Microsoft AZ-500 Practice Test 84
Question 830
A DeployIfNotExists assignment is configured correctly for new resources but historic resources are still reported noncompliant. A review identifies this consequence: Assigning a policy does not guarantee previously deployed resources have already been modified. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to change only the policy display name to trigger a working remediation deployment.
- The controlled remediation is to trigger and monitor remediation and verify expected secure settings on sampled resources.
- The controlled remediation is to delete every noncompliant VM instead of choosing supported remediation.
- The controlled remediation is to mark all policy reports Pass while leaving affected settings unchanged.
Explanation
Correct Answer
B:Test using these records: Policy compliance results, remediation task status, deployment operations and updated resource properties. DeployIfNotExists and Modify effects can need explicit remediation for existing resources.
Incorrect Answers
A:Change only the policy display name to trigger a working remediation deployment. This would not reliably restore the intended security boundary. Assigning a policy does not guarantee previously deployed resources have already been modified. The appropriate controlled recovery is: Trigger and monitor remediation and verify expected secure settings on sampled resources.
C:Delete every noncompliant VM instead of choosing supported remediation. This would not reliably restore the intended security boundary. Assigning a policy does not guarantee previously deployed resources have already been modified. The appropriate controlled recovery is: Trigger and monitor remediation and verify expected secure settings on sampled resources.
D:Mark all policy reports Pass while leaving affected settings unchanged. This would not reliably restore the intended security boundary. Assigning a policy does not guarantee previously deployed resources have already been modified. The appropriate controlled recovery is: Trigger and monitor remediation and verify expected secure settings on sampled resources.
Question 831
An Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration. What is the most defensible Azure security action?
- Assume a Policy Allow alone gives a user subscription Contributor access.
- Give a user Owner to override all applicable Azure Policy Deny restrictions.
- Use a network firewall rule to grant ARM deployment permissions.
- Use Azure RBAC to authorize principals and Azure Policy to enforce resource configuration constraints.
Explanation
Correct Answer
D:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. This directly addresses Azure RBAC versus Azure Policy guardrails.
Incorrect Answers
A:Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied.
B:Give a user Owner to override all applicable Azure Policy Deny restrictions. The proposed change targets the wrong mechanism or lacks essential validation. Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Relevant evidence is effective Azure role, policy assignment, deployment denial reason and required resource properties.
C:Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The intended action is: Use Azure RBAC to authorize principals and Azure Policy to enforce resource configuration constraints.
Question 832
An Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration. Which diagnostic record would most strongly confirm the result?
- A connected agent indicator without a matching data collection rule or event record.
- An incident title without its actual source telemetry and detection results.
- Effective Azure role, policy assignment, deployment denial reason and required resource properties.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
Explanation
Correct Answer
C:These records test the actual Azure RBAC versus Azure Policy guardrails behavior rather than an unrelated dashboard state. Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Effective Azure role, policy assignment, deployment denial reason and required resource properties.
D:On its own, that evidence does not prove the specified security control works. In the given case, an Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration.
Question 833
An Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration. Which platform concept should guide the engineer’s assessment?
- Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed.
- Turning off an alert source is equivalent to remediating the underlying threat.
- Assigning a policy automatically remediates all existing resources under every effect.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
Explanation
Correct Answer
A:Confirmation depends on Effective Azure role, policy assignment, deployment denial reason and required resource properties. This principle supports the security response: Use Azure RBAC to authorize principals and Azure Policy to enforce resource configuration constraints.
Incorrect Answers
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure RBAC versus Azure Policy guardrails. The relevant security behavior is: Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Check evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure RBAC versus Azure Policy guardrails. The relevant security behavior is: Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Check evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
D:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure RBAC versus Azure Policy guardrails. The relevant security behavior is: Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Check evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
Question 834
An Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration. Suppose the operator instead follows this unsafe shortcut: Assume a Policy Allow alone gives a user subscription Contributor access. Which root-cause observation follows from that incorrect change?
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied.
- A successful remediation test was the original reason the plan was disabled.
Explanation
Correct Answer
C:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Azure RBAC versus Azure Policy guardrails weakness after the shortcut. The material failure is: Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied.
B:This does not explain the real Azure RBAC versus Azure Policy guardrails weakness after the shortcut. Inspect evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
D:This does not explain the real Azure RBAC versus Azure Policy guardrails weakness after the shortcut. In the given case, an Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration.
Question 835
An Azure Contributor deploys a storage account that violates governance because role authorization allows the action and no policy blocks configuration. A review identifies this consequence: Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. Which recovery action addresses the underlying technical fault?
- Correct both role scopes and governance assignments and verify compliant deployment behavior.
- Give a user Owner to override all applicable Azure Policy Deny restrictions.
- Use a network firewall rule to grant ARM deployment permissions.
- Assume a Policy Allow alone gives a user subscription Contributor access.
Explanation
Correct Answer
A:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Give a user Owner to override all applicable Azure Policy Deny restrictions. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
C:That option would use a network firewall rule to grant ARM deployment permissions, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
D:That option would assume a Policy Allow alone gives a user subscription Contributor access, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 836
An architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should give a user Owner to override all applicable Azure Policy Deny restrictions.
- For this Azure workload, the team should use Azure RBAC to authorize principals and Azure Policy to enforce resource configuration constraints.
- For this Azure workload, the team should use a network firewall rule to grant ARM deployment permissions.
- For this Azure workload, the team should assume a Policy Allow alone gives a user subscription Contributor access.
Explanation
Correct Answer
B:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Confirm the change against these records: Effective Azure role, policy assignment, deployment denial reason and required resource properties.
Incorrect Answers
A:Give a user Owner to override all applicable Azure Policy Deny restrictions. The proposed change targets the wrong mechanism or lacks essential validation. Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Relevant evidence is effective Azure role, policy assignment, deployment denial reason and required resource properties.
C:Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. Use a network firewall rule to grant ARM deployment permissions.
D:Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. Assume a Policy Allow alone gives a user subscription Contributor access.
Question 837
An architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine effective Azure role, policy assignment, deployment denial reason and required resource properties.
- In this security review, examine an incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
C:These records test the actual Azure RBAC versus Azure Policy guardrails behavior rather than an unrelated dashboard state. The intended action is: Use Azure RBAC to authorize principals and Azure Policy to enforce resource configuration constraints.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights.
B:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed.
D:The more relevant observations are: Effective Azure role, policy assignment, deployment denial reason and required resource properties.
Question 838
An architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
B:Confirmation depends on Effective Azure role, policy assignment, deployment denial reason and required resource properties. Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed.
Incorrect Answers
A:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Azure RBAC versus Azure Policy guardrails. The relevant security behavior is: Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Check evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
C:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure RBAC versus Azure Policy guardrails. The relevant security behavior is: Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Check evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure RBAC versus Azure Policy guardrails. The relevant security behavior is: Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Check evidence such as effective Azure role, policy assignment, deployment denial reason and required resource properties.
Question 839
An architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights. Suppose the operator instead follows this unsafe shortcut: Assume a Policy Allow alone gives a user subscription Contributor access. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied.
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
Explanation
Correct Answer
A:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. The suitable control is: Use Azure RBAC to authorize principals and Azure Policy to enforce resource configuration constraints.
Incorrect Answers
B:This does not explain the real Azure RBAC versus Azure Policy guardrails weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
C:This does not explain the real Azure RBAC versus Azure Policy guardrails weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
D:This does not explain the real Azure RBAC versus Azure Policy guardrails weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
Question 840
An architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights. A review identifies this consequence: Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to correct both role scopes and governance assignments and verify compliant deployment behavior.
- The controlled remediation is to use a network firewall rule to grant ARM deployment permissions.
- The controlled remediation is to assume a Policy Allow alone gives a user subscription Contributor access.
- The controlled remediation is to give a user Owner to override all applicable Azure Policy Deny restrictions.
Explanation
Correct Answer
A:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Test using these records: Effective Azure role, policy assignment, deployment denial reason and required resource properties.
Incorrect Answers
B:Use a network firewall rule to grant ARM deployment permissions. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
C:Assume a Policy Allow alone gives a user subscription Contributor access. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
D:Give a user Owner to override all applicable Azure Policy Deny restrictions. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
