Microsoft AZ-500 Practice Test 90
Question 890
An Azure workload needs a nonexportable signing key but a team stores the key bytes as an ordinary application secret. A review identifies this consequence: Storing sensitive signing material as a broadly readable secret can violate nonexportability goals. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume certificate renewal automatically rotates all unrelated encryption keys.
- The controlled remediation is to migrate to the appropriate object and verify only authorized sign, decrypt or secret-read behavior.
- The controlled remediation is to treat an arbitrary secret string as proof of a managed X.509 certificate lifecycle.
- The controlled remediation is to grant every application secret-get rights to read a private signing key.
Explanation
Correct Answer
B:Test using these records: Object type, supported cryptographic operation, certificate policy, access scope and renewal event. Key Vault keys, secrets and certificates support different management and cryptographic usage patterns.
Incorrect Answers
A:Assume certificate renewal automatically rotates all unrelated encryption keys. This would not reliably restore the intended security boundary. Storing sensitive signing material as a broadly readable secret can violate nonexportability goals. The appropriate controlled recovery is: Migrate to the appropriate object and verify only authorized sign, decrypt or secret-read behavior.
C:Treat an arbitrary secret string as proof of a managed X.509 certificate lifecycle. This would not reliably restore the intended security boundary. Storing sensitive signing material as a broadly readable secret can violate nonexportability goals. The appropriate controlled recovery is: Migrate to the appropriate object and verify only authorized sign, decrypt or secret-read behavior.
D:Grant every application secret-get rights to read a private signing key. This would not reliably restore the intended security boundary. Storing sensitive signing material as a broadly readable secret can violate nonexportability goals. The appropriate controlled recovery is: Migrate to the appropriate object and verify only authorized sign, decrypt or secret-read behavior.
Question 891
An attacker tries to delete VM backups after compromising an operator with broad subscription permissions. Which configuration decision MOST directly resolves the issue?
- Assume Azure VM disk encryption alone prevents deletion of backups.
- Give every junior operator unrestricted backup deletion rights for convenience.
- Disable soft delete as soon as a backup job reports healthy.
- Configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards.
Explanation
Correct Answer
D:Confirm the change against these records: Vault security settings, delete and stop-backup permissions, protected recovery points and restore test. Backup security controls can make destructive recovery-point operations harder and support later restoration.
Incorrect Answers
A:A recovery system without protected retention may permit attackers to destroy the last usable backup. Assume Azure VM disk encryption alone prevents deletion of backups.
B:Give every junior operator unrestricted backup deletion rights for convenience. The proposed change targets the wrong mechanism or lacks essential validation. Backup security controls can make destructive recovery-point operations harder and support later restoration. Relevant evidence is vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
C:A recovery system without protected retention may permit attackers to destroy the last usable backup. The intended action is: Configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards.
Question 892
An attacker tries to delete VM backups after compromising an operator with broad subscription permissions. What evidence most directly confirms the intended security behavior?
- An inventory item list from a different subscription or connected cloud account.
- A historical Secure Score screenshot without the relevant resource-level finding.
- An incident title without its actual source telemetry and detection results.
- Vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
Explanation
Correct Answer
D:These records test the actual Azure Backup vault immutability and soft delete behavior rather than an unrelated dashboard state. Backup security controls can make destructive recovery-point operations harder and support later restoration.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Backup security controls can make destructive recovery-point operations harder and support later restoration.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
C:On its own, that evidence does not prove the specified security control works. In the given case, an attacker tries to delete VM backups after compromising an operator with broad subscription permissions.
Question 893
An attacker tries to delete VM backups after compromising an operator with broad subscription permissions. Which security principle best explains the intended decision?
- Backup security controls can make destructive recovery-point operations harder and support later restoration.
- A high Secure Score certifies that every relevant cloud resource is secure.
- Turning off an alert source is equivalent to remediating the underlying threat.
- A published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
A:Confirmation depends on Vault security settings, delete and stop-backup permissions, protected recovery points and restore test. This principle supports the security response: Configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards.
Incorrect Answers
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Azure Backup vault immutability and soft delete. The relevant security behavior is: Backup security controls can make destructive recovery-point operations harder and support later restoration. Check evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
C:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Azure Backup vault immutability and soft delete. The relevant security behavior is: Backup security controls can make destructive recovery-point operations harder and support later restoration. Check evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure Backup vault immutability and soft delete. The relevant security behavior is: Backup security controls can make destructive recovery-point operations harder and support later restoration. Check evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
Question 894
An attacker tries to delete VM backups after compromising an operator with broad subscription permissions. Suppose the operator instead follows this unsafe shortcut: Assume Azure VM disk encryption alone prevents deletion of backups. Which resulting risk or fault should the reviewer identify?
- A recovery system without protected retention may permit attackers to destroy the last usable backup.
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
- Preserving a security alert audit trail is what caused the risky configuration.
Explanation
Correct Answer
A:The suitable control is: Configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards. Backup security controls can make destructive recovery-point operations harder and support later restoration.
Incorrect Answers
B:This does not explain the real Azure Backup vault immutability and soft delete weakness after the shortcut. The material failure is: A recovery system without protected retention may permit attackers to destroy the last usable backup.
C:This does not explain the real Azure Backup vault immutability and soft delete weakness after the shortcut. Inspect evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
D:This does not explain the real Azure Backup vault immutability and soft delete weakness after the shortcut. Preserving a security alert audit trail is what caused the risky configuration.
Question 895
An attacker tries to delete VM backups after compromising an operator with broad subscription permissions. A review identifies this consequence: A recovery system without protected retention may permit attackers to destroy the last usable backup. Which remediation most directly restores the intended behavior?
- Give every junior operator unrestricted backup deletion rights for convenience.
- Disable soft delete as soon as a backup job reports healthy.
- Apply protected backup retention and test legitimate restore under least-privilege governance.
- Assume Azure VM disk encryption alone prevents deletion of backups.
Explanation
Correct Answer
C:Test using these records: Vault security settings, delete and stop-backup permissions, protected recovery points and restore test. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Give every junior operator unrestricted backup deletion rights for convenience. This would not reliably restore the intended security boundary. A recovery system without protected retention may permit attackers to destroy the last usable backup. The appropriate controlled recovery is: Apply protected backup retention and test legitimate restore under least-privilege governance.
B:Disable soft delete as soon as a backup job reports healthy. This would not reliably restore the intended security boundary. A recovery system without protected retention may permit attackers to destroy the last usable backup. The appropriate controlled recovery is: Apply protected backup retention and test legitimate restore under least-privilege governance.
D:Assume Azure VM disk encryption alone prevents deletion of backups. This would not reliably restore the intended security boundary. A recovery system without protected retention may permit attackers to destroy the last usable backup. The appropriate controlled recovery is: Apply protected backup retention and test legitimate restore under least-privilege governance.
Question 896
A recovery platform needs delayed deletion and stronger protection against unauthorized backup removal. Which operator action best meets this technical requirement?
- For this Azure workload, the team should configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards.
- For this Azure workload, the team should give every junior operator unrestricted backup deletion rights for convenience.
- For this Azure workload, the team should disable soft delete as soon as a backup job reports healthy.
- For this Azure workload, the team should assume Azure VM disk encryption alone prevents deletion of backups.
Explanation
Correct Answer
A:Confirm the change against these records: Vault security settings, delete and stop-backup permissions, protected recovery points and restore test. This directly addresses Azure Backup vault immutability and soft delete.
Incorrect Answers
B:Give every junior operator unrestricted backup deletion rights for convenience. The proposed change targets the wrong mechanism or lacks essential validation. Backup security controls can make destructive recovery-point operations harder and support later restoration. Relevant evidence is vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
C:A recovery system without protected retention may permit attackers to destroy the last usable backup.
D:In the given case, a recovery platform needs delayed deletion and stronger protection against unauthorized backup removal.
Question 897
A recovery platform needs delayed deletion and stronger protection against unauthorized backup removal. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
- In this security review, examine vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
Explanation
Correct Answer
D:These records test the actual Azure Backup vault immutability and soft delete behavior rather than an unrelated dashboard state. The intended action is: Configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a recovery platform needs delayed deletion and stronger protection against unauthorized backup removal.
B:Backup security controls can make destructive recovery-point operations harder and support later restoration.
C:The more relevant observations are: Vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
Question 898
A recovery platform needs delayed deletion and stronger protection against unauthorized backup removal. Which statement most accurately explains this scenario?
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that backup security controls can make destructive recovery-point operations harder and support later restoration.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
Explanation
Correct Answer
C:Confirmation depends on Vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
Incorrect Answers
A:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Azure Backup vault immutability and soft delete. The relevant security behavior is: Backup security controls can make destructive recovery-point operations harder and support later restoration. Check evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Azure Backup vault immutability and soft delete. The relevant security behavior is: Backup security controls can make destructive recovery-point operations harder and support later restoration. Check evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
D:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Azure Backup vault immutability and soft delete. The relevant security behavior is: Backup security controls can make destructive recovery-point operations harder and support later restoration. Check evidence such as vault security settings, delete and stop-backup permissions, protected recovery points and restore test.
Question 899
A recovery platform needs delayed deletion and stronger protection against unauthorized backup removal. Suppose the operator instead follows this unsafe shortcut: Assume Azure VM disk encryption alone prevents deletion of backups. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that a recovery system without protected retention may permit attackers to destroy the last usable backup.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
Explanation
Correct Answer
C:The suitable control is: Configure supported Backup vault soft delete, immutability and appropriate multi-user authorization safeguards. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Azure Backup vault immutability and soft delete weakness after the shortcut. In the given case, a recovery platform needs delayed deletion and stronger protection against unauthorized backup removal.
B:This does not explain the real Azure Backup vault immutability and soft delete weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
D:This does not explain the real Azure Backup vault immutability and soft delete weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
Question 900
A recovery platform needs delayed deletion and stronger protection against unauthorized backup removal. A review identifies this consequence: A recovery system without protected retention may permit attackers to destroy the last usable backup. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to apply protected backup retention and test legitimate restore under least-privilege governance.
- The controlled remediation is to disable soft delete as soon as a backup job reports healthy.
- The controlled remediation is to assume Azure VM disk encryption alone prevents deletion of backups.
- The controlled remediation is to give every junior operator unrestricted backup deletion rights for convenience.
Explanation
Correct Answer
A:Test using these records: Vault security settings, delete and stop-backup permissions, protected recovery points and restore test. Backup security controls can make destructive recovery-point operations harder and support later restoration.
Incorrect Answers
B:Disable soft delete as soon as a backup job reports healthy. This would not reliably restore the intended security boundary. A recovery system without protected retention may permit attackers to destroy the last usable backup. The appropriate controlled recovery is: Apply protected backup retention and test legitimate restore under least-privilege governance.
C:Assume Azure VM disk encryption alone prevents deletion of backups. This would not reliably restore the intended security boundary. A recovery system without protected retention may permit attackers to destroy the last usable backup. The appropriate controlled recovery is: Apply protected backup retention and test legitimate restore under least-privilege governance.
D:Give every junior operator unrestricted backup deletion rights for convenience. This would not reliably restore the intended security boundary. A recovery system without protected retention may permit attackers to destroy the last usable backup. The appropriate controlled recovery is: Apply protected backup retention and test legitimate restore under least-privilege governance.
