AZ-500 Practice Exam 4 — 20 Questions

Question 1

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

Accepted Answer

Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Answer

Enable Azure AD Domain Services authentication and join the storage account to the managed domain.

Answer

Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.

Answer

Use storage account keys to mount the share and rely on Windows ACLs.

Question 2

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation. Option B is wrong because Azure Disk Encryption encrypts VM disks, not the Azure SQL Database. It does not meet the requirement for encrypting the database at rest. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access. Option D is wrong because Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Question 3

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Accepted Answer

Create suppression rules to automatically dismiss alerts that meet specific criteria.. Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts matching specific criteria, such as alert name, resource, or severity. This is useful for reducing noise from known benign activities without disabling the underlying security detection. Suppression rules are configured per alert type and can be set to expire after a defined period.

Answer

Directly modify the affected Azure resource's configuration from the alert.

Answer

Export alerts to a third-party SIEM using continuous export.

Answer

Change the severity of an alert after it is generated.

Question 4

You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?

Accepted Answer

Azure Monitor Logs (Log Analytics workspace). Azure Monitor Logs (Log Analytics workspace) is correct because it serves as the central ingestion and storage destination for network monitoring data. NSG flow logs capture IP traffic through Network Security Groups, and Traffic Analytics processes those raw flow logs to provide visualizations, top-talkers, and anomaly detection. Together, these three components enable comprehensive network traffic monitoring and security analysis for Azure VMs.

Answer

Azure Firewall logs

Answer

VNet flow logs

Question 5

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

Accepted Answer

The 'Use remote gateway' setting is disabled on the spoke VNet peering.. In a hub-spoke topology with Azure Firewall, the 'Use remote gateway' setting on the spoke VNet peering must be disabled. This setting is only for using a VPN or ExpressRoute gateway in the hub; it does not enable routing through Azure Firewall. With this setting disabled, the configured UDRs on the spoke subnets can direct spoke-to-spoke traffic to the firewall for inspection.

Answer

Azure Firewall does not support traffic between spoke VNets.

Answer

The UDR on the firewall subnet does not include the spoke address spaces.

Answer

The 'Allow gateway transit' setting is disabled on the spoke peering.

Question 6

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

Accepted Answer

The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.. When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.

Answer

The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

Answer

The NSG is not associated with the NIC because the command did not specify the NIC correctly.

Answer

The NSG rule should be an inbound rule to block outbound traffic.

Question 7

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 8

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 9

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

Accepted Answer

The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group. PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Answer

Users have permanent eligible assignments that bypass approval

Answer

The audit log is not enabled for PIM

Answer

Users are assigned the role directly instead of through eligibility

Question 10

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Answer

Playbooks

Answer

Incident settings in analytics rule

Answer

Workbooks

Question 11

Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?

Accepted Answer

The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR. The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.

Answer

The UDR must be applied to the subnet that hosts the Azure Firewall

Answer

The spoke subnet does not have 'GatewaySubnet' route propagation enabled

Answer

The Azure Firewall is not configured with a route to the on-premises network

Question 12

A security analyst uses Microsoft Sentinel. They want to create a scheduled analytics rule that runs every hour and queries Azure Activity logs to detect deployment of VMs in non-approved regions. They want to generate an incident automatically when suspicious activity is found. Which configuration is required to automatically create an incident?

Accepted Answer

Enable 'Create incident from alerts triggered by this rule' in the Incident settings. The 'Create incident from alerts triggered by this rule' setting in the Incident settings tab is the specific toggle that instructs Microsoft Sentinel to automatically generate a security incident whenever the scheduled analytics rule fires an alert. Without this setting enabled, the rule will only produce raw alerts that must be manually triaged or routed through a separate automation rule to become incidents. This is the direct configuration required for automatic incident creation from a scheduled query rule.

Answer

Configure the 'Alert details' section with the appropriate severity and description

Answer

Define entity mapping in the 'Entity mapping' tab

Answer

Connect Azure Activity log to Sentinel via Event Hub

Question 13

A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key (CMK). Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.

Answer

Enable infrastructure encryption

Answer

Enable soft delete for the storage account

Answer

Enable Azure AD authentication for Blob Storage

Question 14

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Accepted Answer

1. Navigate to the Key Vault in the Azure portal. 2. Under Settings, select Networking. 3. In the Firewalls and virtual networks tab, add the desired virtual network. 4. Click Save.. The firewall configuration is under networking, and you must add the virtual network to allow traffic.

Answer

1. Navigate to the Key Vault. 2. Click Save. 3. Then go to Networking. 4. Add virtual network.

Answer

1. Navigate to the Key Vault. 2. Select Networking. 3. Save the current firewall settings. 4. Then add virtual network.

Answer

1. Navigate to the Key Vault. 2. Add virtual network. 3. Select Networking. 4. Save.

Question 15

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Accepted Answer

1. Navigate to Azure AD Security
2. Configure user risk policy
3. Configure sign-in risk policy
4. Review risk detections. Identity Protection policies are configured under Security, with user risk policy settings.

Answer

1. Configure sign-in risk policy
2. Configure user risk policy
3. Navigate to Azure AD Security
4. Review risk detections

Answer

1. Review risk detections
2. Navigate to Azure AD Security
3. Configure user risk policy
4. Configure sign-in risk policy

Answer

1. Configure user risk policy
2. Navigate to Azure AD Security
3. Configure sign-in risk policy
4. Review risk detections

Question 16

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall that blocks all public access. The SQL server is a managed service that needs to access the key to perform TDE operations. The Key Vault is in the same Azure region as the SQL server. Which additional configuration is needed?

Accepted Answer

Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings. When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.

Answer

Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet

Answer

Assign the SQL server's server identity the 'Contributor' role on the Key Vault

Answer

Create a private endpoint for the Key Vault in the SQL server's virtual network

Question 17

A company has multiple on-premises web applications that need to be securely published for remote employees. The company uses Azure AD for identity management and wants to apply Conditional Access policies, including multi-factor authentication, to these applications. The security team wants to avoid exposing the on-premises infrastructure to the internet directly. Which Azure service should they deploy to meet these requirements?

Accepted Answer

Azure AD Application Proxy. Azure AD Application Proxy is the correct service because it provides secure remote access to on-premises web applications without requiring a VPN or opening inbound firewall ports. It integrates natively with Azure AD, enabling Conditional Access policies such as multi-factor authentication (MFA) to be applied to these applications. The service works by establishing an outbound-only connection from the on-premises Application Proxy connector to Azure AD, ensuring the on-premises infrastructure is never directly exposed to the internet.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 18

A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?

Accepted Answer

Create an automation rule that triggers when an incident is created and sets the severity and owner fields.. Automation rules in Microsoft Sentinel allow you to centrally manage incident handling by triggering actions when incidents are created or updated. By configuring an automation rule that triggers on incident creation from the specific analytics rule, you can automatically set the severity and assign the incident to a security operations group (via an Azure AD group or user) without custom scripting or manual intervention.

Answer

Modify the analytics rule to include a custom script that runs upon alert generation.

Answer

Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.

Answer

Configure a workbook to filter and manually assign incidents.

Question 19

A company uses Microsoft Defender for Cloud to manage its security posture. The compliance team wants to monitor the subscription's compliance with the Payment Card Industry Data Security Standard (PCI DSS). They need to view a detailed compliance report and track progress over time. What should they do in Defender for Cloud?

Accepted Answer

Add the PCI DSS standard from the regulatory compliance dashboard.. The regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in compliance standards like PCI DSS. Once added, the dashboard automatically assesses your subscription against the standard's controls, provides a detailed compliance report, and tracks progress over time with a compliance score and historical trend. This is the direct method to monitor PCI DSS compliance without needing to enable specific Defender plans or create custom initiatives.

Answer

Enable the relevant Defender for Cloud plans (e.g., Defender for Servers, Defender for SQL).

Answer

Create a custom regulatory compliance initiative based on PCI DSS controls.

Answer

Configure continuous export to send compliance data to a Log Analytics workspace.

Question 20

A security team uses Microsoft Defender for Cloud to monitor the security posture of a hybrid environment that includes on-premises servers connected via Azure Arc. They want to enable a vulnerability assessment solution that automatically scans all servers (both Azure VMs and on-premises Arc-enabled servers) for OS vulnerabilities. Which solution should they enable directly from Defender for Cloud?

Accepted Answer

Enable the integrated vulnerability assessment solution (Qualys) in Defender for Cloud. The integrated vulnerability assessment (VA) solution in Defender for Cloud, powered by Qualys, is the correct choice because it is a native, built-in capability that can be automatically enabled for both Azure VMs and Azure Arc-enabled on-premises servers. It requires no additional licensing or external configuration, and it automatically discovers and scans OS vulnerabilities without manual intervention, directly from the Defender for Cloud portal.

Answer

Enable Microsoft Defender for Endpoint and integrate it with Defender for Cloud

Answer

Configure Azure Update Management to assess missing patches

Answer

Use Azure Policy to deploy the Log Analytics agent and manually enable scanning