AZ-500 Practice Test 12 — 15 Questions

Question 1

You have an Azure Cosmos DB account with multiple containers. You need to ensure that only specific Azure AD identities can access the data and that all access is logged. What should you use?

Accepted Answer

Use Azure AD authentication and RBAC roles, and enable diagnostic logs. Microsoft Entra ID authentication with RBAC roles allows you to restrict data access to specific Microsoft Entra ID identities, and enabling diagnostic logs captures all data plane operations for auditing. This combination meets the requirements of identity-based access control and comprehensive logging, unlike primary keys which are shared secrets and do not support identity-level auditing.

Answer

Use primary keys for authentication and enable audit logging

Answer

Configure managed identities for Azure resources and enable diagnostic logs

Answer

Configure an Azure Cosmos DB firewall and enable diagnostic logs

Question 2

You need to ensure that Azure SQL Database connections are encrypted and the server's identity is verified. Which connection string parameter should be required?

Accepted Answer

Encrypt=True; TrustServerCertificate=False. Setting `Encrypt=True` forces TLS encryption for all data in transit between the client and Azure SQL Database, while `TrustServerCertificate=False` ensures that the server's TLS certificate is validated against a trusted certificate authority (CA). This combination provides both encryption and server identity verification, which is required for secure connections to Azure SQL Database.

Answer

Encrypt=Optional

Answer

TrustServerCertificate=True

Answer

Encrypt=False

Question 3

A company uses Azure AD Identity Protection. They have detected a user with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user only when the sign-in comes from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy. Which configuration should they use?

Accepted Answer

Assign the user to the policy, set condition 'User risk level: High' and condition 'Locations: All locations except trusted', and set 'Grant' to 'Block access'. It combines the 'User risk level: High' condition (triggered by Identity Protection's user risk detection) with the 'Locations: All locations except trusted' condition, and sets 'Grant' to 'Block access'. This ensures that only sign-ins from untrusted locations are blocked when the user's risk is high, meeting the requirement to allow sign-ins from trusted IPs even for high-risk users.

Answer

Assign the user to the policy, set condition 'Sign-in risk level: High' and condition 'Locations: All trusted locations', and set 'Grant' to 'Block access'

Answer

Assign the user to the policy, set condition 'User risk level: High' and set 'Grant' to 'Require multi-factor authentication'

Answer

Create a risk detection policy in Identity Protection that triggers a user risk policy, and have Conditional Access use the risk policy

Question 4

A Sentinel analytics rule creates a new incident every time the same brute-force activity is detected for the same account within an hour. The SOC wants one incident that continues to group related alerts. What should be changed?

Accepted Answer

Configure incident grouping in the scheduled analytics rule. Incident grouping in a scheduled analytics rule allows multiple alerts triggered by the same entity (e.g., the same account) within a specified time window to be combined into a single incident. By configuring the 'Group related alerts into a single incident' setting and setting the grouping window to one hour, the SOC ensures that all brute-force alerts for the same account are merged into one incident, reducing alert fatigue and providing a consolidated view of the attack.

Answer

Disable entity mapping for the account entity

Answer

Change the rule query to use project-away on TimeGenerated

Answer

Run the rule as a near-real-time rule

Question 5

A Sentinel playbook fails to update incidents even though the Logic App runs successfully. The playbook uses a managed identity. What is the most likely missing configuration?

Accepted Answer

The managed identity lacks Microsoft Sentinel Responder or Contributor permissions on the workspace. The managed identity assigned to the Logic App must have at least Microsoft Sentinel Responder or Contributor permissions on the workspace to update incidents. Without these RBAC roles, the Logic App's API calls to modify incident properties (e.g., status, severity) are denied, even if the Logic App itself runs without errors.

Answer

The analytics rule does not include MITRE ATT&CK tactics

Answer

The Log Analytics workspace is not linked to Azure Monitor Private Link

Answer

The incident title does not contain an entity mapping

Question 6

You run the PowerShell cmdlet shown in the exhibit for an Azure SQL Database. What is the security implication?

Accepted Answer

The database is not protected against anomalous activities.. The cmdlet shown is `Set-AzSqlDatabaseVulnerabilityAssessmentSettings`, which enables Vulnerability Assessment (VA) but does not enable Advanced Threat Protection (ATP). Without ATP, the database lacks anomaly detection capabilities such as SQL injection detection, brute-force attack alerts, and unusual access pattern monitoring. Therefore, the database is not protected against anomalous activities, making option B correct.

Answer

Auditing of database queries is not configured.

Answer

The database firewall allows all public IP addresses.

Answer

Transparent data encryption is not enabled.

Question 7

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

Accepted Answer

Set the key vault's 'enabledForDiskEncryption' property to true.. Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.

Answer

Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.

Answer

Grant the virtual machine's managed identity 'Contributor' role on the key vault.

Answer

Configure soft-delete and purge protection on the key vault.

Question 8

A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?

Accepted Answer

Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.. It combines a condition for 'User risk' set to 'High' with an exclusion of 'All trusted locations' under the 'Locations' condition, then grants 'Block access'. This ensures that the block only applies when the sign-in originates from an untrusted location, meeting the requirement to automatically block sign-ins for high-risk users only from locations not in the company's trusted IP list.

Answer

Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.

Answer

Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.

Answer

Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.

Question 9

You are reviewing the ARM template for an Azure Disk Encryption Set. The template includes the JSON snippet shown. You notice that the key version is empty. What is the consequence?

Accepted Answer

The encryption set will automatically use the latest version of the key.. When the key version is omitted in an Azure Disk Encryption Set ARM template, the encryption set automatically uses the latest version of the key from the specified Azure Key Vault. This behavior allows the encryption set to stay updated with key rotations without requiring manual template updates, as Azure Disk Encryption Sets support automatic key version updates when no version is specified.

Answer

The encryption set will use a platform-managed key.

Answer

The encryption set will use the key name without any version, causing it to fail.

Answer

The deployment will fail because a key version is required.

Question 10

A company has an Azure SQL Database that contains sensitive financial data. They want to audit all successful and failed login attempts for the database. What should they configure?

Accepted Answer

Azure SQL Database auditing. Azure SQL Database auditing is the correct configuration because it captures both successful and failed login attempts (authentication events) at the database level. Auditing writes these events to an audit log destination (such as Azure Storage, Log Analytics, or Event Hubs), enabling detailed forensic analysis of access patterns. This directly meets the requirement to audit all login attempts for the sensitive financial database.

Answer

SQL Vulnerability Assessment

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 11

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to restrict a user to only view data from the 'Sales' schema, without granting permissions to other schemas. What should you do?

Accepted Answer

Create a user mapped to the Entra ID user and grant SELECT on the Sales schema only.. It directly implements the principle of least privilege by creating a database user mapped to the Microsoft Entra ID user and granting SELECT only on the Sales schema. This ensures the user can view data exclusively within that schema, with no implicit permissions on other schemas. Azure SQL Database supports schema-level permissions, making this a precise and secure approach.

Answer

Add the user to the db_datareader role in the database.

Answer

Use a DENY statement on all other schemas for the user.

Answer

Create a contained database user with password and assign to db_datareader.

Question 12

You need to protect Azure VMs from ransomware by ensuring that encrypted file systems cannot be read by attackers. Which solution should you implement?

Accepted Answer

Enable Azure Disk Encryption on the VMs.. Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks of Azure VMs at rest. This ensures that even if an attacker gains access to the underlying storage or exports the VHD files, the encrypted file system cannot be read without the encryption keys, which are protected by Azure Key Vault. This directly addresses the requirement to prevent attackers from reading encrypted file systems.

Answer

Apply network security groups (NSGs) to block unauthorized access.

Answer

Configure Azure Backup for the VMs.

Answer

Enable Microsoft Defender for Cloud on the subscription.

Question 13

You need to ensure that Azure SQL Database automatically detects and alerts on potential SQL injection attacks. Which Microsoft Defender for Cloud plan should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL includes advanced SQL security features such as Vulnerability Assessment, Advanced Threat Protection, and Data Discovery & Classification. Specifically, its Advanced Threat Protection capability uses machine learning models to detect anomalous database activities, including SQL injection attempts, and can trigger alerts or automated responses. Enabling this plan on your Azure SQL Database ensures that potential SQL injection attacks are automatically detected and alerted.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud (free tier)

Answer

Microsoft Defender for App Service

Question 14

A security analyst is using Microsoft Sentinel to detect multi-stage attacks. They want to create an analytics rule that correlates a user sign-in from an unusual location with a subsequent data exfiltration attempt from Azure Blob Storage within one hour. Which type of analytics rule should they use?

Accepted Answer

Scheduled query rule with entity mapping.. A scheduled query rule with entity mapping is correct because it allows the security analyst to write a KQL query that correlates two distinct events—a sign-in from an unusual location and a subsequent data exfiltration from Azure Blob Storage—within a defined time window (one hour). Entity mapping enables the rule to link these events by common entities (e.g., user account or IP address), which is essential for detecting multi-stage attacks. This rule type runs on a schedule, making it ideal for time-bound correlation queries.

Answer

Fusion rule.

Answer

Microsoft Security incident rule.

Answer

Anomaly rule.

Question 15

Refer to the exhibit. You are deploying an Azure Storage account with the ARM template snippet shown. The deployment fails with an error about the encryption configuration. What is the most likely cause?

Accepted Answer

The storage account does not have the required permissions on the key vault. The storage account must be granted explicit permissions on the Azure Key Vault to access the encryption key. Even if the key vault URI, key name, and version are correct, the deployment will fail if the storage account's managed identity (or the user-assigned identity) does not have 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the key vault. This is a common oversight when configuring customer-managed keys for Azure Storage encryption.

Answer

The key vault URI is incorrect

Answer

The key name or version is missing

Answer

The key vault is in a different region than the storage account