AZ-500 Practice Test 28 — 15 Questions

Question 1

An Application Gateway WAF blocks legitimate requests because a managed rule detects a known false positive. The team wants to keep the rule set enabled. What should they configure?

Accepted Answer

A narrowly scoped WAF exclusion for the affected variable or rule. A narrowly scoped WAF exclusion is the correct approach because it allows the team to keep the managed rule set enabled while preventing false positives. By configuring an exclusion for the specific variable (e.g., RequestHeaderNames, RequestCookieNames, RequestArgNames) or rule ID that triggers the false positive, the WAF will skip inspection on that particular element without weakening the overall security posture. This maintains protection against other threats while resolving the blocking of legitimate traffic.

Answer

Disable WAF prevention mode for the entire gateway

Answer

Remove TLS from the listener

Answer

Move the application behind an internal load balancer only

Question 2

You need to securely connect an on-premises network to Azure over the internet with encrypted traffic. The connection must be site-to-site and use IPsec. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway supports site-to-site (S2S) VPN connections over the internet using IPsec/IKE (IKEv1 or IKEv2) to encrypt traffic between an on-premises VPN device and Azure. This matches the requirement for an encrypted, internet-based site-to-site connection. ExpressRoute bypasses the internet entirely, Virtual WAN is a higher-level orchestration service that still relies on VPN Gateway for S2S IPsec, and Bastion is for RDP/SSH access to VMs without public IPs.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 3

You have an Azure virtual machine that hosts a custom web application. You need to restrict inbound internet traffic to only HTTPS (port 443) from any source. Which Azure resource should you configure?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) is the correct choice because it acts as a distributed, stateful firewall that filters inbound and outbound traffic at the subnet or network interface level. By creating an inbound security rule allowing TCP port 443 from any source (0.0.0.0/0) and denying all other inbound traffic, you can restrict internet traffic to HTTPS only. NSGs are the native Azure resource for controlling network traffic to VMs without additional cost or complexity.

Answer

Application Security Group (ASG)

Answer

Azure Bastion

Answer

Azure Firewall

Question 4

You are configuring Microsoft Defender for Cloud for a subscription that contains Azure Kubernetes Service (AKS) clusters. You need to ensure that Defender for Containers provides vulnerability assessment for container images stored in Azure Container Registry (ACR). What should you enable?

Accepted Answer

Enable the Defender for Containers plan and ensure that the ACR integration is turned on, then grant the Defender for Cloud service principal the AcrPull role on the registry.. Defender for Containers is the correct plan for protecting AKS clusters and container images in ACR. Enabling the plan and the ACR integration, along with granting the service principal AcrPull permissions, allows Defender for Cloud to scan images for vulnerabilities. The other plans target different resource types and do not include container image assessment.

Answer

Enable the Defender for App Service plan and configure the ACR integration from the App Service environment.

Answer

Enable the Defender for Storage plan and configure a private endpoint to ACR.

Answer

Enable the Defender for Servers plan and deploy the Log Analytics agent to all AKS nodes.

Question 5

Refer to the exhibit. You are analyzing a Conditional Access policy JSON. The policy requires MFA for Office 365 applications. However, users report that they are still able to access Office 365 without MFA. What is the most likely reason?

Accepted Answer

The 'grantControls' section is empty. The most likely reason is that the 'grantControls' section is empty. In a Conditional Access policy, the 'grantControls' section specifies the controls to enforce, such as requiring MFA. If this section is empty, no controls are applied, and users can access Office 365 without MFA.

Answer

The policy excludes some Office 365 apps

Answer

The 'authenticationStrength' property is not a valid Conditional Access policy property

Answer

The policy does not include all users

Question 6

Drag and drop the steps to configure Azure AD Privileged Identity Management (PIM) for a role into the correct order.

Accepted Answer

Step 1: Enable PIM, Step 2: Select roles, Step 3: Configure settings, Step 4: Assign users as eligible. PIM requires enabling the service first, then selecting roles, configuring settings, and finally assigning users as eligible.

Answer

Step 1: Select roles, Step 2: Configure settings, Step 3: Enable PIM, Step 4: Assign users as eligible

Answer

Step 1: Assign users as eligible, Step 2: Enable PIM, Step 3: Select roles, Step 4: Configure settings

Answer

Step 1: Configure settings, Step 2: Select roles, Step 3: Enable PIM, Step 4: Assign users as eligible

Question 7

Drag and drop the steps to configure Azure Defender for SQL on an Azure SQL Database into the correct order.

Accepted Answer

1. Enable Azure Defender for SQL on the database. 2. Configure a storage account for vulnerability assessment scans. 3. Set up email notifications for security alerts.. Defender for SQL is enabled per database under security settings, requiring storage for scans.

Answer

1. Configure a storage account for vulnerability assessment scans. 2. Enable Azure Defender for SQL on the database. 3. Set up email notifications for security alerts.

Answer

1. Enable Azure Defender for SQL on the database. 2. Set up email notifications for security alerts. 3. Configure a storage account for vulnerability assessment scans.

Answer

1. Set up email notifications for security alerts. 2. Enable Azure Defender for SQL on the database. 3. Configure a storage account for vulnerability assessment scans.

Question 8

You are troubleshooting why a user cannot sign in to a custom line-of-business application that is federated with Microsoft Entra ID. The user reports that they are repeatedly prompted for credentials and then receive an error. The application is configured for SAML-based SSO. What is the most likely cause?

Accepted Answer

The SAML certificate has expired or the configuration has a mismatch. When a SAML-based SSO application repeatedly prompts for credentials and then fails, the most common cause is an expired or misconfigured SAML signing certificate. The certificate is used by Microsoft Entra ID to sign SAML assertions; if it has expired, or if the thumbprint, audience URI, or reply URL in the Entra ID configuration does not match what the application expects, the application will reject the assertion and force re-authentication or display an error.

Answer

The user's browser cookies are disabled

Answer

The application is not registered in the app gallery

Answer

The user does not have a license for Microsoft Entra ID

Question 9

You are a security administrator for a company that stores sensitive data in Azure Blob Storage. You need to ensure that data cannot be accessed from outside the corporate network, even if someone obtains a valid SAS token. The company uses a site-to-site VPN to connect to Azure. What should you configure?

Accepted Answer

Configure storage firewall to allow access only from selected virtual networks and IP ranges.. To restrict blob access to the corporate network, you must configure the storage account firewall to allow only specific virtual networks or IP ranges. This ensures that requests from outside the allowed networks are denied, even if they present a valid SAS token.

Answer

Enable soft delete for blobs.

Answer

Use customer-managed keys (CMK) for encryption at rest.

Answer

Enable Azure Defender for Storage.

Question 10

A security operations team uses Microsoft Sentinel. They want to create a custom analytics rule that detects when an Azure virtual machine is created with a public IP address that is not in an approved list. Which type of rule should they use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that runs on a recurring schedule (e.g., every 5 minutes) to detect when an Azure VM is created with a public IP not in an approved list. This rule type is designed for custom detection logic that requires periodic evaluation of log data, such as AzureActivity logs or Azure Resource Graph, making it ideal for this scenario.

Answer

NRT rule

Answer

Anomaly rule

Answer

Fusion rule

Question 11

A company has an Azure SQL Database that stores personally identifiable information (PII) in columns. They need to encrypt those columns so that only authorized applications can decrypt the data, and even database administrators cannot view the plaintext. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they use?

Accepted Answer

Always Encrypted with deterministic encryption. Always Encrypted with deterministic encryption is the correct choice because it encrypts PII columns at the client side, ensuring that even database administrators cannot view plaintext data. Deterministic encryption generates the same ciphertext for the same plaintext, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting the requirement for query support.

Answer

Always Encrypted with randomized encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 12

Which THREE Microsoft Entra ID roles can be assigned to a user to manage Microsoft Defender XDR (formerly Microsoft 365 Defender) incidents? (Choose three.)

Accepted Answer

Security Administrator. The Security Administrator role (Option B) can manage Microsoft Defender XDR incidents because it grants full access to security features, including the ability to view, investigate, and respond to incidents in the Microsoft 365 Defender portal. This role is designed for users who need to manage security policies and incidents without having full administrative control over the tenant.

Answer

Exchange Administrator

Answer

Global Reader

Question 13

Your company uses Azure Firewall Premium. You need to inspect outbound traffic for malware using signature-based detection. Which feature should you enable?

Accepted Answer

Intrusion Detection and Prevention System (IDPS). Intrusion Detection and Prevention System (IDPS) on Azure Firewall Premium uses signature-based detection to inspect outbound traffic for known malware patterns. It can alert or block traffic matching malicious signatures, making it the correct feature for this requirement.

Answer

Web categories

Answer

URL filtering

Answer

Threat intelligence-based filtering

Question 14

You need to ensure that security alerts from Microsoft Defender for Cloud are sent to a central SIEM system. What should you configure?

Accepted Answer

Enable continuous export to Event Hubs. Microsoft Defender for Cloud can stream security alerts and recommendations to an Event Hubs namespace via the 'Continuous export' settings. This enables external SIEM systems, such as Splunk or Azure Sentinel, to ingest the data by connecting to the Event Hubs endpoint. Diagnostic settings export activity logs and metrics, not security alerts, and playbooks are for automated response, not data forwarding.

Answer

Create a playbook that forwards alerts to the SIEM

Answer

Configure diagnostic settings for the subscription

Answer

Assign an Azure Policy to export alerts

Question 15

Your organization uses Microsoft Entra ID to manage access for employees and partners. You need to implement a solution that allows partners to self-service request access to specific applications, with approval from their manager, and access expires after 30 days. Which feature should you use?

Accepted Answer

Entitlement Management access packages. Entitlement Management access packages are designed to allow external partners to request access to specific applications through a self-service portal. The feature supports approval workflows (e.g., manager approval) and automatically enforces time-bound access, such as a 30-day expiration. This directly matches the requirement for partner self-service with approval and expiration.

Answer

Azure AD B2B collaboration

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access with session restrictions