View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 361

Which Azure Key Vault authorization model integrates with Azure role-based access control to manage permissions for keys, secrets, and certificates?

1. Azure RBAC
2. Network Security Group
3. Azure Policy
4. Shared Access Signature

Correct Answer: 1

Explanation

Azure Key Vault can use Azure RBAC as its authorization model, allowing administrators to assign predefined or custom roles to users, groups, managed identities, and service principals. This approach integrates Key Vault permissions with the broader Azure role-based access control framework and can support centralized permission management and least-privilege access. Network Security Groups control network traffic, Azure Policy governs resource configuration, and Shared Access Signatures provide delegated access to supported Azure Storage resources. Azure RBAC is therefore the appropriate authorization model when Key Vault permissions should be managed through Azure roles.

Question 362

An organization wants to prevent users from authenticating to a storage account by using account access keys and instead require Microsoft Entra-based authorization. Which storage setting should be disabled?

1. Public network access
2. Shared Key authorization
3. Secure transfer
4. Blob versioning

Correct Answer: 2

Explanation

Disabling Shared Key authorization prevents clients from using the storage account’s account keys for authentication and authorization. This can encourage the use of Microsoft Entra-based identity and role-based access controls where supported, providing more centralized identity governance and reducing dependence on long-lived shared credentials. Public network access controls network connectivity, secure transfer protects data in transit, and blob versioning preserves historical blob versions. Shared Key authorization is therefore the setting that should be disabled when an organization wants to eliminate account-key-based access.

Question 363

Which Microsoft Entra feature allows an organization to package access to applications and resources so that users can request access through a controlled workflow?

1. Identity Protection
2. Authentication strengths
3. Entitlement management
4. Named locations

Correct Answer: 3

Explanation

Microsoft Entra entitlement management helps organizations govern access to applications, groups, and other resources through access packages. Access packages can define the resources users receive, eligibility requirements, approval workflows, and lifecycle settings. This provides a structured method for requesting and managing access instead of granting permissions individually without centralized governance. Identity Protection focuses on identity risks, authentication strengths define authentication requirements, and named locations provide location-based conditions. Entitlement management is therefore appropriate when users need to request access through controlled and governed access packages.

Question 364

A company needs to verify whether a network security group is allowing or denying traffic between a source IP address and a destination port. Which Network Watcher feature is designed specifically for this purpose?

1. Connection troubleshoot
2. Packet capture
3. IP flow verify
4. Traffic Analytics

Correct Answer: 3

Explanation

Network Watcher IP flow verify determines whether traffic is permitted or denied for a specified source and destination combination. It evaluates applicable network security group rules and identifies the rule responsible for the result. This makes it useful when administrators need to troubleshoot unexpected network access or determine why traffic is being blocked. Connection troubleshoot focuses on connectivity testing, packet capture collects network packets, and Traffic Analytics provides broader traffic analysis. IP flow verify is therefore the most direct tool for checking an NSG traffic decision.

Question 365

Which Microsoft Entra capability can help require a stronger authentication method for a sensitive operation or application than the authentication method normally used for ordinary access?

1. Authentication strengths
2. Access reviews
3. Enterprise applications
4. Resource locks

Correct Answer: 1

Explanation

Microsoft Entra authentication strengths allow organizations to define which authentication methods are acceptable for specific Conditional Access scenarios. Administrators can require stronger authentication for sensitive applications or situations where ordinary authentication does not provide sufficient assurance. Access reviews are used to periodically review existing access, enterprise applications represent applications integrated with Microsoft Entra, and resource locks protect Azure resources from management operations. Authentication strengths are therefore appropriate when an organization needs to require a higher-assurance authentication method for selected access scenarios.

Question 366

Which Azure service can provide a web application firewall capability at the edge of Microsoft’s global network for applications published through the service?

1. Azure Bastion
2. Azure Front Door
3. Azure Resource Graph
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Front Door provides global application delivery capabilities and can integrate with a Web Application Firewall to protect web applications at the edge. The WAF can inspect HTTP and HTTPS requests and apply supported security rules before traffic reaches the application origin. Azure Bastion is designed for secure administrative access to virtual machines, Resource Graph queries Azure resources, and Key Vault manages secrets and cryptographic material. Azure Front Door is therefore the appropriate service when an organization needs globally distributed application delivery with edge-based WAF protection.

Question 367

An administrator wants Azure resources to inherit governance requirements from a higher management scope rather than creating separate policy assignments for every subscription. Which Azure hierarchy level is commonly used for this purpose?

1. Individual resource
2. Resource group
3. Management group
4. Storage container

Correct Answer: 3

Explanation

Management groups provide a hierarchy above Azure subscriptions and can be used to organize subscriptions according to organizational structures. Azure Policy assignments made at a management group scope can apply to subscriptions and resources beneath that scope, subject to policy behavior and exemptions. This helps organizations establish consistent governance without creating identical assignments separately for every subscription. Individual resources and resource groups are narrower scopes, while storage containers are unrelated to Azure governance hierarchy. Management groups are therefore appropriate for applying organization-wide governance across multiple subscriptions.

Question 368

Which Azure Storage capability helps ensure that deleted blobs remain recoverable for a configured retention period?

1. Blob soft delete
2. Storage firewall
3. Private Link
4. Customer-managed key

Correct Answer: 1

Explanation

Blob soft delete protects against accidental or unintended deletion by retaining deleted blob data for a configured period. During that retention period, authorized users can recover the deleted data according to the service’s supported recovery behavior. A storage firewall controls network access, Private Link provides private connectivity, and customer-managed keys control cryptographic key ownership for supported encryption scenarios. Blob soft delete is therefore the appropriate storage protection feature when the primary requirement is recovering blobs that were accidentally deleted.

Question 369

A security team wants to automate a response whenever Microsoft Sentinel creates an incident that matches a particular condition. Which capability can apply automated actions based on incident or alert conditions?

1. Automation rules
2. Workbooks
3. Data connectors
4. Resource locks

Correct Answer: 1

Explanation

Microsoft Sentinel automation rules can automatically perform supported actions when specified alert or incident conditions are met. They can help standardize repetitive security operations, such as modifying incident properties, assigning incidents, adding tasks, or triggering supported response workflows. Workbooks are primarily used for visualization and investigation, while data connectors ingest information into Sentinel. Resource locks protect Azure resources from deletion or modification. Automation rules are therefore appropriate when a security team wants Sentinel to automatically respond to incidents according to predefined conditions.

Question 370

Which Azure security mechanism can require multifactor authentication when a user attempts to access an application from an untrusted location?

1. Azure Policy
2. Conditional Access
3. Azure Firewall
4. Resource Graph

Correct Answer: 2

Explanation

Microsoft Entra Conditional Access can evaluate conditions such as user identity, application, device state, location, and risk before applying access controls. An organization can configure a policy that requires multifactor authentication when users access an application from locations that do not meet defined trusted-location conditions. Azure Policy governs Azure resource configurations, Azure Firewall filters network traffic, and Resource Graph queries Azure resources. Conditional Access is therefore the appropriate identity security mechanism for enforcing multifactor authentication based on access location.

Question 371

Which Azure SQL Database security feature can record database activity such as queries and operations for security investigation and compliance purposes?

1. Transparent Data Encryption
2. Dynamic Data Masking
3. SQL Auditing
4. Always Encrypted

Correct Answer: 3

Explanation

Azure SQL Auditing records database activity and can send audit information to supported destinations for monitoring, investigation, and compliance purposes. It helps organizations establish a record of database operations that can be reviewed when investigating suspicious behavior or meeting auditing requirements. Transparent Data Encryption protects data at rest, Dynamic Data Masking limits exposure of sensitive query results, and Always Encrypted protects selected sensitive values from unauthorized database access. SQL Auditing is therefore the appropriate feature when the requirement is to record database activity.

Question 372

Which Microsoft Entra object represents an identity that an application can use to access resources on behalf of itself?

1. Service principal
2. Security group
3. Conditional Access policy
4. Access package

Correct Answer: 1

Explanation

A service principal represents an application identity within a Microsoft Entra tenant and can be granted permissions to access supported resources. Applications can authenticate using the service principal and its configured credentials or supported federated mechanisms. Security groups organize identities and can be used for permission assignment, Conditional Access policies control access conditions, and access packages manage governed resource access for users and groups. A service principal is therefore the appropriate Microsoft Entra object when an application requires its own identity for resource access.

Question 373

An organization wants to collect Azure resource diagnostic logs and send them to a centralized Log Analytics workspace for security analysis. Which Azure capability should be configured on the relevant resource?

1. Diagnostic settings
2. Resource locks
3. Private endpoints
4. Azure Bastion

Correct Answer: 1

Explanation

Azure diagnostic settings allow administrators to configure supported resource logs and metrics for export to destinations such as Log Analytics workspaces, storage accounts, or event hubs. Sending relevant security and operational logs to a centralized Log Analytics workspace can support monitoring, investigation, and Microsoft Sentinel integration. Resource locks protect resources, private endpoints provide private connectivity, and Azure Bastion enables secure virtual machine administration. Diagnostic settings are therefore the appropriate configuration when resource-level telemetry must be collected centrally for security analysis.

Question 374

Which Azure Firewall capability can block connections to known malicious IP addresses and domains based on Microsoft’s threat intelligence information?

1. DNAT
2. Threat intelligence filtering
3. Application Gateway
4. Private DNS

Correct Answer: 2

Explanation

Azure Firewall threat intelligence filtering can identify and block traffic associated with known malicious IP addresses and domains using Microsoft’s threat intelligence information. This capability provides an additional security layer alongside network and application filtering. DNAT performs destination network address translation, Application Gateway provides application delivery and can integrate with WAF, and Private DNS provides name resolution within private environments. Threat intelligence filtering is therefore the appropriate Azure Firewall capability when the requirement is to block known malicious destinations or sources.

Question 375

Which Microsoft Entra Identity Governance capability can place an expiration date on a user’s assigned access to a resource package?

1. Access package lifecycle settings
2. Network Security Group
3. Azure Policy initiative
4. Key Vault rotation policy

Correct Answer: 1

Explanation

Microsoft Entra entitlement management access packages can include lifecycle settings that control how long users retain access. Expiration settings can help ensure that temporary or project-based access does not remain indefinitely and can support periodic governance of permissions. Network Security Groups control network traffic, Azure Policy initiatives group policy definitions for governance, and Key Vault rotation policies manage cryptographic key lifecycle. Access package lifecycle settings are therefore appropriate when an organization’s requirement is to automatically manage the duration of governed resource access.

Question 376

Which Azure networking option provides private connectivity to an Azure service by creating a private endpoint in the consumer’s virtual network?

1. Service endpoint
2. Public IP
3. Private Link
4. Network security group

Correct Answer: 3

Explanation

Azure Private Link enables private connectivity to supported Azure services through private endpoints. A private endpoint is created within the consumer’s virtual network and receives a private IP address, allowing traffic to reach the service through private connectivity rather than relying on a public endpoint. Service endpoints extend a virtual network identity to supported services but do not provide the same private endpoint model. Public IP addresses provide public addressing, while NSGs filter network traffic. Private Link is therefore the appropriate option for private endpoint-based connectivity.

Question 377

Which Azure Bastion deployment requirement helps ensure that the Bastion service has the dedicated subnet it needs for its deployment?

1. AzureFirewallSubnet
2. GatewaySubnet
3. AzureBastionSubnet
4. AppGatewaySubnet

Correct Answer: 3

Explanation

Azure Bastion requires a dedicated subnet named AzureBastionSubnet within the virtual network where Bastion is deployed. This subnet is reserved for the Bastion service and has specific deployment requirements. AzureFirewallSubnet is associated with Azure Firewall, GatewaySubnet is used by supported virtual network gateways, and AppGatewaySubnet is commonly used for application gateway deployments. Using the required AzureBastionSubnet helps ensure that Bastion can be deployed correctly and that its service resources are separated from ordinary application workloads.

Question 378

Which Azure Policy component groups multiple policy definitions together so that an organization can assign and manage them as a single governance unit?

1. Policy initiative
2. Resource lock
3. Management certificate
4. Private endpoint

Correct Answer: 1

Explanation

An Azure Policy initiative, also called a policy set definition, groups multiple related policy definitions into a single logical collection. Organizations can use initiatives to manage broader governance requirements without assigning every individual policy separately. For example, a security initiative can contain several controls covering allowed locations, required configurations, and security settings. Resource locks protect resources, management certificates are not policy collections, and private endpoints provide network connectivity. A policy initiative is therefore the appropriate Azure Policy component for grouping multiple policy definitions into one manageable assignment.

Question 379

Which Microsoft Defender for Cloud capability provides a numerical indication of an organization’s overall security posture based on available security improvement actions?

1. Attack path analysis
2. Secure Score
3. Workflow automation
4. Regulatory compliance

Correct Answer: 2

Explanation

Microsoft Defender for Cloud Secure Score provides an overall indication of security posture based on available security improvement opportunities. It helps organizations understand how effectively recommended security controls are being addressed and can identify areas where improvements may increase the security posture. Attack path analysis provides contextual relationships between risks, workflow automation supports automated responses, and regulatory compliance focuses on supported standards and requirements. Secure Score is therefore the appropriate Defender for Cloud capability when an organization needs a numerical security posture indicator.

Question 380

A company wants to prevent a resource from being changed or deleted by normal management operations while retaining the resource for reference and protection. Which Azure resource lock should be used?

1. CanNotDelete
2. ReadOnly
3. Audit
4. Deny

Correct Answer: 2

Explanation

A ReadOnly resource lock prevents supported modifications and deletion of the locked resource. It is more restrictive than a CanNotDelete lock, which allows configuration changes while blocking deletion. Azure Policy Audit reports compliance information rather than acting as a resource lock, while Deny is an Azure Policy effect that blocks operations based on policy conditions. Therefore, when the requirement is to protect a resource from both changes and deletion through normal management operations, the ReadOnly lock is the appropriate control.