View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 281

Which Azure capability can help an organization identify security risks associated with excessive permissions assigned to identities?

1. Azure Bastion
2. Microsoft Defender for Cloud
3. Azure Storage
4. Azure DNS

Correct Answer: 2

Explanation

Microsoft Defender for Cloud can provide security recommendations that help organizations identify and address identity and access-related risks in supported environments. Excessive permissions can increase the potential impact of compromised accounts and conflict with least-privilege principles. Defender for Cloud brings together security posture information and recommendations that can guide remediation. Azure Bastion provides secure virtual machine access, Azure Storage manages data services, and Azure DNS provides name resolution. Defender for Cloud is therefore the appropriate choice when security teams need centralized visibility into cloud security risks and recommended improvements.

Question 282

A security administrator needs to prevent users from assigning a highly privileged Azure role unless they have an approved business requirement. Which control can help enforce this governance requirement?

1. Microsoft Entra Privileged Identity Management
2. Azure Storage encryption
3. Network Security Group
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Microsoft Entra Privileged Identity Management can help govern privileged role assignments by providing eligibility, activation, approval, justification, and time-bound controls. Organizations can require users to activate privileged roles only when needed and can configure approval for sensitive assignments or activations. This reduces standing administrative privileges and improves control over privileged access. Storage encryption protects data at rest, NSGs filter network traffic, and DDoS Protection mitigates denial-of-service attacks. PIM is therefore the most appropriate control when privileged Azure role access must be governed according to business requirements.

Question 283

Which Azure Storage option provides encryption for data at rest while allowing an organization to use a key stored in Azure Key Vault?

1. Shared Access Signature
2. Customer-managed key
3. Service endpoint
4. Storage firewall

Correct Answer: 2

Explanation

A customer-managed key allows an organization to control the cryptographic key used for supported Azure Storage encryption scenarios. The key can be maintained in Azure Key Vault, where administrators can manage permissions, rotation, expiration, and lifecycle requirements. A Shared Access Signature controls delegated access to storage data, while a service endpoint provides network connectivity from supported virtual networks. A storage firewall restricts network access. Customer-managed keys are therefore appropriate when an organization needs control over encryption keys instead of relying solely on Microsoft-managed keys.

Question 284

An organization wants to ensure that security logs from Azure resources remain available for investigation even if the originating resource is later deleted. Which destination is generally suitable for centralized retention and analysis?

1. Azure Bastion
2. Azure Key Vault
3. Log Analytics workspace
4. Network Security Group

Correct Answer: 3

Explanation

A Log Analytics workspace provides centralized storage and analysis for supported Azure logs and telemetry. Sending security-relevant logs to a centralized workspace separates the retained monitoring data from the individual resource that generated it. This can help security teams continue investigating historical activity even when the original resource is changed or removed, subject to configured retention settings. Azure Bastion provides administrative access, Key Vault manages secrets and keys, and NSGs control network traffic. A Log Analytics workspace is therefore suitable for centralized security log retention and analysis.

Question 285

Which Microsoft Entra feature can help detect whether a sign-in is considered risky based on signals such as unfamiliar locations or suspicious authentication behavior?

1. Identity Protection
2. Resource locks
3. Azure Policy
4. Azure Firewall

Correct Answer: 1

Explanation

Microsoft Entra ID Protection evaluates identity and authentication signals to identify potentially risky users and sign-ins. Risk detections can include suspicious authentication behavior and other indicators that may suggest an account or sign-in is compromised. These risk signals can also be used with Conditional Access to require additional controls. Resource locks protect Azure resources, Azure Policy governs resource configurations, and Azure Firewall filters network traffic. Identity Protection is therefore the appropriate Microsoft Entra capability when the objective is to identify potentially risky authentication activity.

Question 286

Which Azure security feature can restrict access to a Key Vault so that requests are permitted only from configured networks or private endpoints?

1. Key rotation
2. Key versioning
3. Key Vault networking controls
4. Access reviews

Correct Answer: 3

Explanation

Azure Key Vault provides networking controls that can restrict how clients connect to the vault. Administrators can configure network access rules and private connectivity options to reduce exposure and limit requests to approved network paths. This complements identity-based authorization by adding a network security layer around sensitive keys, secrets, and certificates. Key rotation changes cryptographic keys over time, key versioning manages different versions of keys, and access reviews govern identity access. Key Vault networking controls are therefore appropriate when access must be restricted according to network location or private connectivity requirements.

Question 287

A company needs to ensure that a storage account cannot be reached through its public endpoint and must instead be accessed privately from an Azure virtual network. Which design is most appropriate?

1. Public IP with NSG
2. Private endpoint
3. Shared Access Signature
4. Azure Policy only

Correct Answer: 2

Explanation

A private endpoint provides a private IP address within an Azure virtual network for supported Azure services such as Storage. Applications can use private connectivity to the storage account without relying on its public endpoint. This architecture can be combined with appropriate DNS and network access controls to ensure traffic follows the intended private path. A public IP with an NSG still involves a public endpoint, while a SAS controls authorization rather than network exposure. Azure Policy can enforce configurations but does not itself create private connectivity. A private endpoint is therefore the appropriate design.

Question 288

Which Azure Firewall feature allows administrators to define rules that filter outbound traffic based on fully qualified domain names for supported protocols?

1. Network rules
2. Application rules
3. NAT rules
4. Resource locks

Correct Answer: 2

Explanation

Azure Firewall application rules can filter traffic based on application-level information such as fully qualified domain names for supported protocols. This allows administrators to control which destinations applications can reach rather than relying only on IP addresses and ports. Network rules primarily evaluate network-level characteristics, while NAT rules are used for network address translation scenarios. Resource locks do not filter traffic. Application rules are therefore useful when an organization needs application-aware outbound filtering based on permitted domain destinations.

Question 289

A security team wants to identify whether an Azure policy assignment is currently being satisfied by resources within its assigned scope. Which information should the team review?

1. Policy compliance state
2. VPN connection status
3. DNS records
4. Key version number

Correct Answer: 1

Explanation

Azure Policy provides compliance information that shows whether resources satisfy assigned policy requirements. Administrators can review the compliance state to identify compliant and noncompliant resources and investigate policy failures. This information can support remediation and governance activities across subscriptions and resource groups. VPN connection status relates to network connectivity, DNS records provide name-resolution information, and key version numbers identify cryptographic key versions. Policy compliance state is therefore the relevant information when determining whether resources currently satisfy assigned governance requirements.

Question 290

Which Microsoft Sentinel component brings security data from external services and Azure resources into the Sentinel environment?

1. Workbooks
2. Playbooks
3. Data connectors
4. Resource locks

Correct Answer: 3

Explanation

Microsoft Sentinel data connectors provide integration with supported data sources and allow security information to be collected into the Sentinel environment. Once data is available, analytics rules can evaluate it, workbooks can visualize it, and playbooks can automate response activities. Workbooks are primarily used for visualization, while playbooks provide automated workflows. Resource locks are unrelated to Sentinel data ingestion. Data connectors are therefore the appropriate component when the requirement is to bring security telemetry from Azure resources or external services into Microsoft Sentinel.

Question 291

A security administrator wants to limit the permissions granted to an application that accesses Azure resources without a user being present. Which identity type is commonly used for this workload scenario?

1. Managed identity
2. Resource lock
3. Network Security Group
4. Storage firewall

Correct Answer: 1

Explanation

A managed identity provides an Azure-managed identity for applications and services that need to authenticate to supported resources without storing credentials in application code or configuration. Administrators can then assign only the permissions required by that identity, supporting least privilege. This is particularly useful for background services, automation, and workloads that need to access Key Vault, Storage, or other Azure resources. Resource locks protect resources, NSGs control network traffic, and storage firewalls restrict network access. Managed identities are therefore appropriate for secure workload authentication without embedded credentials.

Question 292

Which Azure security control can prevent a user from creating a resource configuration that violates an organization’s mandatory security requirement?

1. Azure Monitor
2. Azure Policy with Deny
3. Microsoft Sentinel workbook
4. Azure Resource Graph

Correct Answer: 2

Explanation

Azure Policy with the Deny effect provides preventive governance by rejecting resource creation or modification requests that violate the defined policy condition. This allows organizations to enforce mandatory security requirements before noncompliant configurations are deployed. Azure Monitor focuses on monitoring and telemetry, Sentinel workbooks provide security visualization, and Azure Resource Graph supports resource inventory and querying. When the requirement is to stop a prohibited configuration from being deployed rather than simply report it afterward, Azure Policy with Deny is the appropriate control.

Question 293

Which Azure Storage protection feature allows administrators to recover deleted containers or blobs during a configured retention period?

1. Soft delete
2. Application rules
3. Private Link
4. Key rotation

Correct Answer: 1

Explanation

Azure Storage soft delete provides a recovery mechanism for supported deleted data by retaining it for a configured period. This can help protect against accidental deletion, malicious deletion, or operational mistakes. During the retention period, administrators may be able to restore the deleted data depending on the specific storage feature and configuration. Application rules filter network traffic through Azure Firewall, Private Link provides private connectivity, and key rotation manages cryptographic lifecycle requirements. Soft delete is therefore the appropriate storage protection capability when recovery from deletion is required.

Question 294

An organization wants to require users to authenticate with a specific stronger authentication method when accessing a sensitive application. Which Microsoft Entra feature should be incorporated into the Conditional Access policy?

1. Access reviews
2. Authentication strengths
3. Resource locks
4. Policy exemptions

Correct Answer: 2

Explanation

Authentication strengths allow Microsoft Entra administrators to define which authentication methods are acceptable for a particular Conditional Access scenario. A policy can require a stronger authentication combination when users access sensitive applications or resources. This provides more granular control than simply requiring generic multifactor authentication. Access reviews are used to periodically evaluate existing access, resource locks protect Azure resources, and policy exemptions apply to Azure Policy governance. Authentication strengths are therefore appropriate when the organization needs to enforce stronger or specific authentication methods for sensitive access.

Question 295

Which Azure service can provide a centralized security posture view that combines recommendations, alerts, and other security information for supported cloud workloads?

1. Microsoft Defender for Cloud
2. Azure DNS
3. Azure Bastion
4. Azure Storage

Correct Answer: 1

Explanation

Microsoft Defender for Cloud provides centralized security posture management and workload protection capabilities for supported environments. It can present security recommendations, alerts, and other information that helps security teams understand and improve their cloud security posture. Azure DNS handles name resolution, Azure Bastion provides secure administrative access to virtual machines, and Azure Storage provides cloud storage services. Defender for Cloud is therefore the service designed to provide a centralized security view and help organizations identify and respond to security issues across supported workloads.

Question 296

A company wants to prevent unauthorized changes to a critical Azure resource but still permit users to view its configuration. Which resource lock should be used?

1. CanNotDelete
2. ReadOnly
3. Audit
4. Modify

Correct Answer: 2

Explanation

A ReadOnly resource lock prevents users from modifying or deleting the protected resource through supported management operations while still allowing read access. This makes it suitable when a critical resource must remain unchanged but administrators and users still need to inspect its configuration. A CanNotDelete lock prevents deletion but permits modifications. Audit and Modify are Azure Policy effects rather than resource lock types. Therefore, ReadOnly is appropriate when the organization needs to prevent configuration changes while maintaining visibility into the resource.

Question 297

Which Microsoft Defender for Cloud feature can provide security recommendations specifically related to storage accounts and storage workloads?

1. Defender for Storage
2. Defender for Servers
3. Defender for Containers
4. Defender for App Service

Correct Answer: 1

Explanation

Microsoft Defender for Storage provides security capabilities focused on supported Azure Storage workloads. It can help identify suspicious activity and security issues associated with storage resources and provide relevant recommendations or alerts depending on the enabled capabilities. Defender for Servers focuses on server workloads, Defender for Containers protects container environments, and Defender for App Service focuses on supported web application workloads. When the protected resource is Azure Storage and the organization needs workload-specific security monitoring, Defender for Storage is the appropriate Defender plan.

Question 298

A security administrator wants to identify all virtual machines across several subscriptions that have a particular configuration property. Which query-oriented Azure service is most appropriate?

1. Azure Bastion
2. Azure Resource Graph
3. Azure DDoS Protection
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Resource Graph is designed to query Azure resources at scale across subscriptions and management groups. Security administrators can use Resource Graph queries to identify resources based on properties, configurations, resource types, and other attributes. This makes it useful for security inventory, compliance checks, and large-scale configuration investigations. Azure Bastion provides secure VM access, DDoS Protection addresses network attack mitigation, and Key Vault manages cryptographic material and secrets. Resource Graph is therefore the appropriate service for querying virtual machines across multiple subscriptions.

Question 299

Which Azure Policy effect is most appropriate when an organization wants to report a security configuration as noncompliant without preventing the resource from being deployed?

1. Deny
2. Modify
3. Audit
4. Disabled

Correct Answer: 3

Explanation

The Audit effect records or reports resources that do not comply with the policy requirement without blocking their deployment or update. This is useful when an organization first wants visibility into the current security posture before introducing preventive enforcement. Deny would block noncompliant operations, while Modify can alter supported properties to bring resources into compliance. A disabled policy does not actively evaluate the requirement. Therefore, Audit is appropriate when security teams need to identify noncompliance without interrupting resource deployment.

Question 300

An organization needs to protect sensitive data stored in selected Azure SQL columns so that the database engine does not expose the plaintext values to unauthorized users, including certain database administrators. Which feature is designed for this requirement?

1. SQL auditing
2. Always Encrypted
3. Transparent Data Encryption
4. SQL firewall rules

Correct Answer: 2

Explanation

Always Encrypted is designed to protect sensitive SQL data by encrypting designated columns so that plaintext values are not exposed to the database engine in the same manner as normally encrypted-at-rest data. Encryption and decryption can occur within the client application, helping protect sensitive information from unauthorized database access, including certain privileged database users. SQL auditing records activity, Transparent Data Encryption protects database files at rest, and firewall rules restrict network access. Always Encrypted is therefore the appropriate feature when column-level protection against unauthorized plaintext exposure is required.