AZ-500 Practice Test 37 — 15 Questions

Question 1

Your organization is using Azure Database for MySQL. You need to ensure that only traffic from Azure services and specific client IP addresses can connect to the database. What should you configure?

Accepted Answer

Firewall rules with 'Allow access to Azure services' enabled and specific IP rules. Azure Database for MySQL uses firewall rules to control access at the server level. Enabling 'Allow access to Azure services' permits connections from Azure internal IP ranges, while adding specific client IP rules restricts access to only those addresses. This dual configuration meets the requirement to allow traffic from Azure services and specific client IPs while blocking all other traffic.

Answer

Azure Active Directory authentication

Answer

Virtual Network service endpoints

Answer

Network Security Group (NSG) rules on the subnet

Question 2

A company wants to detect exposed internet-facing assets that are not yet known in its Azure inventory. Which Microsoft Defender capability is most relevant?

Accepted Answer

Defender External Attack Surface Management. Defender External Attack Surface Management (EASM) is specifically designed to discover and inventory internet-facing assets (e.g., domains, IPs, open ports, certificates) that are not yet known to an organization's Azure inventory. It continuously scans public attack surfaces to identify unknown or unmanaged resources, making it the most relevant capability for detecting exposed assets outside the current Azure footprint.

Answer

Defender for SQL vulnerability assessment

Answer

Microsoft Entra Permissions Management

Answer

Azure Monitor VM insights

Question 3

You need to block inbound traffic from the internet to a specific subnet except for TCP port 443. Which Azure service should you use?

Accepted Answer

Network security group (NSG). Network security groups (NSGs) are the correct choice because they provide stateful filtering of inbound and outbound traffic at the subnet or NIC level. By creating an inbound security rule that denies all traffic from the Internet (source 'Internet' service tag) and a higher-priority allow rule for TCP port 443, you can precisely block all inbound internet traffic except HTTPS. NSGs are the native Azure service for granular subnet-level access control lists (ACLs).

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Firewall

Answer

Azure DDoS Protection

Question 4

Your company uses Azure Firewall Premium with TLS inspection to filter outbound traffic from Azure VMs. Users report that some websites are not loading. You have configured the firewall to inspect traffic to *.microsoft.com. What is the most likely cause of the issue?

Accepted Answer

The client does not trust the certificate presented by the firewall during TLS inspection.. Azure Firewall Premium with TLS inspection acts as a man-in-the-middle (MITM) proxy. It decrypts outbound HTTPS traffic, inspects it, then re-encrypts it using a certificate signed by an internal CA. If the client VM does not trust the firewall's internal CA certificate (e.g., it is not installed in the Trusted Root Certification Authorities store), the browser will reject the connection, causing websites to fail to load even though the firewall rule is correctly configured.

Answer

The firewall rule for *.microsoft.com is misconfigured.

Answer

The firewall cannot inspect HTTPS traffic.

Answer

The firewall is blocking HTTP traffic.

Question 5

You need to provide secure remote access to Azure virtual machines for developers without exposing public IP addresses. The solution must authenticate users via Microsoft Entra ID and support multifactor authentication. Which service should you use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure RDP/SSH connectivity to Azure virtual machines directly from the Azure portal over TLS, without exposing public IP addresses. It integrates with Microsoft Entra ID for authentication and supports multifactor authentication (MFA) when combined with Conditional Access policies, meeting all requirements.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure Firewall

Question 6

A company has Azure AD with Premium P2 licenses. They want to enforce Azure Multi-Factor Authentication (MFA) for all users accessing the Azure portal from untrusted networks, but only after the user has successfully entered their password. Which Conditional Access grant control should they configure?

Accepted Answer

Require multi-factor authentication. The 'Require multi-factor authentication' grant control in Conditional Access enforces MFA after password authentication, which aligns with the requirement to prompt for MFA only after the user has successfully entered their password. This control is applied based on the condition of 'untrusted networks' (e.g., using the 'Locations' condition to target all locations except trusted IPs), ensuring that MFA is triggered specifically for Azure portal access from untrusted networks.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Answer

Require domain join

Question 7

You need to ensure that all new blobs uploaded to an Azure Storage account are automatically encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) on the storage account.. Azure Storage Service Encryption (SSE) automatically encrypts data at rest for all storage accounts using 256-bit AES encryption, and it is enabled by default for new storage accounts. This ensures that any new blobs uploaded are encrypted without requiring any application changes or additional configuration, making it the simplest solution.

Answer

Use Azure Disk Encryption on any VMs writing to storage.

Answer

Implement client-side encryption in the application.

Answer

Configure a customer-managed key in Azure Key Vault.

Question 8

You need to design a network security solution for a hub-spoke topology. The hub contains Azure Firewall and Azure Bastion. Spoke VNets contain application workloads. You need to ensure that all traffic from the spokes to the internet is routed through the Azure Firewall. What should you configure?

Accepted Answer

Add a user-defined route (UDR) on the spoke subnets with 0.0.0.0/0 next hop to the Azure Firewall private IP.. A user-defined route (UDR) with 0.0.0.0/0 and next hop set to the Azure Firewall's private IP forces all internet-bound traffic from spoke subnets to be routed through the firewall. This ensures traffic inspection and control by the firewall, which is a key requirement in a hub-spoke topology for centralized security.

Answer

Use service endpoints for internet-bound traffic.

Answer

Enable BGP on the spoke VNets and advertise a default route from the hub.

Answer

Configure the Azure Firewall to have a default route to the internet.

Question 9

Your security team wants to automatically detect and remediate misconfigurations in Azure Storage accounts, such as enabling public access. The solution should use Azure Policy and be centrally managed for multiple subscriptions. What should you configure?

Accepted Answer

Azure Policy with a custom initiative for storage security. Azure Policy with a custom initiative allows you to define a set of policies (e.g., 'Audit storage accounts with unrestricted public access') that can be assigned at a management group scope, covering multiple subscriptions. This enables automatic detection and remediation of misconfigurations like enabling public access, using built-in effects such as 'Deny' or 'DeployIfNotExists' to enforce compliance centrally.

Answer

Azure Blueprints

Answer

Azure Resource Graph

Answer

Microsoft Defender for Cloud (formerly Azure Security Center)

Question 10

A company uses Azure AD Privileged Identity Management (PIM) for Azure AD roles. They want to require that users must perform multi-factor authentication (MFA) when activating a role. Which PIM setting should they configure?

Accepted Answer

Require Azure AD Multi-Factor Authentication on activation. To enforce multi-factor authentication during role activation in Microsoft Entra Privileged Identity Management (PIM), you must configure the 'Require Microsoft Entra ID Multi-Factor Authentication on activation' setting. This ensures that before a user’s role assignment is activated, they must complete an MFA challenge, adding an extra layer of security against unauthorized access.

Answer

Require approval to activate

Answer

Require justification on activation

Answer

Require ticket information on activation

Question 11

You are designing a solution for Azure Blob Storage that must prevent data from being overwritten or deleted for a specified retention period. Which feature should you enable?

Accepted Answer

Immutable storage with time-based retention policy. Immutable storage with a time-based retention policy (WORM – Write Once, Read Many) is the correct feature because it explicitly prevents any user, including the storage account owner, from overwriting or deleting blobs until the retention period expires. This is enforced at the container level and overrides all other permissions, making it the only option that guarantees data cannot be altered or removed for a specified duration.

Answer

Blob versioning

Answer

Lifecycle management policies

Answer

Soft delete for blobs

Question 12

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

Accepted Answer

Set the activation maximum duration to 8 hours.. Setting the activation maximum duration to 8 hours enforces the time-bound requirement, ensuring that once a user activates the Global Administrator role, the activation automatically expires after 8 hours. Option B is correct because enabling the approval workflow and adding the manager as an approver ensures that the manager must approve each activation request, meeting the requirement for manager approval. Together, these two configurations satisfy both the time-bound and approval constraints.

Answer

Require multi-factor authentication on activation.

Answer

Require justification on activation.

Question 13

Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?

Accepted Answer

Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.. Enabling the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level automatically enables Advanced Threat Protection (ATP) for all existing and future Azure SQL databases within that subscription. This approach requires minimal administrative effort because it applies the protection globally without needing to configure each database individually or create custom policies. Microsoft Defender for Cloud manages the ATP settings centrally, ensuring consistent security coverage across the entire subscription.

Answer

Configure Microsoft Sentinel to monitor Azure SQL databases.

Answer

Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.

Answer

Enable Advanced Threat Protection on each Azure SQL database individually.

Question 14

A company has an Azure virtual network with a subnet that hosts a web application. They need to allow inbound HTTP (port 80) and HTTPS (port 443) traffic from a specific source IP range (203.0.113.0/24) to the web servers. Additionally, they need to allow inbound RDP (port 3389) traffic from a management subnet (10.0.1.0/24). They want to block all other inbound traffic. They are using a network security group (NSG) associated with the subnet. What is the minimum number of inbound security rules required?

Accepted Answer

3. (3 rules) because an NSG includes default rules that already block all inbound traffic by default. You only need explicit allow rules for the three permitted traffic types: HTTP (port 80) from 203.0.113.0/24, HTTPS (port 443) from 203.0.113.0/24, and RDP (port 3389) from 10.0.1.0/24. The default deny rule handles blocking all other traffic, so no additional deny rule is required.

Answer

4

Answer

5

Answer

2

Question 15

You have configured Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). You notice that sign-in logs for external guest users are not appearing in Sentinel. What is the most likely cause?

Accepted Answer

The diagnostic settings in Microsoft Entra ID are not configured to stream sign-in logs to the Log Analytics workspace used by Sentinel.. Microsoft Sentinel ingests Microsoft Entra ID (Entra ID) logs via diagnostic settings configured on the Entra ID tenant. These settings must explicitly stream sign-in logs (including guest user sign-ins) to a Log Analytics workspace. If the diagnostic settings are missing or misconfigured, no sign-in logs—including those for external guest users—will appear in Sentinel.

Answer

Microsoft Sentinel does not support ingestion of external guest user sign-in logs.

Answer

The Microsoft Sentinel Entra ID connector requires a separate connector for guest users.

Answer

Guest user sign-ins are not logged in Microsoft Entra ID.