AZ-500 Practice Exam 4 — 20 Questions

Question 1

You need to securely connect an on-premises network to an Azure virtual network. The connection must use the internet and provide authenticated and encrypted communication. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct choice because it creates an encrypted site-to-site VPN connection over the internet using IPsec/IKE protocols. This meets the requirement for authenticated and encrypted communication between an on-premises network and an Azure virtual network without needing a dedicated private link.

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Answer

Azure Virtual WAN

Question 2

Which two actions should you take to secure Azure Storage accounts against data exfiltration?

Accepted Answer

Use Azure Private Endpoints for storage accounts.. Correct: A and C. Firewall and virtual network service endpoints restrict network access, and private endpoints provide secure connectivity. Option B (shared access keys) does not prevent exfiltration. Option D (soft delete) helps recovery but not prevention. Option E (CORS) controls cross-origin requests, not exfiltration.

Answer

Enable shared access key authentication.

Answer

Enable soft delete for blobs.

Answer

Configure CORS rules to allow all origins.

Question 3

You are an Azure security engineer. Your team has assigned the Azure Policy shown in the exhibit. A developer creates a new virtual network with a subnet that does not have a Network Security Group (NSG) associated. What will happen when the policy is evaluated?

Accepted Answer

The virtual network creation fails because a subnet lacks an NSG.. The Azure Policy in the exhibit is configured with a 'Deny' effect for virtual networks that have subnets without an associated Network Security Group (NSG). When the developer attempts to create a virtual network with a subnet lacking an NSG, the policy evaluation triggers a denial of the entire virtual network creation operation. This is because the policy's condition checks each subnet for the presence of an NSG, and if any subnet is non-compliant, the 'Deny' effect prevents the resource from being created.

Answer

A default NSG is automatically associated with the subnet.

Answer

The virtual network is created, but the subnet is denied.

Answer

The virtual network is created, and a non-compliant alert is generated.

Question 4

A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?

Accepted Answer

Two inbound rules: one to allow HTTPS, and one to deny all other traffic. Network Security Groups (NSGs) contain default inbound security rules: AllowVNetInBound (priority 65000) and AllowAzureLoadBalancerInBound (priority 65001). These default rules would permit HTTPS traffic from sources within the virtual network or from Azure Load Balancer, violating the requirement to allow HTTPS only from the specific IP range 198.51.100.0/24. Therefore, an explicit deny-all rule must be added with a higher priority (lower numerical value) than the default allow rules to block all other traffic, including that from VNet and Azure Load Balancer. The minimal set is: one rule to allow HTTPS from 198.51.100.0/24 (high priority), and one rule to deny all inbound traffic from any source (at a slightly lower priority but still above the default rules). Option A is insufficient because it relies on the default deny rule (priority 65500), which is processed after the default allow rules, so VNet and Load Balancer traffic would still be permitted.

Answer

One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'

Answer

Three inbound rules: allow HTTPS, allow RDP for management, and deny all

Answer

One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'

Question 5

You are configuring a site-to-site VPN connection between your on-premises network and Azure. You need to ensure that traffic between the networks is encrypted and authenticated. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it provides encrypted and authenticated site-to-site VPN connections using IPsec/IKE protocols. It establishes a secure tunnel between your on-premises VPN device and the Azure VPN gateway, ensuring confidentiality and integrity of traffic across the public internet.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Firewall

Question 6

You need to secure outbound traffic from an Azure virtual network to the internet. All outbound traffic must be inspected by a firewall and logged. You also need to ensure that traffic to known malicious IP addresses is blocked. Which solution should you implement?

Accepted Answer

Configure Azure Firewall with threat intelligence-based filtering and route all outbound traffic through it.. Azure Firewall with threat intelligence-based filtering can inspect and log all outbound traffic, and it uses Microsoft's threat intelligence feeds to block traffic to known malicious IP addresses and domains. By routing all outbound traffic through the firewall (e.g., via a forced tunneling route), you meet the requirements for inspection, logging, and malicious IP blocking.

Answer

Use Network Security Groups (NSGs) with default outbound deny rules.

Answer

Deploy Azure Front Door with WAF policy.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 7

A company plans to use Azure Private Endpoint to securely connect to an Azure SQL Database from an on-premises network via ExpressRoute. The private endpoint is deployed in a hub virtual network. The on-premises network is connected to the hub via ExpressRoute. What additional configuration is needed to ensure on-premises clients can resolve the private endpoint's DNS name?

Accepted Answer

Configure a DNS forwarder on-premises to forward the private link domain to Azure DNS.. Azure Private Endpoint requires DNS resolution to map the private endpoint's private IP address to the fully qualified domain name (FQDN) of the Azure SQL Database. On-premises clients connected via ExpressRoute cannot resolve the private link domain (e.g., `*.database.windows.net`) to the private IP unless a DNS forwarder is configured on-premises to forward queries for the `privatelink.database.windows.net` zone to Azure DNS (168.63.129.16). This ensures that DNS queries from on-premises resolve to the private endpoint IP instead of the public IP of the SQL Database.

Answer

Configure a network security group to allow inbound traffic from on-premises to the private endpoint.

Answer

Deploy a VPN gateway in the hub VNet for additional encryption.

Answer

Add a public DNS record for the SQL Database pointing to the private endpoint IP.

Question 8

You have an Azure Application Gateway v2 with WAF policy in prevention mode to protect a web app. Users report that legitimate requests are being blocked. You review the WAF logs and see many false positives. You need to resolve this while maintaining security. What should you do?

Accepted Answer

Use managed rule sets with custom rules to allow the legitimate traffic that is being falsely blocked.. Azure Application Gateway WAF allows you to use managed rule sets (e.g., OWASP 3.2) and then add custom rules to explicitly allow traffic that is being falsely blocked. This approach maintains the WAF in prevention mode, ensuring that true threats are still blocked, while overriding false positives for specific request patterns (e.g., based on URI, headers, or source IP). Custom rules are evaluated before managed rules, so you can create an 'allow' rule with a higher priority to bypass the false positive detection.

Answer

Add a custom rule to block all requests that do not match a known pattern.

Answer

Disable the WAF and rely on NSGs.

Answer

Switch the WAF policy to detection mode.

Question 9

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 10

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Question 11

You need to provide secure remote administration access to Azure virtual machines in a production environment. You want to eliminate public RDP/SSH endpoints and provide just-in-time access. Which Azure service should you use?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Just-in-time (JIT) VM access in Microsoft Defender for Cloud is the correct choice because it specifically provides time-bound, policy-controlled access to Azure VMs via RDP/SSH while eliminating permanent public endpoints. JIT dynamically opens NSG rules for a specified duration only when an authorized user requests access, then automatically closes them, enforcing the principle of least privilege for remote administration.

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Answer

Azure Bastion

Question 12

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Microsoft Entra PIM can integrate with Conditional Access via authentication context. By enabling 'Require Microsoft Entra Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 13

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Microsoft Entra ID, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Microsoft Entra ID tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 14

A company uses Azure Firewall to inspect traffic between a spoke VNet hosting a web application and a hub VNet hosting a SQL database. The web application fails to connect to the database after a recent network topology change. You verify that the Azure Firewall rules allow the traffic. Which Azure Network Watcher feature should you use to identify the root cause?

Accepted Answer

Connection troubleshoot. Connection troubleshoot (Option A) is the correct choice because it performs an end-to-end connectivity test from the source VM to the destination, evaluating the actual path, including Azure Firewall rules, NSGs, and route tables. Since the firewall rules are confirmed to allow the traffic, Connection troubleshoot can identify if a UDR misrouting or an NSG on the source or destination subnet is blocking the connection. IP flow verify only checks NSG rules at a single network interface and does not evaluate route tables or the entire path.

Answer

Next hop

Answer

Network Performance Monitor

Answer

IP flow verify

Question 15

Your company uses Azure Virtual WAN with a secured virtual hub (Azure Firewall). You have branch offices connected via ExpressRoute. You need to ensure that traffic from a branch to a VNet in the same region is inspected by the firewall. You configure the default route (0.0.0.0/0) advertisement from the hub to the branch, but the traffic is not being inspected. What is the most likely reason?

Accepted Answer

Routing intent for private traffic is not enabled.. Routing intent for private traffic must be enabled on the Virtual WAN hub to ensure that inter-VNet and branch-to-VNet traffic (private IP ranges) is routed through the Azure Firewall. Without routing intent, only internet-bound traffic (0.0.0.0/0) is forced through the firewall by the default route, while private traffic between branches and VNets bypasses inspection. Enabling routing intent for private traffic overrides the default behavior and injects the firewall as the next hop for all private traffic.

Answer

The 'Inter-hub' setting is disabled.

Answer

The branch does not have a route table associated with the connection.

Answer

The VNet has a network virtual appliance (NVA) that overrides the firewall.

Question 16

You need to secure traffic between two VNets in different Azure regions. The VNets contain virtual machines that must communicate over private IP addresses. Which Azure service should you use?

Accepted Answer

VNet peering. VNet peering enables direct, private IP connectivity between two VNets in different Azure regions (global VNet peering). Traffic flows over the Microsoft backbone network, not the public internet, ensuring low-latency and secure communication between virtual machines using private IP addresses without requiring a gateway or additional appliance.

Answer

Azure Firewall

Answer

Azure VPN Gateway

Answer

ExpressRoute

Question 17

You need to securely connect two Azure virtual networks in the same region to allow VM-to-VM communication using private IP addresses. The solution must minimize latency and administrative overhead. What should you use?

Accepted Answer

VNet peering. VNet peering is the correct choice because it connects two Azure virtual networks in the same region using the Microsoft backbone infrastructure, enabling VM-to-VM communication over private IP addresses with near-zero latency and no intermediate hops. It requires no additional gateways or bandwidth charges within the same region, minimizing administrative overhead as it is a simple, one-time configuration.

Answer

Azure VPN Gateway

Answer

Azure Front Door

Answer

ExpressRoute

Question 18

You are designing a network security solution for a multi-tier application in Azure. The web tier must be accessible from the internet, the application tier only from the web tier, and the database tier only from the application tier. All tiers are in different subnets of the same VNet. What is the minimum configuration?

Accepted Answer

Configure NSGs on each subnet with appropriate allow rules.. Network Security Groups (NSGs) applied to each subnet can enforce least-privilege network access: allow inbound from Internet to the web tier subnet, allow inbound only from the web tier subnet to the application tier subnet, and allow inbound only from the application tier subnet to the database tier subnet. This is the minimum configuration as it uses built-in, no-cost Azure constructs without additional services or complex routing.

Answer

Use service endpoints for each tier.

Answer

Create separate VNets for each tier and use VNet peering.

Answer

Deploy Azure Firewall in the VNet and route all traffic through it.

Question 19

A company needs to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) for their Azure workloads. They use Microsoft Defender for Cloud for security management. Which feature should they use to view their current compliance status against PCI DSS controls and track progress over time?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance posture against standards like PCI DSS. It maps Azure resource configurations to specific PCI DSS controls, shows pass/fail status per control, and tracks compliance score over time, enabling continuous monitoring and evidence collection for auditors.

Answer

Security policy

Answer

Recommendations

Answer

Security incidents

Question 20

Refer to the exhibit. You are reviewing an NSG rule configuration for a subnet. The source subnet is 10.0.0.0/24 and the destination subnet is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

Allows inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.. The rule shown in the exhibit is an inbound security rule with source 10.0.0.0/24, destination 10.0.1.0/24, protocol TCP, destination port 22 (SSH), and action Allow. This explicitly permits inbound SSH traffic from the source subnet to the destination subnet. Therefore, option D is correct.

Answer

Allows outbound SSH traffic from 10.0.1.0/24 to 10.0.0.0/24.

Answer

Blocks inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.

Answer

Allows all inbound traffic from 10.0.0.0/24 to 10.0.1.0/24.