You save $69.98
A risk reviewer is considering an Azure design that aims to: remove Shared Key access as an authentication path while maintaining supported identity-based access. Which limitation should still be documented?
Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key. That remains a practical service boundary even after the recommended change (set the storage account to disallow Shared Key authorization and grant appropriate data-plane Azure RBAC roles) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (an application still accesses private blobs using the account key after identity migration) could recur if a related Azure dependency changes. The design still faces the limitation: Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key.
The successful check 'Retry an old Shared Key request and confirm denial' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key.
The two checks cover separate behavior: 'Retry an old Shared Key request and confirm denial' and 'Use an authorized managed identity for a read operation and confirm success'. Neither check removes the remaining operational limitation: Some Azure Storage services and use cases have different support constraints; inventory dependent applications before disabling Shared Key.
A production subscription has this use case: A compute subnet must access Azure Storage over an authorized service endpoint without opening storage access to every subnet. The owner specifies: restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint. What is the best administrative approach?
The service endpoint identifies traffic from the selected Azure subnet for a storage public endpoint firewall rule. This achieves restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint through enable the Microsoft.Storage service endpoint on the subnet and add that subnet to the storage firewall rules instead of relying on merely similar resource settings.
Custom routing alone does not establish the storage network rule; that would not meet restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint, for which the relevant Azure action is enable the Microsoft.Storage service endpoint on the subnet and add that subnet to the storage firewall rules.
Resource management roles do not configure subnet-based service endpoint access; that would not meet restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint, for which the relevant Azure action is enable the Microsoft.Storage service endpoint on the subnet and add that subnet to the storage firewall rules.
DNS resolution does not enable the subnet's Storage service endpoint; that would not meet restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint, for which the relevant Azure action is enable the Microsoft.Storage service endpoint on the subnet and add that subnet to the storage firewall rules.
An Azure administrator is investigating this symptom: A subnet VM can authenticate but receives network-denied responses from the storage account. Which root cause best matches the underlying requirement: restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint?
The trace reports: A subnet VM can authenticate but receives network-denied responses from the storage account. The causal misconfiguration is: The subnet's Storage service endpoint or matching storage network rule is absent or incorrect. The targeted action is to enable the service endpoint and permit the exact subnet in the storage account firewall.
The ad hoc SAS tokens were not tied to a revocable stored access policy or relevant signing-key change; that mechanism would be more consistent with an observation such as a retired project's service SAS remains functional even after the client is removed from the team roster, rather than this case's a subnet VM can authenticate but receives network-denied responses from the storage account.
The proposed mechanism concerns only ARM resource-reading rights were granted to the identity, not the blob data-plane permission, which is not established by the observed a subnet VM can authenticate but receives network-denied responses from the storage account. Test the more directly supported condition: The subnet's Storage service endpoint or matching storage network rule is absent or incorrect.
The SAS was generated with excessive permissions or an excessively long expiry; that mechanism would be more consistent with an observation such as the vendor's token permits deletion and remains valid after the engagement ends, rather than this case's a subnet VM can authenticate but receives network-denied responses from the storage account.
An Azure rollout fails because: A subnet VM can authenticate but receives network-denied responses from the storage account. Which change most directly restores the intended control?
Enable the service endpoint and permit the exact subnet in the storage account firewall. This addresses the documented failure condition: the subnet's Storage service endpoint or matching storage network rule is absent or incorrect. Retest the affected operation and retain the original least-privilege boundaries.
DNS resolution does not enable the subnet's Storage service endpoint. In the reported incident (a subnet VM can authenticate but receives network-denied responses from the storage account), that change would not correct the cause: the subnet's Storage service endpoint or matching storage network rule is absent or incorrect.
Resource management roles do not configure subnet-based service endpoint access. In the reported incident (a subnet VM can authenticate but receives network-denied responses from the storage account), that change would not correct the cause: the subnet's Storage service endpoint or matching storage network rule is absent or incorrect.
Custom routing alone does not establish the storage network rule. In the reported incident (a subnet VM can authenticate but receives network-denied responses from the storage account), that change would not correct the cause: the subnet's Storage service endpoint or matching storage network rule is absent or incorrect.
For the configuration goal, restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint. The Azure context is: A compute subnet must access Azure Storage over an authorized service endpoint without opening storage access to every subnet. Which TWO observations provide useful assurance? Select TWO answers.
Read an allowed blob from a VM in the approved subnet. This supplies observed evidence for restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint. It is not interchangeable with the second required check, try the same operation from a different unapproved subnet and verify denial, because that checks a separate success or failure boundary.
Try the same operation from a different unapproved subnet and verify denial. This supplies observed evidence for restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint. It is not interchangeable with the second required check, read an allowed blob from a VM in the approved subnet, because that checks a separate success or failure boundary.
A configured resource is not proof of live behavior. The required check must exercise read an allowed blob from a VM in the approved subnet on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Read an allowed blob from a VM in the approved subnet' even though the intended caller fails. This does not prove the required behavior for read an allowed blob from a vm in the approved subnet.
A release checklist recording 'Try the same operation from a different unapproved subnet and verify denial' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must try the same operation from a different unapproved subnet and verify denial on the actual workload to prove its independent boundary.
A stakeholder asks whether the proposed configuration guarantees: restrict the account public endpoint to the approved VNet subnet through an Azure Storage service endpoint. What qualification is technically accurate?
A service endpoint still targets Azure Storage's public endpoint; use a private endpoint when a private IP address is required. That remains a practical service boundary even after the recommended change (enable the Microsoft.Storage service endpoint on the subnet and add that subnet to the storage firewall rules) is implemented; retest it when identities, policies, service capacity or network paths change.
The successful check 'Read an allowed blob from a VM in the approved subnet' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: A service endpoint still targets Azure Storage's public endpoint; use a private endpoint when a private IP address is required.
The two checks cover separate behavior: 'Read an allowed blob from a VM in the approved subnet' and 'Try the same operation from a different unapproved subnet and verify denial'. Neither check removes the remaining operational limitation: A service endpoint still targets Azure Storage's public endpoint; use a private endpoint when a private IP address is required.
The incident (a subnet VM can authenticate but receives network-denied responses from the storage account) could recur if a related Azure dependency changes. The design still faces the limitation: A service endpoint still targets Azure Storage's public endpoint; use a private endpoint when a private IP address is required.
An Azure administrator must resolve a specific request: A data importer uses a rotating Azure Storage account key; a legacy partner still holds an old key. The expected outcome is: rotate secrets safely while ensuring clients migrate before their signing key is regenerated. Which option is appropriate?
Two account keys support staged rollover, but regeneration invalidates clients still using the replaced key. This achieves rotate secrets safely while ensuring clients migrate before their signing key is regenerated through inventory uses of key1 and key2, move clients to the alternate valid key, then regenerate the retired key instead of relying on merely similar resource settings.
That can break all clients using either previous key; that would not meet rotate secrets safely while ensuring clients migrate before their signing key is regenerated, for which the relevant Azure action is inventory uses of key1 and key2, move clients to the alternate valid key, then regenerate the retired key.
Unrestricted legacy key storage defeats rotation and least privilege; that would not meet rotate secrets safely while ensuring clients migrate before their signing key is regenerated, for which the relevant Azure action is inventory uses of key1 and key2, move clients to the alternate valid key, then regenerate the retired key.
Renaming metadata does not rotate cryptographic account keys; that would not meet rotate secrets safely while ensuring clients migrate before their signing key is regenerated, for which the relevant Azure action is inventory uses of key1 and key2, move clients to the alternate valid key, then regenerate the retired key.
Operations sees an unexpected outcome: After key1 regeneration a partner integration suddenly fails authentication. The original demand was: rotate secrets safely while ensuring clients migrate before their signing key is regenerated. Which cause is most consistent with the evidence?
The trace reports: After key1 regeneration a partner integration suddenly fails authentication. The causal misconfiguration is: The partner still signs its requests with the regenerated old key rather than the currently valid alternate. The targeted action is to move the partner integration to the valid alternate key or managed identity and complete staged key rollover.
The SAS was generated with excessive permissions or an excessively long expiry; that mechanism would be more consistent with an observation such as the vendor's token permits deletion and remains valid after the engagement ends, rather than this case's after key1 regeneration a partner integration suddenly fails authentication.
The proposed mechanism concerns only ARM resource-reading rights were granted to the identity, not the blob data-plane permission, which is not established by the observed after key1 regeneration a partner integration suddenly fails authentication. Test the more directly supported condition: The partner still signs its requests with the regenerated old key rather than the currently valid alternate.
The ad hoc SAS tokens were not tied to a revocable stored access policy or relevant signing-key change; that mechanism would be more consistent with an observation such as a retired project's service SAS remains functional even after the client is removed from the team roster, rather than this case's after key1 regeneration a partner integration suddenly fails authentication.
A service owner needs a practical fix after this failure: After key1 regeneration a partner integration suddenly fails authentication. What is the best remediation?
Move the partner integration to the valid alternate key or managed identity and complete staged key rollover. This addresses the documented failure condition: the partner still signs its requests with the regenerated old key rather than the currently valid alternate. Retest the affected operation and retain the original least-privilege boundaries.
Renaming metadata does not rotate cryptographic account keys. In the reported incident (after key1 regeneration a partner integration suddenly fails authentication), that change would not correct the cause: the partner still signs its requests with the regenerated old key rather than the currently valid alternate.
That can break all clients using either previous key. In the reported incident (after key1 regeneration a partner integration suddenly fails authentication), that change would not correct the cause: the partner still signs its requests with the regenerated old key rather than the currently valid alternate.
Unrestricted legacy key storage defeats rotation and least privilege. In the reported incident (after key1 regeneration a partner integration suddenly fails authentication), that change would not correct the cause: the partner still signs its requests with the regenerated old key rather than the currently valid alternate.
A deployment claims to meet: rotate secrets safely while ensuring clients migrate before their signing key is regenerated. The environment is: A data importer uses a rotating Azure Storage account key; a legacy partner still holds an old key. Which TWO test results would substantiate that claim? Select TWO answers.
Confirm a retired key can no longer authorize data operations. This supplies observed evidence for rotate secrets safely while ensuring clients migrate before their signing key is regenerated. It is not interchangeable with the second required check, confirm requests succeed with the alternate key before regenerating key1, because that checks a separate success or failure boundary.
Confirm requests succeed with the alternate key before regenerating key1. This supplies observed evidence for rotate secrets safely while ensuring clients migrate before their signing key is regenerated. It is not interchangeable with the second required check, confirm a retired key can no longer authorize data operations, because that checks a separate success or failure boundary.
A privileged administrator in a different subscription may succeed at 'Confirm a retired key can no longer authorize data operations' even though the intended caller fails. This does not prove the required behavior for confirm a retired key can no longer authorize data operations.
A release checklist recording 'Confirm requests succeed with the alternate key before regenerating key1' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must confirm requests succeed with the alternate key before regenerating key1 on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The relevant result must be observed by confirming a retired key can no longer authorize data operations on the affected Azure deployment.
An infrastructure design was selected to meet: rotate secrets safely while ensuring clients migrate before their signing key is regenerated. What caveat remains relevant during operation?
Key rotation does not revoke independently issued user delegation tokens or fix overprivileged identities by itself. That remains a practical service boundary even after the recommended change (inventory uses of key1 and key2, move clients to the alternate valid key, then regenerate the retired key) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Confirm a retired key can no longer authorize data operations' and 'Confirm requests succeed with the alternate key before regenerating key1'. Neither check removes the remaining operational limitation: Key rotation does not revoke independently issued user delegation tokens or fix overprivileged identities by itself.
The incident (after key1 regeneration a partner integration suddenly fails authentication) could recur if a related Azure dependency changes. The design still faces the limitation: Key rotation does not revoke independently issued user delegation tokens or fix overprivileged identities by itself.
The successful check 'Confirm a retired key can no longer authorize data operations' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Key rotation does not revoke independently issued user delegation tokens or fix overprivileged identities by itself.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
