AZ-500 Practice Test 14 — 15 Questions

Question 1

A company has virtual networks in East US and West US connected via global VNet peering. The security policy requires that all traffic between the peered VNets be encrypted using IPsec. Which action should the company take to meet this requirement?

Accepted Answer

Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.. VNet peering does not encrypt traffic between peered virtual networks by default; it relies on the Microsoft backbone network. To enforce IPsec encryption for all traffic between the peered VNets, you must deploy an Azure VPN Gateway in each VNet and configure a site-to-site VPN connection between them. This creates an encrypted tunnel using IPsec/IKE protocols, satisfying the security policy requirement.

Answer

Enable the 'Allow gateway transit' setting on the VNet peering.

Answer

Enable 'Use remote gateways' on the VNet peering.

Answer

Configure Azure Firewall to encrypt the traffic between the VNets.

Question 2

A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks. The application consists of a single App Service instance. Which Azure DDoS Protection tier should they enable to meet this requirement while minimizing cost?

Accepted Answer

Basic. Azure DDoS Protection Basic is automatically enabled at no additional cost for all Azure services, including App Service. It provides always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks, which meets the requirement to protect the public-facing web application. Since the company wants to minimize cost and only needs Layer 3/4 protection for a single App Service instance, the Basic tier is sufficient.

Answer

Standard

Answer

Premium

Answer

No protection is needed because Azure App Service is inherently protected against DDoS attacks.

Question 3

A company has multiple Azure virtual networks connected via VNet peering. They want to ensure that all traffic between the peered VNets is encrypted and that no traffic can bypass the encryption. Which configuration is required?

Accepted Answer

Use VPN Gateway with IPsec between VNets. VNet peering does not encrypt traffic between virtual networks by default. To enforce encryption for all traffic, you must use a VPN Gateway with IPsec/IKE policy configured between the peered VNets. This ensures that all traffic crossing the peering is encrypted and that no unencrypted path exists, meeting the requirement that no traffic can bypass encryption.

Answer

Enable Service Endpoint Policies

Answer

VNet peering does not support encryption; use Global VNet peering

Answer

Enable Azure Firewall

Question 4

A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?

Accepted Answer

The route table is not associated with the spoke subnet.. The most likely reason is that the route table containing the default route (0.0.0.0/0) pointing to the Azure Firewall private IP has not been associated with the spoke subnet. Without this association, the subnet continues to use system routes, which include a default route to the internet via the Azure default gateway, allowing traffic to bypass the firewall. Associating the route table with the subnet is a required step to override the system default route.

Answer

Azure Firewall is not configured with DNAT rules for outbound traffic.

Answer

The spoke VNet peering does not allow gateway transit.

Answer

The route table has a higher priority than system routes.

Question 5

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

Accepted Answer

Azure AD Application Proxy.. Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Answer

Azure AD B2C (Business-to-Consumer).

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Front Door.

Question 6

A company uses a hub-spoke network topology in Azure. They need to inspect and filter all traffic flowing between spoke virtual networks for security compliance. Which Azure-native service should be deployed in the hub virtual network to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a fully managed, stateful firewall-as-a-service that can inspect and filter traffic between spoke virtual networks when deployed in the hub VNet. It supports application (FQDN) and network (IP/port/protocol) rules, and can enforce security compliance by logging and blocking non-compliant traffic. Unlike a Network Virtual Appliance (NVA), Azure Firewall is a native PaaS service with built-in high availability and auto-scaling, making it the recommended choice for hub-spoke traffic inspection.

Answer

Network Virtual Appliance (NVA)

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Question 7

A company has multiple on-premises web applications that need to be securely published for remote employees. The company uses Azure AD for identity management and wants to apply Conditional Access policies, including multi-factor authentication, to these applications. The security team wants to avoid exposing the on-premises infrastructure to the internet directly. Which Azure service should they deploy to meet these requirements?

Accepted Answer

Azure AD Application Proxy. Azure AD Application Proxy is the correct service because it provides secure remote access to on-premises web applications without requiring a VPN or opening inbound firewall ports. It integrates natively with Azure AD, enabling Conditional Access policies such as multi-factor authentication (MFA) to be applied to these applications. The service works by establishing an outbound-only connection from the on-premises Application Proxy connector to Azure AD, ensuring the on-premises infrastructure is never directly exposed to the internet.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 8

A company uses Azure AD Privileged Identity Management (PIM) for the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a justification, and the activation requires approval from a designated security group. Which PIM role settings should they configure?

Accepted Answer

Require justification on activation (Yes), Require approval (Yes), Select approver(s) (the security group).. Option A is correct because PIM role settings allow administrators to enforce both justification and approval workflows for role activation. Setting 'Require justification on activation' to 'Yes' ensures the user provides a reason, and setting 'Require approval' to 'Yes' with the designated security group as the approver enforces the approval requirement. This combination directly meets the company's stated requirements.

Answer

Require justification on activation (No), Require approval (Yes), Select approver(s) (the security group).

Answer

Expiration > Maximum activation duration (4 hours).

Answer

On activation, require Azure MFA registration.

Question 9

A company has an Azure virtual network with two subnets: Frontend and Backend. They deploy a network virtual appliance (NVA) in a subnet named NVA_Subnet. They want to route all traffic from the Frontend subnet to the Backend subnet through the NVA for inspection. What is the minimum number of route tables required to achieve this traffic steering?

Accepted Answer

1. A single route table can be associated with the Frontend subnet and configured with a user-defined route (UDR) that has the NVA's private IP as the next hop for traffic destined to the Backend subnet. This ensures all traffic from Frontend to Backend is forwarded to the NVA for inspection. No additional route tables are needed because the NVA itself handles the routing decision after inspection, and the Backend subnet does not require a specific route to return traffic unless asymmetric routing is a concern.

Answer

2

Answer

3

Answer

4

Question 10

A security team wants to use Microsoft Sentinel to detect potential data exfiltration events from Azure Blob Storage. Which two logs should they ingest to best identify unauthorized read access and data transfer activities? (Choose two.)

Accepted Answer

Storage account audit logs (e.g., StorageReadKey, GetBlob). Option A is correct because Storage account audit logs (e.g., StorageReadKey, GetBlob) capture detailed data-plane operations, including read access to blobs and keys, which directly indicates potential data exfiltration. Option B is correct because the Azure Activity log for storage account write operations records management-plane events like storage account key regeneration, which can be used to bypass existing access controls and exfiltrate data. Together, these logs provide visibility into both the data access and the administrative actions that could enable exfiltration.

Answer

Azure AD sign-in logs

Answer

Azure Key Vault audit logs

Question 11

A security operations team uses Microsoft Sentinel. They are investigating a security incident that involves multiple alerts from different Azure resources. They need to see the entire attack timeline and all related entities (such as user accounts, IP addresses, and hosts) in a single, visual graph to understand the scope of the attack. Which Microsoft Sentinel feature should they use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually map the relationships between alerts, entities (such as user accounts, IP addresses, and hosts), and the attack timeline. It allows security analysts to explore the scope of an incident by interactively expanding nodes and viewing connections, which directly meets the requirement for a single visual graph showing the entire attack timeline and related entities.

Answer

Incident dashboard

Answer

Entity behavior analytics (UEBA)

Answer

Threat hunting blade

Question 12

A security team is reviewing risky OAuth applications in Microsoft Entra ID. Which two actions reduce future consent risk?

Accepted Answer

Restrict user consent to verified publishers and low-risk permissions. Option A is correct because restricting user consent to verified publishers and low-risk permissions reduces the likelihood of users approving malicious or overly permissive OAuth apps. This policy, configured in Microsoft Entra ID (Azure AD), ensures that only apps from verified publishers requesting low-risk permissions can be consented to by users, thereby mitigating consent-based attacks like OAuth consent phishing.

Answer

Grant tenant-wide admin consent to all existing apps

Answer

Delete all enterprise applications including Microsoft first-party apps

Question 13

A security analyst is using Microsoft Sentinel to detect multi-stage attacks. They want to create an analytics rule that correlates a user sign-in from an unusual location with a subsequent data exfiltration attempt from Azure Blob Storage within one hour. Which type of analytics rule should they use?

Accepted Answer

Scheduled query rule with entity mapping.. A scheduled query rule with entity mapping is correct because it allows the security analyst to write a KQL query that correlates two distinct events—a sign-in from an unusual location and a subsequent data exfiltration from Azure Blob Storage—within a defined time window (one hour). Entity mapping enables the rule to link these events by common entities (e.g., user account or IP address), which is essential for detecting multi-stage attacks. This rule type runs on a schedule, making it ideal for time-bound correlation queries.

Answer

Fusion rule.

Answer

Microsoft Security incident rule.

Answer

Anomaly rule.

Question 14

A company uses Microsoft Defender for Cloud. The security team wants to receive a weekly email digest that includes the current Secure Score, the number of healthy and unhealthy resources, and a list of top recommendations. Which Defender for Cloud feature should they configure?

Accepted Answer

Email notifications for alerts and weekly digests. Option C is correct because Microsoft Defender for Cloud provides a built-in 'Email notifications for alerts and weekly digests' feature that allows security teams to configure a weekly email containing the current Secure Score, the number of healthy and unhealthy resources, and a list of top recommendations. This feature is specifically designed to deliver a summary of the security posture directly to recipients without requiring manual export or custom automation.

Answer

Regulatory Compliance dashboard

Answer

Security policies

Answer

Continuous Export

Question 15

A security analyst uses Microsoft Sentinel. They have created a playbook that tags Azure VMs as 'isolated' when a high-severity malware alert is triggered. They want this playbook to run automatically whenever a related alert is generated. Which feature should they configure?

Accepted Answer

Automation rule.. Automation rules in Microsoft Sentinel allow you to define triggers that automatically run playbooks when specific alerts or incidents are created. In this scenario, the playbook tags Azure VMs as 'isolated' upon a high-severity malware alert, and an automation rule can be configured to run that playbook automatically whenever such an alert is generated, without manual intervention.

Answer

Scheduled analytics rule.

Answer

Incident creation rule.

Answer

Workbook.