AZ-500 Practice Exam 2 — 20 Questions

Question 1

A company manages Azure AD roles with Privileged Identity Management (PIM). They want to enforce that when a user activates the Global Administrator role, they must provide a justification and also use Multi-Factor Authentication. Which PIM settings should they configure? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication on activation.. Option B is correct because PIM allows you to enforce Multi-Factor Authentication (MFA) as a mandatory step during role activation, ensuring the user's identity is verified beyond just a password. Option C is correct because PIM's 'Require justification on activation' setting forces the user to provide a business reason for activating the Global Administrator role, which is a common compliance requirement. Together, these two settings satisfy the requirement for both MFA and justification during activation.

Answer

Require approval on activation.

Answer

Extend activation duration.

Question 2

A Defender for Cloud secure score recommendation says storage accounts allow public blob access. What remediation best addresses the root issue?

Accepted Answer

Disable public blob access at the storage account level and review container ACLs. The secure score recommendation indicates that storage accounts allow public blob access, which is a security risk. The root cause is that anonymous access is enabled at the storage account level, and individual container ACLs may also permit public access. Disabling public blob access at the storage account level (via the 'AllowBlobPublicAccess' property) immediately blocks all anonymous requests, and reviewing container ACLs ensures no residual permissions exist. This directly addresses the vulnerability by enforcing a deny-by-default posture.

Answer

Enable storage account static website hosting

Answer

Increase Log Analytics retention

Answer

Create an Azure Front Door profile

Question 3

A company uses Azure Firewall to filter outbound traffic. They want to ensure that all DNS queries from virtual machines in a spoke VNet are routed through the Azure Firewall for logging and inspection. They have already configured the firewall to use a custom DNS server. Which additional Azure Firewall feature must be enabled to ensure that the VMs use the firewall as a DNS proxy?

Accepted Answer

Enable DNS proxy on the firewall policy. Option A is correct because enabling DNS proxy on the Azure Firewall policy allows the firewall to act as a DNS proxy for the virtual machines in the spoke VNet. When DNS proxy is enabled, the firewall listens on port 53 and forwards DNS queries from the VMs to the configured custom DNS server, ensuring all DNS traffic is logged and inspected. This is required even after setting a custom DNS server on the firewall, as the VMs must be configured to use the firewall's private IP address as their DNS server, and the proxy handles the forwarding.

Answer

Configure a DNS forwarding rule

Answer

Enable Threat Intelligence DNS logging

Answer

Create a NAT rule for DNS traffic

Question 4

A company uses Azure AD Privileged Identity Management (PIM) for Azure AD roles. They want to require that when a user activates the Security Administrator role, they must provide a justification and the activation must be approved by a member of a specific security group. Which PIM setting should they configure?

Accepted Answer

Require approval to activate. Option A is correct because Azure AD PIM allows you to enforce approval workflows for role activation. By configuring 'Require approval to activate' and selecting the specific security group as the approver, you ensure that any user attempting to activate the Security Administrator role must first receive approval from a member of that group, in addition to providing a justification.

Answer

Require multi-factor authentication

Answer

Require justification

Answer

Require Azure AD join

Question 5

A security team has a list of known malicious IP addresses from an external threat intelligence feed in CSV format. They want to import this list into Microsoft Sentinel and use it in analytics rules to detect incoming attacks. Which feature should they use?

Accepted Answer

Watchlists. Watchlists in Microsoft Sentinel allow you to import external data sources, such as CSV files containing known malicious IP addresses, and use them directly in analytics rules for detection. This feature is designed for lightweight, custom threat intelligence that doesn't require the full threat intelligence indicator (TI) lifecycle, making it ideal for ad-hoc lists from CSV feeds.

Answer

Threat intelligence indicators

Answer

Bookmark

Answer

User and Entity Behavior Analytics (UEBA)

Question 6

A security team uses Microsoft Defender for Cloud. They have assigned a custom regulatory compliance initiative that includes policies to enforce encryption on storage accounts and SQL databases. They want to automatically remediate any non-compliant resources as soon as they are created, without manual intervention. Which feature should they configure?

Accepted Answer

Azure Policy with a 'DeployIfNotExists' effect. The 'DeployIfNotExists' effect in Azure Policy automatically deploys a resource (e.g., encryption configuration) when a non-compliant resource is created or updated, without manual intervention. This aligns with the requirement to remediate non-compliant storage accounts and SQL databases as soon as they are provisioned, as part of a custom regulatory compliance initiative assigned via Defender for Cloud.

Answer

Security policies (assignments)

Answer

Just-in-time VM access

Answer

Adaptive application controls

Question 7

A custom Azure role should allow operators to restart virtual machines but not delete them or change networking. Which permission design is most appropriate?

Accepted Answer

Create a custom role with Microsoft.Compute/virtualMachines/restart/action and required read permissions at the narrowest scope. Option B is correct because it grants the specific 'restart/action' permission on virtual machines while excluding destructive actions like delete or network changes. Custom roles in Azure RBAC allow fine-grained control by including only the required data actions and read permissions, ensuring operators can restart VMs without the ability to delete them or modify networking.

Answer

Assign Contributor at the resource group scope

Answer

Assign Virtual Machine Contributor at subscription scope

Answer

Assign Reader and ask operators to use Run Command

Question 8

A security operations team uses Microsoft Sentinel. They have created a playbook that sends an email notification to the security team when a high-severity incident is created by a specific analytics rule named 'CriticalRDPAccess'. They want the playbook to trigger automatically only when the incident has severity 'High' AND the incident was created by the rule named 'CriticalRDPAccess'. Which automation rule configuration should they use?

Accepted Answer

Condition: Incident severity equals High; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.. Option C is correct because the automation rule must use the AND operator to require both conditions—incident severity equals 'High' AND incident rule name equals 'CriticalRDPAccess'—to trigger the playbook. This ensures the playbook runs only when both criteria are met, matching the requirement exactly. Using 'contains' instead of 'equals' (as in Option A) would incorrectly match rules with 'CriticalRDPAccess' as a substring, potentially triggering on unintended rules.

Answer

Condition: Incident severity equals High; AND Incident rule name contains 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity equals High; OR Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity in ['High', 'Critical']; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Question 9

A Defender for Cloud alert indicates possible credential theft on a VM. Which two response actions are sensible early containment steps?

Accepted Answer

Isolate the affected endpoint or restrict network access if business impact allows. Option A is correct because isolating the affected VM or restricting its network access is a fundamental containment step that prevents the attacker from using the compromised credentials to move laterally or exfiltrate data. In Defender for Cloud, this can be achieved by applying a Just-In-Time (JIT) VM access policy or by using network security groups (NSGs) to block all inbound/outbound traffic to the VM, effectively stopping the attack in its tracks while preserving forensic evidence.

Answer

Delete all Log Analytics workspaces

Answer

Disable Microsoft Defender for Endpoint onboarding

Question 10

A security analyst uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to receive an email notification whenever a high-severity security alert is generated for any of their Azure resources. What should they configure in Defender for Cloud?

Accepted Answer

Configure email notifications in the Defender for Cloud settings under 'Notifications'.. Option B is correct because Microsoft Defender for Cloud has a built-in 'Email notifications' setting under its environment settings that allows you to configure email recipients for high-severity alerts directly, without needing external services. This feature sends real-time email notifications for security alerts based on severity levels you define, making it the simplest and most direct method for this requirement.

Answer

Create an alert rule in Azure Monitor that triggers an email when a security alert is raised.

Answer

Use a Logic Apps playbook to send an email when a new alert is generated.

Answer

Set up a workflow automation rule in Microsoft Sentinel to forward alerts to email.

Question 11

An organization has deployed Microsoft Sentinel as their SIEM. They need to ingest audit logs from their Amazon Web Services (AWS) environment, including CloudTrail logs. Which data connector should they use in Microsoft Sentinel to collect these logs?

Accepted Answer

Amazon Web Services connector. The Amazon Web Services connector is the correct data connector in Microsoft Sentinel for ingesting AWS audit logs, including CloudTrail logs. It establishes a connection to AWS by requiring a role ARN and external ID, enabling Sentinel to pull CloudTrail events via the AWS API. This connector specifically supports CloudTrail management and data events, making it the appropriate choice for audit log ingestion.

Answer

AWS S3 connector

Answer

Azure Sentinel to AWS connector

Answer

CloudTrail connector

Question 12

A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?

Accepted Answer

A Data Collection Rule that defines the custom log collection. A Data Collection Rule (DCR) is required to define the schema, transformation, and destination for custom log data ingested by Azure Monitor Agent. Without a DCR, the agent has no configuration for which custom logs to collect or how to process them.

Answer

A storage account configured for static website hosting

Answer

A Conditional Access policy requiring MFA

Question 13

A security administrator is troubleshooting network connectivity to an Azure virtual machine. The VM is behind a network security group (NSG) that has a deny-all inbound rule as the default. The administrator wants to quickly verify whether a specific TCP packet on port 3389 from their client IP (203.0.113.50) would be allowed or blocked by the NSG. Which Azure Network Watcher tool should they use?

Accepted Answer

IP flow verify.. IP flow verify is the correct tool because it tests whether a specific packet (source IP, destination IP, protocol, port) is allowed or denied by an NSG or virtual network (VNet) route. In this scenario, the administrator needs to quickly validate inbound TCP traffic on port 3389 from client IP 203.0.113.50 to the VM, and IP flow verify provides a pass/fail result along with the exact rule that caused the outcome.

Answer

Network Performance Monitor.

Answer

Next hop.

Answer

NSG diagnostics (flow logs).

Question 14

A security operations team uses Microsoft Sentinel. They want to enable User and Entity Behavior Analytics (UEBA) to detect anomalous user activities. Which configuration is required?

Accepted Answer

Enable UEBA in the Sentinel settings. UEBA in Microsoft Sentinel is a built-in feature that must be explicitly enabled in the Sentinel configuration settings under 'Entity behavior analytics'. It does not require a separate data connector or analytics rule template; once enabled, Sentinel automatically ingests and analyzes existing log data (e.g., Azure AD sign-ins, Office 365 audit logs) to establish behavioral baselines and detect anomalies.

Answer

Install the UEBA data connector

Answer

Create an analytics rule with UEBA template

Answer

Assign the Security Reader role to Sentinel

Question 15

A security team uses Microsoft Defender for Cloud to centralize security alerts. They want to continuously export all security alerts to a Log Analytics workspace for long-term retention and custom analysis. Which two actions must be taken to achieve this? (Choose two that apply.)

Accepted Answer

Enable the continuous export feature in Microsoft Defender for Cloud.. Option A is correct because Microsoft Defender for Cloud's continuous export feature allows you to stream security alerts and recommendations to a Log Analytics workspace or Event Hubs at the subscription or tenant level. This feature is designed specifically for ongoing export, supporting long-term retention and custom analysis without manual intervention.

Answer

Create a Log Analytics workspace in the same region as the resources.

Answer

Assign an Azure Policy definition for 'Deploy export to Log Analytics workspace for Azure Security Center data'.

Question 16

A security team uses Microsoft Defender for Cloud to monitor Azure virtual machines. They want to automatically install a specific endpoint protection solution on all Windows VMs that are currently missing it, without manual intervention. The solution is not integrated natively with Defender for Cloud. Which feature should they use?

Accepted Answer

Create an Azure Policy 'DeployIfNotExists' assignment that installs the endpoint protection extension on VMs missing it. Option B is correct because Azure Policy's 'DeployIfNotExists' effect can automatically deploy a custom endpoint protection extension to Windows VMs that are missing it, even if the solution is not natively integrated with Defender for Cloud. This allows the security team to enforce compliance by installing the specific third-party endpoint protection agent via a policy assignment, without manual intervention.

Answer

Enable the 'Endpoint protection' recommendation and use the 'Fix' option

Answer

Configure adaptive application controls to allow the endpoint protection software

Answer

Enable just-in-time VM access for the VMs

Question 17

A company wants to identify excessive permissions across Azure, AWS, and GCP identities. Which Microsoft security capability is designed for cloud infrastructure entitlement management?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions assigned to identities across multi-cloud environments (Azure, AWS, GCP). It helps detect and remediate excessive, unused, or risky permissions by analyzing identity activity and entitlement data, enabling least-privilege access control.

Answer

Azure Monitor metrics

Answer

Microsoft Purview eDiscovery

Answer

Azure Front Door WAF

Question 18

A hub-and-spoke Azure network uses Azure Firewall for egress inspection. Which two settings are typically required on spoke workloads?

Accepted Answer

UDRs that send default traffic to the firewall next hop. In a hub-and-spoke topology with Azure Firewall for egress inspection, spoke workloads must not be able to bypass the firewall. A User Defined Route (UDR) with address prefix 0.0.0.0/0 and next hop type VirtualAppliance pointing to the firewall's private IP forces all outbound traffic through the firewall. Additionally, DNS and routing design must prevent direct internet access—for example, by using Azure Private DNS zones or custom DNS servers that resolve only internal names, ensuring that no traffic can exit the spoke without firewall inspection.

Answer

Public IP addresses on every VM

Answer

NSG rules that allow all inbound internet traffic

Question 19

A security analyst uses Microsoft Sentinel. They want to create a rule that triggers an incident when a user is added to a highly privileged Azure AD role (e.g., Global Administrator). The data source is Azure AD audit logs. Which type of analytics rule should they create?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because Azure AD audit logs are historical data ingested into Log Analytics, and scheduled queries run on a defined interval (e.g., every 5 minutes) to detect patterns like role assignments. This rule type allows you to write a KQL query against the AuditLogs table to identify when a user is added to a highly privileged role, then map the results to an incident. NRT rules are designed for high-frequency, low-latency scenarios but do not support Azure AD audit logs as a source; they require a dedicated table with near-real-time streaming.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Microsoft Security incident creation rule

Question 20

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment (VA) solution that continuously scans Azure VMs for vulnerabilities and provides security alerts when critical vulnerabilities are found. Plan 1 only offers basic threat detection and does not include the integrated VA scanner or the ability to generate alerts based on VA findings.

Answer

Defender for Servers Plan 1

Answer

Defender for Cloud Apps

Answer

Defender for Storage