AZ-500 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing the external collaboration settings for your Microsoft Entra ID tenant. Based on the exhibit, which of the following statements is true about the current configuration?

Accepted Answer

External users will receive a one-time passcode via email when they are invited.. Option C is correct because enableB2BEmailOneTimePasscode is true, allowing guests to authenticate using a one-time passcode if they cannot use other identity providers. Option A is wrong because allowInvitationsFrom is set to 'adminsAndGuestInviters', meaning guests can also invite. Option B is wrong because allowEmailVerifiedUsersToJoinOrganization is false, so email-verified users cannot join automatically. Option D is wrong because enableB2BDirectConnect is false, so Teams external access is not enabled.

Answer

Only administrators can invite external users.

Answer

B2B direct connect is enabled for Teams external access.

Answer

Users with email-verified accounts can join the organization automatically.

Question 2

Which THREE of the following are valid methods to secure service principals in Microsoft Entra ID?

Accepted Answer

Use certificate-based credentials instead of client secrets. A, C, and E are correct. Option A is correct because certificate-based credentials are more secure than client secrets. Option B is wrong because managed identities are not 'assigning roles to a service principal' but rather an identity for Azure resources. Option D is wrong because enabling MFA for service principals is not supported; service principals are non-interactive. Option E is correct because Conditional Access for workload identities can restrict service principal access based on conditions.

Answer

Assign the service principal to the Global Administrator role to monitor its activity

Answer

Enable Azure Multi-Factor Authentication for the service principal sign-in

Question 3

A company plans to implement a Zero Trust identity strategy using Microsoft Entra ID. Which TWO actions should be taken to enforce least-privilege access for administrative roles?

Accepted Answer

Configure Privileged Identity Management (PIM) to require approval for role activation. Options B and E are correct. Using Privileged Identity Management (PIM) for just-in-time access and enabling Conditional Access policies to require MFA for administrative roles align with Zero Trust least-privilege principles. Option A is wrong because permanent role assignment contradicts just-in-time. Option C is wrong because legacy authentication is less secure. Option D is wrong because guest users are not the focus.

Answer

Enable legacy authentication for administrative accounts

Answer

Set guest user permissions to the same level as employees

Answer

Assign permanent Global Administrator roles to all IT staff

Question 4

You need to ensure that only approved iOS devices can access corporate email. Which Microsoft Intune policy should you configure?

Accepted Answer

Device compliance policy. The correct answer is B: Device compliance policy. This policy defines rules for device health, including requiring devices to be jailbreak-detected and compliant. Option A is wrong because app protection policies manage data within apps, not device-level access. Option C is wrong because configuration policies push settings. Option D is wrong because enrollment restrictions limit which devices can enroll, but compliance ensures ongoing access.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

App protection policy

Question 5

You need to distribute incoming internet traffic across multiple Azure virtual machines in the same region. The solution must provide layer 7 load balancing and SSL offloading. Which Azure service should you use?

Accepted Answer

Azure Application Gateway. Option C is correct because Azure Application Gateway provides layer 7 load balancing with SSL termination. Option A is wrong because Azure Load Balancer is layer 4. Option B is wrong because Traffic Manager is DNS-based. Option D is wrong because Azure Front Door is global, not regional.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 6

You are designing network security for a hybrid application that uses Azure Front Door and Azure Application Gateway. The application must block malicious requests at the edge before they reach the backend. You need to implement Web Application Firewall (WAF) protection with the lowest latency and the ability to inspect traffic at the application layer. Which solution should you use?

Accepted Answer

Apply WAF policy on Azure Front Door.. Option B is correct because WAF policy on Azure Front Door operates at the edge, inspecting traffic at the application layer (HTTP/HTTPS) before it reaches the Application Gateway, providing the lowest latency and early threat blocking. Option A is wrong because WAF on Application Gateway inspects traffic after it passes Front Door, adding latency. Option C is wrong because Azure Firewall is a stateful firewall that operates at layers 3-7 but is not optimized for application-layer inspection like WAF. Option D is wrong because DDoS Protection protects against volumetric attacks, not application-layer threats.

Answer

Enable Azure DDoS Protection on the virtual network.

Answer

Apply WAF policy on Azure Application Gateway only.

Answer

Use Azure Firewall with threat intelligence-based filtering.

Question 7

You are troubleshooting an Azure virtual machine that cannot access the internet. The VM is in a subnet with a route table that has a default route (0.0.0.0/0) with next hop 'Virtual appliance' pointing to the private IP of an Azure Firewall. The Azure Firewall has a DNAT rule to allow outbound traffic. You verify that the VM's NSG allows outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The Azure Firewall does not have an allow rule for outbound internet traffic.. Option A is correct because Azure Firewall must have the 'Allow traffic' property set to allow outbound traffic. By default, Azure Firewall blocks all traffic unless an allow rule is configured. Option B is wrong because the VM's NSG allows outbound traffic. Option C is wrong because the route table exists and points to the firewall. Option D is wrong because Azure Firewall SNATs outbound traffic by default.

Answer

Azure Firewall does not support SNAT for outbound traffic.

Answer

The route table does not have a default route.

Answer

The VM's NSG is blocking outbound traffic.

Question 8

A company uses Azure Bastion to provide secure RDP and SSH access to Azure VMs without public IPs. Recently, a security audit recommended logging all connections to Bastion. What should you enable?

Accepted Answer

Diagnostic settings on the Bastion resource to stream Bastion logs to a Log Analytics workspace. Azure Bastion integrates with Azure Diagnostic Logs to capture connection logs. Enabling diagnostic settings on the Bastion resource sends logs to a Log Analytics workspace, Storage account, or Event Hub.

Answer

Azure Monitor alerts for Bastion resource health

Answer

Azure Activity Logs for the Bastion resource

Answer

Network Security Group flow logs on the subnet containing Bastion

Question 9

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

Accepted Answer

The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.. The NSG rule denies traffic to 'Internet' service tag, but the NIC is attached to a subnet that may also have an NSG that allows outbound traffic. Additionally, the rule specifies 'Tcp' protocol with ports 80 and 443, but HTTPS uses TCP port 443. The rule should block it. However, Azure VMs have a default outbound access via SNAT; if the VM is using a public IP or has a default route, the NSG should block. The most likely issue is that the NSG is applied to the NIC but not to the subnet, and the subnet's default NSG (or lack thereof) allows traffic. But the commands show NSG applied to NIC. Another possibility: the rule priority is 100, but maybe there is a higher priority allow rule? The commands do not show any allow rule. Actually, the problem may be that the NSG rule's protocol is 'Tcp' but the outbound traffic might be using UDP? Unlikely. The correct answer is that the NSG is not associated with the subnet; NIC-level NSG works, but the rule's destination is 'Internet' tag, which should work. The most plausible answer is that the VM has a public IP and the NSG rule is outbound, but maybe the VM is using a different port (e.g., 443 is blocked but 80 is allowed? No). Wait, the commands do not create a VM; they create a NIC and NSG, but the NIC is not attached to a VM? Actually, the commands create a VNet, subnet, NIC, NSG, and attach NSG to NIC. They do not create a VM. But the stem says 'creates a VM with a single NIC' assuming the NIC is used for a VM. The real issue: the NSG rule denies TCP to Internet on ports 80 and 443, but the VM may be using a different protocol (e.g., HTTP/HTTPS uses TCP). The most likely reason: the NSG is applied at the NIC level, but the subnet may have a separate NSG that allows the traffic, and NSG rules are evaluated at both levels (subnet first, then NIC). If the subnet NSG allows, the traffic is allowed. The commands do not apply an NSG to the subnet. Therefore, the default subnet NSG (if any) or no NSG on subnet means no filtering at subnet level. However, the NIC NSG should still block. Actually, Azure NSG evaluation: subnet NSG is evaluated first, then NIC NSG. If subnet NSG has no rule, it defaults to allow all. So the traffic would be allowed by subnet NSG default allow, and then NIC NSG denies, but the overall is deny? Actually, security rules are evaluated and the first match applies. If subnet NSG has no rule (default deny inbound, default allow outbound), the default outbound allow would match and allow the traffic before the NIC NSG rule is evaluated. That's the catch: default outbound allow in subnet NSG lets traffic out, and the NIC NSG deny rule is not evaluated because a match already occurred. So the correct answer is that the subnet has no NSG, and its default outbound rule allows all traffic.

Answer

The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

Answer

The NSG is not associated with the NIC because the command did not specify the NIC correctly.

Answer

The NSG rule should be an inbound rule to block outbound traffic.

Question 10

Your company has an Azure subscription with multiple virtual networks (VNets) connected via VNet peering. You need to filter traffic between VNets based on source IP addresses and ports. You want a managed solution that provides stateful inspection and centralized logging. Which TWO solutions meet the requirements?

Accepted Answer

Azure Firewall. Option A is correct because Azure Firewall provides stateful inspection, network filtering based on IP/port, and centralized logging. Option C is correct because Network Virtual Appliances (NVAs) from partners can provide similar capabilities. Option B is wrong because NSGs are stateful but not managed centrally for cross-VNet traffic. Option D is wrong because Azure Front Door is a global load balancer, not for VNet-to-VNet filtering. Option E is wrong because VPN Gateway is for encrypted connectivity, not filtering.

Answer

Network Security Groups (NSGs)

Answer

Azure VPN Gateway

Answer

Azure Front Door

Question 11

You are reviewing an NSG rule as shown in the exhibit. This rule is applied to a subnet containing web servers. What is the security implication of this rule?

Accepted Answer

It allows all inbound traffic, creating a security risk.. Option B is correct because the rule allows all inbound traffic from any source to any destination port and IP, which is overly permissive and exposes the subnet to potential attacks. Option A is wrong because the rule allows all traffic, not just HTTP. Option C is wrong because the rule allows inbound traffic, not outbound. Option D is wrong because the rule does not specify a protocol; 'Any' includes all protocols.

Answer

It restricts inbound traffic to TCP only.

Answer

It blocks all inbound traffic except HTTP.

Answer

It restricts inbound traffic to HTTP only.

Question 12

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to investigate denied application rule traffic through Azure Firewall. The query returns no results, but you know that application rules are being applied and some traffic is being denied. What is the most likely cause?

Accepted Answer

The query filters on the wrong OperationName; denied hits use 'AzureFirewallApplicationRuleDeny'.. The query filters on Category == 'AzureFirewallApplicationRule' and OperationName == 'AzureFirewallApplicationRuleHit'. However, denied traffic is logged under Category == 'AzureFirewallApplicationRule' with OperationName == 'AzureFirewallApplicationRuleDeny'. The query uses 'AzureFirewallApplicationRuleHit' which may log only allowed hits, not denies. Alternatively, the logs might be in a different table or property. The most direct fix: the correct OperationName for denies is 'AzureFirewallApplicationRuleDeny'.

Answer

The time range is too short and the denied events are older.

Answer

The firewall is not configured to log denied traffic.

Answer

The query should use the 'AzureFirewallNetworkRule' category for denied traffic.

Question 13

You need to ensure that security alerts from Microsoft Defender for Cloud are sent to a central SIEM system. What should you configure?

Accepted Answer

Enable continuous export to Event Hubs. Option A is correct because continuous export allows streaming alerts to Event Hubs for integration with SIEMs. Option B is wrong because diagnostic settings are for logs, not alerts. Option C is wrong because playbooks are for response, not export. Option D is wrong because Azure Policy is for governance.

Answer

Create a playbook that forwards alerts to the SIEM

Answer

Configure diagnostic settings for the subscription

Answer

Assign an Azure Policy to export alerts

Question 14

You have an Azure virtual machine that hosts a custom web application. You need to restrict inbound internet traffic to only HTTPS (port 443) from any source. Which Azure resource should you configure?

Accepted Answer

Network Security Group (NSG). Option B is correct because a Network Security Group (NSG) with an inbound rule allowing HTTPS traffic from any source while denying all other traffic meets the requirement. Option A is wrong because Azure Firewall is overkill and more expensive for a single VM. Option C is wrong because Azure Bastion is for RDP/SSH access, not web traffic. Option D is wrong because Application Security Groups (ASGs) are used to group VMs, not to define inbound rules directly.

Answer

Application Security Group (ASG)

Answer

Azure Bastion

Answer

Azure Firewall

Question 15

You need to provide secure remote administration access to Azure virtual machines in a production environment. You want to eliminate public RDP/SSH endpoints and provide just-in-time access. Which Azure service should you use?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Option A is correct because Microsoft Defender for Cloud's just-in-time (JIT) VM access allows you to lock down inbound traffic to VMs and provide time-limited access. Option B is wrong because Azure Bastion provides secure RDP/SSH through the portal but does not provide JIT access. Option C is wrong because NSGs are used for filtering, not JIT access. Option D is wrong because Azure Firewall can be used for JIT-like scenarios but is not the primary service for JIT VM access.

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Answer

Azure Bastion

AZ-500 Practice Test 26 — 15 Questions

Exhibit

AZ-500 Practice Test 26 — 15 Questions

Exhibit