AZ-500 Practice Test 22 — 15 Questions

Question 1

A company has an Azure virtual network with subnets SubnetA and SubnetB. They deploy a network virtual appliance (NVA) in a subnet called NVA_Subnet. They want all traffic between SubnetA and SubnetB to be routed through the NVA for inspection. What is the minimum number of route tables and routes required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Two route tables, each with a route to the other subnet via the NVA. Azure route tables are associated with subnets, not the virtual network as a whole. To force traffic between SubnetA and SubnetB through the NVA, you need two separate route tables: one for SubnetA with a route to SubnetB's address space with the next hop set to the NVA's private IP, and one for SubnetB with a route to SubnetA's address space with the next hop set to the NVA's private IP. This ensures bidirectional traffic is inspected.

Answer

One route table with a route for each subnet via the NVA

Answer

No route tables needed; enable IP forwarding on the NVA

Answer

One route table with a single default route (0.0.0.0/0) via the NVA

Question 2

A security operations team uses Microsoft Sentinel. They are investigating a security incident that involves multiple alerts from different Azure resources. They need to see the entire attack timeline and all related entities (such as user accounts, IP addresses, and hosts) in a single, visual graph to understand the scope of the attack. Which Microsoft Sentinel feature should they use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually map the relationships between alerts, entities (such as user accounts, IP addresses, and hosts), and the attack timeline. It allows security analysts to explore the scope of an incident by interactively expanding nodes and viewing connections, which directly meets the requirement for a single visual graph showing the entire attack timeline and related entities.

Answer

Incident dashboard

Answer

Entity behavior analytics (UEBA)

Answer

Threat hunting blade

Question 3

A company deploys multiple Azure virtual machines across several subnets in a virtual network. The VMs are grouped by application tiers: web, application, and database. The security team wants to apply network security group (NSG) rules that target all VMs in a specific tier, and they need a way to easily add or remove VMs from these groups without updating NSG rules. Which Azure feature should they use to define these logical VM groups?

Accepted Answer

Application Security Group (ASG).. Application Security Groups (ASGs) allow you to group VMs logically by application tier (e.g., web, application, database) without relying on IP addresses or subnet boundaries. NSG rules can reference ASGs as source or destination, so adding or removing a VM from an ASG automatically updates the effective security policy without modifying the NSG rules themselves.

Answer

Network security group (NSG) with multiple IP address ranges.

Answer

Azure Resource Manager tags.

Answer

Virtual Network peering.

Question 4

You have an Azure subscription with multiple virtual networks. You need to centrally manage and enforce security policies for all outbound traffic from virtual machines to the internet. The solution must be able to inspect traffic and log all connections. What should you deploy?

Accepted Answer

Azure Firewall in a hub virtual network.. Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It can be deployed in a hub virtual network to enforce security policies across all spoke VMs, inspecting all outbound connections using application (FQDN) and network (IP/port) rules, and logging all traffic to Azure Monitor or Storage. This meets the requirements for central management, traffic inspection, and full connection logging.

Answer

Network security groups (NSGs) on all subnets.

Answer

Azure Application Gateway with WAF.

Answer

Azure VPN Gateway with forced tunneling.

Question 5

Your company uses Azure SQL Database. You need to ensure that all queries are audited for compliance. Which feature should you enable?

Accepted Answer

Enable SQL Auditing on the server and configure the audit log destination.. To audit all queries against Azure SQL Database for compliance, you must enable SQL Auditing at the server level and configure an audit log destination (such as Azure Storage, Log Analytics, or Event Hubs). This captures database events, including all queries, and writes them to the chosen destination for review and retention. Option B directly fulfills the requirement to track and log query activity.

Answer

Enable SQL Vulnerability Assessment.

Answer

Configure Dynamic Data Masking.

Answer

Enable Advanced Threat Protection.

Question 6

Your company uses Microsoft Sentinel to monitor Azure resources. A new analytics rule is created to detect anomalous access to storage accounts. The rule runs every 5 minutes and looks at the last 15 minutes of data. After deploying, the rule generates no alerts even though you suspect there are anomalies. What is the most likely issue?

Accepted Answer

The rule query logic is incorrect or the entities are not properly mapped.. The most likely issue is that the rule query logic is incorrect or the entities are not properly mapped. In Microsoft Sentinel, an analytics rule uses a KQL query to detect anomalies; if the query syntax is wrong, the logic fails to match the expected data patterns, or the entity mappings (e.g., Account, IP, Host) are misconfigured, the rule will not generate alerts even when anomalous activity exists. Without correct entity mapping, the rule cannot correlate events or trigger incidents, resulting in zero alerts despite underlying anomalies.

Answer

The rule is not enabled.

Answer

The rule severity is set too low.

Answer

The rule query frequency is longer than the data lookback period.

Question 7

A company wants to use Microsoft Defender for Cloud to continuously assess their Azure resources against the Microsoft cloud security benchmark (MCSB). They need to view the current compliance score and specific recommendations for failing controls. Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess resources against compliance standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score, a breakdown of failing controls, and actionable recommendations to remediate those controls, directly meeting the company's requirement.

Answer

Security Policy

Answer

Secure Score

Answer

Workload Protections

Question 8

A company has Azure AD Identity Protection enabled. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on Identity Protection risk?

Accepted Answer

Add a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access'.. Identity Protection detects sign-ins from known malicious IP addresses and assigns a 'Sign-in risk' level (e.g., High). By adding a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access', the Conditional Access policy will automatically block those sign-ins. This directly uses Identity Protection's risk detection to enforce the block without needing to manually maintain IP address lists.

Answer

Add a condition for 'Locations' and specify the known malicious IP ranges as 'Blocked locations'.

Answer

Add a condition for 'User risk' set to 'High' and a grant control of 'Require multi-factor authentication'.

Answer

Add a condition for 'Device state' set to 'Not compliant' and a grant control of 'Block access'.

Question 9

A security operations team uses Microsoft Sentinel. They want to create a rule that generates an incident when an Azure virtual machine is deployed with a public IP address that is not in a predefined approved list. The rule should run every hour and query Azure Activity logs. Which type of analytics rule should they create?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because the requirement specifies a rule that runs every hour and queries Azure Activity logs. Scheduled query rules in Microsoft Sentinel are designed for periodic, time-based queries against log data, such as Azure Activity logs, and can generate incidents based on predefined conditions like detecting a VM deployment with an unapproved public IP. This aligns perfectly with the need for a recurring, non-real-time check.

Answer

NRT (Near-Real-Time) rule

Answer

Anomaly rule

Answer

Fusion rule

Question 10

A company has a partner organization in another Azure AD tenant. They want to allow users from the partner tenant to access their Azure resources through Azure AD B2B collaboration. They also want the partner's Multi-Factor Authentication (MFA) claims to be trusted when partner users access their resources, so that they do not need to perform MFA again. Which configuration in cross-tenant access settings should they enable?

Accepted Answer

Trust multi-factor authentication from the partner tenant (inbound trust).. Cross-tenant access settings in Microsoft Entra ID allow you to configure inbound trust for MFA from an external Microsoft Entra ID tenant. When enabled, Microsoft Entra B2B collaboration will accept the partner tenant's MFA claims, so partner users who have already satisfied MFA in their home tenant will not be prompted again when accessing your resources. This is configured under 'Cross-tenant access settings' > 'Inbound trust settings' for the specific partner tenant.

Answer

Trust device compliance from the partner tenant.

Answer

Enable a Conditional Access policy that grants access to the partner tenant.

Answer

Configure identity synchronization with the partner tenant.

Question 11

A company has an Azure virtual network with subnets SubnetA and SubnetB. They deploy a network virtual appliance (NVA) in a subnet called NVA_Subnet. They want all traffic between SubnetA and SubnetB to be routed through the NVA for inspection. What is the minimum number of route tables and routes required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides full Layer 3–7 inspection and can filter traffic based on FQDNs in network and application rules. It can inspect all traffic between subnets in a virtual network (via forced tunneling or routing) and supports threat intelligence-based filtering for malicious patterns, making it the correct choice for this requirement.

Answer

Azure Network Security Group (NSG)

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 12

A company uses Azure AD Conditional Access. They need to restrict access to a cloud application such that users with unmanaged devices can only view data but cannot download it. Which Conditional Access session control should they enable?

Accepted Answer

Use Conditional Access App Control. Conditional Access App Control (Microsoft Defender for Cloud Apps) provides session-level controls that can enforce restrictions like 'Block Download' based on device compliance. This allows administrators to apply policies that restrict data exfiltration from unmanaged devices while still permitting read-only access to the cloud application.

Answer

Sign-in frequency

Answer

Session persistence

Answer

Application consent policy

Question 13

You have an Azure Web Application Firewall (WAF) policy associated with an Azure Front Door instance. You want to block requests from a specific country (e.g., Country X) unless the request includes a valid API key. How should you configure this?

Accepted Answer

Use a geo-match custom rule to block Country X, and create a separate custom rule with higher priority to allow traffic from Country X if the request contains the API key header.. Azure WAF custom rules are evaluated in priority order, and a higher-priority 'allow' rule can override a lower-priority 'block' rule. By creating a geo-match rule to block Country X, and then a separate custom rule with a higher priority (lower numeric value) that allows requests from Country X if they contain a valid API key header, you achieve the conditional access requirement. This leverages WAF's ability to inspect request headers and apply logic based on multiple conditions within a single policy.

Answer

Use a geo-match custom rule to allow all countries except Country X, and use a rate limit rule to block Country X.

Answer

Configure IP restriction on the origin to block Country X IPs.

Answer

Configure the WAF policy to use 'Prevention' mode and add a managed rule set that includes the country block.

Question 14

A company deploys Azure Firewall in a hub VNet to inspect all outbound traffic from a spoke VNet. They enable VNet peering between the hub and spoke. They create a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop, and associate it with the spoke subnets. However, outbound traffic from the spoke subnets is still going directly to the internet, bypassing the firewall. What is the most likely cause?

Accepted Answer

The route table's next hop type is not set to 'Virtual appliance'. The most likely cause is that the route table's next hop type is not set to 'Virtual appliance'. When creating a custom route in Azure, the next hop type must be explicitly set to 'Virtual appliance' and the next hop address must be the firewall's private IP. If the next hop type is left as 'Internet' or another value, Azure will ignore the custom route and use the default system route for 0.0.0.0/0, which sends traffic directly to the internet without inspection.

Answer

The route table is not associated with the subnet

Answer

The hub-spoke peering is not configured correctly

Answer

Azure Firewall is in a different resource group

Question 15

You need to enable Microsoft Defender for Cloud's workload protection for Azure Kubernetes Service (AKS) clusters. Which Defender plan should you enable?

Accepted Answer

Enable Defender for Containers.. To enable workload protection for Azure Kubernetes Service (AKS) clusters in Microsoft Defender for Cloud, you must enable the Defender for Containers plan. This plan provides runtime threat detection, vulnerability assessment, and compliance monitoring specifically for containerized environments, including AKS, Azure Container Registry (ACR), and Azure Container Instances (ACI). It covers Kubernetes audit logs, host-level security, and container image scanning, which are essential for securing AKS workloads.

Answer

Enable the foundational Cloud Security Posture Management (CSPM) plan.

Answer

Enable Defender for SQL.

Answer

Enable Defender for Servers.