AZ-500 Practice Test 43 — 15 Questions

Question 1

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement? (Choose TWO.)

Accepted Answer

Deploy Azure Web Application Firewall (WAF) in front of the application.. Option B is correct because Azure Web Application Firewall (WAF), typically via Application Gateway or Front Door, inspects HTTP/HTTPS traffic and applies OWASP Core Rule Set rules that detect and block common SQL injection payloads before they reach the application or database. Option E is correct because parameterized queries (prepared statements) cause the database engine to treat user input strictly as data rather than executable SQL, which is the fundamental application-level defense against SQL injection. Option A is not correct here because Always Encrypted protects data confidentiality at rest and in memory by encrypting sensitive columns, but it does not detect or prevent SQL injection. Option C is not correct because Transparent Data Encryption (TDE) only encrypts data and log files at rest and has no bearing on injection attacks. Option D is not correct because SQL Server auditing records activity for compliance and forensic review after the fact; it is a detective control, not a preventive measure against SQL injection.

Answer

Use Always Encrypted for sensitive columns.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable SQL Server auditing.

Question 2

Which TWO Azure services can be used to filter inbound internet traffic to a virtual network? (Choose two.)

Accepted Answer

Azure Firewall. Both Azure Firewall and Network Security Groups (NSGs) can filter inbound internet traffic to a virtual network. Azure Firewall provides centralized, stateful filtering at Layers 3-7 with features like threat intelligence and application rules. NSGs are distributed, stateful packet filters that apply to subnets or NICs, filtering traffic based on source/destination IP, port, and protocol rules, and are commonly used to block inbound internet traffic at the subnet boundary.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

VPN gateway

Question 3

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Accepted Answer

Implement Azure Web Application Firewall (WAF). Option B (Azure Web Application Firewall) is correct because WAF, especially when deployed with Azure Application Gateway or Front Door, includes managed rule sets that detect and block common SQL injection patterns in HTTP requests before they reach the database. Option D (parameterized queries) is correct because parameterization separates SQL code from user-supplied data, so injected input is treated as a literal value rather than executable SQL, which is the most fundamental defense against SQL injection at the application layer. Option A (TDE) is not correct because it only encrypts data at rest and does nothing to prevent injection attacks. Option C (Azure SQL Database firewall rules) is not correct because it restricts access by IP address or Azure service, not by inspecting query content. Option E (Always Encrypted) is not correct because it protects sensitive column data from unauthorized viewing, not from SQL injection logic.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure Azure SQL Database firewall rules

Answer

Enable Always Encrypted for sensitive columns

Question 4

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Answer

Playbooks

Answer

Incident settings in analytics rule

Answer

Workbooks

Question 5

A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?

Accepted Answer

Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.. Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.

Answer

Data Collection Rules (DCR) in Azure Monitor.

Answer

Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.

Answer

Use Azure Automation State Configuration.

Question 6

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Option A is correct because configuring Key Vault networking with a private endpoint or selected networks restricts access to the vault from approved private IP ranges within your virtual networks, blocking public internet access. Option C is correct because Key Vault's firewall and virtual network restrictions let you allow traffic only from specified VNets/subnets and trusted Azure services, directly enforcing the 'selected private networks and approved Azure services' requirement. Option B is incorrect because soft delete is a data-protection feature that retains deleted vaults/objects for recovery; disabling it does not control network accessibility and would weaken security. Option D is incorrect because storing secrets as plain text tags is insecure and unrelated to network access restrictions; tags are metadata and should never hold secret values.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 7

You are designing a network security solution for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must be isolated. Which TWO configurations should you implement?

Accepted Answer

Use network security groups (NSGs) on each subnet. Option C is correct because placing each tier in its own subnet provides the network segmentation needed to isolate the application and database tiers from the internet-facing web tier, allowing you to apply distinct security rules per tier. Option A is correct because network security groups (NSGs) applied to each subnet let you enforce inbound and outbound rules that permit internet traffic only to the web tier while restricting the app and database tiers to internal traffic. Together, separate subnets plus per-subnet NSGs deliver the required multi-tier isolation. Option B is not needed because separate VNets add complexity and require peering for tier-to-tier communication, which is unnecessary for isolation. Option D is incorrect because VNet peering connects VNets rather than isolating tiers within a single VNet. Option E is incorrect because placing all VMs in one subnet removes the segmentation boundary needed to isolate the app and database tiers.

Answer

Deploy each tier in a separate VNet

Answer

Use VNet peering to connect the tiers

Answer

Place all VMs in the same subnet

Question 8

You are the security engineer for a financial services company that has multiple Azure subscriptions. The company uses Azure Virtual WAN with a secured hub containing Azure Firewall. Recently, the compliance team identified that traffic between two spoke virtual networks (SpokeA and SpokeB) is bypassing the firewall. Investigation shows that SpokeA and SpokeB are directly peered and have not been routed through the hub. The requirement is that all inter-spoke traffic must be inspected by Azure Firewall. You need to enforce this without disrupting existing applications. Also, the company uses Azure Firewall Manager for policy management and wants to use Azure Policy to prevent future direct peering. What should you do first?

Accepted Answer

Remove the VNet peering between SpokeA and SpokeB.. The immediate problem is the existing VNet peering between SpokeA and SpokeB that bypasses Azure Firewall. The first step must address this existing peering. Removing the peering removes the direct path, forcing inter-spoke traffic to route through the Virtual WAN hub where Azure Firewall inspects it. Option C (Azure Policy) is a preventive measure for future peerings but does not resolve the current violation. Option D (UDR) is ineffective because VNet peering has higher precedence than user-defined routes. Option B is unrelated to the peering issue. Therefore, the correct first action is to remove the VNet peering.

Answer

Disable 'Use remote virtual network gateways' on both spokes.

Answer

Create an Azure Policy to deny VNet peering between spokes.

Answer

Add a user-defined route in SpokeA and SpokeB pointing to the Azure Firewall for inter-spoke traffic.

Question 9

A company has deployed Azure Firewall in a hub virtual network with forced tunneling enabled. Spoke virtual networks are peered to the hub. The security team reports that outbound traffic from the spoke VMs is bypassing the firewall. What is the most likely reason?

Accepted Answer

The spoke subnets do not have a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall.. Forced tunneling on Azure Firewall requires that all outbound traffic from spoke VMs is routed to the firewall via a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop. Without this route, traffic from spoke subnets will use the default system route and bypass the firewall, even if the firewall itself is configured with forced tunneling.

Answer

The Azure Firewall policy has an allow-all network rule.

Answer

Azure Firewall is deployed in the same virtual network as the spoke VMs.

Answer

The spoke virtual networks are not peered to the hub.

Question 10

You are configuring Microsoft Entra Privileged Identity Management (PIM) for a group of users who need to activate the Security Administrator role. The role should only be activated after approval by a designated approver, and the activation should be limited to a maximum of 4 hours. Which two settings must you configure in the role's PIM settings? (Choose two.)

Accepted Answer

Require approval to activate.. To enforce approval and a maximum activation duration, you must enable 'Require approval to activate' and set the 'Maximum activation duration' to 4 hours. These two settings directly address the requirements. Other settings like justification or MFA are optional and do not fulfill the specified conditions. Proper configuration ensures that privileged access is tightly controlled.

Answer

Require conditional access authentication context.

Answer

Require multi-factor authentication on activation.

Answer

Require justification on activation.

Question 11

Which TWO components are required to enable Azure Disk Encryption for Windows VMs using Azure Key Vault? (Choose two.)

Accepted Answer

Azure Key Vault with an access policy granting permissions to the Azure Disk Encryption service. Option A is correct because Azure Disk Encryption (ADE) for Windows VMs requires an Azure Key Vault that holds the BitLocker encryption keys (BEKs) and secrets, and the vault must have an access policy that grants the Azure Disk Encryption service principal the required permissions (key permissions such as wrapKey/unwrapKey and secret permissions such as get/set) so the ADE extension can read and write the secrets. Option E is correct because ADE is delivered as a VM extension (the AzureDiskEncryption extension for Windows, or AzureDiskEncryptionForLinux for Linux) that must be installed on the VM to perform the actual encryption of the OS and data disks. Option B is not required: a key encryption key (KEK) is an optional second layer of key protection used to wrap the BitLocker keys, not a mandatory component. Option C is not required: a Recovery Services vault is used for Azure Backup, not for ADE key storage. Option D is not required: ADE does not need a storage account to store encryption logs; diagnostic/audit data is handled through Azure Monitor and Key Vault logging.

Answer

A key encryption key (KEK) in Azure Key Vault

Answer

A Recovery Services vault

Answer

A storage account to store the encryption logs

Question 12

You are a security engineer managing a Microsoft Sentinel workspace. The security operations team wants to automatically create a ServiceNow incident whenever a new high-severity incident is generated in Microsoft Sentinel. You need to configure the automation rule to trigger only for incidents with severity High and to include the incident's entities in the ServiceNow ticket. What should you do first?

Accepted Answer

Create a playbook that uses the ServiceNow connector, then create an automation rule with the condition Severity equals High and add an action to run the playbook.. Automation rules in Microsoft Sentinel allow you to define conditions and actions that run when incidents are created or updated. To integrate with ServiceNow, you must first create a playbook that contains the logic to create a ServiceNow incident, using the ServiceNow connector. Then, you create an automation rule that triggers on High severity incidents and runs that playbook. This ensures that only high-severity incidents result in ServiceNow tickets, and the playbook can access incident entities to populate the ticket details.

Answer

Enable the Microsoft Sentinel data connector for ServiceNow and configure the connector to automatically create incidents for all high-severity alerts.

Answer

Create an analytics rule that generates an incident and configure its incident settings to run a playbook automatically.

Answer

Create a workbook that monitors incidents and use Azure Logic Apps to send an email to the security team when a high-severity incident occurs.

Question 13

You are a security administrator for a company that uses Microsoft Entra ID. You need to provide a partner organization with access to specific resources in your tenant. The partner users must use their own credentials, and you must be able to revoke access without managing their accounts. What should you configure?

Accepted Answer

Configure B2B collaboration with a cross-tenant access policy that allows the partner tenant and grants access to a specific enterprise application.. B2B collaboration with cross-tenant access settings allows partner users to authenticate against their home tenant while you control which applications and resources they can access. Revocation is achieved by modifying or deleting the cross-tenant access policy or the application assignment, without managing partner accounts.

Answer

Configure B2C authentication with a local account for each partner user.

Answer

Create an app registration and share the client secret with the partner organization.

Answer

Create guest user accounts in your tenant and assign them to a security group.

Question 14

You are a security engineer at a company that uses Microsoft Sentinel. You need to create an automation rule that assigns a specific owner to incidents generated from a particular analytics rule and adds a comment. The automation rule must run when an incident is created. What should you use to define the condition?

Accepted Answer

A Microsoft Sentinel automation rule with a condition based on the analytics rule name.. Microsoft Sentinel automation rules are designed to automate incident handling. They can trigger on incident creation and evaluate conditions such as the analytics rule name. When the condition matches, the rule can assign an owner and add a comment. Playbooks are for more complex orchestration and are invoked by automation rules, but the condition and simple actions are defined in the automation rule itself.

Answer

A playbook that uses the incident creation trigger and a condition action.

Answer

A workbook that monitors incident metrics and triggers an alert.

Answer

A Microsoft Sentinel analytics rule with incident grouping enabled.

Question 15

You are the Azure Security Engineer for a company that uses Microsoft Entra ID (formerly Azure AD). The security team wants to ensure that when a user signs in from an unknown location, they are required to perform multi-factor authentication (MFA). However, users signing in from the corporate office should not be prompted for MFA. You create a Conditional Access policy with a condition for trusted locations. What should you configure to ensure the policy works as intended?

Accepted Answer

Add the corporate office public IP addresses as named locations and mark them as trusted.. The correct approach is to define named locations for the corporate office IP ranges and mark them as trusted. Conditional Access policies can then include or exclude these locations. This allows the policy to require MFA for unknown locations while exempting the trusted corporate office. Other options do not provide the necessary location-based control or are not granular enough.

Answer

Enable security defaults in Microsoft Entra ID to automatically require MFA for all users except those with privileged roles.

Answer

Create a conditional access policy that requires MFA for all users and then exclude users who are in the corporate office by using a dynamic group.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block sign-ins from unknown locations.