AZ-500 Practice Test 42 — 15 Questions

Question 1

Which TWO of the following are supported ways to connect an on-premises network to Azure?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute (B) is correct because it provides a private, dedicated connection between an on-premises network and Azure through a connectivity provider, bypassing the public internet. Site-to-Site VPN (D) is correct because it establishes an IPsec/IKE VPN tunnel over the public internet between an on-premises VPN device and an Azure VPN gateway, connecting entire networks. Azure Bastion (A) is not a network-to-network connection method; it provides secure RDP/SSH access to VMs through the Azure portal over TLS. Point-to-Site VPN (C) connects an individual client computer to an Azure virtual network, not an on-premises network as a whole. Azure Front Door (E) is a global HTTP/HTTPS application delivery and load-balancing service, not a site-to-site connectivity solution.

Answer

Azure Bastion

Answer

Point-to-Site VPN

Answer

Azure Front Door

Question 2

Which TWO of the following are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Sign-in risk policy. Microsoft Entra ID Protection is specifically designed to detect identity-based risks and let administrators respond to them via two built-in policies: the sign-in risk policy (B), which evaluates each authentication attempt and can require MFA or block the sign-in when the sign-in is deemed risky, and the user risk policy (C), which evaluates the overall risk of a user account (for example, from leaked credentials) and can force a secure password change. Both B and C are core, out-of-the-box capabilities of Entra ID Protection and are configured directly in its Risk policies blade. Conditional Access session controls (A) are a feature of Conditional Access (sign-in frequency, app-enforced restrictions, Cloud App Security/Defender for Cloud Apps controls), not of ID Protection itself, even though risk signals can feed Conditional Access. Access reviews (D) belong to Entra ID Governance (Identity Governance), and role-based access control (E) is the general authorization model used across Azure and Entra ID, not a risk-detection capability of ID Protection.

Answer

Conditional Access session controls

Answer

Access reviews

Answer

Role-based access control (RBAC)

Question 3

Which TWO methods can be used to protect privileged accounts in Microsoft Entra ID? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires MFA for privileged roles. Option D is correct because a Conditional Access policy that requires multifactor authentication for privileged roles enforces an additional authentication factor specifically when members of highly privileged directory roles (such as Global Administrator) sign in, directly reducing the risk of credential compromise for those accounts. Option E is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time role activation, so privileged roles are not permanently assigned; users must activate eligibility with justification, approval, and MFA, and access expires after a set duration, which minimizes standing administrative access. Option A is not correct because enabling external identities for guest users governs B2B collaboration and does not protect privileged administrative accounts. Option B is not correct because self-service password reset for all users is a general account-recovery feature and does not specifically secure privileged roles. Option C is not correct because registering devices with Microsoft Entra ID (now Microsoft Entra ID) supports device-based Conditional Access but by itself does not protect privileged accounts.

Answer

Enable external identities for guest users

Answer

Enable self-service password reset for all users

Answer

Register all devices with Azure AD

Question 4

Which TWO of the following are required to implement a successful Just-In-Time (JIT) access strategy using Microsoft Entra Privileged Identity Management (PIM) for Azure resources?

Accepted Answer

Configure role settings to specify activation duration and require approval if needed. Option C is correct because PIM role settings define the activation parameters that make access just-in-time, such as maximum activation duration, whether approval is required, and whether justification or MFA is needed at activation; without configuring these settings, eligible assignments would not enforce time-bound, controlled activation. Option D is correct because JIT access in PIM for Azure resources requires users to be assigned as eligible for the Azure RBAC roles they need, so they can activate the role only when required rather than holding standing access. Option A is not required for the JIT strategy itself, since MFA can be enforced as a role setting at activation rather than mandating MFA for all tenant users. Option B is not required because PIM works with built-in Azure RBAC roles and custom roles are not a prerequisite for JIT access. Option E is incorrect because permanently active assignments provide standing access, which is the opposite of just-in-time access.

Answer

Enable Azure Multi-Factor Authentication for all users in the tenant

Answer

Create custom RBAC roles for the JIT access

Answer

Assign users as permanently active for the roles they need

Question 5

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a secure authentication strategy that satisfies the following requirements:
- Users must not be able to bypass security verification using alternate authentication methods.
- Passwordless authentication should be used where possible.
- Legacy authentication protocols must be blocked.

Which THREE actions should you take? (Choose three.)

Accepted Answer

Create a Conditional Access policy to block legacy authentication protocols.. Option A is correct because a Conditional Access policy targeting the 'Other clients' client apps condition (which covers legacy protocols such as IMAP, POP3, SMTP AUTH, and older Office clients) is the supported way to block legacy authentication in Microsoft Entra ID. Option C is correct because enabling the FIDO2 security key authentication method and configuring it for passwordless sign-in provides a phishing-resistant, passwordless credential that satisfies the passwordless requirement. Option E is correct because disabling SMS and voice call methods removes weaker alternate authentication methods that users could otherwise use to bypass stronger security verification, directly addressing the no-bypass requirement. Option B is not correct because per-user MFA is a legacy, always-on setting that cannot enforce method restrictions or passwordless flows and does not block legacy authentication. Option D is not correct because Security defaults are a baseline for tenants without Conditional Access and cannot be combined with the granular Conditional Access policy needed here, nor do they enforce passwordless authentication.

Answer

Configure per-user MFA to require verification.

Answer

Enable the 'Security defaults' feature in Microsoft Entra ID.

Question 6

Which THREE of the following are required to configure Microsoft Entra ID self-service password reset (SSPR)?

Accepted Answer

Microsoft Entra ID P1 or P2 license. Option A is correct because Microsoft Entra ID self-service password reset requires a Microsoft Entra ID P1 or P2 license (or Microsoft 365 Business Premium, which includes Entra ID P1 features); the P1 tier is the minimum paid license that unlocks SSPR for cloud-only and hybrid users. Option D is correct because users must register their authentication methods (such as Microsoft Authenticator, email, phone, or security questions) before they can prove their identity and reset their own password. Option E is correct because an administrator must explicitly enable SSPR in the tenant (for example, by selecting All users or a pilot group under Password reset > Properties), since the feature is not active by default. Option B is not required because Premium P2 is not the minimum license — P1 already satisfies the SSPR licensing requirement, and P2 is only needed for features like Identity Protection and Privileged Identity Management. Option C is not required because password writeback is only necessary for hybrid environments where the password must sync back to on-premises Active Directory via Microsoft Entra Connect; for cloud-only users, SSPR works without writeback.

Answer

Microsoft Entra ID Premium P2 license

Answer

Password writeback must be enabled

Question 7

Which THREE components are part of Microsoft Entra Conditional Access? (Choose three.)

Accepted Answer

Conditions (sign-in risk, device state, location). Conditional Access in Microsoft Entra is built on an if-then policy model, and option B correctly identifies the 'if' side: Conditions such as sign-in risk, user risk, device state/platform, location, and client app that determine when a policy applies. Option C correctly identifies the 'then' side: Access controls, which include grant controls (for example require MFA or compliant device), block controls, and session controls (such as app-enforced restrictions or sign-in frequency). Option E correctly identifies Assignments, which scope the policy to specific users, groups, directory roles, or workload identities (service principals) as the target of the policy. Option A is not a component of Conditional Access; MFA is one possible grant control configured within a policy, not a standalone Conditional Access component. Option D is not a Conditional Access component either; role assignments belong to Entra RBAC and govern administrative permissions, not policy evaluation.

Answer

Multi-factor authentication service settings

Answer

Role assignments

Question 8

Which THREE of the following are valid methods to secure service principals in Microsoft Entra ID?

Accepted Answer

Use certificate-based credentials instead of client secrets. Option A is correct because certificate-based credentials are a more secure alternative to client secrets for service principals; the public key is registered in Microsoft Entra ID and the private key is held by the app, so no shared secret is transmitted or stored, reducing the risk of credential theft. Option C is correct because Conditional Access for workload identities is a policy engine specifically designed to evaluate service principal sign-ins and can block or restrict them based on conditions such as location, risk, or IP range, which helps protect non-human identities. Option E is correct because Managed Identities for Azure resources let Azure create and rotate the service principal's credentials automatically, eliminating the need to store and manage secrets or certificates in code or configuration. Option B is not appropriate because assigning a service principal the Global Administrator role grants excessive, unnecessary privileges and does not secure the principal; it increases risk. Option D is not valid because Azure Multi-Factor Authentication applies to interactive user sign-ins and cannot be enforced for a service principal, which authenticates non-interactively with secrets, certificates, or federated credentials.

Answer

Assign the service principal to the Global Administrator role to monitor its activity

Answer

Enable Azure Multi-Factor Authentication for the service principal sign-in

Question 9

You are designing network security for a three-tier application. You need to isolate each tier (web, application, data) and control traffic between them. Which TWO Azure services should you use to achieve this? (Choose two.)

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are correct because they let you define inbound and outbound security rules (by IP, port, and protocol) that filter traffic to and from subnets or NICs, which is exactly how you enforce isolation and control traffic between the web, application, and data tiers. Application Security Groups (ASGs) are correct because they let you group VMs by workload role (for example, web, app, or data) and then reference those groups as sources/destinations in NSG rules, so you can control tier-to-tier traffic without hardcoding individual IP addresses. Together, NSGs provide the filtering mechanism and ASGs provide the logical grouping that makes tier-based rules scalable and maintainable. VNet peering only connects virtual networks for private IP communication and does not itself filter or isolate tier traffic. Azure Policy is a governance/compliance tool for enforcing resource configurations, not a runtime traffic filter. Azure Firewall is a centralized, stateful network security service, but it is not the service used to isolate individual tiers within a VNet via subnet/NIC-level rules and workload grouping.

Answer

VNet peering

Answer

Azure Policy

Answer

Azure Firewall

Question 10

You are designing a secure network for an e-commerce application in Azure. The application consists of web servers, application servers, and database servers. You need to ensure that inbound traffic is filtered at multiple layers. Which THREE Azure services should you use to implement defense in depth for network security?

Accepted Answer

Azure Application Gateway with WAF policy. Azure Application Gateway with WAF policy (A) is correct because it provides layer 7 (HTTP/HTTPS) filtering at the regional level, inspecting inbound web traffic for OWASP Top 10 threats such as SQL injection and cross-site scripting before it reaches the web servers. Azure Front Door with WAF policy (B) is correct because it adds a global layer 7 entry point with anycast routing, TLS termination, and WAF inspection at the network edge, filtering malicious inbound traffic before it enters the Azure region. Network Security Groups (C) are correct because they enforce layer 3/layer 4 stateful packet filtering on subnets and NICs, allowing you to segment web, application, and database tiers with rules based on source/destination IP, port, and protocol. Azure Bastion (D) is not correct here because it provides secure RDP/SSH access to VMs over TLS from the Azure portal and does not filter inbound application traffic. Azure DNS (E) is not correct because it is a name resolution service for hosting and resolving DNS zones, not a traffic-filtering or security control.

Answer

Azure Bastion

Answer

Azure DNS

Question 11

You need to monitor network traffic to detect anomalies and potential security threats. Which THREE Azure services can you use to achieve this? (Choose three.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel (A) is correct because it is a cloud-native SIEM/SOAR platform that ingests network telemetry and logs, applies analytics rules and machine learning to detect anomalies and security threats, and supports investigation and automated response. Azure Firewall logs (C) are correct because the firewall's network, application, and threat-intelligence logs capture allowed/denied traffic and malicious activity that can be analyzed for anomalies and threats. Azure Network Watcher (E) is correct because it provides network monitoring and diagnostic tools such as NSG flow logs, Traffic Analytics, packet capture, and connection monitor that reveal traffic patterns and anomalies. Azure Monitor Metrics (B) is not correct here because it stores numeric time-series metrics rather than detailed traffic/log data needed for threat detection. Azure Policy (D) is not correct because it is a governance service that enforces and audits resource configurations, not a network traffic monitoring or threat detection tool.

Answer

Azure Monitor Metrics

Answer

Azure Policy

Question 12

You need to secure traffic between an on-premises network and Azure using a VPN connection. Which TWO configurations are required?

Accepted Answer

Create a virtual network gateway (VPN). Option A is correct because a virtual network gateway of type VPN is the Azure-side endpoint that terminates the IPsec/IKE tunnel and is mandatory for any site-to-site VPN connection. Option E is correct because the local network gateway is the Azure resource that represents the on-premises VPN device, holding its public IP address and address spaces so Azure knows how to route traffic to the remote network. Together, the virtual network gateway and local network gateway form the two required endpoints for a site-to-site VPN. Option B is not required because Azure Firewall provides traffic filtering and security policies, not the VPN tunnel itself. Option C is not required because the public IP is assigned to the on-premises VPN device (or referenced in the local network gateway), not to the local network gateway resource itself. Option D is not required because ExpressRoute is a separate dedicated private connectivity service, not a VPN solution.

Answer

Deploy Azure Firewall

Answer

Assign a public IP to the local network gateway

Answer

Provision an ExpressRoute circuit

Question 13

Which THREE of the following are required to enable network traffic flow between two peered Azure virtual networks in different Azure regions?

Accepted Answer

Both VNets must have the Allow virtual network access setting enabled for the peering.. Option A is correct because each side of a VNet peering link has an 'Allow virtual network access' setting that must be enabled so the peered VNet's address space is reachable; if it is disabled, traffic to that VNet is blocked even though the peering exists. Option B is correct because when traffic is routed through a network virtual appliance in the peered VNet, the receiving peering must have 'Allow forwarded traffic' enabled, otherwise traffic not originating from the peered VNet's own address space is dropped. Option E is correct because VNet peering requires the address spaces of the two VNets to be non-overlapping; overlapping prefixes make routing ambiguous and the peering cannot be created. Option C is not required: gateway transit only matters when sharing a VPN/ExpressRoute gateway, not for basic VNet-to-VNet traffic flow. Option D is not required: NSGs are optional security filters, and peering itself does not depend on an NSG rule allowing traffic.

Answer

Gateway transit must be enabled in at least one VNet.

Answer

An NSG rule must allow traffic between the VNets.

Question 14

Which TWO components are required to implement a secure hybrid network that connects on-premises to Azure using ExpressRoute? (Choose two.)

Accepted Answer

Virtual network gateway in Azure.. Option A is correct because an ExpressRoute connection terminates on a virtual network gateway of type 'ExpressRoute' (ExpressRouteGateway) deployed in the Azure virtual network's GatewaySubnet, which is the mandatory Azure-side endpoint that peers with the ExpressRoute circuit. Option B is correct because the ExpressRoute circuit is the connectivity resource provisioned through a connectivity provider (or ExpressRoute Direct) that establishes the private Layer 3 connection between on-premises and Microsoft's edge, and it is the fundamental component required for any ExpressRoute-based hybrid network. Option C is not required for the connectivity itself; Azure Firewall is an optional security service for traffic inspection and does not establish the ExpressRoute link. Option D is not required because a VPN Gateway is only an optional failover path (or a separate S2S VPN design), not a mandatory component of an ExpressRoute implementation. Option E is not required because Azure Front Door is a global Layer 7 HTTP/HTTPS load balancer and CDN service, unrelated to private ExpressRoute hybrid connectivity.

Answer

Azure Firewall.

Answer

Azure VPN Gateway for failover.

Answer

Azure Front Door.

Question 15

Which TWO of the following are valid methods to ingest data into Microsoft Sentinel? (Select two.)

Accepted Answer

Using the Log Analytics agent to send custom logs.. Option A is correct because the Log Analytics agent (MMA/AMA) can be installed on machines to collect custom logs and Windows/Linux events and forward them to the Log Analytics workspace that backs Microsoft Sentinel, including custom log ingestion via the Log Analytics Data Collector API or custom tables. Option E is correct because Microsoft Sentinel ingests data through data connectors, many of which are available from the Content Hub (e.g., Microsoft 365 Defender, Azure Activity, AWS, syslog via AMA), and these connectors are the primary supported ingestion method. Option B is not a valid ingestion method because Azure PowerShell cmdlets manage resources and configuration but do not stream event data directly into Sentinel; ingestion occurs via agents, connectors, or the Data Collector API. Option C is not valid because Power BI is a visualization and reporting tool, not a data streaming or ingestion pipeline into Sentinel. Option D is not valid because Azure Policy enforces governance and compliance on resources; it does not forward logs to Microsoft Sentinel, though diagnostic settings or connectors are used for that purpose.

Answer

Using the Azure PowerShell cmdlets to send events directly.

Answer

Using Power BI to stream data.

Answer

Using Azure Policy to forward logs.