cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 59

Question 580

Security analysts need alerts about suspicious container activity and configuration findings for their AKS environment. A review identifies this consequence: A healthy AKS dashboard does not automatically mean runtime security monitoring is active. Which recovery action restores the intended control and validates its effect?

  1. The controlled remediation is to enable and validate the required protection components and confirm alerts and recommendations.
  2. The controlled remediation is to treat a container image tag as proof of runtime threat detection.
  3. The controlled remediation is to assume Defender for Servers always supplies every AKS runtime protection feature.
  4. The controlled remediation is to disable all Kubernetes audit events to prevent noisy security alerts.

Explanation

Correct Answer

A:

Test using these records: Defender plan status, AKS onboarding and sensor health, findings and supported coverage. Container threat and posture protection requires the relevant Defender plan and operational data collection.

Incorrect Answers

B:

Treat a container image tag as proof of runtime threat detection. This would not reliably restore the intended security boundary. A healthy AKS dashboard does not automatically mean runtime security monitoring is active. The appropriate controlled recovery is: Enable and validate the required protection components and confirm alerts and recommendations.

C:

Assume Defender for Servers always supplies every AKS runtime protection feature. This would not reliably restore the intended security boundary. A healthy AKS dashboard does not automatically mean runtime security monitoring is active. The appropriate controlled recovery is: Enable and validate the required protection components and confirm alerts and recommendations.

D:

Disable all Kubernetes audit events to prevent noisy security alerts. This would not reliably restore the intended security boundary. A healthy AKS dashboard does not automatically mean runtime security monitoring is active. The appropriate controlled recovery is: Enable and validate the required protection components and confirm alerts and recommendations.

Question 581

An Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace. Which operator action best meets this technical requirement?

  1. Assume an ACR image scan automatically records every container execution event.
  2. Disable logs to avoid storing data from short-running jobs.
  3. Use a VM guest event log policy without any container diagnostic integration.
  4. Configure supported diagnostic settings and logging destinations for the chosen container service.

Explanation

Correct Answer

D:

Confirm the change against these records: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events. This directly addresses container Apps and Container Instances monitoring.

Incorrect Answers

A:

Assume an ACR image scan automatically records every container execution event. This is not a valid substitute for the specified security control. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The correct targeted action is: Configure supported diagnostic settings and logging destinations for the chosen container service.

B:

Disable logs to avoid storing data from short-running jobs. The proposed change targets the wrong mechanism or lacks essential validation. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Relevant evidence is container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

C:

Use a VM guest event log policy without any container diagnostic integration. This leaves the security requirement unresolved. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The intended action is: Configure supported diagnostic settings and logging destinations for the chosen container service.

Question 582

An Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace. Which collection of observations most directly tests the suspected cause?

  1. Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.
  2. An outdated deployment template without current effective settings.
  3. A storage account resource name without its encryption or retention configuration.
  4. The identity name without a corresponding workload data authorization test.

Explanation

Correct Answer

A:

These records test the actual container Apps and Container Instances monitoring behavior rather than an unrelated dashboard state. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

Incorrect Answers

B:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

C:

On its own, that evidence does not prove the specified security control works. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

D:

On its own, that evidence does not prove the specified security control works. In the given case, an Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace.

Question 583

An Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace. Which statement most accurately explains this scenario?

  1. A protected storage account is immune to every accidental deletion and overwrite.
  2. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.
  3. Encrypting network transport guarantees all storage at-rest and column-level security requirements.
  4. A running compute resource automatically enforces least-privilege Kubernetes permissions.

Explanation

Correct Answer

B:

Confirmation depends on Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events. This principle supports the security response: Configure supported diagnostic settings and logging destinations for the chosen container service.

Incorrect Answers

A:

A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for container Apps and Container Instances monitoring. The relevant security behavior is: Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Check evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

C:

Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for container Apps and Container Instances monitoring. The relevant security behavior is: Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Check evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

D:

A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for container Apps and Container Instances monitoring. The relevant security behavior is: Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Check evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

Question 584

An Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace. Suppose the operator instead follows this unsafe shortcut: Assume an ACR image scan automatically records every container execution event. What is the principal technical consequence of the mistaken choice?

  1. Keeping historic blob versions is the cause of the missing RBAC assignment.
  2. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate.
  3. The security flaw is that the team retained a tested database backup.
  4. Inspecting encryption settings itself disables a healthy disk.

Explanation

Correct Answer

B:

The suitable control is: Configure supported diagnostic settings and logging destinations for the chosen container service. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real container Apps and Container Instances monitoring weakness after the shortcut. The material failure is: Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate.

C:

This does not explain the real container Apps and Container Instances monitoring weakness after the shortcut. Inspect evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

D:

This does not explain the real container Apps and Container Instances monitoring weakness after the shortcut. In the given case, an Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace.

Question 585

An Azure Container App runs a sensitive API but its diagnostics are not sent to the expected workspace. A review identifies this consequence: Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. Which recovery action restores the intended control and validates its effect?

  1. Disable logs to avoid storing data from short-running jobs.
  2. Use a VM guest event log policy without any container diagnostic integration.
  3. Correct telemetry collection and verify new log records reach the authorized destination.
  4. Assume an ACR image scan automatically records every container execution event.

Explanation

Correct Answer

C:

Test using these records: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Disable logs to avoid storing data from short-running jobs. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

B:

Use a VM guest event log policy without any container diagnostic integration. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

D:

Assume an ACR image scan automatically records every container execution event. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

Question 586

A short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs. What is the most defensible Azure security action?

  1. For this Azure workload, the team should disable logs to avoid storing data from short-running jobs.
  2. For this Azure workload, the team should use a VM guest event log policy without any container diagnostic integration.
  3. For this Azure workload, the team should configure supported diagnostic settings and logging destinations for the chosen container service.
  4. For this Azure workload, the team should assume an ACR image scan automatically records every container execution event.

Explanation

Correct Answer

C:

Confirm the change against these records: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

Incorrect Answers

A:

Disable logs to avoid storing data from short-running jobs. The proposed change targets the wrong mechanism or lacks essential validation. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Relevant evidence is container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

B:

Use a VM guest event log policy without any container diagnostic integration. This leaves the security requirement unresolved. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The intended action is: Configure supported diagnostic settings and logging destinations for the chosen container service.

D:

Assume an ACR image scan automatically records every container execution event. This is not a valid substitute for the specified security control. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The correct targeted action is: Configure supported diagnostic settings and logging destinations for the chosen container service.

Question 587

A short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs. Which diagnostic record would most strongly confirm the result?

  1. In this security review, examine a database online indicator without a log of the protected operation.
  2. In this security review, examine an outdated deployment template without current effective settings.
  3. In this security review, examine a storage account resource name without its encryption or retention configuration.
  4. In this security review, examine container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

Explanation

Correct Answer

D:

These records test the actual container Apps and Container Instances monitoring behavior rather than an unrelated dashboard state. The intended action is: Configure supported diagnostic settings and logging destinations for the chosen container service.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, a short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs.

B:

The more relevant observations are: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

C:

Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

Question 588

A short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs. Which platform concept should guide the engineer’s assessment?

  1. The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
  2. The applicable security principle is that container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.
  3. The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
  4. The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.

Explanation

Correct Answer

B:

Confirmation depends on Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

Incorrect Answers

A:

A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for container Apps and Container Instances monitoring. The relevant security behavior is: Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Check evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

C:

A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for container Apps and Container Instances monitoring. The relevant security behavior is: Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Check evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

D:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for container Apps and Container Instances monitoring. The relevant security behavior is: Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations. Check evidence such as container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events.

Question 589

A short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs. Suppose the operator instead follows this unsafe shortcut: Assume an ACR image scan automatically records every container execution event. Which root-cause observation follows from that incorrect change?

  1. The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
  2. The resulting security weakness is that the observed issue is fully explained by the service display name.
  3. The resulting security weakness is that the security flaw is that the team retained a tested database backup.
  4. The resulting security weakness is that absent or misrouted diagnostics leave events unavailable after short-lived containers terminate.

Explanation

Correct Answer

D:

The suitable control is: Configure supported diagnostic settings and logging destinations for the chosen container service. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

Incorrect Answers

A:

This does not explain the real container Apps and Container Instances monitoring weakness after the shortcut. In the given case, a short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs.

B:

This does not explain the real container Apps and Container Instances monitoring weakness after the shortcut. The observed issue is fully explained by the service display name.

C:

This does not explain the real container Apps and Container Instances monitoring weakness after the shortcut. The security flaw is that the team retained a tested database backup.

Question 590

A short-lived Azure Container Instance executes jobs without retaining useful operational or security investigation logs. A review identifies this consequence: Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. Which recovery action addresses the underlying technical fault?

  1. The controlled remediation is to correct telemetry collection and verify new log records reach the authorized destination.
  2. The controlled remediation is to use a VM guest event log policy without any container diagnostic integration.
  3. The controlled remediation is to assume an ACR image scan automatically records every container execution event.
  4. The controlled remediation is to disable logs to avoid storing data from short-running jobs.

Explanation

Correct Answer

A:

Test using these records: Container service diagnostics, Log Analytics ingestion, resource identity and sample emitted events. Container Apps and Container Instances need service-appropriate logging and monitoring to support security investigations.

Incorrect Answers

B:

Use a VM guest event log policy without any container diagnostic integration. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

C:

Assume an ACR image scan automatically records every container execution event. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

D:

Disable logs to avoid storing data from short-running jobs. This would not reliably restore the intended security boundary. Absent or misrouted diagnostics leave events unavailable after short-lived containers terminate. The appropriate controlled recovery is: Correct telemetry collection and verify new log records reach the authorized destination.

Microsoft Azure Security Technologies (AZ-500) Practice Tests