Microsoft AZ-500 Practice Test 88
Question 870
An attacker with elevated access could permanently purge recently deleted keys if purge protection is not enforced. A review identifies this consequence: Without properly configured recovery controls, deleting encryption keys can jeopardize protected workloads. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to enforce required protection and test supported recovery without exposing key material.
- The controlled remediation is to treat a VM disk snapshot as a complete backup of all Key Vault secrets.
- The controlled remediation is to assume a Key Vault secret backup substitutes for protecting the entire vault lifecycle.
- The controlled remediation is to disable all key recovery features before rotating CMKs.
Explanation
Correct Answer
A:Test using these records: Vault recovery settings, deleted object list, purge protection state and controlled restore test. Key Vault soft delete and purge protection help recover deleted vaults or objects and resist premature permanent removal.
Incorrect Answers
B:Treat a VM disk snapshot as a complete backup of all Key Vault secrets. This would not reliably restore the intended security boundary. Without properly configured recovery controls, deleting encryption keys can jeopardize protected workloads. The appropriate controlled recovery is: Enforce required protection and test supported recovery without exposing key material.
C:Assume a Key Vault secret backup substitutes for protecting the entire vault lifecycle. This would not reliably restore the intended security boundary. Without properly configured recovery controls, deleting encryption keys can jeopardize protected workloads. The appropriate controlled recovery is: Enforce required protection and test supported recovery without exposing key material.
D:Disable all key recovery features before rotating CMKs. This would not reliably restore the intended security boundary. Without properly configured recovery controls, deleting encryption keys can jeopardize protected workloads. The appropriate controlled recovery is: Enforce required protection and test supported recovery without exposing key material.
Question 871
A long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version. What is the most defensible Azure security action?
- Delete all old key versions before confirming dependent data can be decrypted.
- Share private key material in email to coordinate rotation.
- Assume a new key version is automatically used by every explicitly version-pinned client.
- Use supported Key Vault key rotation policies and verify dependent services can adopt new versions.
Explanation
Correct Answer
D:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Confirm the change against these records: Key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
Incorrect Answers
A:Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. Delete all old key versions before confirming dependent data can be decrypted.
B:Share private key material in email to coordinate rotation. The proposed change targets the wrong mechanism or lacks essential validation. Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Relevant evidence is key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
C:Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The intended action is: Use supported Key Vault key rotation policies and verify dependent services can adopt new versions.
Question 872
A long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version. Which diagnostic record would most strongly confirm the result?
- A historical Secure Score screenshot without the relevant resource-level finding.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
- Key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
- An inventory item list from a different subscription or connected cloud account.
Explanation
Correct Answer
C:These records test the actual Key Vault key rotation policies behavior rather than an unrelated dashboard state. Managed key rotation can generate new key versions but clients and services must handle the intended version behavior.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Managed key rotation can generate new key versions but clients and services must handle the intended version behavior.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
D:On its own, that evidence does not prove the specified security control works. In the given case, a long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version.
Question 873
A long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version. Which platform concept should guide the engineer’s assessment?
- Assigning a policy automatically remediates all existing resources under every effect.
- A published security standard alone grants managed identities permission to change resources.
- Managed key rotation can generate new key versions but clients and services must handle the intended version behavior.
- A high Secure Score certifies that every relevant cloud resource is secure.
Explanation
Correct Answer
C:This principle supports the security response: Use supported Key Vault key rotation policies and verify dependent services can adopt new versions. Confirmation depends on Key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
Incorrect Answers
A:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Key Vault key rotation policies. The relevant security behavior is: Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Check evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
B:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Key Vault key rotation policies. The relevant security behavior is: Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Check evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
D:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Key Vault key rotation policies. The relevant security behavior is: Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Check evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
Question 874
A long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version. Suppose the operator instead follows this unsafe shortcut: Delete all old key versions before confirming dependent data can be decrypted. Which root-cause observation follows from that incorrect change?
- Documenting an approved policy assignment is the cause of its earlier absence.
- Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads.
- Preserving a security alert audit trail is what caused the risky configuration.
- Running a scoped compliance assessment automatically deletes protected resources.
Explanation
Correct Answer
B:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. The suitable control is: Use supported Key Vault key rotation policies and verify dependent services can adopt new versions.
Incorrect Answers
A:This does not explain the real Key Vault key rotation policies weakness after the shortcut. The material failure is: Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads.
C:This does not explain the real Key Vault key rotation policies weakness after the shortcut. Inspect evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
D:This does not explain the real Key Vault key rotation policies weakness after the shortcut. In the given case, a long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version.
Question 875
A long-lived customer-managed encryption key is nearing expiry and storage depends on a valid new key version. A review identifies this consequence: Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. Which recovery action addresses the underlying technical fault?
- Share private key material in email to coordinate rotation.
- Assume a new key version is automatically used by every explicitly version-pinned client.
- Apply approved rotation and validate service continuity and rollback controls.
- Delete all old key versions before confirming dependent data can be decrypted.
Explanation
Correct Answer
C:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Share private key material in email to coordinate rotation. This would not reliably restore the intended security boundary. Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The appropriate controlled recovery is: Apply approved rotation and validate service continuity and rollback controls.
B:Assume a new key version is automatically used by every explicitly version-pinned client. This would not reliably restore the intended security boundary. Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The appropriate controlled recovery is: Apply approved rotation and validate service continuity and rollback controls.
D:Delete all old key versions before confirming dependent data can be decrypted. This would not reliably restore the intended security boundary. Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The appropriate controlled recovery is: Apply approved rotation and validate service continuity and rollback controls.
Question 876
An organization has rotation requirements but relies on operators manually copying keys from a spreadsheet. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should use supported Key Vault key rotation policies and verify dependent services can adopt new versions.
- For this Azure workload, the team should share private key material in email to coordinate rotation.
- For this Azure workload, the team should assume a new key version is automatically used by every explicitly version-pinned client.
- For this Azure workload, the team should delete all old key versions before confirming dependent data can be decrypted.
Explanation
Correct Answer
A:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior.
Incorrect Answers
B:Share private key material in email to coordinate rotation. The proposed change targets the wrong mechanism or lacks essential validation. Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Relevant evidence is key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
C:Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads.
D:Delete all old key versions before confirming dependent data can be decrypted.
Question 877
An organization has rotation requirements but relies on operators manually copying keys from a spreadsheet. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
Explanation
Correct Answer
B:These records test the actual Key Vault key rotation policies behavior rather than an unrelated dashboard state. The intended action is: Use supported Key Vault key rotation policies and verify dependent services can adopt new versions.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an organization has rotation requirements but relies on operators manually copying keys from a spreadsheet.
C:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior.
D:The more relevant observations are: Key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
Question 878
An organization has rotation requirements but relies on operators manually copying keys from a spreadsheet. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that managed key rotation can generate new key versions but clients and services must handle the intended version behavior.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
Explanation
Correct Answer
A:This principle supports the security response: Use supported Key Vault key rotation policies and verify dependent services can adopt new versions.
Incorrect Answers
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Key Vault key rotation policies. The relevant security behavior is: Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Check evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Key Vault key rotation policies. The relevant security behavior is: Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Check evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
D:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Key Vault key rotation policies. The relevant security behavior is: Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Check evidence such as key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
Question 879
An organization has rotation requirements but relies on operators manually copying keys from a spreadsheet. Suppose the operator instead follows this unsafe shortcut: Delete all old key versions before confirming dependent data can be decrypted. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
- The resulting security weakness is that rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads.
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
Explanation
Correct Answer
C:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Key Vault key rotation policies weakness after the shortcut. In the given case, an organization has rotation requirements but relies on operators manually copying keys from a spreadsheet.
B:This does not explain the real Key Vault key rotation policies weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
D:This does not explain the real Key Vault key rotation policies weakness after the shortcut. Preserving a security alert audit trail is what caused the risky configuration.
Question 880
An organization has rotation requirements but relies on operators manually copying keys from a spreadsheet. A review identifies this consequence: Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to assume a new key version is automatically used by every explicitly version-pinned client.
- The controlled remediation is to delete all old key versions before confirming dependent data can be decrypted.
- The controlled remediation is to share private key material in email to coordinate rotation.
- The controlled remediation is to apply approved rotation and validate service continuity and rollback controls.
Explanation
Correct Answer
D:Managed key rotation can generate new key versions but clients and services must handle the intended version behavior. Test using these records: Key rotation policy, current key versions, expiry, dependent resource key URI and operation logs.
Incorrect Answers
A:Assume a new key version is automatically used by every explicitly version-pinned client. This would not reliably restore the intended security boundary. Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The appropriate controlled recovery is: Apply approved rotation and validate service continuity and rollback controls.
B:Delete all old key versions before confirming dependent data can be decrypted. This would not reliably restore the intended security boundary. Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The appropriate controlled recovery is: Apply approved rotation and validate service continuity and rollback controls.
C:Share private key material in email to coordinate rotation. This would not reliably restore the intended security boundary. Rotating a key without checking version-pinned consumers may interrupt encryption-dependent workloads. The appropriate controlled recovery is: Apply approved rotation and validate service continuity and rollback controls.
