AZ-500 Practice Test 39 — 15 Questions

Question 1

A company wants Defender for Cloud to automatically open a Logic App when a high-severity alert is generated for a subscription. Which feature should be configured?

Accepted Answer

Workflow automation. Workflow automation in Defender for Cloud allows you to trigger a Logic App automatically in response to specific security alerts, such as high-severity alerts. This feature uses Azure Event Grid to listen for alert creation events and invoke the Logic App via an HTTP trigger, enabling automated remediation or notification workflows without manual intervention.

Answer

Regulatory compliance dashboard

Answer

Secure score recommendation exemption

Answer

Continuous export

Question 2

A Sentinel watchlist contains high-value administrator accounts. Which KQL pattern best uses it in a detection rule?

Accepted Answer

Load the watchlist with _GetWatchlist() and join or filter SigninLogs by the account identifier. The `_GetWatchlist()` function in KQL allows you to dynamically load a Sentinel watchlist into a query. By joining or filtering `SigninLogs` against the watchlist's account identifier field, you can create a detection rule that triggers only when a high-value administrator account (defined in the watchlist) performs a sign-in, enabling precise, automated alerting without manual intervention.

Answer

Export the watchlist to CSV and manually compare it after alerts fire

Answer

Use the watchlist as a replacement for the SigninLogs table

Answer

Attach the watchlist to a workbook without changing the detection query

Question 3

A security team uses Microsoft Defender for Cloud. They have assigned a custom regulatory compliance initiative that includes policies to enforce encryption on storage accounts and SQL databases. They want to automatically remediate any non-compliant resources as soon as they are created, without manual intervention. Which feature should they configure?

Accepted Answer

Azure Policy with a 'DeployIfNotExists' effect. The 'DeployIfNotExists' effect in Azure Policy automatically deploys a resource (e.g., encryption configuration) when a non-compliant resource is created or updated, without manual intervention. This aligns with the requirement to remediate non-compliant storage accounts and SQL databases as soon as they are provisioned, as part of a custom regulatory compliance initiative assigned via Defender for Cloud.

Answer

Security policies (assignments)

Answer

Just-in-time VM access

Answer

Adaptive application controls

Question 4

A company uses Azure Blob Storage to store sensitive documents. The security policy requires that the storage account can only be accessed from a specific Azure virtual network (VNet) and that all access must use Azure Active Directory (Azure AD) authentication. They want to block any access that uses storage account keys or shared access signatures (SAS). Which configuration should they implement?

Accepted Answer

Configure the storage account firewall to allow access from the specific VNet, and disable 'Allow storage account key access'.. It combines two essential controls: the storage account firewall restricts access to only the specified VNet, and disabling 'Allow storage account key access' enforces Microsoft Entra ID authentication by blocking all requests that use account keys or SAS tokens. This ensures that only authenticated Microsoft Entra ID identities from the allowed VNet can access the storage account, meeting the security policy requirements.

Answer

Configure a private endpoint for the storage account and disable 'Allow storage account key access'.

Answer

Configure the storage account firewall to deny all networks, and set 'Allow storage account key access' to 'Disabled'.

Answer

Configure the storage account firewall to allow access from the specific VNet, and enable 'Require secure transfer' (HTTPS only).

Question 5

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want a user to be able to activate this role for a maximum of 2 hours per activation. Which PIM setting should they configure?

Accepted Answer

Set the 'Activation maximum duration' to 2 hours in the role settings for Security Administrator.. The 'Activation maximum duration' setting in Microsoft Entra PIM role settings directly controls the maximum time a user can remain active in an eligible role after activation. By setting this to 2 hours, the user will be able to activate the Security Administrator role for up to 2 hours per activation, after which the role assignment expires automatically.

Answer

Set the 'Expire eligible assignments after' to 2 hours in the role settings.

Answer

Enable 'Require justification' and 'Require approval' to ensure the role is not misused.

Answer

Set the 'Activation maximum duration' to 1 hour and the user can activate twice.

Question 6

An Azure SQL Database contains salary data. Support analysts need to query employee records but must not see full salary values. Which feature is most appropriate when the application cannot be changed immediately?

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it obfuscates sensitive data in query results without modifying the underlying database or requiring application changes. The support analysts can still query employee records, but the salary column is masked according to a defined masking rule (e.g., showing only the last four digits or replacing with zeros). This meets the requirement of preventing full salary exposure while the application remains unchanged.

Answer

Transparent Data Encryption

Answer

Geo-replication

Answer

Accelerated database recovery

Question 7

A company generates shared access signature (SAS) tokens to grant time-limited access to blobs in an Azure Storage container. A security administrator needs the ability to immediately revoke all active SAS tokens for that container if a token is compromised. What should they use?

Accepted Answer

Use a stored access policy on the container and reference it in the SAS token.. A stored access policy on the container provides a centralized way to manage permissions for shared access signatures (SAS). By associating the SAS token with the policy, you can immediately revoke all tokens that reference that policy by simply deleting or modifying the policy's permissions or expiry time. This is the only method that allows instant revocation of multiple SAS tokens without waiting for their individual expiry.

Answer

Use a user delegation key to create the SAS token.

Answer

Use an account-level SAS token.

Answer

Use a service-level SAS token with IP address restrictions.

Question 8

A security team uses Microsoft Defender for Cloud. They want to receive a weekly email summary of the Secure Score, top recommendations, and new alerts for their subscription. Which feature should they configure?

Accepted Answer

Enable the 'Weekly email summary' option in the Defender for Cloud email notifications settings.. Defender for Cloud includes a built-in 'Email notifications' settings page where you can enable a weekly email summary that automatically delivers the Secure Score, top recommendations, and new alerts. This feature is designed specifically for periodic, high-level security posture summaries without requiring custom infrastructure.

Answer

Configure continuous export to export all security data to a Log Analytics workspace and use a workbook to create a summary.

Answer

Create a workflow automation that triggers on a schedule and uses a Logic App to send an email summary.

Answer

Enable the 'Security Policy' default initiative to automatically send reports.

Question 9

A company uses Azure Active Directory (Azure AD) and has a conditional access policy that requires multi-factor authentication (MFA) for all external users accessing SharePoint Online. However, the security team wants to enforce that external users must re-authenticate every 30 minutes when accessing SharePoint. Which control should they configure in a new conditional access policy targeting SharePoint Online?

Accepted Answer

Add a session control and set 'Sign-in frequency' to 30 minutes.. The 'Sign-in frequency' session control in a Conditional Access policy allows administrators to enforce re-authentication at a specified interval. By setting this to 30 minutes and targeting the SharePoint Online app, external users will be prompted to re-authenticate every 30 minutes, meeting the security team's requirement. This control is independent of MFA and specifically addresses the frequency of authentication sessions.

Answer

Assign the policy to 'All cloud apps' and use a grant control to require multi-factor authentication.

Answer

Configure a condition for sign-in risk level and set it to 'High'.

Answer

Configure a session control to use 'App enforced restrictions' for SharePoint.

Question 10

A security team uses Microsoft Sentinel. They want to create a custom analytics rule that detects when a user account is created in Azure AD and then within 5 minutes attempts to access a sensitive SharePoint site. What should they use to correlate these two events?

Accepted Answer

KQL query with join on UserId. A KQL query with a join on UserId allows you to correlate two separate tables—such as AuditLogs for user creation and SharePoint access logs—based on a common field (UserId) within a specified time window (5 minutes). This is the standard method in Microsoft Sentinel for creating multi-event detection rules that require temporal correlation between distinct activities.

Answer

Watchlist

Answer

Automation rule

Answer

Playbook

Question 11

A security analyst uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to receive an email notification whenever a high-severity security alert is generated for any of their Azure resources. What should they configure in Defender for Cloud?

Accepted Answer

Configure email notifications in the Defender for Cloud settings under 'Notifications'.. Microsoft Defender for Cloud has a built-in 'Email notifications' setting under its environment settings that allows you to configure email recipients for high-severity alerts directly, without needing external services. This feature sends real-time email notifications for security alerts based on severity levels you define, making it the simplest and most direct method for this requirement.

Answer

Create an alert rule in Azure Monitor that triggers an email when a security alert is raised.

Answer

Use a Logic Apps playbook to send an email when a new alert is generated.

Answer

Set up a workflow automation rule in Microsoft Sentinel to forward alerts to email.

Question 12

Your organization has multiple Azure subscriptions and wants to centrally manage Azure Firewall policies across all subscriptions. What should you use?

Accepted Answer

Azure Firewall Manager. Azure Firewall Manager is the correct choice because it provides a centralized platform to create, manage, and enforce firewall policies across multiple Azure subscriptions and regions. It allows you to define a parent policy that child firewall instances inherit, ensuring consistent security rules without manual per-firewall configuration. This aligns directly with the requirement for central management of Azure Firewall policies.

Answer

Azure Policy to enforce firewall rules

Answer

Azure Resource Manager templates

Answer

Azure Network Watcher

Question 13

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that automatically detects and remediates identity risks such as leaked credentials and impossible travel. The solution must use built-in Microsoft Entra capabilities without additional licensing beyond Microsoft Entra ID P2. What should you configure?

Accepted Answer

Configure Identity Protection policies for sign-in risk and user risk.. Configure Identity Protection policies for sign-in risk and user risk. Microsoft Entra ID Protection is the built-in P2 capability that detects identity risks such as leaked credentials (user risk) and impossible travel (sign-in risk), and it can automatically remediate them by requiring MFA or password change through risk-based Conditional Access policies. PIM (A) governs just-in-time privileged role activation and does not detect leaked credentials or impossible travel. Conditional Access requiring MFA for all users (B) enforces a static control and does not perform risk detection or risk-based remediation. Access Reviews for guest users (C) handle periodic attestation of guest access, not identity risk detection or remediation.

Answer

Enable Privileged Identity Management (PIM) for role activation.

Answer

Create Conditional Access policies requiring MFA for all users.

Answer

Set up Access Reviews for guest users.

Question 14

A company runs a global web application on Azure App Service instances deployed in multiple Azure regions. They want to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) using a centralized set of managed rules that can be automatically updated. They also need to improve performance by terminating traffic at the nearest point of presence (POP) to end users. Which Azure service should they deploy in front of the App Service?

Accepted Answer

Azure Front Door with Web Application Firewall (WAF). Azure Front Door with WAF is correct because it provides global, centralized protection against common web attacks (SQL injection, XSS) using managed rule sets that are automatically updated, and it terminates traffic at the nearest point of presence (POP) to end users, improving performance through global load balancing and TLS termination. This meets both the security and performance requirements for a multi-region App Service deployment.

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Traffic Manager

Answer

Azure CDN (Content Delivery Network)

Question 15

You are designing a secure network architecture for a multi-region application. You need to ensure that traffic between virtual networks in different Azure regions is encrypted and uses the Microsoft backbone network, and you must minimize latency. Which TWO configurations should you implement?

Accepted Answer

Configure VNet peering between the virtual networks.. Option B (Configure VNet peering between the virtual networks) is correct because Azure VNet peering routes traffic directly over the Microsoft backbone network, keeping it off the public internet and providing the lowest-latency path between VNets in different regions (global VNet peering). Option C is incorrect because ExpressRoute with Microsoft peering is used to reach Microsoft public services such as Microsoft 365 and Azure PaaS, not to connect virtual networks to each other, and ExpressRoute does not encrypt traffic by default. Option A is not required because gateway transit only lets a peered VNet share a VPN/ExpressRoute gateway; it does not itself provide encryption for VNet-to-VNet traffic. Option D is not the best choice because site-to-site VPN traffic traverses the public internet and typically adds latency compared with backbone-based peering. Option E is incorrect because Azure Firewall inspects and filters traffic but does not encrypt cross-region traffic or optimize latency.

Answer

Enable 'Gateway transit' on the peering to use a VPN gateway if needed, but not required for encryption.

Answer

Use Azure ExpressRoute with Microsoft peering.

Answer

Deploy Azure VPN Gateway in each region and connect them via site-to-site VPN.

Answer

Place an Azure Firewall in each region to inspect cross-region traffic.