View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 161

Which Azure service can help protect SQL workloads by providing security recommendations and threat detection capabilities?

1. Azure DNS
2. Microsoft Defender for SQL
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 2

Explanation

Microsoft Defender for SQL provides security capabilities designed to protect supported Azure SQL workloads. It can help identify suspicious database activity, security weaknesses, and potential threats while providing recommendations that can improve the security posture of SQL resources. This protection complements database access controls, encryption, and network security measures. Azure DNS provides name resolution, Azure Bastion provides secure administrative connectivity, and Traffic Manager performs traffic routing. Therefore, Microsoft Defender for SQL is the appropriate service when an organization requires specialized security protection for supported SQL workloads.

Question 162

A company wants to prevent an Azure Storage account from accepting connections that do not use encrypted transport. Which configuration should be enforced?

1. Secure transfer required
2. Public network access
3. Anonymous blob access
4. HTTP-only access

Correct Answer: 1

Explanation

The secure transfer required setting helps ensure that supported Azure Storage requests use encrypted transport such as HTTPS. Requiring secure transfer reduces the risk of sensitive information being transmitted over an unencrypted connection. Organizations should enable this setting when they want to enforce encrypted communication between clients and supported Storage services. Public network access controls where the service can be reached, anonymous access concerns authorization, and HTTP-only communication would not provide encrypted transport. Therefore, secure transfer required is the appropriate Storage security configuration.

Question 163

An administrator needs to restrict access to an Azure SQL server so that only approved client IP addresses can connect. Which control should be configured?

1. Azure Resource Graph
2. SQL firewall rules
3. Azure Bastion
4. Microsoft Sentinel

Correct Answer: 2

Explanation

Azure SQL firewall rules can restrict connections to an Azure SQL server based on specified IP address ranges. Administrators can define approved client addresses or ranges and prevent connections originating outside those allowed ranges. This provides a network-level access control layer for SQL connectivity and should be combined with appropriate authentication and authorization mechanisms. Azure Resource Graph queries resource information, Azure Bastion provides VM administration, and Microsoft Sentinel provides security analytics. Therefore, SQL firewall rules are the appropriate control for restricting SQL access by client IP address.

Question 164

Which encryption feature protects Azure SQL Database data at rest without requiring applications to change how they access the database?

1. Always Encrypted
2. Transparent Data Encryption
3. Azure DDoS Protection
4. Network Security Group

Correct Answer: 2

Explanation

Transparent Data Encryption, commonly called TDE, encrypts database files at rest and operates transparently to applications. Because encryption and decryption are handled by the database platform, application developers generally do not need to modify their database queries or application logic. Always Encrypted addresses a different scenario by protecting sensitive column data from certain database administrators and services. DDoS Protection mitigates network attacks, while NSGs control network traffic. Therefore, TDE is the appropriate feature when the requirement is transparent encryption of Azure SQL Database data at rest.

Question 165

A security administrator wants to protect sensitive database columns so that the database service cannot access the plaintext values during normal processing. Which Azure SQL feature is designed for this purpose?

1. Always Encrypted
2. Azure Firewall
3. Transparent Data Encryption
4. Azure Bastion

Correct Answer: 1

Explanation

Always Encrypted is designed to protect sensitive data stored in selected database columns by keeping encryption keys under the control of trusted client applications or users. The approach helps prevent the database service from accessing plaintext values for protected columns during normal operations. This differs from Transparent Data Encryption, which primarily protects database files at rest. Azure Firewall controls network traffic and Bastion provides secure administrative connectivity to virtual machines. Therefore, Always Encrypted is the appropriate feature when stronger protection is required for sensitive database column values.

Question 166

Which Azure security feature can make blob data immutable so that it cannot be modified or deleted during a defined retention period?

1. Azure Resource Graph
2. Immutable Blob Storage
3. Azure Bastion
4. Azure Load Balancer

Correct Answer: 2

Explanation

Immutable Blob Storage allows organizations to retain blob data in a write-once, read-many state for a configured retention period. During the applicable immutability period, protected data cannot be modified or deleted according to the configured policy. This can support compliance and data-retention requirements where records must remain unchanged. Azure Resource Graph queries resource information, Bastion provides secure VM administration, and Load Balancer distributes network traffic. Therefore, Immutable Blob Storage is the appropriate feature when stored blob data must remain protected against modification or deletion.

Question 167

An organization wants to separate administrative responsibilities so that one team manages security policies while another manages application resources. Which Azure concept can help enforce these permissions?

1. Azure CDN
2. Azure Role-Based Access Control
3. Azure Traffic Manager
4. Azure DNS

Correct Answer: 2

Explanation

Azure Role-Based Access Control allows organizations to assign permissions according to job responsibilities. Different teams can receive different built-in or custom roles at appropriate scopes, supporting separation of duties and least privilege. For example, security administrators can receive permissions needed for security-related tasks while application administrators receive only the permissions required to manage application resources. CDN, Traffic Manager, and DNS provide application delivery or networking functions rather than granular authorization. Therefore, Azure RBAC is the appropriate mechanism for separating administrative responsibilities through controlled permissions.

Question 168

Which Azure feature can automatically apply a required configuration to resources when a policy supports a modification effect?

1. Azure Policy
2. Azure Bastion
3. Azure Key Vault
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Azure Policy can use supported effects such as Modify to change or add certain resource properties when resources are created or updated. This allows organizations to enforce governance requirements while automatically bringing supported resources into compliance. For example, a policy can add required tags or modify supported configurations when appropriate permissions and policy definitions are available. Azure Bastion provides VM access, Key Vault manages secrets and keys, and DDoS Protection mitigates denial-of-service attacks. Therefore, Azure Policy is the appropriate governance capability for automatically applying supported configuration changes.

Question 169

A company wants to reduce the risk of unauthorized changes to a critical Azure resource while still allowing administrators to view the resource. Which resource lock provides the strongest restriction?

1. CanNotDelete
2. Audit
3. ReadOnly
4. Append

Correct Answer: 3

Explanation

A ReadOnly resource lock prevents modifications and deletion of the protected resource while allowing authorized users to view it. This provides stronger protection than a CanNotDelete lock, which prevents deletion but still allows modifications. Audit and Append are Azure Policy effects rather than resource lock types. ReadOnly locks should be used carefully because they can interfere with legitimate management operations and some dependent actions. Therefore, ReadOnly is the appropriate resource lock when the goal is to prevent configuration changes as well as deletion while preserving read access.

Question 170

Which Microsoft Entra feature can use device compliance as a condition before allowing access to a protected application?

1. Azure Policy
2. Microsoft Entra Conditional Access
3. Azure Firewall
4. Azure Resource Graph

Correct Answer: 2

Explanation

Microsoft Entra Conditional Access can evaluate device-related conditions when making access decisions. Organizations can configure policies that require a device to meet defined compliance requirements before users are allowed to access selected applications or services. Additional controls such as multifactor authentication can also be included in the same access policy. Azure Policy governs Azure resources, Azure Firewall controls network traffic, and Resource Graph queries resource information. Therefore, Microsoft Entra Conditional Access is the appropriate identity control for enforcing access requirements based on device compliance.

Question 171

An administrator needs to allow an Azure application to retrieve a Key Vault secret while ensuring the application cannot delete secrets. What approach should be used?

1. Grant only the required secret permissions
2. Assign Owner at subscription scope
3. Assign Global Administrator
4. Allow anonymous Key Vault access

Correct Answer: 1

Explanation

Key Vault access should follow the principle of least privilege. If an application only needs to retrieve a secret, its identity should receive only the permissions necessary for reading that secret or supported secret operations. Granting Owner at subscription scope would provide excessive permissions and could allow unrelated resource management actions. Global Administrator is an identity administration role and is unnecessary for application secret retrieval. Anonymous access would remove authorization controls. Therefore, administrators should grant only the required Key Vault secret permissions to the application’s identity.

Question 172

Which Azure service can provide security alerts and recommendations specifically for Azure virtual machines and supported compute workloads?

1. Microsoft Defender for Servers
2. Azure DNS
3. Azure Traffic Manager
4. Azure Queue Storage

Correct Answer: 1

Explanation

Microsoft Defender for Servers provides security capabilities for supported server workloads, including Azure virtual machines. Depending on the enabled plan and integrations, it can provide threat protection, security recommendations, vulnerability-related insights, and other workload protection features. Azure DNS handles name resolution, Traffic Manager provides traffic routing, and Queue Storage supports messaging. Therefore, Microsoft Defender for Servers is the appropriate security service when organizations need specialized protection and security insights for supported virtual machine and server workloads.

Question 173

An organization wants to make sure users can access a sensitive application only from approved network locations. Which Microsoft Entra capability can enforce this condition?

1. Microsoft Entra Conditional Access
2. Azure Storage
3. Azure Load Balancer
4. Azure Resource Graph

Correct Answer: 1

Explanation

Microsoft Entra Conditional Access can use location-based conditions to control access to applications and services. Administrators can define trusted or named locations and create policies that require additional authentication or block access when users connect from locations that do not meet organizational requirements. Azure Storage provides data services, Load Balancer distributes network traffic, and Resource Graph queries Azure resource information. Therefore, Microsoft Entra Conditional Access is the appropriate capability for enforcing identity-based access restrictions according to approved network locations.

Question 174

Which Azure service can help centralize security alerts from supported Microsoft security products for investigation and response?

1. Azure CDN
2. Microsoft Sentinel
3. Azure Bastion
4. Azure DNS

Correct Answer: 2

Explanation

Microsoft Sentinel provides centralized security analytics capabilities and can ingest data and alerts from Microsoft security services and many other sources. Security teams can use Sentinel to correlate events, investigate incidents, create analytics rules, and automate selected response actions. This makes it useful when organizations need a centralized platform for security monitoring across multiple systems. Azure CDN provides content delivery, Bastion provides secure VM administration, and DNS manages name resolution. Therefore, Microsoft Sentinel is the appropriate service for centralized security alert analysis and response.

Question 175

A company needs to maintain previous versions of Azure Storage blobs so that users can recover an earlier version after an accidental overwrite. Which capability should be enabled?

1. Blob versioning
2. Azure Firewall
3. Private DNS
4. Azure Bastion

Correct Answer: 1

Explanation

Blob versioning automatically maintains previous versions of blob data when supported changes occur. This allows users or applications to recover an earlier version after an accidental overwrite or other modification. Versioning provides a useful recovery mechanism and can complement blob soft delete and other data-protection features. Azure Firewall filters network traffic, private DNS supports private name resolution, and Azure Bastion provides secure administrative access to virtual machines. Therefore, blob versioning is the appropriate Storage capability when previous blob versions need to remain available for recovery.

Question 176

Which Azure networking feature can provide private name resolution for resources accessed through private endpoints?

1. Azure Public DNS
2. Private DNS zone
3. Azure CDN
4. Traffic Manager

Correct Answer: 2

Explanation

Private DNS zones can provide name resolution for private IP addresses associated with resources such as private endpoints. They allow applications inside appropriate virtual networks to resolve service names to private addresses rather than relying on public name resolution. This is important when designing private connectivity architectures because DNS must correctly resolve the service endpoint to its private network interface. Public DNS is intended for public name resolution, while CDN and Traffic Manager provide content delivery and traffic-routing functions. Therefore, a private DNS zone is appropriate for private endpoint name resolution.

Question 177

An administrator wants to determine whether a resource is compliant with a specific Azure Policy definition. Which information should be reviewed?

1. Policy compliance state
2. DNS cache
3. Load balancer health probe
4. VPN tunnel status

Correct Answer: 1

Explanation

Azure Policy provides compliance information showing whether resources meet the requirements defined by assigned policy definitions. Administrators can review compliance states to identify resources that are compliant or noncompliant and investigate the specific policy requirements that were not satisfied. DNS cache information, load balancer health probes, and VPN tunnel status address different networking or service concerns and do not provide Azure Policy compliance results. Therefore, the policy compliance state should be reviewed when determining whether a resource satisfies an assigned Azure Policy definition.

Question 178

A security team wants to inspect network traffic and apply centralized filtering rules between different Azure network segments. Which service is designed for this purpose?

1. Azure Firewall
2. Azure Key Vault
3. Microsoft Entra ID Protection
4. Azure Resource Graph

Correct Answer: 1

Explanation

Azure Firewall is a managed, stateful network security service that can provide centralized traffic filtering for Azure network environments. It supports network and application-level rules and can be used to control traffic between network segments according to organizational security requirements. Depending on the configuration, it also supports features such as threat intelligence and DNAT. Key Vault protects secrets and cryptographic keys, Entra ID Protection handles identity risks, and Resource Graph queries resources. Therefore, Azure Firewall is the appropriate service for centralized network traffic filtering.

Question 179

Which Azure security feature can require additional authentication when a user account is detected as presenting elevated sign-in risk?

1. Azure Resource Lock
2. Azure Policy
3. Microsoft Entra Conditional Access
4. Azure Load Balancer

Correct Answer: 3

Explanation

Microsoft Entra Conditional Access can use sign-in risk information from Microsoft Entra ID Protection when evaluating access requests. Organizations can configure policies that require multifactor authentication or apply other controls when risk reaches a specified level. This provides adaptive protection against potentially compromised accounts without requiring the same additional verification for every sign-in. Resource locks protect Azure resources, Azure Policy governs configurations, and Load Balancer distributes network traffic. Therefore, Microsoft Entra Conditional Access is the appropriate feature for requiring additional authentication based on elevated sign-in risk.

Question 180

An organization wants to ensure that sensitive Azure resources can be accessed only through approved private network paths and not through their public endpoints. Which architecture should be considered?

1. Public endpoints with unrestricted access
2. Private endpoints with appropriate network controls
3. Public DNS without network restrictions
4. Internet-facing load balancers

Correct Answer: 2

Explanation

Private endpoints provide private connectivity between a virtual network and supported Azure services by using private IP addresses. Organizations can combine private endpoints with appropriate network controls, DNS configuration, and access permissions to reduce public exposure and restrict how sensitive services are accessed. Public endpoints with unrestricted access and internet-facing load balancers increase public exposure, while public DNS alone does not create private network connectivity. Therefore, using private endpoints together with appropriate network controls is the architecture that best supports private access requirements for sensitive Azure resources.