View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 101

Which Azure service provides centralized visibility into security posture, recommendations, and threat protection for cloud workloads?

1. Azure DNS
2. Azure Load Balancer
3. Microsoft Defender for Cloud
4. Azure Storage

Correct Answer: 3

Explanation

Microsoft Defender for Cloud provides centralized security posture management and workload protection capabilities across supported cloud resources. It can identify security recommendations, provide security alerts, and help organizations improve the configuration of their workloads. Security teams can use its recommendations to identify weaknesses and prioritize remediation activities. Azure DNS provides name resolution, Load Balancer distributes network traffic, and Azure Storage provides data storage services. Therefore, Microsoft Defender for Cloud is the appropriate service when an organization needs a centralized view of security posture and workload protection information.

Question 102

An administrator needs to allow an application to authenticate to Azure resources without storing credentials in configuration files. Which identity option should be used for an Azure-hosted workload?

1. Managed identity
2. Shared user account
3. Static password
4. Public IP address

Correct Answer: 1

Explanation

Managed identities allow Azure resources to authenticate to supported services without requiring developers to store passwords, client secrets, or certificates in application configuration files. Azure manages the identity and its credentials, while administrators control its permissions through appropriate access mechanisms. This reduces the exposure of long-lived credentials and simplifies credential management. Shared accounts and static passwords increase security and accountability risks, while a public IP address is not an authentication mechanism. Therefore, managed identity is the preferred option for an Azure-hosted workload that needs secure access to other Azure resources.

Question 103

A security engineer wants to prevent users from creating resources in regions that are not approved by the organization. Which Azure capability should enforce this requirement?

1. Azure Bastion
2. Microsoft Sentinel
3. Azure Policy
4. Azure VPN Gateway

Correct Answer: 3

Explanation

Azure Policy can enforce organizational requirements for resource deployments, including restrictions on which Azure regions may be used. An administrator can create a policy that audits or denies deployments outside the approved locations. This helps maintain governance and can support compliance requirements across subscriptions and resource groups. Azure Bastion provides secure VM access, Microsoft Sentinel provides security monitoring and SIEM capabilities, and VPN Gateway provides encrypted network connectivity. Therefore, Azure Policy is the appropriate capability for preventing users from deploying resources into unauthorized Azure regions.

Question 104

Which Microsoft Entra capability can identify users whose credentials may have been compromised based on detected identity risks?

1. Azure Policy
2. Microsoft Entra ID Protection
3. Azure Firewall
4. Azure Resource Lock

Correct Answer: 2

Explanation

Microsoft Entra ID Protection uses identity-related signals to detect potentially risky users and sign-ins. It can identify patterns associated with compromised credentials, suspicious authentication activity, and other identity risks. Organizations can use these risk detections with Conditional Access policies to require additional authentication or block risky access. Azure Policy governs resource configurations, Azure Firewall filters network traffic, and resource locks protect Azure resources from deletion or modification. Therefore, Microsoft Entra ID Protection is the appropriate capability for detecting potentially compromised user identities.

Question 105

A company wants to ensure that data stored in Azure Storage is encrypted using a key managed by the organization rather than relying only on Microsoft-managed encryption keys. What should be configured?

1. Customer-managed key
2. Network Security Group
3. Azure Bastion
4. Service tag

Correct Answer: 1

Explanation

Customer-managed keys allow organizations to control encryption keys used by supported Azure services. The keys can be managed through supported Azure Key Vault configurations, giving the organization greater control over key lifecycle, rotation, access, and governance. This approach can be useful when regulatory or organizational requirements demand direct control over encryption material. Network Security Groups control network traffic, Azure Bastion provides administrative connectivity, and service tags simplify network security rules. Therefore, a customer-managed key should be configured when an organization requires greater control over encryption keys for supported Azure Storage configurations.

Question 106

An organization wants to collect diagnostic information from Azure resources and send it to a centralized Log Analytics workspace for investigation. Which Azure capability should be configured?

1. Resource lock
2. Diagnostic settings
3. Private endpoint
4. Application Security Group

Correct Answer: 2

Explanation

Azure diagnostic settings allow supported resource logs and metrics to be collected and sent to destinations such as Log Analytics workspaces, storage accounts, or event hubs. Centralizing diagnostic information in Log Analytics can help security and operations teams investigate activity, troubleshoot issues, and correlate events from multiple resources. Resource locks protect resources, private endpoints provide private connectivity, and Application Security Groups organize network interfaces for NSG rules. Therefore, diagnostic settings are the appropriate capability for exporting resource monitoring data to a centralized Log Analytics workspace.

Question 107

A security administrator needs to grant an application permission to read specific secrets from Key Vault while avoiding unnecessary administrative permissions. Which principle should guide the permission assignment?

1. High availability
2. Least privilege
3. Elastic scaling
4. Load balancing

Correct Answer: 2

Explanation

The principle of least privilege requires an identity to receive only the permissions necessary to perform its assigned function. If an application only needs to read specific secrets from Key Vault, granting broad administrative permissions would create unnecessary security exposure. Permissions should therefore be limited to the required operations and appropriate scope. High availability focuses on resilience, elastic scaling concerns resource capacity, and load balancing distributes traffic. Applying least privilege helps reduce the potential impact if the application’s identity or credentials are compromised.

Question 108

Which Azure service provides a cloud-native SIEM and SOAR platform for detecting, investigating, and responding to security threats?

1. Azure Bastion
2. Azure Storage
3. Microsoft Sentinel
4. Azure Load Balancer

Correct Answer: 3

Explanation

Microsoft Sentinel is a cloud-native security information and event management and security orchestration, automation, and response platform. It can collect security data from Azure resources, Microsoft services, third-party solutions, and other sources. Security teams can create analytics rules, investigate incidents, automate response actions, and correlate events across multiple environments. Azure Bastion provides secure VM administration, Storage provides data storage, and Load Balancer distributes traffic. Therefore, Microsoft Sentinel is the appropriate service when an organization needs centralized SIEM and SOAR capabilities.

Question 109

A virtual machine must communicate with a specific application tier, but administrators want to avoid maintaining individual IP addresses in every NSG rule. Which feature can simplify this configuration?

1. Application Security Group
2. Azure Key Vault
3. Azure Policy
4. Resource lock

Correct Answer: 1

Explanation

Application Security Groups allow administrators to logically group network interfaces according to application roles. NSG rules can then reference an application security group instead of maintaining individual IP addresses for every workload. This makes security rules easier to manage as applications scale or their network addresses change. Azure Key Vault manages secrets and keys, Azure Policy governs resource configurations, and resource locks protect resources from accidental changes or deletion. Therefore, an Application Security Group is appropriate when NSG rules need to be organized around application tiers.

Question 110

Which Microsoft Entra feature can temporarily elevate a user’s privileges when administrative access is required?

1. Microsoft Entra Privileged Identity Management
2. Azure CDN
3. Azure DNS
4. Azure Load Balancer

Correct Answer: 1

Explanation

Microsoft Entra Privileged Identity Management, or PIM, helps organizations manage privileged roles by providing controlled, time-limited access. Eligible users can activate required privileges when necessary, often with additional controls such as multifactor authentication, approval, justification, or time limits. This reduces standing administrative access and can improve accountability. Azure CDN handles content delivery, Azure DNS provides name resolution, and Azure Load Balancer distributes network traffic. Therefore, Microsoft Entra PIM is the appropriate feature for temporarily elevating a user’s administrative privileges.

Question 111

An administrator needs to determine which Azure resources are currently assigned a specific security-related tag across multiple subscriptions. Which service can provide resource inventory queries at scale?

1. Azure Bastion
2. Azure Resource Graph
3. Azure Firewall
4. Azure Key Vault

Correct Answer: 2

Explanation

Azure Resource Graph is designed for efficiently querying information about Azure resources at scale across subscriptions. Administrators can use it to inventory resources, examine properties, identify configurations, and locate resources matching specific criteria such as tags or resource types. This is useful for governance and security assessments across large Azure environments. Azure Bastion provides VM administration, Azure Firewall filters network traffic, and Key Vault manages secrets and cryptographic material. Therefore, Azure Resource Graph is the appropriate service for querying resource inventory across multiple subscriptions.

Question 112

A company wants to make sure users accessing a sensitive application from unmanaged devices must complete multifactor authentication. Which control should be configured?

1. Azure Policy
2. Azure Firewall
3. Microsoft Entra Conditional Access
4. Azure Resource Graph

Correct Answer: 3

Explanation

Microsoft Entra Conditional Access evaluates access conditions and can enforce controls based on factors such as user identity, device state, application, location, and risk. A policy can require multifactor authentication when a user accesses a sensitive application from an unmanaged device. This provides an adaptive access control mechanism instead of relying solely on static permissions. Azure Policy governs Azure resource configurations, Azure Firewall controls network traffic, and Resource Graph queries resource information. Therefore, Conditional Access is the appropriate control for applying MFA based on device and application conditions.

Question 113

Which Azure security capability can automatically identify virtual machines that have unnecessary management ports exposed and recommend restricting access?

1. Microsoft Defender for Cloud
2. Azure DNS
3. Azure Storage
4. Azure Traffic Manager

Correct Answer: 1

Explanation

Microsoft Defender for Cloud can provide security recommendations that help identify weaknesses in Azure workloads, including insecure network configurations and exposed management access. These recommendations can help administrators reduce unnecessary exposure and improve the security posture of virtual machines. Azure DNS provides name resolution, Azure Storage handles data storage, and Traffic Manager provides DNS-based traffic routing. Therefore, Microsoft Defender for Cloud is the appropriate security service for identifying VM security weaknesses and recommending configuration improvements.

Question 114

A security team needs to store cryptographic keys in hardware-backed protection and maintain centralized control over those keys. Which Azure capability is designed for this requirement?

1. Azure CDN
2. Network Security Group
3. Azure Key Vault Managed HSM
4. Azure Load Balancer

Correct Answer: 3

Explanation

Azure Key Vault Managed HSM provides a dedicated hardware security module service for managing cryptographic keys using hardware-backed protection. It is designed for organizations with demanding security and compliance requirements around key custody and cryptographic operations. Managed HSM provides centralized key management while using dedicated HSM-backed protection. Azure CDN handles content delivery, NSGs filter network traffic, and Load Balancer distributes traffic. Therefore, Azure Key Vault Managed HSM is the appropriate capability when an organization requires hardware-backed centralized cryptographic key management.

Question 115

An organization wants to prevent unauthorized users from accessing a web application while also applying identity-based conditions such as user risk and device compliance. Which service should enforce these identity conditions?

1. Azure Firewall
2. Microsoft Entra Conditional Access
3. Azure Storage
4. Network Watcher

Correct Answer: 2

Explanation

Microsoft Entra Conditional Access is designed to make access decisions using identity and contextual signals. Policies can evaluate conditions such as user risk, sign-in risk, device compliance, application, location, and other supported factors. The policy can then require MFA, block access, or apply another access control. Azure Firewall focuses on network traffic, Storage provides data services, and Network Watcher provides network monitoring and troubleshooting. Therefore, Microsoft Entra Conditional Access should be used when access decisions need to incorporate identity, risk, and device conditions.

Question 116

A security administrator wants to monitor Azure Activity Log events continuously and send them to a centralized security analytics platform. Which configuration can support this requirement?

1. Resource lock
2. Diagnostic settings
3. Application Security Group
4. Private endpoint

Correct Answer: 2

Explanation

Diagnostic settings can route Azure Activity Log data to supported destinations such as Log Analytics workspaces, Event Hubs, or storage accounts. This allows organizations to retain and analyze management-plane activity centrally and can support security monitoring, auditing, and investigation workflows. Resource locks protect resources, Application Security Groups organize network interfaces, and private endpoints provide private connectivity to supported services. Therefore, configuring diagnostic settings is an appropriate method for forwarding Activity Log events to a centralized security analytics environment.

Question 117

A company wants to periodically verify whether external users still require access to internal applications and resources. Which Microsoft Entra capability is most suitable?

1. Microsoft Entra access reviews
2. Azure DDoS Protection
3. Azure Firewall
4. Azure Bastion

Correct Answer: 1

Explanation

Microsoft Entra access reviews help organizations periodically verify whether users should continue to have access to applications, groups, or other protected resources. They are particularly useful for reviewing guest and external-user access, where permissions can remain after the original business requirement has ended. Regular reviews can help reduce unnecessary access and improve identity governance. Azure DDoS Protection protects against denial-of-service attacks, Azure Firewall filters network traffic, and Azure Bastion provides secure VM administration. Therefore, access reviews are the appropriate capability for periodically validating external-user access.

Question 118

Which Azure network security service can use threat intelligence to help identify and block traffic associated with known malicious sources?

1. Azure Key Vault
2. Azure Storage
3. Azure Firewall
4. Azure Bastion

Correct Answer: 3

Explanation

Azure Firewall includes threat intelligence capabilities that can help identify traffic associated with known malicious IP addresses and domains. When threat intelligence mode is configured appropriately, the firewall can alert on or deny traffic based on Microsoft-maintained threat intelligence information. This provides an additional security layer alongside network and application rules. Azure Key Vault protects secrets and keys, Storage provides data services, and Bastion provides secure administrative connectivity. Therefore, Azure Firewall is the appropriate network security service for threat-intelligence-based traffic filtering.

Question 119

An administrator needs to identify whether a resource deployment violated an organizational security policy and wants to review the policy evaluation result. Which Azure service should be examined?

1. Azure Load Balancer
2. Azure Bastion
3. Azure Policy
4. Azure DNS

Correct Answer: 3

Explanation

Azure Policy evaluates Azure resources against organizational requirements and maintains compliance information that administrators can review. Policy results can help identify resources that violate defined rules, such as requirements involving regions, tags, resource types, or security configurations. Administrators can use policy compliance information to investigate violations and determine remediation actions. Load Balancer manages traffic distribution, Bastion provides secure VM access, and Azure DNS handles name resolution. Therefore, Azure Policy should be examined when investigating whether resource deployments comply with organizational governance requirements.

Question 120

A security architect wants to reduce the risk of compromised administrator accounts by requiring an approval before highly privileged roles can be activated. Which Azure identity capability supports this control?

1. Azure Resource Graph
2. Microsoft Entra Privileged Identity Management
3. Azure Storage
4. Azure CDN

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management supports controlled activation of privileged roles and can be configured with approval requirements for eligible users. Additional controls can include multifactor authentication, justification, notifications, and time-limited activation. These controls reduce standing privilege and provide greater oversight over sensitive administrative actions. Azure Resource Graph is used for resource queries, Storage provides data services, and CDN handles content delivery. Therefore, Microsoft Entra PIM is the appropriate identity capability for requiring approval before highly privileged roles are activated.