View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 381

What is the primary purpose of an Azure Policy remediation task?

1. Delete noncompliant resources
2. Restore deleted resources
3. Correct supported existing resources that are already noncompliant
4. Replace Azure RBAC assignments

Correct Answer: 3

Explanation

An Azure Policy remediation task helps bring existing resources into compliance when a policy uses a remediation-capable effect such as Modify or DeployIfNotExists. Policy evaluation can identify resources that do not currently meet requirements, while remediation can apply supported changes or deploy required configurations. This is different from simply auditing resources or blocking future deployments. Remediation is particularly useful when an organization introduces a new security requirement and needs previously deployed resources to receive the required configuration without manually updating every resource.

Question 382

Which Azure Policy component determines the rules and conditions that are evaluated when a policy assignment is applied?

1. Policy definition
2. Resource lock
3. Diagnostic setting
4. Management group

Correct Answer: 1

Explanation

An Azure Policy definition contains the policy rule that determines which resources or properties are evaluated and what compliance behavior should occur. The definition can specify conditions and an effect such as Audit, Deny, Modify, or DeployIfNotExists. A policy assignment applies the definition to a selected scope. Resource locks protect resources, diagnostic settings configure telemetry collection, and management groups provide organizational hierarchy. The policy definition is therefore the component that establishes the actual governance logic evaluated by Azure Policy.

Question 383

An administrator wants an Azure Policy assignment to apply to every subscription beneath a management group. What scope should be used for the assignment?

1. Individual virtual machine
2. Storage account
3. Resource group
4. Management group

Correct Answer: 4

Explanation

Assigning an Azure Policy at the management group scope allows the policy to apply to subscriptions and resources beneath that management group, subject to inheritance and any applicable exclusions or exemptions. This is useful for organizations that need consistent governance across multiple subscriptions. Assigning the policy directly to a virtual machine, storage account, or resource group would provide a much narrower scope. Management groups therefore provide an effective governance level when security requirements need to be inherited across multiple Azure subscriptions.

Question 384

Which Microsoft Entra feature can detect potentially compromised user identities by evaluating signals such as unusual sign-in behavior and leaked credentials?

1. Azure Policy
2. Microsoft Entra ID Protection
3. Azure Firewall
4. Microsoft Sentinel workbook

Correct Answer: 2

Explanation

Microsoft Entra ID Protection uses identity-related signals to identify potentially risky users and sign-ins. These signals can include unusual authentication behavior, compromised credentials, and other indicators associated with identity-based threats. Risk information can then be used with Conditional Access policies to require additional controls or block risky access. Azure Policy governs Azure resources, Azure Firewall filters network traffic, and Sentinel workbooks primarily visualize security information. Microsoft Entra ID Protection is therefore the appropriate service for detecting and responding to identity-related risk signals.

Question 385

Which security option provides private connectivity to a supported Azure Storage account while also allowing the storage account’s public network endpoint to remain disabled?

1. Private endpoint
2. Public IP address
3. Network security group only
4. Azure DNS public zone

Correct Answer: 1

Explanation

A private endpoint provides a private IP address within a virtual network for accessing supported Azure Storage services. This allows workloads to communicate with the storage account through private connectivity while public network access can remain disabled. A public IP address would expose the service through a public network path, an NSG alone does not create private connectivity to the storage service, and a public DNS zone does not provide private network access. A private endpoint is therefore appropriate for highly restricted storage architectures requiring private connectivity.

Question 386

Which Microsoft Entra object is created in a tenant when an application registration needs an identity that can be assigned permissions and used for authentication?

1. Management group
2. Service principal
3. Resource group
4. Policy initiative

Correct Answer: 2

Explanation

A service principal provides an identity for an application within a Microsoft Entra tenant. Permissions can be assigned to the service principal so the application can access supported resources according to the organization’s authorization requirements. An application registration defines the application’s identity configuration, while the service principal represents that application in a specific tenant. Management groups organize subscriptions, resource groups organize Azure resources, and policy initiatives group governance policies. A service principal is therefore the identity used by an application for tenant-specific access.

Question 387

Which Conditional Access mode allows administrators to evaluate the potential effect of a policy without immediately enforcing its access controls?

1. Block mode
2. Report-only mode
3. ReadOnly mode
4. Audit lock mode

Correct Answer: 2

Explanation

Conditional Access report-only mode allows administrators to evaluate how a policy would affect users and sign-ins without immediately enforcing the policy’s controls. This provides an opportunity to review expected results, identify unintended consequences, and adjust conditions before enabling enforcement. Block mode is an enforcement concept rather than the specific testing mode, while ReadOnly and Audit lock mode are not Conditional Access policy modes. Report-only mode is therefore useful when administrators want to validate a new security policy before applying it to production access.

Question 388

Which Azure SQL feature protects sensitive column values by encrypting them so that the database service does not have access to the plaintext data?

1. SQL Auditing
2. Dynamic Data Masking
3. Always Encrypted
4. Vulnerability Assessment

Correct Answer: 3

Explanation

Always Encrypted protects sensitive data by encrypting selected values on the client side before they are sent to Azure SQL. The database service stores encrypted data rather than receiving the plaintext value, which provides stronger protection for selected sensitive columns against unauthorized database-level access. SQL Auditing records activity, Dynamic Data Masking limits exposure of data returned to certain users, and Vulnerability Assessment identifies potential security weaknesses. Always Encrypted is therefore the appropriate Azure SQL feature when sensitive values need strong protection from plaintext exposure to the database service.

Question 389

A security administrator wants to require users to provide a justification whenever they activate an eligible privileged role through Microsoft Entra PIM. Which PIM capability supports this requirement?

1. Activation settings
2. Storage lifecycle management
3. Network security rules
4. Diagnostic settings

Correct Answer: 1

Explanation

Microsoft Entra Privileged Identity Management activation settings can define requirements that users must satisfy when activating eligible privileged roles. Depending on the configuration, administrators can require justification, multifactor authentication, approval, and other controls before elevated access becomes active. These requirements help provide accountability and reduce the risk associated with standing administrative privileges. Storage lifecycle management handles storage data policies, network security rules control traffic, and diagnostic settings collect telemetry. PIM activation settings are therefore the appropriate mechanism for requiring justification during privileged role activation.

Question 390

Which Azure networking feature can provide name resolution for private endpoint addresses inside a virtual network?

1. Azure DDoS Protection
2. Private DNS zone
3. Azure Firewall DNAT
4. Network Watcher

Correct Answer: 2

Explanation

Private DNS zones can provide DNS name resolution for private endpoint addresses within Azure virtual networks. When a private endpoint is used, DNS configuration is important so applications can resolve the service’s normal hostname to the appropriate private IP address rather than a public endpoint. Azure DDoS Protection mitigates distributed denial-of-service attacks, Azure Firewall DNAT performs destination address translation, and Network Watcher provides network monitoring and troubleshooting capabilities. A private DNS zone is therefore the appropriate solution for resolving private endpoint names internally.

Question 391

Which Azure Storage security setting prevents anonymous public access to blobs and containers when configured to disable public access at the storage account level?

1. AllowBlobPublicAccess disabled
2. Secure transfer disabled
3. Versioning disabled
4. Shared Key enabled

Correct Answer: 1

Explanation

The storage account setting that controls anonymous public access to blobs and containers can be configured to prevent public access. Disabling the relevant public access setting helps ensure that containers and blobs cannot be exposed anonymously through public access configurations. Secure transfer controls encryption in transit, versioning preserves previous blob versions, and Shared Key relates to account-key authorization. Disabling public blob access is therefore an important storage security control when an organization requires authenticated and authorized access instead of anonymous access to stored data.

Question 392

Which Microsoft Defender for Cloud capability can automatically trigger an action or workflow when a security alert or recommendation meets specified conditions?

1. Workflow automation
2. Secure Score
3. Regulatory compliance
4. Attack path analysis

Correct Answer: 1

Explanation

Microsoft Defender for Cloud workflow automation can trigger supported actions based on security alerts and recommendations that meet configured conditions. This can help security teams automate repetitive responses and integrate Defender for Cloud with other operational or security workflows. Secure Score measures aspects of security posture, regulatory compliance helps evaluate supported standards, and attack path analysis provides contextual information about potential routes through security weaknesses. Workflow automation is therefore the appropriate capability when the requirement is to automatically initiate actions in response to specified Defender for Cloud events.

Question 393

An organization wants to use a security policy package containing multiple related controls and assign the entire collection to a subscription. What should the administrator create?

1. Resource lock
2. Policy initiative
3. Private endpoint
4. Network security group

Correct Answer: 2

Explanation

An Azure Policy initiative combines multiple related policy definitions into one logical collection. Administrators can assign the initiative to a management group, subscription, resource group, or other supported scope depending on governance requirements. This approach simplifies management when many related security controls need to be applied together. Resource locks protect resources, private endpoints provide private connectivity, and network security groups filter network traffic. A policy initiative is therefore the appropriate choice when an organization wants to package several governance controls and manage them through one assignment.

Question 394

Which Microsoft Entra capability can allow an organization to define trusted geographic or network locations that can be referenced by Conditional Access policies?

1. Named locations
2. Access packages
3. Privileged groups
4. Enterprise applications

Correct Answer: 1

Explanation

Microsoft Entra named locations allow administrators to define locations using supported IP ranges or geographic conditions. These named locations can then be referenced in Conditional Access policies to apply different access controls depending on where a sign-in originates. Access packages support governed resource access, privileged groups support controlled privileged membership, and enterprise applications represent integrated applications. Named locations are therefore the appropriate Microsoft Entra feature when an organization needs to create reusable trusted or restricted location conditions for access policies.

Question 395

Which Azure security feature allows administrators to restrict inbound network traffic to a virtual machine based on source address, destination port, and protocol?

1. Azure Key Vault
2. Microsoft Sentinel
3. Network Security Group
4. Azure Policy initiative

Correct Answer: 3

Explanation

A Network Security Group provides stateful network traffic filtering for supported Azure resources. Security rules can specify source and destination addresses, ports, protocols, direction, and access behavior. This allows administrators to restrict inbound traffic to virtual machines and other supported resources according to defined network security requirements. Azure Key Vault manages secrets and cryptographic material, Microsoft Sentinel provides security analytics, and Azure Policy initiatives provide governance controls. An NSG is therefore the appropriate mechanism for controlling inbound network traffic at the network security layer.

Question 396

Which Azure Key Vault protection feature helps prevent an authorized user or process from permanently deleting a vault object and then purging it before the retention period expires?

1. Key rotation
2. Purge protection
3. Diagnostic settings
4. Certificate renewal

Correct Answer: 2

Explanation

Key Vault purge protection helps prevent permanently deleting protected objects through purge operations during the configured retention period. It works with soft-delete behavior to provide stronger protection against destructive actions involving keys, secrets, and certificates. Key rotation manages cryptographic key lifecycle, diagnostic settings collect logs and telemetry, and certificate renewal manages certificate lifecycle. Purge protection is therefore particularly important for critical cryptographic material because it helps prevent irreversible deletion even when a user or process has sufficient permissions to initiate deletion.

Question 397

Which Azure service can query resources across subscriptions using resource properties without requiring administrators to inspect each resource individually?

1. Azure Resource Graph
2. Azure Bastion
3. Azure DDoS Protection
4. Azure Key Vault

Correct Answer: 1

Explanation

Azure Resource Graph provides efficient querying of Azure resources across subscriptions and management groups. Security and governance teams can use it to inventory resources, identify configurations, investigate properties, and support compliance analysis at scale. Azure Bastion provides secure administrative access to virtual machines, Azure DDoS Protection provides DDoS mitigation, and Key Vault manages sensitive information and cryptographic assets. Resource Graph is therefore the appropriate service when administrators need to query and analyze resource metadata across a broad Azure environment.

Question 398

A security team needs to collect sign-in and security information from an external security product into Microsoft Sentinel. Which Sentinel capability should be configured?

1. Automation rule
2. Data connector
3. Workbook
4. Resource lock

Correct Answer: 2

Explanation

Microsoft Sentinel data connectors provide supported methods for bringing security information and telemetry from external products and Azure services into Sentinel. Once the data is available, analytics rules can detect suspicious activity and incidents can be investigated through Sentinel capabilities. Automation rules can automate incident actions, workbooks visualize collected information, and resource locks protect Azure resources. A data connector is therefore the appropriate capability when the primary requirement is to ingest security data from an external product into Microsoft Sentinel.

Question 399

Which Azure SQL security capability identifies potential database security weaknesses and can provide recommendations for addressing discovered vulnerabilities?

1. SQL vulnerability assessment
2. Blob soft delete
3. Azure Firewall
4. Azure Resource Graph

Correct Answer: 1

Explanation

SQL vulnerability assessment helps identify potential security weaknesses in Azure SQL environments and provides findings that can guide administrators toward remediation. It can support security reviews by examining database configurations and other supported security conditions. Blob soft delete protects Azure Storage data from accidental deletion, Azure Firewall provides network traffic filtering, and Resource Graph supports resource querying. SQL vulnerability assessment is therefore the appropriate security capability when an organization needs to identify database vulnerabilities and receive guidance for improving the security configuration.

Question 400

Which security principle requires administrators to grant users and workloads only the permissions necessary to perform their assigned tasks?

1. Defense in depth
2. Zero trust
3. Least privilege
4. Network segmentation

Correct Answer: 3

Explanation

The principle of least privilege requires users, applications, and workloads to receive only the permissions necessary to perform their required tasks. Limiting permissions reduces the potential impact of compromised identities, accidental actions, and unauthorized activity. Defense in depth uses multiple complementary security controls, zero trust requires continuous verification and explicit authorization, and network segmentation separates network environments to reduce unwanted communication. Least privilege is therefore the principle directly concerned with minimizing unnecessary authorization and ensuring that access rights remain limited to legitimate operational requirements.