AZ-500 Practice Test 24 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect Azure workloads. You notice that a critical Azure VM is not covered by any of the Defender for Cloud plans. You need to ensure that the VM is protected by the Defender for Servers plan. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM.. Defender for Cloud plans are enabled at the subscription level, not per resource. By enabling the Defender for Servers plan in the Defender for Cloud environment settings for the subscription containing the VM, all current and future VMs in that subscription will be automatically protected, including the critical VM in question.

Answer

Create a custom Azure Policy to assign the Defender for Servers plan to the VM.

Answer

Enable the Defender for Servers plan directly on the VM's security configuration blade.

Answer

Ensure the VM is running a supported operating system; the plan is automatically enabled for all VMs.

Question 2

You are designing a secure data solution for a financial application. The data must be encrypted at rest, in transit, and in use. You choose Azure SQL Database. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption, enforce TLS, and Always Encrypted. It addresses all three encryption states required by the scenario: Transparent Data Encryption (TDE) encrypts data at rest, enforcing TLS secures data in transit, and Always Encrypted protects data in use by keeping encryption keys client-side, ensuring plaintext data never appears in the database engine.

Answer

Azure Information Protection, Dynamic Data Masking, and column-level security

Answer

Always Encrypted, Azure Active Directory authentication, and Azure Information Protection

Answer

Transparent Data Encryption, Dynamic Data Masking, and Azure Active Directory authentication

Question 3

A security analyst uses Microsoft Defender for Cloud. They want to view a list of all security recommendations for their Azure subscription, prioritized by their potential impact. Which Defender for Cloud dashboard should they use?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations based on their potential impact on your overall security posture. Each recommendation is assigned a score contribution, allowing you to focus on the actions that will most improve your secure score. This directly matches the requirement to view recommendations prioritized by impact.

Answer

Regulatory Compliance

Answer

Inventory

Answer

Workload protections

Question 4

Your organization has Microsoft Sentinel deployed in the East US region. You need to ensure that security logs are retained for 2 years to meet compliance requirements. The workspace retention policy is set to 90 days. What should you do?

Accepted Answer

Configure data retention for the specific tables that need long-term retention. Microsoft Sentinel allows you to configure table-level retention in Log Analytics workspaces, overriding the workspace default retention of 90 days. By setting the retention period to 730 days (2 years) on specific tables containing security logs, you meet compliance requirements without affecting other tables. This is the recommended approach for long-term retention of security data in Sentinel.

Answer

Change the workspace retention setting to 730 days

Answer

Use Azure Policy to enforce retention on the Log Analytics workspace

Answer

Export logs to an Azure Storage account and set a lifecycle management policy

Question 5

An organization uses Microsoft Defender for Cloud. They want to allow specific administrators to temporarily open RDP (port 3389) to a virtual machine only when needed, and for a limited time, while minimizing management overhead. Which Defender for Cloud feature should they use?

Accepted Answer

Just-in-time (JIT) VM access. Just-in-time (JIT) VM access in Microsoft Defender for Cloud allows administrators to temporarily open RDP (port 3389) to a virtual machine for a limited time, reducing exposure to brute-force attacks. It integrates with Azure Network Security Groups (NSGs) and Azure Firewall to automatically lock down inbound traffic when not in use, minimizing management overhead by eliminating the need for manual NSG rule changes.

Answer

Azure Bastion

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Network Security Groups (NSGs)

Question 6

Refer to the exhibit. You are deploying an Azure Disk Encryption Set using this ARM template. The deployment succeeds, but when you try to create a disk using this encryption set, the disk creation fails with an error about key vault permissions. What is the most likely cause?

Accepted Answer

The disk encryption set's system-assigned identity lacks Get, WrapKey, and UnwrapKey permissions on the key vault. The disk encryption set uses a system-assigned managed identity to authenticate to Azure Key Vault. When the ARM template deploys the encryption set, this identity is created but must be explicitly granted Get, WrapKey, and UnwrapKey permissions on the key vault's access policy. Without these permissions, the encryption set cannot retrieve the key or perform wrapping operations, causing disk creation to fail.

Answer

The identity type should be UserAssigned

Answer

The key vault URI is malformed

Answer

The key source should be Microsoft.Storage

Question 7

Your company deploys a web application in an Azure App Service that needs to securely connect to an Azure SQL Database. You want to avoid exposing the database to the public internet. What is the recommended approach?

Accepted Answer

Use a private endpoint for the SQL database and VNet integration for the App Service. It uses Azure Private Endpoint to place the Azure SQL Database on a virtual network, removing its public endpoint, and combines it with VNet integration for the App Service to route traffic through the same VNet. This ensures the database is never exposed to the public internet, meeting the security requirement without relying on IP-based firewall rules that can change or be spoofed.

Answer

Configure the SQL database firewall to allow only the App Service outbound IP

Answer

Use Azure Firewall to block outbound traffic to the database

Answer

Create an NSG on the database subnet to deny internet traffic

Question 8

You are designing a secure compute solution for a critical application that must comply with PCI DSS. The application runs on Azure Virtual Machines with sensitive data. You need to ensure that ephemeral disks are encrypted at the host level. Which Azure Disk Encryption option should you use?

Accepted Answer

Encryption at host. Encryption at host encrypts data at the VM host level, including ephemeral disks, before it is transmitted to Azure Storage. This meets the PCI DSS requirement for encrypting ephemeral disks at rest without relying on the guest OS or key management. It uses server-side encryption with platform-managed or customer-managed keys directly on the host node.

Answer

Server-side encryption (SSE) with platform-managed keys

Answer

Azure Disk Encryption (ADE) with Key Vault

Answer

Double encryption (SSE with CMK and ADE)

Question 9

You have an Azure subscription with a virtual network (VNet1) that hosts a SQL Managed Instance. You need to connect from an on-premises application to the SQL Managed Instance using a private IP address, with minimal latency and without traversing the public internet. The on-premises network has a high-speed ExpressRoute connection to Microsoft. What should you configure?

Accepted Answer

Connect the on-premises network to Azure via ExpressRoute private peering and ensure the SQL Managed Instance subnet is reachable.. ExpressRoute private peering establishes a Layer 3 connection between on-premises and Azure, ensuring traffic to the SQL Managed Instance subnet traverses the Microsoft backbone network without touching the public internet. This provides the lowest latency and highest security for private IP connectivity, as the managed instance's private IP is directly routable over the ExpressRoute circuit.

Answer

Configure a public endpoint on the SQL Managed Instance and allow the on-premises public IP.

Answer

Use Azure Private Link Service and connect via a VPN.

Answer

Create a site-to-site VPN connection and enable forced tunneling.

Question 10

You have an Azure subscription with multiple VNets connected via VNet peering. You need to audit all network traffic between two specific VNets for compliance. The solution must capture traffic metadata (source/destination IP, ports, protocol) without affecting performance. What should you use?

Accepted Answer

Enable NSG flow logs and use Network Watcher traffic analytics.. NSG flow logs capture metadata (source/destination IP, port, protocol) for traffic traversing a Network Security Group, and Network Watcher traffic analytics provides aggregated visibility into inter-VNet flows without inline inspection. This meets the compliance requirement for auditing metadata without performance impact, as flow logs are collected asynchronously and do not alter the data path.

Answer

Route all traffic through Azure Firewall and enable logs.

Answer

Use Network Watcher packet capture on the VMs.

Answer

Enable Azure Monitor metrics on the VNet peering.

Question 11

Your organization has a Microsoft Entra ID tenant and uses Azure Virtual Desktop (AVD). You need to ensure that AVD session hosts in a virtual network can access on-premises resources securely without exposing the session hosts to the internet. The on-premises network is connected to Azure via ExpressRoute. All AVD traffic should be routed through the ExpressRoute connection. You have already deployed a reverse connect transport for AVD. What else should you configure to meet the requirements?

Accepted Answer

Add a user-defined route (UDR) in the AVD subnet for the on-premises IP prefixes with next hop to the ExpressRoute gateway.. Adding a user-defined route (UDR) in the AVD subnet for on-premises IP prefixes with the next hop set to the ExpressRoute gateway forces all traffic destined for on-premises resources to traverse the ExpressRoute connection. This ensures secure, private connectivity without exposing session hosts to the internet, while the reverse connect transport already handles AVD control plane traffic securely.

Answer

Configure VNet peering between the AVD virtual network and the on-premises network.

Answer

Disable reverse connect transport and allow inbound RDP traffic from the internet.

Answer

Create a private endpoint for the AVD control plane.

Question 12

Your company has deployed Azure Kubernetes Service (AKS) in a virtual network. The AKS cluster needs to pull images from a private Azure Container Registry (ACR) that has a private endpoint configured. The virtual network where AKS is deployed is peered to the ACR's virtual network. You have configured the AKS cluster to use managed identity for authentication to ACR. However, the AKS cluster is unable to pull images from the ACR. You need to resolve the connectivity issue without exposing the ACR to the internet. What should you do?

Accepted Answer

Link the private DNS zone of the ACR private endpoint to the AKS virtual network.. The AKS cluster cannot pull images from the private ACR because the private endpoint's DNS resolution is not propagated to the AKS virtual network. By linking the private DNS zone of the ACR private endpoint to the AKS virtual network, the AKS nodes can resolve the ACR's private FQDN to the private IP address of the endpoint, enabling connectivity without exposing the ACR to the internet.

Answer

Update the AKS cluster's DNS server to use a custom DNS that can resolve the private endpoint.

Answer

Delete the private endpoint and configure ACR firewall rules to allow the AKS subnet.

Answer

Recreate the AKS cluster with a different managed identity that has ACR pull permissions.

Question 13

You are configuring security for an Azure App Service web app that connects to an Azure SQL Database. You need to ensure that the database connection string does not contain credentials in plaintext. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and use a Key Vault reference in the App Service application settings.. Azure Key Vault provides a secure, centralized store for secrets like database connection strings. By using a Key Vault reference in the App Service application settings (e.g., @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/)), the connection string is never exposed in plaintext in configuration files or environment variables, and access is controlled via managed identities or service principals.

Answer

Store the connection string in the web.config file with encryption.

Answer

Store the connection string in Azure App Configuration with encryption.

Answer

Store the connection string in an App Service application setting without encryption.

Question 14

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. Which data source should you use?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Microsoft Entra ID Sign-in Logs contain detailed information about user sign-in events, including location data. A custom analytic rule in Microsoft Sentinel can use these logs to detect sign-ins from unfamiliar locations by comparing the location against a user's typical sign-in pattern, which is a common UEBA (User and Entity Behavior Analytics) scenario.

Answer

Azure Activity Logs

Answer

Azure AD Audit Logs

Answer

Microsoft 365 Defender Alerts

Question 15

You are analyzing network traffic patterns. You have configured NSG flow logs with Traffic Analytics as shown in the exhibit. You need to identify which virtual machines are communicating with a specific malicious IP address. Which tool should you use to query the flow log data?

Accepted Answer

Log Analytics workspace using KQL queries. NSG flow logs with Traffic Analytics are stored in a Log Analytics workspace. To query the flow log data and identify which virtual machines are communicating with a specific malicious IP address, you must use Log Analytics with Kusto Query Language (KQL). KQL allows you to filter, aggregate, and join flow log records based on source/destination IP addresses, ports, and protocols, enabling precise identification of affected VMs.

Answer

Azure Storage Explorer

Answer

Azure Monitor Metrics Explorer

Answer

Network Watcher Topology