Pass Your Microsoft SC-500 Exam Easy!

Container Apps revisions are a different service mechanism and do not address an Azure Container Instance’s storage credential.

Ingress access restrictions protect inbound traffic but cannot narrow a stolen shared storage account key’s data-plane authority.

ACR image-pull rights govern the registry, not runtime authorization to a storage account; the high-privilege account key still permits broad storage operations.

Replacing a storage credential is a distinct problem and does not generally reverse an insecure ingress/revision configuration.

Rolling back just once without repairing the source template recreates the insecure setting with the next revision.

Changing registry identity may be needed if credential exposure was found, but not every unsafe revision is caused by image-pull secrets.

VNet integration protects outbound or private network paths; it does not authorize unauthenticated payment modifications at the HTTP endpoint.

A shared host/function key is an application access secret, not proof that a particular human principal may amend a payment record.

Managed identity gives the Function an outbound workload identity for resources such as Key Vault, not inbound caller authentication.

Function HTTP caller authorization is unrelated to the outbound managed identity the slot uses to read a vault reference.

Enabling endpoint authentication does not grant the slot’s actual managed identity Key Vault secret-read privileges.

Network path checks are valid if a vault firewall is denying requests, but the scenario’s identity transition specifically requires verifying the slot principal first.

Function-key security and application authorization determine who can invoke the Function, not its outbound network route to Azure SQL.

Key Vault managed-identity authorization does not route the Function’s SQL connection through a SQL private endpoint.

Platform authentication for inbound Function requests is unrelated to DNS and outbound routing to the SQL private endpoint.

Function keys can be copied and shared and are not attributable business authorization for privileged operations.

A login prompt without per-operation authorization leaves any key holder able to execute sensitive actions, so it does not solve the described defect.

Key Vault managed identity deals with the Function’s access to downstream secrets, not caller permissions to perform administrative actions.

Secure run-history inputs/outputs protect logging confidentiality, not the leaked URL that currently authorizes trigger calls.

Least-privilege connector access limits consequences after triggering but does not stop an outsider from activating the HTTP workflow.

Idempotency prevents repeated financial side effects but cannot identify or block the untrusted user invoking the trigger.

Run-history redaction protects output confidentiality but cannot narrow the connector’s underlying directory-wide access token.

Idempotency addresses duplicate effects after retries, not access to unrelated directory objects and mailboxes.

Output-field masking does not limit what the connector can read from the directory while overbroad scopes remain active.

Protecting trigger signatures is useful for invocation security, but does not automatically hide downstream action inputs and outputs.

Idempotent processing prevents duplicate transactions, not leakage of a single transaction payload into run history.

Caller authentication secures entry but sensitive values can still appear in the diagnostic history of authorized runs.

Secure run-history data reduces information leakage but does not identify or deduplicate an already completed refund.

Connector least privilege restricts accounts but does not make non-idempotent retries safe.

Blind retries after timeout can execute the same financial effect twice when the initial response was lost.

Rotating an application secret helps credential hygiene but cannot force visitors to authenticate to an open HTTP endpoint.

Enforcing modern TLS protects confidentiality in transit, not authentication or access rights to the application.

Separate staging/production slots improve environment segregation but do not require login for the publicly reachable application.