AZ-500 Practice Test 5 — 25 Questions

Question 1

You are designing a security solution for Azure Cosmos DB that stores Personally Identifiable Information (PII). You need to encrypt data at rest and in transit. You also need to implement row-level security to restrict access based on user role. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encryption at rest is automatically enabled; enforce TLS for transit; implement row-level security via application code.. Azure Cosmos DB automatically encrypts data at rest using AES-256 encryption, and data in transit is secured by enforcing TLS (Transport Layer Security). Row-level security is not natively supported in Cosmos DB; instead, it must be implemented at the application layer by filtering queries based on user roles, typically using a partition key or a custom property in the document.

Answer

Enable Azure Disk Encryption on the Cosmos DB account.

Answer

Enable Always Encrypted and configure column encryption.

Answer

Use Dynamic Data Masking to restrict sensitive data.

Question 2

A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?

Accepted Answer

Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).. Azure Key Vault supports automatic key rotation with a configurable rotation period, and when a disk encryption set (DES) is configured with an empty string as the key version, it automatically uses the latest version of the KEK. This ensures that after the KEK is rotated every 90 days, the running VMs' OS and data disks are re-wrapped with the new KEK version without manual intervention or VM restart.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.

Answer

Use Azure Policy to enforce automatic key rotation.

Question 3

Your organization has deployed Azure Front Door Premium with Web Application Firewall (WAF) policy in front of an Azure App Service. You need to ensure that only traffic from Azure Front Door is allowed to reach the App Service, and all other traffic is blocked. Which configuration should you implement?

Accepted Answer

Configure IP restrictions on the App Service to allow only the Azure Front Door service tag AzureFrontDoor.Backend.. The Azure Front Door Premium service tag 'AzureFrontDoor.Backend' represents the backend IP address range used by Azure Front Door to forward traffic to the origin. By configuring IP restrictions on the App Service to allow only this service tag, you ensure that only traffic originating from Azure Front Door can reach the App Service, effectively blocking all other traffic.

Answer

Configure the App Service to require client certificates and configure Azure Front Door to present a certificate.

Answer

Set the App Service access restrictions to deny all and then add a rule to allow the Azure Front Door service tag AzureFrontDoor.Frontend.

Answer

Configure a WAF policy to block all requests that do not contain the X-Azure-FDID header.

Question 4

Your company uses Azure SQL Managed Instance. You need to ensure that all connections from clients use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'Minimal TLS version' property to 1.2 in the Managed Instance settings. Azure SQL Managed Instance exposes a 'Minimal TLS version' property in its settings that enforces the minimum TLS version for all client connections. Setting this to 1.2 ensures that any connection attempt using TLS 1.0 or 1.1 is rejected at the server level, providing a centralized, server-side enforcement mechanism without relying on client-side configurations.

Answer

Configure a firewall rule to block non-TLS 1.2 connections

Answer

Create an Azure Policy to require TLS 1.2 for all SQL Managed Instances

Answer

Enable the 'Force encryption' option on the client side

Question 5

Your company has an Azure Cosmos DB account that stores customer profiles. You need to ensure that only authenticated and authorized users can access the data. Which access control method should you use?

Accepted Answer

Use Azure RBAC with Microsoft Entra ID authentication.. Azure RBAC with Microsoft Entra ID authentication provides fine-grained, identity-based access control for Azure Cosmos DB. This method allows you to assign specific roles (e.g., Cosmos DB Built-in Data Reader) to users or service principals, ensuring that only authenticated and authorized identities can access the data plane operations, such as reading or writing documents. It eliminates the need to share or manage keys, aligning with the principle of least privilege.

Answer

Configure an IP firewall rule to allow only corporate IP ranges.

Answer

Use primary read-write keys with connection strings.

Answer

Use resource tokens generated from a master key.

Question 6

You are designing a solution to store sensitive documents in Azure Blob Storage. The documents must be encrypted at rest using a customer-managed key that is automatically rotated every 90 days. Microsoft Entra ID must be used to control access to the key. What should you use?

Accepted Answer

Azure Storage Service Encryption (SSE) with a customer-managed key stored in Azure Key Vault and configure key rotation.. Azure Storage Service Encryption (SSE) with a customer-managed key (CMK) stored in Azure Key Vault allows you to control the encryption key used for data at rest in Blob Storage. By storing the key in Key Vault, you can configure automatic key rotation every 90 days, and you can use Microsoft Entra ID (formerly Azure AD) to control access to the key via RBAC roles such as Key Vault Crypto Officer. This meets all requirements: encryption at rest, customer-managed key, automatic rotation, and Entra ID-based access control.

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Answer

Client-side encryption (CSE) using Azure Key Vault.

Question 7

A company uses Azure AD B2B collaboration to invite external partner users to collaborate on a project. The security team wants to ensure that when a partner user's account is disabled in their home Azure AD tenant, the user should immediately lose access to the company's resources, even if the user had a valid session token. Which configuration should they implement in cross-tenant access settings?

Accepted Answer

Configure cross-tenant access settings to trust the user's account status from the home tenant.. Configuring cross-tenant access settings to trust the user's account status from the home tenant enables Microsoft Entra ID to evaluate the external user's account state (enabled/disabled) in their home tenant at each authentication. When the partner user's account is disabled in their home tenant, Microsoft Entra ID will deny access even if a valid session token exists, because the token's validity is rechecked against the home tenant's account status via the cross-tenant trust policy.

Answer

Configure external collaboration settings to restrict B2B users to specific apps.

Answer

Assign a conditional access policy that requires device compliance for B2B users.

Answer

Enable Azure AD Identity Protection for B2B users.

Question 8

You have an Azure virtual machine that hosts a web application. You need to allow inbound HTTP (80) and HTTPS (443) traffic from the internet to this VM only. You also need to allow outbound traffic to the internet from the VM. You want to use a managed Azure service with minimal configuration. What should you use?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) is the correct choice because it is a managed Azure service that provides a stateful, layer-3/4 firewall for filtering inbound and outbound traffic to a virtual machine. With minimal configuration, you can create inbound rules to allow HTTP (TCP/80) and HTTPS (TCP/443) from the internet (source 'Internet' or 'Any') and an outbound rule to allow all traffic to the internet (default outbound rule already allows this). NSGs are directly associated with a VM's subnet or network interface, making them the simplest managed solution for this scenario.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 9

You are deploying an Azure SQL Database with a security alert policy as shown in the exhibit. Which statement is true?

Accepted Answer

Alerts are enabled and notifications are sent to both account admins and admin@contoso.com.. The security alert policy in Azure SQL Database has 'state' set to 'Enabled' and 'emailAddresses' includes both 'admin@contoso.com' and the account admins (via 'emailAccountAdmins' set to true). This means alerts are active and notifications are sent to both the specified email and the account administrators, making option A correct.

Answer

Email notifications are sent only to admin@contoso.com.

Answer

Alerts are not retained because retentionDays is set to 30.

Answer

All alerts are disabled because disabledAlerts is empty.

Question 10

Your company uses Azure SQL Database. You need to ensure that all queries from a specific application use Always Encrypted to protect sensitive columns. The application is developed in C#. What must you configure in the application and database?

Accepted Answer

Define column master key and column encryption key in the database, and update the connection string to include 'Column Encryption Setting=enabled'.. Always Encrypted requires a column master key and column encryption key to be defined in the database to encrypt sensitive columns, and the client application must enable the feature in its connection string by adding 'Column Encryption Setting=enabled'. This ensures that encryption and decryption occur on the client side, protecting data in transit and at rest from the database engine.

Answer

Enable Transparent Data Encryption (TDE) on the database and use integrated security.

Answer

Configure Dynamic Data Masking and use ODBC driver.

Answer

Use Azure Information Protection labels and configure the application to enforce protection.

Question 11

You are deploying a new application on Azure VMs. The application must be encrypted at rest and during transmission. Which combination of features should you implement?

Accepted Answer

Azure Disk Encryption and HTTPS. Azure Disk Encryption (ADE) provides at-rest encryption for Azure VM disks using BitLocker (Windows) or DM-Crypt (Linux), while HTTPS ensures encryption in transit between the client and the application. Together, they satisfy the requirement for encryption both at rest and during transmission.

Answer

Azure Firewall and Azure Disk Encryption

Answer

Azure Storage Service Encryption and SSL

Answer

Azure Disk Encryption and SSL

Question 12

You are configuring an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can securely access Azure Container Registry (ACR) without storing image pull secrets in the pod specification. What should you do?

Accepted Answer

Enable managed identity on AKS and assign the AcrPull role to the kubelet identity. Enabling managed identity on AKS creates a kubelet identity that can be granted the AcrPull role via Azure RBAC. This allows AKS to authenticate to ACR automatically without storing any secrets in the pod specification, as the kubelet uses the managed identity to pull container images on behalf of the pods.

Answer

Create a service principal and store the secret in a Kubernetes secret, then reference it in the pod spec

Answer

Enable admin account on ACR and use the admin username and password in the pod spec

Answer

Use the storage account key of the attached Azure storage account

Question 13

A company has several Azure virtual machines (VMs) in a VNet that host a legacy application. IT support staff need to perform remote administration using RDP. The security team wants to avoid exposing the VMs to the public internet and also enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions. Which Azure service should they deploy to meet these requirements?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing the VMs to a public IP address. It also integrates with Microsoft Entra ID and Conditional Access to enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions, meeting both the security and compliance requirements.

Answer

Just-in-Time (JIT) VM Access from Microsoft Defender for Cloud

Answer

Network Security Groups (NSGs) with allow rules for RDP only from a trusted IP

Answer

Azure Firewall with DNAT rules to forward RDP traffic

Question 14

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to manage RDP connections to a critical jump-box virtual machine. The company has a CI/CD pipeline running on Azure DevOps agent pools that needs to periodically RDP into this VM to deploy software. The agent pool's source IP addresses are dynamic and change frequently. They want the pipeline to automatically request JIT access before each deployment without manual intervention. Which approach should they implement?

Accepted Answer

Use the Azure REST API with a managed identity assigned to the DevOps agent to request JIT access, specifying the agent's current source IP address. It uses the Azure REST API with a managed identity to dynamically request JIT VM access, specifying the agent's current source IP address. This approach allows the CI/CD pipeline to authenticate without secrets and automatically obtain time-bound RDP access, even though the agent's IP changes frequently. The managed identity provides secure, automated authentication to Azure Resource Manager, enabling the pipeline to call the JIT policy endpoint and grant access for the deployment duration.

Answer

Create a JIT access rule in Defender for Cloud with a scheduled time window that matches the pipeline's deployment schedule

Answer

Configure a PowerShell script in the pipeline to modify the network security group (NSG) to allow the agent's IP during deployment

Answer

Assign a static public IP to the Azure DevOps agent and add that IP to the JIT allowed list permanently

Question 15

You need to enable transparent data encryption (TDE) for an Azure SQL Managed Instance. What is the prerequisite?

Accepted Answer

No additional configuration is needed; TDE is enabled by default.. Transparent Data Encryption (TDE) is enabled by default for Azure SQL Managed Instance. When you create a new managed instance, TDE is automatically turned on using a service-managed key, so no additional configuration is required. This default behavior ensures data at rest is encrypted without any prerequisite steps from the user.

Answer

Configure a backup policy for the managed instance.

Answer

Enable a service endpoint for Azure SQL.

Answer

Create an Azure Key Vault and configure a customer-managed key.

Question 16

You have an Azure Cosmos DB account with multiple containers. You need to ensure that only specific Azure AD identities can access the data and that all access is logged. What should you use?

Accepted Answer

Use Azure AD authentication and RBAC roles, and enable diagnostic logs. Microsoft Entra ID authentication with RBAC roles allows you to restrict data access to specific Microsoft Entra ID identities, and enabling diagnostic logs captures all data plane operations for auditing. This combination meets the requirements of identity-based access control and comprehensive logging, unlike primary keys which are shared secrets and do not support identity-level auditing.

Answer

Use primary keys for authentication and enable audit logging

Answer

Configure managed identities for Azure resources and enable diagnostic logs

Answer

Configure an Azure Cosmos DB firewall and enable diagnostic logs

Question 17

You need to ensure that Azure SQL Database connections are encrypted and the server's identity is verified. Which connection string parameter should be required?

Accepted Answer

Encrypt=True; TrustServerCertificate=False. Setting `Encrypt=True` forces TLS encryption for all data in transit between the client and Azure SQL Database, while `TrustServerCertificate=False` ensures that the server's TLS certificate is validated against a trusted certificate authority (CA). This combination provides both encryption and server identity verification, which is required for secure connections to Azure SQL Database.

Answer

Encrypt=Optional

Answer

TrustServerCertificate=True

Answer

Encrypt=False

Question 18

A company uses Azure AD Identity Protection. They have detected a user with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user only when the sign-in comes from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy. Which configuration should they use?

Accepted Answer

Assign the user to the policy, set condition 'User risk level: High' and condition 'Locations: All locations except trusted', and set 'Grant' to 'Block access'. It combines the 'User risk level: High' condition (triggered by Identity Protection's user risk detection) with the 'Locations: All locations except trusted' condition, and sets 'Grant' to 'Block access'. This ensures that only sign-ins from untrusted locations are blocked when the user's risk is high, meeting the requirement to allow sign-ins from trusted IPs even for high-risk users.

Answer

Assign the user to the policy, set condition 'Sign-in risk level: High' and condition 'Locations: All trusted locations', and set 'Grant' to 'Block access'

Answer

Assign the user to the policy, set condition 'User risk level: High' and set 'Grant' to 'Require multi-factor authentication'

Answer

Create a risk detection policy in Identity Protection that triggers a user risk policy, and have Conditional Access use the risk policy

Question 19

A Sentinel analytics rule creates a new incident every time the same brute-force activity is detected for the same account within an hour. The SOC wants one incident that continues to group related alerts. What should be changed?

Accepted Answer

Configure incident grouping in the scheduled analytics rule. Incident grouping in a scheduled analytics rule allows multiple alerts triggered by the same entity (e.g., the same account) within a specified time window to be combined into a single incident. By configuring the 'Group related alerts into a single incident' setting and setting the grouping window to one hour, the SOC ensures that all brute-force alerts for the same account are merged into one incident, reducing alert fatigue and providing a consolidated view of the attack.

Answer

Disable entity mapping for the account entity

Answer

Change the rule query to use project-away on TimeGenerated

Answer

Run the rule as a near-real-time rule

Question 20

A Sentinel playbook fails to update incidents even though the Logic App runs successfully. The playbook uses a managed identity. What is the most likely missing configuration?

Accepted Answer

The managed identity lacks Microsoft Sentinel Responder or Contributor permissions on the workspace. The managed identity assigned to the Logic App must have at least Microsoft Sentinel Responder or Contributor permissions on the workspace to update incidents. Without these RBAC roles, the Logic App's API calls to modify incident properties (e.g., status, severity) are denied, even if the Logic App itself runs without errors.

Answer

The analytics rule does not include MITRE ATT&CK tactics

Answer

The Log Analytics workspace is not linked to Azure Monitor Private Link

Answer

The incident title does not contain an entity mapping