View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 81

Which Azure feature can automatically remove or block access when a sign-in is considered risky based on identity risk signals?

1. Microsoft Entra ID Protection
2. Azure Load Balancer
3. Azure Storage
4. Azure Firewall

Correct Answer: 1

Explanation

Microsoft Entra ID Protection uses identity-based risk signals to identify potentially compromised users and risky sign-in activity. Organizations can integrate these risk detections with Conditional Access policies to require additional authentication or block access when appropriate. This helps reduce the likelihood that compromised credentials can be used successfully. Azure Load Balancer distributes network traffic, Azure Storage provides data storage, and Azure Firewall filters network traffic. Therefore, Microsoft Entra ID Protection is the appropriate feature for identifying identity risks and supporting automated responses to suspicious authentication activity.

Question 82

An organization wants to ensure that deleted Azure Key Vault secrets cannot immediately be permanently removed by an administrator. Which feature should be enabled?

1. Azure Bastion
2. Purge protection
3. Network Security Group
4. Traffic Manager

Correct Answer: 2

Explanation

Key Vault purge protection helps prevent protected objects from being permanently purged during the configured retention period. This provides an additional safeguard against intentional or accidental permanent deletion of keys, secrets, and certificates. Soft delete allows deleted objects to remain recoverable, while purge protection adds stronger protection against permanent removal. Azure Bastion, Network Security Groups, and Traffic Manager address different security or networking requirements. Therefore, purge protection should be enabled when an organization needs stronger assurance that deleted Key Vault objects cannot be permanently purged prematurely.

Question 83

Which Azure storage security capability can help protect blob data from accidental deletion or overwrite?

1. Azure DNS
2. Blob soft delete
3. Azure Firewall
4. Application Gateway

Correct Answer: 2

Explanation

Blob soft delete allows deleted or overwritten blob data to remain recoverable for a configured retention period. This can protect against accidental deletion, unintended overwrites, and certain operational mistakes. Administrators can restore affected data while it remains within the retention period. Azure DNS handles name resolution, Azure Firewall provides network traffic filtering, and Application Gateway manages application delivery and can provide web application firewall capabilities. Therefore, blob soft delete is the appropriate storage protection feature when recoverability from accidental deletion or overwrite is required.

Question 84

A company requires database encryption at rest for an Azure SQL Database without requiring application developers to change the application code. Which feature should be configured?

1. Transparent Data Encryption
2. Azure Bastion
3. Network Security Group
4. Microsoft Entra ID Protection

Correct Answer: 1

Explanation

Transparent Data Encryption, or TDE, protects Azure SQL Database data files by encrypting data at rest. The encryption operates transparently to applications, so developers generally do not need to modify application logic to use encrypted database storage. TDE is intended primarily to protect stored database data from unauthorized access to underlying storage. Azure Bastion provides administrative connectivity, NSGs filter network traffic, and Entra ID Protection detects identity risks. Therefore, TDE is the appropriate feature for transparent encryption of Azure SQL Database data at rest.

Question 85

Which Azure security capability allows an administrator to restrict virtual machine management access to a temporary time window?

1. Azure CDN
2. Just-in-time VM access
3. Azure DNS
4. Storage lifecycle management

Correct Answer: 2

Explanation

Just-in-time VM access can reduce exposure of management ports by allowing access only when an authorized user requests it and for a limited duration. This helps minimize the time during which administrative ports such as RDP or SSH may be reachable. It is particularly useful for reducing the attack surface associated with continuously exposed management endpoints. Azure CDN handles content delivery, Azure DNS provides name resolution, and storage lifecycle management controls data movement or deletion. Therefore, just-in-time VM access is the appropriate security capability for temporary VM management access.

Question 86

A security team wants to collect security events from multiple sources and analyze them centrally using SIEM capabilities in Azure. Which service should they consider?

1. Azure Bastion
2. Microsoft Sentinel
3. Azure Load Balancer
4. Azure Key Vault

Correct Answer: 2

Explanation

Microsoft Sentinel is a cloud-native security information and event management platform that can collect security data from multiple sources, analyze events, identify threats, and support incident response workflows. It can connect to Microsoft services, Azure resources, third-party solutions, and other data sources. Azure Bastion focuses on secure VM administration, Load Balancer distributes network traffic, and Key Vault manages secrets and cryptographic material. Therefore, Microsoft Sentinel is the appropriate service when an organization needs centralized security event analysis and SIEM capabilities.

Question 87

Which Azure feature can group network interfaces so that NSG rules can be applied to applications rather than individual IP addresses?

1. Application Security Group
2. Azure Resource Lock
3. Azure Policy
4. Key Vault certificate

Correct Answer: 1

Explanation

Application Security Groups, or ASGs, allow administrators to logically group network interfaces according to application roles. NSG rules can then reference these groups instead of requiring administrators to maintain individual IP addresses for every rule. This can simplify network security administration in environments containing multiple application tiers. Resource locks protect Azure resources, Azure Policy governs configurations, and Key Vault certificates are used for certificate management. Therefore, Application Security Groups are appropriate when network security rules should be organized around application workloads.

Question 88

An administrator wants to use a predefined collection of IP address ranges representing Azure services when creating network security rules. Which NSG feature should be used?

1. Service tags
2. Resource locks
3. Managed identities
4. Private DNS zones

Correct Answer: 1

Explanation

NSG service tags represent groups of IP address prefixes associated with specific Azure services or categories of network traffic. They simplify security rule management because administrators do not need to manually maintain individual IP ranges as service addresses change. Service tags can be used as sources or destinations in supported network security rules. Resource locks protect resources, managed identities provide identity-based authentication, and private DNS zones provide private name resolution. Therefore, service tags are the appropriate NSG feature for referencing predefined Azure service address ranges.

Question 89

A company wants to access Azure Storage privately from a virtual network without exposing the storage account through its public endpoint. Which design should be used?

1. Public IP address
2. Private endpoint
3. Internet-facing load balancer
4. Public DNS only

Correct Answer: 2

Explanation

A private endpoint provides a private IP address within a virtual network for accessing supported Azure services such as Azure Storage. Traffic can remain on private network connectivity rather than reaching the service through its public endpoint. This design can reduce public exposure and support network isolation requirements. A public IP address and internet-facing load balancer intentionally provide public connectivity, while public DNS alone does not create private network access. Therefore, a private endpoint is the appropriate design for privately accessing Azure Storage from a virtual network.

Question 90

Which Azure feature can require users to complete an access review to determine whether they should continue retaining access to resources?

1. Azure Firewall
2. Microsoft Entra access reviews
3. Azure Storage
4. Azure VPN Gateway

Correct Answer: 2

Explanation

Microsoft Entra access reviews help organizations periodically review whether users, groups, or other identities should continue to have access to specific resources. These reviews can help reduce unnecessary or outdated permissions and support governance over external users and privileged access. Azure Firewall protects network traffic, Storage provides data services, and VPN Gateway provides encrypted network connectivity. Access reviews are particularly useful when access needs to be periodically confirmed rather than granted permanently. Therefore, Microsoft Entra access reviews are the appropriate feature for validating whether users should retain access.

Question 91

Which Azure service can protect web applications from attacks such as SQL injection and cross-site scripting by inspecting HTTP requests?

1. Azure Web Application Firewall
2. Azure Key Vault
3. Azure Monitor
4. Azure VPN Gateway

Correct Answer: 1

Explanation

Azure Web Application Firewall provides application-layer protection by inspecting HTTP and HTTPS traffic before requests reach the protected web application. It can use managed and custom rules to help detect and block common web application attacks, including SQL injection and cross-site scripting. Key Vault manages secrets and cryptographic material, Azure Monitor provides observability, and VPN Gateway provides encrypted network connectivity. Therefore, Web Application Firewall is the appropriate security control when protection against common HTTP-based attacks is required.

Question 92

An organization wants to encrypt Azure-managed disks using keys that it controls and manages. Which approach should be considered?

1. Customer-managed keys
2. Public DNS
3. Application Security Groups
4. Network Watcher

Correct Answer: 1

Explanation

Customer-managed keys allow organizations to maintain greater control over encryption keys used by supported Azure services. When supported for the specific disk and configuration, customer-managed keys can be stored and managed through Azure Key Vault or supported managed HSM capabilities. This can help organizations meet security, governance, and compliance requirements that require control over key management. Public DNS handles name resolution, Application Security Groups organize network interfaces, and Network Watcher provides network monitoring tools. Therefore, customer-managed keys are the appropriate approach when organizational control over encryption keys is required.

Question 93

A security administrator needs to determine whether network security rules are preventing traffic between two Azure virtual machines. Which Azure tool can help troubleshoot the connection?

1. Azure Policy
2. Network Watcher
3. Microsoft Entra ID Protection
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Network Watcher provides tools for monitoring and troubleshooting Azure network connectivity. Administrators can use capabilities such as connection troubleshooting and IP flow verification to investigate whether network security rules or routing configurations are affecting communication. Azure Policy evaluates resource compliance, Entra ID Protection focuses on identity risks, and Key Vault manages secrets and keys. Therefore, Network Watcher is the appropriate service for diagnosing network connectivity problems and determining whether security rules are contributing to blocked traffic.

Question 94

A company wants to use a security service that can identify vulnerabilities and provide security recommendations for Azure virtual machines. Which service is appropriate?

1. Microsoft Defender for Cloud
2. Azure DNS
3. Azure Load Balancer
4. Azure Queue Storage

Correct Answer: 1

Explanation

Microsoft Defender for Cloud provides security posture management and workload protection capabilities for supported Azure resources. It can identify security weaknesses, provide recommendations, and help organizations improve the security configuration of virtual machines and other workloads. Depending on the enabled capabilities and plans, Defender for Cloud can also provide threat protection and vulnerability-related insights. Azure DNS, Load Balancer, and Queue Storage provide networking, traffic distribution, and messaging functionality rather than centralized workload security recommendations. Therefore, Microsoft Defender for Cloud is the appropriate service.

Question 95

Which Key Vault feature allows an organization to maintain multiple versions of a cryptographic key as it is rotated?

1. Network Security Group
2. Key versioning
3. Azure Bastion
4. DDoS Protection

Correct Answer: 2

Explanation

Azure Key Vault supports key versions, allowing new versions of keys to be created while previous versions remain available according to the relevant configuration and lifecycle requirements. Key versioning is useful during cryptographic key rotation because applications and administrators can transition from an older key version to a newer one without treating the key as an entirely unrelated object. Network Security Groups control network traffic, Azure Bastion provides VM management access, and DDoS Protection mitigates denial-of-service attacks. Therefore, Key Vault key versioning supports controlled cryptographic key rotation.

Question 96

A security team wants to create automated detections that identify suspicious events from collected security data and generate security incidents. Which Microsoft Sentinel capability should be configured?

1. Analytics rules
2. Resource locks
3. Storage replication
4. Private endpoints

Correct Answer: 1

Explanation

Microsoft Sentinel analytics rules define logic for detecting suspicious activity within collected security data. When configured appropriately, these rules can generate alerts and contribute to incident creation and investigation workflows. This allows security teams to automate detection of patterns that may indicate threats or policy violations. Resource locks protect resources from accidental deletion, storage replication provides data redundancy, and private endpoints provide private connectivity to supported services. Therefore, analytics rules are the appropriate Microsoft Sentinel capability for creating automated security detections from collected data.

Question 97

Which Azure networking option provides private connectivity to a supported platform service while using a private IP address from a virtual network?

1. Private endpoint
2. Public IP
3. Azure CDN
4. Traffic Manager

Correct Answer: 1

Explanation

A private endpoint connects a virtual network privately to a supported Azure service by assigning a private IP address from the virtual network. This allows applications to access the service through private connectivity and can reduce reliance on public endpoints. Public IP addresses provide internet-facing connectivity, while Azure CDN and Traffic Manager focus on content delivery and traffic routing. Therefore, a private endpoint is the appropriate networking option when a supported platform service must be accessed through a private IP address within an Azure virtual network.

Question 98

A company wants to detect whether a storage account has security recommendations related to exposed or misconfigured data services. Which Microsoft security service can provide these recommendations?

1. Azure DNS
2. Microsoft Defender for Storage
3. Azure Load Balancer
4. Azure Bastion

Correct Answer: 2

Explanation

Microsoft Defender for Storage provides security capabilities for Azure Storage resources. Depending on the enabled plan and supported capabilities, it can help detect suspicious activity and provide security-related insights for storage workloads. This allows security teams to investigate potential threats and improve the protection of storage accounts. Azure DNS manages name resolution, Load Balancer distributes network traffic, and Bastion provides secure administrative connectivity to virtual machines. Therefore, Microsoft Defender for Storage is the appropriate service when security monitoring and protection specifically target Azure Storage workloads.

Question 99

Which Azure feature can help protect an application from a large-scale distributed denial-of-service attack at the network layer?

1. Azure DDoS Protection
2. Azure Key Vault
3. Microsoft Entra access reviews
4. Azure Resource Graph

Correct Answer: 1

Explanation

Azure DDoS Protection is designed to help protect Azure resources from distributed denial-of-service attacks. It provides mitigation capabilities for attacks that attempt to overwhelm network resources with large volumes of malicious traffic. DDoS Protection can be integrated with supported virtual network resources and provides additional protection beyond ordinary network security rules. Key Vault protects secrets and keys, access reviews govern identity permissions, and Resource Graph provides resource-query capabilities. Therefore, Azure DDoS Protection is the appropriate security feature for defending against large-scale DDoS attacks.

Question 100

An administrator wants to prevent users from permanently deleting critical Azure resources while still allowing authorized administrators to modify their configurations. Which lock type should be applied?

1. ReadOnly
2. CanNotDelete
3. Audit
4. Deny

Correct Answer: 2

Explanation

The CanNotDelete resource lock prevents a resource from being deleted while still allowing authorized users to modify its configuration. This makes it useful for protecting critical resources where operational changes must remain possible but accidental or unauthorized deletion should be prevented. A ReadOnly lock is more restrictive because it prevents modification as well as deletion. Audit and Deny are not Azure resource lock types. Therefore, CanNotDelete is the appropriate lock when an organization wants to preserve administrative modification capabilities while blocking deletion.