Question 620 A vendor only needs to operate one Azure VM in a shared subscription. Which access approach best supports least privilege? Assign the necessary role at the narrowest resource scope supported Grant Owner at the root management group for convenience Move all other VMs to a different region to separate access Share the subscription administrator password Explanation Correct Answer A:A resource-scoped assignment avoids granting unnecessary access to peers. Incorrect Answers B:That greatly exceeds the single-VM requirement. C:Regional placement isn't an authorization replacement. D:Shared credentials reduce accountability and scope control.
Question 621 A user can create a storage account but cannot read its private Blob content using Entra authentication. What is the likely permission distinction? Azure regions own all storage permissions Any Contributor assignment gives unrestricted data contents on every service Management-plane roles and Blob data-plane roles can be separate Blob access tiers control Entra RBAC Explanation Correct Answer C:Creating the account does not automatically grant blob-read privileges through data RBAC. Incorrect Answers A:Geography doesn't determine a user's role. B:Management permissions don't always confer data access. D:Data temperature doesn't grant identities.
Question 622 An operator grants access to a virtual machine by Azure RBAC. What must the assignment identify? Only the Azure region pair Grant permission to the VM's public network endpoint rather than to the user or service principal Only the VM's OS disk type A security principal, a role definition and an appropriate scope Explanation Correct Answer D:RBAC binds who can do which actions over which resources. Incorrect Answers A:Regions aren't RBAC role definitions. B:Network reachability is separate from Azure RBAC assignments to an identity at a resource scope. C:Disk type cannot specify cloud permissions.
Question 623 A user has Contributor on a resource group but a higher-scope policy prevents a disallowed resource SKU. What principle should they understand? RBAC permission and Azure Policy compliance are distinct controls A VM size change always bypasses disallowed SKU rules A policy tag changes the user's identity provider password Contributor automatically overrides every tenant policy Explanation Correct Answer A:A user may be authorized to request a deployment that policy still denies. Incorrect Answers B:Policy may apply to SKU choices. C:Resource governance isn't identity authentication. D:RBAC doesn't bypass policy enforcement.
Question 624 A team granted Owner to dozens of users several years ago and now needs tighter cloud management. What approach improves risk posture? Move resource groups between regions Review assignments and reduce roles/scopes to current business needs Rename the subscription while preserving roles Leave all old Owners permanently because removing roles is unsupported Explanation Correct Answer B:Least privilege limits unnecessary administrative authority. Incorrect Answers A:Administrative risk isn't solved by geography. C:Renaming doesn't remove access. D:Role assignments can be reviewed and changed.
Question 625 A company trusts any device on its office network without checking identity or device health. Which Zero Trust concept challenges this? Delete all application audit logs Always trust every packet from one private subnet Verify explicitly using available identity, device and context signals Give everyone permanent Owner to avoid support calls Explanation Correct Answer C:Network location alone isn't proof that every session is trustworthy. Incorrect Answers A:Less evidence does not increase assurance. B:Private addressing is not an identity credential. D:Excessive privileges contradict least privilege.
Question 626 An administrator gives every employee subscription Owner to avoid requests for access. Which Zero Trust principle is violated? Use a redundant storage tier Verify every user's device posture Use least-privilege access with only necessary permissions Inspect cloud health incidents Explanation Correct Answer C:Broad administrative access increases the blast radius of compromised accounts. Incorrect Answers A:Storage copies are unrelated to user privileges. B:Device posture is useful but doesn't justify unrestricted Owner. D:Monitoring outages isn't a substitute for role scoping.
Question 627 A company uses encryption and MFA but assumes a successful attacker can never move laterally. Which Zero Trust principle should still guide design? Assume breach and segment access while monitoring for compromise Remove network segmentation because cloud providers secure the hosts Consolidate all workloads under one shared admin account Turn off logs because MFA prevents compromise Explanation Correct Answer A:Designing for a potential compromise reduces lateral impact. Incorrect Answers B:Provider responsibility doesn't remove tenant segmentation needs. C:Shared authority increases blast radius. D:Identity controls do not eliminate all threats.
Question 628 A web application has TLS but no identity checks, network filtering or monitoring. Which security principle indicates this is incomplete? One encryption setting makes every layer unnecessary Changing resource names reduces attacker privilege Defense in depth with multiple complementary controls A storage redundancy tier is the only security layer Explanation Correct Answer C:Protecting transport alone does not replace identity, application, network and operational layers. Incorrect Answers A:Encryption protects a specific concern, not all attack paths. B:Names are not an authorization boundary. D:Replication is availability, not comprehensive access control.
Question 629 An organization adds network firewalls yet still uses shared passwords for cloud administration. What security gap remains? Strong individual identity and authentication controls are still required A VM scale set solves credential theft Firewalls automatically issue MFA tokens to every administrator Shared credentials are a requirement of Zero Trust Explanation Correct Answer A:Perimeter filtering does not authenticate or authorize privileged cloud actions. Incorrect Answers B:Compute redundancy doesn't address identity exposure. C:Network devices are not an Entra MFA policy. D:Shared admin identities contradict accountability.
Question 630 A team protects a database subnet with an NSG but stores sensitive backups without access controls. What defense-in-depth layer is missing? Only another VM fault domain Appropriate data protection and authorization for the backups Treat public endpoint firewall rules as a substitute for encryption of stored sensitive data More CPU for the application server Explanation Correct Answer B:Network filtering on the database VM does not secure all copies of the data. Incorrect Answers A:Availability placement doesn't control backup readers. C:Network controls limit traffic; encryption protects data confidentiality at rest when properly configured. D:Performance is not data confidentiality.
