AZ-500 Practice Test 10 — 10 Questions

Question 1

A company uses Azure AD. They want to ensure that all users enroll in Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. After 14 days, any user who has not enrolled must be blocked from accessing applications. Which configuration should they implement?

Accepted Answer

Create a Conditional Access policy targeting all users and all cloud apps, with the grant control 'Require multi-factor authentication registration' and configure the grace period in the MFA registration settings.. Option B is correct because it combines a Conditional Access policy requiring MFA registration with a configured grace period in the MFA registration settings. The 'Require multi-factor authentication registration' grant control forces users to register during sign-in, and the grace period (set in the MFA service settings) allows up to 14 days before blocking access. This meets the requirement to block unregistered users after 14 days.

Answer

Use Azure AD Identity Protection to create a sign-in risk policy that requires MFA registration for medium and above risks.

Answer

Enable security defaults for the directory.

Answer

Configure the Azure AD audit logs to send an alert when a user has not registered for MFA after 14 days, then manually block them.

Question 2

A company uses Azure Front Door to accelerate and secure its public web application. The security team wants to limit the number of requests from a single client IP address to 100 per minute to prevent a single user from overwhelming the backend. Which configuration should they add to the Web Application Firewall (WAF) policy associated with the Front Door?

Accepted Answer

Add a custom rule with a rate limit condition.. Option A is correct because Azure Front Door's WAF supports custom rate limit rules that can restrict the number of requests from a single client IP address within a specified time window. By creating a custom rule with a rate limit condition set to 100 requests per minute, the security team can prevent a single client from overwhelming the backend while allowing legitimate traffic. This is the only option that directly addresses the requirement to limit requests per client IP.

Answer

Enable a managed rule set for the WAF policy.

Answer

Configure a bot protection rule set.

Answer

Set a geolocation filter to block all traffic except from allowed countries.

Question 3

A company uses Microsoft Defender for Cloud. They want to receive email notifications when a high-severity security alert is generated for any resource in the subscription. Which configuration should they make in Defender for Cloud?

Accepted Answer

Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses.. Option A is correct because the 'Email notifications' setting in Microsoft Defender for Cloud allows you to directly configure email recipients to receive notifications for high-severity alerts. This built-in feature sends emails to specified addresses whenever a high-severity security alert is triggered for any resource in the subscription, without requiring additional automation or external tools.

Answer

Create a workflow automation in Defender for Cloud that sends an email when a high-severity alert is generated.

Answer

Enable continuous export to stream all security alerts to a Log Analytics workspace and create an alert rule to send email.

Answer

Enable the 'Send email alerts' option in the Azure Monitor activity log alert rule.

Question 4

A Defender for Cloud recommendation requires enabling private endpoints for a storage account. Which security risk is primarily reduced?

Accepted Answer

Unauthorized changes to Azure AD users. Enabling private endpoints for a storage account removes the public endpoint from the service, ensuring that all traffic to the storage account traverses the Microsoft backbone network via a private IP address in your virtual network. This directly mitigates the risk of data exposure to the public internet, which is the primary security concern addressed by this Defender for Cloud recommendation.

Answer

VM disk fragmentation

Answer

Public internet exposure of the storage service endpoint

Answer

Excessive Log Analytics ingestion

Question 5

A company uses Microsoft Defender for Cloud to monitor its security posture. The compliance team wants to receive email notifications immediately when a control in the ISO 27001 regulatory compliance standard fails. They want to be alerted only when specific controls change from 'compliant' to 'non-compliant'. Which feature should they configure?

Accepted Answer

Workflow automation based on regulatory compliance assessment changes. Option C is correct because workflow automation in Microsoft Defender for Cloud can be configured to trigger based on regulatory compliance assessment changes, specifically when a control transitions from 'compliant' to 'non-compliant'. This allows the compliance team to receive immediate email notifications for ISO 27001 control failures without manual polling or dashboard monitoring.

Answer

Security Alerts from Microsoft Defender for Cloud

Answer

Regulatory Compliance dashboard with continuous export

Answer

Custom recommendations in Microsoft Defender for Cloud

Question 6

A company wants to allow external business partners to access specific SharePoint Online sites using their own corporate credentials. They do not want to manage partner accounts in their own Azure AD tenant. Which Azure AD feature should they use?

Accepted Answer

Azure AD External Identities. Azure AD External Identities (specifically B2B collaboration) allows you to invite external business partners to access your SharePoint Online sites using their own corporate credentials (their home Azure AD or identity provider). This eliminates the need to manage partner accounts in your tenant, as identities remain in their home directory and are authenticated via federation or SAML/WS-Fed protocols.

Answer

Azure AD B2C

Answer

Conditional Access

Answer

Privileged Identity Management

Question 7

A company wants to require that users perform multi-factor authentication (MFA) when accessing a critical enterprise application, but only when they are outside the corporate network. They have Azure Active Directory Premium P1 licenses. Which feature should they use to enforce this requirement?

Accepted Answer

Conditional Access policy. Conditional Access policies in Azure AD Premium P1 allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the critical enterprise application and includes a condition for 'Locations' set to 'All trusted locations' (or 'Not trusted locations'), you can require MFA only when users access the app from outside the corporate network. This directly meets the requirement without needing additional licensing or services.

Answer

Azure AD Identity Protection

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Application Proxy

Question 8

A security engineer wants Defender for Cloud to detect threats against Azure SQL Database and SQL Server on Azure VMs. Which plan should be enabled?

Accepted Answer

Defender for Databases or Defender for SQL coverage as presented in the portal. Defender for Databases (or the Defender for SQL coverage option in the portal) is the correct plan because it provides threat detection specifically for Azure SQL Database and SQL Server on Azure VMs. This plan monitors anomalous activities such as SQL injection, brute-force attacks, and unusual access patterns using Microsoft's threat intelligence and machine learning models. It is the only plan that directly covers both PaaS and IaaS SQL workloads as described.

Answer

Defender for Storage

Answer

Defender for App Service only

Answer

Defender External Attack Surface Management

Question 9

An organization is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). They use Microsoft Defender for Cloud to manage their Azure security posture. Which feature in Defender for Cloud should they use to view their current compliance status against HIPAA controls?

Accepted Answer

Regulatory compliance dashboard.. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of your compliance posture against various standards, including HIPAA. It continuously assesses your Azure environment against HIPAA controls and displays the current compliance status, enabling you to track and improve adherence to regulatory requirements.

Answer

Security posture dashboard.

Answer

Recommendations dashboard.

Answer

Inventory dashboard.

Question 10

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.