View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 201

Which Azure security service can help protect Azure virtual machines by providing threat detection and workload security capabilities?

1. Azure DNS
2. Azure Traffic Manager
3. Microsoft Defender for Servers
4. Azure Queue Storage

Correct Answer: 3

Explanation

Microsoft Defender for Servers provides security capabilities for supported server workloads, including Azure virtual machines. Depending on the selected plan and configuration, it can provide threat detection, security recommendations, vulnerability-related insights, and other workload protection capabilities. These features help security teams identify weaknesses and investigate suspicious activity affecting server resources. Azure DNS provides name resolution, Traffic Manager manages traffic routing, and Queue Storage supports messaging. Therefore, Microsoft Defender for Servers is the appropriate service when specialized security protection is required for Azure virtual machines.

Question 202

An organization needs to restrict Azure resource deployments to a specific set of approved regions. Which Azure Policy effect should be used when nonapproved deployments must be blocked?

1. Audit
2. Deny
3. Append
4. Disabled

Correct Answer: 2

Explanation

The Deny effect in Azure Policy prevents a resource operation when the requested configuration violates the assigned policy. For example, an organization can define an allowed list of Azure regions and use a Deny policy to stop deployments outside those locations. Audit would identify noncompliant resources without blocking deployment, while Append modifies supported properties and Disabled prevents policy evaluation. Therefore, the Deny effect is appropriate when regional restrictions must be actively enforced rather than simply reported.

Question 203

A security administrator wants to ensure that an application identity can read Key Vault secrets but cannot create or delete them. What should the administrator configure?

1. Broad Owner permissions
2. Anonymous access
3. Least-privileged Key Vault permissions
4. Public network access

Correct Answer: 3

Explanation

Key Vault permissions should follow the principle of least privilege. If an application only needs to retrieve secrets, its identity should receive only the permissions necessary for reading those secrets and should not receive unnecessary create, update, or delete permissions. Broad Owner access would provide excessive privileges and could allow unrelated resource management. Anonymous access would remove appropriate authorization, while public network access only concerns connectivity and does not determine application permissions. Therefore, least-privileged Key Vault permissions are the appropriate configuration for this scenario.

Question 204

Which Azure feature allows administrators to protect a resource from deletion while still permitting authorized configuration changes?

1. ReadOnly lock
2. CanNotDelete lock
3. Azure CDN
4. Service tag

Correct Answer: 2

Explanation

A CanNotDelete resource lock prevents a protected Azure resource from being deleted while still allowing authorized users to modify its configuration. This is useful for important production resources where administrators must continue making legitimate changes but need protection against accidental deletion. A ReadOnly lock is more restrictive because it prevents both modification and deletion. Azure CDN and service tags are networking or content-delivery features and do not provide resource deletion protection. Therefore, CanNotDelete is the appropriate lock type for this requirement.

Question 205

Which Microsoft Entra feature can require multifactor authentication when a user attempts to access an application from a location that is not trusted?

1. Microsoft Entra Conditional Access
2. Azure Resource Graph
3. Azure Storage
4. Azure Load Balancer

Correct Answer: 1

Explanation

Microsoft Entra Conditional Access allows organizations to create policies based on conditions such as user identity, application, device, location, and sign-in risk. A policy can require multifactor authentication when users access protected applications from locations that are not considered trusted. This provides adaptive access control based on the context of each authentication attempt. Azure Resource Graph queries resource information, Storage provides data services, and Load Balancer distributes network traffic. Therefore, Microsoft Entra Conditional Access is the appropriate feature for enforcing MFA based on access location.

Question 206

An organization wants to analyze security events from Azure resources, Microsoft services, and third-party systems in a centralized security platform. Which service should be selected?

1. Azure Bastion
2. Microsoft Sentinel
3. Azure DNS
4. Azure Load Balancer

Correct Answer: 2

Explanation

Microsoft Sentinel is a cloud-native SIEM and SOAR platform capable of collecting security data from Azure resources, Microsoft services, third-party products, and other supported sources. Security teams can use this centralized data to create detections, investigate incidents, correlate events, and automate selected response actions. Azure Bastion provides secure administrative access to virtual machines, DNS manages name resolution, and Load Balancer distributes network traffic. Therefore, Microsoft Sentinel is the appropriate service for centralized security-event collection and analysis across multiple environments.

Question 207

A company wants applications to access an Azure service through a private IP address rather than its public endpoint. Which Azure feature should be deployed?

1. Private endpoint
2. Public IP address
3. Azure Traffic Manager
4. Azure CDN

Correct Answer: 1

Explanation

A private endpoint provides a private IP address within a virtual network for accessing supported Azure services. This allows applications to communicate with the service through private network connectivity rather than relying on a public endpoint. Private endpoints can help reduce public exposure and support network isolation requirements. Public IP addresses provide public connectivity, while Traffic Manager and Azure CDN are designed for traffic routing and content delivery. Therefore, a private endpoint is the appropriate feature when applications must access a supported Azure service through a private IP address.

Question 208

Which Azure capability can periodically verify whether users should continue to have access to applications, groups, or other protected resources?

1. Azure Firewall
2. Microsoft Entra access reviews
3. Azure DDoS Protection
4. Azure Network Watcher

Correct Answer: 2

Explanation

Microsoft Entra access reviews provide recurring identity governance by allowing organizations to review whether users should continue to have access to applications, groups, and other resources. They are especially useful for guest users, external collaborators, and situations where permissions may become unnecessary over time. Reviewers can confirm continued access or initiate removal according to organizational processes. Azure Firewall filters network traffic, DDoS Protection mitigates denial-of-service attacks, and Network Watcher provides network monitoring tools. Therefore, Microsoft Entra access reviews are appropriate for periodic access validation.

Question 209

An administrator wants to determine why a network connection between two Azure resources is failing. Which Azure service provides tools specifically designed for network troubleshooting?

1. Azure Key Vault
2. Microsoft Sentinel
3. Azure Network Watcher
4. Microsoft Entra ID Protection

Correct Answer: 3

Explanation

Azure Network Watcher provides network monitoring and troubleshooting capabilities for Azure environments. Administrators can use features such as connection troubleshooting and IP flow verification to investigate connectivity failures, routing behavior, and NSG decisions. These tools can help identify whether traffic is being blocked or whether a routing configuration is contributing to the problem. Key Vault manages secrets, Microsoft Sentinel provides security analytics, and Entra ID Protection detects identity risks. Therefore, Azure Network Watcher is the appropriate service for diagnosing Azure network connectivity problems.

Question 210

Which Azure service can provide security recommendations and help organizations improve the security posture of supported cloud workloads?

1. Azure DNS
2. Microsoft Defender for Cloud
3. Azure Load Balancer
4. Azure Queue Storage

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides centralized security posture management for supported cloud workloads. It can identify security weaknesses, generate recommendations, and provide security information that helps organizations prioritize remediation. Depending on enabled plans, it can also provide workload protection and threat detection capabilities. Azure DNS handles name resolution, Load Balancer distributes network traffic, and Queue Storage provides messaging functionality. Therefore, Microsoft Defender for Cloud is the appropriate service for reviewing security recommendations and improving the security posture of supported workloads.

Question 211

A security team wants to ensure that Azure Storage connections use encrypted transport. Which configuration should be enabled?

1. Secure transfer required
2. Anonymous access
3. Public network access
4. HTTP-only communication

Correct Answer: 1

Explanation

The secure transfer required setting helps ensure that supported Azure Storage requests use encrypted transport, such as HTTPS. This reduces the risk of sensitive information being exposed while traveling between clients and the Storage service. Anonymous access controls authentication requirements, public network access controls network reachability, and HTTP-only communication would not provide encrypted transport. Enforcing secure transfer is an important storage security measure when organizations need to ensure that data is transmitted using protected communication channels. Therefore, secure transfer required should be enabled.

Question 212

Which Azure networking feature can simplify NSG rules by allowing administrators to reference a group of Azure service IP addresses?

1. Application Security Groups
2. Service tags
3. Private DNS zones
4. Route tables

Correct Answer: 2

Explanation

Service tags simplify NSG rule management by representing groups of IP address prefixes associated with specific Azure services or categories. Instead of manually maintaining individual IP addresses, administrators can reference the appropriate service tag in supported security rules. This can reduce administrative effort and help keep network rules aligned with changing Azure service address ranges. Application Security Groups organize network interfaces by application role, private DNS zones provide name resolution, and route tables control routing. Therefore, service tags are the appropriate feature for referencing predefined Azure service address ranges in NSG rules.

Question 213

An application hosted in Azure needs to authenticate to Key Vault without storing a password, certificate, or client secret in its configuration. Which option is most appropriate?

1. Managed identity
2. Shared administrator account
3. Anonymous access
4. Public IP address

Correct Answer: 1

Explanation

Managed identity allows Azure-hosted applications to authenticate to supported services without storing credentials in application configuration. Azure manages the identity credentials, while administrators assign the required permissions to the identity. This reduces the risk of exposed client secrets and simplifies credential lifecycle management. A shared administrator account creates unnecessary privilege and accountability risks, anonymous access does not provide suitable authorization, and a public IP address is not an authentication mechanism. Therefore, managed identity is the preferred option for securely authenticating an Azure application to Key Vault.

Question 214

A company needs centralized filtering of outbound traffic based on application destinations and network rules. Which Azure service should be considered?

1. Azure Key Vault
2. Azure Firewall
3. Microsoft Entra ID Protection
4. Azure Resource Graph

Correct Answer: 2

Explanation

Azure Firewall provides centralized, stateful network traffic filtering and supports both network and application rules. Application rules can control supported web traffic based on destinations such as fully qualified domain names, while network rules can control traffic based on addresses, ports, and protocols. This makes Azure Firewall useful for implementing centralized outbound traffic policies. Key Vault manages secrets and cryptographic keys, Entra ID Protection handles identity risks, and Resource Graph queries resource information. Therefore, Azure Firewall is the appropriate service for centralized application-aware and network-level outbound traffic filtering.

Question 215

Which Key Vault feature helps prevent a deleted secret or key from being permanently purged before the configured retention period expires?

1. Purge protection
2. Azure Bastion
3. Network Security Group
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Purge protection helps prevent protected Key Vault objects from being permanently purged during the configured retention period. This provides an additional safeguard for sensitive keys, secrets, and certificates against accidental or unauthorized permanent deletion. Soft delete provides recoverability after deletion, while purge protection strengthens that protection by preventing early permanent removal. Azure Bastion provides secure VM administration, NSGs filter network traffic, and DDoS Protection mitigates denial-of-service attacks. Therefore, purge protection is the appropriate Key Vault feature when permanent deletion must be prevented during the retention period.

Question 216

A security administrator wants to identify management operations such as resource creation, modification, and deletion across a subscription. Which Azure log provides this information?

1. Azure DNS log
2. Azure Activity Log
3. Application trace
4. Storage access tier

Correct Answer: 2

Explanation

Azure Activity Log records management-plane operations performed on Azure resources at the subscription level. It can provide information about actions such as resource creation, modification, and deletion, along with details useful for auditing and investigation. Organizations can also route Activity Log data to supported destinations through diagnostic settings for longer retention or centralized analysis. DNS logs, application traces, and storage access tiers serve different purposes and do not provide the same subscription-level management activity information. Therefore, Azure Activity Log is the appropriate source for reviewing Azure resource management operations.

Question 217

Which Azure service provides dedicated security protection for supported Azure SQL workloads, including threat detection and security recommendations?

1. Azure CDN
2. Microsoft Defender for SQL
3. Azure Traffic Manager
4. Azure Bastion

Correct Answer: 2

Explanation

Microsoft Defender for SQL provides specialized security capabilities for supported SQL workloads. It can help identify suspicious database activity, provide threat alerts, and offer security recommendations that can improve database protection. These capabilities complement controls such as authentication, authorization, encryption, and network restrictions. Azure CDN provides content delivery, Traffic Manager performs traffic routing, and Bastion provides secure administrative connectivity to virtual machines. Therefore, Microsoft Defender for SQL is the appropriate service when security monitoring and threat protection are specifically required for supported Azure SQL workloads.

Question 218

An organization wants to enforce that a required tag is automatically added to supported resources when they are created or updated. Which Azure governance service can provide this capability?

1. Azure Policy
2. Azure Firewall
3. Azure Bastion
4. Microsoft Sentinel

Correct Answer: 1

Explanation

Azure Policy can use supported policy effects such as Modify to automatically add or change certain resource properties when policy conditions are met. This can help organizations enforce governance standards such as required tags across supported resources. Policies can also audit or deny noncompliant configurations depending on the selected effect and requirement. Azure Firewall provides network filtering, Bastion provides secure VM administration, and Microsoft Sentinel provides security analytics. Therefore, Azure Policy is the appropriate governance service for automatically applying supported required resource properties.

Question 219

A security team wants to identify suspicious identity activity and use the resulting risk information to trigger stronger authentication controls. Which combination should be used?

1. Azure Firewall and Azure DNS
2. Microsoft Entra ID Protection and Conditional Access
3. Azure Storage and Azure CDN
4. Network Watcher and Traffic Manager

Correct Answer: 2

Explanation

Microsoft Entra ID Protection identifies identity and sign-in risks, while Conditional Access can use those risk signals to make access decisions. For example, an organization can configure a policy that requires multifactor authentication when sign-in risk reaches a defined level. This combination provides risk detection followed by an adaptive access response. Azure Firewall and DNS address network functions, Storage and CDN provide data and content services, and Network Watcher and Traffic Manager address networking and routing. Therefore, Microsoft Entra ID Protection combined with Conditional Access supports this identity-risk scenario.

Question 220

A company wants to keep previous versions of a blob so that an accidentally overwritten object can be restored. Which Azure Storage capability should be enabled?

1. Blob versioning
2. Azure DDoS Protection
3. Azure Firewall
4. Azure Bastion

Correct Answer: 1

Explanation

Blob versioning maintains previous versions of supported Azure Storage blobs when changes occur. If an application or user accidentally overwrites a blob, an earlier version can remain available for recovery according to the configured storage lifecycle and retention practices. Versioning can complement other data-protection features such as blob soft delete. Azure DDoS Protection protects against denial-of-service attacks, Azure Firewall filters network traffic, and Azure Bastion provides secure VM administration. Therefore, blob versioning is the appropriate Storage capability when recovery of earlier blob versions is required.