You save $69.98
An infrastructure design was selected to meet: report the misconfiguration while allowing teams to schedule remediation. What caveat remains relevant during operation?
Audit is a detective governance mechanism; it does not itself remediate insecure resource settings. That remains a practical service boundary even after the recommended change (assign an Azure Policy audit effect for the relevant secure-transfer requirement) is implemented; retest it when identities, policies, service capacity or network paths change.
The successful check 'Check a compliant storage account is not marked incorrectly' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Audit is a detective governance mechanism; it does not itself remediate insecure resource settings.
The two checks cover separate behavior: 'Check a compliant storage account is not marked incorrectly' and 'Query Policy compliance and confirm the violating resource is flagged'. Neither check removes the remaining operational limitation: Audit is a detective governance mechanism; it does not itself remediate insecure resource settings.
The incident (the compliance dashboard is empty even though test storage accounts violate secure-transfer settings) could recur if a related Azure dependency changes. The design still faces the limitation: Audit is a detective governance mechanism; it does not itself remediate insecure resource settings.
A scheduled Azure Function downloads input blobs and writes transformed output blobs to the same approved container. It must authenticate using its managed identity, without shared account keys. Which configuration provides the minimum suitable built-in data-plane role for both operations?
Storage Blob Data Contributor covers the read and write blob operations required here. A container-scoped assignment limits the built-in role to the intended dataset and avoids storing a shared account key.
The key grants account-wide data access and complicates least-privilege rotation; that would not meet the selected workload requirement, for which the relevant Azure action is assign Storage Blob Data Contributor at the specific container scope to the Function managed identity, and use Entra tokens.
Anonymous access exposes information instead of authenticating the workload; that would not meet the selected workload requirement, for which the relevant Azure action is assign Storage Blob Data Contributor at the specific container scope to the Function managed identity, and use Entra tokens.
Control-plane Reader alone does not grant blob data-plane read actions; that would not meet the selected workload requirement, for which the relevant Azure action is assign Storage Blob Data Contributor at the specific container scope to the Function managed identity, and use Entra tokens.
The Function can download input blobs using its managed identity, but its attempt to upload a transformed blob to the same container returns AuthorizationPermissionMismatch. The runtime can reach the Blob endpoint. What is the most likely permission defect?
The trace reports: The Function can download input blobs using its managed identity, but its attempt to upload a transformed blob to the same container returns AuthorizationPermissionMismatch. The runtime can reach the Blob endpoint. The causal misconfiguration is: The Function has Storage Blob Data Reader but lacks an effective blob data write permission at the output container. The targeted action is to grant Storage Blob Data Contributor to the Function identity at the exact output container and retest upload with an Entra token.
A successful upload under the same correctly scoped Contributor role contradicts the stated failure; the observed upload is denied despite a successful download.
An unrelated workspace Reader grant is not part of blob upload authorization and cannot explain why the Function can read but not write.
The successful blob download and accessible endpoint contradict a full Blob service outage as the primary cause.
An Azure Function can read its input blobs but cannot upload transformed output because its managed identity lacks blob write permission. Which targeted remediation fixes the mismatch without distributing storage-account keys?
Grant Storage Blob Data Contributor to the Function identity at the exact output container and retest upload with an Entra token. This addresses the documented failure condition: the Function has Storage Blob Data Reader but lacks an effective blob data write permission at the output container. Retest the affected operation and retain the original least-privilege boundaries.
Control-plane Reader alone does not grant blob data-plane read actions. In the reported incident (the Function can download input blobs using its managed identity, but its attempt to upload a transformed blob to the same container returns AuthorizationPermissionMismatch. The runtime can reach the Blob endpoint), that change would not correct the cause: the Function has Storage Blob Data Reader but lacks an effective blob data write permission at the output container.
Anonymous access exposes information instead of authenticating the workload. In the reported incident (the Function can download input blobs using its managed identity, but its attempt to upload a transformed blob to the same container returns AuthorizationPermissionMismatch. The runtime can reach the Blob endpoint), that change would not correct the cause: the Function has Storage Blob Data Reader but lacks an effective blob data write permission at the output container.
The key grants account-wide data access and complicates least-privilege rotation. In the reported incident (the Function can download input blobs using its managed identity, but its attempt to upload a transformed blob to the same container returns AuthorizationPermissionMismatch. The runtime can reach the Blob endpoint), that change would not correct the cause: the Function has Storage Blob Data Reader but lacks an effective blob data write permission at the output container.
A team gives its Azure Function a container-scoped Blob Data Contributor role for scheduled input reads and transformed output writes. Which TWO tests provide meaningful positive and negative evidence? Select TWO answers.
This performs the actual operations using the exact workload identity and permitted container. The successful round-trip establishes that the role, network route and token usage work in the tested path.
A negative test on a separate container verifies that the intended scope boundary is enforced. It distinguishes container-scoped authorization from an accidental account-wide grant.
Management-plane visibility is not proof of Blob data-plane write rights; the Function could still receive AuthorizationPermissionMismatch.
An Owner or administrator may have different access rights and account-key paths from the Function. Its successful upload cannot establish least-privilege behavior for the workload identity.
Resource names are descriptive metadata and do not validate that the scheduled Function can write the expected output.
The Function can now both read and upload blobs using a container-scoped Storage Blob Data Contributor assignment. Which remaining limitation must the administrator document?
Blob Data Contributor also includes blob deletion within its assigned scope; if deletion must be prohibited, enforce a narrower custom role or independent safeguards. That remains a practical service boundary even after the recommended change (assign Storage Blob Data Contributor at the specific container scope to the Function managed identity, and use Entra tokens) is implemented; retest it when identities, policies, service capacity or network paths change.
The built-in Blob Data Contributor role includes delete actions. It is not equivalent to the Reader role used for download-only scenarios.
Container-level RBAC does not implicitly extend to other accounts. The permission boundary must be checked on the actual scoped resource.
Storage network restrictions still apply after an identity is authorized. Data-plane RBAC does not bypass private endpoints or firewall rules.
A cloud administrator receives this request: A company must prevent shared-account-key authorization to a sensitive blob storage account, preferring Microsoft Entra identities. The requirement is: remove Shared Key access as an authentication path while maintaining supported identity-based access. Which configuration should be chosen first?
Disabling Shared Key removes broad account-key authorization for supported requests, encouraging scoped Entra access. This achieves remove Shared Key access as an authentication path while maintaining supported identity-based access through set the storage account to disallow Shared Key authorization and grant appropriate data-plane Azure RBAC roles instead of relying on merely similar resource settings.
Reader RBAC has no power to revoke existing account-key acceptance; that would not meet remove Shared Key access as an authentication path while maintaining supported identity-based access, for which the relevant Azure action is set the storage account to disallow Shared Key authorization and grant appropriate data-plane Azure RBAC roles.
Concealing a displayed key does not disable its use by applications; that would not meet remove Shared Key access as an authentication path while maintaining supported identity-based access, for which the relevant Azure action is set the storage account to disallow Shared Key authorization and grant appropriate data-plane Azure RBAC roles.
Management locks are not data-plane authentication switches; that would not meet remove Shared Key access as an authentication path while maintaining supported identity-based access, for which the relevant Azure action is set the storage account to disallow Shared Key authorization and grant appropriate data-plane Azure RBAC roles.
A pilot in Azure exposes this failure: An application still accesses private blobs using the account key after identity migration. The service was intended to meet: remove Shared Key access as an authentication path while maintaining supported identity-based access. What is the most likely cause?
The trace reports: An application still accesses private blobs using the account key after identity migration. The causal misconfiguration is: Shared Key authorization remains enabled for the account or the app still uses an accepted key. The targeted action is to disallow Shared Key authorization and update clients to appropriate identity-based methods.
The proposed mechanism concerns only ARM resource-reading rights were granted to the identity, not the blob data-plane permission, which is not established by the observed an application still accesses private blobs using the account key after identity migration. Test the more directly supported condition: Shared Key authorization remains enabled for the account or the app still uses an accepted key.
The SAS was generated with excessive permissions or an excessively long expiry; that mechanism would be more consistent with an observation such as the vendor's token permits deletion and remains valid after the engagement ends, rather than this case's an application still accesses private blobs using the account key after identity migration.
The ad hoc SAS tokens were not tied to a revocable stored access policy or relevant signing-key change; that mechanism would be more consistent with an observation such as a retired project's service SAS remains functional even after the client is removed from the team roster, rather than this case's an application still accesses private blobs using the account key after identity migration.
The team confirms the following Azure defect: An application still accesses private blobs using the account key after identity migration. Which targeted remediation addresses the root cause?
Disallow Shared Key authorization and update clients to appropriate identity-based methods. This addresses the documented failure condition: shared Key authorization remains enabled for the account or the app still uses an accepted key. Retest the affected operation and retain the original least-privilege boundaries.
Concealing a displayed key does not disable its use by applications. In the reported incident (an application still accesses private blobs using the account key after identity migration), that change would not correct the cause: shared Key authorization remains enabled for the account or the app still uses an accepted key.
Reader RBAC has no power to revoke existing account-key acceptance. In the reported incident (an application still accesses private blobs using the account key after identity migration), that change would not correct the cause: shared Key authorization remains enabled for the account or the app still uses an accepted key.
Management locks are not data-plane authentication switches. In the reported incident (an application still accesses private blobs using the account key after identity migration), that change would not correct the cause: shared Key authorization remains enabled for the account or the app still uses an accepted key.
A team has configured Azure for this workload: A company must prevent shared-account-key authorization to a sensitive blob storage account, preferring Microsoft Entra identities. The requirement is: remove Shared Key access as an authentication path while maintaining supported identity-based access. Which TWO verification steps would establish the relevant behavior? Select TWO answers.
Retry an old Shared Key request and confirm denial. This supplies observed evidence for remove Shared Key access as an authentication path while maintaining supported identity-based access. It is not interchangeable with the second required check, use an authorized managed identity for a read operation and confirm success, because that checks a separate success or failure boundary.
Use an authorized managed identity for a read operation and confirm success. This supplies observed evidence for remove Shared Key access as an authentication path while maintaining supported identity-based access. It is not interchangeable with the second required check, retry an old Shared Key request and confirm denial, because that checks a separate success or failure boundary.
A release checklist recording 'Use an authorized managed identity for a read operation and confirm success' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must use an authorized managed identity for a read operation and confirm success on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise retry an old Shared Key request and confirm denial on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Retry an old Shared Key request and confirm denial' even though the intended caller fails. This does not prove the required behavior for retry an old shared key request and confirm denial.
A risk reviewer is considering an Azure design that aims to: remove Shared Key access as an authentication path while maintaining supported identity-based access. Which limitation should still be documented?
Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key. That remains a practical service boundary even after the recommended change (set the storage account to disallow Shared Key authorization and grant appropriate data-plane Azure RBAC roles) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (an application still accesses private blobs using the account key after identity migration) could recur if a related Azure dependency changes. The design still faces the limitation: Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key.
The successful check 'Retry an old Shared Key request and confirm denial' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key.
The two checks cover separate behavior: 'Retry an old Shared Key request and confirm denial' and 'Use an authorized managed identity for a read operation and confirm success'. Neither check removes the remaining operational limitation: Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
