View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 41

Which Azure service provides centralized network traffic filtering for resources across virtual networks?

1. Azure Key Vault
2. Microsoft Entra ID Protection
3. Azure Firewall
4. Azure Policy

Correct Answer: 3

Explanation

Azure Firewall is a managed, stateful network security service that provides centralized traffic filtering for Azure virtual networks. It can control network traffic using rules for applications, network addresses, ports, and other supported criteria. This makes it useful when an organization needs a centralized security control for traffic flowing between networks or toward external destinations. Azure Key Vault manages secrets and keys, Entra ID Protection focuses on identity risks, and Azure Policy governs resource configurations. Therefore, Azure Firewall is the appropriate service for centralized network traffic filtering.

Question 42

An administrator needs to create a security rule that allows HTTPS traffic to a virtual machine while blocking other unwanted inbound connections. Which port should be allowed for HTTPS?

1. 22
2. 53
3. 80
4. 443

Correct Answer: 4

Explanation

HTTPS normally uses TCP port 443 for encrypted web communication. A security rule can allow inbound traffic on port 443 when a web application or service needs to receive secure HTTPS connections. Port 22 is commonly used for SSH, port 53 is associated with DNS, and port 80 is commonly used for unencrypted HTTP traffic. Network security controls such as Network Security Groups can use ports and protocols as conditions in traffic rules. Therefore, TCP port 443 is the appropriate port for HTTPS traffic.

Question 43

A company wants to provide secure access to Azure resources from employees working remotely without exposing internal services directly to the public internet. Which connectivity option can establish an encrypted connection from a user device to an Azure virtual network?

1. Point-to-site VPN
2. Public DNS
3. Azure CDN
4. Traffic Manager

Correct Answer: 1

Explanation

A point-to-site VPN provides an encrypted connection between an individual client device and an Azure virtual network. It is useful when remote employees or administrators need secure access to resources hosted inside Azure without making those resources directly accessible from the public internet. Public DNS provides name resolution, Azure CDN accelerates content delivery, and Traffic Manager distributes traffic using DNS-based routing. Therefore, point-to-site VPN is the appropriate connectivity option when individual remote users need secure access to an Azure virtual network.

Question 44

A network security team wants to inspect and control traffic based on application-layer characteristics rather than only IP addresses and ports. Which Azure service is designed for this purpose?

1. Azure Storage
2. Azure Firewall
3. Azure Queue Storage
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Firewall provides centralized network security and supports application and network traffic filtering capabilities. Application rules can help control outbound traffic based on supported application-level information, while network rules can filter traffic using network addresses, ports, and protocols. Azure Storage is used for storing data, Queue Storage supports messaging scenarios, and Key Vault protects secrets and cryptographic material. Therefore, Azure Firewall is the service among these options designed to provide centralized inspection and control of network traffic using application-aware and network-level rules.

Question 45

An organization needs to ensure that only approved administrators can modify critical Azure resources. What combination best supports this requirement?

1. Public IP addresses and DNS
2. RBAC and least privilege
3. CDN and caching
4. Load balancing and autoscaling

Correct Answer: 2

Explanation

Role-Based Access Control and the principle of least privilege can work together to restrict administrative actions to authorized identities. RBAC assigns permissions through roles, while least privilege ensures that users receive only the permissions necessary for their responsibilities. This combination reduces unnecessary administrative access and helps limit the impact of compromised accounts. Public IP addresses and DNS address networking, CDN and caching improve content delivery, and load balancing and autoscaling address availability and performance. Therefore, RBAC combined with least privilege is appropriate for restricting administrative changes.

Question 46

A security engineer wants to identify configuration weaknesses across an Azure environment and prioritize actions that can improve its overall security posture. Which service should be reviewed?

1. Azure Data Box
2. Azure Load Balancer
3. Microsoft Defender for Cloud
4. Azure DNS

Correct Answer: 3

Explanation

Microsoft Defender for Cloud provides security posture management capabilities that can identify security recommendations and configuration weaknesses across supported cloud resources. It helps organizations understand their current security posture and prioritize improvements based on identified recommendations and risks. Azure Data Box is designed for data transfer, Load Balancer distributes network traffic, and Azure DNS provides name resolution. Therefore, Defender for Cloud is the most relevant service when security teams need centralized visibility into configuration weaknesses and recommendations for improving the security posture.

Question 47

Which Azure feature allows an administrator to assign permissions to users or groups for specific Azure resources?

1. Azure RBAC
2. Azure CDN
3. Azure Monitor
4. Azure Front Door

Correct Answer: 1

Explanation

Azure Role-Based Access Control allows administrators to assign permissions to users, groups, service principals, and managed identities. Roles can be assigned at scopes such as management groups, subscriptions, resource groups, or individual resources. This enables organizations to control which actions identities can perform and where those permissions apply. Azure CDN and Front Door focus on application delivery and traffic routing, while Azure Monitor provides monitoring and observability. Therefore, Azure RBAC is the Azure authorization mechanism used to assign permissions to identities.

Question 48

A company uses Azure Storage for sensitive business documents. The security team wants the storage account to accept requests only from a predefined list of public IP addresses. Which configuration can support this requirement?

1. Storage firewall and network rules
2. Azure Bastion
3. Azure Traffic Manager
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Azure Storage network access controls can restrict access to selected public IP addresses and virtual networks. Storage firewall and network rules allow administrators to define which network sources are permitted to connect to supported storage services. This can reduce exposure by preventing requests from unauthorized network locations. Azure Bastion provides administrative access to virtual machines, Traffic Manager performs DNS-based traffic distribution, and DDoS Protection focuses on denial-of-service attacks. Therefore, storage firewall and network rules are appropriate for limiting storage access to predefined public IP addresses.

Question 49

A development team needs to store a database password used by an application. The password should not appear in source code, configuration files, or deployment scripts. Which service should store it?

1. Azure Monitor
2. Azure Key Vault
3. Azure Load Balancer
4. Azure Virtual Network

Correct Answer: 2

Explanation

Azure Key Vault is designed to securely store secrets such as passwords, connection strings, tokens, certificates, and cryptographic keys. Applications can retrieve secrets from Key Vault through authorized identities instead of embedding sensitive values in source code or configuration files. This approach helps reduce the risk of credentials being accidentally exposed through source repositories or deployment artifacts. Azure Monitor handles observability, Load Balancer distributes traffic, and Virtual Network provides networking. Therefore, Azure Key Vault is the appropriate service for securely storing an application’s database password.

Question 50

A security team wants to ensure that a particular Azure resource cannot be accidentally deleted even by an authorized user performing routine administrative work. Which Azure feature can provide this protection?

1. Resource lock
2. Network Security Group
3. Azure DNS
4. Azure CDN

Correct Answer: 1

Explanation

Azure resource locks help prevent accidental modification or deletion of important resources. A delete lock can be applied when an organization wants to ensure that a resource remains available even if an authorized administrator unintentionally attempts to remove it. Resource locks are an additional safeguard and do not replace proper identity permissions or governance policies. Network Security Groups control network traffic, Azure DNS provides name resolution, and Azure CDN supports content delivery. Therefore, a resource lock is the appropriate feature for protecting an important Azure resource against accidental deletion.

Question 51

An administrator needs to protect a virtual network from unauthorized inbound traffic. The administrator wants rules based on source address, destination port, and protocol. Which Azure control should be configured?

1. Azure Key Vault
2. Network Security Group
3. Microsoft Entra ID Protection
4. Azure Policy

Correct Answer: 2

Explanation

A Network Security Group provides network security rules that can allow or deny inbound and outbound traffic based on conditions such as source and destination addresses, ports, and protocols. NSGs can be associated with subnets or network interfaces to control traffic reaching Azure resources. Key Vault protects sensitive information, Entra ID Protection detects identity risks, and Azure Policy enforces resource governance requirements. Therefore, an NSG is the appropriate Azure control when network traffic needs to be filtered using source addresses, ports, and protocols.

Question 52

A company has deployed an internet-facing application and wants protection against distributed denial-of-service attacks that attempt to overwhelm the application with large amounts of traffic. Which Azure capability addresses this threat?

1. Azure DDoS Protection
2. Azure Key Vault
3. Azure Policy
4. Azure Bastion

Correct Answer: 1

Explanation

Azure DDoS Protection is designed to help defend supported Azure resources against distributed denial-of-service attacks. DDoS attacks attempt to make services unavailable by overwhelming them with large volumes of traffic or other malicious requests. DDoS Protection provides additional safeguards for applications and network resources against these attacks. Azure Key Vault protects secrets and keys, Azure Policy governs resource configurations, and Azure Bastion provides secure virtual machine administration. Therefore, Azure DDoS Protection is the appropriate capability for reducing the impact of distributed denial-of-service attacks.

Question 53

An organization wants to enforce a rule requiring all newly created resources to use only approved Azure regions. Which Azure governance tool should be used?

1. Azure Bastion
2. Azure Policy
3. Azure Monitor
4. Azure Load Balancer

Correct Answer: 2

Explanation

Azure Policy enables organizations to define and enforce governance requirements for Azure resources. A policy can restrict resource deployments to approved regions and can audit or deny deployments that do not comply with the defined requirement. This helps organizations maintain consistent security, regulatory, or operational standards. Azure Bastion provides secure VM access, Azure Monitor provides monitoring, and Load Balancer distributes network traffic. Therefore, Azure Policy is the appropriate governance tool for enforcing approved-region requirements on newly created Azure resources.

Question 54

A security architect wants to protect a web application by filtering malicious HTTP requests before they reach the application. The architect also wants rules specifically designed for common web attacks. What should be used?

1. Azure Web Application Firewall
2. Azure VPN Gateway
3. Azure Private DNS
4. Azure Storage Queue

Correct Answer: 1

Explanation

Azure Web Application Firewall provides application-layer protection by inspecting HTTP and HTTPS requests and applying rules designed to detect common web attacks. It can help protect applications against threats such as SQL injection and cross-site scripting. This makes WAF different from network-level controls that primarily filter traffic according to addresses, ports, and protocols. VPN Gateway provides encrypted network connectivity, Private DNS manages private name resolution, and Storage Queue provides messaging functionality. Therefore, Web Application Firewall is the appropriate choice for filtering malicious web requests.

Question 55

An administrator is reviewing permissions for an application that needs to read files from a storage account but does not need to delete or modify them. Which access-design approach follows the principle of least privilege?

1. Grant full administrative access
2. Grant only the required read permissions
3. Grant subscription owner permissions
4. Share a global administrator account

Correct Answer: 2

Explanation

Least privilege requires an identity to receive only the permissions necessary to perform its assigned task. If an application only needs to read files, granting write, delete, or administrative permissions would provide unnecessary access. Excessive permissions increase the potential impact of compromised credentials or application vulnerabilities. Subscription Owner permissions and shared administrator accounts provide much broader access than required. Therefore, assigning only the required read permissions is the appropriate access design because it satisfies the application’s functional requirement while minimizing unnecessary privileges.

Question 56

A company wants to audit whether users are making unauthorized configuration changes to Azure resources. Which source provides records of management operations performed on the Azure subscription?

1. Azure Activity Log
2. Azure CDN cache
3. Azure DNS zone
4. Azure Storage container

Correct Answer: 1

Explanation

Azure Activity Log records management-plane operations performed on Azure resources at the subscription level. Security teams can use these records to investigate actions such as resource creation, deletion, configuration changes, and other administrative operations. This makes the Activity Log useful for auditing and investigating unexpected changes. A CDN cache stores content for delivery, a DNS zone contains name-resolution records, and a storage container organizes stored data. Therefore, Azure Activity Log is the appropriate source for reviewing management operations and investigating configuration changes.

Question 57

An organization needs to provide an application with access to Azure resources using an identity that Azure manages automatically. Which option should be selected?

1. Managed identity
2. Shared password
3. Public certificate file
4. Anonymous access

Correct Answer: 1

Explanation

Managed identities provide Azure resources with identities that can authenticate to supported Azure services without requiring developers to manage credentials directly. Azure manages the identity and its authentication credentials, while administrators can assign appropriate permissions through supported authorization mechanisms. Using shared passwords or storing credentials manually increases the burden of credential management and can create security risks. Anonymous access removes authentication rather than strengthening it. Therefore, a managed identity is the appropriate option when an application needs Azure-managed identity-based access to resources.

Question 58

A security administrator wants users to activate privileged roles only when they need to perform a specific administrative task, with access automatically ending after a defined period. Which solution is designed for this scenario?

1. Microsoft Entra Privileged Identity Management
2. Azure Traffic Manager
3. Azure Storage firewall
4. Azure Application Gateway

Correct Answer: 1

Explanation

Microsoft Entra Privileged Identity Management is designed to manage privileged access using controlled and time-limited role activation. Users can be eligible for privileged roles and activate them when necessary, rather than maintaining permanent active privileges. Organizations can configure controls such as activation duration, approval, justification, and multifactor authentication. Traffic Manager handles DNS-based traffic routing, Storage firewall controls storage network access, and Application Gateway provides application delivery and web traffic management. Therefore, PIM is the appropriate solution for temporary and controlled activation of privileged roles.

Question 59

A security team wants to reduce the number of publicly accessible endpoints in its Azure environment. For a supported Azure service, which option provides private connectivity from an Azure virtual network?

1. Public IP address
2. Private endpoint
3. Public load balancer
4. Internet gateway

Correct Answer: 2

Explanation

A private endpoint provides a private IP address within an Azure virtual network for accessing supported Azure services. This enables applications to communicate with the service through private connectivity and can reduce dependence on publicly exposed endpoints. A public IP address and public load balancer provide public network accessibility, while an internet gateway is not the Azure feature used for this specific private-service connectivity model. Therefore, a private endpoint is the appropriate option when the security goal is to reduce public exposure while maintaining access from an Azure virtual network.

Question 60

An organization is designing security controls for a critical Azure workload. The team plans to restrict permissions, protect secrets, filter network traffic, monitor activity, and continuously review security recommendations. What is the main benefit of using multiple complementary security controls?

1. It eliminates the need for authentication
2. It creates multiple layers of protection
3. It guarantees that attacks cannot occur
4. It removes the need for monitoring

Correct Answer: 2

Explanation

Using multiple complementary security controls creates layers of protection across identities, data, networks, resources, and monitoring processes. This approach is commonly associated with defense in depth. If one security control is bypassed or fails to prevent an attack, other controls may still limit access, detect suspicious behavior, protect sensitive information, or reduce the attacker’s ability to move further through the environment. No security architecture can guarantee that attacks will never occur. Therefore, combining access controls, secret protection, network security, and monitoring provides multiple defensive layers.