AZ-500 Practice Exam 3 — 20 Questions

Question 1

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.. The workbook likely has a time range filter set to 'Last 7 days', but the underlying KQL query uses a hardcoded 24-hour filter. This mismatch causes the query to return data only for the last 24 hours, but the dashboard filter may interfere or the query may be incorrectly referencing the time parameter. As a result, no data is displayed. Option A is incorrect because workbooks rely on KQL queries regardless of visualization type. Option B is incorrect because the Log Analytics gateway is used for on-premises data, not for Microsoft Entra ID sign-in logs which stream directly to the workspace. Option D is incorrect because the problem statement confirms sign-in logs are being received.

Answer

The workbook uses a different visualization type that requires KQL.

Answer

The Log Analytics gateway is blocking the sign-in logs.

Answer

The Log Analytics workspace is not receiving sign-in logs from Azure AD.

Question 2

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.. When Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Answer

Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.

Answer

Enable soft-delete on the Key Vault.

Answer

Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

Question 3

A company has established a site-to-site VPN connection between its on-premises network and an Azure virtual network using an Azure VPN gateway. The security team wants to confirm that all traffic crossing the VPN tunnel is encrypted. Which protocol does the Azure VPN gateway use to encrypt the data?

Accepted Answer

IPSec (Internet Protocol Security). Azure VPN gateways use IPsec (Internet Protocol Security) in tunnel mode to encrypt all data traversing the site-to-site VPN tunnel. IPsec provides confidentiality, integrity, and authentication at the IP layer, ensuring that all traffic between the on-premises network and Azure virtual network is encrypted and secure.

Answer

SSL (Secure Sockets Layer) / TLS (Transport Layer Security)

Answer

SSH (Secure Shell)

Answer

PGP (Pretty Good Privacy)

Question 4

A compliance team wants evidence that Azure resources are evaluated against the Microsoft Cloud Security Benchmark. Which Defender for Cloud area should they use?

Accepted Answer

Regulatory compliance and security policy assignments. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides continuous monitoring of Azure resources against the Microsoft Cloud Security Benchmark (MCSB). It maps built-in policy assignments to compliance controls, generates a compliance score, and offers remediation steps. This is the designated area for evidence of MCSB evaluation.

Answer

Microsoft Entra app consent settings

Answer

Azure Firewall DNAT rules

Answer

Log Analytics saved searches only

Question 5

A security team uses Microsoft Sentinel. They want to automatically block a user's account in Azure AD when a high-severity incident is created in Sentinel indicating the user's credentials are compromised. Which automation feature should they use?

Accepted Answer

Create a playbook that uses the Azure AD connector to block the user, and associate it with an automation rule for high-severity incidents.. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic Apps workflow) when a high-severity incident is created. The playbook can use the Microsoft Entra ID connector to call the Microsoft Graph API and block the user account, providing automated response to credential compromise without manual intervention.

Answer

Configure the analytic rule for credential compromise to include a script that blocks the user as part of the rule.

Answer

Use a workbook to monitor incidents and manually block users.

Answer

Enable the 'User blocking' feature directly in the Microsoft Sentinel settings for all high-severity incidents.

Question 6

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

Accepted Answer

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'. Microsoft Entra Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Answer

Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

Answer

Use Identity Protection's 'User risk policy' instead of Conditional Access

Answer

Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'

Question 7

A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks and have a single web application. Which Azure DDoS Protection tier should they use?

Accepted Answer

DDoS Protection Basic (default). DDoS Protection Basic is automatically enabled for all Azure resources at no additional cost, providing always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks. Since the company has a single web application and only needs protection against Layer 3/4 DDoS attacks, the Basic tier is sufficient and requires no configuration or extra cost.

Answer

DDoS Protection Standard

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Front Door with DDoS Protection Standard

Question 8

You have configured the Conditional Access policy shown in the exhibit. Users report that they can still access Exchange Online using legacy authentication protocols. What is the most likely reason?

Accepted Answer

The policy state is set to reporting mode. The policy state is set to 'Report-only' (reporting mode), which means the Conditional Access policy is evaluated but not enforced. Users can still access Exchange Online using legacy authentication because the policy only logs the outcome without blocking access. To enforce the block, the policy state must be set to 'On'.

Answer

The policy should use 'Require MFA' instead of 'Block'

Answer

The policy does not include the correct client app types

Answer

The policy should include 'mobileAppsAndDesktopClients' instead

Question 9

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

Accepted Answer

Blob Storage change feed.. The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Answer

Azure Blob Storage soft delete.

Answer

Azure Blob Storage versioning.

Answer

Azure Storage analytics logs.

Question 10

A company uses Azure Bastion to provide secure RDP and SSH access to Azure VMs without public IPs. Recently, a security audit recommended logging all connections to Bastion. What should you enable?

Accepted Answer

Diagnostic settings on the Bastion resource to stream Bastion logs to a Log Analytics workspace. Azure Bastion does not support Network Security Group flow logs or Azure Activity Logs for capturing connection-level details like source IP, target VM, or session duration. Diagnostic settings on the Bastion resource must be enabled to stream Bastion logs (e.g., BastionAuditLogs) to a Log Analytics workspace, which records all RDP/SSH connection attempts and session metadata. This is the only way to meet the audit requirement for logging all connections to Bastion.

Answer

Azure Monitor alerts for Bastion resource health

Answer

Azure Activity Logs for the Bastion resource

Answer

Network Security Group flow logs on the subnet containing Bastion

Question 11

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?

Accepted Answer

Enable password writeback in Microsoft Entra Connect and assign Azure AD Premium licenses. Password writeback requires both the feature to be enabled in Microsoft Entra Connect (via the synchronization settings) and Microsoft Entra ID Premium licenses (P1 or P2) assigned to users. Without the license, the SSPR writeback functionality is not available, even if the feature is enabled in the sync tool. This combination allows password changes from the cloud to be written back to on-premises Active Directory.

Answer

Configure pass-through authentication

Answer

Enable password hash synchronization

Answer

Install the Azure AD Password Protection proxy

Question 12

A security operations team uses Microsoft Sentinel. They have created a playbook that sends an email notification to the security team when a high-severity incident is created by a specific analytics rule named 'CriticalRDPAccess'. They want the playbook to trigger automatically only when the incident has severity 'High' AND the incident was created by the rule named 'CriticalRDPAccess'. Which automation rule configuration should they use?

Accepted Answer

Condition: Incident severity equals High; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.. The automation rule must use the AND operator to require both conditions—incident severity equals 'High' AND incident rule name equals 'CriticalRDPAccess'—to trigger the playbook. This ensures the playbook runs only when both criteria are met, matching the requirement exactly. Using 'contains' instead of 'equals' (as in Option A) would incorrectly match rules with 'CriticalRDPAccess' as a substring, potentially triggering on unintended rules.

Answer

Condition: Incident severity equals High; AND Incident rule name contains 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity equals High; OR Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity in ['High', 'Critical']; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Question 13

A company uses Microsoft Defender for Cloud to manage the security posture of their Azure workloads. The compliance officer needs to generate a report that shows the current compliance status against the SOC 2 standard, including the pass/fail status of each control. Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built, continuously updated view of compliance posture against standards like SOC 2. It maps Azure Policy initiatives to specific controls and shows the pass/fail status for each control, enabling the compliance officer to generate the required report directly.

Answer

Inventory

Answer

Secure Score

Answer

Workbooks

Question 14

A company uses Defender for Servers Plan 2. Which two capabilities are included compared with a basic posture-only configuration?

Accepted Answer

File integrity monitoring or equivalent advanced server protection capabilities. Defender for Servers Plan 2 includes advanced server protection capabilities such as file integrity monitoring (FIM), which tracks changes to critical system files and registry keys, and endpoint detection and response (EDR) integration through Microsoft Defender for Endpoint. These capabilities go beyond the basic posture-only configuration, which only provides vulnerability assessment and security recommendations without real-time threat detection or file change monitoring.

Answer

Azure Cost Management budget alerts

Answer

Microsoft 365 message trace

Question 15

You are a security administrator for a financial institution. You need to implement a solution that allows users to authenticate using biometrics and prevents password-based attacks. Which Microsoft Entra ID feature should you enable?

Accepted Answer

Passwordless authentication (FIDO2 or Windows Hello for Business). Passwordless authentication methods like FIDO2 and Windows Hello for Business eliminate the use of passwords entirely, thereby preventing password-based attacks such as brute force, phishing, and credential stuffing. Biometric verification (e.g., fingerprint or facial recognition) is a core component of these methods, meeting the requirement for biometric authentication. This aligns with the Zero Trust principle of reducing the attack surface by removing shared secrets.

Answer

Microsoft Entra ID Protection

Answer

Password hash synchronization

Answer

Azure Multi-Factor Authentication

Question 16

You are designing network security for a hybrid application that uses Azure Front Door and Azure Application Gateway. The application must block malicious requests at the edge before they reach the backend. You need to implement Web Application Firewall (WAF) protection with the lowest latency and the ability to inspect traffic at the application layer. Which solution should you use?

Accepted Answer

Apply WAF policy on Azure Front Door.. Azure Front Door's WAF operates at the edge of the Microsoft global network, inspecting HTTP/HTTPS traffic at the application layer (Layer 7) with minimal latency due to its distributed point-of-presence (PoP) architecture. This allows malicious requests to be blocked before they traverse the backbone to the origin, meeting the requirement for edge protection and low latency.

Answer

Enable Azure DDoS Protection on the virtual network.

Answer

Apply WAF policy on Azure Application Gateway only.

Answer

Use Azure Firewall with threat intelligence-based filtering.

Question 17

Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant. A is correct because Conditional Access in Microsoft Entra ID is the policy engine that enforces access control decisions based on signals like device compliance. Even after Intune compliance policies are configured, you must create a Conditional Access policy that requires the device to be marked as compliant. This policy blocks or grants access to corporate resources (e.g., Exchange Online, SharePoint) based on the compliance state reported by Intune to Microsoft Entra ID.

Answer

Enable certificate-based authentication for all devices

Answer

Deploy device configuration profiles to all devices

Answer

Configure app protection policies in Microsoft Defender for Cloud Apps

Question 18

Your organization uses Microsoft Entra ID and has deployed Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud applications based on user behavior and device health. Which feature should you use?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is a feature of Microsoft Defender for Cloud Apps that integrates with Microsoft Entra ID Conditional Access policies to monitor and control access to cloud applications in real time. It enforces access controls based on user behavior (e.g., risky sign-ins) and device health (e.g., compliance status from Intune), allowing actions like blocking downloads or requiring session monitoring. This directly meets the requirement to monitor and control access based on user behavior and device health.

Answer

Microsoft Purview Information Protection

Answer

Cloud App Discovery

Answer

OAuth app policies

Question 19

You are reviewing an NSG rule as shown in the exhibit. This rule is applied to a subnet containing web servers. What is the security implication of this rule?

Accepted Answer

It allows all inbound traffic, creating a security risk.. The NSG rule shown in the exhibit has a source and destination of 'Any' and an action of 'Allow' for all ports and protocols. This effectively permits all inbound traffic from any source to the subnet, bypassing any intended security restrictions. Such a configuration exposes the web servers to unrestricted network access, including malicious traffic, creating a significant security risk.

Answer

It restricts inbound traffic to TCP only.

Answer

It blocks all inbound traffic except HTTP.

Answer

It restricts inbound traffic to HTTP only.

Question 20

Drag and drop the steps to configure Azure Disk Encryption for a Windows VM using Azure Key Vault into the correct order.

Accepted Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.. The correct sequence for configuring Azure Disk Encryption for a Windows VM using Azure Key Vault is to first create or configure the Key Vault with soft-delete and purge protection, then set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions, and finally enable disk encryption on the VM specifying the Key Vault and key. This order ensures that all prerequisites are met, preventing errors during the encryption process.

Answer

1. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.

Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Answer

1. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.