View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 261

Which Azure Storage capability allows an organization to define a separate encryption boundary for data within a storage account by using a dedicated encryption key?

1. Storage firewall
2. Shared Access Signature
3. Encryption scope
4. Resource lock

Correct Answer: 3

Explanation

An encryption scope provides a separate encryption boundary for data within an Azure Storage account. It can be associated with a customer-managed key or Microsoft-managed key, depending on the configuration and supported scenario. This allows organizations to apply different encryption requirements to specific containers or blobs rather than applying one key uniformly across the entire account. A storage firewall controls network access, a SAS delegates data access, and a resource lock protects management operations. Encryption scopes are therefore useful when different datasets require distinct encryption controls.

Question 262

A company wants to protect Azure disks using encryption keys that it controls and manages rather than relying exclusively on Microsoft-managed encryption keys. Which capability should be configured?

1. Customer-managed keys
2. Network Security Groups
3. Azure Bastion
4. Microsoft Sentinel

Correct Answer: 1

Explanation

Azure supports customer-managed keys for supported disk encryption scenarios, allowing organizations to maintain greater control over the cryptographic keys used to protect data. These keys can be managed through Azure Key Vault or supported key management services. This approach can help satisfy organizational security and compliance requirements involving key ownership, rotation, and lifecycle management. Network Security Groups control network traffic, Azure Bastion provides secure administrative connectivity, and Microsoft Sentinel handles security monitoring. Customer-managed keys are therefore appropriate when organizations require greater control over disk encryption keys.

Question 263

Which Azure SQL feature can identify database security weaknesses related to configurations, permissions, and potential vulnerabilities?

1. SQL auditing
2. SQL vulnerability assessment
3. Transparent Data Encryption
4. Private Link

Correct Answer: 2

Explanation

SQL vulnerability assessment helps organizations discover security weaknesses in Azure SQL databases. It can identify issues involving database configurations, permissions, and other security conditions that may require remediation. The results can help administrators prioritize corrective actions and improve the database security posture. SQL auditing is primarily used to record database events, while Transparent Data Encryption protects data at rest. Private Link provides private connectivity to supported Azure services. Therefore, vulnerability assessment is the appropriate feature when the objective is to identify potential database security weaknesses.

Question 264

An organization needs to record database activity for compliance investigations and retain the resulting audit information for later analysis. Which Azure SQL capability should be enabled?

1. SQL auditing
2. Dynamic Data Masking
3. Always Encrypted
4. Database firewall rules

Correct Answer: 1

Explanation

Azure SQL auditing records database events and user activities and can send audit information to supported destinations for retention and analysis. This makes it useful for compliance investigations, security monitoring, and forensic review. Dynamic Data Masking limits exposure of sensitive information in query results, while Always Encrypted protects sensitive columns from unauthorized access by database administrators and other parties. Firewall rules control network connectivity. SQL auditing is therefore the appropriate capability when the primary requirement is to maintain a record of database activity.

Question 265

Which Azure Storage feature can prevent a blob from being permanently modified or deleted during a defined retention period?

1. Storage account firewall
2. Immutable Blob Storage
3. Private endpoint
4. Azure Policy

Correct Answer: 2

Explanation

Immutable Blob Storage allows organizations to retain blob data in a protected state according to defined retention requirements. Time-based retention policies and legal holds can help prevent data from being modified or deleted while it must be preserved. This capability is particularly useful for regulatory, compliance, and records-management scenarios where data integrity must be maintained. A storage firewall restricts network access, a private endpoint provides private connectivity, and Azure Policy governs resource configurations. Immutable Blob Storage is therefore the appropriate feature for protecting retained blob data from modification or deletion.

Question 266

A security team needs to prevent administrators from permanently deleting protected Azure Storage data during an accidental or malicious deletion event. Which feature should be considered?

1. Storage firewall
2. Blob soft delete
3. Private DNS
4. Service endpoint

Correct Answer: 2

Explanation

Blob soft delete helps protect blob data from accidental or malicious deletion by retaining deleted blobs for a configured retention period. During that period, deleted data can potentially be recovered instead of being immediately lost. This provides an additional recovery mechanism for storage data. A storage firewall controls network access, private DNS provides name resolution for private resources, and a service endpoint provides optimized private connectivity from supported virtual networks. Blob soft delete is therefore the appropriate feature when recoverability after blob deletion is the primary requirement.

Question 267

Which Microsoft Entra capability is designed to manage requests for access to applications and resources through predefined access packages and approval policies?

1. Authentication strengths
2. Entitlement management
3. Identity Protection
4. Conditional Access

Correct Answer: 2

Explanation

Microsoft Entra entitlement management provides governance for access packages that can contain applications, groups, SharePoint sites, and other supported resources. Organizations can define request policies, approval requirements, expiration periods, and other conditions for access. This creates a structured process for granting and removing access based on business requirements. Authentication strengths determine acceptable authentication methods, Identity Protection evaluates identity risks, and Conditional Access applies access controls based on conditions. Entitlement management is therefore the appropriate capability for controlled resource-access requests through access packages.

Question 268

A security administrator wants to require approval before an eligible user can activate a highly privileged role. Which Microsoft Entra PIM setting supports this requirement?

1. Role activation approval
2. Named location
3. Access review
4. Authentication session

Correct Answer: 1

Explanation

Microsoft Entra Privileged Identity Management can require approval before eligible users activate certain privileged roles. This adds an additional governance step to sensitive privilege elevation and can help organizations enforce separation of duties. Other activation controls can also be configured depending on the role and organizational requirements. Named locations are used by Conditional Access to define network or geographic conditions. Access reviews evaluate whether access should continue, while session settings control authentication sessions. Role activation approval is therefore the relevant PIM capability for requiring authorization before privilege elevation.

Question 269

An organization wants to enforce a security baseline consisting of multiple Azure Policy requirements across several subscriptions. Which approach simplifies assignment of the related policies?

1. Assign each policy manually without grouping
2. Create a policy initiative
3. Create a resource lock
4. Configure an NSG

Correct Answer: 2

Explanation

A policy initiative combines multiple related Azure Policy definitions into a single logical collection. Organizations can assign the initiative at an appropriate management group, subscription, or resource scope, making it easier to apply and manage a broader security baseline. Each individual policy can still evaluate its own requirement while the initiative provides centralized assignment and governance. Resource locks protect resources from deletion or modification, while NSGs control network traffic. A policy initiative is therefore useful when several security policies need to be managed as one coordinated governance package.

Question 270

Which Azure Policy capability allows an organization to make an approved exception for a specific resource without removing the overall policy assignment?

1. Policy exemption
2. Policy initiative
3. Modify effect
4. Audit effect

Correct Answer: 1

Explanation

An Azure Policy exemption allows an organization to exclude a defined scope from a policy requirement while keeping the original policy assignment active elsewhere. This is useful when a specific resource or environment has a documented business, technical, or compliance reason for requiring different treatment. A policy initiative groups policy definitions, while Modify changes supported resource properties and Audit reports noncompliance. An exemption therefore provides a controlled governance mechanism for approved exceptions without weakening the policy assignment across the broader environment.

Question 271

Which Azure networking architecture allows a customer to expose its own service privately to consumers through Azure Private Link?

1. Private Link service
2. Network Security Group
3. Azure DNS
4. Azure Bastion

Correct Answer: 1

Explanation

Azure Private Link service allows a service provider to expose an application or service privately to consumers through private endpoints. The service provider can publish the service behind a supported Azure load balancer, while consumers establish private connectivity from their own virtual networks. This architecture avoids exposing the service through a public endpoint. Network Security Groups control network traffic, Azure DNS provides name resolution, and Azure Bastion provides secure administrative access to virtual machines. Private Link service is therefore appropriate when an organization wants to privately publish its own service to other consumers.

Question 272

A company wants to ensure that a virtual machine management subnet used by Azure Bastion follows the required subnet naming convention. Which subnet name is required for Azure Bastion?

1. AzureFirewallSubnet
2. GatewaySubnet
3. AzureBastionSubnet
4. ManagementSubnet

Correct Answer: 3

Explanation

Azure Bastion requires a dedicated subnet named AzureBastionSubnet within the virtual network where the Bastion resource is deployed. This dedicated subnet is reserved for Bastion infrastructure and should be configured according to the service’s deployment requirements. GatewaySubnet is associated with VPN Gateway or ExpressRoute gateway infrastructure, while AzureFirewallSubnet is used for Azure Firewall deployments. ManagementSubnet is not the required Azure Bastion subnet name. Therefore, AzureBastionSubnet is the correct subnet required for an Azure Bastion deployment.

Question 273

Which Azure Firewall capability can block connections to destinations identified as malicious based on Microsoft’s threat intelligence information?

1. Threat intelligence-based filtering
2. Resource locking
3. Access reviews
4. Storage encryption

Correct Answer: 1

Explanation

Azure Firewall includes threat intelligence-based filtering that can help identify and block traffic involving known malicious IP addresses and domains based on Microsoft’s threat intelligence information. This provides an additional layer of protection against connections to known malicious destinations. Resource locks protect Azure resources from certain management operations, access reviews evaluate identity permissions, and storage encryption protects stored data. Threat intelligence-based filtering is therefore the Azure Firewall capability that specifically addresses connections associated with known malicious indicators.

Question 274

A security team wants to collect Azure Activity Log information from multiple subscriptions into a centralized Log Analytics workspace. What should be configured?

1. Resource lock
2. Diagnostic settings
3. Private endpoint
4. Network Security Group

Correct Answer: 2

Explanation

Diagnostic settings can route Azure Activity Log categories to supported destinations such as a Log Analytics workspace. Centralizing activity information allows security teams to query management-plane operations across resources and subscriptions and correlate them with other security telemetry. Resource locks protect resources, private endpoints provide private connectivity to supported services, and NSGs control network traffic. Diagnostic settings therefore provide the configuration needed to forward relevant Activity Log data to a centralized Log Analytics environment for monitoring, investigation, and compliance purposes.

Question 275

Which Microsoft Defender for Cloud capability helps organizations compare their environment against recognized security and compliance standards?

1. Regulatory compliance dashboard
2. Azure Bastion
3. Storage lifecycle management
4. Private DNS

Correct Answer: 1

Explanation

The Microsoft Defender for Cloud regulatory compliance dashboard helps organizations assess their environment against supported regulatory and security standards. It presents compliance information and related recommendations so security teams can identify areas that require attention. Azure Bastion provides secure administrative connectivity, Storage lifecycle management controls data movement or retention behavior, and Private DNS provides private name resolution. The regulatory compliance capability is therefore appropriate when an organization needs visibility into how its Azure environment aligns with recognized compliance requirements and security standards.

Question 276

An administrator wants to reduce the number of permanently assigned privileged permissions by making users eligible for administrative roles that they activate only when necessary. Which principle does this approach primarily support?

1. Public access
2. Least privilege
3. Data replication
4. Network segmentation

Correct Answer: 2

Explanation

The least-privilege principle requires users and services to receive only the permissions necessary to perform their responsibilities. Making administrators eligible for privileged roles and requiring temporary activation reduces the amount of time that elevated permissions remain active. This limits the potential impact if an account is compromised and reduces unnecessary standing privileges. Public access concerns resource exposure, data replication concerns availability or distribution of information, and network segmentation separates network zones. The described privileged-access approach therefore primarily supports least privilege.

Question 277

Which Azure security mechanism can enforce that a storage account is accessible only through selected virtual networks or private connectivity options?

1. Storage network access controls
2. SQL auditing
3. Key rotation
4. Access reviews

Correct Answer: 1

Explanation

Azure Storage network access controls allow administrators to restrict how clients can reach a storage account. Depending on the architecture, administrators can configure selected networks, private endpoints, firewall rules, and related access settings to reduce unwanted network exposure. SQL auditing records database activity, key rotation manages cryptographic lifecycle requirements, and access reviews govern identity permissions. Storage network access controls are therefore the appropriate mechanism when the security requirement concerns restricting storage account connectivity to approved networks or private access paths.

Question 278

A security engineer wants to determine which Azure resources have a specific security-related configuration across many subscriptions without manually opening each resource. Which service is most suitable?

1. Azure Resource Graph
2. Azure Bastion
3. Azure Key Vault
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Azure Resource Graph is designed for querying Azure resource information at scale across subscriptions and management groups. Security administrators can use queries to discover resources, inspect properties, identify configurations, and support large-scale governance investigations. This is more efficient than manually examining individual resources through the Azure portal. Azure Bastion provides secure VM administration, Key Vault manages secrets and cryptographic material, and DDoS Protection mitigates denial-of-service attacks. Resource Graph is therefore well suited for large-scale security inventory and configuration discovery.

Question 279

Which Azure security option can require a resource deployment to satisfy organizational tagging requirements before the deployment is allowed?

1. Azure Monitor
2. Microsoft Sentinel
3. Azure Policy with the Deny effect
4. Azure Bastion

Correct Answer: 3

Explanation

Azure Policy with the Deny effect can prevent resource deployments when required conditions are not satisfied. For example, an organization can define a policy requiring a specific security or ownership tag and reject deployments that do not contain the required configuration. Azure Monitor collects and analyzes monitoring data, Microsoft Sentinel provides security analytics and response, and Azure Bastion provides secure administrative connectivity. When the objective is to prevent noncompliant resources from being deployed, the Deny policy effect provides preventive governance.

Question 280

Which Azure security service can help detect threats against App Service workloads and provide security recommendations for supported web applications?

1. Microsoft Defender for App Service
2. Azure Resource Graph
3. Azure Policy
4. Azure Bastion

Correct Answer: 1

Explanation

Microsoft Defender for App Service provides security capabilities designed to help protect supported Azure App Service workloads. It can provide threat detection and security recommendations that help organizations identify and respond to risks affecting web applications and their hosting environment. Azure Resource Graph is used for resource querying and inventory, Azure Policy enforces governance requirements, and Azure Bastion provides secure access to virtual machines. Defender for App Service is therefore the appropriate service when the protected workload is an Azure App Service application.