View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 341

Which Azure security capability allows an organization to define a centralized set of policies that can be applied consistently to resources across multiple subscriptions?

1. Network Security Group
2. Azure Bastion
3. Resource lock
4. Azure Policy

Correct Answer: 4

Explanation

Azure Policy provides centralized governance for Azure resources and can enforce or evaluate organizational requirements across subscriptions and management groups. Administrators can assign policies or policy initiatives at an appropriate scope so that security, compliance, tagging, location, and configuration requirements are consistently evaluated. Network Security Groups control network traffic, Azure Bastion provides secure virtual machine administration, and resource locks protect resources from selected management operations. Azure Policy is therefore the appropriate capability when an organization needs centralized and consistent resource governance across multiple Azure subscriptions.

Question 342

Which Microsoft Entra feature allows an organization to periodically confirm whether users still require access to a sensitive application?

1. Access reviews
2. Conditional Access
3. Authentication strengths
4. Azure RBAC

Correct Answer: 1

Explanation

Microsoft Entra access reviews provide a structured process for periodically reviewing whether users, groups, or other identities should retain access to applications and resources. Reviewers can confirm continued access or remove permissions that are no longer required. This helps organizations reduce unnecessary access and supports ongoing identity governance. Conditional Access controls access based on conditions, authentication strengths define acceptable authentication methods, and Azure RBAC manages permissions to Azure resources. Access reviews are therefore the appropriate feature when an organization needs recurring verification of existing application access.

Question 343

Which Azure Storage feature can help recover data after a blob has been accidentally overwritten by maintaining previous blob versions?

1. Storage firewall
2. Private endpoint
3. Blob versioning
4. Secure transfer

Correct Answer: 3

Explanation

Blob versioning maintains previous versions of supported blobs when changes are made. If a user or application accidentally overwrites a blob, an earlier version can remain available for recovery, depending on the configured storage features and retention requirements. A storage firewall controls network access, a private endpoint provides private connectivity, and secure transfer protects communication between clients and the storage service. Blob versioning is therefore the appropriate feature when the organization needs to preserve historical blob versions and recover from accidental modifications.

Question 344

A security administrator wants to ensure that only resources in approved Azure regions can be created within a subscription. Which Azure Policy effect should be used to block deployments to unauthorized regions?

1. Audit
2. Deny
3. Modify
4. Append

Correct Answer: 2

Explanation

The Deny effect prevents resource creation or modification when the requested configuration violates the policy requirement. A policy can evaluate the resource location and reject deployments outside the organization’s approved Azure regions. Audit only reports noncompliance, while Modify changes supported resource properties and Append adds supported fields to resource requests. When geographic restrictions must be enforced before deployment rather than simply reported afterward, the Deny effect is the appropriate preventive control.

Question 345

Which Azure service provides centralized protection and security recommendations for supported virtual machines and server workloads?

1. Microsoft Defender for Servers
2. Azure DNS
3. Azure Bastion
4. Azure Resource Graph

Correct Answer: 1

Explanation

Microsoft Defender for Servers provides security capabilities for supported server workloads, including virtual machines. Depending on the enabled plan and environment, it can provide threat detection, security recommendations, vulnerability-related capabilities, and other workload protections. Azure DNS provides name resolution, Azure Bastion enables secure administrative access to virtual machines, and Azure Resource Graph supports resource inventory and querying. Defender for Servers is therefore the appropriate security service when an organization needs workload-focused protection and security recommendations for supported server environments.

Question 346

An organization wants to use a private IP address in its virtual network to access Azure Key Vault without routing requests through the public internet. Which solution should be configured?

1. Public IP address
2. Storage firewall
3. Azure Bastion
4. Private endpoint

Correct Answer: 4

Explanation

A private endpoint provides a private IP address within an Azure virtual network for supported Azure services, including Azure Key Vault. This allows applications to communicate with the service through private connectivity while reducing dependence on public network access. A public IP address would maintain public exposure, a storage firewall is specific to storage network controls, and Azure Bastion provides administrative access to virtual machines. A private endpoint is therefore the appropriate solution when Key Vault must be accessed privately from an Azure virtual network.

Question 347

Which Microsoft Entra capability can provide temporary access to privileged groups while requiring users to activate that membership only when needed?

1. Access reviews
2. Privileged Identity Management
3. Identity Protection
4. Named locations

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management supports controlled, time-bound access to privileged roles and groups. Users can be made eligible rather than permanently privileged and can activate access when they need to perform an administrative task. Organizations can also apply requirements such as approval, multifactor authentication, justification, and activation time limits. Access reviews evaluate whether access should continue, Identity Protection detects identity risks, and named locations define network or geographic conditions. PIM is therefore the appropriate capability for temporary privileged group membership.

Question 348

A security engineer needs to determine whether a virtual machine can communicate with another endpoint and identify connectivity problems along the network path. Which Network Watcher capability should be used?

1. IP flow verify
2. Connection troubleshoot
3. NSG diagnostics
4. Packet capture

Correct Answer: 2

Explanation

Network Watcher Connection troubleshoot helps administrators test connectivity between endpoints and investigate problems affecting network communication. It can provide information about connectivity and the path involved, helping security and network teams identify routing or configuration issues. IP flow verify focuses on determining whether traffic is allowed or denied by network security rules. Packet capture collects traffic for deeper analysis, while NSG diagnostics can assist with security rule investigation. Connection troubleshoot is therefore the most appropriate option when the primary requirement is testing end-to-end connectivity.

Question 349

Which Azure security feature can help protect an application from distributed denial-of-service attacks by providing dedicated mitigation capabilities for supported resources?

1. Azure Firewall
2. Azure Policy
3. Azure DDoS Protection
4. Microsoft Sentinel

Correct Answer: 3

Explanation

Azure DDoS Protection provides dedicated capabilities for mitigating distributed denial-of-service attacks against supported Azure resources. It is designed to help protect applications and network resources from attacks that attempt to overwhelm services with large volumes of traffic or other malicious patterns. Azure Firewall provides centralized network filtering, Azure Policy enforces governance requirements, and Microsoft Sentinel provides security monitoring and response. Azure DDoS Protection is therefore the appropriate service when the primary security requirement is protection against distributed denial-of-service attacks.

Question 350

Which Azure Key Vault feature can automatically generate new versions of a key according to a configured rotation schedule?

1. Key rotation policy
2. Resource lock
3. Diagnostic setting
4. Private endpoint

Correct Answer: 1

Explanation

An Azure Key Vault key rotation policy can define lifecycle and rotation settings for supported cryptographic keys. Automated rotation helps reduce dependence on manual key replacement and can support organizational requirements for regularly changing cryptographic material. Resource locks protect resources from selected management operations, diagnostic settings collect logs and telemetry, and private endpoints provide private connectivity. A key rotation policy is therefore the appropriate Key Vault feature when an organization wants keys to be rotated according to a defined schedule or lifecycle policy.

Question 351

Which Microsoft Sentinel capability evaluates security telemetry against detection logic to identify suspicious activity?

1. Workbooks
2. Analytics rules
3. Data connectors
4. Playbooks

Correct Answer: 2

Explanation

Microsoft Sentinel analytics rules evaluate incoming security data against configured detection logic. When relevant conditions are identified, the rules can generate alerts and contribute to incident creation for investigation. Data connectors bring security information into Sentinel, workbooks provide visualization and analysis, and playbooks automate response workflows. Analytics rules are therefore the primary detection mechanism when a security team wants Sentinel to identify suspicious patterns within collected telemetry and turn those detections into actionable security events.

Question 352

A company wants to automatically add a required environment tag to Azure resources when the tag is missing and the resource property can be modified by policy. Which Azure Policy effect should be considered?

1. Audit
2. Deny
3. Modify
4. Disabled

Correct Answer: 3

Explanation

The Modify effect can add or update supported resource properties when resources are created or updated. This makes it useful for governance requirements such as automatically adding required tags to resources. Audit only reports noncompliant resources, Deny blocks requests that violate the policy, and a disabled policy performs no enforcement. When the organization’s objective is to automatically correct a supported property rather than simply report or block the resource, Modify is the appropriate Azure Policy effect.

Question 353

Which Azure security capability allows an application hosted on an Azure resource to authenticate to supported services without storing a client secret in application code?

1. Managed identity
2. Shared Access Signature
3. Resource lock
4. Public IP address

Correct Answer: 1

Explanation

Managed identities provide Azure-managed identities that applications and services can use to authenticate to supported Azure resources without storing passwords, client secrets, or other credentials in application code. Administrators can assign permissions to the identity through appropriate authorization mechanisms, supporting least privilege and reducing credential-management risks. A SAS is primarily used for delegated Azure Storage access, a resource lock protects resource management operations, and a public IP address provides network addressing. Managed identity is therefore the appropriate solution for credential-free workload authentication.

Question 354

Which Microsoft Defender for Cloud feature can help security teams understand how multiple weaknesses could combine to create a possible route toward a sensitive resource?

1. Secure score
2. Security recommendations
3. Regulatory compliance
4. Attack path analysis

Correct Answer: 4

Explanation

Attack path analysis in Microsoft Defender for Cloud provides contextual information about relationships between security weaknesses, resources, and potential routes toward sensitive assets. This can help security teams prioritize risks by understanding how multiple issues may interact rather than treating each recommendation independently. Secure Score provides a broader posture measurement, security recommendations identify specific improvement actions, and regulatory compliance focuses on supported standards and requirements. Attack path analysis is therefore the capability best suited to understanding how combinations of weaknesses can contribute to a potential attack route.

Question 355

Which Azure Storage security control can restrict access to a storage account based on selected virtual networks and IP address rules?

1. Blob versioning
2. Storage network access controls
3. Key rotation
4. Dynamic Data Masking

Correct Answer: 2

Explanation

Azure Storage network access controls allow administrators to restrict connectivity to storage accounts using supported network rules, selected virtual networks, IP address ranges, and private connectivity options. These controls reduce unwanted network exposure and can be combined with identity-based authorization for layered protection. Blob versioning preserves previous data versions, key rotation manages cryptographic keys, and Dynamic Data Masking is an Azure SQL capability for limiting exposure of sensitive query results. Storage network access controls are therefore appropriate when access must be limited based on network origin.

Question 356

Which Azure Firewall rule type should be used when an administrator needs to allow or deny traffic based primarily on source and destination IP addresses, ports, and protocols?

1. Application rule
2. DNAT rule
3. Network rule
4. Threat intelligence rule

Correct Answer: 3

Explanation

Azure Firewall network rules provide filtering based on network-level properties such as source and destination IP addresses, ports, and protocols. They are appropriate when traffic needs to be controlled without relying on application-layer domain information. Application rules provide application-aware filtering for supported protocols, while DNAT rules perform destination address translation. Threat intelligence capabilities help identify known malicious sources and destinations. Network rules are therefore the correct choice when the required firewall decision is based primarily on IP addresses, ports, and network protocols.

Question 357

Which Microsoft Entra capability can use information about risky sign-ins as a condition for applying stronger access controls?

1. Conditional Access
2. Azure Policy
3. Azure RBAC
4. Storage firewall

Correct Answer: 1

Explanation

Microsoft Entra Conditional Access can evaluate sign-in risk and apply additional controls when a sign-in meets a configured risk condition. For example, a policy can require multifactor authentication or another supported control when a sign-in is considered risky. Identity Protection supplies risk-related signals, while Conditional Access uses those conditions to make access decisions. Azure Policy governs Azure resource configurations, Azure RBAC controls resource permissions, and storage firewalls restrict network access. Conditional Access is therefore the appropriate control for applying stronger authentication based on sign-in risk.

Question 358

A security administrator needs to prevent a critical Azure resource from being deleted while still allowing authorized configuration changes. Which control should be applied?

1. ReadOnly lock
2. Azure Policy Audit
3. CanNotDelete lock
4. Conditional Access

Correct Answer: 3

Explanation

A CanNotDelete resource lock prevents deletion while continuing to allow supported modifications to the resource. This makes it useful for important production resources where accidental deletion must be prevented but administrators still need to make legitimate configuration changes. A ReadOnly lock is more restrictive because it prevents modification and deletion. Azure Policy Audit reports compliance issues but does not directly prevent deletion, while Conditional Access controls identity access conditions. CanNotDelete is therefore the appropriate resource protection mechanism for this requirement.

Question 359

Which Azure service can centralize security alerts and correlate information from multiple data sources for investigation and response?

1. Azure Key Vault
2. Azure Bastion
3. Microsoft Sentinel
4. Azure Resource Graph

Correct Answer: 3

Explanation

Microsoft Sentinel is a cloud-native SIEM and SOAR service that can collect security information from multiple sources, analyze events, correlate activity, and support incident investigation and response. It can integrate with Azure resources and external services through supported connectors and use analytics rules, incidents, and automation capabilities to help security teams respond to threats. Key Vault manages sensitive credentials and cryptographic material, Bastion provides secure VM access, and Resource Graph supports resource queries. Microsoft Sentinel is therefore the appropriate centralized security analytics and response platform.

Question 360

Which Azure Policy effect can deploy a supporting resource or configuration when the evaluated resource does not already meet the required condition?

1. Audit
2. DeployIfNotExists
3. Deny
4. Disabled

Correct Answer: 2

Explanation

The DeployIfNotExists effect can initiate deployment of a related resource or configuration when an evaluated resource does not satisfy a specified condition. This is useful for governance scenarios where organizations want required security or monitoring configurations to be established automatically. Audit identifies noncompliance without directly changing resources, Deny prevents noncompliant operations, and Disabled stops the policy from evaluating. DeployIfNotExists is therefore the appropriate effect when Azure Policy should trigger a supporting deployment whenever a required configuration or resource is missing.