cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 53

Question 520

An operations team needs SSH access to an internal Linux VM but must avoid direct internet inbound connectivity. A review identifies this consequence: Directly opening management ports to the Internet increases exposure beyond Bastion's private path. What is the BEST controlled recovery once this failure is recognized?

  1. The controlled remediation is to assume Azure Bastion requires a public IP assigned to each target VM.
  2. The controlled remediation is to close unintended public management access and verify authorized Bastion sessions.
  3. The controlled remediation is to open TCP 3389 to the entire internet and call it equivalent to Azure Bastion.
  4. The controlled remediation is to use a storage account SAS token to authorize Windows Remote Desktop.

Explanation

Correct Answer

B:

Azure Bastion provides managed RDP or SSH connectivity to VMs without requiring a VM public IP. Test using these records: Bastion subnet configuration, target VM NIC, connection audit, inbound exposure and authenticated session.

Incorrect Answers

A:

Assume Azure Bastion requires a public IP assigned to each target VM. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.

C:

Open TCP 3389 to the entire internet and call it equivalent to Azure Bastion. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.

D:

Use a storage account SAS token to authorize Windows Remote Desktop. This would not reliably restore the intended security boundary. Directly opening management ports to the Internet increases exposure beyond Bastion's private path. The appropriate controlled recovery is: Close unintended public management access and verify authorized Bastion sessions.

Question 521

A security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions. What is the BEST supported implementation or corrective action?

  1. Enable just-in-time VM access with constrained source, protocol and permitted request duration.
  2. Create a permanent global Allow for TCP 22 instead of a timed JIT request.
  3. Assume Azure Bastion and JIT are always identical products.
  4. Disable management authentication because the access window is short.

Explanation

Correct Answer

A:

Confirm the change against these records: JIT policy, requested access windows, relevant NSG or firewall changes and access logs. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.

Incorrect Answers

B:

Create a permanent global Allow for TCP 22 instead of a timed JIT request. This is not a valid substitute for the specified security control. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The correct targeted action is: Enable just-in-time VM access with constrained source, protocol and permitted request duration.

C:

Assume Azure Bastion and JIT are always identical products. The proposed change targets the wrong mechanism or lacks essential validation. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Relevant evidence is jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

D:

Disable management authentication because the access window is short. This leaves the security requirement unresolved. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The intended action is: Enable just-in-time VM access with constrained source, protocol and permitted request duration.

Question 522

A security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions. Which evidence BEST verifies the intended technical behavior?

  1. A powered-on VM status without the actual guest or data-plane security state.
  2. JIT policy, requested access windows, relevant NSG or firewall changes and access logs.
  3. The identity name without a corresponding workload data authorization test.
  4. A database online indicator without a log of the protected operation.

Explanation

Correct Answer

B:

These records test the actual just-in-time VM access windows behavior rather than an unrelated dashboard state. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: JIT policy, requested access windows, relevant NSG or firewall changes and access logs.

C:

On its own, that evidence does not prove the specified security control works. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.

D:

On its own, that evidence does not prove the specified security control works. In the given case, a security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions.

Question 523

A security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions. Which principle BEST explains why the recommended solution is appropriate?

  1. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.
  2. Encrypting network transport guarantees all storage at-rest and column-level security requirements.
  3. Setting a registry image tag guarantees security monitoring of the running workload.
  4. A valid Azure management role always gives full access to every blob object and SQL row.

Explanation

Correct Answer

A:

Confirmation depends on JIT policy, requested access windows, relevant NSG or firewall changes and access logs. This principle supports the security response: Enable just-in-time VM access with constrained source, protocol and permitted request duration.

Incorrect Answers

B:

Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for just-in-time VM access windows. The relevant security behavior is: JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Check evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

C:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for just-in-time VM access windows. The relevant security behavior is: JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Check evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

D:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for just-in-time VM access windows. The relevant security behavior is: JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Check evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

Question 524

A security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions. Suppose the operator instead follows this unsafe shortcut: Create a permanent global Allow for TCP 22 instead of a timed JIT request. What is the MOST significant failure introduced by that shortcut?

  1. The observed issue is fully explained by the service display name.
  2. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement.
  3. Collecting VM diagnostic data caused the original unauthorized storage read.
  4. Keeping historic blob versions is the cause of the missing RBAC assignment.

Explanation

Correct Answer

B:

The suitable control is: Enable just-in-time VM access with constrained source, protocol and permitted request duration. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.

Incorrect Answers

A:

This does not explain the real just-in-time VM access windows weakness after the shortcut. Inspect evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

C:

This does not explain the real just-in-time VM access windows weakness after the shortcut. The material failure is: Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement.

D:

This does not explain the real just-in-time VM access windows weakness after the shortcut. In the given case, a security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions.

Question 525

A security team wants to reduce permanent SSH exposure on selected Azure VMs while allowing scheduled administrator sessions. A review identifies this consequence: Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. What is the BEST controlled recovery once this failure is recognized?

  1. Assume Azure Bastion and JIT are always identical products.
  2. Disable management authentication because the access window is short.
  3. Require approved short access requests and verify ports close again after the window.
  4. Create a permanent global Allow for TCP 22 instead of a timed JIT request.

Explanation

Correct Answer

C:

Test using these records: JIT policy, requested access windows, relevant NSG or firewall changes and access logs. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Assume Azure Bastion and JIT are always identical products. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.

B:

Disable management authentication because the access window is short. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.

D:

Create a permanent global Allow for TCP 22 instead of a timed JIT request. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.

Question 526

Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access. Which configuration decision MOST directly resolves the issue?

  1. For this Azure workload, the team should assume Azure Bastion and JIT are always identical products.
  2. For this Azure workload, the team should disable management authentication because the access window is short.
  3. For this Azure workload, the team should enable just-in-time VM access with constrained source, protocol and permitted request duration.
  4. For this Azure workload, the team should create a permanent global Allow for TCP 22 instead of a timed JIT request.

Explanation

Correct Answer

C:

Confirm the change against these records: JIT policy, requested access windows, relevant NSG or firewall changes and access logs.

Incorrect Answers

A:

Assume Azure Bastion and JIT are always identical products. The proposed change targets the wrong mechanism or lacks essential validation. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Relevant evidence is jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

B:

Disable management authentication because the access window is short. This leaves the security requirement unresolved. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The intended action is: Enable just-in-time VM access with constrained source, protocol and permitted request duration.

D:

Create a permanent global Allow for TCP 22 instead of a timed JIT request. This is not a valid substitute for the specified security control. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The correct targeted action is: Enable just-in-time VM access with constrained source, protocol and permitted request duration.

Question 527

Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access. What evidence most directly confirms the intended security behavior?

  1. In this security review, examine an outdated deployment template without current effective settings.
  2. In this security review, examine jIT policy, requested access windows, relevant NSG or firewall changes and access logs.
  3. In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
  4. In this security review, examine the identity name without a corresponding workload data authorization test.

Explanation

Correct Answer

B:

These records test the actual just-in-time VM access windows behavior rather than an unrelated dashboard state. The intended action is: Enable just-in-time VM access with constrained source, protocol and permitted request duration.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access.

C:

The more relevant observations are: JIT policy, requested access windows, relevant NSG or firewall changes and access logs.

D:

On its own, that evidence does not prove the specified security control works. The identity name without a corresponding workload data authorization test.

Question 528

Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access. Which security principle best explains the intended decision?

  1. The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
  2. The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
  3. The applicable security principle is that jIT access reduces the time sensitive VM management ports remain reachable from allowed sources.
  4. The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.

Explanation

Correct Answer

C:

Confirmation depends on JIT policy, requested access windows, relevant NSG or firewall changes and access logs. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.

Incorrect Answers

A:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for just-in-time VM access windows. The relevant security behavior is: JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Check evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

B:

Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for just-in-time VM access windows. The relevant security behavior is: JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Check evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

D:

A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for just-in-time VM access windows. The relevant security behavior is: JIT access reduces the time sensitive VM management ports remain reachable from allowed sources. Check evidence such as jIT policy, requested access windows, relevant NSG or firewall changes and access logs.

Question 529

Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access. Suppose the operator instead follows this unsafe shortcut: Create a permanent global Allow for TCP 22 instead of a timed JIT request. Which resulting risk or fault should the reviewer identify?

  1. The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
  2. The resulting security weakness is that the security flaw is that the team retained a tested database backup.
  3. The resulting security weakness is that leaving RDP or SSH open indefinitely undermines intended temporary access enforcement.
  4. The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.

Explanation

Correct Answer

C:

The suitable control is: Enable just-in-time VM access with constrained source, protocol and permitted request duration. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real just-in-time VM access windows weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.

B:

This does not explain the real just-in-time VM access windows weakness after the shortcut. The security flaw is that the team retained a tested database backup.

D:

This does not explain the real just-in-time VM access windows weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.

Question 530

Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access. A review identifies this consequence: Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. Which remediation most directly restores the intended behavior?

  1. The controlled remediation is to require approved short access requests and verify ports close again after the window.
  2. The controlled remediation is to disable management authentication because the access window is short.
  3. The controlled remediation is to create a permanent global Allow for TCP 22 instead of a timed JIT request.
  4. The controlled remediation is to assume Azure Bastion and JIT are always identical products.

Explanation

Correct Answer

A:

Test using these records: JIT policy, requested access windows, relevant NSG or firewall changes and access logs. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.

Incorrect Answers

B:

Disable management authentication because the access window is short. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.

C:

Create a permanent global Allow for TCP 22 instead of a timed JIT request. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.

D:

Assume Azure Bastion and JIT are always identical products. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.

Microsoft Azure Security Technologies (AZ-500) Practice Tests