AZ-500 Practice Test 18 — 15 Questions

Question 1

You are a security analyst in a company that uses Microsoft Sentinel. You need to create a hunting query that identifies failed sign-in attempts from a specific IP address range and then automatically create an incident if the count exceeds a threshold. Which Microsoft Sentinel feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a scheduled analytics rule that runs the query and triggers an incident based on the threshold.. Scheduled analytics rules are the correct feature for automated detection and incident creation in Microsoft Sentinel. They allow you to define a query, set a schedule, and specify a threshold for generating incidents. When the query returns results exceeding the threshold, Sentinel creates an incident with the mapped entities. This is ideal for detecting patterns like multiple failed sign-ins from a specific IP range. Other features like hunting or workbooks do not provide this automated incident creation capability.

Answer

Configure a workbook that visualizes failed sign-ins and set up an alert rule in Azure Monitor to create an incident.

Answer

Create a playbook that runs the query on a schedule and sends an email to the security team.

Answer

Use the hunting dashboard to run the query and manually create an incident from the results.

Question 2

You are a security engineer at Adventure Works. The company has an Azure Kubernetes Service (AKS) cluster that uses the Azure CNI network plugin. The cluster's pods must access an Azure SQL Database securely without traversing the public internet. You need to configure private connectivity from the AKS cluster to the Azure SQL server. What should you implement?

Accepted Answer

Create an Azure Private Endpoint for the Azure SQL server in a subnet within the AKS virtual network, and configure private DNS integration.. Azure Private Endpoint creates a network interface with a private IP address from your virtual network subnet for the Azure SQL server. Combined with private DNS zone integration, the SQL server's name resolves to that private IP, ensuring all traffic from AKS pods remains on the Microsoft backbone. This provides secure, private connectivity without exposing traffic to the public internet.

Answer

Deploy an Azure Firewall in the AKS virtual network and configure DNAT rules to forward SQL traffic to the Azure SQL server's public endpoint.

Answer

Enable Azure Private Link service on the AKS cluster and create a private endpoint for the SQL server in the AKS subnet.

Answer

Configure a service endpoint for Microsoft.Sql on the AKS subnet and restrict the Azure SQL server firewall to that subnet.

Question 3

You are a security engineer at Litware. The company has an Azure virtual network named VNet1 with a subnet named Subnet1 that hosts several virtual machines. You need to restrict outbound internet access from Subnet1 to only allow traffic to specific FQDNs, such as *.microsoft.com and *.azure.com, while blocking all other outbound internet traffic. You also need to log allowed and denied traffic. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a user-defined route (UDR) in Subnet1 that directs all outbound traffic (0.0.0.0/0) to the Azure Firewall's private IP address as the next hop.. To restrict outbound internet access to specific FQDNs and log traffic, you need Azure Firewall with application rules that allow the desired FQDNs and deny everything else. You also need a user-defined route in Subnet1 that sends all outbound traffic (0.0.0.0/0) to the firewall's private IP. This combination ensures traffic is forced through the firewall and filtered by FQDN, with logging of allowed and denied flows.

Answer

Enable Azure DDoS Protection Standard on VNet1 to filter outbound traffic based on domain names.

Answer

Configure a network security group (NSG) on Subnet1 with outbound rules that allow traffic to the FQDNs and deny all other outbound traffic.

Answer

Deploy an Azure Application Gateway with WAF and configure custom rules to allow the FQDNs for outbound traffic.

Question 4

You are a security engineer for Adventure Works. The company has an Azure subscription with a virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 hosts an Azure App Service Environment (ASE) and several Azure virtual machines. You need to inspect all traffic between Subnet1 and the internet for malicious content and generate alerts for suspicious activity. You also need to ensure that the solution can decrypt and inspect HTTPS traffic. What should you do?

Accepted Answer

Deploy Azure Firewall Premium in VNet1. Enable TLS inspection and configure the firewall to use a certificate stored in Azure Key Vault. Create a user-defined route to direct traffic from Subnet1 to the firewall's private IP address.. To inspect all traffic between Subnet1 and the internet, including HTTPS, deploy Azure Firewall Premium and enable TLS inspection. This allows the firewall to decrypt and inspect encrypted traffic. You must also configure a user-defined route to force traffic from Subnet1 through the firewall's private IP address. This ensures all outbound traffic is inspected and alerts can be generated for suspicious activity.

Answer

Configure Azure Application Gateway with Web Application Firewall (WAF) in VNet1. Create a user-defined route to direct traffic from Subnet1 to the Application Gateway.

Answer

Configure Azure Firewall in VNet1. Create application rules to allow outbound traffic and enable threat intelligence in alert mode. Configure the VMs and ASE to use Azure Firewall as the default gateway.

Answer

Deploy a network virtual appliance (NVA) from Azure Marketplace that supports TLS inspection. Configure a user-defined route to direct traffic from Subnet1 to the NVA.

Question 5

You are deploying a new line-of-business application on an Azure virtual machine. The application needs to access an Azure SQL Database. The security team requires that the application uses a managed identity to authenticate to the database without storing credentials in code or configuration files. You assign a system-assigned managed identity to the virtual machine. What should you do next to allow the application to authenticate to Azure SQL Database?

Accepted Answer

Create a contained database user in Azure SQL Database that maps to the managed identity and grant the necessary permissions.. After enabling a system-assigned managed identity on the VM, you must create a contained database user in Azure SQL Database for that identity and grant it the necessary permissions. This enables the application to authenticate using the managed identity. Other options either grant excessive permissions, misunderstand managed identity capabilities, or use the wrong plane of access.

Answer

Generate a client secret for the managed identity and store it in Azure Key Vault.

Answer

Add the managed identity's object ID to the Azure SQL Server's Azure Active Directory admin group.

Answer

Assign the virtual machine's managed identity the Contributor role on the Azure SQL Server resource.

Question 6

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?

Accepted Answer

Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.. A Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.

Answer

Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.

Answer

Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.

Answer

Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.

Question 7

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access corporate email. You configure a Conditional Access policy targeting Exchange Online. Which grant control should you use?

Accepted Answer

Require device to be marked as compliant. The scenario requires that only devices compliant with security policies can access corporate email. The 'Require device to be marked as compliant' grant control in Conditional Access checks the device compliance status reported by Microsoft Intune. If the device is not compliant, access to Exchange Online is blocked, ensuring policy enforcement.

Answer

Require multifactor authentication

Answer

Block access

Answer

Require hybrid Azure AD joined device

Question 8

A security operations team uses Microsoft Sentinel. They want to create an automation that automatically changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is observed in the incident's entities. The playbook should run immediately when the incident is created. Which type of automation rule trigger should they configure?

Accepted Answer

When incident is created. The requirement specifies that the automation should run immediately when the incident is created. In Microsoft Sentinel, an automation rule with the trigger 'When incident is created' executes a playbook as soon as the incident is generated, before any updates occur. This allows the playbook to evaluate the incident's entities (e.g., IP addresses, hashes) and change the severity from 'Medium' to 'High' if a specific IOC is present, meeting the real-time response need.

Answer

When incident is updated

Answer

When alert is generated

Answer

Scheduled

Question 9

A security operations team uses Microsoft Sentinel. They need to collect Syslog messages from on-premises Linux servers for analysis. Which data connector should they use to ingest these logs into Sentinel?

Accepted Answer

Syslog connector via Log Analytics agent. The Syslog connector via Log Analytics agent is the correct choice because it allows Microsoft Sentinel to collect Syslog messages from on-premises Linux servers. The Log Analytics agent (formerly OMS agent) listens on UDP port 514 (or a custom port) for Syslog messages forwarded by the Linux rsyslog or syslog-ng daemon, then forwards them to the Log Analytics workspace. This connector is specifically designed for standard Syslog ingestion without requiring format transformation.

Answer

Azure Activity Log connector

Answer

Common Event Format (CEF) connector

Answer

Windows Security Events connector

Question 10

A Sentinel rule using a threat intelligence table fires on stale indicators that expired last week. What should be added to the query?

Accepted Answer

A filter for active indicators whose expiration time is in the future. The rule fires on stale indicators because the query lacks a filter to exclude expired threat intelligence entries. Adding a filter for active indicators whose expiration time is in the future ensures that only current, valid indicators trigger the rule, preventing false positives from outdated data.

Answer

A union with Usage

Answer

A sort by Description

Answer

A project-away of ConfidenceScore

Question 11

You have an Azure Cosmos DB account with multiple containers. You need to ensure that data is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which steps should you take?

Accepted Answer

Configure the Cosmos DB account to use a customer-managed key from Key Vault and assign the appropriate RBAC role.. Azure Cosmos DB supports encryption at rest using customer-managed keys (CMK) stored in Azure Key Vault. To enable this, you must configure the Cosmos DB account to use a CMK from Key Vault and assign the appropriate RBAC role (e.g., 'Key Vault Crypto Service Encryption User') to the Cosmos DB system-assigned managed identity, allowing it to access the key for encryption and decryption operations.

Answer

Use Azure Disk Encryption on the VMs hosting Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) and bring your own key (BYOK) from Key Vault.

Answer

Enable Always Encrypted on the Cosmos DB account and reference the key from Key Vault.

Question 12

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

Accepted Answer

Implement Always Encrypted and store the column encryption key in Azure Key Vault. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.

Answer

Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

Answer

Use Dynamic Data Masking to mask the credit card column for non-privileged users

Answer

Implement Azure SQL Database's Always Encrypted with enclaves

Question 13

Refer to the exhibit. You are querying the sys.column_master_keys view in an Azure SQL Database. What is the purpose of this query?

Accepted Answer

To retrieve the column master key configuration for Always Encrypted.. The sys.column_master_keys view in Azure SQL Database specifically returns metadata about column master keys (CMKs) used by Always Encrypted. These keys protect the column encryption keys (CEKs) that encrypt sensitive data columns. Therefore, querying this view retrieves the column master key configuration for Always Encrypted, making option B correct.

Answer

To check the Dynamic Data Masking policies.

Answer

To verify the configuration of Transparent Data Encryption (TDE).

Answer

To list the encryption keys used for column-level encryption.

Question 14

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. The security policy requires that when a user activates the Security Administrator role, they must: 1) Provide a justification, 2) Get approval from a designated security group, and 3) The activation must last a maximum of 4 hours. Which combination of PIM settings should they configure?

Accepted Answer

Enable 'Require justification', 'Require approval', and set 'Maximum activation duration' to 4 hours. Assign the security group as the approver.. Microsoft Entra PIM allows you to enforce all three requirements: justification, approval from a specified security group, and a maximum activation duration. By enabling 'Require justification' and 'Require approval' and setting the 'Maximum activation duration' to 4 hours, you meet the security policy exactly. The approval step requires assigning a designated security group as the approver, which is supported in PIM role settings.

Answer

Enable 'Require justification', 'Require ticket information', and set 'Maximum activation duration' to 8 hours.

Answer

Enable 'Require approval' and set 'Maximum activation duration' to 4 hours. Do not require justification.

Answer

Enable 'Require Azure MFA on activation', 'Require justification', and set 'Maximum activation duration' to 4 hours.

Question 15

You need to allow inbound HTTP traffic from the internet to a specific VM in a VNet. The VM is in a subnet with an NSG. What is the correct way to configure access?

Accepted Answer

Add an inbound security rule in the NSG to allow HTTP traffic.. Network Security Groups (NSGs) operate at the subnet or NIC level and act as a stateful firewall for traffic entering or leaving Azure resources. To allow inbound HTTP (TCP port 80) traffic from the internet to a specific VM, you must add an inbound security rule to the NSG associated with the VM's subnet or NIC, specifying the source as 'Internet', destination port 80, and protocol TCP. This is the direct and correct method for controlling traffic to a VM within a VNet.

Answer

Add a rule in Azure Firewall to allow HTTP traffic to the VM.

Answer

Enable Azure DDoS Protection on the VNet.

Answer

Configure Azure Traffic Manager to route traffic to the VM.