A service principal is used by a CI/CD pipeline to deploy resources to Azure. The pipeline was working, but after a security review, the service principal's permissions were changed from 'Contributor' to a custom role that includes only 'Microsoft.Resources/subscriptions/resourceGroups/write'. Now the pipeline fails with an 'AuthorizationFailed' error when trying to create a virtual network. What is the most likely cause?

The service principal's client secret has expired

The custom role does not include the 'Microsoft.Network/virtualNetworks/write' permission

The pipeline is using the wrong tenant ID

The virtual network already exists and the pipeline is trying to create a duplicate

A user reports they cannot access a storage account in Azure. The user has the 'Storage Blob Data Reader' role on the storage account. The user can authenticate but receives a '403 Forbidden' error when trying to list blobs. The storage account's firewall is set to 'Enabled from selected virtual networks and IP addresses'. What is the most likely cause?

The user's 'Storage Blob Data Reader' role has been revoked

The storage account's shared access signature (SAS) token is invalid

The user's IP address is not included in the storage account's firewall allow list

The user's Azure AD token has expired

A new employee was added to the 'Security Readers' group in Azure AD, which is assigned the 'Reader' role on the production resource group. The employee can see the resource group in the portal but cannot view the virtual machines inside it. What is the most likely cause?

The employee's account is not licensed for Azure Active Directory

The employee needs to be added to the 'Virtual Machine Reader' role separately

The 'Reader' role does not include permission to view virtual machines

The role assignment on the resource group has not propagated to the child resources yet

A user cannot decrypt a file even though they have the correct password. What should be checked?

Whether the user's monitor is calibrated

Whether the user's mouse is optical

Whether the user has permission to the encryption key

Whether the user's keyboard is wireless

A user is a member of a group that has been granted access to a resource, but the user still cannot access it. What should be investigated?

Whether the user's email is configured correctly

Whether the group membership is correctly assigned and active

Whether the user's password is strong enough

Whether the user's device has the latest OS updates

Palo Alto NetworksCertified Cloud Security Engineer

Domain 6Objective 6

6.6 Identify and Describe Access and Permissions Troubleshooting Issues CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Part of the Troubleshooting domain, which accounts for 16% of the CLOUD-SECURITY-ENGINEER exam.

40questions here

8free pages

13concepts

16%of the exam

Questions 16–20

16expert · hard
A service principal is used by a CI/CD pipeline to deploy resources to Azure. The pipeline was working, but after a security review, the service principal's permissions were changed from 'Contributor' to a custom role that includes only 'Microsoft.Resources/subscriptions/resourceGroups/write'. Now the pipeline fails with an 'AuthorizationFailed' error when trying to create a virtual network. What is the most likely cause?
Select an answer first
17expert · hard
A user reports they cannot access a storage account in Azure. The user has the 'Storage Blob Data Reader' role on the storage account. The user can authenticate but receives a '403 Forbidden' error when trying to list blobs. The storage account's firewall is set to 'Enabled from selected virtual networks and IP addresses'. What is the most likely cause?
Select an answer first
18application · medium
A new employee was added to the 'Security Readers' group in Azure AD, which is assigned the 'Reader' role on the production resource group. The employee can see the resource group in the portal but cannot view the virtual machines inside it. What is the most likely cause?
Select an answer first
19foundation · easy
A user cannot decrypt a file even though they have the correct password. What should be checked?
Select an answer first
20foundation · easy
A user is a member of a group that has been granted access to a resource, but the user still cannot access it. What should be investigated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

6.6 Identify and Describe Access and Permissions Troubleshooting Issues CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

A new employee was added to the 'Security Readers' group in Azure AD, which is assigned the 'Reader' role on the production resource group. The employee can see the resource group in the portal but cannot view the virtual machines inside it. What is the most likely cause?

A user cannot decrypt a file even though they have the correct password. What should be checked?

A user is a member of a group that has been granted access to a resource, but the user still cannot access it. What should be investigated?

Keep studying — Troubleshooting