AZ-500 Practice Test 3 — 25 Questions

Question 1

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable password writeback in Microsoft Entra Connect and assign Azure AD Premium licenses. Password writeback requires both the feature to be enabled in Microsoft Entra Connect (via the synchronization settings) and Microsoft Entra ID Premium licenses (P1 or P2) assigned to users. Without the license, the SSPR writeback functionality is not available, even if the feature is enabled in the sync tool. This combination allows password changes from the cloud to be written back to on-premises Active Directory.

Answer

Configure pass-through authentication

Answer

Enable password hash synchronization

Answer

Install the Azure AD Password Protection proxy

Question 2

A security operations team uses Microsoft Sentinel. They have created a playbook that sends an email notification to the security team when a high-severity incident is created by a specific analytics rule named 'CriticalRDPAccess'. They want the playbook to trigger automatically only when the incident has severity 'High' AND the incident was created by the rule named 'CriticalRDPAccess'. Which automation rule configuration should they use?

Accepted Answer

Condition: Incident severity equals High; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.. The automation rule must use the AND operator to require both conditions—incident severity equals 'High' AND incident rule name equals 'CriticalRDPAccess'—to trigger the playbook. This ensures the playbook runs only when both criteria are met, matching the requirement exactly. Using 'contains' instead of 'equals' (as in Option A) would incorrectly match rules with 'CriticalRDPAccess' as a substring, potentially triggering on unintended rules.

Answer

Condition: Incident severity equals High; AND Incident rule name contains 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity equals High; OR Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Answer

Condition: Incident severity in ['High', 'Critical']; AND Incident rule name equals 'CriticalRDPAccess'. Action: Run playbook.

Question 3

A company uses Microsoft Defender for Cloud to manage the security posture of their Azure workloads. The compliance officer needs to generate a report that shows the current compliance status against the SOC 2 standard, including the pass/fail status of each control. Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built, continuously updated view of compliance posture against standards like SOC 2. It maps Azure Policy initiatives to specific controls and shows the pass/fail status for each control, enabling the compliance officer to generate the required report directly.

Answer

Inventory

Answer

Secure Score

Answer

Workbooks

Question 4

A company uses Defender for Servers Plan 2. Which two capabilities are included compared with a basic posture-only configuration?

Accepted Answer

File integrity monitoring or equivalent advanced server protection capabilities. Defender for Servers Plan 2 includes advanced server protection capabilities such as file integrity monitoring (FIM), which tracks changes to critical system files and registry keys, and endpoint detection and response (EDR) integration through Microsoft Defender for Endpoint. These capabilities go beyond the basic posture-only configuration, which only provides vulnerability assessment and security recommendations without real-time threat detection or file change monitoring.

Answer

Azure Cost Management budget alerts

Answer

Microsoft 365 message trace

Question 5

You are a security administrator for a financial institution. You need to implement a solution that allows users to authenticate using biometrics and prevents password-based attacks. Which Microsoft Entra ID feature should you enable?

Accepted Answer

Passwordless authentication (FIDO2 or Windows Hello for Business). Passwordless authentication methods like FIDO2 and Windows Hello for Business eliminate the use of passwords entirely, thereby preventing password-based attacks such as brute force, phishing, and credential stuffing. Biometric verification (e.g., fingerprint or facial recognition) is a core component of these methods, meeting the requirement for biometric authentication. This aligns with the Zero Trust principle of reducing the attack surface by removing shared secrets.

Answer

Microsoft Entra ID Protection

Answer

Password hash synchronization

Answer

Azure Multi-Factor Authentication

Question 6

You are designing network security for a hybrid application that uses Azure Front Door and Azure Application Gateway. The application must block malicious requests at the edge before they reach the backend. You need to implement Web Application Firewall (WAF) protection with the lowest latency and the ability to inspect traffic at the application layer. Which solution should you use?

Accepted Answer

Apply WAF policy on Azure Front Door.. Azure Front Door's WAF operates at the edge of the Microsoft global network, inspecting HTTP/HTTPS traffic at the application layer (Layer 7) with minimal latency due to its distributed point-of-presence (PoP) architecture. This allows malicious requests to be blocked before they traverse the backbone to the origin, meeting the requirement for edge protection and low latency.

Answer

Enable Azure DDoS Protection on the virtual network.

Answer

Apply WAF policy on Azure Application Gateway only.

Answer

Use Azure Firewall with threat intelligence-based filtering.

Question 7

Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant. A is correct because Conditional Access in Microsoft Entra ID is the policy engine that enforces access control decisions based on signals like device compliance. Even after Intune compliance policies are configured, you must create a Conditional Access policy that requires the device to be marked as compliant. This policy blocks or grants access to corporate resources (e.g., Exchange Online, SharePoint) based on the compliance state reported by Intune to Microsoft Entra ID.

Answer

Enable certificate-based authentication for all devices

Answer

Deploy device configuration profiles to all devices

Answer

Configure app protection policies in Microsoft Defender for Cloud Apps

Question 8

Your organization uses Microsoft Entra ID and has deployed Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud applications based on user behavior and device health. Which feature should you use?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is a feature of Microsoft Defender for Cloud Apps that integrates with Microsoft Entra ID Conditional Access policies to monitor and control access to cloud applications in real time. It enforces access controls based on user behavior (e.g., risky sign-ins) and device health (e.g., compliance status from Intune), allowing actions like blocking downloads or requiring session monitoring. This directly meets the requirement to monitor and control access based on user behavior and device health.

Answer

Microsoft Purview Information Protection

Answer

Cloud App Discovery

Answer

OAuth app policies

Question 9

You are reviewing an NSG rule as shown in the exhibit. This rule is applied to a subnet containing web servers. What is the security implication of this rule?

Accepted Answer

It allows all inbound traffic, creating a security risk.. The NSG rule shown in the exhibit has a source and destination of 'Any' and an action of 'Allow' for all ports and protocols. This effectively permits all inbound traffic from any source to the subnet, bypassing any intended security restrictions. Such a configuration exposes the web servers to unrestricted network access, including malicious traffic, creating a significant security risk.

Answer

It restricts inbound traffic to TCP only.

Answer

It blocks all inbound traffic except HTTP.

Answer

It restricts inbound traffic to HTTP only.

Question 10

Drag and drop the steps to configure Azure Disk Encryption for a Windows VM using Azure Key Vault into the correct order.

Accepted Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.. The correct sequence for configuring Azure Disk Encryption for a Windows VM using Azure Key Vault is to first create or configure the Key Vault with soft-delete and purge protection, then set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions, and finally enable disk encryption on the VM specifying the Key Vault and key. This order ensures that all prerequisites are met, preventing errors during the encryption process.

Answer

1. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.

Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Answer

1. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Question 11

You need to securely connect an on-premises network to an Azure virtual network. The connection must use the internet and provide authenticated and encrypted communication. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct choice because it creates an encrypted site-to-site VPN connection over the internet using IPsec/IKE protocols. This meets the requirement for authenticated and encrypted communication between an on-premises network and an Azure virtual network without needing a dedicated private link.

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Answer

Azure Virtual WAN

Question 12

Which two actions should you take to secure Azure Storage accounts against data exfiltration?

Accepted Answer

Use Azure Private Endpoints for storage accounts.. Correct: A and C. Firewall and virtual network service endpoints restrict network access, and private endpoints provide secure connectivity. Option B (shared access keys) does not prevent exfiltration. Option D (soft delete) helps recovery but not prevention. Option E (CORS) controls cross-origin requests, not exfiltration.

Answer

Enable shared access key authentication.

Answer

Enable soft delete for blobs.

Answer

Configure CORS rules to allow all origins.

Question 13

You are an Azure security engineer. Your team has assigned the Azure Policy shown in the exhibit. A developer creates a new virtual network with a subnet that does not have a Network Security Group (NSG) associated. What will happen when the policy is evaluated?

Accepted Answer

The virtual network creation fails because a subnet lacks an NSG.. The Azure Policy in the exhibit is configured with a 'Deny' effect for virtual networks that have subnets without an associated Network Security Group (NSG). When the developer attempts to create a virtual network with a subnet lacking an NSG, the policy evaluation triggers a denial of the entire virtual network creation operation. This is because the policy's condition checks each subnet for the presence of an NSG, and if any subnet is non-compliant, the 'Deny' effect prevents the resource from being created.

Answer

A default NSG is automatically associated with the subnet.

Answer

The virtual network is created, but the subnet is denied.

Answer

The virtual network is created, and a non-compliant alert is generated.

Question 14

A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?

Accepted Answer

Two inbound rules: one to allow HTTPS, and one to deny all other traffic. Network Security Groups (NSGs) contain default inbound security rules: AllowVNetInBound (priority 65000) and AllowAzureLoadBalancerInBound (priority 65001). These default rules would permit HTTPS traffic from sources within the virtual network or from Azure Load Balancer, violating the requirement to allow HTTPS only from the specific IP range 198.51.100.0/24. Therefore, an explicit deny-all rule must be added with a higher priority (lower numerical value) than the default allow rules to block all other traffic, including that from VNet and Azure Load Balancer. The minimal set is: one rule to allow HTTPS from 198.51.100.0/24 (high priority), and one rule to deny all inbound traffic from any source (at a slightly lower priority but still above the default rules). Option A is insufficient because it relies on the default deny rule (priority 65500), which is processed after the default allow rules, so VNet and Load Balancer traffic would still be permitted.

Answer

One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'

Answer

Three inbound rules: allow HTTPS, allow RDP for management, and deny all

Answer

One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'

Question 15

You are configuring a site-to-site VPN connection between your on-premises network and Azure. You need to ensure that traffic between the networks is encrypted and authenticated. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it provides encrypted and authenticated site-to-site VPN connections using IPsec/IKE protocols. It establishes a secure tunnel between your on-premises VPN device and the Azure VPN gateway, ensuring confidentiality and integrity of traffic across the public internet.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Firewall

Question 16

You need to secure outbound traffic from an Azure virtual network to the internet. All outbound traffic must be inspected by a firewall and logged. You also need to ensure that traffic to known malicious IP addresses is blocked. Which solution should you implement?

Accepted Answer

Configure Azure Firewall with threat intelligence-based filtering and route all outbound traffic through it.. Azure Firewall with threat intelligence-based filtering can inspect and log all outbound traffic, and it uses Microsoft's threat intelligence feeds to block traffic to known malicious IP addresses and domains. By routing all outbound traffic through the firewall (e.g., via a forced tunneling route), you meet the requirements for inspection, logging, and malicious IP blocking.

Answer

Use Network Security Groups (NSGs) with default outbound deny rules.

Answer

Deploy Azure Front Door with WAF policy.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 17

A company plans to use Azure Private Endpoint to securely connect to an Azure SQL Database from an on-premises network via ExpressRoute. The private endpoint is deployed in a hub virtual network. The on-premises network is connected to the hub via ExpressRoute. What additional configuration is needed to ensure on-premises clients can resolve the private endpoint's DNS name?

Accepted Answer

Configure a DNS forwarder on-premises to forward the private link domain to Azure DNS.. Azure Private Endpoint requires DNS resolution to map the private endpoint's private IP address to the fully qualified domain name (FQDN) of the Azure SQL Database. On-premises clients connected via ExpressRoute cannot resolve the private link domain (e.g., `*.database.windows.net`) to the private IP unless a DNS forwarder is configured on-premises to forward queries for the `privatelink.database.windows.net` zone to Azure DNS (168.63.129.16). This ensures that DNS queries from on-premises resolve to the private endpoint IP instead of the public IP of the SQL Database.

Answer

Configure a network security group to allow inbound traffic from on-premises to the private endpoint.

Answer

Deploy a VPN gateway in the hub VNet for additional encryption.

Answer

Add a public DNS record for the SQL Database pointing to the private endpoint IP.

Question 18

You have an Azure Application Gateway v2 with WAF policy in prevention mode to protect a web app. Users report that legitimate requests are being blocked. You review the WAF logs and see many false positives. You need to resolve this while maintaining security. What should you do?

Accepted Answer

Use managed rule sets with custom rules to allow the legitimate traffic that is being falsely blocked.. Azure Application Gateway WAF allows you to use managed rule sets (e.g., OWASP 3.2) and then add custom rules to explicitly allow traffic that is being falsely blocked. This approach maintains the WAF in prevention mode, ensuring that true threats are still blocked, while overriding false positives for specific request patterns (e.g., based on URI, headers, or source IP). Custom rules are evaluated before managed rules, so you can create an 'allow' rule with a higher priority to bypass the false positive detection.

Answer

Add a custom rule to block all requests that do not match a known pattern.

Answer

Disable the WAF and rely on NSGs.

Answer

Switch the WAF policy to detection mode.

Question 19

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 20

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)