Pass Your Microsoft SC-500 Exam Easy!

Drift detection compares infrastructure configuration and cannot remove credential material from the build definition.

Security scanning can identify exposed credentials but does not replace or revoke the current broad plaintext pipeline secret.

Changing module defaults leaves the pipeline’s high-privilege exposed secret usable for unrelated resource operations.

Changing one local module copy will not distribute consistent audited changes across many unrelated repositories.

Federated pipeline identity is good practice but unrelated to fixing the duplication and inconsistent patching of the baseline definition.

Drift detection examines running resources; it does not ensure all repositories consume the same reviewed security baseline.

Changing a module default might fix one symptom, but without evaluating the actual deployed resources it cannot establish control compliance.

Replacing the pipeline identity reduces credential risk, but cannot show whether the deployed resource satisfies the mandatory policy.

Plan-time policy checks are useful screening but do not prove the final deployed state satisfies the control after provider defaults and policy effects apply.

Container anonymity and blob permissions are separate from the connection protocol. Even a private, properly authorized container may receive requests over HTTP unless the account requires secure transfer; this option leaves the transport risk open.

Rotating an account key can reduce credential exposure, but a newly authenticated caller can still submit HTTP requests if the storage account permits them. Credential rotation does not enforce encryption in transit.

A valid SAS and a data-plane role determine authorization after a request reaches Storage. Diagnosing a role or firewall denial would not prohibit this legacy client from sending its blob requests over plaintext HTTP while secure transfer is off.

Rotating keys only replaces the secret. A developer who retains permission to list the new account keys can bypass data-role limits again; the permission and Shared Key access path must be constrained.

Versioning and soft delete let an operator recover deleted or overwritten blob data. They do not prevent a person who can obtain an account key from using that key to authorize read or write operations outside the intended Entra data-role scope.

The described problem is a valid account key granting overly broad access, not a blocked network request or an expired SAS. Distinguishing firewall from data authorization does not remove the management-plane capability to obtain the key.

Account-key rotation can affect clients using Shared Key authentication, but anonymous blob GET requests do not rely on possession of that key. A key change does not make a public container private.

Entra data-plane RBAC strengthens authenticated access, but it does not by itself override a container deliberately allowing anonymous reads. The existing container access level must be made private to stop the unauthenticated request.

Encryption at rest is normally available for blob data, but it does not prevent an anonymous caller from reading the plaintext through an authorized public endpoint. Leaving the container publicly readable keeps the immediate invoice disclosure open.

Immediate shared-key disablement without proven alternative authorization would strand the existing dependent clients.

Public-access restrictions are important independently; they do not test the application’s dependence on the shared key being rotated.

Secure TLS protects data in transit, but has no bearing on whether clients can authenticate after an account key is regenerated.

A controlled key rotation is useful when a key may have leaked or dependent callers need rollover. It does not override the account setting that permits anonymous access on containers.

Regenerating account keys only changes credentials used for authenticated Shared Key access. Anonymous requests do not depend on storage account keys, so enabling future public containers remains possible if AllowBlobPublicAccess is still true.

HTTPS enforces encrypted transport for requests but does not determine whether an unauthenticated user can read a blob. A public container served over TLS is still public; the account-level anonymous access setting is the relevant control.

Restricting public anonymous access prevents exposure to unauthenticated readers but does not save an earlier blob state when an authorized operator accidentally overwrites the object.

Immutable retention or legal hold prevents some writes or deletions while a policy is active. That is a compliance-preservation control, not the normal mechanism for continuing to overwrite an operational blob and later selecting a previous version.

A narrowly scoped Entra data role helps limit which principals can write, yet a properly authorized application can still overwrite a blob accidentally. Version-based recovery is needed to restore prior content in this case.

Logging may provide evidence that a write or delete was attempted, but a log entry does not stop the data-plane operation from altering a document before the retention period expires.

Blob versions and soft delete aid recovery after accidents, but they do not necessarily prohibit deletion or rewriting for a regulated WORM retention interval. An immutability policy is the control designed for the stated legal constraint.

Network firewall and SAS settings govern who can reach or authorize storage operations. They do not alone provide a defined, tamper-resistant retention period that prevents even a privileged authorized write or delete.

Disallowing Shared Key is a sensible hardening step after migration, but it might invalidate a key-signed SAS and aggravate this failure. It does not identify whether the current 403 comes from SAS scope, expiry, or the network filter.

Anonymous container settings control calls without an authorization token. The question concerns a request that includes a SAS and may be filtered by a firewall; making a container private does not diagnose the rejection.

Enabling HTTPS or fixing an older TLS client solves an insecure transport handshake, but the described client already negotiates HTTPS and receives a service response. This step would not establish why the request was denied.