{"id":11805,"date":"2026-09-14T12:13:55","date_gmt":"2026-09-14T12:13:55","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=11805"},"modified":"2026-09-14T12:13:55","modified_gmt":"2026-09-14T12:13:55","slug":"microsoft-az-104-practice-test-questions-and-exam-dumps-part-17-q321-340","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-az-104-practice-test-questions-and-exam-dumps-part-17-q321-340\/","title":{"rendered":"Microsoft AZ-104 Practice Test Questions and Exam Dumps Part 17 (Q321\u2013340)"},"content":{"rendered":"

View Full\u00a0Microsoft AZ-104 Exam Dumps<\/a>\u00a0and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 321<\/b><\/h3>\n

Which security solution collects and analyzes log data from multiple sources to identify potential security threats?<\/b><\/p>\n

    \n
  1. SIEM<\/span><\/li>\n
  2. VPN<\/span><\/li>\n
  3. NAC<\/span><\/li>\n
  4. HSM<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    A security information and event management (SIEM) solution collects logs and security events from multiple systems, applications, servers, endpoints, and network devices. It then analyzes and correlates these events to identify suspicious patterns that may indicate an attack. Security teams can use SIEM platforms for real-time monitoring, alerting, investigation, and incident response. SIEM can also support compliance requirements by maintaining searchable security records. Proper configuration is important because excessive or poorly tuned logging can generate large numbers of false positives and make important security events harder to identify.<\/span><\/p>\n

    Question 322<\/b><\/h3>\n

    Which attack repeatedly attempts different password combinations until the correct password is discovered?<\/b><\/p>\n

      \n
    1. Brute-force attack<\/span><\/li>\n
    2. Phishing<\/span><\/li>\n
    3. DDoS<\/span><\/li>\n
    4. Man-in-the-middle<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      A brute-force attack attempts to discover a password by systematically trying many possible combinations until the correct one is found. Attackers can automate this process using specialized tools and large password lists. The effectiveness of brute-force attacks depends on password complexity, authentication controls, and the number of attempts allowed. Organizations can reduce this risk through strong passwords, multifactor authentication, account lockout policies, rate limiting, and monitoring for repeated failed login attempts. Longer and more unique passwords make brute-force attacks significantly more difficult.<\/span><\/p>\n

      Question 323<\/b><\/h3>\n

      Which security process determines what resources an authenticated user is permitted to access?<\/b><\/p>\n

        \n
      1. Authentication<\/span><\/li>\n
      2. Authorization<\/span><\/li>\n
      3. Accounting<\/span><\/li>\n
      4. Identification<\/span><\/li>\n<\/ol>\n

        Correct Answer: 2<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Authorization determines which resources and actions an authenticated user is allowed to access. Authentication first verifies the identity of the user, while authorization determines what that user can do after their identity has been confirmed. For example, an employee may successfully authenticate but only have authorization to access specific files or applications. Authorization can be managed using roles, access control lists, permissions, and policies. Proper authorization supports least privilege by ensuring that users receive only the access required to perform their assigned responsibilities.<\/span><\/p>\n

        Question 324<\/b><\/h3>\n

        Which part of AAA records and tracks what an authenticated user does on a system?<\/b><\/p>\n

          \n
        1. Authentication<\/span><\/li>\n
        2. Authorization<\/span><\/li>\n
        3. Accounting<\/span><\/li>\n
        4. Availability<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Accounting is the third component of the AAA security framework and is responsible for recording user activities. It can track information such as login times, accessed resources, commands executed, data transfers, and administrative actions. These records help organizations investigate security incidents and determine who performed specific actions. Accounting also supports auditing, compliance, and accountability. Authentication verifies identity, while authorization determines permissions. Accounting completes the process by maintaining records of activities performed after a user has been authenticated and granted access.<\/span><\/p>\n

          Question 325<\/b><\/h3>\n

          Which type of social engineering attack uses fraudulent text messages to trick users into revealing information or clicking malicious links?<\/b><\/p>\n

            \n
          1. Vishing<\/span><\/li>\n
          2. Smishing<\/span><\/li>\n
          3. Pharming<\/span><\/li>\n
          4. Tailgating<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Smishing is a social engineering attack that uses SMS or other text messaging services to deceive victims. Attackers may impersonate banks, delivery companies, government agencies, employers, or other trusted organizations. The message may contain a malicious link, request account credentials, or ask the victim to provide financial information. Because mobile users may quickly respond to urgent messages, smishing can be highly effective. Users should independently verify unexpected requests and avoid clicking suspicious links. Multifactor authentication can also reduce the damage caused by stolen credentials.<\/span><\/p>\n

            Question 326<\/b><\/h3>\n

            Which security technology monitors critical files and alerts administrators when unauthorized changes occur?<\/b><\/p>\n

              \n
            1. File integrity monitoring<\/span><\/li>\n
            2. Network load balancing<\/span><\/li>\n
            3. Data masking<\/span><\/li>\n
            4. Port forwarding<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              File integrity monitoring (FIM) tracks important files and system configurations and detects changes that may indicate unauthorized activity. It can identify modifications, deletions, or additions to files and compare them against an approved baseline. FIM is useful for detecting malware, unauthorized administrative activity, and configuration changes. When a monitored file changes unexpectedly, an alert can be generated for investigation. FIM is particularly valuable for servers containing sensitive information or critical applications because unauthorized file changes may indicate that a system has been compromised.<\/span><\/p>\n

              Question 327<\/b><\/h3>\n

              Which type of malware is designed to hide its presence by modifying low-level system components?<\/b><\/p>\n

                \n
              1. Rootkit<\/span><\/li>\n
              2. Worm<\/span><\/li>\n
              3. Adware<\/span><\/li>\n
              4. Spyware<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                A rootkit is malware designed to conceal its presence and maintain unauthorized access to a system. Rootkits can operate at different levels, including the operating system kernel, applications, or firmware. Because they are designed to remain hidden, detecting them can be difficult using traditional security tools. Attackers may use rootkits to hide malicious processes, files, network connections, or other activities. Organizations can reduce the risk through secure boot mechanisms, endpoint security, system integrity monitoring, patch management, and maintaining trusted system images for recovery.<\/span><\/p>\n

                Question 328<\/b><\/h3>\n

                Which network security technique separates a network into smaller isolated sections to limit unauthorized access and lateral movement?<\/b><\/p>\n

                  \n
                1. Network segmentation<\/span><\/li>\n
                2. Port mirroring<\/span><\/li>\n
                3. Load balancing<\/span><\/li>\n
                4. NAT<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Network segmentation divides a larger network into smaller isolated sections with controlled communication between them. Organizations can use segmentation to separate sensitive systems, user devices, servers, guest networks, and critical infrastructure. If an attacker compromises one segment, segmentation can make it more difficult to move laterally into other areas. Firewalls, VLANs, access control lists, and other technologies can enforce segmentation policies. Proper segmentation reduces the attack surface and limits the potential impact of a compromised account, endpoint, or application.<\/span><\/p>\n

                  Question 329<\/b><\/h3>\n

                  Which type of cryptography uses separate public and private keys?<\/b><\/p>\n

                    \n
                  1. Symmetric encryption<\/span><\/li>\n
                  2. Asymmetric encryption<\/span><\/li>\n
                  3. Hashing<\/span><\/li>\n
                  4. Steganography<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Asymmetric encryption uses a pair of mathematically related keys: a public key and a private key. The public key can be distributed to other users, while the private key must remain protected. Asymmetric cryptography is commonly used for secure key exchange, digital signatures, and certificate-based authentication. It is generally slower than symmetric encryption, so secure communication systems often use asymmetric cryptography to establish a secure session and then use faster symmetric encryption for bulk data. Protecting private keys is essential to maintaining security.<\/span><\/p>\n

                    Question 330<\/b><\/h3>\n

                    Which application security control allows only approved software to execute on an endpoint?<\/b><\/p>\n

                      \n
                    1. Application allowlisting<\/span><\/li>\n
                    2. URL filtering<\/span><\/li>\n
                    3. Data retention<\/span><\/li>\n
                    4. Network segmentation<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Application allowlisting restricts software execution to applications that have been explicitly approved by an organization. When an unknown or unauthorized application attempts to run, the security control can prevent its execution. This helps protect endpoints against malware, unauthorized utilities, and potentially dangerous software. Allowlisting can be particularly useful on systems with predictable workloads, such as servers or specialized workstations. Administrators must maintain the approved list carefully so that legitimate applications and updates are not unnecessarily blocked while unauthorized software remains restricted.<\/span><\/p>\n

                      Question 331<\/b><\/h3>\n

                      Which social engineering technique involves creating a fabricated scenario to persuade a victim to provide sensitive information?<\/b><\/p>\n

                        \n
                      1. Pretexting<\/span><\/li>\n
                      2. Shoulder surfing<\/span><\/li>\n
                      3. Dumpster diving<\/span><\/li>\n
                      4. Tailgating<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Pretexting is a social engineering technique in which an attacker creates a believable story or scenario to manipulate a victim into providing information or performing an action. For example, an attacker may pretend to be a technical support employee and request a user’s password or verification code. The success of pretexting depends heavily on trust and psychological manipulation rather than technical exploitation. Security awareness training, identity verification procedures, and policies requiring employees to independently confirm unusual requests can help reduce the effectiveness of pretexting attacks.<\/span><\/p>\n

                        Question 332<\/b><\/h3>\n

                        Which security device is specifically designed to protect web applications from application-layer attacks?<\/b><\/p>\n

                          \n
                        1. WAF<\/span><\/li>\n
                        2. Router<\/span><\/li>\n
                        3. Switch<\/span><\/li>\n
                        4. VPN concentrator<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          A web application firewall (WAF) protects web applications by inspecting HTTP and HTTPS requests and blocking traffic that matches malicious patterns. It can help defend against attacks such as SQL injection, cross-site scripting, malicious requests, and certain application-layer exploits. A WAF can apply rules based on URLs, parameters, headers, request methods, and other web traffic characteristics. Although it provides an important defensive layer, it should be used alongside secure coding practices, vulnerability management, authentication controls, and application security testing.<\/span><\/p>\n

                          Question 333<\/b><\/h3>\n

                          Which access control principle gives users only the permissions required to perform their jobs?<\/b><\/p>\n

                            \n
                          1. Least privilege<\/span><\/li>\n
                          2. Open access<\/span><\/li>\n
                          3. Mandatory access<\/span><\/li>\n
                          4. Federation<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Least privilege means providing users, applications, and systems with only the permissions necessary to perform their authorized tasks. This principle reduces the potential impact of compromised accounts and limits accidental or intentional misuse of sensitive resources. For example, a user who only needs to read a document should not receive permission to modify or delete it. Organizations should regularly review permissions because users may change roles or responsibilities. Combining least privilege with role-based access control and strong authentication can significantly improve overall access security.<\/span><\/p>\n

                            Question 334<\/b><\/h3>\n

                            Which attack inserts malicious SQL commands into an application’s input to manipulate a database?<\/b><\/p>\n

                              \n
                            1. SQL injection<\/span><\/li>\n
                            2. Directory traversal<\/span><\/li>\n
                            3. Cross-site request forgery<\/span><\/li>\n
                            4. Buffer overflow<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              SQL injection occurs when an attacker places malicious SQL statements into application input that is improperly handled by the backend database system. Successful exploitation may allow attackers to retrieve sensitive records, modify information, bypass authentication, or delete database contents. Developers can reduce SQL injection risk by using parameterized queries and prepared statements instead of dynamically constructing SQL commands from user input. Input validation, least-privilege database accounts, secure coding practices, and regular application testing provide additional layers of protection against database manipulation attacks.<\/span><\/p>\n

                              Question 335<\/b><\/h3>\n

                              Which security technique executes potentially dangerous code in an isolated environment to prevent it from affecting production systems?<\/b><\/p>\n

                                \n
                              1. Sandboxing<\/span><\/li>\n
                              2. Tokenization<\/span><\/li>\n
                              3. Hashing<\/span><\/li>\n
                              4. Network address translation<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Sandboxing places potentially dangerous or untrusted code inside an isolated environment where its actions can be restricted and monitored. This prevents the code from directly interacting with sensitive production systems or resources. Security teams can use sandboxes to analyze suspicious files, test applications, examine malware behavior, or safely execute untrusted content. If malicious activity occurs inside the sandbox, the impact can be contained. Sandboxing is especially useful for malware analysis and application testing, although it should not replace endpoint security or other protective controls.<\/span><\/p>\n

                                Question 336<\/b><\/h3>\n

                                Which physical security control is designed to prevent vehicles from entering a restricted area?<\/b><\/p>\n

                                  \n
                                1. Bollard<\/span><\/li>\n
                                2. Mantrap<\/span><\/li>\n
                                3. Motion sensor<\/span><\/li>\n
                                4. Badge reader<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  A bollard is a physical security barrier designed to prevent or restrict vehicles from entering protected areas. Bollards can be installed around building entrances, pedestrian areas, parking facilities, and other locations where vehicle-based threats or unauthorized access are concerns. Some bollards are fixed, while others can be retractable or automatically controlled. They are a form of physical preventive control and can complement other security measures such as gates, barriers, surveillance cameras, and access control systems to protect facilities and personnel.<\/span><\/p>\n

                                  Question 337<\/b><\/h3>\n

                                  Which solution provides centralized management and monitoring of privileged accounts?<\/b><\/p>\n

                                    \n
                                  1. PAM<\/span><\/li>\n
                                  2. IDS<\/span><\/li>\n
                                  3. DLP<\/span><\/li>\n
                                  4. Proxy<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Privileged access management (PAM) provides centralized control over accounts that have elevated permissions. PAM solutions can securely store administrator credentials, enforce approval workflows, rotate passwords, restrict privileged sessions, and record administrative activities. These capabilities reduce the risk of attackers abusing compromised administrator accounts. PAM can also help organizations implement least privilege by providing temporary or just-in-time access rather than permanent administrative rights. Monitoring privileged activity is particularly important because administrative accounts can often access sensitive systems, databases, configurations, and security controls.<\/span><\/p>\n

                                    Question 338<\/b><\/h3>\n

                                    Which backup method stores only data that has changed since the previous backup?<\/b><\/p>\n

                                      \n
                                    1. Full backup<\/span><\/li>\n
                                    2. Differential backup<\/span><\/li>\n
                                    3. Incremental backup<\/span><\/li>\n
                                    4. Synthetic backup<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 3<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      An incremental backup saves only the data that has changed since the previous backup, regardless of whether that previous backup was full or incremental. This approach usually requires less storage space and takes less time than performing full backups repeatedly. However, restoration can be more complicated because the original full backup and all required incremental backups may be needed. Organizations should regularly test their restoration procedures to ensure backups are usable. Incremental backups are commonly used when organizations need frequent backups while controlling storage and backup-window requirements.<\/span><\/p>\n

                                      Question 339<\/b><\/h3>\n

                                      Which security strategy limits communication between different network zones to reduce lateral movement?<\/b><\/p>\n

                                        \n
                                      1. Segmentation<\/span><\/li>\n
                                      2. Compression<\/span><\/li>\n
                                      3. Multiplexing<\/span><\/li>\n
                                      4. Fragmentation<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Network segmentation separates systems and users into different security zones and restricts communication between those zones. This limits an attacker’s ability to move laterally after compromising one system. For example, an organization may place public web servers, employee workstations, database servers, and sensitive administrative systems in separate network segments. Firewalls and access control policies can regulate traffic between these areas. Segmentation reduces the potential blast radius of an incident and provides security teams with greater control over which systems are allowed to communicate.<\/span><\/p>\n

                                        Question 340<\/b><\/h3>\n

                                        During which incident response phase are malicious files, compromised accounts, and attacker persistence mechanisms removed from affected systems?<\/b><\/p>\n

                                          \n
                                        1. Identification<\/span><\/li>\n
                                        2. Containment<\/span><\/li>\n
                                        3. Eradication<\/span><\/li>\n
                                        4. Recovery<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Eradication is the incident response phase in which the root cause and malicious components of an incident are removed from affected systems. Security teams may delete malware, remove unauthorized accounts, eliminate persistence mechanisms, patch exploited vulnerabilities, and correct compromised configurations. Eradication normally follows containment, which focuses on limiting the spread and impact of the incident. After eradication is complete, systems can move toward recovery and normal operation. Proper eradication is important because simply restoring a system without removing the attacker’s access or persistence could allow the compromise to return.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full\u00a0Microsoft AZ-104 Exam Dumps\u00a0and Practice Test Dumps.   Question 321 Which security solution collects and analyzes log data from multiple sources to identify potential security threats? SIEM VPN NAC HSM Correct Answer: 1 Explanation A security information and event management (SIEM) solution collects logs and security events from multiple systems, applications, servers, endpoints, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11805"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=11805"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11805\/revisions"}],"predecessor-version":[{"id":11806,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11805\/revisions\/11806"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=11805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=11805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=11805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}