AZ-500 Practice Test 36 — 15 Questions

Question 1

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 2

Which TWO are features of Microsoft Defender for Cloud's workload protection for Azure SQL databases? (Select two.)

Accepted Answer

Advanced threat protection (ATP). Option D (Advanced threat protection/ATP) is correct because Microsoft Defender for Cloud's workload protection for Azure SQL databases includes Defender for SQL's advanced threat protection, which detects anomalous activities such as potential SQL injection, brute-force attempts, and unusual access patterns, and raises security alerts. Option E (Vulnerability assessment) is correct because Defender for SQL provides a built-in vulnerability assessment that scans Azure SQL databases for misconfigurations, missing security updates, and other weaknesses, with findings surfaced in Defender for Cloud. Option A (File integrity monitoring) is not correct here because FIM applies to files and registry keys on servers/VMs (via Defender for Servers/Log Analytics), not to Azure SQL database workload protection. Option B (Adaptive network hardening) is not correct because it is a Defender for Cloud feature for virtual machines that analyzes network security group rules and traffic patterns, not a SQL database protection feature. Option C (Just-in-time VM access) is not correct because JIT VM access is a Defender for Servers capability that locks down management ports on VMs, not an Azure SQL database workload protection feature.

Answer

File integrity monitoring (FIM)

Answer

Adaptive network hardening

Answer

Just-in-time VM access

Question 3

A company has an Azure virtual network with a single subnet that hosts web servers. The security team needs to allow inbound HTTPS traffic from the internet to the web servers, but block all other inbound traffic. They want to use a single Azure resource to accomplish this at the subnet level. Which resource should they configure?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) is the correct resource because it can be associated with a subnet to filter inbound traffic at Layer 3/4. By creating a rule that allows TCP port 443 (HTTPS) from the Internet service tag and a default deny-all rule, the NSG blocks all other inbound traffic while permitting HTTPS. This meets the requirement of a single Azure resource operating at the subnet level.

Answer

Azure Firewall

Answer

Azure Front Door

Answer

Application Security Group (ASG)

Question 4

A company has an Azure virtual network with a subnet that hosts a web application. They want to allow inbound HTTPS traffic from any source on the internet (0.0.0.0/0) and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required to achieve this?

Accepted Answer

One inbound rule allowing HTTPS from Internet.. An NSG includes a set of default security rules that already block all inbound traffic not explicitly allowed. By adding a single inbound rule that allows HTTPS (TCP port 443) from the Internet (0.0.0.0/0), the default deny rule (DenyAllInbound) will block all other inbound traffic. Therefore, only one custom inbound rule is required to achieve the stated goal.

Answer

One inbound rule allowing HTTPS from Internet, and one inbound rule DenyAllInbound.

Answer

Two inbound rules: one allowing HTTPS from Internet, one allowing HTTP from Internet.

Answer

Two inbound rules: one allowing HTTPS from Internet, one allowing RDP from Internet.

Question 5

A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?

Accepted Answer

The route table is not associated with the spoke subnet.. The most likely reason is that the route table containing the default route (0.0.0.0/0) pointing to the Azure Firewall private IP has not been associated with the spoke subnet. Without this association, the subnet continues to use system routes, which include a default route to the internet via the Azure default gateway, allowing traffic to bypass the firewall. Associating the route table with the subnet is a required step to override the system default route.

Answer

Azure Firewall is not configured with DNAT rules for outbound traffic.

Answer

The spoke VNet peering does not allow gateway transit.

Answer

The route table has a higher priority than system routes.

Question 6

A company has a virtual network with a subnet hosting Azure VMs. They want to restrict all inbound traffic to only allow HTTPS (port 443) from the internet, but also allow SSH (port 22) only from a specific management IP address range (e.g., 203.0.113.0/24). Which Azure service should they use to achieve this filtering?

Accepted Answer

Network Security Group (NSG) rule. A Network Security Group (NSG) rule is the correct choice because NSGs provide stateful, granular inbound and outbound filtering at the subnet or NIC level. You can create a rule to allow HTTPS (TCP/443) from any source (Internet) and a separate rule to allow SSH (TCP/22) only from the specific management IP range 203.0.113.0/24, while implicitly denying all other inbound traffic. NSGs are the native Azure service for this type of traffic filtering and do not require additional cost or deployment.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Azure Bastion

Question 7

Refer to the exhibit. You assign this policy to a subscription that already has a security contact configured with email 'admin@contoso.com'. What will be the outcome?

Accepted Answer

The policy will not modify the existing security contact because it already exists.. The Azure Policy definition shown uses the 'DeployIfNotExists' effect, which only deploys a resource (in this case, a security contact) if it does not already exist. Since the subscription already has a security contact configured with email 'admin@contoso.com', the policy will detect its presence and skip the deployment, leaving the existing contact unchanged. This behavior is by design to avoid overwriting existing configurations that may have been set manually or by other processes.

Answer

The policy will fail because the security contact already exists.

Answer

The subscription will become non-compliant because the email does not match.

Answer

The policy will overwrite the existing security contact with the one in the policy.

Question 8

A company has an Azure virtual network with multiple subnets. They want to centrally inspect and log all outbound traffic to the internet. They also need to allow or deny traffic based on domain names (FQDNs). Which Azure resource should they deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It supports application rules based on fully qualified domain names (FQDNs), enabling allow or deny decisions for outbound traffic to the internet using Layer 7 (application layer) filtering, which meets both requirements directly.

Answer

Network Virtual Appliance (NVA) from Azure Marketplace

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Network Security Groups (NSGs)

Question 9

Drag and drop the steps to assign an Azure RBAC role to a user at the resource group scope into the correct order.

Accepted Answer

Navigate to the resource group, then open Access control (IAM), then add a role assignment, then select a role, then select a user, then review and assign.. IAM is used for RBAC, and you add a role assignment by selecting the role and assigning it to a user.

Answer

Select a role, then navigate to the resource group, then open Access control (IAM), then add a role assignment, then select a user, then review and assign.

Answer

Select a user, then navigate to the resource group, then open Access control (IAM), then add a role assignment, then select a role, then review and assign.

Answer

Navigate to the subscription, then open Access control (IAM), then add a role assignment, then select a role, then select a user, then review and assign.

Question 10

An organization uses Microsoft Defender for Cloud. They want to implement just-in-time (JIT) VM access for a set of production VMs. However, the security team needs to ensure that JIT access requests are always approved by a manager before opening ports. Which configuration should they use?

Accepted Answer

Enable JIT and configure a custom workflow automation with an approval step. Microsoft Defender for Cloud's JIT VM access can be integrated with a custom workflow automation that includes an approval step. This allows the security team to enforce manager approval before ports are opened, meeting the requirement for a formal approval process. The workflow automation can trigger an Azure Logic App or other action that requires a designated approver to authorize the request.

Answer

Enable JIT in Defender for Cloud and configure a logic app to send approval emails

Answer

Use Azure AD Privileged Identity Management (PIM) for JIT activation

Answer

Use Conditional Access with session controls

Question 11

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory. Which two data connectors are necessary to collect sign-in logs and audit logs?

Accepted Answer

Azure Active Directory Sign-in logs and Azure Active Directory Audit logs. To collect sign-in logs and audit logs in Microsoft Sentinel, you need the Microsoft Entra ID Sign-in logs connector for sign-in activity and the Microsoft Entra ID Audit logs connector for directory changes and user management events. These two connectors directly correspond to the two log categories required by the question.

Answer

Azure Activity and Azure Active Directory Audit logs

Answer

Office 365 and Azure Active Directory Sign-in logs

Answer

Security Events and Azure Active Directory Sign-in logs

Question 12

A company uses Azure AD Conditional Access. They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but only when the sign-in risk level is medium or above. Which configuration should they use in the Conditional Access policy?

Accepted Answer

Assignments > Cloud apps > Include > Microsoft Azure Management, Conditions > Sign-in risk > Medium and above, Grant > Require MFA.. It specifically targets the Azure portal via 'Microsoft Azure Management' in Cloud apps, sets the sign-in risk condition to 'Medium and above', and requires MFA. This matches the requirement exactly: MFA is triggered only when accessing the Azure portal and the sign-in risk level is medium or higher.

Answer

Assignments > Users > All users, Cloud apps > All cloud apps, Conditions > User risk > Medium, Grant > Require MFA.

Answer

Assignments > Conditions > Locations > All trusted locations, Grant > Require MFA.

Answer

Assignments > Cloud apps > Include > All cloud apps, Conditions > Device platforms > iOS, Grant > Require MFA.

Question 13

You are configuring Azure Private Link for a SQL Database. You want to ensure that all traffic from your virtual network to the SQL Database stays within the Microsoft Azure backbone network. What is the primary benefit of using Azure Private Link over a service endpoint?

Accepted Answer

Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.. Azure Private Link exposes the SQL Database as a private endpoint within your virtual network, assigning it a private IP address from your VNet's address space. This ensures that all traffic to the database stays on the Microsoft backbone network and never traverses the public internet, which is the primary benefit over a service endpoint. Service endpoints still route traffic to the public endpoint of the SQL Database, even though the source traffic originates from the VNet.

Answer

Private Link provides higher throughput than service endpoints.

Answer

Private Link enables access to the SQL Database from on-premises via VPN/ExpressRoute without traversing the internet.

Answer

Private Link allows you to use NSGs to filter traffic to the SQL Database.

Question 14

A company has an Azure virtual network with a subnet hosting web servers. The security policy requires that all inbound HTTP traffic must be sourced from a specific IP address range (203.0.113.0/24). All other inbound traffic must be denied. The subnet is associated with a network security group (NSG). Which set of inbound rules should they configure?

Accepted Answer

Allow HTTP from 203.0.113.0/24 (priority 100), then Deny all inbound (priority 200). NSG rules are evaluated in priority order (lowest number first). The Allow rule for HTTP from 203.0.113.0/24 at priority 100 permits the desired traffic, and the subsequent Deny all inbound rule at priority 200 blocks all other traffic, including HTTP from any other source. This satisfies the security policy of allowing only HTTP from the specified IP range and denying everything else.

Answer

Deny all inbound (priority 100), then Allow HTTP from 203.0.113.0/24 (priority 200)

Answer

Allow HTTP from any (priority 100), then Deny all inbound (priority 200)

Answer

Only Allow HTTP from 203.0.113.0/24 (priority 100) with no explicit deny

Question 15

A security team uses Microsoft Defender for Cloud to protect Azure virtual machines. They want to implement application allowlisting to prevent execution of unauthorized software on a set of Windows Server VMs. They need to create a baseline of allowed applications and then enforce the allowlist. Which Defender for Cloud feature should they enable?

Accepted Answer

Adaptive application controls. Adaptive application controls (AAC) in Microsoft Defender for Cloud is the correct feature because it specifically provides application allowlisting for Azure VMs. AAC uses machine learning to analyze processes running on a VM, generate a baseline of allowed applications, and then enforce that allowlist by blocking execution of any unauthorized software. This directly meets the requirement to create a baseline and enforce it on Windows Server VMs.

Answer

Just-in-time VM access

Answer

File integrity monitoring

Answer

Adaptive network hardening