Microsoft AZ-500 Practice Test 81
Question 800
A security team needs one reusable standards bundle across subscriptions but changes individual policy assignments inconsistently. A review identifies this consequence: Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to replace policy definitions with an Azure Monitor workbook chart.
- The controlled remediation is to create a governed initiative and validate which subscriptions and resources are in scope.
- The controlled remediation is to assume one initiative is a network security group and directly filters packets.
- The controlled remediation is to deploy an initiative only to a test resource and claim entire tenant compliance.
Explanation
Correct Answer
B:Test using these records: Initiative definition, referenced policy IDs, assignment parameters, scope and compliance rollup. An Azure Policy initiative groups multiple definitions for consistent assignment and evaluation.
Incorrect Answers
A:Replace policy definitions with an Azure Monitor workbook chart. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
C:Assume one initiative is a network security group and directly filters packets. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
D:Deploy an initiative only to a test resource and claim entire tenant compliance. This would not reliably restore the intended security boundary. Ungoverned individual assignments can create coverage gaps and inconsistent compliance reporting. The appropriate controlled recovery is: Create a governed initiative and validate which subscriptions and resources are in scope.
Question 801
A legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception. What is the BEST supported implementation or corrective action?
- Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification.
- Disable the initiative for every subscription to exempt one legacy workload.
- Mark the resource compliant manually without recording an exemption.
- Give application Owner roles as a replacement for security policy exemptions.
Explanation
Correct Answer
A:Confirm the change against these records: Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation. Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
Incorrect Answers
B:Removing a broad assignment to excuse one resource can expose unrelated assets. In the given case, a legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception.
C:Mark the resource compliant manually without recording an exemption. The proposed change targets the wrong mechanism or lacks essential validation. Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Relevant evidence is exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
D:Removing a broad assignment to excuse one resource can expose unrelated assets. The intended action is: Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification.
Question 802
A legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception. Which evidence BEST verifies the intended technical behavior?
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
- A connected agent indicator without a matching data collection rule or event record.
- A historical Secure Score screenshot without the relevant resource-level finding.
- Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
Explanation
Correct Answer
D:These records test the actual Azure Policy exemption governance behavior rather than an unrelated dashboard state. Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
C:On its own, that evidence does not prove the specified security control works. In the given case, a legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception.
Question 803
A legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception. Which principle BEST explains why the recommended solution is appropriate?
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
- A high Secure Score certifies that every relevant cloud resource is secure.
- Assigning a policy automatically remediates all existing resources under every effect.
Explanation
Correct Answer
B:This principle supports the security response: Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification. Confirmation depends on Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
Incorrect Answers
A:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure Policy exemption governance. The relevant security behavior is: Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Check evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
C:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Azure Policy exemption governance. The relevant security behavior is: Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Check evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
D:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure Policy exemption governance. The relevant security behavior is: Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Check evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
Question 804
A legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception. Suppose the operator instead follows this unsafe shortcut: Disable the initiative for every subscription to exempt one legacy workload. What is the MOST significant failure introduced by that shortcut?
- Preserving a security alert audit trail is what caused the risky configuration.
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- Removing a broad assignment to excuse one resource can expose unrelated assets.
Explanation
Correct Answer
D:The suitable control is: Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification. Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
Incorrect Answers
A:This does not explain the real Azure Policy exemption governance weakness after the shortcut. The material failure is: Removing a broad assignment to excuse one resource can expose unrelated assets.
B:This does not explain the real Azure Policy exemption governance weakness after the shortcut. Inspect evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
C:This does not explain the real Azure Policy exemption governance weakness after the shortcut. In the given case, a legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception.
Question 805
A legacy application cannot immediately meet a security policy and a team removes the entire assignment instead of documenting an exception. A review identifies this consequence: Removing a broad assignment to excuse one resource can expose unrelated assets. What is the BEST controlled recovery once this failure is recognized?
- Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
- Mark the resource compliant manually without recording an exemption.
- Give application Owner roles as a replacement for security policy exemptions.
- Disable the initiative for every subscription to exempt one legacy workload.
Explanation
Correct Answer
A:Test using these records: Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Mark the resource compliant manually without recording an exemption. This would not reliably restore the intended security boundary. Removing a broad assignment to excuse one resource can expose unrelated assets. The appropriate controlled recovery is: Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
C:Give application Owner roles as a replacement for security policy exemptions. This would not reliably restore the intended security boundary. Removing a broad assignment to excuse one resource can expose unrelated assets. The appropriate controlled recovery is: Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
D:Disable the initiative for every subscription to exempt one legacy workload. This would not reliably restore the intended security boundary. Removing a broad assignment to excuse one resource can expose unrelated assets. The appropriate controlled recovery is: Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
Question 806
An authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should mark the resource compliant manually without recording an exemption.
- For this Azure workload, the team should give application Owner roles as a replacement for security policy exemptions.
- For this Azure workload, the team should create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification.
- For this Azure workload, the team should disable the initiative for every subscription to exempt one legacy workload.
Explanation
Correct Answer
C:Confirm the change against these records: Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
Incorrect Answers
A:Mark the resource compliant manually without recording an exemption. The proposed change targets the wrong mechanism or lacks essential validation. Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Relevant evidence is exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
B:Removing a broad assignment to excuse one resource can expose unrelated assets. In the given case, an authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured.
D:Removing a broad assignment to excuse one resource can expose unrelated assets. Disable the initiative for every subscription to exempt one legacy workload.
Question 807
An authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured. What evidence most directly confirms the intended security behavior?
- In this security review, examine an incident title without its actual source telemetry and detection results.
- In this security review, examine exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
Explanation
Correct Answer
B:These records test the actual Azure Policy exemption governance behavior rather than an unrelated dashboard state. The intended action is: Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured.
C:Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
D:The more relevant observations are: Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
Question 808
An authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured. Which security principle best explains the intended decision?
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that policy exemptions support controlled exceptions without eliminating protections for the whole environment.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
Explanation
Correct Answer
C:This principle supports the security response: Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification.
Incorrect Answers
A:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure Policy exemption governance. The relevant security behavior is: Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Check evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
B:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure Policy exemption governance. The relevant security behavior is: Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Check evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
D:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Policy exemption governance. The relevant security behavior is: Policy exemptions support controlled exceptions without eliminating protections for the whole environment. Check evidence such as exemption category, owner, resource scope, expiry, approval trail and compliance evaluation.
Question 809
An authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured. Suppose the operator instead follows this unsafe shortcut: Disable the initiative for every subscription to exempt one legacy workload. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that removing a broad assignment to excuse one resource can expose unrelated assets.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
Explanation
Correct Answer
A:The suitable control is: Create a documented and narrowly scoped Azure Policy exemption with accountable expiry and justification. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Azure Policy exemption governance weakness after the shortcut. In the given case, an authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured.
C:This does not explain the real Azure Policy exemption governance weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
D:This does not explain the real Azure Policy exemption governance weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
Question 810
An authorized temporary waiver expires but the noncompliant resource remains exempt because no expiration was configured. A review identifies this consequence: Removing a broad assignment to excuse one resource can expose unrelated assets. Which remediation most directly restores the intended behavior?
- The controlled remediation is to restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
- The controlled remediation is to give application Owner roles as a replacement for security policy exemptions.
- The controlled remediation is to disable the initiative for every subscription to exempt one legacy workload.
- The controlled remediation is to mark the resource compliant manually without recording an exemption.
Explanation
Correct Answer
A:Test using these records: Exemption category, owner, resource scope, expiry, approval trail and compliance evaluation. Policy exemptions support controlled exceptions without eliminating protections for the whole environment.
Incorrect Answers
B:Give application Owner roles as a replacement for security policy exemptions. This would not reliably restore the intended security boundary. Removing a broad assignment to excuse one resource can expose unrelated assets. The appropriate controlled recovery is: Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
C:Disable the initiative for every subscription to exempt one legacy workload. This would not reliably restore the intended security boundary. Removing a broad assignment to excuse one resource can expose unrelated assets. The appropriate controlled recovery is: Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
D:Mark the resource compliant manually without recording an exemption. This would not reliably restore the intended security boundary. Removing a broad assignment to excuse one resource can expose unrelated assets. The appropriate controlled recovery is: Restore broad policy coverage and use a reviewed time-limited exemption for the affected resource.
