AZ-500 Practice Test 2 — 25 Questions

Question 1

A company has several Azure virtual machines (VMs) in a VNet that host a legacy application. IT support staff need to perform remote administration using RDP. The security team wants to avoid exposing the VMs to the public internet and also enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions. Which Azure service should they deploy to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing the VMs to a public IP address. It also integrates with Azure AD and Conditional Access to enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions, meeting both the security and compliance requirements.

Answer

Just-in-Time (JIT) VM Access from Microsoft Defender for Cloud

Answer

Network Security Groups (NSGs) with allow rules for RDP only from a trusted IP

Answer

Azure Firewall with DNAT rules to forward RDP traffic

Question 2

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to manage RDP connections to a critical jump-box virtual machine. The company has a CI/CD pipeline running on Azure DevOps agent pools that needs to periodically RDP into this VM to deploy software. The agent pool's source IP addresses are dynamic and change frequently. They want the pipeline to automatically request JIT access before each deployment without manual intervention. Which approach should they implement?

Accepted Answer

Use the Azure REST API with a managed identity assigned to the DevOps agent to request JIT access, specifying the agent's current source IP address. It uses the Azure REST API with a managed identity to dynamically request JIT VM access, specifying the agent's current source IP address. This approach allows the CI/CD pipeline to authenticate without secrets and automatically obtain time-bound RDP access, even though the agent's IP changes frequently. The managed identity provides secure, automated authentication to Azure Resource Manager, enabling the pipeline to call the JIT policy endpoint and grant access for the deployment duration.

Answer

Create a JIT access rule in Defender for Cloud with a scheduled time window that matches the pipeline's deployment schedule

Answer

Configure a PowerShell script in the pipeline to modify the network security group (NSG) to allow the agent's IP during deployment

Answer

Assign a static public IP to the Azure DevOps agent and add that IP to the JIT allowed list permanently

Question 3

A company uses Azure AD Identity Protection. They have detected a user with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user only when the sign-in comes from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy. Which configuration should they use?

Accepted Answer

Assign the user to the policy, set condition 'User risk level: High' and condition 'Locations: All locations except trusted', and set 'Grant' to 'Block access'. It combines the 'User risk level: High' condition (triggered by Identity Protection's user risk detection) with the 'Locations: All locations except trusted' condition, and sets 'Grant' to 'Block access'. This ensures that only sign-ins from untrusted locations are blocked when the user's risk is high, meeting the requirement to allow sign-ins from trusted IPs even for high-risk users.

Answer

Assign the user to the policy, set condition 'Sign-in risk level: High' and condition 'Locations: All trusted locations', and set 'Grant' to 'Block access'

Answer

Assign the user to the policy, set condition 'User risk level: High' and set 'Grant' to 'Require multi-factor authentication'

Answer

Create a risk detection policy in Identity Protection that triggers a user risk policy, and have Conditional Access use the risk policy

Question 4

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

Accepted Answer

Set the key vault's 'enabledForDiskEncryption' property to true.. Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.

Answer

Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.

Answer

Grant the virtual machine's managed identity 'Contributor' role on the key vault.

Answer

Configure soft-delete and purge protection on the key vault.

Question 5

A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?

Accepted Answer

Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.. It combines a condition for 'User risk' set to 'High' with an exclusion of 'All trusted locations' under the 'Locations' condition, then grants 'Block access'. This ensures that the block only applies when the sign-in originates from an untrusted location, meeting the requirement to automatically block sign-ins for high-risk users only from locations not in the company's trusted IP list.

Answer

Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.

Answer

Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.

Answer

Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.

Question 6

You configure Azure Bastion to allow secure RDP access to VMs in a VNet. However, users report that they cannot connect to a specific VM, while other VMs in the same VNet are accessible. The VM is running and has a public IP. What is the most likely cause?

Accepted Answer

The NSG on the VM's subnet does not allow inbound RDP from the AzureBastionSubnet.. Azure Bastion provides secure RDP/SSH connectivity to VMs in a peered VNet without exposing public IPs. For Bastion to reach a VM, the Network Security Group (NSG) on the VM's subnet must allow inbound TCP traffic on port 3389 from the AzureBastionSubnet (which uses the Azure Bastion service's private IP range). If the NSG blocks this traffic, Bastion cannot establish the RDP session even though the VM is running and has a public IP. The correct answer is B because the NSG misconfiguration is the most likely cause when other VMs in the same VNet are accessible.

Answer

The user does not have 'Reader' role on the VM.

Answer

The VM is located in a different region than the Bastion host.

Answer

The VM has a public IP assigned, which interferes with Bastion connectivity.

Question 7

A company has a subscription with Azure Active Directory (Azure AD). They want to enable a conditional access policy that requires all users to use multi-factor authentication (MFA) when accessing the Azure portal. The policy should only apply to users who are members of a group called 'AllUsers'. Which assignment should they configure in the policy?

Accepted Answer

Assign the 'AllUsers' group to the 'Users' section and select 'Azure portal' as the cloud app. In an Azure AD Conditional Access policy, the 'Users' section is where you specify which users or groups the policy applies to, and the 'Cloud apps' section is where you select the target application (Azure portal). By assigning the 'AllUsers' group to 'Users' and selecting 'Azure portal' as the cloud app, the policy enforces MFA for all members of that group when they access the Azure portal.

Answer

Assign the 'AllUsers' group to the 'Cloud apps' section and select 'Azure portal' as the application

Answer

Add a condition for 'Client apps' specifying 'Browser' only

Answer

Create two policies: one for users and one for the Azure portal

Question 8

A company uses Azure Firewall to filter outbound traffic. They want to ensure that all DNS queries from virtual machines in a spoke VNet are routed through the Azure Firewall for logging and inspection. They have already configured the firewall to use a custom DNS server. Which additional Azure Firewall feature must be enabled to ensure that the VMs use the firewall as a DNS proxy?

Accepted Answer

Enable DNS proxy on the firewall policy. Enabling DNS proxy on the Azure Firewall policy allows the firewall to act as a DNS proxy for the virtual machines in the spoke VNet. When DNS proxy is enabled, the firewall listens on port 53 and forwards DNS queries from the VMs to the configured custom DNS server, ensuring all DNS traffic is logged and inspected. This is required even after setting a custom DNS server on the firewall, as the VMs must be configured to use the firewall's private IP address as their DNS server, and the proxy handles the forwarding.

Answer

Configure a DNS forwarding rule

Answer

Enable Threat Intelligence DNS logging

Answer

Create a NAT rule for DNS traffic

Question 9

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Global Administrator' role. The security team wants to ensure that when a user activates the role, they must provide a justification, and the activation request must be approved by a specific group of security administrators. They have already configured the role for activation with a maximum duration of 8 hours. Which additional PIM settings should they configure?

Accepted Answer

Enable 'Require approval to activate' and select the security group as approver. The scenario requires both justification and approval for role activation. PIM allows you to enforce 'Require justification on activation' and 'Require approval to activate' as separate settings. By enabling 'Require approval to activate' and selecting the security group as the approver, you meet the requirement for approval. Justification is already a default requirement in PIM when approval is enabled, but you must also explicitly set 'Require justification on activation' to 'On' if not already enforced; however, the question states they have already configured the role for activation with a maximum duration, so the missing piece is the approval configuration.

Answer

Set 'Require Azure Multi-Factor Authentication' to 'On'

Answer

Set 'Require justification on activation' to 'On' and also enable 'Require ticket information'

Answer

Create a separate PIM request workflow using Azure Logic Apps

Question 10

A company has Azure virtual machines that need to download updates from specific external websites (e.g., *.microsoft.com and *.windowsupdate.com). The security team wants to centrally manage and allow outbound HTTPS traffic only to these FQDNs, while blocking all other outbound internet access. Which Azure networking service should they deploy to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that can centrally enforce outbound FQDN-based rules. It allows you to create application rules that permit HTTPS traffic to specific FQDNs (e.g., *.microsoft.com) while blocking all other outbound internet access, meeting the security team's requirement for granular, centralized control.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 11

A company has an Azure virtual network with a subnet that hosts a web application. The security team wants to allow inbound HTTPS traffic (port 443) from the internet to the web servers, but block all other inbound traffic. They have a network security group (NSG) associated with the subnet. What is the minimal set of inbound rules required?

Accepted Answer

A rule allowing HTTPS from Internet, and no other rules (default deny all inbound).. Network security groups (NSGs) in Azure have a default deny-all inbound rule (rule 65500) that is automatically applied to all inbound traffic. Therefore, you only need to add an explicit allow rule for HTTPS (port 443) from the Internet. No additional deny rule is required because the default rule already blocks all other inbound traffic.

Answer

A rule allowing HTTPS from Internet, and a default deny all rule.

Answer

A rule allowing HTTPS from Internet, and a rule explicitly denying all other inbound traffic.

Answer

A rule allowing HTTPS from any source, and a rule denying all other traffic with lower priority.

Question 12

A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?

Accepted Answer

Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.. Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.

Answer

Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.

Answer

Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.

Answer

Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.

Question 13

A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?

Accepted Answer

Enable Azure Storage encryption with customer-managed keys (CMK). Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.

Answer

Use service-managed keys (SSE) with platform-managed keys

Answer

Enable Azure Disk Encryption on VMs that access the storage account

Answer

Configure Azure Information Protection for the storage account

Question 14

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

Accepted Answer

Enable 'Auto-provisioning' in Defender for Cloud's environment settings.. Defender for Cloud's environment settings include a dedicated 'Auto-provisioning' toggle for the Log Analytics agent. When enabled, Defender for Cloud automatically installs the agent on any new Azure VM that is provisioned in the selected subscriptions, ensuring continuous monitoring without manual intervention. This is the native mechanism within Defender for Cloud to enforce agent deployment at scale.

Answer

Configure Azure Automation State Configuration to push the agent.

Answer

Set up data connectors in Microsoft Sentinel.

Answer

Create an Azure Policy assignment to deploy the Log Analytics agent.

Question 15

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Accepted Answer

Configure Dynamic Data Masking (DDM) for the PII columns.. (Dynamic Data Masking) masks PII columns for non-privileged users. Option C (Minimum TLS Version 1.2) ensures data in transit is encrypted. Option D (Transparent Data Encryption) encrypts data at rest. Option B (Always Encrypted) is client-side and requires client support, not suitable for legacy apps. Option E (Azure Information Protection) is not a database security feature for this scenario.

Answer

Implement Always Encrypted for the PII columns.

Answer

Apply Azure Information Protection labels to the database.

Question 16

A company stores sensitive healthcare data in Azure SQL Database. They need to encrypt specific columns containing patient diagnosis codes so that even database administrators with the 'sysadmin' role cannot view the plaintext. The application must be able to perform equality searches (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted (deterministic encryption). Always Encrypted with deterministic encryption ensures that sensitive columns are encrypted at the client side, so the encryption keys are never revealed to the database engine, including sysadmin roles. Deterministic encryption generates the same ciphertext for the same plaintext, enabling equality searches (WHERE clauses) on encrypted columns without exposing plaintext data to the server.

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security (RLS)

Answer

Dynamic Data Masking (DDM)

Question 17

A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) policy.. Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.

Answer

Azure Firewall.

Answer

Network Security Groups on the VM subnet.

Answer

Azure DDoS Protection.

Question 18

A security operations team uses Microsoft Sentinel. They want to create a custom analytics rule that detects when an Azure virtual machine is created with a public IP address that is not in an approved list. Which type of rule should they use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that runs on a recurring schedule (e.g., every 5 minutes) to detect when an Azure VM is created with a public IP not in an approved list. This rule type is designed for custom detection logic that requires periodic evaluation of log data, such as AzureActivity logs or Azure Resource Graph, making it ideal for this scenario.

Answer

NRT rule

Answer

Anomaly rule

Answer

Fusion rule

Question 19

A company has an Azure virtual network with two subnets: App and Data. The App subnet hosts web servers, and the Data subnet hosts SQL databases. Security policy requires that only HTTPS traffic from the App subnet is allowed to the Data subnet, and all other inbound traffic to the Data subnet must be blocked. The solution must use a single network security group (NSG) associated to the Data subnet. Which NSG inbound rule configuration meets the requirement?

Accepted Answer

Allow HTTPS from App subnet priority 100, then Deny All priority 200. NSG rules are evaluated in priority order, with lower numbers processed first. By placing the Allow HTTPS rule at priority 100, it matches and permits traffic from the App subnet to the Data subnet. The subsequent Deny All rule at priority 200 then blocks all other inbound traffic, satisfying the security policy with a single NSG on the Data subnet.

Answer

Deny All priority 100, then Allow HTTPS from App subnet priority 200

Answer

Allow HTTPS from App subnet priority 100, and Deny All from any source priority 100 (duplicate priority)

Answer

Allow HTTPS from App subnet priority 100, no other rules

Question 20

Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?

Accepted Answer

Microsoft Defender for Servers. Just-In-Time (JIT) VM access is a feature of Microsoft Defender for Cloud that requires the Microsoft Defender for Servers plan to be enabled on the subscription. This plan provides the advanced threat protection and access control capabilities, including JIT, which dynamically locks down inbound traffic to VMs and opens ports only when authorized users request access via Azure Policy or the portal.

Answer

Microsoft Defender for Databases

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Key Vault