Question 590 A background worker repeatedly fails on one malformed queue message. What processing strategy helps avoid blocking useful work forever? Delete every message in the queue when one fails Retry the malformed message infinitely with no observability Use bounded retries and a poison-message handling path Change only the storage account redundancy model Explanation Correct Answer C:Bad messages need separate investigation while good tasks continue. Incorrect Answers A:That destroys unrelated valid work. B:Endless retries can consume capacity and hide the defect. D:Replica placement doesn't fix message content.
Question 591 An Azure Storage Explorer user can browse Blob containers but not list files in a protected share. What should operators distinguish? Permissions can differ between Blob data and Azure Files resources The Blob's access tier controls Azure Files user RBAC All storage services share one global anonymous permission The desktop client has the same rights as the Azure tenant root by default Explanation Correct Answer A:Access to one storage service doesn't automatically authorize all data planes. Incorrect Answers B:Object temperature is unrelated to share authorization. C:Authorization is service/resource-specific. D:Client rights depend on sign-in and granted privileges.
Question 592 A global company wants a managed cloud directory for workforce identities and sign-ins to Azure resources. Which service is foundational? Azure Queue Storage An Azure VM availability set Microsoft Entra ID An Azure resource group with user names stored as tags Explanation Correct Answer C:Entra ID provides cloud identity and access management for users and applications. Incorrect Answers A:Queues cannot be the organization directory. B:Fault-domain placement doesn't authenticate users. D:Resource metadata does not provide cloud identity sign-in and authentication services like Entra ID.
Question 593 Two organizations each use Azure but need distinct directories for their users and applications. Which concept is relevant? Two virtual machine subnets in one tenant alone Different Blob tiers for each organization Separate Microsoft Entra tenants as identity boundaries A different resource tag for every employee Explanation Correct Answer C:A tenant represents a directory instance with its own identities and configuration. Incorrect Answers A:Subnet separation isn't the same as directory tenancy. B:Storage temperature doesn't create identity isolation. D:Tags don't create separate identity directories.
Question 594 A company grants the same application access to many employees and wants easier membership changes. Which Entra object is useful? An Azure region pair A security group used for an appropriate group-based assignment A public IP address for the app A VM data disk Explanation Correct Answer B:Groups simplify administering common access for sets of users. Incorrect Answers A:Regions don't represent employee memberships. C:IP addresses are network identifiers, not identity groups. D:Disks don't grant SaaS application access.
Question 595 A consulting firm needs a partner employee to access selected internal collaboration resources without creating a fully managed workforce account in every case. What capability helps? Microsoft Entra B2B collaboration with appropriate guest access Give the partner a shared administrator password Publish all documents anonymously on the Internet Give every external collaborator an unmanaged shared administrator account Explanation Correct Answer A:External identities can collaborate under controlled access policies. Incorrect Answers B:Shared credentials undermine accountability. C:Public sharing sacrifices guest-specific authorization. D:Shared privileged accounts are not a controlled guest-collaboration identity approach.
Question 596 A partner project ends and its guest identities should no longer access company resources. What governance action is appropriate? Retain all guests permanently because access cannot expire Rename every employee's resource group Review and remove or disable unnecessary guest access and assignments Change Azure storage redundancy to GRS Explanation Correct Answer C:External collaboration access should follow the business lifecycle. Incorrect Answers A:External identities can be governed and removed. B:Group names don't disable guest authorization. D:Replica placement doesn't revoke a guest identity.
Question 597 An employee signs in successfully but cannot modify an Azure VM. What distinction explains this? Authentication proves identity while authorization determines permitted management actions Azure region choice determines the person's global admin status A VM's public IP is its authorization role A valid password always grants subscription Owner Explanation Correct Answer A:Successful sign-in does not imply the VM write role. Incorrect Answers B:Geography isn't identity authorization. C:Networking doesn't assign Azure RBAC. D:Identity proof isn't an all-powerful permission.
Question 598 An organization wants to require MFA for access to sensitive cloud apps from unmanaged devices. Which policy capability should be evaluated? Microsoft Entra Conditional Access Treat a virtual network rule as the complete user sign-in policy Azure Blob lifecycle management Azure VM autoscaling Explanation Correct Answer A:Conditional Access can apply access controls based on signals such as user, app and device context. Incorrect Answers B:Networking restrictions alone do not implement identity-driven Conditional Access decisions. C:Blob retention doesn't enforce MFA sign-in. D:Compute scaling is unrelated to identity policy.
Question 599 A security team wants stronger sign-in requirements for risky access attempts and lighter controls for routine compliant sessions. What design concept supports this? A storage account hot tier Evaluate only the user's resource-group tag while ignoring sign-in risk signals Conditional Access policies using appropriate signals and controls A VM availability set with two hosts Explanation Correct Answer C:Access decisions can depend on risk and context rather than only a static password. Incorrect Answers A:Object access frequency isn't a sign-in signal. B:Conditional Access evaluates supported identity and device conditions, not just arbitrary resource metadata. D:Compute redundancy doesn't challenge suspicious sign-ins.
Question 600 A tenant plans to deploy advanced Conditional Access policies. What pre-deployment consideration matters? Verify licensing and support for the selected Conditional Access capabilities Disable audit records to reduce policy overhead Assume every trial account has unlimited features permanently Change the storage account redundancy tier to unlock CA Explanation Correct Answer A:Identity feature availability can depend on license entitlements. Incorrect Answers B:Logging removal doesn't provide licensed features. C:Trial eligibility differs from production entitlement. D:Storage replicas don't license identity controls.
