AZ-500 Practice Test 27 — 15 Questions

Question 1

A company has two Azure virtual networks in different Azure regions that need to communicate with each other. The security policy mandates that all inter-region traffic must be encrypted over the public internet. Which connectivity solution should the company implement to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure VPN Gateway (site-to-site connection). Azure VPN Gateway with a site-to-site (S2S) connection is the correct solution because it establishes an encrypted IPSec tunnel over the public internet between the two virtual networks. This meets the security mandate for encryption of inter-region traffic traversing the public internet, as IPSec provides confidentiality, integrity, and authentication at the network layer.

Answer

VNet peering

Answer

Azure ExpressRoute

Answer

Azure Firewall

Question 2

A company uses Azure Front Door to accelerate and secure its public web application. The security team wants to limit the number of requests from a single client IP address to 100 per minute to prevent a single user from overwhelming the backend. Which configuration should they add to the Web Application Firewall (WAF) policy associated with the Front Door?

Accepted Answer

Add a custom rule with a rate limit condition.. Azure Front Door's WAF supports custom rate limit rules that can restrict the number of requests from a single client IP address within a specified time window. By creating a custom rule with a rate limit condition set to 100 requests per minute, the security team can prevent a single client from overwhelming the backend while allowing legitimate traffic. This is the only option that directly addresses the requirement to limit requests per client IP.

Answer

Enable a managed rule set for the WAF policy.

Answer

Configure a bot protection rule set.

Answer

Set a geolocation filter to block all traffic except from allowed countries.

Question 3

Drag and drop the steps to configure Azure Application Gateway with SSL termination using a Key Vault certificate into the correct order.

Accepted Answer

Step 1: Create an Azure Key Vault. Step 2: Import a certificate into the Key Vault. Step 3: Enable managed identity on the Application Gateway. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets. Step 5: Configure the HTTPS listener to use the certificate from Key Vault.. SSL termination requires a certificate from Key Vault, configured on the listener.

Answer

Step 1: Create an Application Gateway. Step 2: Configure the HTTPS listener. Step 3: Create a Key Vault and import a certificate. Step 4: Grant the Application Gateway access to the Key Vault.

Answer

Step 1: Enable managed identity on the Application Gateway. Step 2: Create a Key Vault and import a certificate. Step 3: Configure the HTTPS listener to use the certificate from Key Vault. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets.

Answer

Step 1: Create a Key Vault and import a certificate. Step 2: Configure the HTTPS listener to use the certificate from Key Vault. Step 3: Enable managed identity on the Application Gateway. Step 4: Grant the managed identity permissions to access the Key Vault certificate secrets.

Question 4

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.

Accepted Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Choose the subscription, Step 4: Set pricing tier to Standard. To enable Azure Security Center's enhanced security features for a subscription, you must first navigate to Security Center, then access 'Security policy' under Management. Within that blade, select the target subscription and set its pricing tier to Standard. This activates advanced threat detection and vulnerability assessment capabilities. Common mistakes include confusing the order of subscription selection and tier setting, or mixing up the security policy with auto-provisioning settings.

Answer

Step 1: Navigate to Azure Security Center, Step 2: Choose the subscription, Step 3: Set pricing tier to Standard, Step 4: Select 'Security policy' under Management

Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Set pricing tier to Standard, Step 4: Choose the subscription

Answer

Step 1: Navigate to Azure Security Center, Step 2: Go to 'Auto provisioning' settings, Step 3: Enable Log Analytics agent, Step 4: Set pricing tier to Standard

Question 5

Your organization uses Azure Virtual WAN. You need to secure traffic between a spoke VNet and an on-premises site that connects via a Virtual WAN VPN gateway. What is the best way to inspect traffic?

Accepted Answer

Use Azure Firewall Manager to deploy a secured virtual hub.. Azure Firewall Manager enables you to deploy a secured virtual hub, which centrally manages and routes traffic between Virtual WAN spokes and on-premises sites through Azure Firewall for inspection. This is the best approach because it provides a scalable, hub-and-spoke architecture with forced tunneling and routing policies that ensure all traffic between the spoke VNet and the on-premises site is inspected without requiring additional NVAs or complex user-defined routes.

Answer

Deploy Azure Firewall in the spoke VNet.

Answer

Deploy a third-party NVA in the spoke VNet.

Answer

Apply NSG rules on the spoke subnet.

Question 6

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?

Accepted Answer

Enable trusted Microsoft services on the Key Vault firewall. When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.

Answer

Create a private endpoint for Key Vault

Answer

Assign the SQL server's managed identity to the Key Vault

Answer

Configure a service endpoint on the SQL server

Question 7

You need to restrict access to an Azure Storage account so that only traffic from a specific virtual network is allowed. What should you configure?

Accepted Answer

Storage account firewall and virtual network settings. Azure Storage accounts have a built-in firewall that can be configured to restrict access based on source IP addresses or virtual network (VNet) rules. By enabling the storage account firewall and adding a rule that allows traffic only from a specific VNet/subnet, you effectively block all other traffic, including internet traffic, while permitting requests from the designated VNet. This is the native Azure method for network-level access control to storage accounts.

Answer

Azure Firewall application rule

Answer

Private endpoint connection

Answer

Network security group (NSG) on the subnet

Question 8

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with the 'sysadmin' role cannot view the plaintext data. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with deterministic encryption. Always Encrypted with deterministic encryption is correct because it encrypts specific columns at the client side, ensuring that even database administrators with 'sysadmin' role cannot view plaintext data. Deterministic encryption generates the same ciphertext for identical plaintext values, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting both requirements.

Answer

Transparent Data Encryption (TDE)

Answer

Always Encrypted with randomized encryption

Answer

Dynamic Data Masking

Question 9

Which TWO actions can be performed using Microsoft Defender for Cloud's 'Regulatory Compliance' dashboard?

Accepted Answer

Upload evidence documents for manual controls.. Option A is correct because the Regulatory Compliance dashboard in Microsoft Defender for Cloud lets you attach evidence files to manual controls that cannot be assessed automatically, so auditors can verify attestation-based requirements. Option C is correct because the dashboard displays a compliance score for each selected regulatory standard (for example, PCI DSS, ISO 27001, or NIST SP 800-53), showing the percentage of passed controls and the breakdown by control domain. Options B, D, and E are not actions available from this dashboard: automatic remediation is driven by workflow automation or remediation logic in recommendations, continuous export is configured separately under Environment settings, and third-party GRC integration is not performed directly from the Regulatory Compliance dashboard.

Answer

Automatically remediate non-compliant resources.

Answer

Configure continuous export of compliance data.

Answer

Integrate with third-party GRC tools directly from the dashboard.

Question 10

A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?

Accepted Answer

Always Encrypted with a client-side encryption key stored in Azure Key Vault.. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted on the client side before being sent to Azure SQL Database, and the encryption keys are never revealed to the database engine. This prevents DBAs or any server-side administrators from viewing the plaintext data, as decryption can only occur using the client-side encryption key stored in Azure Key Vault and accessed by the dedicated application library.

Answer

Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.

Answer

Dynamic Data Masking (DDM) for the credit card column.

Answer

Row-Level Security (RLS) to restrict DBA access to the credit card column.

Question 11

A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?

Accepted Answer

Enable the Key Vault firewall to allow trusted Microsoft services. When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.

Answer

Create a private endpoint for the SQL server to access the Key Vault

Answer

Enable public network access on the Key Vault

Answer

Assign the SQL server's managed identity the 'Reader' role on the Key Vault

Question 12

You are using Microsoft Sentinel to monitor security events. You need to create a custom analytics rule that detects when a user account is added to a privileged group. The rule should run every 5 minutes and generate an incident. Which query language and data source should you use?

Accepted Answer

KQL against the AuditLogs table.. To detect user account additions to privileged groups, you need Microsoft Entra ID audit logs, which are stored in the AuditLogs table in Microsoft Sentinel. KQL is the query language for analytics rules. The AuditLogs table captures group management activities, including additions to privileged roles. The rule can be scheduled to run every 5 minutes and generate incidents when the condition is met.

Answer

KQL against the AzureActivity table.

Answer

KQL against the SigninLogs table.

Answer

KQL against the SecurityEvent table.

Question 13

An AKS cluster needs to pull container images from a private Azure Container Registry (ACR). The security policy requires that the AKS cluster identity should not have direct access to the ACR; instead, a service principal with the AcrPull role should be used, with credentials stored as a Kubernetes secret. Which authentication method should be configured on the AKS cluster?

Accepted Answer

Kubernetes pull secret using a service principal. The scenario explicitly requires that the AKS cluster identity not have direct access to ACR, and instead mandates using a service principal with AcrPull role whose credentials are stored as a Kubernetes secret. A Kubernetes pull secret of type 'docker-registry' stores the service principal's client ID and client secret, which kubelet uses to authenticate to ACR when pulling images. This method decouples the AKS cluster's managed identity from ACR access, satisfying the security policy.

Answer

AKS managed identity

Answer

ACR admin account

Answer

Azure AD pod identity

Question 14

Your organization uses Azure Storage for sensitive customer data. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, you want to automatically rotate the key every 90 days. What should you configure?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key and configure a key rotation policy in Azure Key Vault.. Azure Storage encryption with a customer-managed key (CMK) allows you to use your own key stored in Azure Key Vault to encrypt data at rest. By configuring a key rotation policy in Azure Key Vault, you can automatically rotate the key every 90 days, meeting both the CMK and rotation requirements without custom code.

Answer

Enable Azure Disk Encryption on the storage account and store the key in Key Vault with rotation policy.

Answer

Enable server-side encryption with a platform-managed key and use Azure Policy to enforce rotation.

Answer

Use client-side encryption with .NET client library and implement custom rotation logic.

Question 15

You are designing network security for a multi-tier application. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. Both tiers are in the same virtual network. Which Azure service should you use to restrict traffic between the tiers?

Accepted Answer

Network Security Group (NSG). Network Security Groups (NSGs) are used to filter network traffic to and from Azure resources within a virtual network. They contain security rules that allow or deny inbound and outbound traffic based on source/destination IP, port, and protocol. By applying NSGs to the subnets or NICs of the web and database tiers, you can restrict database access to only the web tier.

Answer

Route table

Answer

Azure Firewall

Answer

Application Security Groups (ASGs)