AZ-500 Practice Test 33 — 15 Questions

Question 1

A security team uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. They notice that some controls are marked as 'N/A' even though they have relevant resources. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The resources are in a subscription that is not included in the scope of the compliance standard.. The correct answer is C: resources in a subscription that is not included in the scope of the compliance standard. In Microsoft Defender for Cloud's regulatory compliance dashboard, a control is shown as 'N/A' when the standard's assessment scope does not cover the subscription containing those resources, so the control is not evaluated against them. This scoping is configured when assigning the regulatory compliance standard, and only in-scope subscriptions are assessed. Option A is incorrect because a missing custom assessment would leave a control unassessed or healthy/unhealthy, not scoped out as N/A. Option B is incorrect because the regulatory compliance dashboard is a Defender for Cloud capability and does not require a Microsoft Purview Compliance Manager license. Option D is incorrect because manual attestation affects a control's compliance state, not whether it is marked N/A due to scope.

Answer

The resources do not have the required custom assessment.

Answer

The compliance dashboard requires a Microsoft Purview Compliance Manager license.

Answer

The resources have not been manually claimed as compliant.

Question 2

Your organization uses Microsoft Entra ID and requires that all accesses to sensitive applications be approved by the application owner. You need to implement a solution where users can request access to these applications, and the request is automatically routed to the owner for approval. What should you configure?

Accepted Answer

Entitlement management access packages. Entitlement management access packages in Microsoft Entra ID are the correct choice because they let you bundle resources such as sensitive applications into an access package with an approval policy, so users request access through the My Access portal and the request is automatically routed to the designated approver (the application owner) before access is granted. This directly satisfies the requirement for owner-approved, request-based access to applications. Option A (Entra roles and administrative units) governs role assignments and scoping, not user access-request approval workflows for applications. Option C (Privileged Identity Management for groups) handles just-in-time activation of privileged group membership, not application access requests with owner approval. Option D (cross-tenant access settings) controls collaboration and trust with external Entra tenants, which is unrelated to internal application access approvals.

Answer

Microsoft Entra roles and administrative units

Answer

Privileged Identity Management for groups

Answer

Cross-tenant access settings

Question 3

You are deploying a critical application on Azure Virtual Machines that must remain highly available. You need to implement a security solution that ensures the application can recover from a ransomware attack that encrypts all data disks. What is the most cost-effective approach?

Accepted Answer

Configure Azure Backup with immutable vault and soft delete.. Azure Backup with an immutable vault and soft delete (option A) is the most cost-effective solution because it provides ransomware-resistant, tamper-proof recovery points for the VM data disks at a lower cost than full VM replication, and immutability plus soft delete prevents attackers from deleting or altering backups during an attack. Azure Site Recovery (option C) is designed for disaster recovery and VM replication, which is more expensive and not specifically aimed at protecting backup data from ransomware. Azure Files snapshots (option B) only apply to Azure Files shares, not VM data disks, so they cannot protect the application's disk data. Daily disk snapshots stored in the same storage account (option D) are not immutable and can be deleted or encrypted along with the source data, making them a weak ransomware defense.

Answer

Use Azure Files share with snapshots for the application data.

Answer

Enable Azure Site Recovery for the virtual machines.

Answer

Take daily snapshots of the disks and store them in the same storage account.

Question 4

You are a security engineer at Fabrikam Inc. The company has an Azure subscription with a single virtual network (VNet1) that contains a production workload. The network is connected to an on-premises data center via a site-to-site VPN. The security team requires that all Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines in VNet1 must be brokered through Azure Bastion. Additionally, the team wants to ensure that no public IP addresses are assigned to any virtual machines in the production environment. Currently, there are several VMs with public IPs. You need to implement the requirements with minimal downtime. The solution must also ensure that administrators can access the VMs using Azure Bastion without any additional client software. What should you do?

Accepted Answer

Deploy Azure Bastion in the virtual network and then remove the public IP addresses from all VMs.. Option D is correct because Azure Bastion must be deployed in the same virtual network as the target VMs (or a peered VNet) before public IPs are removed, since Bastion provides RDP/SSH connectivity over TLS port 443 through the Azure portal without requiring any client software or public IPs on the VMs. Deploying Bastion first ensures administrators retain access while the public IPs are disassociated, minimizing downtime. Option A is wrong because a point-to-site VPN does not broker RDP/SSH through Bastion and does not satisfy the no-public-IP requirement by itself. Option B is wrong because JIT VM access is a Microsoft Defender for Cloud feature that reduces exposure but does not replace Bastion or eliminate the need for public IPs. Option C is wrong because removing public IPs before Bastion is deployed would cut off RDP/SSH access and cause downtime.

Answer

Create a point-to-site VPN for administrators and remove public IPs from VMs.

Answer

Deploy Azure Bastion in the virtual network, then configure Just-In-Time (JIT) VM access for all VMs.

Answer

Disassociate public IPs from all VMs, then deploy Azure Bastion in the same virtual network.

Question 5

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Cloud to monitor security posture. You notice that the recommendation 'MFA should be enabled on accounts with owner permissions on your subscription' shows a status of 'Unhealthy' for some accounts, but those accounts already have Microsoft Entra Conditional Access policies requiring MFA. What is the most likely reason for the discrepancy?

Accepted Answer

Defender for Cloud evaluates the 'per-user' MFA state, which is separate from Conditional Access.. The correct answer is C: Defender for Cloud evaluates the 'per-user' MFA state, which is separate from Conditional Access. Microsoft Defender for Cloud's MFA recommendation checks whether each account has MFA enabled at the per-user level in Microsoft Entra ID (the legacy per-user MFA setting), not whether Conditional Access policies enforce MFA at sign-in. Therefore, accounts protected only by Conditional Access can still appear 'Unhealthy' because their per-user MFA status remains disabled. Option A is wrong because the scenario states the Conditional Access policies require MFA, so the discrepancy is not caused by policy scope. Option B is wrong because guest users can be protected by MFA through Conditional Access. Option D is wrong because Azure subscription IAM does not configure MFA; MFA is an identity-level control in Microsoft Entra ID.

Answer

The Conditional Access policies are not applied to all users; some users bypass MFA.

Answer

The accounts are guest users from another tenant; MFA cannot be enforced.

Answer

The recommendation requires MFA to be configured in the subscription's access control (IAM) blade.

Question 6

A company uses Azure Front Door (AFD) with WAF policy in front of a web application. The security team notices that some requests from a specific IP range are being blocked incorrectly. The WAF policy uses custom rules. The team wants to allow a specific IP range while still having the WAF inspect other traffic. What is the most efficient way to configure this?

Accepted Answer

Create a custom rule with priority 1, action 'Allow', and match condition for the source IP range.. The correct option is B: create a custom rule with priority 1, action 'Allow', and a match condition for the source IP range. In Azure Front Door WAF, custom rules are evaluated in priority order (lower numbers first), and an Allow rule matched early short-circuits the remaining WAF evaluation, so the trusted IP range bypasses blocking while all other traffic continues to be inspected by the managed and custom rules. Option A is wrong because a Block rule for that IP range would continue blocking the traffic the team wants to permit. Option C is wrong because a rate-limit rule controls request volume, not allow-listing, and would not reliably exempt the range from other WAF blocks. Option D is wrong because managed rule sets cannot be selectively disabled per IP range via a geo-match condition; exclusions apply to specific rule/request attributes, not source IP ranges in that manner.

Answer

Add a custom rule with priority 100, action 'Block', and match condition for the IP range.

Answer

Add a rate limit rule that allows traffic from the IP range.

Answer

Disable the managed rule sets for the specific IP range using a geo-match condition.

Question 7

Which THREE are valid ways to trigger a playbook in Microsoft Sentinel? (Choose three.)

Accepted Answer

Manually from an incident by selecting 'Run playbook'.. Option A is correct because Microsoft Sentinel allows analysts to manually trigger a playbook directly from an incident's page by selecting 'Run playbook', which executes the associated Logic App workflow on demand. Option B is correct because automation rules in Microsoft Sentinel can be configured with a trigger of 'When incident is created' and an action of 'Run playbook', automatically invoking the playbook as soon as the incident is generated. Option E is correct because automation rules also support the trigger 'When alert is created', allowing a playbook to be run automatically at alert creation time, before or independently of incident creation. Option C is not a valid trigger because watchlists are reference data sources and do not have automation-rule triggers for playbook execution. Option D is not a valid trigger because the 'Investigate' action on an entity page opens the investigation experience and does not itself run a playbook.

Answer

From a watchlist item update.

Answer

From an entity page by clicking 'Investigate'.

Question 8

You are the security architect for a large enterprise that uses Microsoft Entra ID with 50,000 users. The company recently adopted a cloud-first strategy and is migrating on-premises applications to Azure. You need to design a secure identity and access solution that meets the following requirements:

- All access to cloud applications must be authenticated using modern authentication protocols.
- Legacy authentication protocols (such as POP3, IMAP4, SMTP, and basic authentication) must be blocked.
- Users must be required to use multi-factor authentication (MFA) when accessing any application from outside the corporate network.
- Administrative access to Azure resources must be time-bound and require approval.
- The solution must minimize user friction for internal users on the corporate network.
- All sign-in risks must be detected and automatically remediated.

You have deployed Microsoft Entra ID P2 licensing and configured Microsoft Defender for Cloud Apps. Which of the following is the most appropriate combination of actions to meet all requirements?

Accepted Answer

Create a Conditional Access policy to block legacy authentication and require MFA for all users when accessing from outside the corporate network. Exclude trusted locations from MFA. Use PIM with approval for admin roles. Enable Identity Protection for risk detection and automatic remediation.. Option D is correct because it directly satisfies every stated requirement: a Conditional Access policy blocking legacy authentication eliminates POP3, IMAP4, SMTP, and basic authentication; requiring MFA for all users outside the corporate network with trusted locations excluded minimizes friction for internal users; PIM with approval provides time-bound, approved administrative access to Azure resources; and Microsoft Entra ID Protection (included with Entra ID P2) detects sign-in risk and enables automatic remediation via risk-based Conditional Access. Option A is wrong because Security defaults cannot enforce the granular legacy-auth blocking, trusted-location MFA exclusions, or risk-based remediation required here, and it does not scope MFA by network location. Option B is wrong because it omits blocking legacy authentication and omits approval for PIM activation, and device compliance alone does not meet the MFA-from-outside requirement. Option C is wrong because it explicitly allows legacy authentication for service accounts and uses PIM without approval, violating two requirements.

Answer

Enable Security defaults for all users and configure risk-based Conditional Access policies for admin roles. Use PIM for time-bound access.

Answer

Configure device compliance policies in Intune and require compliant devices for access. Use PIM with time-bound roles but without approval. Enable Identity Protection for risk detection.

Answer

Create a Conditional Access policy to require MFA for all cloud apps and allow legacy authentication for non-interactive service accounts. Use PIM without approval for admin roles.

Question 9

Refer to the exhibit. You are configuring network access for an Azure Storage account. After applying this configuration, users report that they cannot access the storage account from their on-premises network (public IP: 198.51.100.50). What is the most likely reason?

Accepted Answer

The user's public IP address is not in the allowed IP rules. The correct answer is D: the user's public IP address is not in the allowed IP rules. When an Azure Storage account firewall is configured with selected networks, only traffic from explicitly listed public IP addresses (or ranges) and permitted virtual networks is allowed; since the on-premises public IP 198.51.100.50 is not included in the allowed IP rules, requests are denied. Option A is not the likely cause because a private endpoint would affect access over the private link rather than simply blocking an on-premises public IP, and the scenario points to firewall IP filtering. Option B is incorrect because the AzureServices bypass applies to trusted Microsoft services, not to on-premises clients. Option C is incorrect because missing virtual network rules would not matter for an on-premises client connecting over the public internet.

Answer

The storage account is configured with a private endpoint

Answer

The bypass for AzureServices is not configured correctly

Answer

The virtual network rules are missing

Question 10

Your organization runs a critical application on an Azure VM that generates sensitive data. You need to ensure that only approved applications can execute on the VM to prevent malware. You have Microsoft Defender for Cloud enabled with the Defender for Servers plan P2. Which feature provides application control without requiring custom rules?

Accepted Answer

Enable Adaptive application controls in Defender for Cloud.. Adaptive application controls in Microsoft Defender for Cloud (option D) is the correct choice because, with the Defender for Servers P2 plan, it uses machine learning to automatically analyze VM behavior and create a baseline of approved applications, generating allowlist recommendations without requiring you to author custom rules. It then enforces these allowlists to block untrusted executables, directly meeting the requirement to prevent malware execution. AppLocker via Group Policy (A) also provides application control but requires manually defining and maintaining rules, so it does not fit the 'no custom rules' requirement. Just-in-time VM access (B) only restricts inbound network access to management ports and does not control which applications can execute. WDAC (C) is a valid application control mechanism, but it likewise requires you to create and manage policies rather than automatically generating them from Defender for Cloud's adaptive recommendations.

Answer

Configure AppLocker via Group Policy.

Answer

Enable Just-in-time VM access on the VM.

Answer

Enable Windows Defender Application Control (WDAC) on the VM.

Question 11

A company uses Azure Key Vault to store secrets. They want to grant developers the ability to read secrets, but only for specific secret names (e.g., 'App--ConnectionString'). They also want to use Azure RBAC instead of the Key Vault access policy model. Which RBAC role should they assign, and at which scope?

Accepted Answer

Assign the 'Key Vault Secrets User' role at the secret scope. The 'Key Vault Secrets User' role, when assigned at the individual secret scope (e.g., /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vault}/secrets/{secretName}), grants read-only access to that specific secret. This satisfies the requirement to use Azure RBAC (instead of the legacy access policy model) and to limit developers to reading only secrets with a specific name, such as 'App--ConnectionString'.

Answer

Assign the 'Key Vault Secrets User' role at the vault scope

Answer

Assign the 'Key Vault Reader' role at the secret scope

Answer

Assign the 'Key Vault Secrets Officer' role at the secret scope

Question 12

Your company uses Azure SQL Database to store customer data. You need to ensure that database administrators cannot access sensitive columns (e.g., credit card numbers) even during maintenance. What should you implement?

Accepted Answer

Always Encrypted. Always Encrypted ensures that sensitive columns like credit card numbers are encrypted at all times — both at rest and in transit — and that the encryption keys are never revealed to the database engine. This means database administrators (DBAs) cannot decrypt the data even during maintenance, because the decryption happens only on the client side. This directly meets the requirement to prevent DBA access to sensitive columns.

Answer

Transparent Data Encryption

Answer

Dynamic Data Masking

Answer

Row-level security

Question 13

You are a security engineer for Contoso Ltd. The company has a hybrid environment with Azure VMs and on-premises servers running Windows Server 2022. You have enabled Microsoft Defender for Cloud's multi-cloud posture management for AWS and GCP. Recently, you deployed Microsoft Sentinel in a Log Analytics workspace named 'ContosoWorkspace'. The security team needs to centralize security alerts from all sources: Azure, on-premises, AWS, and GCP. They also require automated investigation and response for common threats. Specifically, they want to automatically disable a compromised user account when a high-severity alert is generated. You have configured data connectors for Azure Activity, Microsoft Entra ID, and AWS CloudTrail. For on-premises servers, you installed the Azure Monitor Agent (AMA) and enabled Defender for Cloud's plan for servers. For GCP, you are using the GCP Security Command Center connector. The team needs to create a playbook that runs when a high-severity alert from any source is triggered. The playbook should disable the user account in Microsoft Entra ID. You have created a playbook using Azure Logic Apps and granted it the necessary permissions. Which step should you take to ensure the playbook runs automatically when alerts are generated?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.. The correct option is A: create an automation rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created. Automation rules in Microsoft Sentinel are the native mechanism for automatically invoking playbooks (Logic Apps) in response to incidents or alerts, and they can filter by severity so the playbook runs only for high-severity alerts. Option B is wrong because automation rules in Microsoft Defender for Cloud govern Defender for Cloud alerts and cannot directly trigger a Sentinel playbook for alerts from all connected sources. Option C is wrong because analytics rules generate alerts/incidents from ingested data; they do not trigger playbooks. Option D is wrong because a scheduled Logic App polling Sentinel would not provide the required automatic, event-driven response when an alert is generated.

Answer

Create an automation rule in Microsoft Defender for Cloud that triggers the playbook when a high-severity alert is generated.

Answer

Create an analytics rule in Microsoft Sentinel that triggers the playbook when a high-severity alert is created.

Answer

Configure the Logic App to run on a schedule and query Sentinel for high-severity alerts.

Question 14

Which TWO of the following are valid data sources for Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select two.)

Accepted Answer

Microsoft Entra ID sign-in logs.. Microsoft Sentinel UEBA is designed to ingest identity-centric telemetry, and Microsoft Entra ID sign-in logs (option A) are a core data source because they provide the authentication events (user, application, IP, location, device, risk level) that UEBA uses to build behavioral baselines and detect anomalous sign-in activity. Microsoft Entra ID audit logs (option B) are also a valid UEBA source, since they record directory-level changes such as user, group, role, and application modifications that feed entity behavior profiling and help correlate administrative actions with other activity. Options C, D, and E are not among the documented UEBA data sources: Azure SQL Database audit logs, Azure Activity Logs, and Azure Firewall logs are resource/network telemetry that can be collected into Sentinel for analytics, but they are not identity behavior sources used by the UEBA engine.

Answer

Azure SQL Database audit logs.

Answer

Azure Activity Logs.

Answer

Azure Firewall logs.

Question 15

Your company uses Microsoft Entra ID (P2 licensed) and requires that all user logins from untrusted networks be blocked unless the user's device is marked as compliant by Microsoft Intune. You need to implement this requirement. Which TWO components should you use together to achieve this? (Choose two.)

Accepted Answer

Conditional Access policy with device compliance condition. Option C is correct because a Conditional Access policy is the mechanism in Microsoft Entra ID that enforces access decisions at sign-in; you configure it with conditions (for example, 'All locations' or 'Any location' excluding trusted named locations) and grant controls requiring a compliant device, so logins from untrusted networks are blocked unless the device meets the compliance requirement. Option D is correct because Microsoft Intune Device Compliance policy defines what 'compliant' actually means (for example, BitLocker enabled, minimum OS version, Defender/antivirus active, no jailbreak/root), and it sets the device's compliance state in Entra ID that the Conditional Access policy evaluates. Together, the Intune compliance policy produces the device compliance signal and the Conditional Access policy consumes it to block non-compliant devices from untrusted networks. Option A (PIM) is for just-in-time privileged role activation and approval, not for device-based sign-in blocking. Option B (Identity Protection) detects and responds to risky users/sign-ins but does not itself enforce device compliance. Option E (Access Reviews) is for periodic attestation of group, role, or application access, not for real-time conditional access enforcement.

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Access Reviews