AZ-500 Practice Test 26 — 15 Questions

Question 1

You are designing a Microsoft Sentinel solution for a multinational company. The company requires that security incidents be correlated across regions, but data residency mandates require logs to remain in their original region. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy one Microsoft Sentinel workspace per region and use cross-workspace querying for correlation. Deploying one Microsoft Sentinel workspace per region satisfies data residency mandates by keeping logs in their original region, while cross-workspace querying allows security incidents to be correlated across regions using KQL queries that span multiple workspaces. This approach ensures compliance with regional data sovereignty laws without sacrificing the ability to perform centralized threat detection and investigation.

Answer

Deploy a separate Log Analytics workspace per region, but only one Sentinel workspace

Answer

Deploy a single Microsoft Sentinel workspace in a central region and use Azure Lighthouse

Answer

Deploy a single Microsoft Sentinel workspace and use data collection rules to filter logs

Question 2

Your company uses Azure Blob Storage to store sensitive documents. You need to prevent data exfiltration by ensuring that all access to the storage account is through Microsoft's private network. What should you configure?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. Creating a private endpoint for the storage account assigns it a private IP from your virtual network, and disabling public network access ensures that all traffic to the storage account is routed through Microsoft's backbone network, preventing data exfiltration over the public internet. This configuration effectively isolates the storage account to your private network, meeting the requirement to block all public access.

Answer

Apply a network security group (NSG) to the subnet with a deny rule for internet traffic.

Answer

Set the firewall to deny all and add a rule to allow only your VNet's public IP.

Answer

Enable service endpoints and configure a service endpoint policy.

Question 3

A company plans to enable Azure Disk Encryption (ADE) on a fleet of Windows virtual machines. They want to use a key stored in Azure Key Vault to encrypt the disks. Which additional access configuration must be made in the Key Vault to allow ADE to succeed?

Accepted Answer

Grant the Azure Disk Encryption service principal (Microsoft.Azure.Security) appropriate key permissions in the Key Vault access policy.. Azure Disk Encryption (ADE) uses the Azure platform's built-in service principal (Microsoft.Azure.Security) to access the Key Vault and retrieve the disk encryption key. Without granting this service principal the necessary 'Get', 'WrapKey', and 'UnwrapKey' key permissions in the Key Vault access policy, ADE cannot authenticate and perform the encryption operations. This is a mandatory configuration step for ADE to succeed.

Answer

Assign a managed identity to each VM and grant that identity key permissions in the Key Vault.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Assign the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal.

Question 4

A storage account contains legal evidence that must not be modified or deleted for seven years. Which feature should be configured?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) is the correct choice because it enforces a strict seven-year retention period during which blobs cannot be modified or deleted, even by account administrators. This is achieved through a policy that locks the data at the storage level, ensuring compliance with legal hold requirements for evidence preservation.

Answer

Soft delete only

Answer

Lifecycle management to archive tier

Answer

Customer-managed keys

Question 5

A security analyst uses Microsoft Defender for Cloud. They need to view the current compliance status of their Azure subscription against the Payment Card Industry Data Security Standard (PCI DSS). Which feature in Defender for Cloud should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of your Azure subscription's compliance posture against specific standards like PCI DSS. It continuously assesses your resources against the controls defined in the selected compliance framework and displays a compliance score, passed/failed controls, and remediation steps. This is the dedicated feature for tracking regulatory compliance, not general security posture or vulnerability management.

Answer

Security posture dashboard

Answer

Vulnerability assessment solutions

Answer

Workflow automation

Question 6

Refer to the exhibit. You are creating a custom Azure RBAC role for a security analyst. The role as shown allows read access to storage accounts. The analyst reports that they cannot read the contents of a blob container in a storage account. Why is this?

Accepted Answer

The role does not include dataActions to read blob data.. The custom RBAC role only includes read permissions for the storage account's control plane (e.g., listing keys, reading properties) but lacks the necessary dataActions to read blob data. To read blob container contents, the role must include 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' under dataActions, which governs access to the data plane. Without this, the analyst can see the storage account but cannot access the blobs within it.

Answer

The role is not assigned to the analyst's user account.

Answer

The assignable scope is incorrect; it should be at the resource group level.

Answer

The storage account does not exist in the specified subscription.

Question 7

You are a security engineer for a company that uses Azure Virtual Networks and Azure Private Endpoints. You have a storage account with a private endpoint in VNet1. You need to ensure that all DNS queries for the storage account's private endpoint resolve to the private IP address from any virtual machine in VNet1. The virtual machines use the default Azure-provided DNS servers. What should you do?

Accepted Answer

Create a private DNS zone named privatelink.blob.core.windows.net and link it to VNet1.. Private Endpoints require DNS resolution to the private IP. Azure Private DNS zones with names like privatelink.blob.core.windows.net are the standard method. Linking the zone to the virtual network enables Azure-provided DNS to resolve the private endpoint FQDN correctly. Other options either misuse features or do not provide the required DNS resolution.

Answer

Enable Azure DNS Private Resolver in VNet1 and configure a forwarding rule to the storage account's private IP.

Answer

Add a DNS record for the storage account's public FQDN pointing to the private IP address in the VNet's DNS settings.

Answer

Configure a conditional forwarder on the Azure-provided DNS servers to forward queries for the storage account to an on-premises DNS server.

Question 8

Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You receive a recommendation that 'SQL databases should have vulnerability findings resolved'. You run a vulnerability assessment scan and find a high-severity finding about a missing firewall rule. How should you resolve this finding?

Accepted Answer

Add a firewall rule to the SQL server allowing traffic from the required IP addresses.. The vulnerability assessment finding about a missing firewall rule indicates that the SQL server is accessible from an overly broad range of IP addresses or lacks a necessary restriction. Adding a firewall rule to the SQL server that allows traffic only from the required IP addresses directly resolves the misconfiguration, reducing the attack surface. This aligns with the recommendation to remediate vulnerability findings by applying network access controls.

Answer

Change the SQL database auditing settings to capture all events.

Answer

Enable Advanced Threat Protection for Azure SQL Database.

Answer

Enable the 'Defender for SQL' plan on the server.

Question 9

Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?

Accepted Answer

Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.. Azure Files supports network security via storage account firewalls, which can restrict access to specific IP ranges. Enabling diagnostic settings allows sending logs (e.g., to a Log Analytics workspace) for auditing. Option C correctly combines both requirements. Option A is incorrect because Private Endpoints and service endpoints provide network isolation but do not filter by IP source. Option B is incorrect because while a SAS token can include an IP restriction, it is not designed for persistent user access to home directories and complicates management. Option D is incorrect because Microsoft Entra Domain Services and conditional access control authentication but do not enforce network-level IP restrictions.

Answer

Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.

Answer

Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.

Answer

Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.

Question 10

You are using Microsoft Defender for Cloud to protect Azure Kubernetes Service (AKS) clusters. You need to receive alerts about suspicious activities within the cluster, such as privilege escalations. What should you enable?

Accepted Answer

Microsoft Defender for Containers. Microsoft Defender for Containers is the correct solution because it provides threat detection for AKS clusters, including alerts for privilege escalations, suspicious process execution, and other runtime threats. It integrates directly with Defender for Cloud to monitor the Kubernetes audit logs and container workloads without requiring additional data connectors or agents.

Answer

Microsoft Sentinel with AKS data connector

Answer

Azure Policy for AKS

Answer

Azure Security Center (classic)

Question 11

A company has enabled Microsoft Defender for Cloud on all subscriptions. The security team wants to ensure that all virtual machines have vulnerability assessment solutions installed. What should they configure?

Accepted Answer

Enable the Vulnerability Assessment solution in Defender for Cloud and set it to 'On'. Microsoft Defender for Cloud provides a built-in Vulnerability Assessment solution that can be enabled at the subscription level. When set to 'On', it automatically deploys the Qualys or Microsoft threat and vulnerability management agent to all supported Azure VMs, ensuring continuous vulnerability scanning without manual intervention.

Answer

Enable Azure Update Management for all VMs

Answer

Create an Azure Policy to audit VMs without vulnerability assessment

Answer

Use Azure Automation to run a script that installs a vulnerability scanner

Question 12

You have an Azure SQL Database that stores credit card numbers. You need to encrypt the column containing the credit card numbers so that only authorized applications can decrypt the data. The database administrator should not be able to view the plaintext data. Which feature should you use?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves (Option D) is correct because it ensures that credit card numbers are encrypted at rest and in memory, and only client applications with the column encryption key can decrypt the data. The database administrator (DBA) cannot access the plaintext because the encryption keys are never revealed to SQL Server or Azure SQL Database, and secure enclaves allow rich computations (e.g., equality, pattern matching) on encrypted data without exposing the plaintext to the database engine.

Answer

Transparent Data Encryption (TDE)

Answer

Column-level encryption using SQL Server built-in functions

Answer

Dynamic Data Masking

Question 13

Your organization uses Microsoft Entra ID and needs to implement a policy that blocks all sign-ins from countries that are not approved. What should you configure?

Accepted Answer

Create a Conditional Access policy with a location condition set to block. A Conditional Access policy in Microsoft Entra ID allows you to define location conditions based on IP ranges, countries, or regions. By configuring the location condition to include all countries except the approved ones and setting the access control to 'Block access', you can effectively block sign-ins from non-approved countries. This is the native, policy-driven approach to enforce geographic restrictions without manual intervention.

Answer

Enable multi-factor authentication for all users

Answer

Review sign-in logs and manually block IPs

Answer

Configure an Identity Protection risk policy

Question 14

You need to secure an Azure Storage account that will host sensitive data. Which TWO configurations should you implement?

Accepted Answer

Enable 'Secure transfer required'. Option B is correct because enabling 'Secure transfer required' on the storage account enforces HTTPS/TLS for all requests to the storage endpoints, rejecting any HTTP traffic so sensitive data is never transmitted in cleartext. Option E is correct because configuring a private endpoint assigns the storage account a private IP address inside your virtual network via Azure Private Link, removing exposure to the public internet and letting access flow only over the Microsoft backbone network. Option A is not correct here because a SAS is a delegated, time-limited access token for granting scoped permissions to clients, not a baseline network or transport security configuration for the account. Option C is not correct because allowing public network access from all networks does the opposite of securing the account, exposing it to the internet. Option D is not correct because enabling Azure Files simply turns on the SMB/NFS file share service and does not itself harden or restrict access to the storage account.

Answer

Generate a shared access signature (SAS)

Answer

Allow public network access from all networks

Answer

Enable Azure Files

Question 15

An organization has deployed Azure Firewall and wants to inspect all outbound traffic from a virtual network (VNet) to the internet. The VNet already contains subnets with workloads. What is the required networking configuration to force traffic through Azure Firewall?

Accepted Answer

Configure a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP and associate it with the subnets.. Azure Firewall requires a route table with a default route (0.0.0.0/0) that has the Azure Firewall's private IP as the next hop, associated with each subnet whose traffic must be inspected. This forces all outbound traffic from those subnets to be routed through the firewall, enabling inspection and logging. Without this explicit route, traffic would use the default system route and bypass the firewall.

Answer

Add a Network Security Group (NSG) rule that allows all outbound traffic and associate it with the subnets.

Answer

Deploy an Application Gateway with Web Application Firewall (WAF) in front of the subnets.

Answer

Enable Azure DDoS Protection Standard on the VNet.