AZ-500 Practice Test 19 — 15 Questions

Question 1

Your company wants to use Microsoft Defender for Cloud's just-in-time (JIT) VM access to reduce the attack surface. You have enabled JIT for a set of VMs. A security administrator reports that they cannot connect via RDP even after requesting access. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The administrator's source IP address is not in the allowed list for the JIT policy.. The most likely cause is that the administrator's source IP address is not included in the allowed list for the JIT policy. When a user requests JIT access, Defender for Cloud opens the specified ports (e.g., 3389 for RDP) only to the source IP addresses that are explicitly permitted in the policy. If the administrator's IP is not in the allowed list, the request may be approved but the network security group (NSG) or Azure Firewall rule will not include that IP, resulting in a connection failure.

Answer

The JIT policy is set at the subscription level and does not apply to individual VMs.

Answer

The VM is not located in a region that supports JIT.

Answer

The VM does not have the Azure VM agent installed.

Question 2

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

Accepted Answer

Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.. Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.

Answer

Configure a firewall rule to allow only corporate IP ranges.

Answer

Use storage account access keys to mount the file share.

Answer

Generate a shared access signature (SAS) with read permissions.

Question 3

Which TWO features are available in Microsoft Entra ID Privileged Identity Management (PIM) for managing Azure AD roles? (Choose two.)

Accepted Answer

Just-in-time activation. Option B (Just-in-time activation) is correct because PIM's core capability is making users eligible for Microsoft Entra ID roles and requiring them to activate the role only when needed, granting time-bound, temporary elevation instead of permanent assignment. Option E (Approval workflow for role activation) is correct because PIM role settings allow administrators to require approval before an eligible user's activation request is granted, with designated approvers reviewing the request. The other options do not belong: self-service password reset (A) is an Entra ID authentication feature, not a PIM role-management feature; multi-factor authentication enforcement (C) is configured via Conditional Access or authentication methods, not as a PIM role feature; and automatic role assignment based on group membership (D) is handled by group-based licensing/role-assignable groups, not by PIM activation.

Answer

Self-service password reset

Answer

Multi-factor authentication enforcement

Answer

Automatic role assignment based on group membership

Question 4

A company has virtual networks in East US and West US connected via global VNet peering. The security policy requires that all traffic between the peered VNets be encrypted using IPsec. Which action should the company take to meet this requirement?

Accepted Answer

Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.. VNet peering does not encrypt traffic between peered virtual networks by default; it relies on the Microsoft backbone network. To enforce IPsec encryption for all traffic between the peered VNets, you must deploy an Azure VPN Gateway in each VNet and configure a site-to-site VPN connection between them. This creates an encrypted tunnel using IPsec/IKE protocols, satisfying the security policy requirement.

Answer

Enable the 'Allow gateway transit' setting on the VNet peering.

Answer

Enable 'Use remote gateways' on the VNet peering.

Answer

Configure Azure Firewall to encrypt the traffic between the VNets.

Question 5

Your company wants to implement a least-privilege model for administrative roles in Microsoft Entra ID. Which TWO features should you use?

Accepted Answer

Custom roles in Microsoft Entra ID. Custom roles in Microsoft Entra ID (option B) are correct because they let you define a precise set of directory permissions (for example, scoping actions like microsoft.directory/users/read) so administrators get only the access they need, which is the essence of least privilege. Privileged Identity Management (option E) is also correct because it enforces just-in-time activation of eligible directory roles with approval, MFA, and time-bound assignments, eliminating standing privileged access. Azure RBAC roles (option A) govern Azure resource-plane access, not Microsoft Entra ID administrative roles, so they don't address the directory role model in scope. Conditional Access policies (option C) control sign-in conditions and access to resources but do not define or limit administrative role permissions. Microsoft Entra B2B external identities (option D) is about collaborating with external users, not about constraining administrative privileges.

Answer

Azure RBAC roles

Answer

Conditional Access policies

Answer

Microsoft Entra B2B external identities

Question 6

A company stores sensitive data in Azure Blob Storage. They use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. The security policy requires that the encryption keys be automatically rotated every 90 days. Which configuration should they implement to meet this requirement without manual intervention?

Accepted Answer

Enable key auto-rotation in Key Vault by setting a rotation policy on the key.. Azure Key Vault supports automatic key rotation by configuring a rotation policy on the key. When you enable auto-rotation, Key Vault automatically creates a new key version at the specified interval (e.g., every 90 days) without any manual intervention. This directly satisfies the requirement for automatic rotation of customer-managed keys used for Azure Storage encryption at rest.

Answer

Use a custom Azure Automation runbook to rotate the key.

Answer

Set a key expiration date of 90 days and manually renew.

Answer

Enable versioning on the storage account and manually create a new key version.

Question 7

You need to ensure that an Azure Key Vault is accessible only from a specific virtual network and that all operations are logged. What should you configure?

Accepted Answer

Key Vault firewall and virtual network service endpoints, and diagnostic settings. To restrict Key Vault access to a specific virtual network, you must configure the Key Vault firewall and virtual network service endpoints, which allow you to deny all traffic except that originating from the specified VNet/subnet. To log all operations, you must configure diagnostic settings to send audit events (e.g., AuditEvent logs) to a Log Analytics workspace, Storage account, or Event Hub. Option A is correct because it combines both network access control and logging requirements.

Answer

Azure RBAC roles and diagnostic settings

Answer

Soft-delete and purge protection, and diagnostic settings

Answer

Azure Policy and diagnostic settings

Question 8

A security analyst uses Microsoft Defender for Cloud. They need to continuously monitor the security posture of their Azure subscription against the Microsoft cloud security benchmark (MCSB). They want to see the current compliance score and specific recommendations for failing controls. Which Defender for Cloud feature should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud is specifically designed to track compliance against standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score and lists specific recommendations for failing controls, enabling continuous monitoring and remediation tracking. This dashboard aggregates assessment results from the secure score and maps them to the controls defined in the selected regulatory standard.

Answer

Security posture

Answer

Workbooks

Answer

Advanced hunting

Question 9

A security operations team uses Microsoft Sentinel. They want to enable User and Entity Behavior Analytics (UEBA) to detect anomalous user activities. Which configuration is required?

Accepted Answer

Enable UEBA in the Sentinel settings. UEBA in Microsoft Sentinel is a built-in feature that must be explicitly enabled in the Sentinel configuration settings under 'Entity behavior analytics'. It does not require a separate data connector or analytics rule template; once enabled, Sentinel automatically ingests and analyzes existing log data (e.g., Microsoft Entra ID sign-ins, Office 365 audit logs) to establish behavioral baselines and detect anomalies.

Answer

Install the UEBA data connector

Answer

Create an analytics rule with UEBA template

Answer

Assign the Security Reader role to Sentinel

Question 10

You are the Azure Security Engineer for a company that uses Microsoft Entra ID. The company has a policy that all administrative accounts must use multi-factor authentication (MFA) when signing in. You need to enforce this policy for a group of administrators. What is the simplest way to achieve this?

Accepted Answer

Create a Conditional Access policy that requires MFA for the administrator group when accessing all cloud apps.. The simplest way to enforce MFA for a specific group of administrators is to create a Conditional Access policy that targets that group and requires MFA for all cloud apps. This provides granular control and is easy to manage. Other options either apply to all users, require manual per-user settings, or are risk-based rather than always-on.

Answer

Configure per-user MFA for each administrator account.

Answer

Enable security defaults in Microsoft Entra ID.

Answer

Create a Microsoft Entra ID Protection sign-in risk policy that requires MFA for administrators.

Question 11

You are a security engineer at Northwind Traders. The company has an Azure subscription with a virtual network named VNet1. You need to ensure that all outbound internet traffic from VNet1 is inspected by a central security appliance before leaving the network. You also need to log all traffic for auditing. The solution must minimize administrative effort and support scaling. What should you deploy?

Accepted Answer

Azure Firewall in a hub virtual network, with user-defined routes (UDRs) in VNet1 pointing to the firewall's private IP address as the next hop for 0.0.0.0/0.. Azure Firewall is a managed, cloud-native network security service that provides central inspection, logging, and scalability. By deploying it in a hub and using user-defined routes in VNet1 to direct all outbound traffic (0.0.0.0/0) to the firewall's private IP, you ensure every packet is inspected and logged. This design minimizes administrative effort because Azure manages the firewall infrastructure and scaling.

Answer

Network security groups (NSGs) on each subnet with rules to allow only required outbound traffic, and enable NSG flow logs.

Answer

Azure VPN Gateway with forced tunneling configured to route all traffic through an on-premises firewall.

Answer

Azure Application Gateway with Web Application Firewall (WAF) and configure custom routing rules to send all outbound traffic to the gateway.

Question 12

Your company is implementing a zero-trust security model. You need to ensure that all access to cloud applications is continuously verified based on user identity, device health, and location. Which combination of Microsoft security solutions should you use?

Accepted Answer

Microsoft Entra ID Conditional Access, Microsoft Intune, and Microsoft Defender for Cloud Apps. The zero-trust requirement for continuous verification of user identity, device health, and location is met by combining Microsoft Entra ID Conditional Access (enforces policies based on user, device, and location signals), Microsoft Intune (manages device compliance and health), and Microsoft Defender for Cloud Apps (provides continuous session-level monitoring and control of cloud app access). This trio delivers the real-time, policy-driven access checks that zero trust demands.

Answer

Microsoft Sentinel and Azure Policy

Answer

Microsoft Entra ID Protection and Privileged Identity Management

Answer

Azure Active Directory Domain Services and Azure Firewall

Question 13

You are the identity security engineer for a company that uses Microsoft Entra ID. You need to reduce the risk of credential theft for administrative accounts. Which TWO controls should you implement? (Choose two.)

Accepted Answer

Require passwordless authentication methods such as FIDO2 security keys for administrators.. Passwordless authentication removes the password as a stealable secret, and banned password lists prevent weak or predictable passwords from being set. Together they reduce the likelihood that an administrative credential can be phished, guessed, or reused, which directly addresses credential theft risk.

Answer

Configure a long password expiration interval of 730 days for administrator accounts.

Answer

Assign the Privileged Authentication Administrator role to a shared helpdesk account.

Answer

Enable self-service password reset for all administrator accounts.

Question 14

You are designing a hub-and-spoke network topology with Azure Firewall in the hub VNet. Which TWO components are essential for routing traffic from spoke VNets through the firewall? (Choose two.)

Accepted Answer

VNet peering between spoke and hub VNets. Option D is correct because VNet peering between each spoke and the hub VNet is the foundational connectivity that allows traffic to flow from spokes to the hub where Azure Firewall resides; without peering (or another connectivity method), spoke traffic cannot reach the firewall at all. Option E is correct because even with peering, Azure's default system routes would send internet-bound traffic directly out of the spoke, so user-defined routes (UDRs) in a route table must set 0.0.0.0/0 (and typically spoke-to-spoke prefixes) with a next hop of the Azure Firewall's private IP to force traffic through the firewall for inspection. Option A is incorrect because Azure Private DNS zones provide name resolution for private endpoints and are unrelated to traffic routing through a firewall. Option B is incorrect because Azure Bastion provides secure RDP/SSH access to VMs and does not influence packet routing between VNets. Option C is incorrect because a VPN gateway in each spoke is not required for hub-and-spoke firewall routing; VNet peering is the standard mechanism, and gateways are only needed for hybrid/on-premises connectivity, typically deployed in the hub.

Answer

Azure Private DNS zones

Answer

Azure Bastion host in the hub VNet

Answer

VPN gateway in each spoke VNet

Question 15

You are configuring Azure DDoS Network Protection for your VNet. Which TWO benefits does enabling DDoS Protection Standard provide?

Accepted Answer

Adaptive tuning to baseline traffic patterns.. Option B is correct because Azure DDoS Protection Standard continuously monitors traffic and uses adaptive tuning to learn your application's normal traffic patterns, then automatically adjusts mitigation thresholds to match that baseline, enabling accurate detection of anomalies. Option E is correct because DDoS Protection Standard includes cost protection, which provides service credits for resource costs (such as scaled-out VM instances) incurred as a result of a documented DDoS attack. Option A is incorrect because DDoS Protection Standard does not perform packet inspection through Azure Firewall integration; it operates at Layers 3/4 within the Azure network fabric. Option C is incorrect because Layer 7 application protection is provided by Azure Web Application Firewall (WAF) on Application Gateway or Front Door, not by DDoS Protection Standard itself. Option D is incorrect because vulnerability scanning is not a DDoS Protection Standard feature; it is offered through separate services such as Microsoft Defender for Cloud.

Answer

Integration with Azure Firewall for packet inspection.

Answer

Application-layer (Layer 7) protection via integrated WAF.

Answer

Vulnerability scanning for web applications.