AZ-500 Practice Test 16 — 15 Questions

Question 1

Your company uses Azure Firewall to protect a virtual network. The security team needs to allow outbound HTTPS traffic from a specific subnet to a set of FQDNs, such as '*.contoso.com', while blocking all other outbound traffic. Which type of Azure Firewall rule should they configure?

Accepted Answer

An application rule with the 'Https' protocol and the target FQDNs set to '*.contoso.com'. Option B is correct because Azure Firewall application rules are specifically designed to allow outbound HTTP/HTTPS traffic based on fully qualified domain names (FQDNs). By configuring an application rule with protocol 'Https' and target FQDNs set to '*.contoso.com', the firewall inspects the TLS Server Name Indication (SNI) extension to match the requested domain, allowing traffic only to the specified FQDNs while blocking all other outbound traffic.

Answer

A network rule with destination port 443 and protocol TCP, and the destination IP address set to the resolved IPs of the FQDNs

Answer

A NAT rule that translates the source IP to a public IP and allows traffic to any destination on port 443

Answer

A DNAT rule that redirects outbound HTTPS traffic to an internal proxy server

Question 2

An Azure SQL Database must be accessed privately from workloads in a VNet and should not allow public network access. Which two configurations are required?

Accepted Answer

Create a Private Endpoint for the SQL server. A Private Endpoint assigns a private IP address from your VNet to the Azure SQL Database logical server, enabling traffic to reach the database entirely over the Microsoft backbone network without traversing the public internet. This is a fundamental requirement for private connectivity from workloads inside a VNet.

Answer

Enable service endpoint only and leave public access open

Answer

Create an inbound NAT rule on Azure Load Balancer

Question 3

A security team uses Microsoft Sentinel. They have created a playbook that isolates a virtual machine by modifying a network security group rule. They want this playbook to execute automatically whenever a new incident of type 'Suspicious VM activity' is created. Which Microsoft Sentinel feature should they use to trigger the playbook?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define triggers that automatically run playbooks when incidents are created or updated. In this scenario, the automation rule can be configured to trigger on incident creation with the condition 'Suspicious VM activity' and then execute the playbook that modifies the NSG rule to isolate the VM. This is the correct mechanism because automation rules are designed specifically for incident-based triggers, unlike analytics rules which generate alerts or incidents.

Answer

Analytics rule

Answer

Playbook

Answer

Hunt

Question 4

An organization has deployed Azure Firewall and wants to inspect all outbound traffic from a virtual network (VNet) to the internet. The VNet already contains subnets with workloads. What is the required networking configuration to force traffic through Azure Firewall?

Accepted Answer

Configure a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP and associate it with the subnets.. Option A is correct because Azure Firewall requires a route table with a default route (0.0.0.0/0) that has the Azure Firewall's private IP as the next hop, associated with each subnet whose traffic must be inspected. This forces all outbound traffic from those subnets to be routed through the firewall, enabling inspection and logging. Without this explicit route, traffic would use the default system route and bypass the firewall.

Answer

Add a Network Security Group (NSG) rule that allows all outbound traffic and associate it with the subnets.

Answer

Deploy an Application Gateway with Web Application Firewall (WAF) in front of the subnets.

Answer

Enable Azure DDoS Protection Standard on the VNet.

Question 5

A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?

Accepted Answer

Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.. Option B is correct because Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.

Answer

Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.

Answer

Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.

Answer

Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.

Question 6

An organization is deploying Microsoft Sentinel to centrally collect and analyze security events. They need to ingest logs from multiple on-premises Windows servers located behind a firewall. Which agent should they deploy on those servers?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data-collection agent for Microsoft Sentinel and Azure Monitor, designed to collect logs from Windows servers behind firewalls via outbound HTTPS (port 443) to the Log Analytics workspace. It supports data-collection rules (DCRs) for flexible, scalable ingestion and is the recommended replacement for the legacy Log Analytics agent. AMA can be deployed on-premises Windows servers using Azure Arc for management, ensuring secure log forwarding to Sentinel.

Answer

Log Analytics agent (Microsoft Monitoring Agent)

Answer

Azure Security Center agent

Answer

Azure Automation Agent

Question 7

An organization uses Microsoft Defender for Cloud. They want to allow specific administrators to temporarily open RDP (port 3389) to a virtual machine only when needed, and for a limited time, while minimizing management overhead. Which Defender for Cloud feature should they use?

Accepted Answer

Just-in-time (JIT) VM access. Just-in-time (JIT) VM access in Microsoft Defender for Cloud allows administrators to temporarily open RDP (port 3389) to a virtual machine for a limited time, reducing exposure to brute-force attacks. It integrates with Azure Network Security Groups (NSGs) and Azure Firewall to automatically lock down inbound traffic when not in use, minimizing management overhead by eliminating the need for manual NSG rule changes.

Answer

Azure Bastion

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Network Security Groups (NSGs)

Question 8

A security operations team uses Microsoft Sentinel. They want to create an automation that automatically changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is observed in the incident's entities. The playbook should run immediately when the incident is created. Which type of automation rule trigger should they configure?

Accepted Answer

When incident is created. Option A is correct because the requirement specifies that the automation should run immediately when the incident is created. In Microsoft Sentinel, an automation rule with the trigger 'When incident is created' executes a playbook as soon as the incident is generated, before any updates occur. This allows the playbook to evaluate the incident's entities (e.g., IP addresses, hashes) and change the severity from 'Medium' to 'High' if a specific IOC is present, meeting the real-time response need.

Answer

When incident is updated

Answer

When alert is generated

Answer

Scheduled

Question 9

A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?

Accepted Answer

Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.. Option B is correct because Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.

Answer

Data Collection Rules (DCR) in Azure Monitor.

Answer

Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.

Answer

Use Azure Automation State Configuration.

Question 10

A company has an Azure virtual network with a subnet that hosts a web application. The security team wants to allow inbound HTTPS traffic (port 443) from the internet to the web servers, but block all other inbound traffic. They have a network security group (NSG) associated with the subnet. What is the minimal set of inbound rules required?

Accepted Answer

A rule allowing HTTPS from Internet, and no other rules (default deny all inbound).. Network security groups (NSGs) in Azure have a default deny-all inbound rule (rule 65500) that is automatically applied to all inbound traffic. Therefore, you only need to add an explicit allow rule for HTTPS (port 443) from the Internet. No additional deny rule is required because the default rule already blocks all other inbound traffic.

Answer

A rule allowing HTTPS from Internet, and a default deny all rule.

Answer

A rule allowing HTTPS from Internet, and a rule explicitly denying all other inbound traffic.

Answer

A rule allowing HTTPS from any source, and a rule denying all other traffic with lower priority.

Question 11

A company has an Azure virtual network with a subnet that hosts a web application. They want to allow inbound HTTPS traffic from any source on the internet (0.0.0.0/0) and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required to achieve this?

Accepted Answer

One inbound rule allowing HTTPS from Internet.. Option B is correct because an NSG includes a set of default security rules that already block all inbound traffic not explicitly allowed. By adding a single inbound rule that allows HTTPS (TCP port 443) from the Internet (0.0.0.0/0), the default deny rule (DenyAllInbound) will block all other inbound traffic. Therefore, only one custom inbound rule is required to achieve the stated goal.

Answer

One inbound rule allowing HTTPS from Internet, and one inbound rule DenyAllInbound.

Answer

Two inbound rules: one allowing HTTPS from Internet, one allowing HTTP from Internet.

Answer

Two inbound rules: one allowing HTTPS from Internet, one allowing RDP from Internet.

Question 12

A security team uses Microsoft Sentinel. They want to create a custom detection rule that identifies a potential data exfiltration scenario: when a user signs in from an unusual location and then, within 30 minutes, performs a large download from Azure Blob Storage. They need to correlate sign-in logs from Azure AD with storage diagnostic logs. Which type of analytics rule should they create in Microsoft Sentinel?

Accepted Answer

A scheduled query rule using KQL. A scheduled query rule is correct because it allows you to write a KQL query that joins Azure AD sign-in logs (SigninLogs) with Azure Storage diagnostic logs (StorageBlobLogs) based on a user identifier, and then uses a time window (e.g., 30 minutes) to correlate the two events. This is the only rule type that supports custom KQL logic for multi-table joins and time-based correlation, which is essential for detecting the described exfiltration pattern.

Answer

An NRT (near-real-time) rule

Answer

A fusion rule

Answer

A machine learning-based analytics rule

Question 13

A security team uses Microsoft Sentinel. They want to create a custom analytic rule that triggers an incident when more than 10 failed Azure Active Directory sign-ins occur from the same source IP address within any 5-minute window. Which type of rule should they use?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because it allows you to define a KQL query that counts failed Azure AD sign-ins grouped by source IP address within a 5-minute sliding window, and then triggers an incident when the count exceeds 10. This rule type supports custom aggregation and threshold-based alerting, which is exactly what the scenario requires.

Answer

Near-Real-Time (NRT) rule

Answer

Fusion rule

Answer

Anomaly rule

Question 14

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a ticket number as justification, and the activation must be approved by a designated approver group. The role activation duration should be limited to 4 hours. Which PIM settings should be configured?

Accepted Answer

Enable 'Require approval' and set 'Approvers' to the designated group. Also, enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours.. Option C is correct because the scenario requires both approval and ticket-based justification. In Azure AD PIM, 'Require approval' enforces that a designated approver group must approve the activation, while 'Require ticket information on activation' ensures the user provides a ticket number as justification. Setting 'Activation maximum duration' to 4 hours limits the role activation time. These three settings together satisfy all requirements.

Answer

Enable 'Require approval' for the role and set 'Approvers' to the designated group. Also, set 'Activation maximum duration' to 4 hours.

Answer

Enable 'Require justification on activation' and set 'Activation maximum duration' to 4 hours. No approval configuration is needed.

Answer

Enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours. Approval is not required because the ticket number serves as justification.

Question 15

A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks and have a single web application. Which Azure DDoS Protection tier should they use?

Accepted Answer

DDoS Protection Basic (default). DDoS Protection Basic is automatically enabled for all Azure resources at no additional cost, providing always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks. Since the company has a single web application and only needs protection against Layer 3/4 DDoS attacks, the Basic tier is sufficient and requires no configuration or extra cost.

Answer

DDoS Protection Standard

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Front Door with DDoS Protection Standard