AZ-500 Practice Test 16 — 15 Questions

Question 1

A team enables Microsoft Defender for Storage. Which two threats can the plan help detect?

Accepted Answer

Access from suspicious IP addresses to storage accounts. Microsoft Defender for Storage detects anomalous activities that could indicate threats to storage accounts. Option A is correct because the service analyzes incoming requests to identify access from suspicious IP addresses, such as known malicious IPs or Tor exit nodes, using threat intelligence feeds. Option D is correct because when malware scanning is enabled, Defender for Storage can detect malware uploaded to Blob Storage by scanning files for known malicious signatures.

Answer

Expired Azure AD PIM role assignments

Answer

Public IP address creation on virtual machines

Question 2

A Kubernetes workload in AKS needs to pull images from Azure Container Registry without using admin credentials. Which configuration should be used?

Accepted Answer

Grant the AKS kubelet identity AcrPull on the registry. The AKS cluster uses a kubelet identity (managed identity) to authenticate with ACR. By granting the AcrPull role to this identity, the kubelet can pull container images without requiring admin credentials, as Azure RBAC handles the authentication via Microsoft Entra ID tokens. This is the recommended secure method for image pull operations.

Answer

Enable anonymous pull access on the registry

Answer

Store the ACR admin password in a ConfigMap

Answer

Expose the registry through a public load balancer

Question 3

A DevOps team wants Defender for Cloud to identify secrets exposed in GitHub repositories. What should be configured?

Accepted Answer

Defender for Cloud DevOps Security connector. Defender for Cloud's DevOps Security connector integrates with GitHub to scan repositories for exposed secrets (e.g., API keys, tokens) using Microsoft's secret scanning engine. This connector enables Defender for Cloud to monitor commits and pull requests, alerting on secrets detected in code. It is the correct solution because it directly addresses the requirement to identify secrets in GitHub repositories within the Defender for Cloud ecosystem.

Answer

Azure Bastion native client

Answer

Sentinel Syslog connector

Answer

Azure Storage lifecycle management

Question 4

A security team wants to visualize MITRE ATT&CK coverage for Microsoft Sentinel analytics rules. Which Sentinel experience should they use?

Accepted Answer

MITRE ATT&CK coverage in analytics/content hub views. The MITRE ATT&CK coverage view in the Microsoft Sentinel analytics/content hub provides a direct mapping between configured analytics rules and specific MITRE ATT&CK techniques. This allows security teams to visually identify gaps in detection coverage by seeing which techniques are covered by active rules and which are not, enabling targeted rule deployment.

Answer

Hunting bookmarks

Answer

Watchlists

Answer

Data collection endpoints

Question 5

A company manages Azure AD roles with Privileged Identity Management (PIM). They want to enforce that when a user activates the Global Administrator role, they must provide a justification and also use Multi-Factor Authentication. Which PIM settings should they configure? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication on activation.. PIM allows you to enforce Multi-Factor Authentication (MFA) as a mandatory step during role activation, ensuring the user's identity is verified beyond just a password. Option C is correct because PIM's 'Require justification on activation' setting forces the user to provide a business reason for activating the Global Administrator role, which is a common compliance requirement. Together, these two settings satisfy the requirement for both MFA and justification during activation.

Answer

Require approval on activation.

Answer

Extend activation duration.

Question 6

A team wants Sentinel to ingest firewall logs from an appliance that emits Common Event Format over Syslog. Which connector pattern is most appropriate?

Accepted Answer

CEF connector using a Linux log forwarder or AMA-supported collection path. The Common Event Format (CEF) over Syslog is a standard logging format used by many security appliances. Sentinel's CEF connector is specifically designed to ingest these logs, typically using a Linux log forwarder (rsyslog or syslog-ng) or the Azure Monitor Agent (AMA) with a Data Collection Rule to parse and forward the CEF messages to the Log Analytics workspace.

Answer

Azure Activity connector

Answer

Microsoft Entra ID Protection connector

Answer

Office 365 connector

Question 7

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections use at least TLS 1.2 encryption and that connections not meeting this requirement are rejected. Which configuration should they implement on the Azure SQL Server?

Accepted Answer

Set the 'Minimum TLS version' on the SQL server. Azure SQL Server allows you to enforce a minimum TLS version for all client connections. By setting the 'Minimum TLS version' to 1.2, the server will reject any connection attempt using TLS 1.0 or 1.1, ensuring compliance with the security policy that requires at least TLS 1.2 encryption.

Answer

Configure firewall rules to allow only trusted IP addresses

Answer

Enable Transparent Data Encryption (TDE)

Answer

Enable Advanced Threat Protection (ATP)

Question 8

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Accepted Answer

Configure Dynamic Data Masking (DDM) for the PII columns.. (Dynamic Data Masking) masks PII columns for non-privileged users. Option C (Minimum TLS Version 1.2) ensures data in transit is encrypted. Option D (Transparent Data Encryption) encrypts data at rest. Option B (Always Encrypted) is client-side and requires client support, not suitable for legacy apps. Option E (Azure Information Protection) is not a database security feature for this scenario.

Answer

Implement Always Encrypted for the PII columns.

Answer

Apply Azure Information Protection labels to the database.

Question 9

A security team uses Microsoft Sentinel. They have created a playbook that isolates a virtual machine by modifying a network security group rule. They want this playbook to execute automatically whenever a new incident of type 'Suspicious VM activity' is created. Which Microsoft Sentinel feature should they use to trigger the playbook?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define triggers that automatically run playbooks when incidents are created or updated. In this scenario, the automation rule can be configured to trigger on incident creation with the condition 'Suspicious VM activity' and then execute the playbook that modifies the NSG rule to isolate the VM. This is the correct mechanism because automation rules are designed specifically for incident-based triggers, unlike analytics rules which generate alerts or incidents.

Answer

Analytics rule

Answer

Playbook

Answer

Hunt

Question 10

A KQL query in Microsoft Sentinel detects impossible travel but returns many false positives from known VPN egress IP addresses. Which two changes would best reduce noise while preserving useful detections?

Accepted Answer

Join or filter against a watchlist of approved VPN egress IPs. Integrating a watchlist of known VPN egress IPs allows the KQL query to filter out these trusted IPs, reducing false positives from impossible travel detections. Option C is also correct because excluding events where the source IP is in an approved network list directly removes noise from legitimate VPN traffic, preserving detection of truly anomalous sign-ins. Both approaches leverage Sentinel's watchlist or allowlist capabilities to maintain detection fidelity while minimizing alert fatigue.

Answer

Disable the SigninLogs connector for the tenant

Answer

Raise the query frequency from 1 hour to 24 hours

Question 11

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They want to ensure that when a user activates the role, the activation request must be approved by a member of the 'Global Admin Approvers' group, and the activation should be time-bound with a maximum of 4 hours. Which PIM settings should they configure?

Accepted Answer

Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.. Microsoft Entra PIM allows you to configure role activation settings, including an activation maximum duration (which can be set to 4 hours) and requiring approval from a specified group (in this case, 'Global Admin Approvers'). These settings directly meet the requirement for time-bound activation with approval.

Answer

Set the activation maximum duration to 4 hours and enable MFA on activation.

Answer

Set the activation to require a ticket number justification and set the maximum duration to 8 hours.

Answer

Set the role to be permanently active but with a just-in-time approval workflow.

Question 12

A company stores sensitive healthcare data in Azure SQL Database. They need to encrypt specific columns containing patient diagnosis codes so that even database administrators with the 'sysadmin' role cannot view the plaintext. The application must be able to perform equality searches (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted (deterministic encryption). Always Encrypted with deterministic encryption ensures that sensitive columns are encrypted at the client side, so the encryption keys are never revealed to the database engine, including sysadmin roles. Deterministic encryption generates the same ciphertext for the same plaintext, enabling equality searches (WHERE clauses) on encrypted columns without exposing plaintext data to the server.

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security (RLS)

Answer

Dynamic Data Masking (DDM)

Question 13

A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) policy.. Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.

Answer

Azure Firewall.

Answer

Network Security Groups on the VM subnet.

Answer

Azure DDoS Protection.

Question 14

A company uses Azure Active Directory (Azure AD) and wants to regularly review the membership of a group that grants access to a critical application. Each member must attest their continued need for access. Which Azure AD feature should they use?

Accepted Answer

Azure AD Identity Governance access reviews. Microsoft Entra ID Identity Governance access reviews enable administrators to create recurring reviews of group memberships, requiring each member to attest their continued need for access. This directly addresses the requirement for regular attestation of group membership for a critical application, as it automates the review process and ensures compliance.

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Conditional Access

Answer

Azure AD Identity Protection

Question 15

A company has an Azure virtual network with two subnets: App and Data. The App subnet hosts web servers, and the Data subnet hosts SQL databases. Security policy requires that only HTTPS traffic from the App subnet is allowed to the Data subnet, and all other inbound traffic to the Data subnet must be blocked. The solution must use a single network security group (NSG) associated to the Data subnet. Which NSG inbound rule configuration meets the requirement?

Accepted Answer

Allow HTTPS from App subnet priority 100, then Deny All priority 200. NSG rules are evaluated in priority order, with lower numbers processed first. By placing the Allow HTTPS rule at priority 100, it matches and permits traffic from the App subnet to the Data subnet. The subsequent Deny All rule at priority 200 then blocks all other inbound traffic, satisfying the security policy with a single NSG on the Data subnet.

Answer

Deny All priority 100, then Allow HTTPS from App subnet priority 200

Answer

Allow HTTPS from App subnet priority 100, and Deny All from any source priority 100 (duplicate priority)

Answer

Allow HTTPS from App subnet priority 100, no other rules