AZ-500 Practice Test 29 — 15 Questions

Question 1

You are configuring security for an Azure Functions app that processes credit card numbers. You need to ensure that the function can securely access a storage account without storing any credentials in code or configuration, and that all data in the storage account is encrypted with a customer-managed key. Which three actions should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the 'Storage Blob Data Contributor' role to the function app's managed identity. Assigning the 'Storage Blob Data Contributor' role to the function app's managed identity authorizes the function to read and write blobs in the storage account using Azure RBAC, without requiring any credentials in code or configuration. This aligns with the requirement to avoid storing credentials, as the managed identity provides a secure identity for the function app to authenticate to Azure services.

Answer

Store the storage account connection string in an application setting

Answer

Use a Key Vault reference in the function app configuration to retrieve the storage account key

Question 2

You run the above PowerShell script. What is the effect on the storage account?

Accepted Answer

Block blobs with the prefix 'logs' are deleted after 30 days. The PowerShell script uses `Add-AzStorageAccountManagementPolicyAction` with `-Action Delete` and `-DaysAfterCreationGreaterThan 30` on a filter that targets block blobs with the prefix 'logs'. This creates a lifecycle management policy rule that automatically deletes those blobs 30 days after their creation. The correct answer is A because the rule specifically applies to block blobs (not all blobs) with the 'logs' prefix and sets a deletion action after 30 days.

Answer

Block blobs with the prefix 'logs' are deleted after 90 days

Answer

All block blobs are deleted after 30 days

Answer

Block blobs with the prefix 'logs' are moved to cool tier after 30 days

Question 3

You are designing a Microsoft Entra ID tenant for a multinational organization. The security team requires that all administrative users must use phishing-resistant MFA. Administrators are located in different regions and may use different devices. Which MFA method should you enforce?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the only option that provides phishing-resistant MFA, as they use public-key cryptography and are bound to a specific web origin, preventing credential theft via man-in-the-middle attacks. This satisfies the security team's requirement for all administrative users, regardless of region or device, because FIDO2 keys are hardware-based and interoperable across platforms.

Answer

SMS-based verification

Answer

Phone call verification

Answer

Microsoft Authenticator with OTP

Question 4

You need to prioritize security recommendations in Microsoft Defender for Cloud. Your compliance team requires a framework that maps to regulatory standards. What should you use?

Accepted Answer

Regulatory compliance standards. Regulatory compliance standards in Microsoft Defender for Cloud map security recommendations to specific regulatory frameworks (e.g., SOC 2, PCI DSS, ISO 27001), enabling the compliance team to prioritize based on regulatory requirements. The secure score (Option D) provides an overall posture but does not map to specific standards. Azure Policy compliance dashboard (Option B) is used for policy enforcement, not recommendation prioritization. Inventory (Option C) lists resources without compliance mapping.

Answer

Azure Policy compliance dashboard

Answer

Inventory feature

Answer

Secure score

Question 5

Refer to the exhibit. You are reviewing an ARM template for an Azure Storage account. Which of the following is true about the deployment?

Accepted Answer

The storage account will enforce HTTPS traffic and replicate data to a paired region.. The ARM template configures the storage account with the 'supportsHttpsTrafficOnly' property set to true, which enforces HTTPS for all requests. Additionally, the 'sku.name' is set to 'Standard_GRS', which replicates data to a paired region for geo-redundancy. Therefore, option D correctly identifies both HTTPS enforcement and geo-replication to a paired region.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

The storage account will use locally redundant storage (LRS).

Answer

The storage account will have a firewall rule to restrict access to specific IPs.

Question 6

Your organization uses Microsoft Defender for Cloud's workload protection for Azure SQL databases. You notice that Defender for Cloud is not generating alerts for anomalous activities on a specific SQL database. The database is in a VNet with a service endpoint enabled for SQL. What should you verify first?

Accepted Answer

Enable Advanced Threat Protection on the Azure SQL Server.. Defender for Cloud's workload protection for Azure SQL databases relies on Advanced Threat Protection (ATP) being enabled at the Azure SQL Server level. Without ATP enabled, Defender for Cloud cannot generate alerts for anomalous activities, regardless of network configurations like VNet service endpoints. Enabling ATP activates the threat detection engine that monitors SQL audit logs for suspicious patterns.

Answer

Ensure the service endpoint is configured correctly.

Answer

Enable auditing on the SQL database.

Answer

Configure a firewall rule to allow Defender for Cloud IP addresses.

Question 7

Which TWO features are available in Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) capabilities? (Choose two.)

Accepted Answer

Attack path analysis. Attack path analysis is a CSPM capability in Microsoft Defender for Cloud that identifies the most likely sequences of actions an attacker could take to breach critical resources. It uses a graph-based model of your cloud environment to map dependencies and misconfigurations, enabling proactive risk mitigation. This is a core part of the Cloud Security Posture Management (CSPM) pillar, not a workload protection feature.

Answer

Just-in-time VM access

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Vulnerability assessment for VMs

Question 8

A public web application should be protected from OWASP-style attacks and network-layer DDoS attacks. Which two Azure services are most relevant?

Accepted Answer

Application Gateway WAF or Azure Front Door WAF. Both Azure Application Gateway WAF and Azure Front Door WAF provide managed rule sets (e.g., OWASP Core Rule Set 3.2) that protect against common web vulnerabilities such as SQL injection and cross-site scripting. Option C is correct because Azure DDoS Protection, when enabled on the virtual network hosting the application, mitigates network-layer DDoS attacks (e.g., SYN floods, UDP floods) by leveraging Azure's global infrastructure to absorb and scrub attack traffic.

Answer

Azure Automation State Configuration

Answer

Azure Files premium tier

Question 9

Which THREE of the following are capabilities of Microsoft Defender for Cloud's workload protection plans?

Accepted Answer

Adaptive application controls. Adaptive application controls (A) are a capability of Microsoft Defender for Cloud's workload protection plans. They use machine learning to analyze processes running on Azure and non-Azure machines, allowing you to define allowlists for known safe applications and generate security alerts when unauthorized applications execute, thus reducing the attack surface.

Answer

DDoS protection

Answer

Data Loss Prevention (DLP)

Question 10

Which TWO actions should you take to integrate on-premises servers with Microsoft Defender for Cloud for unified security management? (Choose two.)

Accepted Answer

Install the Log Analytics agent on each server.. The Log Analytics agent (now the Azure Monitor Agent) is required to collect security events and performance data from on-premises servers and send it to the Log Analytics workspace used by Microsoft Defender for Cloud. This enables Defender for Cloud to apply security policies, detect threats, and provide unified security management across hybrid environments.

Answer

Migrate the servers to Azure Stack HCI.

Answer

Enroll the servers in Microsoft Intune.

Answer

Establish a site-to-site VPN connection to Azure.

Question 11

Which TWO are valid connection methods for Azure VPN Gateway? (Choose two.)

Accepted Answer

Point-to-Site. Point-to-Site (P2S) is a valid connection method for Azure VPN Gateway because it allows individual client computers to connect securely to an Azure virtual network from anywhere using the SSTP, IKEv2, or OpenVPN protocols. This method is ideal for remote workers who need encrypted access without requiring a site-level VPN device.

Answer

VNet-to-VNet

Answer

Azure Bastion

Answer

ExpressRoute

Question 12

Your organization wants to use Microsoft Sentinel to detect and respond to threats. You need to ensure that Sentinel can ingest data from Azure Firewall logs. Which three components are required? (Choose three.)

Accepted Answer

Enable diagnostic logs on Azure Firewall.. Azure Firewall logs must be enabled via diagnostic settings to send data to a Log Analytics workspace. Without diagnostic logs, the firewall does not produce the necessary log data for Sentinel to ingest. This is the foundational step for log collection.

Answer

Assign an Azure Policy to enforce diagnostic logs on all firewalls.

Answer

Install the Log Analytics agent on the Azure Firewall.

Question 13

Your organization uses Azure Files shares. You need to ensure that users authenticate using on-premises Active Directory credentials and that access is logged. What should you do?

Accepted Answer

Enable identity-based authentication for Azure Files and configure diagnostic logs. Azure Files supports identity-based authentication using on-premises Active Directory Domain Services (AD DS) via Kerberos. This allows users to authenticate with their on-premises AD credentials and access the file share seamlessly. Enabling diagnostic logs captures access events, meeting the logging requirement.

Answer

Configure a firewall rule to allow on-premises IPs and enable diagnostic logs

Answer

Use shared access signatures (SAS) for access and enable diagnostic logs

Answer

Configure Azure RBAC for the share and enable diagnostic logs

Question 14

Which THREE are valid methods to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Microsoft Sentinel Data Collector API. The Microsoft Sentinel Data Collector API is a valid ingestion method because it allows custom logs and data sources to be sent directly to Sentinel via a RESTful API endpoint. This is commonly used for non-standard data sources that do not have built-in connectors, enabling organizations to ingest data from custom applications or legacy systems.

Answer

Azure CLI

Answer

Azure Data Factory

Question 15

Your company uses Azure Storage to store sensitive customer data. You need to ensure that only authorized applications running on Azure VMs can access the storage account without using shared keys or SAS tokens. What should you configure?

Accepted Answer

Enable Azure Storage firewall, deny access from all networks, and add a private endpoint. Then assign a managed identity to the VMs and grant it the necessary RBAC role.. Azure Storage firewall with service endpoints or private endpoints, combined with managed identity, allows secure access without shared keys or SAS tokens. Option A (storage account key) is a shared key. Option C (SAS token) is a shared access signature. Option D (access keys) are shared keys.

Answer

Use Azure AD authentication with storage account access keys.

Answer

Configure a storage account key and distribute it to the applications.

Answer

Generate a SAS token with IP restrictions and embed it in the application code.