View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 181

Which Azure service can help identify vulnerabilities in supported virtual machine workloads and provide recommendations for remediation?

1. Azure DNS
2. Microsoft Defender for Servers
3. Azure Traffic Manager
4. Azure Queue Storage

Correct Answer: 2

Explanation

Microsoft Defender for Servers provides security capabilities for supported server workloads, including Azure virtual machines. Depending on the enabled plan and configuration, it can provide vulnerability-related insights, security recommendations, threat protection, and other workload security capabilities. These features help administrators identify weaknesses and take remediation actions before vulnerabilities can be exploited. Azure DNS handles name resolution, Traffic Manager routes traffic, and Queue Storage provides messaging functionality. Therefore, Microsoft Defender for Servers is the appropriate service when vulnerability assessment and security protection are required for supported virtual machine workloads.

Question 182

An organization wants to ensure that users cannot create Azure resources without applying required security tags. Which Azure service should enforce this requirement?

1. Azure Policy
2. Azure Bastion
3. Azure Firewall
4. Microsoft Sentinel

Correct Answer: 1

Explanation

Azure Policy can enforce organizational requirements for resource configurations, including mandatory tags. An administrator can create a policy that evaluates whether required security or ownership tags are present and can use an appropriate policy effect to deny noncompliant deployments or audit existing resources. This supports consistent governance across Azure environments. Azure Bastion provides secure VM administration, Azure Firewall filters network traffic, and Microsoft Sentinel provides security analytics. Therefore, Azure Policy is the appropriate service for enforcing required resource tags as part of an organization’s security and governance standards.

Question 183

Which Azure security feature can help prevent accidental permanent deletion of protected Key Vault objects during their retention period?

1. Azure DDoS Protection
2. Purge protection
3. Application Security Group
4. Azure Network Watcher

Correct Answer: 2

Explanation

Purge protection adds an additional safeguard to Azure Key Vault by preventing protected objects from being permanently purged during the configured retention period. It is particularly useful for sensitive cryptographic keys, secrets, and certificates where permanent deletion could cause data-access or recovery problems. Soft delete supports recovery of deleted objects, while purge protection helps prevent those objects from being permanently removed before the retention period ends. DDoS Protection, Application Security Groups, and Network Watcher address network security or troubleshooting rather than Key Vault object retention.

Question 184

A security administrator needs to verify which user performed a management operation on an Azure resource. Which log should be examined first?

1. Azure Activity Log
2. Application cache
3. DNS query cache
4. Load balancer health probe

Correct Answer: 1

Explanation

Azure Activity Log records management-plane operations performed on Azure resources at the subscription level. It can provide details about actions such as creating, updating, or deleting resources and can identify the caller associated with the operation. This makes it useful for auditing administrative activity and investigating unauthorized or unexpected resource changes. Application caches and DNS query caches do not provide Azure resource management records, while load balancer health probes report service availability. Therefore, Azure Activity Log should be examined first when investigating who performed an Azure management operation.

Question 185

Which Azure networking feature can restrict communication between application tiers by allowing only explicitly permitted traffic?

1. Azure Key Vault
2. Network Security Group
3. Azure Resource Graph
4. Microsoft Entra ID Protection

Correct Answer: 2

Explanation

A Network Security Group can restrict network communication between application tiers by using inbound and outbound security rules. Administrators can specify permitted or denied traffic based on source, destination, port, protocol, and related network characteristics. This allows organizations to limit communication to only the connections required by an application architecture. Key Vault manages secrets, Resource Graph queries Azure resources, and Entra ID Protection detects identity risks. Therefore, an NSG is the appropriate network security control for restricting communication between application tiers.

Question 186

A company wants to analyze Azure security events in real time and create automated responses when certain threat patterns are detected. Which service should be used?

1. Azure Storage
2. Microsoft Sentinel
3. Azure Bastion
4. Azure DNS

Correct Answer: 2

Explanation

Microsoft Sentinel provides cloud-native SIEM and SOAR capabilities that allow organizations to collect and analyze security data from many sources. Analytics rules can detect suspicious patterns and generate alerts or incidents, while automation capabilities can trigger response actions through supported mechanisms. This enables security teams to move from manual event review toward centralized detection and response workflows. Azure Storage provides data storage, Bastion provides secure VM access, and DNS provides name resolution. Therefore, Microsoft Sentinel is the appropriate service for centralized security-event analysis and automated response workflows.

Question 187

Which Microsoft Entra capability allows an organization to review whether users still require access to a group on a recurring schedule?

1. Microsoft Entra access reviews
2. Azure Firewall
3. Azure Policy
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Microsoft Entra access reviews provide recurring governance over user access to groups, applications, and other resources. Organizations can configure reviews so that designated reviewers periodically confirm whether access remains necessary. This helps identify and remove permissions that are no longer justified, particularly for guest users or changing business responsibilities. Azure Firewall controls network traffic, Azure Policy governs resource configurations, and DDoS Protection mitigates denial-of-service attacks. Therefore, Microsoft Entra access reviews are the appropriate capability for regularly validating whether users should continue to belong to a group.

Question 188

A company needs to protect a web application from malicious HTTP requests while also maintaining centralized application delivery through Azure Front Door. Which capability should be integrated?

1. Azure Resource Graph
2. Web Application Firewall
3. Azure Key Vault
4. Network Watcher

Correct Answer: 2

Explanation

Web Application Firewall can be integrated with supported Azure application delivery services, including Azure Front Door, to provide application-layer protection. It inspects HTTP and HTTPS requests and can help detect and block common web attacks using managed and custom rules. Resource Graph is used for querying resources, Key Vault manages sensitive cryptographic material and secrets, and Network Watcher provides network monitoring and troubleshooting tools. Therefore, Web Application Firewall is the appropriate capability when an application delivered through Azure Front Door requires protection from malicious web requests.

Question 189

Which Azure capability can help an organization automatically identify resources that do not comply with required security configurations?

1. Azure Policy
2. Azure CDN
3. Azure Bastion
4. Azure Load Balancer

Correct Answer: 1

Explanation

Azure Policy evaluates Azure resources against defined organizational requirements and provides compliance information for assigned policies. Administrators can use policy results to identify resources that do not meet requirements related to locations, tags, resource types, security settings, or other supported properties. Depending on the policy effect, noncompliant configurations can also be prevented or modified. Azure CDN, Bastion, and Load Balancer provide content delivery, secure VM administration, and traffic distribution respectively. Therefore, Azure Policy is the appropriate capability for identifying resources that violate required security configurations.

Question 190

An administrator needs to allow a workload to access Azure Key Vault without creating or storing a client secret. Which identity mechanism is appropriate?

1. Managed identity
2. Shared password
3. Anonymous authentication
4. Public IP address

Correct Answer: 1

Explanation

Managed identity allows an Azure workload to authenticate to supported services without requiring administrators or developers to store application credentials. Azure manages the identity’s credentials, while administrators grant the identity only the permissions needed to access resources such as Key Vault. This reduces the risk associated with exposed client secrets and simplifies credential management. Shared passwords introduce additional credential-management risks, anonymous authentication does not provide appropriate identity verification, and public IP addresses are networking identifiers rather than authentication mechanisms. Therefore, managed identity is the appropriate choice.

Question 191

Which Azure service provides centralized security recommendations and can help prioritize security improvements across supported workloads?

1. Azure Traffic Manager
2. Microsoft Defender for Cloud
3. Azure DNS
4. Azure Queue Storage

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides centralized security posture management capabilities for supported cloud workloads. It can identify security weaknesses, generate recommendations, and provide security information that helps organizations prioritize remediation activities. Depending on enabled plans, it can also provide workload protection and threat detection capabilities. Traffic Manager manages DNS-based traffic routing, Azure DNS handles name resolution, and Queue Storage supports asynchronous messaging. Therefore, Microsoft Defender for Cloud is the appropriate service for centralized security recommendations and security posture improvement.

Question 192

A security team wants to determine whether a network flow between two Azure resources is being blocked by an NSG rule. Which Network Watcher capability can assist with this investigation?

1. IP flow verify
2. Blob versioning
3. Access review
4. Key rotation

Correct Answer: 1

Explanation

Network Watcher’s IP flow verify capability can help determine whether a particular network flow is allowed or denied by the applicable security rules. It evaluates traffic information against NSG rules and can identify the rule responsible for the decision. This is useful when administrators need to troubleshoot connectivity between Azure resources without manually reviewing every possible rule. Blob versioning protects storage data, access reviews govern identity permissions, and key rotation manages cryptographic material. Therefore, IP flow verify is the appropriate Network Watcher capability for investigating NSG-based traffic decisions.

Question 193

Which Azure feature allows administrators to create a new version of a Key Vault key while retaining the existing key versions for supported operations?

1. Resource locks
2. Key versioning
3. Service tags
4. Diagnostic settings

Correct Answer: 2

Explanation

Azure Key Vault supports key versioning, allowing new versions of a key to be created during the key lifecycle. This capability supports controlled key rotation and allows applications or administrators to transition to newer key versions according to their configuration and operational requirements. Maintaining versions can also help with controlled migration and key lifecycle management. Resource locks protect resources, service tags simplify NSG rules, and diagnostic settings route logs and metrics to supported destinations. Therefore, key versioning is the appropriate Key Vault capability for managing successive versions of cryptographic keys.

Question 194

A security architect wants to prevent a privileged account from retaining permanent administrative permissions. Which design follows the principle of least standing privilege?

1. Assign permanent Owner access
2. Use just-in-time privileged access
3. Share one administrator account
4. Enable anonymous access

Correct Answer: 2

Explanation

Just-in-time privileged access reduces standing administrative permissions by allowing eligible users to activate elevated roles only when necessary. Microsoft Entra Privileged Identity Management can support this model through activation controls such as time limits, approval, multifactor authentication, and justification. Permanent Owner access provides unnecessarily broad and continuously available privileges, while shared accounts reduce accountability and increase credential risk. Anonymous access eliminates appropriate identity controls. Therefore, just-in-time privileged access best supports the principle of minimizing standing administrative privileges.

Question 195

Which Azure Storage capability can help recover data after a blob has been accidentally deleted?

1. Blob soft delete
2. Azure Firewall
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 1

Explanation

Blob soft delete allows deleted blobs to remain recoverable for a configured retention period. If a user or application accidentally deletes a blob, administrators or authorized users can restore it while it remains within the retention period. This provides an additional layer of data protection and can complement other Storage capabilities such as blob versioning. Azure Firewall controls network traffic, Azure Bastion provides secure VM administration, and Traffic Manager provides traffic routing. Therefore, blob soft delete is the appropriate capability for recovering accidentally deleted blob data.

Question 196

An organization wants to use private connectivity to an Azure Storage account and ensure DNS queries resolve the storage service to its private IP address. Which combination should be considered?

1. Public DNS and public IP
2. Private endpoint and private DNS zone
3. Azure CDN and Traffic Manager
4. Azure Bastion and NSG only

Correct Answer: 2

Explanation

A private endpoint provides a private IP address for supported Azure services within a virtual network, while a private DNS zone can provide the appropriate name resolution for that private endpoint. Together, these components allow applications to access services such as Azure Storage through private connectivity while resolving the service name to the private address. Public DNS and public IP configurations do not provide the same private access model. CDN, Traffic Manager, and Bastion serve different purposes. Therefore, a private endpoint combined with a private DNS zone is appropriate for this architecture.

Question 197

Which Azure security feature can detect potentially malicious activity affecting supported SQL databases and generate security alerts?

1. Microsoft Defender for SQL
2. Azure CDN
3. Azure Resource Graph
4. Azure Traffic Manager

Correct Answer: 1

Explanation

Microsoft Defender for SQL provides specialized security protection for supported SQL workloads. It can detect suspicious database activity, provide security alerts, and offer recommendations that can help improve database security. This service adds workload-specific protection beyond basic database authentication, authorization, encryption, and network controls. Azure CDN handles content delivery, Resource Graph queries Azure resource information, and Traffic Manager routes traffic using DNS-based methods. Therefore, Microsoft Defender for SQL is the appropriate service when an organization needs security monitoring and threat detection for supported SQL databases.

Question 198

A company wants to make sure that all storage requests use encrypted connections. Which Azure Storage setting should be enabled?

1. Secure transfer required
2. Anonymous access
3. Public network access
4. HTTP-only communication

Correct Answer: 1

Explanation

The secure transfer required setting helps ensure that supported Azure Storage requests use encrypted transport, such as HTTPS. This protects information while it travels between clients and the Storage service and helps prevent exposure through unencrypted communication. Anonymous access controls whether unauthenticated users can access certain storage data, while public network access concerns network reachability. HTTP-only communication would not provide encrypted transport. Therefore, secure transfer required should be enabled when the organization wants to enforce encrypted connections to supported Azure Storage services.

Question 199

Which Azure service can use application-aware rules to control outbound web traffic from workloads?

1. Azure Firewall
2. Azure Key Vault
3. Microsoft Entra ID Protection
4. Azure Resource Graph

Correct Answer: 1

Explanation

Azure Firewall supports application rules that can control traffic based on application-level characteristics such as fully qualified domain names for supported HTTP and HTTPS traffic. This allows administrators to create centralized policies governing which web destinations workloads can reach. Azure Firewall can also combine application rules with network rules and other supported security capabilities. Key Vault manages secrets and cryptographic keys, Entra ID Protection detects identity risks, and Resource Graph queries resource information. Therefore, Azure Firewall is the appropriate service for centralized application-aware outbound traffic filtering.

Question 200

A security architect wants to combine identity controls, network filtering, encryption, monitoring, and threat detection so that failure of one control does not expose the entire environment. Which security strategy does this represent?

1. Single-layer security
2. Defense in depth
3. Anonymous access
4. Public exposure

Correct Answer: 2

Explanation

Defense in depth uses multiple complementary security controls to protect systems at different layers. Identity controls can restrict who accesses resources, network controls can limit communication, encryption protects data, monitoring provides visibility, and threat detection helps identify suspicious activity. Using multiple layers means that bypassing one control does not automatically provide unrestricted access to the environment. Single-layer security depends heavily on one mechanism, while anonymous access and public exposure weaken protection. Therefore, combining multiple independent security mechanisms represents the defense-in-depth strategy.