View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 301

Which Azure identity option is appropriate when an application outside Azure needs to authenticate to Azure resources using an application identity rather than a user account?

1. Resource lock
2. Managed identity
3. Service principal
4. Network Security Group

Correct Answer: 3

Explanation

A service principal represents an application identity in Microsoft Entra ID and can be granted permissions to Azure resources without requiring a human user account. This is useful for applications, automation tools, and workloads that need to authenticate programmatically. A managed identity is another workload identity option, but it is managed by Azure and is especially useful for supported Azure-hosted resources. Resource locks protect resources, while NSGs control network traffic. A service principal is therefore appropriate when an application requires its own identity for authentication and authorization.

Question 302

A security team wants to use a Microsoft-provided baseline to evaluate whether Azure resources follow recommended security practices. Which framework should they consider?

1. Microsoft Cloud Security Benchmark
2. Azure DNS
3. Azure Bastion
4. Shared Access Signature

Correct Answer: 1

Explanation

The Microsoft Cloud Security Benchmark provides a set of security recommendations and controls that organizations can use to evaluate and improve the security posture of cloud environments. Microsoft Defender for Cloud can use benchmark-related information to help organizations understand security recommendations and compliance status. Azure DNS handles name resolution, Azure Bastion provides secure administrative connectivity, and SAS provides delegated storage access. The Microsoft Cloud Security Benchmark is therefore the appropriate reference when a security team wants to evaluate Azure workloads against Microsoft’s recommended cloud security practices.

Question 303

Which Azure Key Vault capability helps manage the lifecycle of certificates, including their renewal and policy configuration?

1. Network Security Group
2. Certificate management
3. Resource Graph
4. DDoS Protection

Correct Answer: 2

Explanation

Azure Key Vault certificate management provides capabilities for creating, storing, and managing certificates and their associated policies. Certificate policies can define properties related to certificate issuance and lifecycle management, and supported integrations can help automate certificate renewal. Network Security Groups control network traffic, Resource Graph provides resource querying, and DDoS Protection addresses denial-of-service attacks. Certificate management is therefore the relevant Key Vault capability when an organization needs centralized handling of certificate lifecycle requirements rather than simply storing an unrelated secret.

Question 304

A company wants to allow an Azure virtual machine to access a storage account using its Microsoft Entra identity without storing a storage account key in the virtual machine. Which approach should be used?

1. Resource lock
2. Public blob access
3. Managed identity with appropriate RBAC permissions
4. Anonymous access

Correct Answer: 3

Explanation

A managed identity allows an Azure virtual machine to authenticate to supported Azure services using a Microsoft Entra identity without requiring credentials such as storage account keys to be stored on the VM. The identity can be assigned only the required Azure RBAC permissions, supporting least privilege. Resource locks do not provide authentication, and public or anonymous access would weaken security rather than provide identity-based authorization. Managed identity with appropriate RBAC permissions is therefore the preferred approach for secure workload authentication to Azure Storage.

Question 305

Which Microsoft Defender for Cloud capability provides a numerical indication of how closely an environment aligns with recommended security controls?

1. Secure score
2. Private endpoint
3. Policy exemption
4. Key rotation

Correct Answer: 1

Explanation

Microsoft Defender for Cloud Secure Score provides an indication of an organization’s security posture based on applicable security recommendations and controls. It helps security teams understand areas where improvements can be made and can prioritize actions that may strengthen the environment. A private endpoint provides private network connectivity, a policy exemption excludes a scope from an Azure Policy requirement, and key rotation manages cryptographic lifecycle activities. Secure Score is therefore the relevant Defender for Cloud capability when the organization wants a consolidated measure of its security posture and improvement opportunities.

Question 306

An organization wants to restrict outbound traffic from a subnet to only the approved service destinations identified by Azure service tags. Which network control can use service tags in its rules?

1. Azure Key Vault
2. Network Security Group
3. Microsoft Sentinel
4. Azure Resource Graph

Correct Answer: 2

Explanation

Network Security Groups support service tags that represent groups of Azure service IP prefixes. Using service tags in NSG rules can simplify network security configuration because administrators do not need to maintain individual IP addresses for supported Azure services. Key Vault manages secrets and cryptographic material, Sentinel provides security analytics, and Resource Graph queries Azure resource information. An NSG is therefore the appropriate network control when administrators need to permit or restrict traffic based on supported Azure service tags.

Question 307

Which Azure Firewall rule type is designed to translate a public destination address and port to a private destination for an internal resource?

1. Application rule
2. Network rule
3. DNAT rule
4. Policy exemption

Correct Answer: 3

Explanation

Destination Network Address Translation, or DNAT, rules in Azure Firewall can translate incoming traffic addressed to a public IP and port into a private destination address and port. This can allow controlled access to internal resources through a firewall while centralizing traffic inspection and policy enforcement. Application rules provide application-aware filtering, while network rules filter traffic using network-level properties such as IP addresses and ports. A policy exemption is unrelated to network translation. DNAT rules are therefore the appropriate Azure Firewall feature for this translation scenario.

Question 308

A web application is published through Azure Front Door, and the organization wants to inspect HTTP requests for common web attacks before they reach the application. Which feature should be configured?

1. Azure Front Door Web Application Firewall
2. Azure Key Vault
3. Azure VPN Gateway
4. Azure Resource Graph

Correct Answer: 1

Explanation

Azure Front Door Web Application Firewall provides protection for web applications by inspecting HTTP and HTTPS requests and applying configured security rules. It can help detect and block common web attacks and can use managed rules and custom rules according to the security requirements. Key Vault protects secrets and cryptographic material, VPN Gateway provides encrypted network connectivity, and Resource Graph supports resource querying. Front Door WAF is therefore the appropriate control when web traffic must be inspected and filtered before reaching an application hosted behind Front Door.

Question 309

Which Microsoft Defender for Cloud plan is specifically intended to provide security capabilities for supported Azure Resource Manager operations and suspicious management activity?

1. Defender for Storage
2. Defender for Resource Manager
3. Defender for Servers
4. Defender for Containers

Correct Answer: 2

Explanation

Microsoft Defender for Resource Manager is designed to help detect suspicious activity involving Azure Resource Manager operations. Because management-plane operations can create, modify, or delete important Azure resources, monitoring these activities can help identify potentially malicious or unusual behavior. Defender for Storage focuses on storage workloads, Defender for Servers protects supported server environments, and Defender for Containers focuses on container workloads. Defender for Resource Manager is therefore the appropriate workload-specific protection when the security concern involves suspicious Azure management-plane activity.

Question 310

A security administrator needs to make a policy assignment effective across all subscriptions contained within an organizational boundary. Which Azure scope is most suitable for centralized governance?

1. Resource group
2. Individual resource
3. Management group
4. Network interface

Correct Answer: 3

Explanation

Management groups provide a hierarchy for organizing Azure subscriptions and can serve as a governance scope for Azure Policy assignments and other supported controls. Assigning a policy at an appropriate management group level allows the requirement to apply to subscriptions beneath that management group, reducing the need to configure identical assignments individually. Resource groups and individual resources provide narrower scopes, while a network interface is a specific networking resource. A management group is therefore suitable when centralized governance must span multiple subscriptions.

Question 311

Which Azure Storage access method uses Microsoft Entra credentials to obtain a user delegation key before generating a SAS?

1. User delegation SAS
2. Account key authentication
3. Anonymous public access
4. Storage firewall

Correct Answer: 1

Explanation

A user delegation SAS uses Microsoft Entra credentials to obtain a user delegation key from Azure Storage. The key is then used to construct a SAS that grants limited permissions to storage resources for a defined period. This approach avoids relying directly on long-lived storage account keys and can provide stronger identity-based control. Account key authentication uses storage account keys, anonymous access removes authentication requirements for permitted public data, and a storage firewall controls network access. User delegation SAS is therefore the appropriate access method for identity-based delegated storage access.

Question 312

An organization needs to identify suspicious activity involving Azure Key Vault operations and wants workload-specific security monitoring. Which Defender plan should be enabled?

1. Defender for Storage
2. Defender for Key Vault
3. Defender for App Service
4. Defender for Containers

Correct Answer: 2

Explanation

Defender for Key Vault provides security monitoring and threat detection capabilities focused on supported Azure Key Vault activity. It can help identify suspicious access patterns and operations involving sensitive keys, secrets, and certificates. Defender for Storage is focused on storage workloads, Defender for App Service protects supported web application workloads, and Defender for Containers focuses on container environments. When the security team specifically needs workload protection for Key Vault operations, Defender for Key Vault is the relevant Defender plan.

Question 313

Which Azure SQL capability can hide portions of sensitive column values from users who are not authorized to view the complete information?

1. Dynamic Data Masking
2. SQL auditing
3. Private endpoint
4. Transparent Data Encryption

Correct Answer: 1

Explanation

Dynamic Data Masking helps limit exposure of sensitive information by masking portions of returned data for users who do not have permission to see the complete values. It can be useful for reducing accidental exposure of information such as phone numbers, email addresses, or identification values in query results. SQL auditing records database activity, private endpoints provide private network connectivity, and Transparent Data Encryption protects database files at rest. Dynamic Data Masking is therefore the appropriate capability when the requirement is to obscure sensitive values in query results.

Question 314

Which Azure security architecture provides private access from a virtual network to a supported Azure service without requiring the service to expose a public endpoint to the client?

1. Public IP routing
2. Azure Bastion
3. Azure Private Link
4. Azure DDoS Protection

Correct Answer: 3

Explanation

Azure Private Link enables private connectivity from a virtual network to supported Azure services through private endpoints. The client communicates with the service using a private IP address rather than relying on public network connectivity. This can significantly reduce public exposure and help organizations implement private access architectures for supported platform services. Public IP routing uses public addressing, Azure Bastion is designed for secure VM administration, and DDoS Protection mitigates denial-of-service attacks. Azure Private Link is therefore the appropriate architecture for private service connectivity.

Question 315

A security administrator wants to require multifactor authentication only when Microsoft Entra sign-in risk reaches a defined level. Which combination should be used?

1. Azure Policy and resource locks
2. Conditional Access and sign-in risk
3. Storage firewall and SAS
4. Network Security Group and service tags

Correct Answer: 2

Explanation

Microsoft Entra Conditional Access can use sign-in risk as a condition and apply controls such as multifactor authentication when the risk level meets the configured threshold. Sign-in risk is evaluated using identity and authentication signals from Microsoft Entra ID Protection. This approach allows organizations to apply stronger authentication requirements dynamically rather than requiring the same control in every situation. Azure Policy governs Azure resources, storage firewalls and SAS control storage access, and NSGs control network traffic. Conditional Access combined with sign-in risk is therefore appropriate.

Question 316

Which Azure Key Vault security practice helps reduce the risk associated with using the same cryptographic key version indefinitely?

1. Resource locking
2. Network filtering
3. Key rotation
4. Diagnostic logging

Correct Answer: 3

Explanation

Key rotation replaces an existing cryptographic key with a new version according to an established lifecycle process. Regular rotation can reduce the amount of time a single key version is used and can support organizational security requirements. Resource locks protect Azure resources against selected management operations, network filtering controls connectivity, and diagnostic logging records activity. Key rotation is therefore the security practice directly associated with periodically replacing cryptographic keys and managing their lifecycle over time.

Question 317

A company wants to prevent a specific Azure Policy from applying to a resource group because the workload has an approved temporary exception. Which object should be created?

1. Policy exemption
2. Custom role
3. Resource lock
4. Security group

Correct Answer: 1

Explanation

An Azure Policy exemption allows an organization to exclude a defined resource scope from a policy assignment while retaining the policy for other resources. This is useful for approved temporary exceptions where a workload cannot currently satisfy a general requirement. A custom role controls user permissions, a resource lock protects resources from certain management operations, and a security group is an identity or network grouping mechanism depending on the service. A policy exemption is therefore the correct object for an approved temporary exception to an Azure Policy requirement.

Question 318

Which Azure networking service can inspect web traffic and apply web application firewall policies when an application is hosted behind an application gateway?

1. Azure VPN Gateway
2. Azure Application Gateway WAF
3. Azure DNS
4. Azure Bastion

Correct Answer: 2

Explanation

Azure Application Gateway Web Application Firewall provides application-layer protection for web applications published through Application Gateway. It can inspect HTTP and HTTPS requests and apply managed or custom WAF rules to help protect applications against common web-based attacks. VPN Gateway provides encrypted network connectivity, Azure DNS provides name resolution, and Azure Bastion provides secure administrative access to virtual machines. Application Gateway WAF is therefore the appropriate service when an organization needs web request inspection and WAF protection at the Application Gateway layer.

Question 319

Which security capability can help identify sensitive data exposure risks within supported Azure Storage workloads?

1. Defender for Storage
2. Azure Bastion
3. Azure VPN Gateway
4. Azure Resource Graph

Correct Answer: 1

Explanation

Microsoft Defender for Storage provides security capabilities for supported storage workloads, including threat detection and security features that can help organizations identify risks involving stored data and suspicious activity. Depending on the enabled capabilities and supported workload, it can provide information relevant to sensitive data and potential exposure. Azure Bastion focuses on VM administration, VPN Gateway provides network connectivity, and Resource Graph supports resource inventory queries. Defender for Storage is therefore the appropriate security service when the workload under investigation is Azure Storage.

Question 320

An organization wants to prevent a user from permanently removing a critical Azure resource but still allow authorized administrators to update its configuration. Which protection should be applied?

1. ReadOnly resource lock
2. CanNotDelete resource lock
3. Audit policy
4. Conditional Access

Correct Answer: 2

Explanation

A CanNotDelete resource lock prevents deletion while still allowing supported modifications to the resource. This makes it appropriate for critical resources that must remain available but still require legitimate administrative updates. A ReadOnly lock is more restrictive because it prevents both modification and deletion through supported management operations. Audit policy reports policy compliance rather than directly protecting a resource from deletion, while Conditional Access controls identity access conditions. Therefore, CanNotDelete is the appropriate protection when deletion must be prevented without blocking authorized configuration changes.