This week is about the doors people forget to lock: Azure CLI next to the portal, guests who stayed after the project ended, the key that encrypts your storage, instructions hidden inside an email that an AI app reads, and the one account that should never sign in on a normal day.

How to use these: read the question, pick your answer before you open Answer , and write it down (or in the comments). Then check the "why not the others" part even if you got it right: that is where the exam traps live. Every scenario, name and number is made up by me; only the question formats follow the real exam.

Table of contents

Q016: MFA for the portal, but the CLI walked right past it

Q017: The project ended in March. The guests are still here

Q018: Our key, our vault: customer-managed keys for storage

Q019: The attack was not in the chat. It was in the email

Q020: The break-glass account signed in.…