Question 640 A security team sees many unexpected authenticator push requests to an employee. What action is appropriate? Approve all prompts to stop notifications Treat unsolicited approvals as suspicious and investigate or block sign-in attempts Disable every sign-in log to avoid noise Publish the user's password for testing Explanation Correct Answer B:Unexpected prompts can indicate an attacker is trying to use a known password. Incorrect Answers A:Approving an attacker's request can compromise the account. C:Removing evidence harms investigation. D:Exposure would create additional credential risk.
Question 641 An employee loses the phone used for passwordless authentication. What identity administration concept is necessary? Automatically grant access to anyone who knows the email address Change all VM disk encryption keys Enable anonymous storage account access A verified alternative sign-in and recovery process Explanation Correct Answer D:Passwordless adoption still needs secure account recovery. Incorrect Answers A:An email address alone isn't authentication. B:Disk keys don't restore an individual login method. C:Public Blob access doesn't repair identity authentication.
Question 642 A legacy Azure-hosted app requires LDAP to a managed Entra Domain Services domain but cannot reach it. Which infrastructure topic matters? Only VM autoscaling thresholds Network connectivity and DNS settings to the managed domain Only an unrelated Azure Function trigger Only Azure Storage access tiers Explanation Correct Answer B:The domain service provides managed directory endpoints inside a VNet scope. Incorrect Answers A:More instances don't fix missing directory DNS/routes. C:Event handling doesn't establish domain connectivity. D:Blob temperature doesn't route LDAP.
Question 643 An enterprise has on-premises AD DS identities and wants cloud sign-in experiences for Azure-connected services. Which identity design should be evaluated? Supported hybrid identity synchronization or federation with Microsoft Entra ID Moving all user account data into Blob Archive A new region pair alone Replace workforce identities with one shared cloud administrator account Explanation Correct Answer A:Identity integration can bridge on-premises accounts and cloud authentication. Incorrect Answers B:Archive isn't a directory synchronization service. C:Geographic pairing isn't identity synchronization. D:A shared privileged identity undermines individual access control, auditing and lifecycle management.
Question 644 A team needs permission for just a narrow set of Azure management actions and no built-in role matches. Which Azure RBAC capability may fit? Use only storage account tags as permissions Place desired actions in a group tag instead of defining a custom Azure RBAC role A custom role with carefully scoped allowed actions Assign the root Owner role because it is simpler Explanation Correct Answer C:Custom roles can express defined Azure operations subject to supported limits. Incorrect Answers A:Tags don't define RBAC role actions. B:RBAC permissions require role definitions and assignments; tags do not grant management actions. D:Owner would grant unnecessarily broad actions.
Question 645 A department changes staff frequently and wants consistent Reader access to one resource group. What administration model reduces per-user assignments? Give every employee subscription Owner Use a VM scale set to clone user identities Set a resource group tag with the employee list Assign Reader to a maintained Entra group at the resource-group scope Explanation Correct Answer D:Group memberships can determine who inherits the permitted resource visibility. Incorrect Answers A:That exceeds read-only scope. B:Compute doesn't manage RBAC memberships. C:Tags don't confer identity rights.
Question 646 An employee leaves an infrastructure team but still has inherited Contributor access through a group. What should admins check? Only the subscription display name Only the storage account access tier Only the VM's public IP address Group membership and inherited role assignments in addition to direct assignments Explanation Correct Answer D:Permissions can persist through group-scoped inheritance. Incorrect Answers A:Names don't alter role membership. B:Object temperature is unrelated to role grants. C:Networking doesn't revoke inherited management roles.
Question 647 A platform owner lets a colleague manage role assignments but not necessarily all resource data. Which built-in role specifically focuses on access administration? Storage Blob Data Reader Reader User Access Administrator at an appropriate scope Monitoring Reader Explanation Correct Answer C:It can manage user access for Azure resources without simply serving as a data reader. Incorrect Answers A:That role reads blobs but doesn't manage Azure role assignments. B:Reader cannot grant other users permissions. D:Monitoring visibility doesn't manage RBAC roles.
Question 648 A security group receives an Azure Contributor assignment, yet one member cannot sign into the tenant. Which distinction matters? Resource group names replace Entra user identities RBAC roles do not repair a disabled or unverified user authentication path Public IP addresses authenticate Azure portal users Contributor grants a working password automatically Explanation Correct Answer B:The principal must still authenticate successfully before exercising management permissions. Incorrect Answers A:Names aren't sign-in principals. C:IP routing doesn't establish a user session. D:Role assignment doesn't create the user's credential.
Question 649 A business authorizes a user once and assumes access can never be reassessed. Which Zero Trust practice is more appropriate? Permanently trust any device after one successful login Use risk-aware access decisions and monitoring throughout the access lifecycle Treat a private IP address as proof of indefinite trust Remove logging to reduce reevaluation work Explanation Correct Answer B:Access should respond to changing identity or device conditions where supported. Incorrect Answers A:Conditions and compromise may change later. C:Network location isn't continuous identity assurance. D:Less visibility impedes risk detection.
Question 650 An application has public frontend servers and private database servers in Azure. Which Zero Trust-style control reduces unnecessary lateral access? Share a single privileged password across all tiers Segment network access so only approved application paths reach the database Allow every workload to contact every database port Use only a data-copying redundancy tier Explanation Correct Answer B:Restricting east-west traffic limits the attack surface after a compromise. Incorrect Answers A:Shared credentials increase compromise impact. C:Unrestricted lateral access increases blast radius. D:Replica choice doesn't restrict network paths.
