AZ-500 Practice Test 2 — 10 Questions

Question 1

A security analyst uses Microsoft Defender for Cloud. They need to assess their Azure environment's compliance against the Payment Card Industry Data Security Standard (PCI DSS). Which dashboard in Defender for Cloud should they use to view the compliance status?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Regulatory Compliance. The Regulatory Compliance dashboard in Microsoft Defender for Cloud provides a pre-built assessment of your Azure environment against specific compliance standards, including PCI DSS. It maps your security controls to the requirements of the standard and shows a compliance score based on the results of continuous assessments. This is the correct tool for viewing compliance status against PCI DSS.

Answer

Secure Score

Answer

Security Alerts

Answer

Workbooks

Question 2

Which TWO actions should you take to secure a virtual network in Azure? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets.. Network security groups (NSGs) are a fundamental Azure security control that filter traffic at the subnet or network interface level. Applying an NSG to a subnet allows you to define inbound and outbound security rules based on source/destination IP, port, and protocol, effectively segmenting and protecting the virtual network from unauthorized access.

Answer

Configure Azure DNS zones.

Answer

Deploy Azure Bastion for VM access.

Answer

Set up Azure Monitor alerts.

Question 3

A company wants to ensure that users can only access Microsoft 365 services (e.g., Exchange Online, SharePoint Online) from devices that are confirmed to be compliant with corporate security policies (e.g., encryption enabled, antivirus active). Which Azure AD policy type should they create?

Accepted Answer

Conditional Access policy with the 'Require compliant device' grant control.. A is correct because a Conditional Access policy with the 'Require compliant device' grant control enforces device-based access restrictions by checking the device's compliance status reported by Microsoft Intune. This ensures that only devices meeting corporate security policies (e.g., encryption enabled, antivirus active) can access Microsoft 365 services like Exchange Online and SharePoint Online.

Answer

Identity Protection policy with a sign-in risk policy.

Answer

Access review policy for groups.

Answer

Privileged Identity Management (PIM) activation policy.

Question 4

A Conditional Access policy requiring compliant devices does not apply to Azure PowerShell access. Sign-in logs show the cloud app is excluded. What should be changed?

Accepted Answer

Include the relevant cloud app or target all cloud apps after testing exclusions. Conditional Access policies apply only to cloud apps explicitly included in the policy. Since Azure PowerShell is excluded, the policy does not enforce the 'Require device to be marked as compliant' condition for that app. To fix this, you must either include the specific cloud app (Microsoft Azure PowerShell) or set the policy to target 'All cloud apps' and then test exclusions to ensure the compliant device requirement is applied to Azure PowerShell access.

Answer

Disable device compliance in Intune

Answer

Convert the policy to a named location policy

Answer

Remove MFA from all users

Question 5

A Defender for Cloud secure score recommendation says storage accounts allow public blob access. What remediation best addresses the root issue?

Accepted Answer

Disable public blob access at the storage account level and review container ACLs. The secure score recommendation indicates that storage accounts allow public blob access, which is a security risk. The root cause is that anonymous access is enabled at the storage account level, and individual container ACLs may also permit public access. Disabling public blob access at the storage account level (via the 'AllowBlobPublicAccess' property) immediately blocks all anonymous requests, and reviewing container ACLs ensures no residual permissions exist. This directly addresses the vulnerability by enforcing a deny-by-default posture.

Answer

Enable storage account static website hosting

Answer

Increase Log Analytics retention

Answer

Create an Azure Front Door profile

Question 6

Which TWO of the following are valid configurations for Microsoft Entra ID Conditional Access policies?

Accepted Answer

Include all users and exclude specific groups. Conditional Access policies allow you to include all users as a baseline and then exclude specific groups (e.g., break-glass emergency accounts) to ensure critical access is never blocked. Option C is correct because you can target a specific cloud application (e.g., Microsoft Azure Management, SharePoint Online) to apply granular access controls only to that app, leaving other apps unaffected.

Answer

Force password change on next sign-in

Answer

Block access for users without MFA registered

Answer

Assign licenses to users based on location

Question 7

You are reviewing an Azure Resource Manager template for a storage account. The exhibit shows a snippet of the template. Which statement about the template is true?

Accepted Answer

The storage account will use Microsoft-managed keys for encryption.. The template snippet does not include any encryption-related properties, such as `encryption.keySource` or `encryption.services`, which means the storage account will use the default Microsoft-managed keys for encryption. By default, Azure Storage encrypts all data at rest using Microsoft-managed keys, and no explicit configuration is required. Option C correctly identifies this default behavior.

Answer

Encryption is disabled for the storage account.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

Encryption is enabled only for blob storage.

Question 8

You are designing a backup strategy for Azure virtual machines. You need to ensure that backups are encrypted at rest and can be restored in a different Azure region in case of a regional disaster. Which two configurations should you use?

Accepted Answer

Enable encryption at rest for the Recovery Services vault using platform-managed keys. Enabling encryption at rest for the Recovery Services vault using platform-managed keys ensures that backup data is encrypted when stored in Azure's storage layer. This is a default encryption mechanism that protects data at rest without requiring additional key management overhead. Option C is correct because Cross-Region Restore (CRR) allows you to restore backup data to a paired Azure region, providing disaster recovery capability if the primary region fails.

Answer

Configure Azure Site Recovery for the VMs

Answer

Enable Azure Disk Encryption on the VMs

Answer

Use geo-redundant storage (GRS) for the Recovery Services vault

Question 9

A company deploys Azure Firewall to inspect and control outbound traffic from a virtual network. The security team wants to allow outbound HTTPS traffic only to specific FQDNs such as *.microsoft.com and *.windowsupdate.com, while blocking all other outbound internet access. Which type of rule should they configure in Azure Firewall to achieve this filtering?

Accepted Answer

Application Rule. Azure Firewall uses Application Rules to filter outbound traffic based on fully qualified domain names (FQDNs) for HTTP/HTTPS protocols. Since the requirement is to allow HTTPS traffic to specific FQDNs like *.microsoft.com and *.windowsupdate.com, an Application Rule is the correct choice because it can inspect the TLS Server Name Indication (SNI) extension to match the target FQDN, enabling granular allow/deny decisions for web traffic.

Answer

Network Rule

Answer

NAT Rule

Answer

DNAT Rule

Question 10

A company has two application tiers: web servers and application servers. They want to allow traffic from the web servers to the application servers on port 8080, but only for a specific set of web servers. They have deployed the web servers in an Availability Set and want to use a single NSG rule to allow traffic from any web server that is part of that application tier. Which component should they use?

Accepted Answer

Application security group. An Application Security Group (ASG) allows you to group virtual machines logically by their application roles (e.g., web servers) and then use that ASG as the source in a single NSG rule. Since the web servers are in an Availability Set, you can assign the same ASG to their NICs, and the NSG rule will dynamically include all current and future VMs in that ASG. This meets the requirement to allow traffic from any web server in that tier to the application servers on port 8080 without maintaining individual IP addresses.

Answer

Service tag

Answer

Source IP address range

Answer

Virtual network peering