AZ-500 Practice Test 20 — 15 Questions

Question 1

Which TWO database-level security features are available in Azure SQL Database to protect sensitive data?

Accepted Answer

Always Encrypted. Always Encrypted (B) is correct because it is a database-level feature in Azure SQL Database that encrypts sensitive columns at the client side, keeping data encrypted at rest, in transit, and in memory, with the encryption keys never revealed to the database engine. Dynamic Data Masking (C) is also correct because it is a database-level feature that limits exposure of sensitive data by masking it in query results for non-privileged users without altering the underlying data. Azure Information Protection (A) is a classification and labeling service for documents and emails, not a database-level SQL security feature. Microsoft Entra ID authentication (D) is an identity/authentication mechanism for connecting to Azure SQL Database, not a data-protection feature for sensitive columns. Azure Disk Encryption (E) encrypts the underlying OS and data disks of VMs, so it does not apply to Azure SQL Database's database-level security.

Answer

Azure Information Protection

Answer

Azure AD authentication

Answer

Azure Disk Encryption

Question 2

Which TWO actions can you perform using Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) feature? (Choose two.)

Accepted Answer

Detect anomalous behavior based on historical user activity. Option D is correct because Microsoft Sentinel UEBA builds behavioral baselines from historical log data (sign-in, Azure Activity, Office 365, etc.) and uses machine learning to surface deviations from a user's own normal activity, such as unusual logon times or data volumes. Option E is correct because UEBA also performs peer-group analysis, comparing each user's actions against similar users in the organization to flag anomalous behavior that would not stand out against the user's own baseline. Options A, B, and C are not UEBA capabilities: blocking anonymous-IP sign-ins is done via Conditional Access or named-location policies, running KQL queries across multiple data sources is core Log Analytics/Sentinel hunting (not UEBA-specific), and automatically disabling compromised accounts requires automated response playbooks (Logic Apps) or identity protection tooling, not UEBA itself.

Answer

Block sign-ins from anonymous IP addresses

Answer

Run KQL queries to find threats across multiple data sources

Answer

Automatically disable compromised user accounts

Question 3

Your organization uses Microsoft Defender for Cloud to monitor Azure resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources. Which TWO options can you use to achieve this?

Accepted Answer

Assign an Azure Policy with a DeployIfNotExists effect that deploys the required configuration.. Option B is correct because an Azure Policy with a DeployIfNotExists effect automatically deploys the required configuration to non-compliant resources, which is the standard mechanism Defender for Cloud uses for automatic remediation at scale. Option D is correct because Defender for Cloud's 'Quick Fix!' feature provides one-click, automated remediation for supported recommendations, directly fixing non-compliant resources. Option A is incorrect because a scheduled Logic Apps playbook is not an automatic remediation trigger tied to non-compliance; playbooks in Defender for Cloud are triggered by alerts or recommendations, not schedules. Option C is incorrect because Microsoft Sentinel is a SIEM/SOAR solution for threat detection and response, not the service that remediates Defender for Cloud compliance recommendations. Option E is incorrect because manually running Azure Automation runbooks is not automatic remediation, which the scenario explicitly requires.

Answer

Create a Logic Apps playbook that runs on a schedule.

Answer

Configure Microsoft Sentinel to automatically remediate based on alerts.

Answer

Use Azure Automation runbooks to manually run remediation.

Question 4

Which TWO are capabilities of Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Entity pages with timelines and related events. Option B is correct because Microsoft Sentinel UEBA provides entity pages that show a timeline of activities and related events for entities such as users, hosts, and IP addresses, helping analysts investigate anomalous behavior in context. Option D is correct because UEBA includes peer group analysis, which baselines an entity's behavior against similar peers to surface deviations that may indicate compromise or insider threat. Option A is not a UEBA capability per se; threat intelligence integration is a separate Sentinel feature (threat intelligence connectors and analytics rules), not part of UEBA's behavioral analytics. Option C is incorrect because UEBA does not automatically create incidents for every detected anomaly; anomalies are surfaced as insights/entities and can be used by analytics rules to generate incidents selectively. Option E is incorrect because automated response actions such as blocking IPs are handled by Sentinel automation rules and playbooks (Logic Apps), not by the UEBA feature itself.

Answer

Integration with external threat intelligence feeds

Answer

Automatic incident creation for all detected anomalies

Answer

Automated response actions like blocking IPs

Question 5

A security engineer connects Azure virtual machines to Microsoft Defender for Cloud. The team wants vulnerability findings without installing a vulnerability scanner extension on each VM. Which capability should be enabled?

Accepted Answer

Agentless vulnerability assessment for machines in Defender for Servers. Agentless vulnerability assessment for machines in Defender for Servers is the correct capability because it uses Microsoft Defender for Cloud's built-in scanning engine to assess VMs for vulnerabilities without requiring any agent or extension installation. This feature leverages the VM's existing configuration and cloud APIs to perform scans, meeting the team's requirement to avoid installing a vulnerability scanner extension on each VM.

Answer

Microsoft Sentinel User and Entity Behavior Analytics

Answer

Azure Firewall threat intelligence mode

Answer

Microsoft Entra Identity Protection sign-in risk

Question 6

An organization has deployed Microsoft Sentinel as their SIEM. They need to ingest audit logs from their Amazon Web Services (AWS) environment, including CloudTrail logs. Which data connector should they use in Microsoft Sentinel to collect these logs?

Accepted Answer

Amazon Web Services connector. The Amazon Web Services connector is the correct data connector in Microsoft Sentinel for ingesting AWS audit logs, including CloudTrail logs. It establishes a connection to AWS by requiring a role ARN and external ID, enabling Sentinel to pull CloudTrail events via the AWS API. This connector specifically supports CloudTrail management and data events, making it the appropriate choice for audit log ingestion.

Answer

AWS S3 connector

Answer

Azure Sentinel to AWS connector

Answer

CloudTrail connector

Question 7

Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?

Accepted Answer

The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR. The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.

Answer

The UDR must be applied to the subnet that hosts the Azure Firewall

Answer

The spoke subnet does not have 'GatewaySubnet' route propagation enabled

Answer

The Azure Firewall is not configured with a route to the on-premises network

Question 8

You are deploying a three-tier application on Azure VMs. The web tier must be accessible from the internet, but the application and database tiers must only accept traffic from the web tier. You need to implement network segmentation using Azure networking components. What is the most secure and manageable solution?

Accepted Answer

Use separate subnets for each tier in the same VNet and configure NSGs to allow traffic only from the previous tier.. Placing each tier in its own subnet within the same VNet allows you to apply Network Security Groups (NSGs) at the subnet level with inbound rules that restrict traffic to only the previous tier's subnet IP range. This follows the principle of least privilege and provides a clear, manageable boundary between tiers without introducing unnecessary complexity or performance overhead.

Answer

Use a single subnet and configure NSGs on VM NICs to restrict traffic.

Answer

Use VNet peering to connect separate VNets for each tier and use NSGs.

Answer

Use a single VNet with one subnet and use Azure Firewall to filter traffic between tiers.

Question 9

A security analyst uses Microsoft Sentinel. They want to create a scheduled analytics rule that runs every hour and queries Azure Activity logs to detect deployment of VMs in non-approved regions. They want to generate an incident automatically when suspicious activity is found. Which configuration is required to automatically create an incident?

Accepted Answer

Enable 'Create incident from alerts triggered by this rule' in the Incident settings. The 'Create incident from alerts triggered by this rule' setting in the Incident settings tab is the specific toggle that instructs Microsoft Sentinel to automatically generate a security incident whenever the scheduled analytics rule fires an alert. Without this setting enabled, the rule will only produce raw alerts that must be manually triaged or routed through a separate automation rule to become incidents. This is the direct configuration required for automatic incident creation from a scheduled query rule.

Answer

Configure the 'Alert details' section with the appropriate severity and description

Answer

Define entity mapping in the 'Entity mapping' tab

Answer

Connect Azure Activity log to Sentinel via Event Hub

Question 10

Your organization is migrating to Azure and needs to protect against advanced threats like fileless malware. You must use a solution that provides real-time protection and integrates with Microsoft Defender for Cloud. What should you deploy on Azure VMs?

Accepted Answer

Microsoft Defender for Endpoint (Microsoft Defender XDR). Microsoft Defender for Endpoint (part of Microsoft Defender XDR) provides next-generation protection, including behavior-based, real-time detection of fileless malware and other advanced threats. It integrates natively with Microsoft Defender for Cloud to deliver unified security management and automated response for Azure VMs, meeting the requirement for real-time protection against sophisticated attacks.

Answer

Microsoft Antimalware for Azure

Answer

Azure Monitor Agent (AMA)

Answer

Azure Security Center (free tier)

Question 11

Your company uses Microsoft Entra ID and has Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud apps based on user behavior. Which feature should you use?

Accepted Answer

Conditional Access for Cloud Apps (session control). Conditional Access for Cloud Apps with session control is the correct feature because it allows you to monitor and control access to cloud apps in real time based on user behavior. It uses Microsoft Entra ID Conditional Access policies combined with Microsoft Defender for Cloud Apps to enforce session policies, such as blocking downloads or requiring multi-factor authentication, when anomalous behavior is detected.

Answer

Information Protection (DLP)

Answer

Cloud Discovery

Answer

Application Proxy

Question 12

A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key (CMK). Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.

Answer

Enable infrastructure encryption

Answer

Enable soft delete for the storage account

Answer

Enable Azure AD authentication for Blob Storage

Question 13

A cloud security team wants Defender for Cloud to assess AWS accounts and GCP projects from the same portal used for Azure posture management. What should they configure?

Accepted Answer

Environment settings with multicloud connectors. Defender for Cloud's multicloud connectors allow you to onboard AWS accounts and GCP projects directly into the Azure portal, enabling unified security posture management across all three cloud environments. This feature integrates with AWS Security Hub and GCP Security Command Center to aggregate findings and assessments into a single dashboard, without requiring any migration of workloads.

Answer

Azure Arc-enabled Kubernetes only

Answer

Microsoft Sentinel data connector for AWS CloudTrail only

Answer

Azure Lighthouse delegation

Question 14

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Accepted Answer

1. Navigate to the Key Vault in the Azure portal. 2. Under Settings, select Networking. 3. In the Firewalls and virtual networks tab, add the desired virtual network. 4. Click Save.. The firewall configuration is under networking, and you must add the virtual network to allow traffic.

Answer

1. Navigate to the Key Vault. 2. Click Save. 3. Then go to Networking. 4. Add virtual network.

Answer

1. Navigate to the Key Vault. 2. Select Networking. 3. Save the current firewall settings. 4. Then add virtual network.

Answer

1. Navigate to the Key Vault. 2. Add virtual network. 3. Select Networking. 4. Save.

Question 15

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Accepted Answer

1. Navigate to Azure AD Security
2. Configure user risk policy
3. Configure sign-in risk policy
4. Review risk detections. Identity Protection policies are configured under Security, with user risk policy settings.

Answer

1. Configure sign-in risk policy
2. Configure user risk policy
3. Navigate to Azure AD Security
4. Review risk detections

Answer

1. Review risk detections
2. Navigate to Azure AD Security
3. Configure user risk policy
4. Configure sign-in risk policy

Answer

1. Configure user risk policy
2. Navigate to Azure AD Security
3. Configure sign-in risk policy
4. Review risk detections