AZ-500 Practice Test 12 — 15 Questions

Question 1

You are planning a network security strategy for a multi-tier application deployed on Azure virtual machines. You need to ensure that traffic between the web tier and the application tier is encrypted and that the application tier is not directly accessible from the internet. Which three of the following should you implement? (Choose three.)

Accepted Answer

Deploy an Azure Application Gateway with SSL/TLS termination in front of the web tier.. Deploying an Azure Application Gateway with SSL/TLS termination in front of the web tier ensures that incoming client traffic is encrypted at the edge, and the gateway can then forward traffic to the web tier. Configuring an NSG on the application tier subnet to deny all inbound traffic from the internet directly protects the application tier from external access. Enabling end-to-end TLS encryption between the web tier and the application tier using certificates ensures that traffic within the virtual network remains encrypted, meeting the requirement for encrypted inter-tier communication.

Answer

Use Azure Front Door to route traffic between the web tier and the application tier.

Answer

Assign public IP addresses to the application tier virtual machines for monitoring purposes.

Answer

Configure a site-to-site VPN between the web tier and the application tier subnets.

Question 2

A company uses Microsoft Defender for Cloud. They want to automatically apply a security recommendation (such as enabling encryption on storage accounts) to all existing resources that are found to be non-compliant without manual intervention. Which Defender for Cloud feature should they configure?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger automated actions (e.g., Azure Logic Apps) based on security recommendations or regulatory compliance changes. By configuring a workflow automation rule that triggers on the 'recommendation' event for a specific recommendation (like 'Storage accounts should use customer-managed key for encryption'), you can automatically remediate non-compliant resources without manual intervention, for example by invoking a Logic App that enables encryption on the storage account.

Answer

Continuous export

Answer

Email notifications

Answer

Security policies

Question 3

Match each Azure network security component to its function.

Question 4

Match each Azure AD Conditional Access component to its role.

Question 5

A DevOps team wants Defender for Cloud to identify secrets exposed in GitHub repositories. What should be configured?

Accepted Answer

Defender for Cloud DevOps Security connector. Defender for Cloud's DevOps Security connector integrates with GitHub to scan repositories for exposed secrets (e.g., API keys, tokens) using Microsoft's secret scanning engine. This connector enables Defender for Cloud to monitor commits and pull requests, alerting on secrets detected in code. It is the correct solution because it directly addresses the requirement to identify secrets in GitHub repositories within the Defender for Cloud ecosystem.

Answer

Azure Bastion native client

Answer

Sentinel Syslog connector

Answer

Azure Storage lifecycle management

Question 6

Drag and drop the steps to assign an Azure RBAC role to a user at the resource group scope into the correct order.

Question 7

A SOC analyst needs a Sentinel query that detects multiple failed sign-ins followed by a successful sign-in for the same user. Which table is the best primary source?

Accepted Answer

SigninLogs. SigninLogs is the correct primary source because it captures both failed and successful user sign-in events from Azure AD, including interactive and non-interactive logins. This table provides the necessary fields like ResultType (e.g., 0 for success, 50125 for failure) and UserPrincipalName to build a KQL query that detects a sequence of failed sign-ins followed by a successful one for the same user.

Answer

SecurityAlert

Answer

AzureActivity

Answer

DeviceNetworkEvents

Question 8

A Sentinel scheduled rule runs every 5 minutes and looks back 1 hour. Analysts see repeated alerts for the same event. Which change best prevents duplicate detections without missing late-arriving logs?

Accepted Answer

Use an ingestion-time or event-time exclusion window in the query. Option B is correct because using an ingestion-time or event-time exclusion window in the query allows the rule to skip events that have already generated an alert within a specific time range, preventing duplicate detections while still accommodating late-arriving logs. This approach leverages the query logic to filter out duplicates based on a time-based deduplication key, ensuring that only new or unique events trigger alerts without altering the lookback period.

Answer

Reduce the query lookback to 1 minute

Answer

Disable alert grouping

Answer

Change the workspace retention period

Question 9

A storage account should be reachable only from a specific subnet over the Microsoft backbone, while keeping the public endpoint firewall restricted. Which feature should be used?

Accepted Answer

Service endpoint for Microsoft.Storage with storage firewall rules. A service endpoint for Microsoft.Storage extends your virtual network private address space and the identity of your VNet to the Azure Storage service over the Microsoft backbone. By combining the service endpoint with a storage firewall rule that restricts access to only that specific subnet, you ensure the storage account is reachable only from that subnet while keeping the public endpoint firewall restricted to deny all other traffic.

Answer

Application Security Group

Answer

Azure Bastion

Answer

Public IP prefix

Question 10

A Sentinel watchlist contains high-value administrator accounts. Which KQL pattern best uses it in a detection rule?

Accepted Answer

Load the watchlist with _GetWatchlist() and join or filter SigninLogs by the account identifier. Option A is correct because the `_GetWatchlist()` function in KQL allows you to dynamically load a Sentinel watchlist into a query. By joining or filtering `SigninLogs` against the watchlist's account identifier field, you can create a detection rule that triggers only when a high-value administrator account (defined in the watchlist) performs a sign-in, enabling precise, automated alerting without manual intervention.

Answer

Export the watchlist to CSV and manually compare it after alerts fire

Answer

Use the watchlist as a replacement for the SigninLogs table

Answer

Attach the watchlist to a workbook without changing the detection query

Question 11

A team wants Sentinel incidents to automatically assign to the Tier 2 queue when severity is High and the product name is Microsoft Defender for Endpoint. What should they configure?

Accepted Answer

An automation rule that updates owner/status based on conditions. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners or queues based on conditions like severity and product name. By configuring an automation rule with a condition that triggers when severity equals 'High' and the product name is 'Microsoft Defender for Endpoint', you can set the incident owner to a specific user or group (e.g., Tier 2 queue) and optionally update the status. This directly meets the requirement without manual intervention.

Answer

A workbook with a dropdown filter

Answer

A watchlist containing Tier 2 users only

Answer

A data retention policy

Question 12

A team enables Microsoft Defender for Storage. Which two threats can the plan help detect?

Accepted Answer

Access from suspicious IP addresses to storage accounts. Microsoft Defender for Storage detects anomalous activities that could indicate threats to storage accounts. Option A is correct because the service analyzes incoming requests to identify access from suspicious IP addresses, such as known malicious IPs or Tor exit nodes, using threat intelligence feeds. Option D is correct because when malware scanning is enabled, Defender for Storage can detect malware uploaded to Blob Storage by scanning files for known malicious signatures.

Answer

Expired Azure AD PIM role assignments

Answer

Public IP address creation on virtual machines

Question 13

A team wants Sentinel to ingest firewall logs from an appliance that emits Common Event Format over Syslog. Which connector pattern is most appropriate?

Accepted Answer

CEF connector using a Linux log forwarder or AMA-supported collection path. The Common Event Format (CEF) over Syslog is a standard logging format used by many security appliances. Sentinel's CEF connector is specifically designed to ingest these logs, typically using a Linux log forwarder (rsyslog or syslog-ng) or the Azure Monitor Agent (AMA) with a Data Collection Rule to parse and forward the CEF messages to the Log Analytics workspace.

Answer

Azure Activity connector

Answer

Microsoft Entra ID Protection connector

Answer

Office 365 connector

Question 14

A SOC wants a Sentinel rule to include account, host, and IP entities so analysts can pivot during investigation. What should be configured in the analytics rule?

Accepted Answer

Entity mapping. Entity mapping is the correct configuration because it explicitly links the analytics rule's results to known entity types (account, host, IP) in Microsoft Sentinel. This enables analysts to pivot directly from an alert to related entities in the investigation graph, enriching context without manual cross-referencing. Without entity mapping, the rule would generate alerts but lack the structured entity data needed for seamless pivot actions.

Answer

Custom details only

Answer

Suppression rules

Answer

Workbook parameters

Question 15

A company has Azure AD Conditional Access policies that require multi-factor authentication (MFA) for all users accessing sensitive cloud apps. The security team wants to extend this protection by monitoring and controlling user activities within those applications (e.g., preventing data exfiltration during a session). Which Conditional Access session control should they implement?

Accepted Answer

Session control: Conditional Access Application Control. Option D is correct because Conditional Access Application Control (also known as Microsoft Defender for Cloud Apps session control) allows real-time monitoring and control of user activities within cloud apps, such as blocking downloads or preventing data exfiltration. This session control works by redirecting user traffic through Microsoft Defender for Cloud Apps as a reverse proxy, enabling granular policy enforcement during the session. The requirement specifically asks for monitoring and controlling activities inside the app, which goes beyond just requiring MFA at sign-in.

Answer

Grant control: Require MFA

Answer

Session control: Use app enforced restrictions

Answer

Session control: Sign-in frequency