AZ-500 Exam Questions and Answers

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.

This setting allows trusted Azure services, including Azure SQL Database, to access the Key Vault even when the firewall is enabled. Since the SQL server's managed identity already has the cryptographic role, this is the missing piece to allow TDE operations.

Enable the 'Secure transfer required' property on the storage account.

Enabling the storage account's 'Secure transfer required' property rejects requests over unencrypted connections. For Azure Files, this forces clients to use SMB 3.0 with encryption (or HTTPS for REST), so sensitive data is encrypted while traversing the network. This is the proper, supported control for enforcing encryption in transit for Azure Files.

Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.

Enabling 'Allow trusted Microsoft services to bypass this firewall' is the correct solution because Azure SQL Database is a trusted Microsoft service and its managed identity can authenticate to the Key Vault using Microsoft Entra ID, then fetch the encryption key for TDE. With this setting, the Key Vault firewall remains enabled for public internet traffic, but Azure services like SQL Database are permitted to bypass the IP restrictions. This is the intended pattern for TDE with customer-managed keys, as SQL Database runs outside your virtual network and its outbound IPs cannot be reliably scoped.

Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).

Key Vault key auto-rotation creates new key versions on schedule. By setting the key version to empty in the disk encryption set, the VMs automatically re-wrap their disks with the latest key version after rotation.

System-assigned managed identity

A system-assigned managed identity is created directly on the storage account and shares its lifecycle: when enabled, Microsoft Entra ID automatically provisions a corresponding service principal for the account, and when the storage account is deleted, the identity is removed automatically. It requires no application ID, client secret, or certificate rotation, so it meets both requirements of credential-free authentication and automatic cleanup. The storage account can use this identity to authenticate to Azure Key Vault for customer-managed key operations.

Enable the Key Vault firewall to allow trusted Microsoft services

Azure SQL Database TDE with customer-managed keys requires SQL to access Key Vault for key wrap and unwrap operations. The Key Vault firewall blocks public access, but the 'Allow trusted Microsoft services' exception lets Azure SQL's underlying service bypass the firewall for these cryptographic operations, using the SQL server's managed identity. This is the only network change needed while keeping public access blocked.

The subscription is not registered with the Microsoft.Security resource provider.

For Defender for Cloud to assess a subscription, the Microsoft.Security resource provider must be registered at the subscription level, as this registration is what allows the service to query Azure Resource Manager for resource metadata and configuration. When the provider is unregistered, Defender for Cloud cannot perform any resource discovery, so no security recommendations, regulatory compliance controls, or secure score data are generated for that subscription. Registration is typically performed automatically when a user first opens Defender for Cloud in the portal, but it can also be done programmatically via Azure CLI (`az provider register --namespace Microsoft.Security`) or PowerShell. An unregistered provider explains both the absence of data and why the user perceives that security posture is completely missing.

Use the Windows Security Events connector via Azure Monitor Agent.

The Windows Security Events connector using the Azure Monitor Agent (AMA) is the correct choice because it collects Windows Event Log entries, including security events such as successful and failed logon attempts (Event IDs 4624, 4625) from Azure VMs. AMA is configured with a data collection rule (DCR) that specifies which event IDs to send to the Log Analytics workspace where Microsoft Sentinel can analyze them. This is exactly the native, supported path for OS-level sign-in monitoring on Windows virtual machines.

The resources are in a subscription that is not included in the scope of the compliance standard.

In Defender for Cloud, each regulatory compliance standard is assigned to a specific scope, such as a subscription or management group, when you enable it. Only resources within that assigned scope are evaluated and reported in the compliance dashboard, and resources in unassigned subscriptions are completely ignored. If the subscription containing the resources is not part of the standard's assignment, those resources will not appear in the compliance view.

Microsoft Entra ID Sign-in logs and Microsoft Entra ID Audit logs

Microsoft Entra ID Sign-in Logs ingest authentication and authorization events, such as successful and failed user sign-ins, conditional access results, and MFA challenges. Microsoft Entra ID Audit Logs capture all directory-management activities, including user creation, group membership changes, password resets, and application role assignments. These two complementary connectors provide the full AAD security telemetry needed to monitor both user access and administrative changes in Microsoft Sentinel.

To list the top 10 most frequent alert names along with their severity over the last 7 days.

The query groups alert records by AlertName and Severity using summarize, counts the occurrences in each combination, and applies top to rank those combinations descending by count. This returns the ten most frequent alert-name/severity pairs over the rolling 7-day window, which precisely matches the stated purpose. The inclusion of both fields in the grouping key is essential to the output.

The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.

The assignment's scope is RG-Prod, making every contained resource subject to policy evaluation. The notScopes array specifies the VM-Sensitive virtual machine resource ID, so that VM alone is excluded from compliance evaluation. All other resources, regardless of type, remain within the assignment's scope and are evaluated.

One-time passcode (OTP)

One-time passcode (OTP) is a built-in Microsoft Entra ID authentication method that sends a verification code to a user's verified email or phone number via SMS or email. It requires no additional app installation, hardware token, or certificate infrastructure, making it the simplest way to authenticate a user without a password. The code is time-limited and used once, providing a low-friction option for temporary or initial sign-in scenarios.

Include 'All cloud apps' and exclude 'Microsoft Entra ID Administration'

Conditional access evaluates include and exclude scopes, with exclusions taking precedence. Selecting 'All cloud apps' as the include and excluding 'Microsoft Entra ID Administration' satisfies the requirement to block untrusted locations everywhere except administrative access, avoiding the need to enumerate every individual app.

Entitlement Management access packages

Entitlement Management access packages are the correct choice because they are specifically designed to govern end-user access to resources such as groups, applications, and SharePoint sites. These packages bundle resources with configurable policies for request approval, recurring access reviews, expiration, and automatic revocation when the policy ends. This enables self-service access requests while maintaining an auditable lifecycle for both internal and external users.

The SAML certificate has expired or the configuration has a mismatch

SAML certificates are used to sign the SAML response; the service provider uses the certificate's public key to validate the signature. If the certificate has expired or the configured certificate doesn't match the one trusted by the application, the SP will discard the assertion and deny sign-in. Likewise, a mismatch in the SAML configuration (e.g., Entity ID, Reply URL, or signing algorithm) will cause authentication failures even when the certificate is valid.

Include all users and exclude specific groups

This is a valid user-and-group assignment in a Conditional Access policy. Selecting All users scopes the policy to every account in the tenant, while the Exclude tab lets you remove specific security groups such as break-glass emergency access accounts. This is the standard way to blanket-apply a policy while preserving administrative exceptions.

Target a specific cloud application

Targeting a specific cloud application is a valid Conditional Access assignment. In the Target resources step you can select single applications such as Exchange Online, SharePoint, or an Entra ID-integrated SaaS app, which restricts the policy to sign-ins for those apps only. This is one of the core assignment groups: users, cloud apps, and conditions.

Certificate-based authentication (CBA)

Certificate-based authentication (CBA) leverages X.509 digital certificates issued by a trusted certification authority to verify a user's identity. In Microsoft Entra ID, this method is supported for federated domains, where the certificate is used to authenticate against the identity provider instead of a password. It offers strong, phishing-resistant protection and is distinct from the physical smart card interaction, which is not natively supported.

SMS-based one-time passcode

SMS-based one-time passcode (OTP) is a supported authentication method in Microsoft Entra ID, where a short-lived verification code is sent by text message to a registered phone number and must be entered during sign-in. It can satisfy multi-factor authentication or act as a passwordless option in certain configurations. SMS OTP is convenient but less secure than certificate-based methods due to risks of SMS interception or SIM swapping.

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'

A separate policy for medium user risk applied to all users will require MFA when medium risk is detected. The existing policy will continue to block Finance users with high risk. Policy evaluation is not mutually exclusive; the block takes precedence for high risk, and the MFA requirement applies for medium risk.

Set the activation maximum duration to 8 hours.

Setting the activation maximum duration to 8 hours in Microsoft Entra PIM enforces a strict time-bound on any privileged role activation. This ensures that a user cannot remain in the role indefinitely; after the configured duration, the role assignment automatically expires and reverts to eligible state. Since 8 hours is the maximum allowed activation duration for Microsoft Entra ID roles, this directly satisfies the requirement that privileged access be temporary and bounded by a specific time limit.

Enable approval workflow by adding the manager as an approver.

Enabling the approval workflow and configuring the user's manager as an approver requires every activation request to be explicitly reviewed and approved by that manager before the role becomes active. This satisfies the approval requirement by adding a mandatory human control point, ensuring that privileged access is granted on-demand only after proper authorization. The approver can evaluate the request context, including the provided justification, before granting access.

In PIM settings for the Global Administrator role, enable 'Require Microsoft Entra Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.

This is the correct approach because PIM supports emitting an Microsoft Entra Conditional Access authentication context during role activation. When you enable 'Require Microsoft Entra Conditional Access authentication context' in PIM settings, Microsoft Entra ID sends that context as a signal to Conditional Access for the activation request. A separate Conditional Access policy can then target that authentication context and apply the 'Require device to be marked as compliant' grant control. This is the documented integration pattern for combining PIM with device-compliance policies, and it satisfies the requirement without relying on unsupported targets like the PIM app itself.

Trust multi-factor authentication from the partner tenant (inbound trust).

This setting, located in the partner tenant's cross-tenant access settings under 'Inbound access' > 'Trust settings', instructs your Microsoft Entra ID to accept the multi-factor authentication (MFA) claims already performed in the partner tenant. When enabled, B2B collaboration users from that tenant are not prompted for MFA again in your tenant, provided their home tenant has satisfied MFA. This is the correct mechanism to avoid redundant authentication prompts.

Microsoft Entra application proxy.

Microsoft Entra application proxy is the appropriate service here because it is purpose-built to publish on-premises HTTP/HTTPS apps to external users through Microsoft Entra ID. A lightweight connector installed on the corporate network establishes an outbound connection to the Microsoft Entra application proxy service, eliminating the need for inbound firewall ports or a VPN; the external endpoint is an Microsoft Entra ID URL that performs full Microsoft Entra ID pre-authentication, including MFA and Conditional Access, before passing the authenticated request back through the connector to the internal web application. It effectively acts as an HTTPS reverse proxy bridged by an outbound-only tunnel, which is exactly what is required to securely expose an on-premises web app without making it publicly reachable.

Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.

This is correct because it combines the specific condition—User risk High—with a location exclusion for all trusted IP ranges, ensuring the block only applies to sign-ins that originate from untrusted locations. Conditional Access evaluates the user risk condition and the location condition together, and with the grant control set to Block access, any matching sign-in is denied. This matches the requirement precisely: only high user risk accounts attempting sign-in from outside the corporate network are blocked.

The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR

BGP-learned routes for on-premises networks are more specific than 0.0.0.0/0. They will be used even if a UDR for 0.0.0.0/0 exists. To force through firewall, you must either disable BGP route propagation or create specific UDRs for on-premises ranges.

The route table is not associated with the spoke subnet.

A route table only takes effect when it is explicitly associated with a subnet. In this hub-spoke topology, the spoke subnet still has the default system routes, so traffic destined for the internet follows the default route and bypasses Azure Firewall. You must associate the custom route table—with a UDR that uses the firewall's private IP as the next hop and next hop type 'VirtualAppliance'—to the spoke subnet for forced tunneling to work.

The NVA's network interface (NIC) does not have IP forwarding enabled.

IP forwarding must be explicitly enabled on the network interface (NIC) of the NVA before Azure will deliver packets whose destination IP is not assigned to that NIC. Without it, the Azure fabric drops packets that are addressed to other IPs, so even if the NVA's operating system is configured to route traffic, the packets never reach it. This is the most common omission when deploying NVAs with UDRs, and it precisely explains why traffic flows end-to-end via peering but not through the NVA — the NVA silently discards (or never receives) the forwarded packets.

The route table is not associated to the spoke subnet.

A user-defined route table only takes effect when it is explicitly associated with a subnet; simply creating a route table and adding a route to the firewall's private IP does nothing otherwise. Without that association, the subnet uses Azure's default system routes, which send traffic between peered VNets directly, bypassing the firewall entirely. This is the classic cause of 'spoke traffic isn't going through the firewall' when the routes appear to be configured correctly.

3

You need exactly three inbound allow rules: one for HTTP (destination port 80), one for HTTPS (destination port 443), and one for RDP (destination port 3389), each scoped to the appropriate source address prefix. Azure NSGs include a default inbound deny rule, so any traffic not explicitly allowed by these three rules is automatically blocked. This satisfies the requirement with the minimum number of rules while preserving least privilege.

Disable public network access on the Azure SQL server.

Correct. Disabling public network access on the SQL server blocks all traffic from the public internet, leaving only the private endpoint as the entry point. This ensures all traffic from on-premises and peered VNets must use the private endpoint.