View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 61

Which Azure service is designed to manage secrets, certificates, and cryptographic keys securely?

1. Azure Monitor
2. Azure Key Vault
3. Azure Firewall
4. Azure Bastion

Correct Answer: 2

Explanation

Azure Key Vault provides centralized and secure management of sensitive information such as secrets, certificates, and cryptographic keys. Applications can retrieve required secrets through authorized identities instead of storing passwords or keys directly in source code. This reduces the risk of exposing sensitive information through application files or repositories. Azure Monitor focuses on monitoring and diagnostics, Azure Firewall filters network traffic, and Azure Bastion provides secure administrative access to virtual machines. Therefore, Azure Key Vault is the appropriate service for securely managing cryptographic material and application secrets.

Question 62

A security administrator wants to ensure that a user can manage virtual machines but cannot modify networking resources in the subscription. Which access-control approach should be used?

1. Assign the user the Owner role
2. Assign an appropriate VM-focused RBAC role
3. Give the user Global Administrator access
4. Use a shared administrator account

Correct Answer: 2

Explanation

Azure RBAC allows administrators to assign roles that provide specific permissions required for a user’s responsibilities. If a user only needs to manage virtual machines, an appropriate virtual-machine-focused role can provide those permissions without granting unnecessary access to networking resources. Assigning Owner or broad administrator privileges would violate the principle of least privilege because those roles provide much wider permissions. Shared administrator accounts also reduce accountability. Therefore, assigning an appropriate narrowly scoped RBAC role is the best approach for limiting the user’s access to required VM operations.

Question 63

Which Microsoft Entra feature can require multifactor authentication when a user signs in from an untrusted location?

1. Conditional Access
2. Azure Policy
3. Azure Firewall
4. Azure Resource Lock

Correct Answer: 1

Explanation

Microsoft Entra Conditional Access allows organizations to create policies that evaluate conditions such as user identity, location, device state, application, and sign-in risk. Based on those conditions, the organization can require multifactor authentication, block access, or apply other controls. Azure Policy governs resource configurations, Azure Firewall controls network traffic, and resource locks help prevent accidental modification or deletion. Therefore, Conditional Access is the appropriate Microsoft Entra feature for requiring additional authentication when users access resources from untrusted locations.

Question 64

An organization wants to prevent a production resource from being accidentally deleted by an administrator. Which Azure feature should be applied?

1. Network Security Group
2. Resource lock
3. Private endpoint
4. Azure Bastion

Correct Answer: 2

Explanation

Azure resource locks can protect important resources against accidental modification or deletion. A delete lock can be applied to production resources when the organization wants to prevent them from being removed unintentionally. Resource locks provide an additional safeguard and should be used together with appropriate identity permissions and governance controls. Network Security Groups control network traffic, private endpoints provide private connectivity, and Azure Bastion provides secure virtual machine management. Therefore, a resource lock is the suitable feature for protecting a production resource from accidental deletion.

Question 65

A company needs to identify whether an Azure resource violates an organizational requirement and wants to evaluate compliance without necessarily deleting or blocking the resource. Which Azure capability can perform this type of assessment?

1. Azure Policy
2. Azure Load Balancer
3. Azure Bastion
4. Azure VPN Gateway

Correct Answer: 1

Explanation

Azure Policy can audit resource configurations against organizational requirements. Policies can identify resources that do not comply with defined standards and provide compliance information without necessarily blocking the resource. Depending on the policy effect selected, policies can also deny noncompliant deployments or modify supported configurations. Load Balancer distributes traffic, Bastion provides secure VM access, and VPN Gateway establishes encrypted network connectivity. Therefore, Azure Policy is appropriate when an organization wants to assess whether resources comply with established governance and security requirements.

Question 66

A security team wants to monitor suspicious activity and receive recommendations for improving the security configuration of Azure workloads. Which service should they use?

1. Azure Storage
2. Microsoft Defender for Cloud
3. Azure DNS
4. Azure Queue Storage

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides security posture management and workload protection capabilities. It can provide security recommendations, identify potential threats, and help organizations monitor and improve the security posture of supported cloud resources. Azure Storage is used to store data, Azure DNS handles name resolution, and Queue Storage supports asynchronous messaging. None of these services provides the same centralized security posture and threat-protection capabilities. Therefore, Microsoft Defender for Cloud is the appropriate service for monitoring security issues and receiving recommendations for improving Azure workload protection.

Question 67

Which network security control can filter traffic based on source and destination IP addresses, ports, and protocols?

1. Azure Key Vault
2. Network Security Group
3. Microsoft Entra ID Protection
4. Azure Policy

Correct Answer: 2

Explanation

A Network Security Group provides rules that can allow or deny network traffic based on source and destination IP addresses, ports, and protocols. NSGs can be associated with subnets or network interfaces to control network communication to Azure resources. Azure Key Vault protects secrets and keys, Microsoft Entra ID Protection focuses on identity risks, and Azure Policy governs resource configurations. Therefore, an NSG is the appropriate control when administrators need to filter traffic according to network addresses, ports, and protocols.

Question 68

An application needs to retrieve a secret from Azure Key Vault. The developers do not want to store a password or client secret in the application code. Which authentication method is preferred?

1. Anonymous authentication
2. Managed identity
3. Shared administrator credentials
4. Public IP authentication

Correct Answer: 2

Explanation

Managed identity allows an Azure application or resource to authenticate to supported services without storing credentials directly in application code. The identity is managed by Azure and can be granted appropriate permissions to access secrets in Key Vault. This reduces the need for developers to maintain passwords, client secrets, or other long-lived credentials within the application. Anonymous authentication provides no identity protection, shared administrator credentials increase security risk, and public IP addresses are not authentication mechanisms. Therefore, managed identity is the preferred option for secure application access to Key Vault.

Question 69

A company wants to restrict a storage account so that it can be accessed only from approved virtual networks. What should the administrator configure?

1. Storage network rules
2. Azure Traffic Manager
3. Azure CDN
4. Public DNS

Correct Answer: 1

Explanation

Azure Storage provides network access controls that can restrict access to selected virtual networks and other approved network sources. By configuring storage network rules, an organization can reduce exposure and prevent unauthorized network locations from accessing the storage account. Traffic Manager distributes traffic through DNS-based routing, Azure CDN accelerates content delivery, and Public DNS manages publicly resolvable domain names. Therefore, storage network rules are appropriate when access to a storage account must be restricted to approved virtual networks.

Question 70

An organization wants to securely administer Azure virtual machines through a browser while avoiding direct exposure of RDP and SSH ports to the public internet. Which service should be deployed?

1. Azure Bastion
2. Azure Front Door
3. Azure DNS
4. Azure Load Balancer

Correct Answer: 1

Explanation

Azure Bastion provides secure RDP and SSH connectivity to virtual machines through the Azure portal. It allows administrators to connect without exposing the virtual machines’ RDP or SSH ports directly to the public internet. This can reduce the attack surface associated with publicly accessible management ports. Azure Front Door provides global application delivery, Azure DNS handles domain name resolution, and Load Balancer distributes traffic. Therefore, Azure Bastion is the appropriate service for secure browser-based administrative access to Azure virtual machines.

Question 71

A company wants to prevent resources from being deployed unless they use approved resource types and configurations. Which Azure governance service can enforce this requirement?

1. Azure Policy
2. Azure Monitor
3. Azure Bastion
4. Azure CDN

Correct Answer: 1

Explanation

Azure Policy enables organizations to define rules that govern which resources and configurations are permitted in an Azure environment. Depending on the policy effect, administrators can audit existing resources, deny noncompliant deployments, or apply supported modifications. This makes Azure Policy useful for enforcing standards such as approved resource types, regions, tags, and security configurations. Azure Monitor focuses on observability, Azure Bastion provides VM management access, and Azure CDN accelerates content delivery. Therefore, Azure Policy is the appropriate governance service for enforcing deployment requirements.

Question 72

An administrator wants to determine who deleted a virtual network yesterday and investigate the operation. Which Azure source should be checked?

1. Azure Activity Log
2. Azure CDN logs
3. Azure DNS records
4. Storage blob metadata

Correct Answer: 1

Explanation

Azure Activity Log records management operations performed on Azure resources at the subscription level. A deletion of a virtual network is a management-plane operation, so the Activity Log can provide information about the operation, including the identity associated with the action and relevant timing information. CDN logs focus on content delivery activity, DNS records describe name-resolution configurations, and blob metadata describes stored objects. Therefore, Azure Activity Log should be checked when investigating who performed a resource deletion and when the operation occurred.

Question 73

Which security principle recommends giving an identity only the permissions required to complete its assigned task?

1. Defense in depth
2. Least privilege
3. High availability
4. Elasticity

Correct Answer: 2

Explanation

Least privilege means providing users, applications, and services only the permissions necessary to perform their intended functions. This principle reduces unnecessary access and limits the potential impact of compromised accounts or accidental actions. Defense in depth involves using multiple security controls, while high availability and elasticity relate primarily to resilience and resource scaling. Therefore, least privilege is the security principle that directly addresses limiting permissions to only those required for a specific task.

Question 74

A security architect is designing a solution where network controls, identity controls, data encryption, monitoring, and threat detection are all used together. What security strategy does this represent?

1. Single-point protection
2. Defense in depth
3. Public exposure
4. Anonymous access

Correct Answer: 2

Explanation

Defense in depth uses multiple complementary security controls so that protection does not depend on a single mechanism. Identity controls can restrict who accesses resources, network controls can limit communication, encryption can protect data, monitoring can identify suspicious activity, and threat detection can help respond to attacks. If one layer is bypassed, additional layers may still reduce the attacker’s ability to access or damage resources. Therefore, a security architecture combining several different protective mechanisms represents the defense-in-depth strategy.

Question 75

A company needs to allow an administrator to manage resources only inside a particular subscription. Which RBAC scope is appropriate if the permissions should apply across that subscription but not other subscriptions?

1. Management group
2. Subscription
3. Individual resource
4. Resource property

Correct Answer: 2

Explanation

An Azure RBAC role assignment at the subscription scope applies the assigned permissions to resources within that subscription, subject to the role definition and inheritance behavior. This allows an administrator to manage appropriate resources across the subscription without automatically extending the same assignment to unrelated subscriptions. A management group scope can affect multiple subscriptions, while an individual resource scope is narrower. Resource properties are not an RBAC assignment scope. Therefore, subscription scope is appropriate when permissions should cover resources within one specific subscription.

Question 76

A security team wants to protect a public web application from common HTTP-based attacks while maintaining the ability to inspect incoming web requests. Which Azure service is most suitable?

1. Azure Web Application Firewall
2. Azure Key Vault
3. Azure VPN Gateway
4. Azure Resource Lock

Correct Answer: 1

Explanation

Azure Web Application Firewall provides application-layer protection for web applications by inspecting HTTP and HTTPS requests. It can help identify and block common web attacks, including SQL injection and cross-site scripting, using supported rules and configurations. Azure Key Vault manages secrets and cryptographic keys, VPN Gateway provides encrypted network connectivity, and resource locks protect resources from accidental modification or deletion. Therefore, Web Application Firewall is the most suitable service when a public web application needs inspection and protection against common HTTP-based attacks.

Question 77

An organization has a policy requiring all resources to include an owner tag. The team wants Azure to identify resources that do not meet this requirement. Which service should be used?

1. Azure Policy
2. Azure Firewall
3. Azure Bastion
4. Azure DDoS Protection

Correct Answer: 1

Explanation

Azure Policy can evaluate resource configurations and identify resources that do not comply with organizational requirements. A policy can audit whether required tags, such as an owner tag, are present on resources. Depending on the policy configuration, organizations may also use supported policy effects to enforce or modify certain resource settings. Azure Firewall filters network traffic, Bastion provides secure VM administration, and DDoS Protection addresses denial-of-service threats. Therefore, Azure Policy is the appropriate service for monitoring and enforcing resource-tag requirements.

Question 78

An application needs to connect securely to an Azure service using a private IP address within its virtual network. Which feature provides this connectivity?

1. Public endpoint
2. Private endpoint
3. Public DNS zone
4. Internet-facing load balancer

Correct Answer: 2

Explanation

A private endpoint provides a private IP address from an Azure virtual network for accessing supported Azure services. This allows applications to communicate with the service through private network connectivity rather than using a public endpoint. Private endpoints can help reduce public exposure and support network isolation requirements. A public endpoint, public DNS zone, and internet-facing load balancer are associated with public accessibility rather than private service connectivity. Therefore, a private endpoint is the appropriate feature when an application needs to access a supported Azure service using private network connectivity.

Question 79

A security administrator wants to review security recommendations and determine whether Azure workloads have unresolved security issues. Which service should provide this centralized security view?

1. Azure DNS
2. Microsoft Defender for Cloud
3. Azure Queue Storage
4. Azure Load Balancer

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides a centralized view of security posture information, recommendations, and security alerts for supported cloud resources. It can help security teams identify unresolved security issues and prioritize improvements across workloads. Azure DNS provides name resolution, Queue Storage supports asynchronous messaging, and Load Balancer distributes network traffic. These services do not provide the same security posture management capabilities. Therefore, Microsoft Defender for Cloud is the appropriate service for reviewing security recommendations and identifying unresolved security issues.

Question 80

A security architect wants an application to use short-lived access to sensitive resources rather than permanently storing privileged credentials. Which approach most closely supports this security goal?

1. Permanent shared passwords
2. Just-in-time privileged access
3. Anonymous access
4. Public administrative endpoints

Correct Answer: 2

Explanation

Just-in-time privileged access reduces standing administrative privileges by allowing users to activate elevated access only when it is required and for a limited period. Microsoft Entra Privileged Identity Management supports this type of controlled privileged access. Reducing permanent privileges can lower the risk associated with compromised accounts and accidental administrative actions. Permanent shared passwords create credential-management and accountability risks, while anonymous access and public administrative endpoints increase exposure. Therefore, just-in-time privileged access most closely supports the goal of using temporary access instead of permanently stored privileged credentials.