AZ-500 Practice Test 5 — 25 Questions

Question 1

Your company uses Azure Front Door to globally distribute traffic to a web app. You need to ensure that only traffic from Front Door can reach the web app, and all other traffic is blocked. The web app is behind an Azure Application Gateway. What is the most secure and reliable configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an NSG on the Application Gateway subnet to allow traffic only from the Front Door backend IP ranges.. Azure Front Door uses a set of backend IP ranges that are documented and change over time. By configuring an NSG on the Application Gateway subnet to allow traffic only from these specific IP ranges, you ensure that only Front Door-originated traffic reaches the Application Gateway, while all other traffic is blocked. This approach is reliable because it uses network-layer filtering that the Application Gateway subnet enforces, and it avoids the complexity of private endpoints or service tags that may not apply to the Front Door-to-Application Gateway path.

Answer

Place the web app behind a private endpoint and connect Front Door via private link.

Answer

Use an NSG on the Application Gateway subnet with a deny-all rule and allow the AzureFrontDoor.Backend service tag.

Answer

Restrict the Application Gateway to only accept traffic from the Front Door frontend IP.

Question 2

Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?

Accepted Answer

Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.. Azure Files supports network security via storage account firewalls, which can restrict access to specific IP ranges. Enabling diagnostic settings allows sending logs (e.g., to a Log Analytics workspace) for auditing. Option C correctly combines both requirements. Option A is incorrect because Private Endpoints and service endpoints provide network isolation but do not filter by IP source. Option B is incorrect because while a SAS token can include an IP restriction, it is not designed for persistent user access to home directories and complicates management. Option D is incorrect because Azure AD DS and conditional access control authentication but do not enforce network-level IP restrictions.

Answer

Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.

Answer

Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.

Answer

Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.

Question 3

You are using Microsoft Defender for Cloud to protect Azure Kubernetes Service (AKS) clusters. You need to receive alerts about suspicious activities within the cluster, such as privilege escalations. What should you enable?

Accepted Answer

Microsoft Defender for Containers. Microsoft Defender for Containers is the correct solution because it provides threat detection for AKS clusters, including alerts for privilege escalations, suspicious process execution, and other runtime threats. It integrates directly with Defender for Cloud to monitor the Kubernetes audit logs and container workloads without requiring additional data connectors or agents.

Answer

Microsoft Sentinel with AKS data connector

Answer

Azure Policy for AKS

Answer

Azure Security Center (classic)

Question 4

Which TWO Azure services can be used to distribute incoming traffic across multiple virtual machines in a backend pool while providing layer 7 load balancing? (Choose two.)

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple virtual machines in a backend pool based on HTTP/HTTPS attributes such as URL path, host headers, and cookies. It also provides SSL termination, Web Application Firewall (WAF), and session affinity, making it suitable for web application traffic.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure VPN Gateway

Question 5

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?

Accepted Answer

Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.. In Microsoft Entra ID PIM, the 'Maximum activation duration' setting in role settings controls the time window within which an approval must be granted. If the approver does not respond within that duration, the activation request is denied. By setting this to 30 minutes, requiring approval, and adding the user's manager as an approver, you ensure the manager must approve within 30 minutes or the activation is automatically denied. This directly meets the requirement.

Answer

Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.

Answer

Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.

Answer

Configure the role settings to require approval and set the approval timeout to 0 minutes.

Question 6

A company has two Azure virtual networks in different Azure regions that need to communicate with each other. The security policy mandates that all inter-region traffic must be encrypted over the public internet. Which connectivity solution should the company implement to meet this requirement?

Accepted Answer

Azure VPN Gateway (site-to-site connection). Azure VPN Gateway with a site-to-site (S2S) connection is the correct solution because it establishes an encrypted IPSec tunnel over the public internet between the two virtual networks. This meets the security mandate for encryption of inter-region traffic traversing the public internet, as IPSec provides confidentiality, integrity, and authentication at the network layer.

Answer

VNet peering

Answer

Azure ExpressRoute

Answer

Azure Firewall

Question 7

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team wants to implement a continuous compliance monitoring solution using Microsoft Defender for Cloud's regulatory compliance dashboard. They need to monitor compliance against the 'CIS Microsoft Azure Foundations Benchmark' and 'PCI DSS v3.2.1'. Currently, the subscription has the 'Azure Security Benchmark' initiative assigned. You need to configure the compliance dashboard to show both CIS and PCI DSS standards. The subscription already has Microsoft Defender for Cloud's CSPM plan enabled. You have also enabled the 'Defender for Cloud' plan for servers. What should you do to meet the requirements?

Accepted Answer

Add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 policy initiatives to the regulatory compliance dashboard.. To add compliance standards to the regulatory compliance dashboard, you need to add the corresponding policy initiatives. Option A is correct because you can add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 initiatives to the existing dashboard without removing the Azure Security Benchmark. Option B is incorrect because the CIS benchmark is not a setting but a policy initiative that must be added. Option C is incorrect because there is no separate regulatory compliance add-on; you add initiatives directly. Option D is incorrect because removing the Azure Security Benchmark is unnecessary and would cause loss of monitoring for that standard.

Answer

Enable the CIS benchmark in the Microsoft Defender for Cloud settings.

Answer

Enable Microsoft Defender for Cloud's regulatory compliance add-on.

Answer

Remove the Azure Security Benchmark initiative and assign the CIS and PCI DSS initiatives.

Question 8

A company uses Azure Front Door to accelerate and secure its public web application. The security team wants to limit the number of requests from a single client IP address to 100 per minute to prevent a single user from overwhelming the backend. Which configuration should they add to the Web Application Firewall (WAF) policy associated with the Front Door?

Accepted Answer

Add a custom rule with a rate limit condition.. Azure Front Door's WAF supports custom rate limit rules that can restrict the number of requests from a single client IP address within a specified time window. By creating a custom rule with a rate limit condition set to 100 requests per minute, the security team can prevent a single client from overwhelming the backend while allowing legitimate traffic. This is the only option that directly addresses the requirement to limit requests per client IP.

Answer

Enable a managed rule set for the WAF policy.

Answer

Configure a bot protection rule set.

Answer

Set a geolocation filter to block all traffic except from allowed countries.

Question 9

Drag and drop the steps to configure Azure Application Gateway with SSL termination using a Key Vault certificate into the correct order.

Accepted Answer

Step 1: Create an Azure Key Vault. Step 2: Import a certificate into the Key Vault. Step 3: Enable managed identity on the Application Gateway. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets. Step 5: Configure the HTTPS listener to use the certificate from Key Vault.. SSL termination requires a certificate from Key Vault, configured on the listener.

Answer

Step 1: Create an Application Gateway. Step 2: Configure the HTTPS listener. Step 3: Create a Key Vault and import a certificate. Step 4: Grant the Application Gateway access to the Key Vault.

Answer

Step 1: Enable managed identity on the Application Gateway. Step 2: Create a Key Vault and import a certificate. Step 3: Configure the HTTPS listener to use the certificate from Key Vault. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets.

Answer

Step 1: Create a Key Vault and import a certificate. Step 2: Configure the HTTPS listener to use the certificate from Key Vault. Step 3: Enable managed identity on the Application Gateway. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets.

Question 10

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.

Accepted Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Choose the subscription, Step 4: Set pricing tier to Standard. To enable Azure Security Center's enhanced security features for a subscription, you must first navigate to Security Center, then access 'Security policy' under Management. Within that blade, select the target subscription and set its pricing tier to Standard. This activates advanced threat detection and vulnerability assessment capabilities. Common mistakes include confusing the order of subscription selection and tier setting, or mixing up the security policy with auto-provisioning settings.

Answer

Step 1: Navigate to Azure Security Center, Step 2: Choose the subscription, Step 3: Set pricing tier to Standard, Step 4: Select 'Security policy' under Management

Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Set pricing tier to Standard, Step 4: Choose the subscription

Answer

Step 1: Navigate to Azure Security Center, Step 2: Go to 'Auto provisioning' settings, Step 3: Enable Log Analytics agent, Step 4: Set pricing tier to Standard

Question 11

Refer to the exhibit. You have an Azure Firewall policy with the shown rules. Traffic from 10.0.0.0/8 to www.google.com on HTTPS (443) is being blocked. What is the most likely reason?

Accepted Answer

The network rule collection with priority 100 denies all traffic, and it is evaluated before the application rule collection.. Azure Firewall policy rule collections are evaluated in order of priority, with lower numbers evaluated first. The network rule collection with priority 100 denies all traffic, and since network rules are evaluated before application rules, this deny rule matches the HTTPS traffic from 10.0.0.0/8 to www.google.com before the application rule collection (which would allow it) is ever reached. Therefore, the traffic is blocked by the higher-priority network rule.

Answer

The application rule collection has an action of Deny.

Answer

The source address 10.0.0.0/8 is not included in the application rule.

Answer

The application rule collection does not allow *.google.com.

Question 12

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?

Accepted Answer

Enable trusted Microsoft services on the Key Vault firewall. When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.

Answer

Create a private endpoint for Key Vault

Answer

Assign the SQL server's managed identity to the Key Vault

Answer

Configure a service endpoint on the SQL server

Question 13

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with the 'sysadmin' role cannot view the plaintext data. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with deterministic encryption. Always Encrypted with deterministic encryption is correct because it encrypts specific columns at the client side, ensuring that even database administrators with 'sysadmin' role cannot view plaintext data. Deterministic encryption generates the same ciphertext for identical plaintext values, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting both requirements.

Answer

Transparent Data Encryption (TDE)

Answer

Always Encrypted with randomized encryption

Answer

Dynamic Data Masking

Question 14

A company has two Azure virtual networks, VNet-A (hub) and VNet-B (spoke), connected via VNet peering. They deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. They configure a user-defined route (UDR) on the subnet in VNet-B with the destination address space of VNet-A (10.0.0.0/16) and the next hop set to the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes a direct path. What is the most likely cause?

Accepted Answer

The NVA network interface does not have IP forwarding enabled. A network virtual appliance (NVA) requires IP forwarding to be enabled on its network interface to forward traffic not destined for itself. Without this setting, the NVA drops packets that arrive with a destination IP other than its own, causing the traffic to bypass the NVA and follow the default VNet peering route. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNets as specified by the user-defined route.

Answer

The NVA's private IP address is not reachable from VNet-B

Answer

VNet peering system routes override user-defined routes

Answer

The UDR must be applied to the gateway subnet of VNet-B

Question 15

You manage a multi-tier application in Azure with a web tier, application tier, and database tier. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure networking feature should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet.. Network security groups (NSGs) allow you to define inbound and outbound security rules that filter traffic at the subnet or NIC level. By placing each tier in its own subnet and applying an NSG to the web tier subnet that allows inbound traffic from the internet, and NSGs to the application and database tier subnets that only allow inbound traffic from the web tier subnet (using the source IP address range or the virtual network tag), you can effectively isolate the tiers while permitting necessary east-west traffic.

Answer

Virtual network peering between tiers.

Answer

Azure Firewall with application rules.

Answer

Application security groups (ASGs) within the same subnet.

Question 16

A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?

Accepted Answer

Always Encrypted with a client-side encryption key stored in Azure Key Vault.. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted on the client side before being sent to Azure SQL Database, and the encryption keys are never revealed to the database engine. This prevents DBAs or any server-side administrators from viewing the plaintext data, as decryption can only occur using the client-side encryption key stored in Azure Key Vault and accessed by the dedicated application library.

Answer

Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.

Answer

Dynamic Data Masking (DDM) for the credit card column.

Answer

Row-Level Security (RLS) to restrict DBA access to the credit card column.

Question 17

A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?

Accepted Answer

Enable the Key Vault firewall to allow trusted Microsoft services. When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.

Answer

Create a private endpoint for the SQL server to access the Key Vault

Answer

Enable public network access on the Key Vault

Answer

Assign the SQL server's managed identity the 'Reader' role on the Key Vault

Question 18

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. The security policy requires that when a user activates the Security Administrator role, they must: 1) Provide a justification, 2) Get approval from a designated security group, and 3) The activation must last a maximum of 4 hours. Which combination of PIM settings should they configure?

Accepted Answer

Enable 'Require justification', 'Require approval', and set 'Maximum activation duration' to 4 hours. Assign the security group as the approver.. Azure AD PIM allows you to enforce all three requirements: justification, approval from a specified security group, and a maximum activation duration. By enabling 'Require justification' and 'Require approval' and setting the 'Maximum activation duration' to 4 hours, you meet the security policy exactly. The approval step requires assigning a designated security group as the approver, which is supported in PIM role settings.

Answer

Enable 'Require justification', 'Require ticket information', and set 'Maximum activation duration' to 8 hours.

Answer

Enable 'Require approval' and set 'Maximum activation duration' to 4 hours. Do not require justification.

Answer

Enable 'Require Azure MFA on activation', 'Require justification', and set 'Maximum activation duration' to 4 hours.

Question 19

A company wants Defender for Cloud to recommend fixes for container image vulnerabilities stored in Azure Container Registry. Which capability is most relevant?

Accepted Answer

Container vulnerability assessment in Defender for Containers. Defender for Containers includes a container vulnerability assessment capability that scans container images stored in Azure Container Registry (ACR) for known vulnerabilities. This assessment integrates with Defender for Cloud to provide actionable recommendations for fixing identified vulnerabilities, directly addressing the company's requirement.

Answer

Azure SQL auditing

Answer

Microsoft Entra access reviews

Answer

Application Gateway rewrite rules

Question 20

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Accepted Answer

Configure a private endpoint. Configuring a private endpoint ensures that traffic between the client and Cosmos DB traverses the Microsoft backbone network, enforcing that only Azure services within the same region can access via private IPs. Option C is correct because setting the minimum TLS version to 1.2 enforces encryption in transit for all connections. Option A (service endpoints) does not enforce encryption or regional restriction. Option D (disable public network access) is a prerequisite for private endpoints but alone does not enforce encryption. Option E (firewall rules to allow only Azure services) does not enforce TLS version.

Answer

Enable service endpoints for the Cosmos DB account

Answer

Disable public network access

Answer

Configure firewall rules to allow only Azure services