AZ-500 Practice Test 15 — 15 Questions

Question 1

A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The route table is not associated with the spoke subnet.. The most likely reason is that the route table containing the default route (0.0.0.0/0) pointing to the Azure Firewall private IP has not been associated with the spoke subnet. Without this association, the subnet continues to use system routes, which include a default route to the internet via the Azure default gateway, allowing traffic to bypass the firewall. Associating the route table with the subnet is a required step to override the system default route.

Answer

Azure Firewall is not configured with DNAT rules for outbound traffic.

Answer

The spoke VNet peering does not allow gateway transit.

Answer

The route table has a higher priority than system routes.

Question 2

A company has a virtual network with a subnet hosting Azure VMs. They want to restrict all inbound traffic to only allow HTTPS (port 443) from the internet, but also allow SSH (port 22) only from a specific management IP address range (e.g., 203.0.113.0/24). Which Azure service should they use to achieve this filtering?

Accepted Answer

Network Security Group (NSG) rule. A Network Security Group (NSG) rule is the correct choice because NSGs provide stateful, granular inbound and outbound filtering at the subnet or NIC level. You can create a rule to allow HTTPS (TCP/443) from any source (Internet) and a separate rule to allow SSH (TCP/22) only from the specific management IP range 203.0.113.0/24, while implicitly denying all other inbound traffic. NSGs are the native Azure service for this type of traffic filtering and do not require additional cost or deployment.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Azure Bastion

Question 3

A company has an Azure virtual network with multiple subnets. They want to centrally inspect and log all outbound traffic to the internet. They also need to allow or deny traffic based on domain names (FQDNs). Which Azure resource should they deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It supports application rules based on fully qualified domain names (FQDNs), enabling allow or deny decisions for outbound traffic to the internet using Layer 7 (application layer) filtering, which meets both requirements directly.

Answer

Network Virtual Appliance (NVA) from Azure Marketplace

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Network Security Groups (NSGs)

Question 4

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

Accepted Answer

Configure a Conditional Access policy that requires that the device be marked as compliant. A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.

Answer

Configure a device registration policy

Answer

Configure an Identity Protection policy for user risk

Answer

Configure a Conditional Access policy that requires multi-factor authentication

Question 5

Drag and drop the steps to assign an Azure RBAC role to a user at the resource group scope into the correct order.

Accepted Answer

Navigate to the resource group, then open Access control (IAM), then add a role assignment, then select a role, then select a user, then review and assign.. IAM is used for RBAC, and you add a role assignment by selecting the role and assigning it to a user.

Answer

Select a role, then navigate to the resource group, then open Access control (IAM), then add a role assignment, then select a user, then review and assign.

Answer

Select a user, then navigate to the resource group, then open Access control (IAM), then add a role assignment, then select a role, then review and assign.

Answer

Navigate to the subscription, then open Access control (IAM), then add a role assignment, then select a role, then select a user, then review and assign.

Question 6

An organization uses Microsoft Defender for Cloud. They want to implement just-in-time (JIT) VM access for a set of production VMs. However, the security team needs to ensure that JIT access requests are always approved by a manager before opening ports. Which configuration should they use?

Accepted Answer

Enable JIT and configure a custom workflow automation with an approval step. Microsoft Defender for Cloud's JIT VM access can be integrated with a custom workflow automation that includes an approval step. This allows the security team to enforce manager approval before ports are opened, meeting the requirement for a formal approval process. The workflow automation can trigger an Azure Logic App or other action that requires a designated approver to authorize the request.

Answer

Enable JIT in Defender for Cloud and configure a logic app to send approval emails

Answer

Use Azure AD Privileged Identity Management (PIM) for JIT activation

Answer

Use Conditional Access with session controls

Question 7

You are configuring Azure Private Link for a SQL Database. You want to ensure that all traffic from your virtual network to the SQL Database stays within the Microsoft Azure backbone network. What is the primary benefit of using Azure Private Link over a service endpoint?

Accepted Answer

Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.. Azure Private Link exposes the SQL Database as a private endpoint within your virtual network, assigning it a private IP address from your VNet's address space. This ensures that all traffic to the database stays on the Microsoft backbone network and never traverses the public internet, which is the primary benefit over a service endpoint. Service endpoints still route traffic to the public endpoint of the SQL Database, even though the source traffic originates from the VNet.

Answer

Private Link provides higher throughput than service endpoints.

Answer

Private Link enables access to the SQL Database from on-premises via VPN/ExpressRoute without traversing the internet.

Answer

Private Link allows you to use NSGs to filter traffic to the SQL Database.

Question 8

A company has an Azure virtual network with a subnet hosting web servers. The security policy requires that all inbound HTTP traffic must be sourced from a specific IP address range (203.0.113.0/24). All other inbound traffic must be denied. The subnet is associated with a network security group (NSG). Which set of inbound rules should they configure?

Accepted Answer

Allow HTTP from 203.0.113.0/24 (priority 100), then Deny all inbound (priority 200). NSG rules are evaluated in priority order (lowest number first). The Allow rule for HTTP from 203.0.113.0/24 at priority 100 permits the desired traffic, and the subsequent Deny all inbound rule at priority 200 blocks all other traffic, including HTTP from any other source. This satisfies the security policy of allowing only HTTP from the specified IP range and denying everything else.

Answer

Deny all inbound (priority 100), then Allow HTTP from 203.0.113.0/24 (priority 200)

Answer

Allow HTTP from any (priority 100), then Deny all inbound (priority 200)

Answer

Only Allow HTTP from 203.0.113.0/24 (priority 100) with no explicit deny

Question 9

Which THREE components are part of Azure Disk Encryption for Windows VMs?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption is the correct component because Azure Disk Encryption for Windows VMs leverages BitLocker to provide volume-level encryption for the OS and data disks. BitLocker is the native Windows technology that encrypts the entire volume, ensuring data at rest is protected within Azure managed disks.

Answer

DM-Crypt

Answer

Microsoft Entra ID (Azure AD)

Question 10

A company stores critical business data in an Azure Storage account (Blob Storage). They want to ensure that all data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data quickly if a breach is suspected. Which feature should they enable on the storage account to enforce CMK?

Accepted Answer

Enable Azure Storage encryption with customer-managed keys. Enabling Azure Storage encryption with customer-managed keys (CMK) allows you to use your own key stored in Azure Key Vault to encrypt all data at rest in the storage account. This also provides the ability to revoke access to the data quickly by disabling, deleting, or rotating the key in Key Vault, which renders the data inaccessible until the key is restored.

Answer

Enable infrastructure encryption for the storage account

Answer

Enable soft delete for blobs

Answer

Enable versioning for blobs

Question 11

Which TWO of the following are valid ways to integrate Microsoft Sentinel with Microsoft Defender XDR?

Accepted Answer

Configure the Microsoft Defender XDR data connector. The Microsoft Defender XDR data connector is the official and supported method to ingest alerts and incidents from Microsoft Defender XDR into Microsoft Sentinel. This connector enables bi-directional synchronization, allowing incidents created in Defender XDR to appear in Sentinel and vice versa, with automatic correlation and enrichment.

Answer

Use Azure Lighthouse to connect Defender XDR to Sentinel

Answer

Deploy a playbook that polls Defender XDR APIs

Answer

Create a custom log analytics workspace query

Question 12

Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?

Accepted Answer

Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.. Enabling the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level automatically enables Advanced Threat Protection (ATP) for all existing and future Azure SQL databases within that subscription. This approach requires minimal administrative effort because it applies the protection globally without needing to configure each database individually or create custom policies. Microsoft Defender for Cloud manages the ATP settings centrally, ensuring consistent security coverage across the entire subscription.

Answer

Configure Microsoft Sentinel to monitor Azure SQL databases.

Answer

Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.

Answer

Enable Advanced Threat Protection on each Azure SQL database individually.

Question 13

Your organization uses Microsoft Sentinel to monitor security events. You need to configure automated response actions for incidents. Which TWO of the following can be used to trigger automated responses in Microsoft Sentinel?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, based on conditions like severity or specific analytics rules. They can run playbooks (Azure Logic Apps) to execute complex workflows, such as sending notifications or creating tickets, without manual intervention.

Answer

Workbooks

Answer

Watchlists

Answer

Hunting queries

Question 14

Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?

Accepted Answer

Security recommendations for resources. CSPM in Microsoft Defender for Cloud continuously assesses Azure resources against built-in security policies and industry best practices, generating actionable security recommendations to harden the environment. These recommendations are derived from the Azure Security Benchmark and are displayed in the Recommendations blade, directly influencing the Secure Score.

Answer

Vulnerability scanning of containers

Answer

Threat detection for VMs

Question 15

Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)

Accepted Answer

Appropriate permissions (Security Administrator or Global Administrator). Integrating Microsoft Sentinel with Microsoft Defender XDR requires the user to have either Security Administrator or Global Administrator roles in Azure Active Directory. These permissions are necessary to grant consent for the data connector and to configure cross-tenant or cross-service access policies that enable Defender XDR to send incident and alert data to Sentinel.

Answer

The Microsoft Monitoring Agent installed on all endpoints

Answer

An Azure Sentinel workspace in the same region as the Microsoft 365 tenant