AZ-500 Practice Test 40 — 15 Questions

Question 1

A company has an Azure virtual network with multiple subnets hosting different application tiers. They need to inspect and filter all outbound traffic from VMs to the internet, and they must be able to allow or deny traffic based on fully qualified domain names (FQDNs). Which Azure networking service should they deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Firewall.. Azure Firewall is a managed, cloud-based network security service that can inspect and filter outbound traffic from Azure virtual networks to the internet. It supports application rules based on fully qualified domain names (FQDNs), allowing or denying traffic by FQDN, which directly meets the requirement. Unlike simpler filtering options, Azure Firewall provides stateful inspection and integrates with Azure Monitor for logging.

Answer

Network Security Groups (NSGs).

Answer

Azure Application Gateway.

Answer

Azure VPN Gateway.

Question 2

Which TWO actions can be taken using Azure Network Watcher?

Accepted Answer

Diagnose whether a security rule is blocking traffic to a VM.. Azure Network Watcher includes the IP flow verify capability, which checks whether a packet is allowed or denied to or from a VM and identifies the specific security rule (NSG rule) responsible, so option A is correct. It also includes the Next hop capability, which determines the next hop type and IP address for traffic originating from a VM, validating routing behavior, so option D is correct. Options B, C, and E are incorrect because private endpoints, Application Gateway WAF policies, and Azure Firewall rules are configured through their respective services (Private Link, Application Gateway, and Azure Firewall), not through Network Watcher.

Answer

Create and manage private endpoints.

Answer

Configure WAF policies on Application Gateway.

Answer

Configure Azure Firewall rules.

Question 3

Your company has multiple Azure subscriptions. You need to centralize security alerts and incidents in a single dashboard for the security operations center (SOC) team. The solution should provide advanced analytics and threat detection. Which service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that centralizes security alerts and incidents from multiple Azure subscriptions into a single dashboard. It provides advanced analytics, built-in threat detection, and AI-driven investigation capabilities, making it ideal for a SOC team requiring a unified view across the enterprise.

Answer

Azure Monitor

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 4

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a ticket number as justification, and the activation must be approved by a designated approver group. The role activation duration should be limited to 4 hours. Which PIM settings should be configured?

Accepted Answer

Enable 'Require approval' and set 'Approvers' to the designated group. Also, enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours.. The scenario requires both approval and ticket-based justification. In Microsoft Entra PIM, 'Require approval' enforces that a designated approver group must approve the activation, while 'Require ticket information on activation' ensures the user provides a ticket number as justification. Setting 'Activation maximum duration' to 4 hours limits the role activation time. These three settings together satisfy all requirements.

Answer

Enable 'Require approval' for the role and set 'Approvers' to the designated group. Also, set 'Activation maximum duration' to 4 hours.

Answer

Enable 'Require justification on activation' and set 'Activation maximum duration' to 4 hours. No approval configuration is needed.

Answer

Enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours. Approval is not required because the ticket number serves as justification.

Question 5

A company enables Azure Disk Encryption (ADE) on Windows virtual machines using a key encryption key (KEK) stored in Azure Key Vault. They want the KEK to be automatically rotated every 30 days to meet compliance requirements. Which Azure Key Vault feature should they enable?

Accepted Answer

Key rotation policy. A key rotation policy in Azure Key Vault allows you to define automatic rotation rules for keys, including a rotation interval (e.g., every 30 days) and a rotation time window. This feature ensures that the KEK is automatically replaced with a new key version at the specified interval without manual intervention, meeting compliance requirements for periodic key rotation.

Answer

Key expiration date

Answer

Soft-delete

Answer

Purge protection

Question 6

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that when a user activates this role, they must provide a support ticket number and a brief justification. Additionally, the activation should have a maximum duration of 4 hours. Which PIM role setting should they configure?

Accepted Answer

Require justification on activation. The 'Require justification on activation' setting in Microsoft Entra PIM allows you to mandate that users provide a support ticket number and a brief justification when activating a role. This setting enforces the collection of business-specific details during activation, which aligns with the requirement. The maximum activation duration of 4 hours is configured separately via the 'Activation maximum duration' setting, not through justification.

Answer

Require approval

Answer

Require MFA

Answer

Require Azure AD Identity Protection

Question 7

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

Accepted Answer

Configure a Conditional Access policy that requires that the device be marked as compliant. A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.

Answer

Configure a device registration policy

Answer

Configure an Identity Protection policy for user risk

Answer

Configure a Conditional Access policy that requires multi-factor authentication

Question 8

A company uses Azure Managed Disks for their virtual machines. They want to ensure that all managed disks are encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also want to automatically revoke access to the disks if the key is disabled or deleted. Which feature should they configure?

Accepted Answer

Server-side encryption with customer-managed keys (SSE-CMK). Server-side encryption with customer-managed keys (SSE-CMK) encrypts Azure Managed Disks at rest using a key stored in Azure Key Vault. When the key is disabled or deleted, Azure automatically revokes access to the disk by failing any I/O operations that require that key, ensuring the disk becomes inaccessible. This directly meets the requirement for both CMK-based encryption and automatic access revocation upon key loss.

Answer

Azure Disk Encryption (ADE) with a Key Encryption Key (KEK)

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys

Answer

Azure Key Vault soft-delete and purge protection

Question 9

A company stores sensitive files in Azure Files shares. They require encryption at rest using customer-managed keys (CMK) and encryption in transit using SMB 3.0 encryption. They have created a premium Azure Files share in a storage account and configured encryption at rest with a CMK. However, clients are able to connect without enforcing SMB encryption. What additional configuration is necessary to ensure that all connections to the file share are encrypted in transit?

Accepted Answer

Enable the 'Secure transfer required' property on the storage account.. Enabling the 'Secure transfer required' property on the storage account enforces encryption in transit for all client connections, including SMB 3.0 encryption for Azure Files. Without this setting, clients can connect using unencrypted SMB 2.1 or SMB 3.0 without encryption, even if the file share itself supports encryption. This property is a storage account-level flag that rejects any request not using HTTPS or SMB 3.0 with encryption.

Answer

Configure a network security group (NSG) to allow only encrypted traffic.

Answer

Set the minimum SMB protocol version to 3.0 on the file share.

Answer

Create a service endpoint for the storage account.

Question 10

A company enables Azure SQL Database auditing to log database events to a storage account. The security policy requires that the audit logs be protected from tampering and deletion after they are written. Which storage account feature should the company enable to ensure that audit log files cannot be modified or deleted by anyone for a specified retention period?

Accepted Answer

Immutable storage. Immutable storage for Azure Blob Storage provides a WORM (Write Once, Read Many) policy that prevents audit log files from being modified or deleted by any user, including administrators, for a specified retention period. This directly meets the security requirement to protect audit logs from tampering and deletion after they are written.

Answer

Soft delete

Answer

Hierarchical namespace

Answer

Firewall and virtual networks

Question 11

A company stores business records in Azure Blob Storage. Due to a legal investigation, they must prevent any modification or deletion of the blobs for an indefinite period until the legal hold is released. They also need to ensure that even storage account owners cannot alter the data during the hold. Which blob storage feature should they enable?

Accepted Answer

Legal hold. Legal hold (option B) is the correct choice because it is designed to protect blobs from any modification or deletion for an indefinite period, even by storage account owners. Unlike time-based retention policies, a legal hold has no expiration and cannot be removed until explicitly cleared by an authorized user, making it ideal for indefinite legal investigations.

Answer

Time-based retention policy

Answer

Soft delete

Answer

Blob versioning

Question 12

A company stores highly sensitive data in Azure Blob Storage. The security policy requires that all data is encrypted at rest using a key that is stored in Azure Key Vault, and that the storage account uses its system-assigned managed identity to access the key. Which encryption configuration should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK). Server-side encryption with customer-managed keys (CMK) is required because the security policy mandates that the encryption key be stored in Azure Key Vault and that the storage account uses its system-assigned managed identity to access that key. CMK allows you to bring your own key (BYOK) into Key Vault and grants the storage account access via a managed identity, ensuring the key is under your control and not managed by Azure. Service-managed keys (option A) use Microsoft-managed keys, which do not satisfy the requirement for customer-controlled key storage.

Answer

Server-side encryption with service-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 13

Your organization uses Azure Storage for sensitive financial data. You need to restrict access to storage accounts based on the client's IP address. Which Azure Storage service feature should you configure?

Accepted Answer

Firewalls and virtual networks. Firewalls and virtual networks allow you to restrict access to Azure Storage accounts based on source IP address ranges, including specific client IPs. This is the correct feature because it provides network-level access control that can block or allow traffic from defined IP addresses, which directly meets the requirement to restrict access based on the client's IP address.

Answer

Shared access signatures (SAS)

Answer

Azure Private Link

Answer

Azure AD role-based access control

Question 14

A company wants to allow external business partners to access specific SharePoint Online sites using their own corporate credentials. They do not want to manage partner accounts in their own Azure AD tenant. Which Azure AD feature should they use?

Accepted Answer

Azure AD External Identities. Microsoft Entra ID External Identities (specifically B2B collaboration) allows you to invite external business partners to access your SharePoint Online sites using their own corporate credentials (their home Microsoft Entra ID or identity provider). This eliminates the need to manage partner accounts in your tenant, as identities remain in their home directory and are authenticated via federation or SAML/WS-Fed protocols.

Answer

Azure AD B2C

Answer

Conditional Access

Answer

Privileged Identity Management

Question 15

You need to provide secure remote access to Azure virtual machines without assigning them public IP addresses. Which Azure service should you use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS, without exposing public IP addresses. It uses a hardened, fully managed platform as a service (PaaS) that sits inside your virtual network, eliminating the need for a jump box or public-facing endpoints.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Front Door