Microsoft AZ-500 Practice Test 100
Question 990
A non-Azure Linux server is onboarded for management but has incomplete security configuration or plan association. A review identifies this consequence: A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to repair Arc connection and Defender coverage and verify current hybrid machine assessments.
- The controlled remediation is to disable Arc extensions to make missing security alerts disappear.
- The controlled remediation is to treat a ping to the datacenter server as proof of Defender for Servers onboarding.
- The controlled remediation is to install an unrelated browser extension instead of the required machine connector.
Explanation
Correct Answer
A:This addresses the observed security problem while providing a verifiable outcome. Azure Arc extends supported Azure management and security integrations to hybrid and external servers.
Incorrect Answers
B:Disable Arc extensions to make missing security alerts disappear. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
C:Treat a ping to the datacenter server as proof of Defender for Servers onboarding. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
D:Install an unrelated browser extension instead of the required machine connector. This would not reliably restore the intended security boundary. A server being reachable over VPN does not mean it is connected to Defender posture or threat monitoring. The appropriate controlled recovery is: Repair Arc connection and Defender coverage and verify current hybrid machine assessments.
Question 991
A company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory. What is the most defensible Azure security action?
- Assume every discovered domain is owned by the organization without checking attribution.
- Use Microsoft Defender External Attack Surface Management discovery and attribution to investigate exposed assets.
- Treat public asset discovery as permission to exploit external systems.
- Disable public DNS monitoring because assets are not in the subscription inventory.
Explanation
Correct Answer
B:Confirm the change against these records: EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence. External attack surface management focuses on externally observable assets and exposures linked to an organization.
Incorrect Answers
A:Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. Assume every discovered domain is owned by the organization without checking attribution.
C:External attack surface management focuses on externally observable assets and exposures linked to an organization. The proposed change targets the wrong mechanism or lacks essential validation.
D:Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The intended action is: Use Microsoft Defender External Attack Surface Management discovery and attribution to investigate exposed assets.
Question 992
A company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory. Which diagnostic record would most strongly confirm the result?
- An inventory item list from a different subscription or connected cloud account.
- EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
- A historical Secure Score screenshot without the relevant resource-level finding.
- An incident title without its actual source telemetry and detection results.
Explanation
Correct Answer
B:These records test the actual Defender EASM internet asset discovery behavior rather than an unrelated dashboard state. External attack surface management focuses on externally observable assets and exposures linked to an organization.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
C:On its own, that evidence does not prove the specified security control works. External attack surface management focuses on externally observable assets and exposures linked to an organization.
D:On its own, that evidence does not prove the specified security control works. In the given case, a company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory.
Question 993
A company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory. Which platform concept should guide the engineer’s assessment?
- A high Secure Score certifies that every relevant cloud resource is secure.
- Turning off an alert source is equivalent to remediating the underlying threat.
- External attack surface management focuses on externally observable assets and exposures linked to an organization.
- A published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
C:Confirmation depends on EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence. This principle supports the security response: Use Microsoft Defender External Attack Surface Management discovery and attribution to investigate exposed assets.
Incorrect Answers
A:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Defender EASM internet asset discovery. The relevant security behavior is: External attack surface management focuses on externally observable assets and exposures linked to an organization. Check evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
B:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Defender EASM internet asset discovery. The relevant security behavior is: External attack surface management focuses on externally observable assets and exposures linked to an organization. Check evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Defender EASM internet asset discovery. The relevant security behavior is: External attack surface management focuses on externally observable assets and exposures linked to an organization. Check evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
Question 994
A company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory. Suppose the operator instead follows this unsafe shortcut: Assume every discovered domain is owned by the organization without checking attribution. Which root-cause observation follows from that incorrect change?
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
- Preserving a security alert audit trail is what caused the risky configuration.
- Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure.
Explanation
Correct Answer
D:External attack surface management focuses on externally observable assets and exposures linked to an organization. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Defender EASM internet asset discovery weakness after the shortcut. The material failure is: Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure.
B:This does not explain the real Defender EASM internet asset discovery weakness after the shortcut. Inspect evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
C:This does not explain the real Defender EASM internet asset discovery weakness after the shortcut. In the given case, a company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory.
Question 995
A company has forgotten DNS names and internet services that are visible externally but absent from its cloud inventory. A review identifies this consequence: Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. Which recovery action addresses the underlying technical fault?
- Validate asset ownership and remediate or monitor justified public exposures.
- Treat public asset discovery as permission to exploit external systems.
- Disable public DNS monitoring because assets are not in the subscription inventory.
- Assume every discovered domain is owned by the organization without checking attribution.
Explanation
Correct Answer
A:Test using these records: EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Treat public asset discovery as permission to exploit external systems. This would not reliably restore the intended security boundary. Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The appropriate controlled recovery is: Validate asset ownership and remediate or monitor justified public exposures.
C:Disable public DNS monitoring because assets are not in the subscription inventory. This would not reliably restore the intended security boundary. Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The appropriate controlled recovery is: Validate asset ownership and remediate or monitor justified public exposures.
D:Assume every discovered domain is owned by the organization without checking attribution. This would not reliably restore the intended security boundary. Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The appropriate controlled recovery is: Validate asset ownership and remediate or monitor justified public exposures.
Question 996
A merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should use Microsoft Defender External Attack Surface Management discovery and attribution to investigate exposed assets.
- For this Azure workload, the team should treat public asset discovery as permission to exploit external systems.
- For this Azure workload, the team should disable public DNS monitoring because assets are not in the subscription inventory.
- For this Azure workload, the team should assume every discovered domain is owned by the organization without checking attribution.
Explanation
Correct Answer
A:Confirm the change against these records: EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
Incorrect Answers
B:External attack surface management focuses on externally observable assets and exposures linked to an organization. Relevant evidence is eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
C:Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. Disable public DNS monitoring because assets are not in the subscription inventory.
D:Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. In the given case, a merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set.
Question 997
A merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
Explanation
Correct Answer
C:These records test the actual Defender EASM internet asset discovery behavior rather than an unrelated dashboard state. The intended action is: Use Microsoft Defender External Attack Surface Management discovery and attribution to investigate exposed assets.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set.
B:The more relevant observations are: EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
D:External attack surface management focuses on externally observable assets and exposures linked to an organization.
Question 998
A merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that external attack surface management focuses on externally observable assets and exposures linked to an organization.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
Explanation
Correct Answer
C:Confirmation depends on EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
Incorrect Answers
A:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Defender EASM internet asset discovery. The relevant security behavior is: External attack surface management focuses on externally observable assets and exposures linked to an organization. Check evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Defender EASM internet asset discovery. The relevant security behavior is: External attack surface management focuses on externally observable assets and exposures linked to an organization. Check evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
D:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Defender EASM internet asset discovery. The relevant security behavior is: External attack surface management focuses on externally observable assets and exposures linked to an organization. Check evidence such as eASM discovered hosts and domains, ownership validation, external exposure and remediation evidence.
Question 999
A merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set. Suppose the operator instead follows this unsafe shortcut: Assume every discovered domain is owned by the organization without checking attribution. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure.
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
Explanation
Correct Answer
A:External attack surface management focuses on externally observable assets and exposures linked to an organization. The suitable control is: Use Microsoft Defender External Attack Surface Management discovery and attribution to investigate exposed assets.
Incorrect Answers
B:This does not explain the real Defender EASM internet asset discovery weakness after the shortcut. In the given case, a merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set.
C:This does not explain the real Defender EASM internet asset discovery weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
D:This does not explain the real Defender EASM internet asset discovery weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
Question 1000
A merger introduces public domains and certificate-linked hosts that defenders cannot connect to the organization's known asset set. A review identifies this consequence: Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to disable public DNS monitoring because assets are not in the subscription inventory.
- The controlled remediation is to validate asset ownership and remediate or monitor justified public exposures.
- The controlled remediation is to assume every discovered domain is owned by the organization without checking attribution.
- The controlled remediation is to treat public asset discovery as permission to exploit external systems.
Explanation
Correct Answer
B:Test using these records: EASM discovered hosts and domains, ownership validation, external exposure and remediation evidence. External attack surface management focuses on externally observable assets and exposures linked to an organization.
Incorrect Answers
A:Disable public DNS monitoring because assets are not in the subscription inventory. This would not reliably restore the intended security boundary. Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The appropriate controlled recovery is: Validate asset ownership and remediate or monitor justified public exposures.
C:Assume every discovered domain is owned by the organization without checking attribution. This would not reliably restore the intended security boundary. Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The appropriate controlled recovery is: Validate asset ownership and remediate or monitor justified public exposures.
D:Treat public asset discovery as permission to exploit external systems. This would not reliably restore the intended security boundary. Relying only on internal Azure subscription inventory can miss externally visible unmanaged infrastructure. The appropriate controlled recovery is: Validate asset ownership and remediate or monitor justified public exposures.
