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
C:Replace policy definitions with an Azure Monitor workbook chart. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
D:Assume one initiative is a network security group and directly filters packets. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
Question 796
A security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should group relevant policy definitions in an initiative and assign it at an appropriate management scope.
- For this Azure workload, the team should deploy an initiative only to a test resource and claim entire tenant compliance.
- For this Azure workload, the team should replace policy definitions with an Azure Monitor workbook chart.
- For this Azure workload, the team should assume one initiative is a network security group and directly filters packets.
Explanation
Correct Answer
A:Confirm the change against these records: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
Incorrect Answers
B:Deploy an initiative only to a test resource and claim entire tenant compliance. The proposed change targets the wrong mechanism or lacks essential validation. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Relevant evidence is initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
C:Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. In the given case, a security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently.
D:Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. Assume one initiative is a network security group and directly filters packets.
Question 797
A security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
Explanation
Correct Answer
C:These records test the actual Azure Policy initiative assignment behavior rather than an unrelated dashboard state. The intended action is: Group relevant policy definitions in an initiative and assign it at an appropriate management scope.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently.
B:The more relevant observations are: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
D:On its own, that evidence does not prove the specified security control works. A historical Secure Score screenshot without the relevant resource-level finding.
Question 798
A security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that an Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
Explanation
Correct Answer
A:This principle supports the security response: Group relevant policy definitions in an initiative and assign it at an appropriate management scope.
Incorrect Answers
B:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure Policy initiative assignment. The relevant security behavior is: An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Check evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
C:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Azure Policy initiative assignment. The relevant security behavior is: An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Check evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
D:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure Policy initiative assignment. The relevant security behavior is: An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation. Check evidence such as initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup.
Question 799
A security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently. Suppose the operator instead follows this unsafe shortcut: Assume one initiative is a network security group and directly filters packets. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting.
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
Explanation
Correct Answer
A:The suitable control is: Group relevant policy definitions in an initiative and assign it at an appropriate management scope. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
Incorrect Answers
B:This does not explain the real Azure Policy initiative assignment weakness after the shortcut. In the given case, a security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently.
C:This does not explain the real Azure Policy initiative assignment weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
D:This does not explain the real Azure Policy initiative assignment weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
Question 800
A security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently. A review identifies this consequence: Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to replace policy definitions with an Azure Monitor workbook chart.
- The controlled remediation is to create a governed initiative and validate which subscriptions and resources are in scope.
- The controlled remediation is to assume one initiative is a network security group and directly filters packets.
- The controlled remediation is to deploy an initiative only to a test resource and claim entire tenant compliance.
Explanation
Correct Answer
B:Test using these records: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
Incorrect Answers
A:Replace policy definitions with an Azure Monitor workbook chart. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
C:Assume one initiative is a network security group and directly filters packets. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
D:Deploy an initiative only to a test resource and claim entire tenant compliance. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
