AZ-500 Practice Test 19 — 15 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They want to ensure that when a user activates the role, the activation request must be approved by a member of the 'Global Admin Approvers' group, and the activation should be time-bound with a maximum of 4 hours. Which PIM settings should they configure?

Accepted Answer

Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.. Option A is correct because Azure AD PIM allows you to configure role activation settings, including an activation maximum duration (which can be set to 4 hours) and requiring approval from a specified group (in this case, 'Global Admin Approvers'). These settings directly meet the requirement for time-bound activation with approval.

Answer

Set the activation maximum duration to 4 hours and enable MFA on activation.

Answer

Set the activation to require a ticket number justification and set the maximum duration to 8 hours.

Answer

Set the role to be permanently active but with a just-in-time approval workflow.

Question 2

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

Accepted Answer

The user is a member of the approver group and is self-approving the request. Option B is correct because when a user is a member of the approver security group in Azure AD PIM, they can approve their own activation request. PIM does not prevent self-approval by default; the approval workflow sends the request to all members of the approver group, and if the requesting user is also a member, they can approve it themselves, resulting in immediate activation without any external approval.

Answer

The activation approval requirement is not supported for the Global Administrator role

Answer

The PIM policy has not been activated for the Global Administrator role

Answer

The role activation duration is set to zero, causing immediate activation

Question 3

A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?

Accepted Answer

Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).. Option B is correct because Azure Key Vault supports automatic key rotation with a configurable rotation period, and when a disk encryption set (DES) is configured with an empty string as the key version, it automatically uses the latest version of the KEK. This ensures that after the KEK is rotated every 90 days, the running VMs' OS and data disks are re-wrapped with the new KEK version without manual intervention or VM restart.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.

Answer

Use Azure Policy to enforce automatic key rotation.

Question 4

A company uses Azure AD Privileged Identity Management (PIM) to manage access to the 'Security Administrator' role. They want a specific user to be able to activate the role only when needed, rather than having standing access. The user should not have the role active at all times. Which type of assignment should they configure for this user in PIM?

Accepted Answer

Assign the user as 'Eligible' for the role.. In Azure AD Privileged Identity Management (PIM), an 'Eligible' assignment means the user does not have permanent access to the role. They must activate the role on-demand through a time-bound activation process, which may require approval and multi-factor authentication. This directly meets the requirement of having no standing access, as the role is inactive until the user explicitly activates it.

Answer

Assign the user as 'Active' for the role.

Answer

Assign the user as 'Permanent' for the role.

Answer

Add the user as a 'Guest' in the directory.

Question 5

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that when a user activates this role, they must provide a support ticket number and a brief justification. Additionally, the activation should have a maximum duration of 4 hours. Which PIM role setting should they configure?

Accepted Answer

Require justification on activation. Option C is correct because the 'Require justification on activation' setting in Azure AD PIM allows you to mandate that users provide a support ticket number and a brief justification when activating a role. This setting enforces the collection of business-specific details during activation, which aligns with the requirement. The maximum activation duration of 4 hours is configured separately via the 'Activation maximum duration' setting, not through justification.

Answer

Require approval

Answer

Require MFA

Answer

Require Azure AD Identity Protection

Question 6

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault. Option C is correct because Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.

Answer

Create a private endpoint on the Key Vault for the SQL server

Answer

Disable the Key Vault firewall

Answer

Assign the SQL server a system-assigned managed identity and grant it access to the key vault

Question 7

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to manage RDP connections to a critical jump-box virtual machine. The company has a CI/CD pipeline running on Azure DevOps agent pools that needs to periodically RDP into this VM to deploy software. The agent pool's source IP addresses are dynamic and change frequently. They want the pipeline to automatically request JIT access before each deployment without manual intervention. Which approach should they implement?

Accepted Answer

Use the Azure REST API with a managed identity assigned to the DevOps agent to request JIT access, specifying the agent's current source IP address. Option A is correct because it uses the Azure REST API with a managed identity to dynamically request JIT VM access, specifying the agent's current source IP address. This approach allows the CI/CD pipeline to authenticate without secrets and automatically obtain time-bound RDP access, even though the agent's IP changes frequently. The managed identity provides secure, automated authentication to Azure Resource Manager, enabling the pipeline to call the JIT policy endpoint and grant access for the deployment duration.

Answer

Create a JIT access rule in Defender for Cloud with a scheduled time window that matches the pipeline's deployment schedule

Answer

Configure a PowerShell script in the pipeline to modify the network security group (NSG) to allow the agent's IP during deployment

Answer

Assign a static public IP to the Azure DevOps agent and add that IP to the JIT allowed list permanently

Question 8

A company uses Microsoft Defender for Cloud. They want to automatically implement a specific security recommendation (e.g., 'Enable encryption for Azure SQL Database') on all existing and future SQL Database instances in a subscription. Which feature should they use?

Accepted Answer

Security policy with a custom initiative.. A custom initiative in a security policy allows you to define a set of security recommendations (e.g., 'Enable encryption for Azure SQL Database') and enforce them via Azure Policy. By assigning this initiative at the subscription scope with a 'DeployIfNotExists' or 'Modify' effect, you can automatically remediate non-compliant resources and ensure that all existing and future SQL Database instances have encryption enabled. This is the correct mechanism for automated, continuous compliance with custom security requirements.

Answer

Regulatory compliance dashboard.

Answer

Workload protection plans.

Answer

Vulnerability assessment.

Question 9

A company wants Defender for Cloud to recommend fixes for container image vulnerabilities stored in Azure Container Registry. Which capability is most relevant?

Accepted Answer

Container vulnerability assessment in Defender for Containers. Defender for Containers includes a container vulnerability assessment capability that scans container images stored in Azure Container Registry (ACR) for known vulnerabilities. This assessment integrates with Defender for Cloud to provide actionable recommendations for fixing identified vulnerabilities, directly addressing the company's requirement.

Answer

Azure SQL auditing

Answer

Microsoft Entra access reviews

Answer

Application Gateway rewrite rules

Question 10

A company uses Microsoft Defender for Cloud to manage security posture. The security team wants to receive alerts when a virtual machine has a vulnerability rated as 'Critical' by the integrated vulnerability assessment solution. Which Defender for Cloud plan must be enabled for the subscription to receive these alerts?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment solution that automatically scans VMs and generates security alerts for critical vulnerabilities. Plan 1 only provides basic threat detection and does not include the vulnerability assessment engine or the corresponding alerting capability.

Answer

Defender for Servers Plan 1

Answer

Defender for Storage

Answer

Defender for Databases

Question 11

A company uses Microsoft Defender for Cloud to monitor security alerts. They receive an alert about a compromised virtual machine and want to automatically execute a playbook that isolates the VM by modifying the network security group. Which Defender for Cloud feature should they use to create this automated response?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to define automated responses to security alerts by triggering Azure Logic Apps. In this scenario, you would create a Logic App that modifies the network security group (NSG) to isolate the compromised VM, and then configure a workflow automation rule to run that Logic App whenever the specific alert is triggered. This provides a no-code, event-driven remediation without manual intervention.

Answer

Security policy

Answer

Alert suppression

Answer

Continuous export

Question 12

A company wants Defender for Cloud to automatically open a Logic App when a high-severity alert is generated for a subscription. Which feature should be configured?

Accepted Answer

Workflow automation. Workflow automation in Defender for Cloud allows you to trigger a Logic App automatically in response to specific security alerts, such as high-severity alerts. This feature uses Azure Event Grid to listen for alert creation events and invoke the Logic App via an HTTP trigger, enabling automated remediation or notification workflows without manual intervention.

Answer

Regulatory compliance dashboard

Answer

Secure score recommendation exemption

Answer

Continuous export

Question 13

A company wants to use Microsoft Defender for Cloud to continuously assess their Azure resources against the Microsoft cloud security benchmark (MCSB). They need to view the current compliance score and specific recommendations for failing controls. Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess resources against compliance standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score, a breakdown of failing controls, and actionable recommendations to remediate those controls, directly meeting the company's requirement.

Answer

Security Policy

Answer

Secure Score

Answer

Workload Protections

Question 14

A Conditional Access policy should reduce account takeover risk for administrators without blocking normal low-risk access. Which two signals or controls are most appropriate?

Accepted Answer

Require phishing-resistant MFA or strong authentication for privileged roles. Option A is correct because requiring phishing-resistant MFA (e.g., FIDO2 security keys or certificate-based authentication) for privileged roles directly mitigates account takeover by preventing credential theft and replay attacks. This aligns with the principle of using strong authentication for high-value accounts, as specified in Microsoft's Conditional Access guidance for administrators.

Answer

Allow legacy authentication for administrator accounts

Answer

Exclude all Global Administrators from the policy

Question 15

A company wants to ensure that users can only access Microsoft 365 services (e.g., Exchange Online, SharePoint Online) from devices that are confirmed to be compliant with corporate security policies (e.g., encryption enabled, antivirus active). Which Azure AD policy type should they create?

Accepted Answer

Conditional Access policy with the 'Require compliant device' grant control.. A is correct because a Conditional Access policy with the 'Require compliant device' grant control enforces device-based access restrictions by checking the device's compliance status reported by Microsoft Intune. This ensures that only devices meeting corporate security policies (e.g., encryption enabled, antivirus active) can access Microsoft 365 services like Exchange Online and SharePoint Online.

Answer

Identity Protection policy with a sign-in risk policy.

Answer

Access review policy for groups.

Answer

Privileged Identity Management (PIM) activation policy.