Microsoft AZ-500 Practice Test 85
Question 840
An architect expects an Azure Policy Deny to grant an engineer permission to deploy a VM despite missing Azure RBAC rights. A review identifies this consequence: Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to correct both role scopes and governance assignments and verify compliant deployment behavior.
- The controlled remediation is to use a network firewall rule to grant ARM deployment permissions.
- The controlled remediation is to assume a Policy Allow alone gives a user subscription Contributor access.
- The controlled remediation is to give a user Owner to override all applicable Azure Policy Deny restrictions.
Explanation
Correct Answer
A:Azure RBAC governs who may act while Azure Policy can constrain which resource configurations are allowed. Test using these records: Effective Azure role, policy assignment, deployment denial reason and required resource properties.
Incorrect Answers
B:Use a network firewall rule to grant ARM deployment permissions. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
C:Assume a Policy Allow alone gives a user subscription Contributor access. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
D:Give a user Owner to override all applicable Azure Policy Deny restrictions. This would not reliably restore the intended security boundary. Confusing the two controls can leave an authorized user able to create noncompliant resources or an unauthorized user still denied. The appropriate controlled recovery is: Correct both role scopes and governance assignments and verify compliant deployment behavior.
Question 841
A vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read. What is the BEST supported implementation or corrective action?
- Configure effective vault data-plane roles under the selected permission model and validate the migration.
- Assume Azure subscription Reader automatically reads all Key Vault secrets.
- Add access policies after switching fully to vault RBAC and assume they remain effective.
- Turn off vault network controls to repair missing data-plane authorization.
Explanation
Correct Answer
A:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. This directly addresses Key Vault Azure RBAC versus access policy.
Incorrect Answers
B:Granting permission in an inactive authorization model does not authorize secret access. In the given case, a vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read.
C:That option would add access policies after switching fully to vault RBAC and assume they remain effective, but it addresses a different concern. Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode.
D:Granting permission in an inactive authorization model does not authorize secret access. The intended action is: Configure effective vault data-plane roles under the selected permission model and validate the migration.
Question 842
A vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read. Which evidence BEST verifies the intended technical behavior?
- An inventory item list from a different subscription or connected cloud account.
- Vault permission model, data role assignments, access policy list and secret get result.
- A historical Secure Score screenshot without the relevant resource-level finding.
- An incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
B:These records test the actual Key Vault Azure RBAC versus access policy behavior rather than an unrelated dashboard state. Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Vault permission model, data role assignments, access policy list and secret get result.
D:On its own, that evidence does not prove the specified security control works. In the given case, a vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read.
Question 843
A vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read. Which principle BEST explains why the recommended solution is appropriate?
- Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode.
- A high Secure Score certifies that every relevant cloud resource is secure.
- Turning off an alert source is equivalent to remediating the underlying threat.
- A published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
A:Confirmation depends on Vault permission model, data role assignments, access policy list and secret get result. This principle supports the security response: Configure effective vault data-plane roles under the selected permission model and validate the migration.
Incorrect Answers
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Key Vault Azure RBAC versus access policy. The relevant security behavior is: Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Check evidence such as vault permission model, data role assignments, access policy list and secret get result.
C:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Key Vault Azure RBAC versus access policy. The relevant security behavior is: Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Check evidence such as vault permission model, data role assignments, access policy list and secret get result.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Key Vault Azure RBAC versus access policy. The relevant security behavior is: Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Check evidence such as vault permission model, data role assignments, access policy list and secret get result.
Question 844
A vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read. Suppose the operator instead follows this unsafe shortcut: Assume Azure subscription Reader automatically reads all Key Vault secrets. What is the MOST significant failure introduced by that shortcut?
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
- Granting permission in an inactive authorization model does not authorize secret access.
- Preserving a security alert audit trail is what caused the risky configuration.
Explanation
Correct Answer
C:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Key Vault Azure RBAC versus access policy weakness after the shortcut. The material failure is: Granting permission in an inactive authorization model does not authorize secret access.
B:This does not explain the real Key Vault Azure RBAC versus access policy weakness after the shortcut. Inspect evidence such as vault permission model, data role assignments, access policy list and secret get result.
D:This does not explain the real Key Vault Azure RBAC versus access policy weakness after the shortcut. In the given case, a vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read.
Question 845
A vault is configured for Azure RBAC but an operator adds a traditional access policy that never grants the expected secret read. A review identifies this consequence: Granting permission in an inactive authorization model does not authorize secret access. What is the BEST controlled recovery once this failure is recognized?
- Apply the appropriate role assignments and test key, secret and certificate operations.
- Add access policies after switching fully to vault RBAC and assume they remain effective.
- Turn off vault network controls to repair missing data-plane authorization.
- Assume Azure subscription Reader automatically reads all Key Vault secrets.
Explanation
Correct Answer
A:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:That option would add access policies after switching fully to vault RBAC and assume they remain effective, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
C:Turn off vault network controls to repair missing data-plane authorization. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
D:Assume Azure subscription Reader automatically reads all Key Vault secrets. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
Question 846
A team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should add access policies after switching fully to vault RBAC and assume they remain effective.
- For this Azure workload, the team should configure effective vault data-plane roles under the selected permission model and validate the migration.
- For this Azure workload, the team should turn off vault network controls to repair missing data-plane authorization.
- For this Azure workload, the team should assume Azure subscription Reader automatically reads all Key Vault secrets.
Explanation
Correct Answer
B:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Confirm the change against these records: Vault permission model, data role assignments, access policy list and secret get result.
Incorrect Answers
A:Add access policies after switching fully to vault RBAC and assume they remain effective. The proposed change targets the wrong mechanism or lacks essential validation. Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Relevant evidence is vault permission model, data role assignments, access policy list and secret get result.
C:Granting permission in an inactive authorization model does not authorize secret access. In the given case, a team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective.
D:Granting permission in an inactive authorization model does not authorize secret access. Assume Azure subscription Reader automatically reads all Key Vault secrets.
Question 847
A team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective. What evidence most directly confirms the intended security behavior?
- In this security review, examine vault permission model, data role assignments, access policy list and secret get result.
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
Explanation
Correct Answer
A:These records test the actual Key Vault Azure RBAC versus access policy behavior rather than an unrelated dashboard state. The intended action is: Configure effective vault data-plane roles under the selected permission model and validate the migration.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective.
C:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode.
D:The more relevant observations are: Vault permission model, data role assignments, access policy list and secret get result.
Question 848
A team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective. Which security principle best explains the intended decision?
- The applicable security principle is that Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
Explanation
Correct Answer
A:Confirmation depends on Vault permission model, data role assignments, access policy list and secret get result.
Incorrect Answers
B:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Key Vault Azure RBAC versus access policy. The relevant security behavior is: Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Check evidence such as vault permission model, data role assignments, access policy list and secret get result.
C:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Key Vault Azure RBAC versus access policy. The relevant security behavior is: Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Check evidence such as vault permission model, data role assignments, access policy list and secret get result.
D:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Key Vault Azure RBAC versus access policy. The relevant security behavior is: Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Check evidence such as vault permission model, data role assignments, access policy list and secret get result.
Question 849
A team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective. Suppose the operator instead follows this unsafe shortcut: Assume Azure subscription Reader automatically reads all Key Vault secrets. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that granting permission in an inactive authorization model does not authorize secret access.
Explanation
Correct Answer
D:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. The suitable control is: Configure effective vault data-plane roles under the selected permission model and validate the migration.
Incorrect Answers
A:This does not explain the real Key Vault Azure RBAC versus access policy weakness after the shortcut. In the given case, a team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective.
B:This does not explain the real Key Vault Azure RBAC versus access policy weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
C:This does not explain the real Key Vault Azure RBAC versus access policy weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
Question 850
A team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective. A review identifies this consequence: Granting permission in an inactive authorization model does not authorize secret access. Which remediation most directly restores the intended behavior?
- The controlled remediation is to apply the appropriate role assignments and test key, secret and certificate operations.
- The controlled remediation is to turn off vault network controls to repair missing data-plane authorization.
- The controlled remediation is to assume Azure subscription Reader automatically reads all Key Vault secrets.
- The controlled remediation is to add access policies after switching fully to vault RBAC and assume they remain effective.
Explanation
Correct Answer
A:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Test using these records: Vault permission model, data role assignments, access policy list and secret get result.
Incorrect Answers
B:Turn off vault network controls to repair missing data-plane authorization. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
C:Assume Azure subscription Reader automatically reads all Key Vault secrets. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
D:Add access policies after switching fully to vault RBAC and assume they remain effective. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
