AZ-500 Practice Test 25 — 15 Questions

Question 1

A team wants Sentinel incidents to automatically assign to the Tier 2 queue when severity is High and the product name is Microsoft Defender for Endpoint. What should they configure?

Accepted Answer

An automation rule that updates owner/status based on conditions. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners or queues based on conditions like severity and product name. By configuring an automation rule with a condition that triggers when severity equals 'High' and the product name is 'Microsoft Defender for Endpoint', you can set the incident owner to a specific user or group (e.g., Tier 2 queue) and optionally update the status. This directly meets the requirement without manual intervention.

Answer

A workbook with a dropdown filter

Answer

A watchlist containing Tier 2 users only

Answer

A data retention policy

Question 2

You need to distribute incoming internet traffic across multiple Azure virtual machines in the same region. The solution must provide layer 7 load balancing and SSL offloading. Which Azure service should you use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple Azure virtual machines in the same region. It supports SSL termination (offloading), which offloads the decryption work from the backend VMs, and provides advanced routing based on URL path, host headers, or other HTTP attributes.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 3

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct feature because it allows users to reset their own passwords without IT intervention. SSPR integrates with Microsoft Entra ID and can be configured to require verification methods such as email, phone, or security questions before allowing a password change. This directly meets the requirement of enabling users to reset passwords independently.

Answer

Identity Protection

Answer

Multifactor authentication

Answer

Password Protection

Question 4

A company has an Azure virtual network with a subnet that contains virtual machines. They have deployed Azure Firewall in a hub VNet and peered the spoke VNet to the hub. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. However, traffic from the VMs is still going directly to the internet. What is the most likely cause?

Accepted Answer

The route table is not associated with the subnet.. The most likely cause is that the route table containing the default route (0.0.0.0/0) with the Azure Firewall's private IP as the next hop has not been associated with the spoke subnet. Without this association, the subnet's VMs will use the system default route, which sends internet-bound traffic directly out via the Azure default gateway (0.0.0.0/0, next hop type Internet), bypassing the firewall entirely.

Answer

The Azure Firewall's private IP is not configured as the next hop; it should be the public IP.

Answer

The VNet peering is not configured correctly.

Answer

The Azure Firewall has a default route that bypasses itself.

Question 5

A company uses Azure AD Privileged Identity Management (PIM) for the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a justification, and the activation requires approval from a designated security group. Which PIM role settings should they configure?

Accepted Answer

Require justification on activation (Yes), Require approval (Yes), Select approver(s) (the security group).. PIM role settings allow administrators to enforce both justification and approval workflows for role activation. Setting 'Require justification on activation' to 'Yes' ensures the user provides a reason, and setting 'Require approval' to 'Yes' with the designated security group as the approver enforces the approval requirement. This combination directly meets the company's stated requirements.

Answer

Require justification on activation (No), Require approval (Yes), Select approver(s) (the security group).

Answer

Expiration > Maximum activation duration (4 hours).

Answer

On activation, require Azure MFA registration.

Question 6

You need to allow a specific IP address (203.0.113.5) to access an Azure Storage account over the internet. All other internet traffic must be denied. You have enabled the storage account firewall. What should you configure?

Accepted Answer

Add the IP address to the firewall rules of the storage account.. The Azure Storage account firewall allows you to configure IP-based access control rules. By adding the specific IP address 203.0.113.5 to the firewall rules, you explicitly permit traffic from that IP while denying all other internet traffic, as the default rule is to deny when the firewall is enabled.

Answer

Create a private endpoint for the storage account.

Answer

Configure an NSG on the subnet to allow the IP address.

Answer

Add a service endpoint for Microsoft.Storage to the subnet.

Question 7

Refer to the exhibit. You have a VNet with two subnets, each with a different NSG. Both NSGs have default rules. What is the default connectivity between VMs in subnetA and subnetB?

Accepted Answer

Traffic is allowed by default.. By default, Network Security Groups (NSGs) include an inbound rule named 'AllowVNetInBound' that permits traffic from any virtual network (including peered VNets) to any destination within the VNet. Since subnetA and subnetB are both part of the same VNet, this default rule allows all traffic between VMs in these subnets, regardless of the separate NSG assignments. No additional configuration like peering is required because the subnets share the same virtual network boundary.

Answer

Traffic is blocked by default.

Answer

Traffic is allowed only if the VNet has peering.

Answer

Traffic is allowed only if the subnets are in the same region.

Question 8

You are troubleshooting a sign-in issue. A user reports that they are repeatedly prompted for authentication when accessing a cloud app, even though they already authenticated earlier in the day. You check the Conditional Access policy and see that 'Session control - Sign-in frequency' is set to 1 hour. What is the most likely cause?

Accepted Answer

The sign-in frequency setting forces reauthentication after 1 hour. The 'Session control - Sign-in frequency' setting in Conditional Access enforces reauthentication at the specified interval. When set to 1 hour, the user must re-authenticate every hour, regardless of prior authentication earlier in the day. This explains the repeated prompts, as the session lifetime is capped by this policy.

Answer

The browser is blocking persistent cookies

Answer

Token lifetime policy overrides the sign-in frequency

Answer

The user is considered high risk by Identity Protection

Question 9

You need to assign the 'Security Administrator' role in Microsoft Entra ID to a user named User1. The role assignment must be eligible, and User1 must provide a justification when activating the role. What should you use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID is the only service that supports time-bound, eligible role assignments with activation justification. By configuring a PIM policy for the Security Administrator role, you can require User1 to provide a business justification before the role is activated for a specified duration.

Answer

Direct role assignment in Azure AD roles and administrators

Answer

Global Administrator role with custom activation policy

Answer

User Administrator role with access reviews

Question 10

Refer to the exhibit. You run the command and see the output. What does the UserType 'Member' indicate?

Accepted Answer

The user is a member of the tenant. The UserType 'Member' indicates that the user is a member of the tenant, meaning the user's identity is native to the Microsoft Entra ID tenant and not from an external directory. This is distinct from 'Guest' (UserType = Guest), which represents external users invited via B2B collaboration. The command shown is likely Get-AzureADUser or a similar cmdlet, where the UserType property directly reflects the user's relationship to the tenant.

Answer

The user is a service principal

Answer

The user is a guest user

Answer

The user is an administrator

Question 11

You have an Azure Kubernetes Service (AKS) cluster that needs to restrict egress traffic to specific Azure services (e.g., Azure Container Registry, Azure Monitor). You want a managed solution that allows you to define FQDN-based rules. Which Azure service should you use?

Accepted Answer

Azure Firewall. Azure Firewall is the correct choice because it is a managed, cloud-native network security service that provides FQDN-based rules to control outbound (egress) traffic. It allows you to define application rules using fully qualified domain names (FQDNs) to restrict egress traffic to specific Azure services like Azure Container Registry and Azure Monitor, without needing to manage underlying infrastructure.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Question 12

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to ensure that all privileged role activations are approved by a manager and require a ticket number. What should you configure in PIM?

Accepted Answer

Role settings for the privileged role. In Microsoft Entra ID PIM, role settings for each privileged role allow you to configure approval requirements and justification fields. By editing the role settings, you can require approval from a designated approver (e.g., a manager) and mandate a ticket number in the justification field, ensuring compliance with organizational policies.

Answer

Audit history

Answer

Alerts

Answer

Access reviews

Question 13

Refer to the exhibit. You run the PowerShell command above and get the output: Access: Allow, SourceAddressPrefix: *, DestinationAddressPrefix: VirtualNetwork, DestinationPortRange: 22, Protocol: TCP, Priority: 100. A security audit requires that SSH access be restricted to only the management subnet (10.0.1.0/24). What should you do?

Accepted Answer

Change the SourceAddressPrefix to '10.0.1.0/24'.. The existing rule allows SSH (TCP port 22) from any source (*) to the virtual network. To restrict SSH access to only the management subnet (10.0.1.0/24), you must change the SourceAddressPrefix from '*' to '10.0.1.0/24'. This ensures only traffic originating from the management subnet is permitted, meeting the security audit requirement.

Answer

Change the DestinationAddressPrefix to '10.0.1.0/24'.

Answer

Change the Access to Deny and create a new rule to allow SSH from management subnet.

Answer

Change the SourceAddressPrefix to 'VirtualNetwork'.

Question 14

Your company deploys a new Azure application gateway with WAF policy in prevention mode. After deployment, users report that legitimate traffic is being blocked. You need to identify which WAF rules are causing the blocks without affecting the security posture. What should you do?

Accepted Answer

Change the WAF policy mode to detection.. Switching the WAF policy mode from prevention to detection allows the application gateway to log WAF rule matches without blocking legitimate traffic. This enables you to review the logs and identify which specific rules are causing false positives, while still maintaining visibility into threats. Once identified, you can fine-tune the rules or create exceptions without disrupting the security posture.

Answer

Disable the WAF policy temporarily.

Answer

Create a custom rule to allow all traffic.

Answer

Set the WAF policy to custom rules only.

Question 15

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). You need to investigate a possible insider threat where a user is accessing sensitive data from unusual locations. Which Sentinel feature should you use to visualize the user's activities and related entities?

Accepted Answer

UEBA investigation insights and entity pages. UEBA in Microsoft Sentinel provides investigation insights and entity pages that aggregate user activities, related entities, and behavioral anomalies into a visual timeline. This allows you to see a user's access patterns from unusual locations and correlate them with other entities like devices or IP addresses, making it the correct feature for investigating insider threats.

Answer

Hunting queries

Answer

Analytics rules

Answer

Workbooks