[2025-November-New]Braindump2go AZ-500 Exam Dumps PDF Free[Q446-Q480]
2025/November Latest Braindump2go AZ-500 Exam Dumps with PDF and VCE Free Updated Today! Following are some new Braindump2go AZ-500 Real Exam Questions!
QUESTION 446
You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM).
A user named User1 is eligible for the Billing administrator role.
You need to ensure that the role can only be used for a maximum of two hours.
What should you do?
A. Create a new access review.
B. Edit the role assignment settings.
C. Update the end date of the user assignment.
D. Edit the role activation settings.
Answer: D
Explanation:
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-change-default-settings
QUESTION 447
You have an Azure subscription that contains a user named User1 and a storage account that hosts a blob container named blob1.
You need to grant User1 access to blob1. The solution must ensure that the access expires after six days.
What should you use?
A. a shared access signature (SAS)
B. role-based access control (RBAC)
C. a shared access policy
D. a managed identity
Answer: A
QUESTION 448
You have an Azure subscription linked to an Azure AD tenant named contoso.com. Contoso.com contains a user named User1 and an Azure web app named App1.
You plan to enable User1 to perform the following tasks:
– Configure contoso.com to use Microsoft Entra Verified ID.
– Register App1 in contoso.com.
You need to identify which roles to assign to User1. The solution must use the principle of least privilege.
Which two roles should you identify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Authentication Policy Administrator
B. Authentication Administrator
C. Cloud App Security Administrator
D. Application Administrator
E. User Administrator
Answer: AD
Explanation:
https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/verifiable-credentials-configure-tenant
Ensure that you have the global administrator or the authentication policy administrator permission for the directory you want to configure. If you’re not the global administrator, you need the application administrator permission to complete the app registration including granting admin consent.
QUESTION 449
You have an Azure AD tenant.
You plan to implement an authentication solution to meet the following requirements:
– Require number matching.
– Display the geographical location when signing in.
Which authentication method should you include in the solution?
A. Microsoft Authenticator
B. FIDO2 security key
C. SMS
D. Temporary Access Pass
Answer: A
Explanation:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context
QUESTION 450
Drag and Drop Question
You have an Azure subscription that contains a resource group named RG1 and an Azure policy named Policy1.
You need to assign Policy1 to RG1.
How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azpolicyassignment?view=azps-10.0.0#example-1-policy-assignment-at-subscription-level
QUESTION 452
Your on-premises network contains a Hyper-V virtual machine named VM1.
You need to use Azure Arc to onboard VM1 to Microsoft Defender for Cloud.
What should you install first?
A. the guest configuration agent
B. the Azure Monitor agent
C. the Log Analytics agent
D. the Azure Connected Machine agent
Answer: D
Explanation:
The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers.
QUESTION 453
You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud.
You have the management group hierarchy shown in the following exhibit.
You create the definitions shown in the following table.
You need to use Defender for Cloud to add a security policy.
Which definitions can you use as a security policy?
A. Policy1 only
B. Policy1 and Initiative1 only
C. Initiative1 and Initiative2 only
D. Initiative1, Initiative2, and Initiative3 only
E. Policy1, Initiative1, Initiative2, and Initiative3
Answer: B
Explanation:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept
QUESTION 454
You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EASM1 has discovery enabled and contains several inventory assets.
You need to identify which inventory assets are vulnerable to the most critical web app security risks.
Which Defender EASM dashboard should you use?
A. Security Posture
B. OWASP Top 10
C. Attack Surface Summary
D. GDPR Compliance
Answer: B
Explanation:
https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-dashboards#owasp-top-10-dashboard
QUESTION 455
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to review regulatory compliance with the Azure CIS 1.4.0 standard. The solution must minimize administrative effort.
What should you do first?
A. Assign an Azure policy.
B. Disable one of the Out of the box standards.
C. Manually add the Azure CIS 1.4.0 standard.
D. Add a custom initiative.
Answer: C
Explanation:
Azure CIS 1.4.0 standard is not added by default, you have to add it manually.
Note: You must have Defender Cloud Security Posture Management (CSPM). Foundational CSPM propably is not enough.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-security-policy
Add Azure CIS 1.4.0 standard initiative
QUESTION 456
You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1.
You need to allow access to Vault1 only from VM1.
What should you do in the Networking settings of Vault1?
A. From the Firewalls and virtual networks tab, add the IP address of VM1.
B. From the Private endpoint connections tab, create a private endpoint for VM1.
C. From the Firewalls and virtual networks tab, add VNet1.
D. From the Firewalls and virtual networks tab, set Allow trusted Microsoft services to bypass this firewall to Yes for Vault1.
Answer: A
QUESTION 457
You have an Azure subscription.
You create a new virtual network named VNet1.
You plan to deploy an Azure web app named App1 that will use VNet1 and will be reachable by using private IP addresses. The solution must support inbound and outbound network traffic.
What should you do?
A. Create an Azure App Service Hybrid Connection.
B. Create an Azure application gateway.
C. Create an App Service Environment.
D. Configure regional virtual network integration.
Answer: C
Explanation:
https://learn.microsoft.com/en-us/azure/app-service/environment/overview#feature-differences
“There are no networking dependencies on the customer’s virtual network. You can secure all inbound and outbound traffic and route outbound traffic as you want.”
QUESTION 458
You have an Azure subscription and the computers shown in the following table.
You need to perform a vulnerability scan of the computers by using Microsoft Defender for Cloud.
Which computers can you scan?
A. VM1 only
B. VM1 and VM2 only
C. Server1 and VMSS1_0 only
D. VM1, VM2, and Server1 only
E. VM1, VM2, Server 1, and VMSS1_0
Answer: D
Explanation:
https://learn.microsoft.com/en-us/answers/questions/820846/microsoft-defender-cloud-for-virtual-machine-scalereference?WT.mc_id=AZ-MVP-5000120
QUESTION 459
You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains the Azure Policy definitions shown in the following table.
Which definitions can be assigned as a security policy in Defender for Cloud?
A. Policy1 and Policy2 only
B. Initiative1 and Initiative2 only
C. Policy1 and Initiative1 only
D. Policy2 and Initiative2 only
E. Policy1, Policy2, Initiative1, and Initiative2
Answer: B
QUESTION 460
Hotspot Question
On Monday, you configure an email notification in Microsoft Defender for Cloud to notify [email protected] about alerts that have a severity level of Low, Medium, or High.
On Tuesday, Microsoft Defender for Cloud generates the security alerts shown in the following table.
How many email notifications will [email protected] receive on Tuesday? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
To avoid alert fatigue, Defender for Cloud limits the volume of outgoing mails. For each subscription, Defender for Cloud sends:
approximately four emails per day for high-severity alerts
approximately two emails per day for medium-severity alerts
approximately one email per day for low-severity alerts
https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications
QUESTION 461
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have accounts for the following cloud services:
– Alibaba Cloud
– Amazon Web Services (AWS)
– Google Cloud Platform (GCP)
What can you add to Defender for Cloud?
A. AWS only
B. Alibaba Cloud and AWS only
C. Alibaba Cloud and GCP only
D. AWS and GCP only
E. Alibaba Cloud, AWS, and GCP
Answer: D
Explanation:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/multicloud
QUESTION 462
You have an Azure subscription.
You plan to map an online infrastructure and perform vulnerability scanning for the following:
– ASNs
– Hostnames
– IP addresses
– SSL certificates
What should you use?
A. Microsoft Defender for Cloud
B. Microsoft Defender External Attack Surface Management (Defender EASM)
C. Microsoft Defender for Identity
D. Microsoft Defender for Endpoint
Answer: B
Explanation:
Defender EASM includes the discovery of the following kinds of assets:
Domains
Hostnames
Web Pages
IP Blocks
IP Addresses
ASNs
SSL Certificates
WHOIS Contacts
https://learn.microsoft.com/en-us/azure/external-attack-surface-management/#discovery-and-inventory
QUESTION 463
Hotspot Question
You have an Azure subscription that uses Microsoft Defender for Cloud.
You plan to use the Secure Score Over Time workbook.
You need to configure the Continuous export settings for the Defender for Cloud data.
Which two settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export?tabs=azure-portal
QUESTION 464
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Cosmos DB explorer
B. SQL query editor in Azure
C. AzCopy
D. File Explorer in Windows
Answer: C
QUESTION 465
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have an Amazon Web Services (AWS) account.
You need to ensure that when you deploy a new AWS Elastic Compute Cloud (EC2) instance, the Microsoft Defender for Servers agent installs automatically.
What should you configure first?
A. the classic cloud connector
B. the Azure Monitor agent
C. the Log Analytics agent
D. the native cloud connector
Answer: D
Explanation:
To protect your AWS-based resources, you can connect an AWS account with either Native of Classic Cloud Connector.
Native cloud connector is the recommended way and provides an agentless connection to your AWS account that can extend with Defender for Cloud’s Defender plans to secure the AWS resources.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings
QUESTION 466
Hotspot Question
You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EAMS1 contains the inventory assets shown in the following table.
Which assets are scanned daily, and which assets will display in the default dashboard charts? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
For instance, “Approved Inventory” assets are always represented in dashboard charts and are scanned daily to ensure data recency. All other kinds of assets are not included in dashboard charts by default; however, users can adjust their inventory filters to view assets in different states as needed.
https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-inventory-assets
QUESTION 467
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have an Amazon Web Services (AWS) account named AWS1 that is connected to Defender for Cloud.
You need to ensure that AWS1 uses AWS Foundational Security Best Practices. The solution must minimize administrative effort.
What should you do in Defender for Cloud?
A. Assign a built-in compliance standard.
B. Create a new custom standard.
C. Assign a built-in assessment.
D. Create a new custom assessment.
Answer: A
Explanation:
The regulatory compliance dashboard shows your compliance with built-in standards specific to AWS, including AWS CIS, AWS PCI DSS, and AWS Foundational Security Best Practices.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings
QUESTION 468
Hotspot Question
You plan to deploy a custom policy initiative for Microsoft Defender for Cloud.
You need to identify all the resource groups that have a Delete lock.
How should you complete the policy definition? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/custom-security-policies?pivots=azure-portal
QUESTION 469
You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1.
You review the Attack Surface Summary dashboard.
You need to identify the following insights:
– Deprecated technologies that are no longer supported
– Infrastructure that will soon expire
Which section of the dashboard should you review?
A. Securing the Cloud
B. Sensitive Services
C. Attack Surface Priorities
D. Attack surface composition
Answer: C
Explanation:
https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-dashboards
QUESTION 470
You have an Azure subscription that contains the virtual machines shown in the following table.
Which computers will support file integrity monitoring?
A. Computer2 only
B. Computer1 and Computer2 only
C. Computer2 and Computer3 only
D. Computer1, Computer2, and Computer3
Answer: D
Explanation:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview
QUESTION 471
SIMULATION
The developers at your company plan to create a web app named App28681041 and to publish the app to https://www.contoso.com.
You need to perform the following tasks:
– Ensure that App28681041 is registered to Azure AD.
– Generate a password for App28681041.
To complete this task, sign in to the Azure portal.
Answer:
QUESTION 472
You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.
You create and assign the Azure policy shown in the following exhibit.
What is the flow log status of NSG1 and NSG2 after the Azure policy is assigned?
A. Flow logs will be enabled for NSG1 only.
B. Flow logs will be enabled for NSG2 only.
C. Flow logs will be enabled for NSG1 and NSG2.
D. Flow logs will be disabled for NSG1 and NSG2.
Answer: D
QUESTION 473
Hotspot Question
You have an Azure subscription that contains the virtual machines shown in the following table.
Subnet1 and Subnet2 have a network security group (NSG). The NSG has an outbound rule that has the following configurations:
– Port: Any
– Source: Any
– Priority: 100
– Action: Deny
– Protocol: Any
– Destination: Storage
The subscription contains a storage account named storage1.
You create a private endpoint named Private1 that has the following settings:
– Resource type: Microsoft.Storage/storageAccounts
– Resource: storage1
– Target sub-resource: blob
– Virtual network: VNet1
– Subnet: Subnet1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
The NSG rule has a service tag for Destination, a service tag is a list of public ip addresses. The connection to the private endpoint will no be blocked by this rule.
VM1 and VM2 can connect to the private endpoint because intra-vnet traffic is allowed by default.
QUESTION 475
You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1 that contains one subnet and uses Azure DNS.
You need to ensure that VM1 connects to storage1 by using a private IP address. The solution must minimize administrative effort.
What should you do?
A. For storage1, disable public network access.
B. On VNet1, create a new subnet.
C. For storage1, create a new private endpoint.
D. Create an Azure Private DNS zone.
Answer: C
QUESTION 476
You have an Azure subscription that contains a web app named App1. App1 provides users with product images and videos. Users access App1 by using a URL of HTTPS://app1.contoso.com.
You deploy two server pools named Pool1 and Pool2. Pool1 hosts product images. Pool2 hosts product videos.
You need to optimize the performance of App1. The solution must meet the following requirements:
– Minimize the performance impact of TLS connections on Pool1 and Pool2.
– Route user requests to the server pools based on the requested URL path.
What should you include in the solution?
A. Azure Bastion
B. Azure Front Door
C. Azure Traffic Manager
D. Azure Application Gateway
Answer: B
Explanation:
By using Azure Front Door, you can configure routing rules to direct requests for product images to Pool1 and requests for product videos to Pool2. This ensures that user requests are directed to the appropriate server pool based on the requested URL path.
QUESTION 478
You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFW1.
You need to identify whether you can use the following features with AzFW1:
– TLS inspection
– Threat intelligence
– The network intrusion detection and prevention systems (IDPS)
What can you use?
A. TLS inspection only
B. threat intelligence only
C. TLS inspection and the IDPS only
D. threat intelligence and the IDPS only
E. TLS inspection, threat intelligence, and the IDPS
Answer: B
Explanation:
https://learn.microsoft.com/en-us/azure/firewall/features
QUESTION 479
SIMULATION
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username: [email protected]
Azure Password: Gp0Ae4@!Dg
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 28681041
You need to configure Azure to allow RDP connections from the Internet to a virtual machine named VM1. The solution must minimize the attack surface of VM1.
To complete this task, sign in to the Azure portal.
Answer:
QUESTION 480
SIMULATION
You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account.
To complete this task, sign in to the Azure portal.
Answer:
Resources From:
1.2025 Latest Braindump2go AZ-500 Exam Dumps (PDF & VCE) Free Share:
https://www.braindump2go.com/az-500.html
2.2025 Latest Braindump2go AZ-500 PDF and AZ-500 VCE Dumps Free Share:
https://drive.google.com/drive/folders/1sQAsVdJ79oBKFiswxjUzGT6Gt6a6PYWl?usp=sharing
3.2025 Free Braindump2go AZ-500 Exam Questions Download:
https://www.braindump2go.com/free-online-pdf/AZ-500-VCE-Dumps(446-480).pdf
Free Resources from Braindump2go,We Devoted to Helping You 100% Pass All Exams!