AZ-500 Practice Test 17 — 15 Questions

Question 1

Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?

Accepted Answer

Microsoft Defender for Servers. Just-In-Time (JIT) VM access is a feature of Microsoft Defender for Cloud that requires the Microsoft Defender for Servers plan to be enabled on the subscription. This plan provides the advanced threat protection and access control capabilities, including JIT, which dynamically locks down inbound traffic to VMs and opens ports only when authorized users request access via Azure Policy or the portal.

Answer

Microsoft Defender for Databases

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Key Vault

Question 2

A custom Azure role should allow operators to restart virtual machines but not delete them or change networking. Which permission design is most appropriate?

Accepted Answer

Create a custom role with Microsoft.Compute/virtualMachines/restart/action and required read permissions at the narrowest scope. It grants the specific 'restart/action' permission on virtual machines while excluding destructive actions like delete or network changes. Custom roles in Azure RBAC allow fine-grained control by including only the required data actions and read permissions, ensuring operators can restart VMs without the ability to delete them or modify networking.

Answer

Assign Contributor at the resource group scope

Answer

Assign Virtual Machine Contributor at subscription scope

Answer

Assign Reader and ask operators to use Run Command

Question 3

Which TWO of the following are valid ways to encrypt data at rest in Azure SQL Database? (Choose two.)

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) [B] is correct because it performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest using a symmetric database encryption key (DEK) protected by a certificate stored in Azure Key Vault or the service-managed key store, directly satisfying the data-at-rest requirement. Always Encrypted [D] is also correct because it encrypts sensitive columns at rest and in memory, with keys held outside the database (in Windows Certificate Store or Azure Key Vault), so the data stored on disk is ciphertext and never exposed to the SQL Database engine. Dynamic Data Masking [A] is not encryption — it merely obfuscates column values in query results for non-privileged users while the underlying data remains plaintext. Row-Level Security [C] restricts which rows a user can access via predicates but does not encrypt stored data. Azure Disk Encryption (ADE) [E] is not applicable to Azure SQL Database because it targets IaaS virtual machine OS and data disks (BitLocker/DM-Crypt), not the PaaS SQL Database service.

Answer

Dynamic Data Masking

Answer

Row-Level Security

Answer

Azure Disk Encryption (ADE)

Question 4

A managed identity is used by an Azure Function to access Key Vault. Which two configurations are required?

Accepted Answer

A system-assigned or user-assigned managed identity enabled on the function app. A managed identity (either system-assigned or user-assigned) provides an Microsoft Entra ID-authenticated identity for the function app, eliminating the need for credentials like client secrets. This identity is used to obtain an Microsoft Entra ID access token for authenticating to Key Vault. Option D is also required because the managed identity must be granted explicit Key Vault permissions (e.g., via an access policy or RBAC role) to read secrets; without these permissions, token-based authentication will fail with a 403 Forbidden error.

Answer

A client secret stored in the function app settings

Answer

A public IP address on the function app

Question 5

Your company uses Microsoft Defender for Cloud to protect Azure resources. You want to enable the 'Defender for Containers' plan to secure AKS clusters. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.. Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the primary configuration required to activate threat detection and security monitoring for AKS clusters. Option E is correct because audit logs must be enabled and streamed to a Log Analytics workspace to provide the necessary data for Defender for Containers to analyze Kubernetes audit events and detect suspicious activities.

Answer

Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.

Answer

Connect the AKS cluster to Azure Arc.

Answer

Install the Log Analytics agent on each AKS node.

Question 6

A security team has a list of known malicious IP addresses from an external threat intelligence feed in CSV format. They want to import this list into Microsoft Sentinel and use it in analytics rules to detect incoming attacks. Which feature should they use?

Accepted Answer

Watchlists. Watchlists in Microsoft Sentinel allow you to import external data sources, such as CSV files containing known malicious IP addresses, and use them directly in analytics rules for detection. This feature is designed for lightweight, custom threat intelligence that doesn't require the full threat intelligence indicator (TI) lifecycle, making it ideal for ad-hoc lists from CSV feeds.

Answer

Threat intelligence indicators

Answer

Bookmark

Answer

User and Entity Behavior Analytics (UEBA)

Question 7

You are the identity security engineer for a multinational company that uses Microsoft Entra ID. The company has recently experienced a security breach where an attacker compromised a non-administrator user account and then used that account to enumerate all users in the tenant. The attacker then attempted to brute-force passwords for high-privilege accounts. To prevent such attacks, management requires the following:

- Users with administrative roles must use phishing-resistant MFA.
- Any sign-in from a risky IP address must be blocked.
- Users must not be able to enumerate directory information via the Graph API unless they have a specific role.
- The solution should be implemented using built-in Microsoft Entra ID features.

What should you configure?

Accepted Answer

Configure Conditional Access policy with authentication strength for admins requiring phishing-resistant MFA. Configure Identity Protection sign-in risk policy to block risky sign-ins. Restrict access to the Graph API by requiring a specific role assignment.. Phishing-resistant MFA can be enforced via Conditional Access with authentication strength. Sign-in risk policies in Identity Protection can block sign-ins from risky IPs. To prevent directory enumeration, you can restrict access to the Graph API by requiring a specific role assignment. Option A is wrong because Security defaults enforce MFA but do not block all enumeration. Option C is wrong because PIM does not block enumeration. Option D is wrong because access reviews do not block enumeration.

Answer

Enable Security defaults and configure Identity Protection user risk policy to block high-risk users.

Answer

Configure Conditional Access policy for admins to require phishing-resistant MFA. Use PIM to require approval. Enable Identity Protection sign-in risk policy.

Answer

Configure PIM for all admin roles. Create access reviews for all users. Enable Identity Protection to detect risky sign-ins.

Question 8

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

Accepted Answer

The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.. 'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources. Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Answer

The policy will apply only to the VM-Sensitive virtual machine.

Answer

The policy will apply to all resources in RG-Prod except the entire resource group.

Answer

The policy will apply to the subscription but not to RG-Prod.

Question 9

A security operations team uses Microsoft Sentinel to centralize security monitoring across their hybrid environment. They need to ingest AWS CloudTrail logs from an Amazon Web Services account to detect suspicious activities in their AWS environment. Which data connector should they configure in Microsoft Sentinel?

Accepted Answer

AWS CloudTrail connector. The AWS CloudTrail connector is the correct data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel. It requires configuring an S3 bucket in AWS to receive CloudTrail logs and then connecting that bucket to Sentinel via the connector, enabling the detection of suspicious activities such as unauthorized API calls or privilege escalations in the AWS environment.

Answer

Azure Activity log connector

Answer

Syslog connector

Answer

Common Event Format (CEF) connector

Question 10

A security team uses Microsoft Defender for Cloud to improve their security posture across multiple subscriptions. They want to quickly identify which security recommendations have the highest potential to improve their security score if remediated. Which dashboard or feature should they use?

Accepted Answer

Secure Score dashboard. The Secure Score dashboard in Microsoft Defender for Cloud is specifically designed to show security recommendations ranked by their potential impact on the overall security score. Each recommendation includes a 'score impact' value, allowing the team to prioritize remediation actions that will most effectively improve their security posture across multiple subscriptions.

Answer

Regulatory Compliance dashboard

Answer

Security Alerts dashboard

Answer

Inventory dashboard

Question 11

An analyst creates a Sentinel automation rule and a playbook. The playbook should run only when incidents are created from a specific analytics rule and severity is High. Where should this filtering be configured?

Accepted Answer

Automation rule conditions. Automation rules in Microsoft Sentinel are designed to trigger actions based on incident creation or update events. By configuring conditions within the automation rule, you can specify that the associated playbook should only run when the incident is created from a specific analytics rule and has a severity of High. This is the correct and intended location for such filtering, as automation rules evaluate conditions before invoking the playbook.

Answer

Logic App recurrence trigger

Answer

Log Analytics workspace retention settings

Answer

Analytics rule suppression only

Question 12

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want users who activate this role to provide a justification and a support ticket number, and they want the activation to expire after a maximum of 4 hours. Which PIM role settings should they configure?

Accepted Answer

Configure the activation maximum duration, require justification, and require ticket information in the role settings. The scenario requires all three conditions: a maximum activation duration of 4 hours, mandatory justification, and mandatory ticket information. In Microsoft Entra PIM, these are independent settings within the role settings configuration, and all must be enabled to meet the stated requirements. Without configuring all three, the activation would not enforce the specified controls.

Answer

Configure the activation maximum duration only

Answer

Configure the requirement for justification only

Answer

Configure the requirement for ticket information only

Question 13

A company wants Defender for Cloud to recommend fixes for container image vulnerabilities stored in Azure Container Registry. Which capability is most relevant?

Accepted Answer

Container vulnerability assessment in Defender for Containers. Defender for Containers includes a container vulnerability assessment capability that scans container images stored in Azure Container Registry (ACR) for known vulnerabilities. This assessment integrates with Defender for Cloud to provide actionable recommendations for fixing identified vulnerabilities, directly addressing the company's requirement.

Answer

Azure SQL auditing

Answer

Microsoft Entra access reviews

Answer

Application Gateway rewrite rules

Question 14

You manage security for a company using Microsoft Sentinel. The security team wants to automatically assign incidents to the on-call analyst based on the incident severity and the entity involved. They also want to ensure that when an incident is updated, the assignment is re-evaluated. You need to configure this with minimal administrative effort. What should you use?

Accepted Answer

Create an automation rule that triggers on incident creation and update, with conditions based on severity and entity, and an action to assign the incident to the on-call analyst.. Automation rules in Microsoft Sentinel are the native mechanism for incident management, allowing automatic assignment based on conditions such as severity and entities. They can trigger on both incident creation and update, ensuring re-evaluation when incidents change. This approach requires minimal effort because it is built into the platform and does not require custom playbook development.

Answer

Configure the analytics rule to include the owner in the incident details, and use a scheduled query to update the owner periodically.

Answer

Create a playbook that uses the Microsoft Sentinel connector to assign the incident, and configure the analytics rule to run the playbook on incident creation.

Answer

Use Microsoft Defender for Cloud's workflow automation to assign the incident to the on-call analyst based on severity.

Question 15

You are a security analyst using Microsoft Defender for Cloud. You need to ensure that any new Azure subscription added to your management group automatically receives the default security policy assignments and that security recommendations are continuously assessed. What should you enable?

Accepted Answer

Azure Policy initiative assignment at the management group scope.. To ensure that new subscriptions automatically receive security policy assignments and continuous assessment, you should assign the appropriate Azure Policy initiative (such as the Microsoft cloud security benchmark) at the management group level. Subscriptions within that management group inherit the policy, and Defender for Cloud continuously evaluates resources against the policy, providing recommendations. This centralized approach simplifies governance and ensures compliance across all subscriptions without manual intervention.

Answer

Azure Arc enrollment for all servers in the subscriptions.

Answer

Microsoft Sentinel workspace onboarding for each subscription.

Answer

Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent.