AZ-500 Practice Test 23 — 15 Questions

Question 1

A security team uses Microsoft Sentinel. They want to create a custom analytics rule that generates an incident whenever a user from a list of known malicious IP addresses attempts to sign in to any Azure AD app. They have imported the IP list into Sentinel using Threat Intelligence. Which rule type should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to run a KQL query at a defined interval (e.g., every 5 minutes) to match sign-in events from IP addresses in a Threat Intelligence indicator. This rule type supports alert grouping and incident creation based on the query results, making it ideal for correlating Microsoft Entra ID sign-in logs with a known malicious IP list imported via Threat Intelligence.

Answer

Near-real-time (NRT) rule

Answer

Microsoft Security rule

Answer

Anomaly rule

Question 2

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They have configured the role activation to require Azure Multi-Factor Authentication and a support ticket number. However, users are reporting that they can activate the role without entering a ticket number. What is the most likely cause?

Accepted Answer

The 'Require ticket information on activation' setting is not enabled in the role settings. The 'Require ticket information on activation' setting is a separate toggle in the PIM role settings that must be explicitly enabled. Even if the support ticket number field is displayed in the activation form, the system will not enforce its entry unless this specific setting is turned on. Without it, users can leave the field blank and still successfully activate the role.

Answer

Users are activating through the Azure AD overview page instead of the PIM blade

Answer

The activation policy requires approval but the approvers ignore the ticket field

Answer

The role is configured for 'Active' assignment instead of 'Eligible'

Question 3

A company uses Azure SQL Database to store personally identifiable information (PII). They need to encrypt specific columns containing social security numbers so that even database administrators with the 'db_owner' role cannot view the plaintext. The application must be able to perform equality searches on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with deterministic encryption. Always Encrypted with deterministic encryption is the correct choice because it encrypts specific columns at the client-side, ensuring that even database administrators with db_owner cannot view plaintext data. Deterministic encryption generates the same ciphertext for a given plaintext value, enabling equality searches (e.g., WHERE SSN = '123-45-6789') directly on the encrypted column without decrypting the data on the server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Answer

Row-Level Security

Question 4

An organization is deploying Microsoft Sentinel to centrally collect and analyze security events. They need to ingest logs from multiple on-premises Windows servers located behind a firewall. Which agent should they deploy on those servers?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data-collection agent for Microsoft Sentinel and Azure Monitor, designed to collect logs from Windows servers behind firewalls via outbound HTTPS (port 443) to the Log Analytics workspace. It supports data-collection rules (DCRs) for flexible, scalable ingestion and is the recommended replacement for the legacy Log Analytics agent. AMA can be deployed on-premises Windows servers using Azure Arc for management, ensuring secure log forwarding to Sentinel.

Answer

Log Analytics agent (Microsoft Monitoring Agent)

Answer

Azure Security Center agent

Answer

Azure Automation Agent

Question 5

A company wants to deploy an Azure VPN Gateway in active-active mode to ensure high availability for their site-to-site VPN connection. They have two on-premises VPN devices, each with a distinct public IP address. What is the minimum configuration required for the Azure VPN Gateway to utilize both on-premises devices?

Accepted Answer

Create two local network gateways, each with one on-premises public IP, and connect each to a different IP of the VPN gateway.. Active-active mode requires two distinct IP addresses on the Azure VPN gateway, and each on-premises VPN device must be represented by its own local network gateway. By creating two local network gateways (one per on-premises public IP) and connecting each to a different Azure VPN gateway IP, you establish two independent IPsec tunnels, achieving high availability. This configuration ensures that if one on-premises device or one Azure instance fails, traffic can still flow through the other tunnel.

Answer

Create one local network gateway that includes both on-premises IP addresses and enable BGP on the connection.

Answer

Use active-passive mode and configure a second VPN gateway in the same virtual network.

Answer

Deploy two separate VPN gateways in different Azure regions.

Question 6

Your company has Microsoft Sentinel deployed in multiple workspaces across several Azure regions. The security operations team wants to query data from all workspaces centrally using a single KQL query. What feature should you implement?

Accepted Answer

Use cross-workspace queries with the workspace() expression in KQL.. The workspace() expression in KQL allows you to include tables from multiple Log Analytics workspaces in a single query, enabling centralized querying across all Microsoft Sentinel workspaces without moving or aggregating data. This is the native and recommended approach for cross-workspace queries in Azure Sentinel.

Answer

Configure Log Analytics workspaces as linked to a central workspace.

Answer

Export all data to Azure Data Explorer and query there.

Answer

Use the Microsoft Sentinel SIEM connector to aggregate data.

Question 7

You need to prevent data exfiltration from Azure Storage accounts by controlling which networks can access them. Which Azure feature should you use?

Accepted Answer

Azure Storage firewalls and virtual network rules. Azure Storage firewalls and virtual network rules (Option D) are the correct choice because they allow you to restrict access to your storage account based on specific IP addresses, IP ranges, or virtual networks, effectively preventing data exfiltration by blocking unauthorized network traffic. This feature works at the network layer, enabling you to create a perimeter around your storage account that only allows trusted sources to connect, which directly addresses the requirement to control network-level access.

Answer

Azure Storage shared access signatures (SAS)

Answer

Azure Firewall

Answer

Azure Private Link

Question 8

A company uses Azure AD B2B collaboration to invite external partner users. The security policy requires that guest users who have not signed in for more than 90 days should have their access automatically reviewed and, if not approved, removed. The company has Azure AD Premium P2 licenses. Which Azure AD feature should they configure to meet this requirement?

Accepted Answer

Configure an Azure AD Access Review that reviews guest user access and automatically removes access after 90 days of inactivity.. Microsoft Entra ID Access Reviews, available with Microsoft Entra ID P2 licenses, allow you to create recurring reviews that specifically target guest users who have not signed in for a specified period (e.g., 90 days). The review can be configured to automatically remove access if the reviewer does not approve, directly meeting the requirement for automatic review and removal after 90 days of inactivity.

Answer

Enable automatic user deletion in the Azure AD B2B collaboration settings.

Answer

Create a Conditional Access policy that blocks sign-ins for guest users who haven't authenticated in 90 days.

Answer

Use Azure AD Identity Protection to detect guest user sign-in anomalies and revoke sessions.

Question 9

You are configuring Microsoft Sentinel to use a playbook for automated response to incidents. The playbook needs to block the source IP address of a malicious sign-in on the Azure Firewall. Which Microsoft Sentinel feature should the playbook use?

Accepted Answer

Azure Logic Apps. Microsoft Sentinel playbooks are built on Azure Logic Apps, which provide the workflow automation and connectors needed to orchestrate response actions like blocking an IP on Azure Firewall. Logic Apps can integrate with Azure Firewall via its REST API or the Azure Resource Manager connector to update firewall rules, making it the correct feature for this automated incident response task.

Answer

Azure Automation runbooks

Answer

Azure Functions

Answer

KQL queries

Question 10

An organization wants to export Defender for Cloud recommendations and alerts into a central Log Analytics workspace for retention and hunting. Which feature should they use?

Accepted Answer

Continuous export. Continuous export is the correct feature because it allows you to stream Defender for Cloud security alerts and recommendations to a Log Analytics workspace for long-term retention and custom hunting queries. This feature supports both real-time and scheduled export of security data, enabling centralized monitoring and compliance auditing. It directly addresses the requirement to export Defender for Cloud data into a Log Analytics workspace without additional third-party tools.

Answer

Microsoft Defender External Attack Surface Management

Answer

Microsoft Entra access reviews

Answer

Azure Monitor autoscale

Question 11

A security team needs to analyze network traffic to and from Azure virtual machines to investigate a potential security incident. They want to capture information such as source IP, destination IP, port, and protocol. Which Azure service should they enable on the network security groups (NSGs) associated with the virtual machine subnets?

Accepted Answer

Network Watcher NSG flow logs. Network Watcher NSG flow logs capture IP traffic flowing through Network Security Groups, recording source IP, destination IP, port, and protocol for each flow. This directly meets the requirement to analyze network traffic to and from Azure VMs for security incident investigation.

Answer

Azure Monitor logs

Answer

Traffic Analytics

Answer

Azure Firewall logs

Question 12

A SOC wants a Sentinel rule to include account, host, and IP entities so analysts can pivot during investigation. What should be configured in the analytics rule?

Accepted Answer

Entity mapping. Entity mapping is the correct configuration because it explicitly links the analytics rule's results to known entity types (account, host, IP) in Microsoft Sentinel. This enables analysts to pivot directly from an alert to related entities in the investigation graph, enriching context without manual cross-referencing. Without entity mapping, the rule would generate alerts but lack the structured entity data needed for seamless pivot actions.

Answer

Custom details only

Answer

Suppression rules

Answer

Workbook parameters

Question 13

You need to provide secure remote access to Azure virtual machines for administrators without exposing them to the public internet. The solution must use a single entry point and support Azure Active Directory (now Microsoft Entra ID) authentication. Which Azure service should you use?

Accepted Answer

Azure Bastion.. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing public IP addresses. It uses a single entry point (the Bastion host) and supports Microsoft Entra ID authentication for login, meeting both requirements.

Answer

Just-in-time (JIT) VM access with Microsoft Defender for Cloud.

Answer

Azure Front Door with private endpoints.

Answer

Azure VPN Gateway with point-to-site VPN.

Question 14

A Microsoft Sentinel rule should run with minimal delay against supported data sources and produce alerts close to event time. Which rule type should be considered?

Accepted Answer

Near-real-time analytics rule. Near-real-time (NRT) analytics rules in Microsoft Sentinel are designed to run at 1-minute intervals, providing the minimal delay for alert generation against supported data sources. This rule type queries data with low latency, ensuring alerts are produced close to the event time, which is critical for timely threat detection.

Answer

Fusion rule

Answer

Workbook query

Answer

Threat intelligence indicator import

Question 15

A security engineer wants Defender for Cloud to detect threats against Azure SQL Database and SQL Server on Azure VMs. Which plan should be enabled?

Accepted Answer

Defender for Databases or Defender for SQL coverage as presented in the portal. Defender for Databases (or the Defender for SQL coverage option in the portal) is the correct plan because it provides threat detection specifically for Azure SQL Database and SQL Server on Azure VMs. This plan monitors anomalous activities such as SQL injection, brute-force attacks, and unusual access patterns using Microsoft's threat intelligence and machine learning models. It is the only plan that directly covers both PaaS and IaaS SQL workloads as described.

Answer

Defender for Storage

Answer

Defender for App Service only

Answer

Defender External Attack Surface Management