AZ-500 Practice Test 31 — 15 Questions

Question 1

You are the security administrator for a company that uses Azure Blob Storage to store sensitive documents. You need to ensure that all blob data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You have enabled encryption with CMK on the storage account. However, after a key rotation in Key Vault, you notice that newly uploaded blobs are encrypted with the new key, but existing blobs are still encrypted with the old key. You need to ensure that all blobs are re-encrypted with the new key. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Re-upload the existing blobs using the new key version by calling the Put Blob operation with the new encryption key.. To ensure all blobs are re-encrypted with the new key, you must trigger a rewrite of the blob data. Re-uploading the existing blobs using the Put Blob operation with the new encryption key forces the storage account to re-encrypt the data using the latest key version from Key Vault. Option A is incorrect because the 'Rewrite' operation does not exist in Azure Blob Storage; you must overwrite the blob to trigger re-encryption. Option B is incorrect because changing the encryption key setting does not retroactively re-encrypt existing blobs; it only applies to new blobs. Option C is incorrect because Azure Storage does not automatically re-encrypt existing blobs when the key is rotated; only new blobs use the new key version.

Answer

Update the storage account's encryption scope to use the new key version and then call the 'Rewrite' operation on each blob.

Answer

Set the storage account encryption to use a different key, then revert to the original key to force re-encryption.

Answer

No action is needed; Azure Storage automatically re-encrypts existing blobs with the new key after rotation.

Question 2

Which TWO actions should you take to ensure that an Azure Storage account is only accessible over HTTPS and that data in transit is encrypted?

Accepted Answer

Set 'Secure transfer required' to Enabled.. Enabling 'Secure transfer required' on an Azure Storage account rejects any HTTP requests and enforces HTTPS for all data in transit. Option D is correct because setting the minimum TLS version to 1.2 ensures that only clients using TLS 1.2 or higher can connect, which prevents downgrade attacks and enforces strong encryption for data in transit.

Answer

Configure a custom domain with HTTPS enabled.

Answer

Deploy Azure Firewall in front of the storage account.

Answer

Use Azure Private Link to connect to the storage account.

Question 3

Refer to the exhibit. You are analyzing the Always Encrypted configuration for an Azure SQL Database. The SSN column uses randomized encryption, and the CreditCard column uses deterministic encryption. Which statement is true regarding querying these columns?

Accepted Answer

Only the CreditCard column supports equality searches.. Deterministic encryption always generates the same ciphertext for a given plaintext, enabling equality comparisons and point lookups. Randomized encryption produces different ciphertexts each time, preventing any equality or pattern-matching operations. Therefore, only the CreditCard column (deterministic) supports equality searches.

Answer

Both columns support equality searches.

Answer

Both columns support pattern matching with LIKE.

Answer

Only the SSN column supports point lookups.

Question 4

Your company, Contoso Ltd., has a hybrid environment with 500 on-premises Windows servers and 200 Azure VMs. The Azure VMs are spread across multiple subscriptions. You need to implement a centralized security monitoring solution using Microsoft Sentinel. The requirements are:
- Collect security events from all on-premises servers.
- Collect Azure activity logs and VM logs from all Azure subscriptions.
- Detect and respond to threats using built-in and custom analytics.
- Automatically remediate common threats such as disabling compromised user accounts.
- Ensure compliance with regulatory standards (e.g., NIST 800-53).
- Minimize administrative overhead and cost.

What should you do?

Accepted Answer

Deploy Azure Arc on all on-premises servers. Use Azure Monitor Agent with Data Collection Rules to collect security events. Enable Microsoft Sentinel on a Log Analytics workspace. Configure analytics rules and automation rules with playbooks for remediation.. It uses Azure Arc to onboard the 500 on-premises Windows servers into Azure, then Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) to collect Windows security events into a Log Analytics workspace where Microsoft Sentinel is enabled; Sentinel's analytics rules provide built-in and custom threat detection, and automation rules with playbooks (Logic Apps) deliver automated remediation such as disabling compromised accounts, while Sentinel's compliance workbook and built-in NIST 800-53 content address regulatory requirements. This approach centralizes monitoring across all subscriptions and on-premises servers with minimal administrative overhead. Option A is outdated because the Microsoft Monitoring Agent (MMA) is deprecated in favor of AMA, and it lacks the Arc-based onboarding and DCR-based collection needed for modern hybrid coverage. Option B does not meet the requirement for Microsoft Sentinel, since it forwards logs to a third-party SIEM instead. Option C relies on manual remediation and the Sentinel Free tier, which has limited data ingestion and retention, so it does not satisfy automated remediation or compliance needs.

Answer

Install Microsoft Monitoring Agent on on-premises servers and connect to a Log Analytics workspace. Enable Sentinel. Use Azure Automation runbooks for remediation.

Answer

Enable Microsoft Defender for Cloud on all subscriptions and install Defender for Endpoint on all servers. Forward logs to a third-party SIEM.

Answer

Create a Log Analytics workspace and enable Sentinel on the Free tier. Use KQL queries for detection and manual remediation.

Question 5

You manage a multi-tier application in Azure with a web tier, application tier, and database tier. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure networking feature should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet.. Network security groups (NSGs) allow you to define inbound and outbound security rules that filter traffic at the subnet or NIC level. By placing each tier in its own subnet and applying an NSG to the web tier subnet that allows inbound traffic from the internet, and NSGs to the application and database tier subnets that only allow inbound traffic from the web tier subnet (using the source IP address range or the virtual network tag), you can effectively isolate the tiers while permitting necessary east-west traffic.

Answer

Virtual network peering between tiers.

Answer

Azure Firewall with application rules.

Answer

Application security groups (ASGs) within the same subnet.

Question 6

A privileged administrator should activate the Security Administrator role only for approved work and for a limited time. What should be configured?

Accepted Answer

Eligible assignment with activation controls in Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure eligible assignments for roles like Security Administrator. This means the user must activate the role on demand, with time-bound activation controls (e.g., maximum activation duration, approval, MFA), ensuring the role is used only for approved work and for a limited time. This directly meets the requirement of just-in-time (JIT) access and temporary activation.

Answer

Permanent active assignment in Microsoft Entra ID

Answer

Owner role at the subscription root

Answer

Conditional Access session persistence

Question 7

Refer to the exhibit. You are reviewing user sign-in activity using Microsoft Graph API. The user has not performed an interactive sign-in since December 1, but had a non-interactive sign-in on December 5. You need to determine if the user should be considered inactive for a policy that defines inactivity as no interactive sign-in for 30 days. Today is December 15. What should you do?

Accepted Answer

Use the lastSignInDateTime of December 1, which is only 14 days ago, so the user is not inactive.. The policy defines inactivity as no interactive sign-in for 30 days. The user's last interactive sign-in was on December 1, which is only 14 days ago as of December 15, so the user is not inactive. Microsoft Graph API's lastSignInDateTime property specifically tracks interactive sign-ins, while non-interactive sign-ins are tracked separately via lastNonInteractiveSignInDateTime and do not reset the interactive inactivity timer.

Answer

Check if the user has any sign-in in the last 30 days; since there is a non-interactive sign-in, the user is active.

Answer

Use the lastNonInteractiveSignInDateTime as the last sign-in time, so the user is not inactive.

Answer

The user is inactive because the account is enabled but there is no interactive sign-in in the last 30 days.

Question 8

You are designing network security for a multi-tier application deployed in Azure. The application consists of a front-end web tier, a middle-tier API, and a back-end database. All tiers must be isolated from the internet except the front-end, which must accept HTTPS traffic from the internet. You need to ensure that no traffic can bypass the network security controls. What should you implement?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.. Deploying Azure Firewall in a hub virtual network and routing all traffic between tiers through the firewall for inspection ensures that no traffic can bypass network security controls. This design enforces a forced tunneling architecture where all inter-tier traffic (e.g., from front-end to API to database) must traverse the firewall, allowing centralized inspection, logging, and filtering. This meets the requirement for complete isolation and control, as NSGs alone cannot prevent traffic from bypassing inspection if routes are not explicitly forced.

Answer

Place all tiers in the same virtual network and use Azure Front Door with WAF for the web tier, and rely on NSGs for internal traffic.

Answer

Deploy Network Security Groups (NSGs) on each subnet and allow only necessary traffic between tiers.

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in front of the web tier, and use NSGs for the other tiers.

Question 9

You need to ensure that all Azure subscriptions in your tenant are automatically assessed for security misconfigurations and compliance against Microsoft cloud security benchmark. What should you configure?

Accepted Answer

Assign an initiative via Azure Policy to all subscriptions. The Microsoft cloud security benchmark is a built-in initiative in Azure Policy. By assigning this initiative to all subscriptions, you automatically assess them for security misconfigurations and compliance. Defender for Cloud uses these policies, but ensuring the assessment requires the initiative assignment. Option C is incorrect because enabling continuous export only streams completed assessment data; it does not trigger the assessment itself.

Answer

Deploy Microsoft Sentinel with automatic data connectors

Answer

Enable continuous export in Microsoft Defender for Cloud

Answer

Create a blueprint definition and assign it to management group

Question 10

Drag and drop the steps to configure Azure AD Conditional Access policy to require MFA for all users into the correct order.

Accepted Answer

Assign users and groups, then assign cloud apps, then configure access controls, then enable policy.. Conditional Access policies require defining users and access controls before enabling.

Answer

Assign users and groups, then configure access controls, then assign cloud apps, then enable policy.

Answer

Configure access controls, then assign users and groups, then assign cloud apps, then enable policy.

Answer

Assign users and groups, then assign cloud apps, then enable policy, then configure access controls.

Question 11

A company uses Microsoft Defender for Cloud. The security team wants to receive a weekly email digest that includes the current Secure Score, the number of healthy and unhealthy resources, and a list of top recommendations. Which Defender for Cloud feature should they configure?

Accepted Answer

Email notifications for alerts and weekly digests. Microsoft Defender for Cloud provides a built-in 'Email notifications for alerts and weekly digests' feature that allows security teams to configure a weekly email containing the current Secure Score, the number of healthy and unhealthy resources, and a list of top recommendations. This feature is specifically designed to deliver a summary of the security posture directly to recipients without requiring manual export or custom automation.

Answer

Regulatory Compliance dashboard

Answer

Security policies

Answer

Continuous Export

Question 12

A security team wants to receive a weekly email summary of the security posture of all their Azure subscriptions, including the Secure Score, top recommendations, and the number of healthy resources. Which Microsoft Defender for Cloud feature should they configure?

Accepted Answer

Email notifications for weekly digest. The 'Email notifications for weekly digest' feature in Microsoft Defender for Cloud is specifically designed to send a weekly summary of security posture, including Secure Score, top recommendations, and healthy resources, directly to specified email recipients. This feature is configured under Defender for Cloud's 'Email notifications' settings, where you can enable the weekly digest and define the recipients.

Answer

Continuous export to a Log Analytics workspace

Answer

Automation rules to trigger a Logic App on a schedule

Answer

Workflow automation to export data daily

Question 13

You manage Azure Storage accounts for a healthcare organization. To comply with HIPAA, you need to ensure that all data at rest is encrypted and that encryption keys are rotated automatically every 90 days. What should you implement?

Accepted Answer

Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.. Customer-managed keys (CMK) stored in Azure Key Vault with automatic key rotation fulfill the requirement for encrypted data at rest and automatic rotation of encryption keys. This ensures that HIPAA compliance is met by maintaining control over encryption keys and enforcing their periodic rotation. The other options do not provide automatic key rotation: RBAC controls access but does not rotate keys; infrastructure encryption adds another layer but does not include key rotation; manually rotating storage account access keys addresses authentication keys, not encryption keys, and is not automatic.

Answer

Configure Azure RBAC roles for storage accounts.

Answer

Enable infrastructure encryption for storage accounts.

Answer

Generate new storage account access keys manually every 90 days.

Question 14

You have an Azure SQL Database that contains sensitive customer data. You need to ensure that database administrators (DBAs) cannot view the data in the 'CreditCard' column. What should you implement?

Accepted Answer

Use Always Encrypted with column encryption key stored in Azure Key Vault.. Always Encrypted ensures that sensitive data, such as the 'CreditCard' column, is encrypted at rest and in transit, and that the encryption keys are never exposed to the database engine. By storing the column encryption key in Azure Key Vault, DBAs with full server access cannot decrypt the data because they lack access to the key material. This provides client-side encryption where only authorized applications with the key can view plaintext data.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Answer

Implement Azure SQL Auditing for the database.

Answer

Configure Dynamic Data Masking for the 'CreditCard' column.

Question 15

You are a security analyst using Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from the same IP address within 5 minutes. The rule should use a KQL query. Which query should you use?

Accepted Answer

SigninLogs | where ResultType !in ("0","50125") // failed attempts | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10. It filters for failed sign-ins by excluding successful results (ResultType '0' and '50125', where '50125' is a non-failure code), then uses `summarize` with `bin(TimeGenerated, 5m)` to count failed attempts per IP address within 5-minute windows, and finally filters for counts exceeding 10. This directly meets the requirement to trigger an incident when more than 10 failed sign-ins occur from the same IP within 5 minutes.

Answer

SigninLogs | where ResultType != "0" | make-series Count=count() default=0 on TimeGenerated from ago(5m) to now() step 5m by IPAddress

Answer

SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10

Answer

SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(time-generated, 5m) | where Count > 10