View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 21

An organization wants to prevent users from assigning permissions that are broader than necessary to Azure resources. Which security principle should guide the access design?

1. Least privilege
2. High availability
3. Data redundancy
4. Load balancing

Correct Answer: 1

Explanation

The principle of least privilege means granting users, applications, and services only the permissions they require to perform their intended tasks. Applying this principle reduces the potential impact of compromised accounts and limits accidental changes to resources. In Azure, role assignments can be scoped appropriately at management group, subscription, resource group, or resource levels. High availability, data redundancy, and load balancing address resilience or performance rather than authorization. Therefore, least privilege should guide an access design where users must not receive broader permissions than necessary.

Question 22

A company has employees who need temporary elevated permissions to perform administrative tasks. Which Microsoft Entra feature can help provide time-limited privileged access?

1. Security defaults
2. Microsoft Entra Privileged Identity Management
3. Azure DNS
4. Azure Load Balancer

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management, or PIM, helps organizations manage, control, and monitor access to important resources and privileged roles. Eligible users can activate elevated permissions when needed rather than maintaining permanent privileged access. Organizations can configure requirements such as approval, justification, and time limits for privileged role activation. Security defaults provide basic identity security settings but do not provide the same privileged-access management capabilities. Azure DNS and Load Balancer address networking functions. Therefore, PIM is appropriate when administrators need controlled and temporary elevation of privileges.

Question 23

A security administrator needs to prevent a storage account from being created in regions that are not approved by the organization. Which Azure service should be used?

1. Azure Bastion
2. Azure Policy
3. Azure Monitor
4. Azure VPN Gateway

Correct Answer: 2

Explanation

Azure Policy can enforce organizational standards by evaluating resource configurations and controlling whether resources comply with defined requirements. A policy can restrict resource deployments to approved Azure regions, helping organizations maintain regulatory, operational, or security requirements. Azure Bastion provides secure administrative access to virtual machines, Azure Monitor provides monitoring capabilities, and VPN Gateway provides secure network connectivity. Therefore, Azure Policy is the appropriate service for preventing resources from being deployed in regions that the organization has not approved.

Question 24

A company wants to allow access to a storage account only through selected virtual networks and prevent direct access from the public internet. Which network security feature is appropriate?

1. Storage firewall and virtual network rules
2. Azure Traffic Manager
3. Azure CDN
4. Public DNS

Correct Answer: 1

Explanation

Azure Storage provides network access controls that can restrict access to selected virtual networks and IP addresses. Storage firewall and virtual network rules can help limit network access to approved locations and reduce unnecessary public exposure. Traffic Manager distributes traffic using DNS-based routing, while Azure CDN accelerates content delivery and public DNS manages name resolution. These services do not directly provide the required storage network restriction. Therefore, configuring the storage account’s firewall and virtual network rules is an appropriate approach for limiting access to approved network locations.

Question 25

An administrator wants to assign a role to a user so the user can manage only resources within one specific resource group. At which scope should the role assignment be made?

1. Tenant
2. Subscription
3. Resource group
4. Management group

Correct Answer: 3

Explanation

Azure RBAC supports role assignments at different scopes, including management groups, subscriptions, resource groups, and individual resources. Assigning a role at the resource-group scope limits the permissions granted by that role to resources contained within that resource group, subject to the role definition. This can support the principle of least privilege by avoiding unnecessary access across an entire subscription or management group. Therefore, when a user needs permissions limited to one resource group, assigning the appropriate role at the resource-group scope is suitable.

Question 26

A company wants to store encryption keys separately from the application that uses them and control access to those keys through centralized security policies. Which Azure service should be used?

1. Azure Key Vault
2. Azure Load Balancer
3. Azure Virtual Network
4. Azure Monitor

Correct Answer: 1

Explanation

Azure Key Vault provides centralized management for cryptographic keys, secrets, and certificates. Applications can use Key Vault to access protected cryptographic material without embedding keys directly in application code or configuration files. Access to the vault can be controlled through identity and authorization mechanisms, helping organizations manage sensitive security material more securely. Azure Load Balancer distributes network traffic, Virtual Network provides network isolation and connectivity, and Azure Monitor handles monitoring and diagnostics. Therefore, Azure Key Vault is the appropriate service for centrally managing encryption keys.

Question 27

A security team wants to continuously assess Azure resources and receive recommendations when resources have potentially insecure configurations. Which capability should they use?

1. Microsoft Defender for Cloud
2. Azure Files
3. Azure DNS
4. Azure Queue Storage

Correct Answer: 1

Explanation

Microsoft Defender for Cloud provides security posture management capabilities that can continuously assess supported cloud resources and identify security recommendations. It can help organizations understand security weaknesses, improve configurations, and monitor the overall security posture of their environment. Azure Files provides managed file shares, Azure DNS provides name resolution, and Queue Storage supports asynchronous messaging. These services do not provide centralized cloud security posture assessment. Therefore, Microsoft Defender for Cloud is the appropriate capability for identifying potentially insecure configurations and receiving security recommendations.

Question 28

An administrator needs to determine which changes were made to Azure resources, who performed the operations, and when those operations occurred. Which log should be reviewed first?

1. DNS query logs
2. Azure Activity Log
3. Application cache
4. Storage performance metrics

Correct Answer: 2

Explanation

Azure Activity Log records subscription-level management operations and can provide information about actions performed on Azure resources. Security and operations teams can use it to investigate activities such as resource creation, deletion, configuration changes, and other administrative operations. DNS query logs focus on name-resolution activity, application cache stores temporary application information, and storage performance metrics describe resource behavior rather than administrative actions. Therefore, Azure Activity Log should be reviewed first when investigating who performed management operations and when those changes occurred.

Question 29

A company wants to require multifactor authentication whenever administrators access sensitive Azure management resources. Which solution can enforce this condition based on user role and application?

1. Microsoft Entra Conditional Access
2. Azure Storage Explorer
3. Azure Load Balancer
4. Azure Private DNS

Correct Answer: 1

Explanation

Microsoft Entra Conditional Access can evaluate conditions such as user identity, group or role membership, application, device, location, and risk before granting access. An organization can create a policy requiring multifactor authentication for administrators accessing sensitive applications or resources. Storage Explorer is a management utility, Load Balancer distributes network traffic, and Private DNS provides name resolution within private environments. Therefore, Conditional Access is the appropriate solution when the organization needs to require MFA based on contextual access conditions and administrative roles.

Question 30

A security engineer wants to connect to a Windows virtual machine using RDP without assigning the virtual machine a public IP address. Which Azure service should be considered?

1. Azure Bastion
2. Azure Front Door
3. Azure Traffic Manager
4. Azure CDN

Correct Answer: 1

Explanation

Azure Bastion provides browser-based RDP and SSH connectivity to virtual machines through the Azure portal. A key benefit is that the virtual machines do not need public IP addresses for this administrative access path. This can reduce exposure of management ports to the public internet. Azure Front Door provides global application delivery, Traffic Manager provides DNS-based traffic routing, and Azure CDN focuses on content delivery. Therefore, Azure Bastion is the appropriate service for securely administering a virtual machine without directly exposing its RDP endpoint publicly.

Question 31

An organization wants to detect threats affecting virtual machines and other supported workloads while receiving security alerts from a centralized service. Which Microsoft solution is designed for this purpose?

1. Microsoft Defender for Cloud
2. Azure Resource Graph
3. Azure Cost Management
4. Azure DNS

Correct Answer: 1

Explanation

Microsoft Defender for Cloud provides security capabilities for supported cloud workloads and can generate security alerts when potentially malicious activity or other threats are detected. It also provides security recommendations and posture information to help organizations improve protection. Azure Resource Graph is used to query resource information, Cost Management focuses on financial analysis, and Azure DNS handles domain name resolution. Therefore, Microsoft Defender for Cloud is the appropriate Microsoft security solution for centralized threat detection and security alerts across supported workloads.

Question 32

A company has an Azure SQL Database that should not be reachable through a public endpoint. Applications running inside an Azure virtual network still need to access it privately. Which feature should be configured?

1. Public IP address
2. Private endpoint
3. Internet-facing load balancer
4. Public DNS record

Correct Answer: 2

Explanation

A private endpoint provides a private IP address within an Azure virtual network for supported Azure services. This allows applications in the virtual network to communicate with the service through private connectivity rather than relying on a public endpoint. Using private endpoints can reduce public exposure and support network isolation requirements. A public IP address and public DNS record expose services through public networking, while an internet-facing load balancer is intended for distributing publicly accessible traffic. Therefore, a private endpoint is appropriate for private access to an Azure SQL Database.

Question 33

An organization wants to make sure all storage accounts use secure transfer and deny configurations that violate this requirement. Which Azure governance mechanism can enforce this setting?

1. Azure Policy
2. Azure Bastion
3. Azure Load Balancer
4. Azure Traffic Manager

Correct Answer: 1

Explanation

Azure Policy can evaluate resource configurations and enforce organizational security requirements. An organization can use policy definitions and assignments to audit or deny resources that do not meet specified standards. For example, a policy can require secure transfer settings for supported storage resources. Azure Bastion provides secure VM administration, Load Balancer distributes network traffic, and Traffic Manager performs DNS-based traffic routing. Therefore, Azure Policy is the appropriate governance mechanism for consistently enforcing security configuration requirements across Azure resources.

Question 34

A developer needs an application running in Azure to access secrets stored in Key Vault without storing credentials inside the application. Which identity mechanism is most appropriate?

1. Managed identity
2. Public IP address
3. Network Security Group
4. Azure Firewall policy

Correct Answer: 1

Explanation

A managed identity allows an Azure resource or application to authenticate to supported services without requiring developers to embed credentials in application code. The application can use its managed identity to request access to Azure Key Vault, provided the identity has been granted the required permissions. This reduces the need to manage passwords or client secrets within application configuration. A public IP address controls network addressing, an NSG filters network traffic, and a Firewall policy defines firewall rules. Therefore, a managed identity is appropriate for secure application access to Key Vault.

Question 35

A security administrator needs to determine whether a user should receive permanent administrator privileges or activate them only when required. Which access-management approach supports temporary activation?

1. Permanent role assignment
2. Microsoft Entra Privileged Identity Management
3. Public endpoint access
4. Shared administrator account

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management supports just-in-time and controlled privileged access. Instead of maintaining permanent active administrator permissions, eligible users can activate privileged roles when required and for a defined period. Organizations can also configure additional controls such as approval, multifactor authentication, and justification. Permanent assignments and shared administrator accounts increase the amount of standing privileged access and can make accountability more difficult. Public endpoint access is a networking concern. Therefore, Microsoft Entra Privileged Identity Management is the appropriate approach for managing temporary administrative privileges.

Question 36

A company wants to protect an internet-facing application from SQL injection and cross-site scripting attacks. Which component should be placed in the application traffic path?

1. Azure Web Application Firewall
2. Azure Storage Queue
3. Azure VPN Gateway
4. Azure Private DNS

Correct Answer: 1

Explanation

Azure Web Application Firewall, or WAF, provides application-layer protection for web applications. It can inspect HTTP traffic and help detect and block common attacks such as SQL injection and cross-site scripting. WAF capabilities are particularly useful for applications exposed to untrusted internet traffic. VPN Gateway provides encrypted network connectivity, Private DNS manages private name resolution, and Storage Queue provides asynchronous message storage. Therefore, a Web Application Firewall should be used when the primary requirement is protection against common web application attacks.

Question 37

An administrator wants to grant a service principal access only to a specific storage account instead of the entire subscription. Which Azure RBAC scope provides the narrowest scope listed?

1. Management group
2. Subscription
3. Resource group
4. Individual resource

Correct Answer: 4

Explanation

Azure RBAC supports role assignments at multiple scopes, including management groups, subscriptions, resource groups, and individual resources. Assigning a role directly to an individual storage account provides a narrower scope than assigning the same role at a resource group, subscription, or management group level. This can help implement least privilege when an identity needs access to only one resource. Therefore, among the listed choices, the individual resource scope provides the narrowest scope for granting the service principal the required permissions.

Question 38

A security team wants to restrict network traffic to a subnet by allowing only HTTPS connections from approved sources. Which Azure control is most directly suited to this requirement?

1. Azure Key Vault
2. Network Security Group
3. Microsoft Entra ID Protection
4. Azure Policy

Correct Answer: 2

Explanation

A Network Security Group can contain inbound and outbound rules that control network traffic based on source and destination addresses, ports, and protocols. Security administrators can create rules that allow HTTPS traffic on TCP port 443 from approved sources while denying other unwanted traffic according to the applicable rule set. Azure Key Vault manages sensitive information, Entra ID Protection focuses on identity risk, and Azure Policy governs resource configurations. Therefore, an NSG is the control most directly suited to filtering network traffic to a subnet.

Question 39

An organization wants to identify risky sign-ins and potentially compromised user identities before granting access to cloud resources. Which Microsoft Entra capability provides risk-based identity protection?

1. Microsoft Entra ID Protection
2. Azure Bastion
3. Azure Firewall
4. Azure Storage

Correct Answer: 1

Explanation

Microsoft Entra ID Protection uses identity-related signals to identify potentially risky users and sign-ins. It can help organizations detect suspicious authentication activity and support responses to identity risks. These capabilities can be combined with identity policies to help protect accounts and reduce the impact of compromised credentials. Azure Bastion provides secure virtual machine administration, Azure Firewall filters network traffic, and Azure Storage provides data storage. Therefore, Microsoft Entra ID Protection is the appropriate capability for identifying risky sign-ins and potentially compromised identities.

Question 40

A security architect wants administrators to authenticate with an additional verification method and also wants access decisions to consider device status and sign-in risk. Which Microsoft Entra capability can combine these conditions into an access policy?

1. Azure Activity Log
2. Microsoft Entra Conditional Access
3. Azure Monitor
4. Azure Storage firewall

Correct Answer: 2

Explanation

Microsoft Entra Conditional Access can evaluate multiple contextual signals when deciding whether access should be allowed, blocked, or subjected to additional requirements. Policies can consider factors such as user identity, device state, location, application, and sign-in risk. The organization can also require multifactor authentication when specified conditions are met. Azure Activity Log records Azure management events, Azure Monitor provides observability, and Storage firewall rules control network access to storage resources. Therefore, Conditional Access is the appropriate capability for combining identity and contextual conditions into access decisions.