AZ-500 Practice Test 11 — 15 Questions

Question 1

Drag and drop the steps to configure network security group (NSG) flow logs for a virtual network into the correct order.

Question 2

Drag and drop the steps to configure Azure AD Conditional Access policy to require MFA for all users into the correct order.

Question 3

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.

Question 4

Drag and drop the steps to configure Azure Application Gateway with SSL termination using a Key Vault certificate into the correct order.

Question 5

Drag and drop the steps to configure Azure AD Privileged Identity Management (PIM) for a role into the correct order.

Question 6

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Question 7

Drag and drop the steps to configure Azure Defender for SQL on an Azure SQL Database into the correct order.

Question 8

Drag and drop the steps to configure Azure Disk Encryption for a Windows VM using Azure Key Vault into the correct order.

Question 9

A company has two Azure virtual networks, VNet-A (hub) and VNet-B (spoke), connected via VNet peering. They deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. They configure a user-defined route (UDR) on the subnet in VNet-B with the destination address space of VNet-A (10.0.0.0/16) and the next hop set to the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes a direct path. What is the most likely cause?

Accepted Answer

The NVA network interface does not have IP forwarding enabled. Option D is correct because a network virtual appliance (NVA) requires IP forwarding to be enabled on its network interface to forward traffic not destined for itself. Without this setting, the NVA drops packets that arrive with a destination IP other than its own, causing the traffic to bypass the NVA and follow the default VNet peering route. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNets as specified by the user-defined route.

Answer

The NVA's private IP address is not reachable from VNet-B

Answer

VNet peering system routes override user-defined routes

Answer

The UDR must be applied to the gateway subnet of VNet-B

Question 10

A team wants to deploy Sentinel content consistently across workspaces. Which two approaches are appropriate?

Accepted Answer

Use Content Hub solutions where available. Content Hub solutions in Azure Sentinel provide pre-packaged content (analytic rules, workbooks, playbooks) that can be installed consistently across multiple workspaces via the Azure portal or API. This ensures standardized deployment without manual errors, leveraging Microsoft's curated content for common scenarios.

Answer

Manually copy screenshots of rules

Answer

Store incidents in Azure Key Vault

Question 11

An organization uses Microsoft Defender for Cloud. They want to implement just-in-time (JIT) VM access for a set of production VMs. However, the security team needs to ensure that JIT access requests are always approved by a manager before opening ports. Which configuration should they use?

Accepted Answer

Enable JIT and configure a custom workflow automation with an approval step. Option C is correct because Microsoft Defender for Cloud's JIT VM access can be integrated with a custom workflow automation that includes an approval step. This allows the security team to enforce manager approval before ports are opened, meeting the requirement for a formal approval process. The workflow automation can trigger an Azure Logic App or other action that requires a designated approver to authorize the request.

Answer

Enable JIT in Defender for Cloud and configure a logic app to send approval emails

Answer

Use Azure AD Privileged Identity Management (PIM) for JIT activation

Answer

Use Conditional Access with session controls

Question 12

A security team uses Microsoft Defender for Cloud to monitor the security posture of a hybrid environment that includes on-premises servers connected via Azure Arc. They want to enable a vulnerability assessment solution that automatically scans all servers (both Azure VMs and on-premises Arc-enabled servers) for OS vulnerabilities. Which solution should they enable directly from Defender for Cloud?

Accepted Answer

Enable the integrated vulnerability assessment solution (Qualys) in Defender for Cloud. The integrated vulnerability assessment (VA) solution in Defender for Cloud, powered by Qualys, is the correct choice because it is a native, built-in capability that can be automatically enabled for both Azure VMs and Azure Arc-enabled on-premises servers. It requires no additional licensing or external configuration, and it automatically discovers and scans OS vulnerabilities without manual intervention, directly from the Defender for Cloud portal.

Answer

Enable Microsoft Defender for Endpoint and integrate it with Defender for Cloud

Answer

Configure Azure Update Management to assess missing patches

Answer

Use Azure Policy to deploy the Log Analytics agent and manually enable scanning

Question 13

Your company is implementing an Azure AD B2B collaboration strategy for external partners. Which three of the following statements about Azure AD B2B collaboration are correct? (Choose three.)

Accepted Answer

Conditional Access policies can be applied to guest users. Azure AD B2B collaboration allows external users to sign in using their own Azure AD, Microsoft account (e.g., Outlook.com), or other identity providers (e.g., Google, SAML/WS-Fed IdPs). These users are represented as guest user objects in the tenant directory, which enables them to be managed like internal users. Conditional Access policies can be applied to guest users at the tenant or application level, allowing organizations to enforce MFA, device compliance, or sign-in risk policies for external collaborators.

Answer

Guest users cannot access SharePoint Online sites

Answer

Azure AD B2B collaboration requires an Azure AD Premium P2 license for each guest user

Answer

External users must have an Azure AD tenant in their own organization

Question 14

Your company has deployed an Azure Firewall in a hub virtual network to inspect traffic from spoke virtual networks. You need to ensure that all outbound traffic from a spoke virtual network to the internet is forced through the Azure Firewall. Which three of the following actions are required? (Choose three.)

Accepted Answer

Create a route table in the spoke virtual network with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP as the next hop.. To force all outbound traffic from a spoke virtual network through Azure Firewall, you must create a route table in the spoke with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. This route table must be associated with the subnets in the spoke that need to send traffic through the firewall. Additionally, you must configure the Azure Firewall policy with appropriate network and application rules to allow or deny outbound traffic, as the firewall itself does not automatically permit traffic without explicit rules.

Answer

Set the Azure Firewall to 'Drop' mode for all outbound traffic by default.

Answer

Enable forced tunneling on the Azure Firewall to route traffic through an on-premises network.

Answer

Deploy a Network Virtual Appliance (NVA) in the spoke virtual network to handle outbound traffic.

Question 15

You are designing a secure hybrid network that connects an on-premises datacenter to Azure. The solution must provide high availability and encrypt all traffic between the two sites. Which three of the following should you consider? (Choose three.)

Accepted Answer

Deploy two or more Azure VPN Gateway instances in an active-active configuration.. Deploying two or more Azure VPN Gateway instances in an active-active configuration provides high availability by ensuring that if one gateway instance fails, traffic continues to flow through the other. Using IPsec/IKE policy with strong encryption parameters (e.g., AES256, SHA256, DH Group 14 or higher) ensures all traffic between the on-premises datacenter and Azure is encrypted to meet security compliance. Configuring a second VPN tunnel from the on-premises device to a different Azure region adds geographic redundancy, protecting against a regional Azure outage.

Answer

Implement Azure ExpressRoute with Microsoft peering as the primary connectivity.

Answer

Use Azure Front Door to load balance traffic between the on-premises network and Azure.

Answer

Set up a point-to-site VPN for all on-premises users to access Azure resources.