View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 221

Which Azure Storage feature allows an organization to use a customer-managed key to protect data encryption for a storage account?

1. Shared Access Signature
2. Storage firewall
3. Private endpoint
4. Customer-managed key in Azure Key Vault

Correct Answer: 4

Explanation

Azure Storage supports customer-managed keys when an organization requires greater control over encryption keys. The keys can be stored in Azure Key Vault, allowing administrators to manage access, rotation, expiration, and other lifecycle settings. This approach provides more control than relying solely on Microsoft-managed keys. A storage firewall controls network access, a private endpoint provides private connectivity, and a SAS grants delegated data access. None of those directly provide customer-controlled encryption key management. Customer-managed keys are therefore appropriate when organizational security or compliance requirements require control over encryption keys.

Question 222

Which Azure service should you use to create a user delegation SAS for Blob Storage?

1. Microsoft Entra ID
2. Azure Firewall
3. Azure Policy
4. Microsoft Sentinel

Correct Answer: 1

Explanation

A user delegation SAS for Azure Blob Storage is secured using Microsoft Entra credentials rather than an account key. An authorized identity requests a user delegation key from Azure Storage, and that key is then used to construct the SAS. This approach reduces reliance on long-lived storage account keys and provides identity-based control. Azure Firewall protects network traffic, Azure Policy enforces governance rules, and Microsoft Sentinel provides security monitoring. Microsoft Entra ID is therefore the relevant identity service when implementing user delegation SAS access.

Question 223

An administrator wants to prevent anonymous public access to blobs across newly created storage accounts. Which Azure Policy effect should be used to enforce the requirement?

1. Audit
2. Modify
3. Deny
4. Append

Correct Answer: 3

Explanation

The Deny effect prevents a resource configuration from being created or updated when it violates the assigned policy. If an organization requires storage accounts to block anonymous blob access, a policy using Deny can prevent administrators from deploying configurations that permit the prohibited setting. Audit would only report noncompliance without blocking deployment. Modify can change certain resource properties, while Append adds fields during resource creation. When the requirement is to stop insecure configurations from being deployed, Deny provides preventive enforcement.

Question 224

A security team needs to collect Azure SQL Database audit information in a centralized location for investigation and correlation with other security events. Which destination is appropriate when using Azure diagnostic settings?

1. Azure Storage account
2. Log Analytics workspace
3. Azure DNS
4. Azure Bastion

Correct Answer: 2

Explanation

A Log Analytics workspace is designed to centralize log and telemetry data from Azure resources and applications. Azure SQL auditing information can be sent to a Log Analytics workspace through supported diagnostic settings, allowing security teams to query events and correlate them with information from other resources. A storage account can also be used for certain archival scenarios, but it is not primarily designed for interactive security investigation. Azure DNS and Azure Bastion do not provide centralized security log analysis. Log Analytics is therefore suitable for investigation and correlation.

Question 225

What is the primary security purpose of Azure SQL Database vulnerability assessment?

1. Identify potential database security weaknesses
2. Encrypt every database automatically
3. Create private endpoints for databases
4. Replace SQL authentication with certificates

Correct Answer: 1

Explanation

Azure SQL vulnerability assessment helps identify potential security weaknesses in database configurations, permissions, and other areas that could expose an environment to risk. The assessment produces findings that administrators can review and address to improve the database security posture. It does not automatically encrypt every database, create private endpoints, or replace SQL authentication with certificates. Those functions involve different security mechanisms. Vulnerability assessment is therefore primarily a discovery and assessment capability that helps security teams identify weaknesses requiring remediation.

Question 226

A company wants to automatically rotate an Azure Key Vault key according to a defined rotation policy instead of relying on administrators to create new versions manually. Which capability addresses this requirement?

1. Key Vault access policy
2. Azure Policy initiative
3. Private endpoint
4. Key rotation policy

Correct Answer: 4

Explanation

Azure Key Vault supports key rotation policies that define how and when cryptographic keys should be rotated. This helps organizations establish predictable key lifecycle management and reduce the risk associated with keeping cryptographic material unchanged for extended periods. An access policy controls permissions but does not define rotation schedules. An Azure Policy initiative groups governance policies, while a private endpoint controls network connectivity. A key rotation policy directly addresses the requirement to manage key rotation according to defined organizational security requirements.

Question 227

Which Microsoft Entra feature allows an organization to provide employees with controlled access to groups, applications, and resources through access packages?

1. Privileged Identity Management
2. Entitlement Management
3. Identity Protection
4. Authentication methods

Correct Answer: 2

Explanation

Microsoft Entra entitlement management helps organizations govern access to applications, groups, and other resources through access packages. Access packages can combine resources with policies that define who can request access, how approval works, and when access should expire. Privileged Identity Management focuses primarily on managing privileged roles and just-in-time elevation. Identity Protection detects identity-related risks, while authentication methods manage available sign-in mechanisms. Entitlement management is therefore appropriate when an organization needs a structured process for requesting and reviewing access to multiple resources.

Question 228

A security administrator wants to group several related Azure Policy definitions so they can be assigned and managed as a single governance unit. What should the administrator create?

1. Resource lock
2. Policy exemption
3. Policy initiative
4. Management group

Correct Answer: 3

Explanation

An Azure Policy initiative groups multiple related policy definitions into a single logical collection. Administrators can then assign the initiative rather than assigning each individual policy separately. This is useful for implementing broader governance requirements such as security baselines or compliance frameworks. A resource lock controls resource deletion or modification, while a policy exemption excludes selected resources or scopes from a policy requirement. A management group organizes subscriptions and provides a governance boundary. Therefore, a policy initiative is the appropriate choice for grouping related policies.

Question 229

Which Azure security control is specifically designed to detect and help protect against malicious activity targeting container workloads?

1. Azure Bastion
2. Azure DDoS Protection
3. Microsoft Defender for Containers
4. Azure Key Vault

Correct Answer: 3

Explanation

Microsoft Defender for Containers provides security capabilities for containerized environments, including threat detection and security recommendations for supported container workloads. It can help organizations identify risks involving container configurations, images, and runtime activity depending on the supported environment and enabled capabilities. Azure Bastion provides secure administrative access to virtual machines, while DDoS Protection focuses on denial-of-service attacks against network resources. Azure Key Vault protects secrets and cryptographic material. Defender for Containers is therefore the security service specifically aligned with container workload protection.

Question 230

An administrator needs to ensure that privileged access to a sensitive Azure role is granted only temporarily and requires activation when needed. Which Microsoft Entra capability should be configured?

1. Privileged Identity Management
2. Access reviews
3. Entitlement management
4. Identity Protection

Correct Answer: 1

Explanation

Microsoft Entra Privileged Identity Management provides just-in-time privileged access for eligible users and roles. Instead of permanently assigning sensitive privileges, administrators can make users eligible and require them to activate the role when necessary. Activation can be subject to controls such as authentication, approval, justification, and time limits. Access reviews are intended to periodically verify whether access remains appropriate. Entitlement management governs resource access packages, while Identity Protection focuses on identity risks. PIM is therefore the appropriate capability for temporary, controlled access to privileged Azure roles.

Question 231

Which Azure Storage security mechanism provides delegated access to specific resources for a limited period without sharing the storage account key?

1. Azure Policy
2. Shared Access Signature
3. Resource lock
4. Azure Firewall

Correct Answer: 2

Explanation

A Shared Access Signature provides delegated access to Azure Storage resources without requiring the recipient to know the storage account key. The SAS can specify permitted operations, resources, and an expiration period, helping limit the scope of access. Depending on the SAS type, additional identity-based controls may also be available. Azure Policy governs resource configuration, a resource lock protects resources from deletion or modification, and Azure Firewall controls network traffic. SAS is therefore the appropriate mechanism when controlled, time-limited delegated access to storage data is required.

Question 232

A security team wants to require multifactor authentication when users sign in from locations outside the organization’s trusted network ranges. Which Conditional Access capability should be used?

1. Application filter
2. Session control
3. Named locations
4. Access reviews

Correct Answer: 3

Explanation

Microsoft Entra Conditional Access named locations allow administrators to define trusted network locations using IP ranges or other supported location criteria. A Conditional Access policy can then use location as a condition and require controls such as multifactor authentication when users sign in from outside trusted locations. Application filters can target applications, while session controls manage session behavior. Access reviews are used to verify whether users should retain access. Named locations therefore provide the location-based condition required for this authentication policy.

Question 233

Which Azure Key Vault capability helps ensure that a deleted key cannot be immediately and permanently removed by an unauthorized administrator?

1. Purge protection
2. Diagnostic settings
3. Private endpoint
4. Azure Policy

Correct Answer: 1

Explanation

Key Vault purge protection helps prevent permanently deleting protected objects immediately after they have been soft-deleted. This provides an additional safeguard against accidental or malicious permanent removal of keys, secrets, and certificates. Soft-delete provides recoverability, while purge protection adds stronger protection against irreversible deletion during the configured retention period. Diagnostic settings are used for monitoring and logging, private endpoints provide private network connectivity, and Azure Policy can enforce governance requirements. Purge protection is therefore the relevant capability when permanent deletion must be restricted.

Question 234

An organization wants to investigate security events from multiple Azure resources and automatically trigger response actions when specific conditions are detected. Which Microsoft Sentinel capability is most directly involved in automated response?

1. Workbooks
2. Analytics rules
3. Data connectors
4. Playbooks

Correct Answer: 4

Explanation

Microsoft Sentinel playbooks provide automated response workflows based on Azure Logic Apps. They can perform actions such as sending notifications, enriching incidents, creating tickets, or interacting with other services when triggered by security events. Analytics rules identify suspicious activity and can generate incidents, while data connectors bring information into Sentinel. Workbooks provide visualization and analysis of collected data. When the requirement is to automate actions after security conditions or incidents occur, playbooks provide the response orchestration capability.

Question 235

Which Azure networking feature allows a private IP address in a virtual network to provide private connectivity to an Azure PaaS service?

1. Azure Firewall
2. Private endpoint
3. Network Security Group
4. Public IP address

Correct Answer: 2

Explanation

An Azure private endpoint creates a network interface with a private IP address in a virtual network and connects that interface to a supported Azure service through Azure Private Link. This allows clients to access the service privately without requiring traffic to traverse the public internet. Azure Firewall provides centralized network filtering, an NSG controls network traffic at supported resource interfaces or subnets, and a public IP explicitly provides public addressing. A private endpoint is therefore the appropriate solution when private network connectivity to a PaaS service is required.

Question 236

A company wants to exclude a specific development subscription from an Azure Policy assignment because the subscription is intentionally governed by a separate control framework. What should be configured?

1. Resource lock
2. Policy initiative
3. Policy exemption
4. Azure role assignment

Correct Answer: 3

Explanation

An Azure Policy exemption allows an organization to exclude a defined resource, resource group, subscription, or other supported scope from a policy requirement. Exemptions are useful when a particular environment has a documented reason for not following a general governance rule. A policy initiative groups policies but does not exclude resources. A resource lock protects resources from deletion or modification, while an Azure role assignment controls permissions. A policy exemption is therefore the appropriate mechanism when a specific subscription requires an approved exception.

Question 237

Which Azure security capability helps identify users whose identities or sign-in activities have been associated with elevated risk?

1. Microsoft Entra ID Protection
2. Azure Bastion
3. Azure Resource Graph
4. Azure Firewall

Correct Answer: 1

Explanation

Microsoft Entra ID Protection uses identity-related signals to detect potentially compromised users and risky sign-in activity. It can identify user risk and sign-in risk, which can then be incorporated into Conditional Access policies or investigated by administrators. Azure Bastion provides secure browser-based management access to virtual machines. Azure Resource Graph enables resource inventory and querying, while Azure Firewall provides network traffic filtering. Entra ID Protection is therefore the appropriate capability for identifying identity and authentication risks that may indicate compromised accounts.

Question 238

A security engineer needs to protect an Azure Storage account from requests originating outside approved virtual networks while keeping access private. Which combination is most appropriate?

1. Public endpoint and a resource lock
2. Azure Bastion and Azure DNS
3. Storage account access keys and Azure Firewall
4. Private endpoint and appropriate network access controls

Correct Answer: 4

Explanation

A private endpoint provides private connectivity to the storage account through a private IP address in an Azure virtual network. Network access controls can then restrict which networks and resources are permitted to reach the service. This combination reduces exposure to public network access while maintaining controlled private connectivity. A resource lock does not control network traffic, and access keys are authentication credentials rather than network restrictions. Azure Bastion is designed for virtual machine administration. Therefore, private endpoint connectivity combined with suitable network access controls provides the required security architecture.

Question 239

Which Microsoft Sentinel component is primarily responsible for evaluating incoming security data against detection logic and generating incidents when suspicious activity is identified?

1. Workbooks
2. Playbooks
3. Analytics rules
4. Data connectors

Correct Answer: 3

Explanation

Microsoft Sentinel analytics rules evaluate collected security data against configured detection logic. When matching activity is identified, an analytics rule can generate alerts and contribute to incident creation for investigation. Data connectors are responsible for bringing data from supported sources into Sentinel. Workbooks provide dashboards and visualization, while playbooks automate response actions after relevant events or incidents occur. Therefore, analytics rules perform the detection function that transforms security telemetry into actionable alerts and incidents.

Question 240

A security administrator wants to query resources across multiple Azure subscriptions using a single service designed for large-scale resource inventory and discovery. Which Azure service should be used?

1. Azure Monitor
2. Azure Resource Graph
3. Azure Bastion
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Resource Graph is designed to query information about Azure resources across subscriptions and management groups at scale. It provides a powerful way to inventory resources, identify configurations, and support governance or security investigations using a query language. Azure Monitor focuses on metrics, logs, and monitoring data, while Azure Bastion provides secure administrative access to virtual machines. Azure Key Vault manages secrets, keys, and certificates. Resource Graph is therefore the appropriate service when security administrators need large-scale resource discovery and inventory across Azure environments.