AZ-500 Practice Test 13 — 15 Questions

Question 1

A company has an Azure Storage account with infrastructure encryption enabled. They configure the storage account to use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. Despite this configuration, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

The storage account's encryption type is set to Microsoft-managed keys. Option C is correct because the storage account's encryption type must be explicitly set to 'Customer-managed keys' to use CMK from Azure Key Vault. If the encryption type remains at the default 'Microsoft-managed keys', newly uploaded blobs will continue to be encrypted with Microsoft-managed keys regardless of the CMK configuration in Key Vault. Infrastructure encryption is a separate feature that encrypts data at the hardware level and does not affect the key management type.

Answer

The storage account was created before infrastructure encryption was generally available

Answer

The customer-managed key in Key Vault is disabled or expired

Answer

The blob container has a policy that overrides the encryption setting

Question 2

An organization wants to export Defender for Cloud recommendations and alerts into a central Log Analytics workspace for retention and hunting. Which feature should they use?

Accepted Answer

Continuous export. Continuous export is the correct feature because it allows you to stream Defender for Cloud security alerts and recommendations to a Log Analytics workspace for long-term retention and custom hunting queries. This feature supports both real-time and scheduled export of security data, enabling centralized monitoring and compliance auditing. It directly addresses the requirement to export Defender for Cloud data into a Log Analytics workspace without additional third-party tools.

Answer

Microsoft Defender External Attack Surface Management

Answer

Microsoft Entra access reviews

Answer

Azure Monitor autoscale

Question 3

A company uses Microsoft Defender for Cloud. They want to receive alerts when a virtual machine has a vulnerability that is rated 'Critical' by the integrated vulnerability assessment solution. Which Defender for Cloud plan must be enabled?

Accepted Answer

Defender for Servers plan (P2 or P1). The integrated vulnerability assessment solution in Microsoft Defender for Cloud relies on the Qualys or Microsoft Defender Vulnerability Management (MDVM) agent, which is only available with the Defender for Servers plan. The P2 tier includes the full vulnerability assessment capabilities, while P1 provides foundational coverage; both can generate alerts for critical vulnerabilities. Without this plan, the vulnerability assessment engine is not active, so no critical alerts will be produced.

Answer

Defender for Cloud's free foundational CSPM

Answer

Defender for Storage plan

Answer

Defender for SQL plan

Question 4

A company has an Azure virtual network with a subnet that hosts a web application. They need to allow inbound HTTP (port 80) and HTTPS (port 443) traffic from a specific source IP range (203.0.113.0/24) to the web servers. Additionally, they need to allow inbound RDP (port 3389) traffic from a management subnet (10.0.1.0/24). They want to block all other inbound traffic. They are using a network security group (NSG) associated with the subnet. What is the minimum number of inbound security rules required?

Accepted Answer

3. The correct answer is A (3 rules) because an NSG includes default rules that already block all inbound traffic by default. You only need explicit allow rules for the three permitted traffic types: HTTP (port 80) from 203.0.113.0/24, HTTPS (port 443) from 203.0.113.0/24, and RDP (port 3389) from 10.0.1.0/24. The default deny rule handles blocking all other traffic, so no additional deny rule is required.

Answer

4

Answer

5

Answer

2

Question 5

A company has a hub-spoke network topology in Azure. They need to inspect and filter all traffic flowing between spoke virtual networks for malicious content and require that the inspection is stateful. Which Azure-native service should they deploy in the hub virtual network to meet this requirement?

Accepted Answer

Azure Firewall. Azure Firewall is the correct choice because it is a fully stateful, managed firewall service that can inspect and filter traffic at Layers 3–7. In a hub-spoke topology, deploying Azure Firewall in the hub virtual network allows it to centrally inspect all traffic flowing between spoke virtual networks via forced tunneling (user-defined routes) or through the hub's network virtual appliance, meeting the requirement for stateful inspection of inter-spoke traffic.

Answer

Network Security Groups (NSG) on the peering connections

Answer

Azure Application Gateway with WAF

Answer

Azure DDoS Protection Standard

Question 6

A company enabled Azure Disk Encryption on Windows virtual machines using Azure Key Vault to store encryption keys. They have enabled soft-delete and purge protection on the Key Vault. After a user accidentally deletes a key, the company tries to recover it but the recovery operation fails. What is the most likely reason for the recovery failure?

Accepted Answer

The key vault firewall is blocking access from the VM's virtual network.. The key recovery operation fails because the Key Vault firewall is blocking the recovery request from the VM's virtual network. Even though soft-delete and purge protection are enabled, the firewall rules prevent the VM from communicating with the Key Vault to perform the recovery. The recovery operation requires network access to the Key Vault endpoint, and if the firewall is configured to deny traffic from the VM's subnet, the operation will fail.

Answer

The key vault is in a different Azure region than the VM.

Answer

The key was not created with soft-delete enabled.

Answer

The VM's managed identity does not have 'Key Vault Crypto Service Encryption User' permission.

Question 7

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Azure AD, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Azure AD tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 8

A Defender for Cloud recommendation is valid for most subscriptions but not for a legacy subscription with an approved exception. The team wants secure score to reflect the exception without disabling the recommendation everywhere. What should they do?

Accepted Answer

Create an exemption for the affected scope with a justification. Option C is correct because Azure Policy exemptions allow you to exclude a specific scope (e.g., a subscription or resource group) from a policy or initiative effect while still having the policy enforced elsewhere. By creating an exemption for the legacy subscription with a justification, the Defender for Cloud recommendation remains active for all other subscriptions, and the secure score calculation will correctly reflect the exception without disabling the recommendation globally.

Answer

Delete the built-in initiative from the management group

Answer

Change the recommendation severity to Low

Answer

Disable Defender for Cloud on the legacy subscription

Question 9

A company deploys Azure Firewall in a hub VNet to inspect all outbound traffic from a spoke VNet. They enable VNet peering between the hub and spoke. They create a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop, and associate it with the spoke subnets. However, outbound traffic from the spoke subnets is still going directly to the internet, bypassing the firewall. What is the most likely cause?

Accepted Answer

The route table's next hop type is not set to 'Virtual appliance'. The most likely cause is that the route table's next hop type is not set to 'Virtual appliance'. When creating a custom route in Azure, the next hop type must be explicitly set to 'Virtual appliance' and the next hop address must be the firewall's private IP. If the next hop type is left as 'Internet' or another value, Azure will ignore the custom route and use the default system route for 0.0.0.0/0, which sends traffic directly to the internet without inspection.

Answer

The route table is not associated with the subnet

Answer

The hub-spoke peering is not configured correctly

Answer

Azure Firewall is in a different resource group

Question 10

A company has a virtual network with a subnet hosting Azure VMs. They want to restrict all inbound traffic to only allow HTTPS (port 443) from the internet, but also allow SSH (port 22) only from a specific management IP address range (e.g., 203.0.113.0/24). Which Azure service should they use to achieve this filtering?

Accepted Answer

Network Security Group (NSG) rule. A Network Security Group (NSG) rule is the correct choice because NSGs provide stateful, granular inbound and outbound filtering at the subnet or NIC level. You can create a rule to allow HTTPS (TCP/443) from any source (Internet) and a separate rule to allow SSH (TCP/22) only from the specific management IP range 203.0.113.0/24, while implicitly denying all other inbound traffic. NSGs are the native Azure service for this type of traffic filtering and do not require additional cost or deployment.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Azure Bastion

Question 11

A company has an Azure virtual network with multiple subnets. They want to centrally inspect and log all outbound traffic to the internet. They also need to allow or deny traffic based on domain names (FQDNs). Which Azure resource should they deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It supports application rules based on fully qualified domain names (FQDNs), enabling allow or deny decisions for outbound traffic to the internet using Layer 7 (application layer) filtering, which meets both requirements directly.

Answer

Network Virtual Appliance (NVA) from Azure Marketplace

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Network Security Groups (NSGs)

Question 12

A security operations team uses Microsoft Sentinel. They want to automatically assign incidents to different tiers of analysts based on severity when incidents are created. Which feature should they configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on criteria such as severity. When an incident is created, the automation rule triggers and can set the owner (assignee) to a predefined user or group, enabling tiered assignment without manual intervention.

Answer

Fusion - Advanced Multistage Attack Detection

Answer

Analytics rules with scheduled queries

Answer

Playbooks

Question 13

A company is setting up a site-to-site VPN between an on-premises network and an Azure virtual network using an Azure VPN gateway. The security policy mandates that the VPN tunnel must use the strongest available encryption and authentication. Which IPsec/IKE parameter combination should they configure on both sides?

Accepted Answer

IKEv2 with AES256. Option A is correct because IKEv2 is the most secure and modern IPsec/IKE protocol, supporting stronger encryption algorithms like AES256. AES256 provides the highest level of encryption strength among the options, meeting the mandate for the strongest available encryption and authentication. IKEv2 also offers improved resilience and security features over IKEv1, such as built-in NAT traversal and mobility support.

Answer

IKEv1 with DES

Answer

IKEv2 with 3DES

Answer

IKEv1 with AES128

Question 14

A company has an Azure virtual network with a subnet hosting web servers. The security policy requires that all inbound HTTP traffic must be sourced from a specific IP address range (203.0.113.0/24). All other inbound traffic must be denied. The subnet is associated with a network security group (NSG). Which set of inbound rules should they configure?

Accepted Answer

Allow HTTP from 203.0.113.0/24 (priority 100), then Deny all inbound (priority 200). Option A is correct because NSG rules are evaluated in priority order (lowest number first). The Allow rule for HTTP from 203.0.113.0/24 at priority 100 permits the desired traffic, and the subsequent Deny all inbound rule at priority 200 blocks all other traffic, including HTTP from any other source. This satisfies the security policy of allowing only HTTP from the specified IP range and denying everything else.

Answer

Deny all inbound (priority 100), then Allow HTTP from 203.0.113.0/24 (priority 200)

Answer

Allow HTTP from any (priority 100), then Deny all inbound (priority 200)

Answer

Only Allow HTTP from 203.0.113.0/24 (priority 100) with no explicit deny

Question 15

A company has an Azure virtual network (VNet) with multiple subnets. They deploy Azure Firewall in a hub VNet and peer spoke VNets. They want to force-tunnel all outbound traffic from a specific spoke subnet to the firewall for inspection. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. However, traffic is still bypassing the firewall. What is the most likely cause?

Accepted Answer

The route table on the spoke subnet has 'Propagate gateway routes' enabled, causing a conflicting route from the hub's VPN gateway. Option B is correct because when 'Propagate gateway routes' is enabled on the spoke subnet's route table, the VNet peering with the hub (which may have a VPN or ExpressRoute gateway) injects a system route for 0.0.0.0/0 with a next hop of the virtual gateway. This system route has a lower (better) route preference than the user-defined route (UDR) pointing to the Azure Firewall, causing traffic to bypass the firewall and go directly to the gateway.

Answer

The Azure Firewall subnet is missing a route table entry for the 0.0.0.0/0 route

Answer

The VNet peering does not allow forwarded traffic from the spoke to the firewall

Answer

The Azure Firewall is not configured with the 'Allow outbound traffic' rule