View Full Microsoft AZ-500 Exam Dumps and Practice Test Dumps.

 

Question 141

Which Azure service provides centralized management of cryptographic keys, secrets, and certificates?

1. Azure Key Vault
2. Azure Monitor
3. Azure Load Balancer
4. Azure Traffic Manager

Correct Answer: 1

Explanation

Azure Key Vault is designed to securely store and manage sensitive information such as secrets, cryptographic keys, and certificates. Applications and administrators can access these objects through authenticated and authorized requests rather than embedding sensitive values directly in application code. Key Vault also supports capabilities such as key versions, soft delete, and purge protection for supported objects. Azure Monitor focuses on observability, Load Balancer distributes network traffic, and Traffic Manager provides DNS-based traffic routing. Therefore, Azure Key Vault is the appropriate service for centralized management of cryptographic material and application secrets.

Question 142

An organization wants to prevent users from deploying resources in a geographic region that is not approved by its security policy. Which Azure control should be configured?

1. Azure Bastion
2. Azure Policy
3. Azure CDN
4. Azure VPN Gateway

Correct Answer: 2

Explanation

Azure Policy can enforce organizational governance requirements by evaluating resource properties and deployment configurations. A policy can be configured to audit or deny deployments to regions that are not approved by the organization. This helps maintain consistent governance across subscriptions and resource groups. Azure Bastion provides secure administrative access to virtual machines, Azure CDN handles content delivery, and VPN Gateway provides encrypted network connectivity. Therefore, Azure Policy is the appropriate control when an organization needs to restrict resource deployments according to approved geographic locations.

Question 143

Which Microsoft Entra feature can provide temporary elevated access to privileged roles instead of leaving administrators permanently assigned?

1. Microsoft Entra access reviews
2. Microsoft Entra Privileged Identity Management
3. Microsoft Entra ID Protection
4. Microsoft Entra Connect

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management helps organizations reduce standing administrative privileges by allowing eligible users to activate privileged roles only when required. Organizations can configure activation controls such as time limits, multifactor authentication, approval, and justification. This provides greater oversight over sensitive administrative permissions and reduces the period during which powerful privileges are available. Access reviews focus on periodically reviewing existing access, ID Protection detects identity risks, and Entra Connect supports identity synchronization. Therefore, Microsoft Entra PIM is the appropriate feature for temporary privileged-role activation.

Question 144

A web application is hosted behind Azure Application Gateway and requires protection against common HTTP attacks. Which capability should be enabled?

1. Azure Firewall
2. Azure DDoS Protection
3. Web Application Firewall
4. Network Security Group

Correct Answer: 3

Explanation

Web Application Firewall provides application-layer protection for HTTP and HTTPS traffic. When integrated with supported Azure application delivery services such as Application Gateway, it can inspect web requests and help detect and block common attacks such as SQL injection and cross-site scripting. Azure Firewall provides broader network traffic filtering, DDoS Protection focuses on denial-of-service attacks, and NSGs provide network-level access control. Therefore, Web Application Firewall is the appropriate capability when a web application behind Application Gateway requires protection against common HTTP-based attacks.

Question 145

Which Azure feature can provide a private IP address for an Azure service within a virtual network?

1. Private endpoint
2. Public IP address
3. Azure CDN
4. Traffic Manager

Correct Answer: 1

Explanation

A private endpoint creates a network interface with a private IP address from an Azure virtual network and connects it to a supported Azure service. This allows applications to communicate with the service through private connectivity rather than relying on a public endpoint. Private endpoints are useful when organizations need to reduce public exposure and implement network isolation. Public IP addresses provide internet-facing connectivity, while CDN and Traffic Manager serve content-delivery and traffic-routing purposes. Therefore, a private endpoint is the appropriate feature for private access to supported Azure services.

Question 146

A security administrator wants to identify suspicious activity involving an Azure Storage account and receive storage-specific security alerts. Which service should be considered?

1. Azure Bastion
2. Microsoft Defender for Storage
3. Azure DNS
4. Azure Load Balancer

Correct Answer: 2

Explanation

Microsoft Defender for Storage provides security monitoring and threat protection capabilities for Azure Storage workloads. It can help identify suspicious activities and provide security-related alerts associated with storage resources. This allows security teams to investigate potentially malicious behavior and improve the protection of storage accounts. Azure Bastion provides secure virtual machine administration, Azure DNS handles name resolution, and Load Balancer distributes network traffic. Therefore, Microsoft Defender for Storage is the appropriate service when security monitoring specifically needs to focus on Azure Storage resources.

Question 147

Which network feature allows NSG rules to identify workloads by application role instead of individual IP addresses?

1. Service tags
2. Application Security Groups
3. Private DNS zones
4. Route tables

Correct Answer: 2

Explanation

Application Security Groups allow administrators to logically group network interfaces according to application roles, such as web servers or database servers. NSG rules can then reference these groups instead of requiring administrators to maintain individual IP addresses. This simplifies network security administration and makes rules easier to maintain as workloads change or scale. Service tags represent predefined Azure service address ranges, private DNS zones provide name resolution, and route tables control network routing. Therefore, Application Security Groups are appropriate when NSG rules should be based on application roles.

Question 148

An organization needs to collect management-plane activity from Azure resources and retain it for centralized security investigation. Which log should be collected?

1. Azure Activity Log
2. Web server access log
3. DNS cache
4. Application trace file

Correct Answer: 1

Explanation

Azure Activity Log records subscription-level management operations performed on Azure resources. It can provide information about actions such as resource creation, modification, and deletion, along with details that can support auditing and investigation. Organizations can use diagnostic settings to route Activity Log information to destinations such as Log Analytics workspaces, Event Hubs, or storage. Web server logs and application traces provide workload-specific information, while DNS caches are unrelated to Azure management operations. Therefore, Azure Activity Log is the appropriate source for centralized investigation of Azure resource management activity.

Question 149

Which Azure capability can identify security weaknesses and provide recommendations for improving the security posture of cloud resources?

1. Azure Load Balancer
2. Microsoft Defender for Cloud
3. Azure DNS
4. Azure Queue Storage

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides security posture management capabilities that help organizations identify weaknesses across supported cloud resources. It can generate security recommendations, provide security insights, and help teams prioritize improvements. Depending on the enabled capabilities, Defender for Cloud can also provide workload protection and threat detection. Load Balancer distributes network traffic, Azure DNS handles name resolution, and Queue Storage provides messaging functionality. Therefore, Microsoft Defender for Cloud is the appropriate service for identifying security weaknesses and improving the overall security posture of supported cloud workloads.

Question 150

A company wants to ensure that only authorized applications can retrieve secrets from Azure Key Vault. What should the administrator primarily configure?

1. Appropriate identity permissions
2. Public DNS
3. Azure CDN rules
4. Load-balancing rules

Correct Answer: 1

Explanation

Access to Key Vault objects should be controlled through appropriate identity and authorization permissions. An application should receive only the permissions required for its intended operations, following the principle of least privilege. Depending on the Key Vault configuration, authorization can be managed using Azure RBAC or supported access policies. Public DNS, CDN rules, and load-balancing rules do not determine which identities can retrieve Key Vault secrets. Therefore, administrators should configure appropriate identity permissions and limit access to only the required secrets and operations.

Question 151

Which Azure security service is designed to mitigate distributed denial-of-service attacks against supported public Azure resources?

1. Azure Key Vault
2. Azure DDoS Protection
3. Azure Policy
4. Microsoft Sentinel

Correct Answer: 2

Explanation

Azure DDoS Protection provides dedicated protection against distributed denial-of-service attacks targeting supported Azure resources. It helps detect and mitigate malicious traffic patterns designed to overwhelm network resources and disrupt availability. This protection complements other controls such as network security rules and application-layer defenses. Key Vault protects cryptographic material and secrets, Azure Policy governs resource configurations, and Microsoft Sentinel provides security analytics and incident response capabilities. Therefore, Azure DDoS Protection is the appropriate service when the primary requirement is protection against network-level DDoS attacks.

Question 152

An administrator wants to query all Azure virtual machines across several subscriptions and find those that do not contain a required security tag. Which service should be used?

1. Azure Resource Graph
2. Azure Bastion
3. Azure Firewall
4. Azure VPN Gateway

Correct Answer: 1

Explanation

Azure Resource Graph is designed for querying Azure resource information across subscriptions at scale. Administrators can use queries to filter resources by properties such as resource type, location, tags, and configuration details. This makes Resource Graph useful for security inventory, governance checks, compliance investigations, and large-scale resource discovery. Azure Bastion provides secure VM access, Azure Firewall filters network traffic, and VPN Gateway provides encrypted network connectivity. Therefore, Azure Resource Graph is the appropriate service for locating virtual machines with missing or incorrect security-related tags across multiple subscriptions.

Question 153

A security team needs a platform that can ingest alerts from multiple security products and correlate them into incidents for investigation. Which Azure service is designed for this purpose?

1. Azure Storage
2. Microsoft Sentinel
3. Azure Load Balancer
4. Azure Bastion

Correct Answer: 2

Explanation

Microsoft Sentinel is a cloud-native SIEM and SOAR platform that can collect security data from Microsoft services, Azure resources, third-party solutions, and other sources. It can correlate events, generate alerts through analytics rules, group related activity into incidents, and support investigation and automated response. Azure Storage provides data storage, Load Balancer distributes network traffic, and Bastion provides secure administrative access to virtual machines. Therefore, Microsoft Sentinel is the appropriate platform for centralized security-event correlation and incident investigation.

Question 154

Which Azure feature can protect a critical resource from deletion while still allowing authorized users to modify its configuration?

1. ReadOnly lock
2. CanNotDelete lock
3. Public endpoint
4. Service tag

Correct Answer: 2

Explanation

A CanNotDelete resource lock prevents a resource from being deleted while continuing to allow authorized users to modify its configuration. This is useful for critical production resources where configuration changes remain necessary but accidental deletion must be prevented. A ReadOnly lock is more restrictive because it prevents modifications as well as deletion. Public endpoints and service tags are networking features and do not provide resource deletion protection. Therefore, a CanNotDelete lock is the appropriate choice when administrators must retain modification capabilities while preventing deletion.

Question 155

Which capability allows an organization to periodically confirm whether users should retain access to applications or groups?

1. Microsoft Entra access reviews
2. Azure Firewall
3. Azure DDoS Protection
4. Azure Network Watcher

Correct Answer: 1

Explanation

Microsoft Entra access reviews allow organizations to periodically evaluate whether users should continue to have access to applications, groups, and other protected resources. This capability is useful for removing unnecessary access that may remain after a user’s responsibilities change or an external collaboration ends. Access reviews support identity governance by requiring appropriate reviewers to confirm whether access remains justified. Azure Firewall filters network traffic, DDoS Protection mitigates denial-of-service attacks, and Network Watcher provides network monitoring tools. Therefore, Microsoft Entra access reviews are appropriate for recurring access validation.

Question 156

A company wants to prevent users from deploying Azure resources outside a defined set of approved regions. Which policy effect can directly stop a noncompliant deployment?

1. Audit
2. Deny
3. Append
4. Disabled

Correct Answer: 2

Explanation

The Deny effect in Azure Policy can prevent resource deployments or updates when the requested configuration violates the defined policy rule. For example, an organization can use a Deny policy to stop resources from being deployed in regions that are not approved. Audit records noncompliance but does not block the operation, while Append modifies supported resource properties and Disabled prevents the policy from being evaluated. Therefore, the Deny effect is appropriate when the security requirement is to actively prevent noncompliant deployments rather than simply report them.

Question 157

An Azure application requires access to a secret stored in Key Vault, but developers must not place credentials inside the application’s source code. Which authentication approach is most appropriate?

1. Managed identity
2. Shared password
3. Anonymous access
4. Public IP address

Correct Answer: 1

Explanation

Managed identity provides an Azure-hosted application with an identity that can authenticate to supported services without storing passwords or client secrets in application code. Administrators can grant the managed identity only the permissions needed to retrieve the required Key Vault secret. This reduces credential exposure and simplifies credential lifecycle management. Shared passwords create additional security and accountability risks, anonymous access does not provide identity-based protection, and public IP addresses do not authenticate applications. Therefore, managed identity is the preferred authentication approach for secure application access to Key Vault.

Question 158

Which Azure networking service can help determine whether an NSG rule is allowing or denying a specific network flow?

1. Azure Key Vault
2. Azure Network Watcher
3. Microsoft Sentinel
4. Azure Storage

Correct Answer: 2

Explanation

Azure Network Watcher includes network troubleshooting capabilities such as IP flow verification, which can help determine whether network traffic is permitted or denied by security rules. Administrators can use these tools to investigate connectivity problems involving network interfaces, subnets, NSGs, and routing. Key Vault manages secrets and cryptographic keys, Microsoft Sentinel performs security analytics, and Storage provides data services. Therefore, Network Watcher is the appropriate service for determining how NSG rules affect a particular network flow.

Question 159

An organization wants to use hardware-backed protection for cryptographic keys while maintaining centralized key management in Azure. Which service should be selected?

1. Azure DNS
2. Azure CDN
3. Azure Key Vault Managed HSM
4. Azure Traffic Manager

Correct Answer: 3

Explanation

Azure Key Vault Managed HSM provides hardware-backed protection for cryptographic keys through dedicated managed hardware security modules. It is designed for organizations with stringent requirements for cryptographic key protection, custody, and centralized management. The service can support scenarios where software-based key protection does not satisfy organizational or compliance requirements. Azure DNS provides name resolution, CDN provides content delivery, and Traffic Manager provides DNS-based traffic routing. Therefore, Azure Key Vault Managed HSM is the appropriate service for centralized management of keys requiring dedicated hardware-backed protection.

Question 160

A security architect wants administrators to request elevated permissions only when necessary, require additional controls during activation, and automatically remove those permissions afterward. Which solution best supports this requirement?

1. Azure Resource Graph
2. Microsoft Entra Privileged Identity Management
3. Azure Load Balancer
4. Azure Storage

Correct Answer: 2

Explanation

Microsoft Entra Privileged Identity Management supports just-in-time privileged access by allowing eligible users to activate administrative roles when needed. Organizations can configure additional controls such as multifactor authentication, approval, justification, and activation duration. When the activation period ends, the elevated role is no longer active, reducing standing privilege. Azure Resource Graph is used for resource queries, Load Balancer distributes network traffic, and Storage provides data services. Therefore, Microsoft Entra PIM best supports controlled, temporary, and monitored access to privileged administrative roles.