Microsoft AZ-500 Practice Test 86
Question 850
A team migrates Key Vault permission mode and applications fail because their prior vault access policies are no longer effective. A review identifies this consequence: Granting permission in an inactive authorization model does not authorize secret access. Which remediation most directly restores the intended behavior?
- The controlled remediation is to apply the appropriate role assignments and test key, secret and certificate operations.
- The controlled remediation is to turn off vault network controls to repair missing data-plane authorization.
- The controlled remediation is to assume Azure subscription Reader automatically reads all Key Vault secrets.
- The controlled remediation is to add access policies after switching fully to vault RBAC and assume they remain effective.
Explanation
Correct Answer
A:Key Vault supports distinct RBAC and vault access-policy authorization models whose effects depend on the selected mode. Test using these records: Vault permission model, data role assignments, access policy list and secret get result.
Incorrect Answers
B:Turn off vault network controls to repair missing data-plane authorization. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
C:Assume Azure subscription Reader automatically reads all Key Vault secrets. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
D:Add access policies after switching fully to vault RBAC and assume they remain effective. This would not reliably restore the intended security boundary. Granting permission in an inactive authorization model does not authorize secret access. The appropriate controlled recovery is: Apply the appropriate role assignments and test key, secret and certificate operations.
Question 851
A valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy. Which configuration decision MOST directly resolves the issue?
- Grant Global Administrator to bypass vault firewall routing.
- Assume creating a private DNS record alone approves the vault private endpoint.
- Configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate.
- Open public access to all networks because one private client is misconfigured.
Explanation
Correct Answer
C:Confirm the change against these records: Vault firewall and private endpoint state, private DNS, calling subnet and secret request log. This directly addresses Key Vault firewall and Private Endpoint.
Incorrect Answers
A:Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions.
B:Assume creating a private DNS record alone approves the vault private endpoint. The proposed change targets the wrong mechanism or lacks essential validation. Key Vault network access restrictions are separate from key and secret authorization. Relevant evidence is vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
D:Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. The intended action is: Configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate.
Question 852
A valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy. What evidence most directly confirms the intended security behavior?
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
- A connected agent indicator without a matching data collection rule or event record.
- Vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
- A historical Secure Score screenshot without the relevant resource-level finding.
Explanation
Correct Answer
C:These records test the actual Key Vault firewall and Private Endpoint behavior rather than an unrelated dashboard state. Key Vault network access restrictions are separate from key and secret authorization.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
B:On its own, that evidence does not prove the specified security control works. Key Vault network access restrictions are separate from key and secret authorization.
D:On its own, that evidence does not prove the specified security control works. In the given case, a valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy.
Question 853
A valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy. Which security principle best explains the intended decision?
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- A high Secure Score certifies that every relevant cloud resource is secure.
- Assigning a policy automatically remediates all existing resources under every effect.
- Key Vault network access restrictions are separate from key and secret authorization.
Explanation
Correct Answer
D:Confirmation depends on Vault firewall and private endpoint state, private DNS, calling subnet and secret request log. This principle supports the security response: Configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate.
Incorrect Answers
A:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Key Vault firewall and Private Endpoint. The relevant security behavior is: Key Vault network access restrictions are separate from key and secret authorization. Check evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Key Vault firewall and Private Endpoint. The relevant security behavior is: Key Vault network access restrictions are separate from key and secret authorization. Check evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Key Vault firewall and Private Endpoint. The relevant security behavior is: Key Vault network access restrictions are separate from key and secret authorization. Check evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
Question 854
A valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy. Suppose the operator instead follows this unsafe shortcut: Grant Global Administrator to bypass vault firewall routing. Which resulting risk or fault should the reviewer identify?
- Preserving a security alert audit trail is what caused the risky configuration.
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions.
Explanation
Correct Answer
D:The suitable control is: Configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Key Vault firewall and Private Endpoint weakness after the shortcut. The material failure is: Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions.
B:This does not explain the real Key Vault firewall and Private Endpoint weakness after the shortcut. Inspect evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
C:This does not explain the real Key Vault firewall and Private Endpoint weakness after the shortcut. In the given case, a valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy.
Question 855
A valid managed identity cannot read a vault because its calling VNet is not allowed by vault network access policy. A review identifies this consequence: Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. Which remediation most directly restores the intended behavior?
- Assume creating a private DNS record alone approves the vault private endpoint.
- Open public access to all networks because one private client is misconfigured.
- Grant Global Administrator to bypass vault firewall routing.
- Fix the private connectivity and vault access rules and test identity-based secret retrieval.
Explanation
Correct Answer
D:Test using these records: Vault firewall and private endpoint state, private DNS, calling subnet and secret request log. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:That option would assume creating a private DNS record alone approves the vault private endpoint, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
B:Open public access to all networks because one private client is misconfigured. This would not reliably restore the intended security boundary. Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. The appropriate controlled recovery is: Fix the private connectivity and vault access rules and test identity-based secret retrieval.
C:Grant Global Administrator to bypass vault firewall routing. This would not reliably restore the intended security boundary. Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. The appropriate controlled recovery is: Fix the private connectivity and vault access rules and test identity-based secret retrieval.
Question 856
An organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted. Which operator action best meets this technical requirement?
- For this Azure workload, the team should assume creating a private DNS record alone approves the vault private endpoint.
- For this Azure workload, the team should configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate.
- For this Azure workload, the team should open public access to all networks because one private client is misconfigured.
- For this Azure workload, the team should grant Global Administrator to bypass vault firewall routing.
Explanation
Correct Answer
B:Confirm the change against these records: Vault firewall and private endpoint state, private DNS, calling subnet and secret request log. Key Vault network access restrictions are separate from key and secret authorization.
Incorrect Answers
A:Assume creating a private DNS record alone approves the vault private endpoint. The proposed change targets the wrong mechanism or lacks essential validation. Key Vault network access restrictions are separate from key and secret authorization. Relevant evidence is vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
C:Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. Open public access to all networks because one private client is misconfigured.
D:Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions.
Question 857
An organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted. Which collection of observations most directly tests the suspected cause?
- In this security review, examine vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
- In this security review, examine an incident title without its actual source telemetry and detection results.
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
Explanation
Correct Answer
A:These records test the actual Key Vault firewall and Private Endpoint behavior rather than an unrelated dashboard state. The intended action is: Configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, an organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted.
C:The more relevant observations are: Vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
D:Key Vault network access restrictions are separate from key and secret authorization.
Question 858
An organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted. Which statement most accurately explains this scenario?
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that Key Vault network access restrictions are separate from key and secret authorization.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
Explanation
Correct Answer
C:Confirmation depends on Vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
Incorrect Answers
A:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Key Vault firewall and Private Endpoint. The relevant security behavior is: Key Vault network access restrictions are separate from key and secret authorization. Check evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
B:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Key Vault firewall and Private Endpoint. The relevant security behavior is: Key Vault network access restrictions are separate from key and secret authorization. Check evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
D:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Key Vault firewall and Private Endpoint. The relevant security behavior is: Key Vault network access restrictions are separate from key and secret authorization. Check evidence such as vault firewall and private endpoint state, private DNS, calling subnet and secret request log.
Question 859
An organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted. Suppose the operator instead follows this unsafe shortcut: Grant Global Administrator to bypass vault firewall routing. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
Explanation
Correct Answer
A:The suitable control is: Configure Key Vault network restrictions and an approved private endpoint and DNS path when appropriate. Key Vault network access restrictions are separate from key and secret authorization.
Incorrect Answers
B:This does not explain the real Key Vault firewall and Private Endpoint weakness after the shortcut. In the given case, an organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted.
C:This does not explain the real Key Vault firewall and Private Endpoint weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
D:This does not explain the real Key Vault firewall and Private Endpoint weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
Question 860
An organization requires secrets to be accessed through private network routing but the Key Vault public network endpoint is still unrestricted. A review identifies this consequence: Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to open public access to all networks because one private client is misconfigured.
- The controlled remediation is to grant Global Administrator to bypass vault firewall routing.
- The controlled remediation is to assume creating a private DNS record alone approves the vault private endpoint.
- The controlled remediation is to fix the private connectivity and vault access rules and test identity-based secret retrieval.
Explanation
Correct Answer
D:Test using these records: Vault firewall and private endpoint state, private DNS, calling subnet and secret request log. Key Vault network access restrictions are separate from key and secret authorization.
Incorrect Answers
A:Open public access to all networks because one private client is misconfigured. This would not reliably restore the intended security boundary. Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. The appropriate controlled recovery is: Fix the private connectivity and vault access rules and test identity-based secret retrieval.
B:Grant Global Administrator to bypass vault firewall routing. This would not reliably restore the intended security boundary. Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. The appropriate controlled recovery is: Fix the private connectivity and vault access rules and test identity-based secret retrieval.
C:Assume creating a private DNS record alone approves the vault private endpoint. This would not reliably restore the intended security boundary. Correct RBAC does not bypass denied network access and a private endpoint does not automatically grant permissions. The appropriate controlled recovery is: Fix the private connectivity and vault access rules and test identity-based secret retrieval.
