AZ-500 Practice Test 41 — 15 Questions

Question 1

A company has several critical applications deployed in an Azure virtual network. The security team wants to protect the virtual network against Distributed Denial-of-Service (DDoS) attacks by enabling automatic attack mitigation, adaptive tuning, and access to DDoS Rapid Response Support. Which DDoS Protection tier should they enable for the virtual network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DDoS Protection Standard. DDoS Protection Standard is the correct tier because it provides automatic attack mitigation, adaptive tuning based on traffic patterns, and access to DDoS Rapid Response Support (DRRS) for Azure virtual networks. The Basic tier only offers always-on traffic monitoring and basic mitigation without adaptive tuning or DRRS, while Premium and Advanced are not valid Azure DDoS Protection tiers.

Answer

DDoS Protection Basic (Free)

Answer

DDoS Protection Premium

Answer

DDoS Protection Advanced

Question 2

A security analyst is using Microsoft Sentinel to investigate a security incident. The analyst needs to view all related events, alerts, and entities (users, IPs, hosts) in a single, interactive graph to understand the full scope of the attack. Which Microsoft Sentinel feature should they use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel provides an interactive, visual map that correlates all related events, alerts, and entities (such as users, IPs, and hosts) for a given incident. This allows the analyst to explore the full scope of an attack by dragging and dropping entities to uncover hidden relationships, making it the correct feature for this scenario.

Answer

Incident timeline

Answer

Hunting

Answer

Analytics rules

Question 3

A company uses Azure Active Directory and has guest users invited via B2B collaboration. The security team wants to require that all guest users from specific external organizations must complete multi-factor authentication (MFA) when accessing the company's SaaS applications. Which Conditional Access policy configuration should they use?

Accepted Answer

Create a policy that applies to 'Guest or external users' with a condition for 'External tenants' specifying the organizations, and a grant control of 'Require multi-factor authentication'.. It uses the 'External tenants' condition within a Conditional Access policy targeting 'Guest or external users' to specify the exact organizations from which guests must complete MFA. This directly meets the requirement to scope MFA enforcement to specific external organizations, not all guests. The 'Require multi-factor authentication' grant control ensures MFA is enforced for those guests when accessing SaaS applications.

Answer

Create a policy that applies to 'All users' with a condition for 'Guest or external users' and a grant control of 'Require multi-factor authentication'.

Answer

Create a policy that applies to 'All guest users' and assign it to the SaaS applications. Use a session control 'Use app enforced restrictions'.

Answer

Create a policy that applies to 'Guest or external users' with a condition for 'Sign-in risk' set to 'Medium and above' and a grant control of 'Block access'.

Question 4

A company uses Azure AD Privileged Identity Management (PIM) to manage access to the 'Security Administrator' role. They want a specific user to be able to activate the role only when needed, rather than having standing access. The user should not have the role active at all times. Which type of assignment should they configure for this user in PIM?

Accepted Answer

Assign the user as 'Eligible' for the role.. In Microsoft Entra Privileged Identity Management (PIM), an 'Eligible' assignment means the user does not have permanent access to the role. They must activate the role on-demand through a time-bound activation process, which may require approval and multi-factor authentication. This directly meets the requirement of having no standing access, as the role is inactive until the user explicitly activates it.

Answer

Assign the user as 'Active' for the role.

Answer

Assign the user as 'Permanent' for the role.

Answer

Add the user as a 'Guest' in the directory.

Question 5

An application hosted on an Azure VM needs to read secrets from Key Vault without storing credentials. Which identity pattern should be used?

Accepted Answer

System-assigned managed identity with Key Vault access granted by RBAC or access policy. A system-assigned managed identity enables an Azure VM to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically creates a service principal for the VM in Microsoft Entra ID, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to Key Vault. Access to secrets is then controlled by assigning RBAC roles (e.g., Key Vault Secrets User) or configuring a Key Vault access policy for that identity, eliminating the need for any stored secrets.

Answer

Client secret stored in appsettings.json

Answer

Shared access signature stored as an environment variable

Answer

A user account excluded from MFA

Question 6

A company deploys Azure virtual machines in a virtual network. A security policy requires that only Remote Desktop Protocol (RDP) traffic from the corporate VPN's public IP address (203.0.113.0/26) is allowed. All other inbound RDP traffic must be denied. Which configuration should be applied to the network security group (NSG) associated with the VM subnet?

Accepted Answer

Add an inbound rule to allow RDP from the corporate IP range, and add a default deny rule for all other inbound RDP traffic.. The requirement is to allow RDP (TCP port 3389) only from the corporate VPN's public IP range (203.0.113.0/26) and deny all other inbound RDP traffic. An NSG processes rules in priority order; by adding an inbound allow rule for the corporate IP range with a high priority (e.g., 100) and relying on the default deny rule (which denies all inbound traffic not explicitly allowed), only RDP from the specified range is permitted. This matches the security policy precisely.

Answer

Add an inbound rule to allow RDP from the Internet and a deny rule for RDP from the corporate IP.

Answer

Add an inbound rule to deny RDP from the corporate IP and a default deny all inbound.

Answer

No additional rules are needed because the default NSG rules already deny RDP.

Question 7

You are evaluating Microsoft Defender for Cloud's cloud security posture management (CSPM) capabilities. You need to identify misconfigurations across your Azure, AWS, and GCP environments. What should you enable?

Accepted Answer

Enable the 'Defender for Cloud' multicloud connector for AWS and GCP.. The Defender for Cloud multicloud connector is specifically designed to ingest security findings and configuration data from AWS and GCP into Microsoft Defender for Cloud's CSPM dashboard. This enables unified visibility and assessment of misconfigurations across Azure, AWS, and GCP environments without requiring agents or log ingestion into Sentinel.

Answer

Ingest logs from AWS and GCP into Microsoft Sentinel.

Answer

Create Azure Policy assignments for AWS and GCP resources.

Answer

Deploy Azure Arc on VMs in AWS and GCP.

Question 8

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault. Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.

Answer

Create a private endpoint on the Key Vault for the SQL server

Answer

Disable the Key Vault firewall

Answer

Assign the SQL server a system-assigned managed identity and grant it access to the key vault

Question 9

Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?

Accepted Answer

Security recommendations for resources. CSPM in Microsoft Defender for Cloud continuously assesses Azure resources against built-in security policies and industry best practices, generating actionable security recommendations to harden the environment. These recommendations are derived from the Azure Security Benchmark and are displayed in the Recommendations blade, directly influencing the Secure Score.

Answer

Vulnerability scanning of containers

Answer

Threat detection for VMs

Question 10

A company has a hub-spoke network topology in Azure. The hub virtual network contains an Azure Firewall. Spoke virtual networks are peered to the hub. The security team wants to inspect all traffic between virtual machines in different spoke virtual networks. What is the minimum configuration required?

Accepted Answer

Define user-defined routes (UDRs) in each spoke that direct inter-spoke traffic to the Azure Firewall in the hub.. User-defined routes (UDRs) in each spoke subnet are required to force inter-spoke traffic through the Azure Firewall in the hub. Without UDRs, traffic between peered spokes would flow directly over the VNet peering connections, bypassing the firewall. The UDRs must have the Azure Firewall's private IP as the next hop to ensure all inter-spoke traffic is inspected.

Answer

Enable VNet peering gateway transit and allow forwarded traffic.

Answer

Deploy a VPN gateway in each spoke and configure site-to-site VPNs to the hub.

Answer

Configure network security groups (NSGs) on each spoke subnet.

Question 11

A security operations team uses Microsoft Sentinel. They create a playbook that changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is detected within the incident's entities. The team wants this playbook to run automatically as soon as the incident is created, without manual intervention. Which type of automation rule trigger should they configure to invoke the playbook?

Accepted Answer

When incident is created. The 'When incident is created' trigger in Microsoft Sentinel automation rules is designed to invoke a playbook immediately upon incident generation, without requiring any manual action. This matches the requirement for automatic execution as soon as the incident is created, allowing the playbook to evaluate entities and change severity from 'Medium' to 'High' based on the IOC detection.

Answer

When incident is updated

Answer

When alert is created

Answer

On a time schedule

Question 12

You have an Azure virtual machine that hosts a web application on port 443 and a management interface on port 8443. You need to allow inbound HTTPS traffic from the internet to port 443, and allow inbound traffic on port 8443 only from the company's office public IP range (203.0.113.0/24). You want to use a managed service that provides basic DDoS protection at no additional cost. What should you use?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) is the correct choice because it is a free, managed Azure service that provides basic DDoS protection at no additional cost. NSGs allow you to define inbound security rules to permit HTTPS traffic (port 443) from any source and restrict management traffic (port 8443) to a specific public IP range (203.113.0.0/24). This meets all requirements without incurring extra charges for advanced services.

Answer

Azure Application Gateway with WAF

Answer

Azure Front Door

Answer

Azure Firewall

Question 13

Which TWO of the following are authentication methods supported by Microsoft Entra ID?

Accepted Answer

Certificate-based authentication (CBA). Microsoft Entra ID natively supports certificate-based authentication (CBA), where a user presents an X.509 certificate and Entra ID validates it against configured trusted certificate authorities to satisfy authentication, making option A correct. Entra ID also supports SMS-based one-time passcode as a built-in authentication method, sending a code to a registered phone number that the user enters to complete sign-in, making option E correct. Security questions (B) are not an Entra ID authentication method; they are used in self-service password reset (SSPR) for identity verification, not as a primary or MFA authentication method. Smart card with PIN (C) is not a distinct Entra ID authentication method — smart cards are typically surfaced through certificate-based authentication, so C is not separately supported. OAuth 2.0 authorization code flow (D) is an authorization protocol used by applications to obtain tokens, not an authentication method offered by Entra ID.

Answer

Security questions

Answer

Smart card with PIN

Answer

OAuth 2.0 authorization code flow

Question 14

Which TWO of the following are methods to enforce MFA in Microsoft Entra ID?

Accepted Answer

Security defaults. Security defaults (C) is correct because it is a Microsoft-managed baseline that, once enabled, automatically requires all users to register for MFA and enforces MFA for privileged actions such as Azure portal, Microsoft Entra admin center, and Azure CLI/PowerShell access. Conditional Access policy (D) is correct because it is the primary granular method to enforce MFA, letting you create a policy that targets users/groups and cloud apps with a Grant control of 'Require multifactor authentication' (optionally combined with conditions like sign-in risk, location, or device state). Identity Protection user risk policy (A) does not itself enforce MFA; it can require a password change or, in some configurations, allow access, and MFA enforcement is typically achieved by pairing risk signals with a Conditional Access grant control. Password Protection (B) only blocks weak or banned passwords via custom banned password lists and does not perform MFA. Self-service password reset (E) is a credential-reset feature and does not enforce MFA, even though it may require MFA as an authentication method for the reset process.

Answer

Identity Protection user risk policy

Answer

Password Protection

Answer

Self-service password reset

Question 15

Which THREE are best practices for securing network traffic in Azure? (Choose three.)

Accepted Answer

Use private endpoints for Azure services. Option A is correct because private endpoints assign a private IP address from your VNet to an Azure PaaS service via Azure Private Link, keeping traffic on the Microsoft backbone and eliminating exposure to the public internet. Option D is correct because just-in-time (JIT) VM access in Microsoft Defender for Cloud opens NSG rules only on demand for a limited time and from approved source IPs, reducing the attack surface of management ports like RDP 3389 and SSH 22. Option E is correct because service tags in NSG rules let you allow or deny traffic to specific Azure services (for example, Storage or Sql) by Microsoft-managed IP ranges, avoiding broad 0.0.0.0/0 or Internet rules and simplifying maintenance. Option B is not a best practice because assigning public IP addresses to every VM directly exposes them to internet scanning and brute-force attacks; VMs should generally be reached via Bastion, VPN, or private endpoints. Option C is not a best practice because allowing direct outbound internet access from VMs bypasses inspection and enables data exfiltration and command-and-control traffic; outbound traffic should be routed through Azure Firewall, NAT Gateway, or a user-defined route to a controlled egress point.

Answer

Assign public IP addresses to every VM

Answer

Allow direct outbound internet access from VMs