AZ-500 Practice Test 35 — 15 Questions

Question 1

You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?

Accepted Answer

Use Azure Private Link to connect via a private endpoint. Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address from your on-premises network via ExpressRoute or VPN. This ensures traffic never traverses the public internet, meeting the requirement for secure, non-public connectivity.

Answer

Configure a firewall rule to allow the on-premises public IP address

Answer

Enable Always Encrypted on the database

Answer

Use a virtual network service endpoint for Azure SQL Database

Question 2

Traffic from a spoke VNet must reach the internet through a firewall in the hub VNet. What routing configuration is required on the spoke subnets?

Accepted Answer

A default route to the Azure Firewall private IP or virtual appliance next hop. To force spoke traffic to the internet through a firewall in the hub VNet, you must create a user-defined route (UDR) on the spoke subnet with an address prefix of 0.0.0.0/0 and a next hop of the Azure Firewall's private IP or the virtual appliance's IP. This overrides the default system route that would otherwise send internet-bound traffic directly out via Azure's edge, ensuring all egress traffic is inspected and controlled by the firewall.

Answer

A route to Internet with next hop Internet

Answer

An NSG deny rule for 0.0.0.0/0

Answer

A service endpoint policy

Question 3

A company uses Azure AD Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?

Accepted Answer

Activation settings. The 'Activation settings' in Microsoft Entra PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.

Answer

Notification settings

Answer

Approval settings

Answer

Assignment settings

Question 4

A company stores confidential data in Azure Blob Storage. They need to ensure that all data at rest is encrypted and they must be able to quickly rotate the encryption key on demand in case of a security breach. They also want to minimize administrative overhead. Which encryption option should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault. Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault allows the organization to control and rotate the encryption key on demand, meeting the security breach response requirement. This option encrypts data at rest in Azure Blob Storage while minimizing administrative overhead because Azure manages the encryption process, and the customer only manages the key lifecycle in Key Vault.

Answer

Server-side encryption with Microsoft-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 5

A company uses Azure SQL Database with Azure Active Directory authentication. To meet compliance requirements, they need to audit all failed login attempts and store the audit logs in a storage account located in a different Azure region for disaster recovery. What should they configure?

Accepted Answer

Enable SQL Auditing and set the destination to an Azure Storage account in a different region.. Azure SQL Database auditing can be configured to write audit logs directly to an Azure Storage account. Storing the logs in a storage account located in a different Azure region meets the disaster recovery requirement by ensuring logs survive a regional outage. The audit logs capture all database events, including failed login attempts, which satisfies the compliance need.

Answer

Enable SQL Auditing and set the destination to a Log Analytics workspace in a different region.

Answer

Enable SQL Auditing and set the destination to an Event Hub namespace in the same region.

Answer

Enable Advanced Threat Protection for Azure SQL Database and configure email notifications.

Question 6

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that activation of this role must be approved by a designated group of security engineers before it becomes active. Which PIM role setting should they configure?

Accepted Answer

Require approval. Microsoft Entra PIM's 'Require approval' setting enforces that a designated group of approvers must authorize each activation request before the role becomes active. This directly meets the requirement for approval by security engineers, ensuring that role activation is gated by explicit consent rather than being automatic.

Answer

Activation maximum duration (hours)

Answer

MFA on activation

Answer

Require justification on activation

Question 7

Your company uses Microsoft Entra ID. You need to block sign-ins from countries where your company does not operate. Which approach should you use?

Accepted Answer

Create a Conditional Access policy to block access from those countries. The correct option is B: create a Conditional Access policy to block access from those countries. Conditional Access is the Microsoft Entra ID feature designed to enforce sign-in decisions based on conditions such as location, and a policy can be scoped to all users and cloud apps with a Block grant control, using a Named location that defines the countries to exclude or block. Option D is only a building block—Named locations merely define geographic IP ranges and do not by themselves block anything. Option A (MFA for all users) adds an authentication requirement but does not prevent sign-ins from specific countries, and Option C (Identity Protection user risk policy) responds to risky user behavior, not geographic origin.

Answer

Configure MFA for all users

Answer

Use Identity Protection user risk policy

Answer

Add those countries as Named locations

Question 8

A company has an Azure virtual network with two subnets: Frontend and Backend. They deploy a network virtual appliance (NVA) in a subnet named NVA_Subnet. They want to route all traffic from the Frontend subnet to the Backend subnet through the NVA for inspection. What is the minimum number of route tables required to achieve this traffic steering?

Accepted Answer

1. A single route table can be associated with the Frontend subnet and configured with a user-defined route (UDR) that has the NVA's private IP as the next hop for traffic destined to the Backend subnet. This ensures all traffic from Frontend to Backend is forwarded to the NVA for inspection. No additional route tables are needed because the NVA itself handles the routing decision after inspection, and the Backend subnet does not require a specific route to return traffic unless asymmetric routing is a concern.

Answer

2

Answer

3

Answer

4

Question 9

A security team uses Microsoft Defender for Cloud. They want to ensure that all Azure virtual machines have the guest configuration extension installed to apply a security baseline automatically. They need to remediate non-compliant VMs without manual intervention. Which Defender for Cloud feature should be configured?

Accepted Answer

Assign a security policy (built-in initiative) that includes a policy with DeployIfNotExists effect. The guest configuration extension is deployed automatically via a DeployIfNotExists policy effect within a built-in initiative (such as the Azure Security Benchmark). This effect evaluates VMs for the extension and, if missing, deploys it without manual intervention, ensuring the security baseline is applied. Defender for Cloud uses this policy-driven approach to remediate non-compliant resources at scale.

Answer

Enable automatic provisioning of the Log Analytics agent

Answer

Create an Automation rule that triggers a runbook when a recommendation appears

Answer

Configure a workflow automation scheduled task

Question 10

Security analysts in your company use Microsoft Sentinel to manage incidents. They want to automatically assign any incident with a severity of 'High' or 'Critical' to the senior analyst on duty. Which Microsoft Sentinel feature should they configure to accomplish this?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions such as severity. By creating an automation rule that triggers when an incident is created with a severity of 'High' or 'Critical', you can set the owner to the senior analyst on duty, fulfilling the requirement without manual intervention.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 11

Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?

Accepted Answer

Use Azure AD authentication with managed identities. Microsoft Entra ID authentication with managed identities allows applications to authenticate to Azure Storage without using shared keys or SAS tokens. Managed identities provide an automatically managed identity in Microsoft Entra ID, enabling applications to use OAuth 2.0 tokens for secure access to storage accounts. This approach eliminates the need for any shared secrets or keys, meeting the requirement exactly.

Answer

Use a stored access policy with a shared access signature

Answer

Configure a firewall on the storage account to allow only the application's IP address

Answer

Enable a private endpoint for the storage account

Question 12

A security operations team uses Microsoft Sentinel. They want to automatically assign incidents to different tiers of analysts based on severity when incidents are created. Which feature should they configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on criteria such as severity. When an incident is created, the automation rule triggers and can set the owner (assignee) to a predefined user or group, enabling tiered assignment without manual intervention.

Answer

Fusion - Advanced Multistage Attack Detection

Answer

Analytics rules with scheduled queries

Answer

Playbooks

Question 13

You have an Azure application that uses a private endpoint for Azure SQL Database. Users report intermittent connectivity failures. You need to diagnose whether the private endpoint DNS resolution is working correctly. Which tool should you use?

Accepted Answer

nslookup. When using a private endpoint for Azure SQL Database, connectivity relies on DNS resolution returning the private IP address of the endpoint rather than the public IP. `nslookup` queries the DNS server directly and shows the resolved IP address, allowing you to verify that the private endpoint's private IP is being returned. If it returns the public IP or fails, DNS configuration is incorrect.

Answer

tracert

Answer

netstat

Answer

ping

Question 14

An analyst investigates a Defender for Cloud alert for suspicious process execution on a VM. Which next step best preserves evidence while enabling deeper endpoint investigation?

Accepted Answer

Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required. Pivoting to the Microsoft Defender for Endpoint device timeline allows the analyst to investigate the suspicious process execution in a forensically sound manner without disrupting the live environment. Isolating the device from the network, if needed, contains the threat while preserving volatile evidence such as running processes, memory, and registry state. This approach aligns with incident response best practices and leverages Defender for Endpoint's deep endpoint visibility.

Answer

Delete the VM immediately to stop the process

Answer

Disable all analytics rules in Sentinel

Answer

Rotate every subscription key before reviewing the process tree

Question 15

Your organization uses Microsoft Entra ID to manage identities. You need to ensure that users can reset their own passwords without help desk intervention, but they must register for self-service password reset (SSPR) first. Which configuration is required?

Accepted Answer

Enable SSPR and set the registration campaign to require registration at next sign-in. Enabling SSPR and configuring the registration campaign to require registration at next sign-in ensures users must register for SSPR before they can reset their own passwords. This satisfies the requirement that users register first, and the registration campaign enforces this without requiring help desk intervention.

Answer

Configure Microsoft Entra Password Protection

Answer

Enable Privileged Identity Management for SSPR

Answer

Enable combined registration for SSPR and Microsoft Entra ID Protection