AZ-500 Practice Test 34 — 15 Questions

Question 1

A security analyst uses Microsoft Sentinel. They have created a playbook that tags Azure VMs as 'isolated' when a high-severity malware alert is triggered. They want this playbook to run automatically whenever a related alert is generated. Which feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rule.. Automation rules in Microsoft Sentinel allow you to define triggers that automatically run playbooks when specific alerts or incidents are created. In this scenario, the playbook tags Azure VMs as 'isolated' upon a high-severity malware alert, and an automation rule can be configured to run that playbook automatically whenever such an alert is generated, without manual intervention.

Answer

Scheduled analytics rule.

Answer

Incident creation rule.

Answer

Workbook.

Question 2

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

Accepted Answer

Create a playbook in Microsoft Sentinel with a Logic Apps connector to Microsoft Entra ID.. Microsoft Sentinel can use playbooks, which are automated workflows built on Azure Logic Apps, to respond to security alerts. By creating a playbook triggered by a Sentinel alert, you can use the Microsoft Entra ID connector to automatically disable a compromised user account, providing a direct and integrated remediation action.

Answer

Configure an Azure Policy that disables the user account.

Answer

Use Microsoft Defender for Cloud to automatically disable the account.

Answer

Create a Power Automate flow triggered by the Sentinel alert.

Question 3

A company has a hub-spoke network topology in Azure. The spoke virtual networks contain Azure virtual machines that need to access the internet. The security team requires that all outbound internet traffic from the spoke VMs passes through the Azure Firewall deployed in the hub virtual network for inspection and logging. Which configuration should be implemented to ensure this traffic is routed through the firewall?

Accepted Answer

Create a user-defined route (UDR) in the spoke subnet with 0.0.0.0/0 pointing to the private IP of the Azure Firewall.. A user-defined route (UDR) with the 0.0.0.0/0 prefix and the next hop set to the private IP address of the Azure Firewall forces all outbound internet traffic from the spoke subnet to be routed through the firewall in the hub. This ensures the traffic passes through the firewall for inspection and logging, as required by the security team.

Answer

Configure an Azure Load Balancer in the hub to distribute traffic from spokes to the firewall.

Answer

Use Azure Firewall Manager to automatically enforce a global default route on all spokes. This is the only configuration needed.

Answer

Enable IP forwarding on the NICs of the spoke VMs so they forward traffic to the firewall.

Question 4

A security team uses Microsoft Sentinel. They have created a playbook in Azure Logic Apps that automatically isolates a compromised VM by modifying a network security group. They want the playbook to run automatically whenever an incident of type 'VM Isolation' is created. Which Microsoft Sentinel feature should they use to trigger the playbook automatically?

Accepted Answer

Automation rules.. Automation rules in Microsoft Sentinel are designed to trigger automated responses, such as running a playbook, when an incident is created or updated. In this scenario, the rule can be configured to match incidents of type 'VM Isolation' and automatically execute the Logic Apps playbook to isolate the compromised VM. This is the correct feature for incident-triggered automation without requiring a separate analytics rule.

Answer

Scheduled analytics rules.

Answer

Fusion rules.

Answer

Workbooks.

Question 5

A company has two Azure virtual networks, VNet-A and VNet-B, connected via VNet peering. They want all traffic between the VNets to be inspected by a network virtual appliance (NVA) deployed in a subnet in VNet-A. They have configured a user-defined route (UDR) on the subnet in VNet-B that points the destination address space of VNet-A to the private IP of the NVA. However, traffic between the VNets is still not passing through the NVA. What is the most likely cause?

Accepted Answer

The NVA's network interface (NIC) does not have IP forwarding enabled.. The most likely cause is that the NVA's network interface (NIC) does not have IP forwarding enabled. Even with a correctly configured UDR on VNet-B pointing traffic to the NVA's private IP, the NVA will drop any traffic not destined for its own IP unless IP forwarding is enabled on its NIC. This setting allows the NVA to accept packets with a destination other than itself and forward them based on its routing table, which is essential for traffic inspection scenarios.

Answer

The UDR is not associated with the subnet in VNet-B.

Answer

The VNet peering connection is not in a 'Connected' state.

Answer

The NVA is deployed in the same subnet as the source VMs.

Question 6

A company has an Azure SQL Database with a private endpoint connection. The database is accessed from on-premises via ExpressRoute and from other Azure virtual networks (VNets) via VNet peering. The security team wants to ensure that all queries from both on-premises and peered VNets go through the private endpoint and NEVER use the public endpoint, even as a fallback. Which additional configuration is required to enforce this?

Accepted Answer

Disable public network access on the Azure SQL server.. Disabling public network access on the Azure SQL server explicitly blocks all traffic that does not originate from a private endpoint. This setting ensures that even if a client attempts to connect using the public endpoint (e.g., via a misconfigured connection string or DNS resolution fallback), the server will reject the connection. This is the only configuration that enforces the requirement that all queries—from on-premises via ExpressRoute or from peered VNets—must go through the private endpoint and never use the public endpoint.

Answer

Configure a Network Security Group (NSG) on the subnet hosting the private endpoint to deny outbound traffic to the public endpoint's IP addresses.

Answer

Enable Azure SQL Auditing and configure a log analytics workspace to monitor for public endpoint calls, then manually block them.

Answer

Configure a service endpoint for Azure SQL on the VNet and associate a firewall rule allowing only the VNet traffic.

Question 7

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?

Accepted Answer

Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.. In Microsoft Entra ID PIM, the 'Maximum activation duration' setting in role settings controls the time window within which an approval must be granted. If the approver does not respond within that duration, the activation request is denied. By setting this to 30 minutes, requiring approval, and adding the user's manager as an approver, you ensure the manager must approve within 30 minutes or the activation is automatically denied. This directly meets the requirement.

Answer

Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.

Answer

Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.

Answer

Configure the role settings to require approval and set the approval timeout to 0 minutes.

Question 8

Your company deploys Microsoft Sentinel for security operations. You need to configure just-in-time (JIT) access for Azure VMs. Which Azure security feature should you integrate with Sentinel?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides the just-in-time (JIT) VM access capability, which can be integrated with Microsoft Sentinel to enable automated threat response. When a security incident is detected in Sentinel, a playbook can trigger Defender for Cloud to lock down or open specific ports (e.g., RDP 3389, SSH 22) for a defined time window, reducing the attack surface. This integration relies on the Defender for Cloud's JIT policy applied at the subscription or VM level, not on external network controls or identity governance.

Answer

Azure Policy

Answer

Azure Firewall

Answer

Microsoft Entra Privileged Identity Management

Question 9

You need to block outbound internet access from all VMs in a VNet except for specific allowed destinations (e.g., Microsoft updates). You cannot use a third-party NVA. Which Azure service should you use to meet this requirement?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that can filter outbound traffic from VMs in a VNet based on fully qualified domain names (FQDNs), IP addresses, and port/protocol rules. It supports application rules (e.g., allow *.update.microsoft.com) and network rules, enabling you to block all outbound internet access except for specific allowed destinations like Microsoft Updates. Unlike NSGs, Azure Firewall provides stateful inspection and centralized logging, making it the correct choice for this requirement without a third-party NVA.

Answer

Azure Bastion

Answer

Network Security Groups (NSGs)

Answer

Azure Virtual Network NAT

Question 10

A company uses Microsoft Defender for Cloud to manage security posture. The security team wants to receive alerts when a virtual machine has a vulnerability rated as 'Critical' by the integrated vulnerability assessment solution. Which Defender for Cloud plan must be enabled for the subscription to receive these alerts?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment solution that automatically scans VMs and generates security alerts for critical vulnerabilities. Plan 1 only provides basic threat detection and does not include the vulnerability assessment engine or the corresponding alerting capability.

Answer

Defender for Servers Plan 1

Answer

Defender for Storage

Answer

Defender for Databases

Question 11

A company has an Azure Storage account with infrastructure encryption enabled. They configure the storage account to use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. Despite this configuration, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

The storage account's encryption type is set to Microsoft-managed keys. The storage account's encryption type must be explicitly set to 'Customer-managed keys' to use CMK from Azure Key Vault. If the encryption type remains at the default 'Microsoft-managed keys', newly uploaded blobs will continue to be encrypted with Microsoft-managed keys regardless of the CMK configuration in Key Vault. Infrastructure encryption is a separate feature that encrypts data at the hardware level and does not affect the key management type.

Answer

The storage account was created before infrastructure encryption was generally available

Answer

The customer-managed key in Key Vault is disabled or expired

Answer

The blob container has a policy that overrides the encryption setting

Question 12

You are the security administrator for a company that uses Microsoft Entra ID. You need to configure a Conditional Access policy that applies to all users except the emergency break-glass accounts. The policy must require multi-factor authentication (MFA) when accessing the Azure portal from a location that is not trusted. What should you include in the policy?

Accepted Answer

Include all users, exclude break-glass accounts, require MFA for Azure portal, and use 'Locations' condition to specify untrusted locations. It includes all users, excludes the emergency break-glass accounts to ensure they remain accessible during outages, requires MFA for the Azure portal, and uses the 'Locations' condition to target untrusted locations. This configuration aligns with the requirement to enforce MFA only when accessing Azure portal from untrusted locations, while preserving access for break-glass accounts.

Answer

Include all users, require MFA for Azure portal, and exclude all administrators

Answer

Include break-glass accounts, require MFA for Azure portal, and block access from untrusted locations

Answer

Include all users, require MFA for Azure portal, and exclude break-glass accounts

Question 13

You are designing a secure network architecture for a three-tier application. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. Which Azure service should you use to isolate the tiers most securely?

Accepted Answer

Network security groups (NSGs) on subnets. Network security groups (NSGs) on subnets are the correct choice because they provide stateful, layer-3/layer-4 traffic filtering at the subnet level, allowing you to explicitly deny all inbound traffic to the application and database subnets except from the web tier's subnet or private IP range. This creates a micro-segmentation boundary that enforces the principle of least privilege without introducing additional latency or routing complexity.

Answer

Azure Firewall with application rules

Answer

Azure Front Door with Web Application Firewall

Answer

VNet peering between tiers

Question 14

You are securing an Azure Kubernetes Service (AKS) cluster. You need to restrict network traffic between pods and to external services using Azure network policies. Which three of the following options are valid considerations or steps? (Choose three.)

Accepted Answer

Define Kubernetes NetworkPolicy objects that use selectors to allow or deny traffic between pods.. Azure Network Policy Manager (Azure NPM) is a required add-on for enforcing Kubernetes NetworkPolicy objects in an AKS cluster. It translates Kubernetes network policies into Azure-specific configurations to filter pod-to-pod traffic. Without enabling Azure NPM (or an alternative like Calico), standard Kubernetes NetworkPolicy objects will not be enforced by Azure.

Answer

Assign public IP addresses to each pod for direct internet access without a load balancer.

Answer

Set the AKS cluster to use Calico network policies instead of Azure NPM for better performance.

Answer

Configure an NSG directly on the AKS node subnet to filter pod-to-pod traffic.

Question 15

Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?

Accepted Answer

Assign the initiative as an Azure Policy at the management group scope.. Assigning the initiative as an Azure Policy at the management group scope is the correct approach because Azure Policy can be applied at the management group, subscription, or resource group level, and it will be inherited by all child subscriptions. This ensures a consistent security policy across all subscriptions without manual per-subscription configuration. Microsoft Defender for Cloud uses Azure Policy initiatives (such as the Microsoft Cloud Security Benchmark) to enforce security controls, and assigning at the management group scope is the most efficient method for bulk compliance.

Answer

Use Azure Blueprints to define the initiative and assign it to the management group.

Answer

Create a custom RBAC role that includes the initiative and assign it to the management group.

Answer

Assign the initiative to each subscription individually using the Defender for Cloud interface.