View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 321

Which Azure capability can help a security administrator identify the effective permissions assigned to a user across Azure resources?

1. Azure DDoS Protection
2. Azure Firewall
3. Microsoft Sentinel
4. Azure RBAC

Correct Answer: 4

Explanation

Azure role-based access control determines which management actions a user, group, service principal, or managed identity can perform on Azure resources. By reviewing role assignments and their scopes, administrators can identify the effective permissions available to an identity and determine whether those permissions follow least-privilege requirements. Azure DDoS Protection addresses network attacks, Azure Firewall filters traffic, and Microsoft Sentinel provides security analytics. Azure RBAC is therefore the appropriate control for managing and reviewing authorization to Azure resources.

Question 322

A company wants to ensure that a storage account accepts requests only over encrypted transport. Which setting should be enabled?

1. Secure transfer required
2. Anonymous blob access
3. Public network access
4. Cross-origin resource sharing

Correct Answer: 1

Explanation

The Secure transfer required setting helps ensure that supported requests to Azure Storage use secure transport, such as HTTPS, instead of unencrypted HTTP. This protects information while it travels between clients and the storage service. Anonymous blob access concerns unauthenticated data exposure, public network access controls network reachability, and cross-origin resource sharing controls browser-based access behavior. Secure transfer required is therefore the appropriate setting when an organization wants to enforce encrypted communication with an Azure Storage account.

Question 323

Which Microsoft Entra feature can provide governance over privileged access by requiring users to activate eligible administrative roles only when necessary?

1. Access reviews
2. Privileged Identity Management
3. Entitlement management
4. Authentication strengths

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management allows organizations to make users eligible for privileged roles instead of permanently assigning elevated permissions. Users can activate their eligible roles when required, and administrators can apply controls such as time limits, approval, justification, and multifactor authentication. Access reviews periodically evaluate existing access, entitlement management governs access packages, and authentication strengths define acceptable authentication methods. PIM is therefore the appropriate capability when an organization wants to reduce standing administrative privileges through controlled, just-in-time role activation.

Question 324

A security team needs to analyze management-plane activities such as resource creation, deletion, and configuration changes in Azure. Which log should they primarily review?

1. NSG flow logs
2. Azure Activity Log
3. Application logs
4. Storage access logs

Correct Answer: 2

Explanation

The Azure Activity Log records management-plane operations performed on Azure resources. Events such as resource creation, deletion, configuration changes, and administrative operations can be reviewed through the Activity Log. This makes it useful for auditing administrative actions and investigating changes to the Azure environment. NSG flow logs focus on network traffic flows, application logs contain application-specific information, and storage access logs focus on storage activity. The Azure Activity Log is therefore the appropriate source when investigating Azure management-plane changes.

Question 325

Which Azure security feature can help protect a web application from common attacks such as SQL injection and cross-site scripting?

1. Azure Web Application Firewall
2. Azure Resource Graph
3. Azure Key Vault
4. Azure Bastion

Correct Answer: 1

Explanation

Azure Web Application Firewall provides application-layer protection for supported web applications and can use managed and custom rules to detect and block common web attacks. SQL injection and cross-site scripting are examples of threats that WAF rules can help address. Resource Graph is used for resource inventory and querying, Key Vault manages secrets and cryptographic material, and Bastion provides secure administrative access to virtual machines. Azure Web Application Firewall is therefore the appropriate security control when HTTP and HTTPS requests need to be inspected for common application-layer attacks.

Question 326

An organization wants to use a central identity to allow an Azure automation workload to access Key Vault without storing credentials in code. Which solution should be used?

1. Storage account key
2. Managed identity
3. Public access
4. Shared Access Signature

Correct Answer: 2

Explanation

A managed identity provides an Azure-managed Microsoft Entra identity that workloads can use to authenticate to supported services such as Key Vault. This eliminates the need to place passwords, client secrets, or storage keys directly in application code. Administrators can assign only the permissions required by the workload, supporting least privilege. Storage account keys and SAS tokens are primarily associated with Azure Storage access, while public access would weaken the security model. Managed identity is therefore the preferred solution for secure, credential-free workload authentication to Key Vault.

Question 327

Which Azure Policy effect is designed to report resources that do not comply with a requirement while allowing those resources to continue operating?

1. Deny
2. Modify
3. Audit
4. DeployIfNotExists

Correct Answer: 3

Explanation

The Audit effect identifies resources that do not comply with an Azure Policy requirement without directly blocking their creation or modification. This is useful when organizations want to assess their current security posture before introducing stronger preventive controls. Deny blocks noncompliant requests, Modify changes supported resource properties, and DeployIfNotExists can deploy a related resource or configuration when a required condition is missing. Audit is therefore appropriate when the immediate goal is visibility into noncompliance rather than enforcement through deployment blocking.

Question 328

A security administrator wants to grant a team permission to manage virtual machines but not Key Vault resources or networking resources. Which Azure security mechanism provides the required scope-specific authorization?

1. Azure RBAC
2. Azure DDoS Protection
3. Azure Policy
4. Microsoft Sentinel

Correct Answer: 1

Explanation

Azure RBAC allows administrators to assign permissions at defined scopes, such as management groups, subscriptions, resource groups, or individual resources. A suitable built-in or custom role can provide the team with virtual machine management permissions without granting unrelated access to Key Vault or networking resources. Azure Policy governs resource configuration, DDoS Protection addresses network attacks, and Sentinel provides security monitoring and analytics. Azure RBAC is therefore the mechanism that directly controls which management actions a team can perform on specific Azure resources.

Question 329

Which Azure Key Vault protection feature helps prevent an attacker or administrator from immediately purging a deleted secret, key, or certificate?

1. Azure Policy
2. Diagnostic settings
3. Purge protection
4. Network Security Group

Correct Answer: 3

Explanation

Purge protection provides an additional safeguard for Azure Key Vault objects that have been soft-deleted. When enabled, protected objects cannot be permanently purged before the applicable retention period expires. This helps protect sensitive cryptographic material and secrets from irreversible deletion caused by mistakes or malicious activity. Azure Policy can enforce governance requirements, diagnostic settings collect logs, and Network Security Groups control network traffic. Purge protection is therefore the specific Key Vault capability designed to reduce the risk of immediate permanent deletion.

Question 330

Which Microsoft Defender for Cloud feature can identify security recommendations that should be addressed to improve an organization’s cloud security posture?

1. Secure score
2. Security recommendations
3. Private endpoint
4. Resource lock

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides security recommendations that identify areas where Azure resources or workloads may require security improvements. Recommendations can cover configuration weaknesses, missing protections, identity risks, and other supported security conditions. Secure Score summarizes aspects of the security posture and can help prioritize improvement, but the recommendations provide the specific actions or issues that administrators can investigate and remediate. Private endpoints provide private connectivity, while resource locks protect resources from selected management operations. Security recommendations are therefore the direct feature for identifying improvement actions.

Question 331

A security engineer wants to prevent a public-facing Azure resource from accepting traffic from a specific untrusted source IP address. Which network control is appropriate when the traffic is handled at a subnet or network-interface level?

1. Network Security Group
2. Azure Key Vault
3. Azure Policy
4. Microsoft Entra ID Protection

Correct Answer: 1

Explanation

A Network Security Group can contain inbound rules that allow or deny traffic based on source and destination information, ports, and protocols. Administrators can therefore create a rule that denies traffic from a specified untrusted source IP address when the applicable resource or subnet supports NSG association. Key Vault protects secrets and cryptographic material, Azure Policy governs resource configuration, and Entra ID Protection evaluates identity risks. An NSG is therefore the appropriate network-level control for filtering unwanted traffic from a source address.

Question 332

Which Microsoft Sentinel component can automatically execute a response workflow after a security incident or alert triggers the configured automation?

1. Workbooks
2. Data connectors
3. Playbooks
4. Analytics rules

Correct Answer: 3

Explanation

Microsoft Sentinel playbooks use Azure Logic Apps to automate response and remediation workflows. A playbook can perform actions such as sending notifications, creating tickets, enriching information, or interacting with other security services after an alert or incident triggers it. Data connectors ingest security information, analytics rules detect suspicious activity, and workbooks provide visualization and analysis. Therefore, playbooks are the appropriate Sentinel component when the requirement is to automatically execute a response workflow based on a security event.

Question 333

Which Azure Storage configuration can prevent clients from accessing a storage account through its public network endpoint?

1. Secure transfer required
2. Public network access disabled
3. Blob versioning
4. Soft delete

Correct Answer: 2

Explanation

Disabling public network access can prevent access to a supported Azure Storage account through its public network endpoint, depending on the configured private access architecture. Organizations can combine this setting with private endpoints to provide controlled private connectivity from approved networks. Secure transfer required protects data in transit but does not remove public network exposure. Blob versioning preserves previous versions of blobs, while soft delete supports recovery after deletion. Public network access controls are therefore the relevant configuration when public endpoint access must be restricted.

Question 334

A company wants to retain previous versions of blobs so that users can recover an earlier version after an accidental overwrite. Which feature should be enabled?

1. Blob versioning
2. Azure Firewall
3. Key rotation
4. Conditional Access

Correct Answer: 1

Explanation

Azure Blob Storage versioning automatically maintains previous versions of supported blob data when changes occur. This allows administrators or applications to access earlier versions and can help recover from accidental overwrites or unwanted changes. Azure Firewall filters network traffic, key rotation manages cryptographic keys, and Conditional Access governs identity access based on conditions. Blob versioning is therefore the appropriate storage protection feature when the organization needs to preserve historical versions of data for recovery or investigation.

Question 335

Which Microsoft Entra capability can require an additional authentication control when a user attempts to access a resource from an untrusted network location?

1. Access reviews
2. Conditional Access
3. Entitlement management
4. Privileged Identity Management

Correct Answer: 2

Explanation

Microsoft Entra Conditional Access can evaluate conditions such as user identity, application, device state, and network location before applying access controls. Administrators can define trusted or named locations and configure policies that require multifactor authentication or other controls when users access resources from outside approved locations. Access reviews evaluate whether access should continue, entitlement management governs access packages, and PIM manages privileged role activation. Conditional Access is therefore the appropriate capability when authentication requirements must change according to the user’s network location.

Question 336

Which Azure security service can help protect supported container environments by identifying vulnerabilities and suspicious container activity?

1. Defender for Containers
2. Defender for Storage
3. Defender for App Service
4. Defender for Key Vault

Correct Answer: 1

Explanation

Microsoft Defender for Containers provides security capabilities for supported container environments. Depending on the workload and enabled features, it can help identify vulnerabilities, configuration weaknesses, and suspicious activity associated with containerized applications. Defender for Storage protects storage workloads, Defender for App Service focuses on supported web applications, and Defender for Key Vault monitors Key Vault-related activity. Defender for Containers is therefore the appropriate security service when the organization’s workload consists of supported container environments.

Question 337

Which Azure service can help an organization discover resources with specific properties across many subscriptions by using a query language?

1. Azure Bastion
2. Azure Resource Graph
3. Azure DDoS Protection
4. Azure VPN Gateway

Correct Answer: 2

Explanation

Azure Resource Graph provides a query-based method for discovering and examining Azure resources across subscriptions and management groups. Security teams can use queries to identify resources by type, location, configuration, tags, and other available properties. This is useful for security inventories, compliance checks, and investigations that involve many subscriptions. Azure Bastion provides VM administration, DDoS Protection mitigates denial-of-service attacks, and VPN Gateway provides network connectivity. Azure Resource Graph is therefore the appropriate service for large-scale resource discovery through queries.

Question 338

A security team wants to require that only compliant devices can access a sensitive cloud application. Which Conditional Access condition should be evaluated?

1. Device state
2. Storage account tier
3. Azure region
4. Resource lock status

Correct Answer: 1

Explanation

Conditional Access can evaluate device-related conditions and require that devices meet organizational compliance requirements before access is granted to selected applications or resources. When integrated with Microsoft Intune and supported Microsoft Entra capabilities, administrators can create policies that require a device to be marked compliant. Storage account tiers, Azure regions, and resource lock status are not Conditional Access device conditions. Device state is therefore the relevant condition when an organization wants access decisions to depend on the security and compliance state of the user’s device.

Question 339

Which Azure Firewall capability is intended to control inbound or outbound traffic using IP addresses, ports, and network protocols?

1. Application rules
2. DNAT rules
3. Network rules
4. Threat intelligence reports

Correct Answer: 3

Explanation

Azure Firewall network rules provide network-level traffic filtering using properties such as source and destination IP addresses, ports, and protocols. They are useful when administrators need to control traffic based on network characteristics rather than application-level domain information. Application rules provide application-aware filtering for supported protocols, while DNAT rules translate incoming destinations to internal resources. Threat intelligence capabilities help identify malicious destinations or sources. Network rules are therefore appropriate when the filtering requirement is based on IP addresses, ports, and protocols.

Question 340

Which Azure governance capability can automatically deploy a required configuration or related resource when an existing resource does not meet a specified condition?

1. Audit
2. Deny
3. Modify
4. DeployIfNotExists

Correct Answer: 4

Explanation

The DeployIfNotExists Azure Policy effect can trigger the deployment of a related resource or configuration when the evaluated resource does not meet a specified condition. This can be useful for governance scenarios where an organization wants required security or monitoring configurations to be automatically established rather than merely reported. Audit reports noncompliance, Deny blocks noncompliant requests, and Modify changes supported resource properties. DeployIfNotExists is therefore the appropriate policy effect when the organization wants Azure Policy to initiate a supporting deployment when a required configuration is absent.