AZ-500 Practice Test 43 — 15 Questions

Question 1

Your company stores sensitive documents in Azure Blob Storage. You need to implement a solution that automatically scans uploaded blobs for malware and quarantines any infected files. The solution must minimize administrative overhead and integrate with Azure Security Center. What should you use?

Accepted Answer

Enable Microsoft Defender for Storage and configure malware scanning. Option C is correct because Microsoft Defender for Storage provides built-in malware scanning for blobs, with automatic quarantine and integration with Security Center. Option A is wrong because Azure Firewall is for network traffic filtering, not content scanning. Option B is wrong because Microsoft Sentinel is a SIEM, not a malware scanner. Option D is wrong because Azure Policy can enforce rules but does not scan for malware.

Answer

Deploy Microsoft Sentinel and create an analytics rule to detect malware from storage logs

Answer

Create an Azure Policy to deny storage accounts without encryption

Answer

Enable Azure Firewall and configure application rules to inspect HTTPS traffic

Question 2

Which two actions should you take to secure Azure Storage accounts against data exfiltration?

Accepted Answer

Use Azure Private Endpoints for storage accounts.. Correct: A and C. Firewall and virtual network service endpoints restrict network access, and private endpoints provide secure connectivity. Option B (shared access keys) does not prevent exfiltration. Option D (soft delete) helps recovery but not prevention. Option E (CORS) controls cross-origin requests, not exfiltration.

Answer

Enable shared access key authentication.

Answer

Enable soft delete for blobs.

Answer

Configure CORS rules to allow all origins.

Question 3

Which two options are valid methods to authenticate to Azure Storage from on-premises servers?

Accepted Answer

Microsoft Entra ID authentication.. Correct: B and D. Shared access keys and Entra ID authentication are both supported. Option A (X.509 certificates) is not supported for storage. Option C (SAS tokens) is a form of shared access, but not a primary authentication method. Option E (Azure CLI) is a command-line tool, not an authentication method per se.

Answer

X.509 certificate authentication.

Answer

SAS tokens generated from the storage account.

Answer

Azure CLI login.

Question 4

A company uses Azure Cosmos DB with SQL API to store user profiles. They need to ensure that only authorized applications can access the data, and that the data is encrypted in transit and at rest. Currently, the application uses a master key to connect. What should they implement to improve security?

Accepted Answer

Enable managed identity for the application and grant it access to Cosmos DB via Azure RBAC. Using managed identities for Azure resources eliminates the need for master keys by allowing the application to authenticate to Azure Cosmos DB via Azure AD. Option D is correct. Option A is incorrect because firewall restricts network access but does not address key management. Option B is incorrect because private endpoints improve network security but still require authentication. Option C is incorrect because resource tokens are for granular user-level access, not application authentication.

Answer

Use resource tokens with permissions for each user

Answer

Enable private endpoint for Cosmos DB

Answer

Configure IP firewall rules on the Cosmos DB account

Question 5

You need to ensure that Azure SQL Database automatically detects and alerts on potential SQL injection attacks. Which Microsoft Defender for Cloud plan should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL includes advanced threat protection that detects SQL injection and other anomalous activities. Option B is correct. Option A is incorrect because Defender for Cloud (free) only provides basic security assessments. Option C is incorrect because Defender for Storage protects storage accounts. Option D is incorrect because Defender for App Service protects web apps.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud (free tier)

Answer

Microsoft Defender for App Service

Question 6

You are configuring secure access to Azure Blob Storage for a third-party partner application that runs outside Azure. The partner needs to upload files to a specific container. You want to grant least-privilege access without storing static credentials in the partner's code. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure the storage firewall to allow access only from the partner's public IP address.. Option A (create a managed identity) cannot be used for external partners; managed identities are for Azure resources. Option B (user-delegation SAS) is correct because it can be created with Azure AD credentials and scoped to a container with write permission. Option C (storage account key) is too permissive. Option D (RBAC role assignment) is correct if the partner can authenticate with Azure AD; but if they are external, a user-delegation SAS is better. However, the question says 'without storing static credentials', so a SAS token can be generated programmatically and short-lived. Option E (IP restriction) is a good additional control but not sufficient alone. The best two are user-delegation SAS (B) and RBAC role assignment (D) if partner uses Azure AD. But the question says 'without storing static credentials', so RBAC with managed identity is not applicable for external partner. Therefore, the correct answers are: generate a user-delegation SAS with Write permission (B) and restrict access to the partner's public IP (E).

Answer

Provide the storage account key to the partner and instruct them to use it in their application.

Answer

Create a managed identity for the partner's application and grant it the Storage Blob Data Contributor role.

Answer

Assign the Storage Blob Data Contributor RBAC role to the partner's Azure AD application.

Question 7

Refer to the exhibit. You are configuring network access for an Azure Storage account. After applying this configuration, users report that they cannot access the storage account from their on-premises network (public IP: 198.51.100.50). What is the most likely reason?

Accepted Answer

The user's public IP address is not in the allowed IP rules. Option B is correct because the default action is Deny, and only the IP range 203.0.113.0/24 is allowed. The user's IP is 198.51.100.50, which is not in the allowed range. Option A is wrong because Azure Services bypass only affects trusted Azure services, not user IPs. Option C is wrong because there are no virtual network rules. Option D is wrong because the storage account is not a private endpoint configuration.

Answer

The storage account is configured with a private endpoint

Answer

The bypass for AzureServices is not configured correctly

Answer

The virtual network rules are missing

Question 8

Your organization uses Microsoft Defender for Cloud to manage security posture. You have an Azure SQL Database that stores PII. You need to ensure that all sensitive columns are automatically discovered and classified. Additionally, you want to audit access to these columns. What should you configure?

Accepted Answer

Microsoft Defender for Cloud's data discovery and classification and Azure SQL Database auditing. Option B is correct: Microsoft Defender for Cloud includes data discovery and classification for Azure SQL Database, and auditing can be enabled to track access. Option A (Azure Purview) is for broader data governance but not directly for SQL Database auditing. Option C (Azure SQL Database Vulnerability Assessment) checks for vulnerabilities, not classification. Option D (Azure SQL Database Advanced Threat Protection) detects threats, not classification.

Answer

Azure SQL Database Advanced Threat Protection and Azure SQL Database auditing

Answer

Azure Purview Data Map and Azure SQL Database auditing

Answer

Azure SQL Database Vulnerability Assessment and Azure SQL Database auditing

Question 9

Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?

Accepted Answer

Use Azure AD authentication with managed identities. Option A is correct because Azure Storage supports managed identities for Azure resources, allowing applications to authenticate without storing keys. Option B is wrong because firewall rules control network access, not application identity. Option C is wrong because private endpoints provide network isolation, not application authentication. Option D is wrong because SAS tokens still require managing secrets.

Answer

Use a stored access policy with a shared access signature

Answer

Configure a firewall on the storage account to allow only the application's IP address

Answer

Enable a private endpoint for the storage account

Question 10

Refer to the exhibit. You are deploying an Azure Storage account with the ARM template snippet shown. The deployment fails with an error about the encryption configuration. What is the most likely cause?

Accepted Answer

The storage account does not have the required permissions on the key vault. Option C is correct because the encryption key source requires the storage account's managed identity to have get, wrapKey, and unwrapKey permissions on the key vault. Option A is wrong because the key vault URI format is correct. Option B is wrong because the key name and version are provided. Option D is wrong because the key vault is in the same region.

Answer

The key vault URI is incorrect

Answer

The key name or version is missing

Answer

The key vault is in a different region than the storage account

Question 11

You have an Azure virtual machine that runs a line-of-business application. You need to ensure that the disks attached to the VM are encrypted at rest using platform-managed keys. What should you do?

Accepted Answer

Enable Azure Disk Encryption on the VM. Option B is correct because Azure Disk Encryption uses DM-Crypt (Linux) or BitLocker (Windows) to encrypt disks with platform-managed keys by default. Option A is wrong because enabling encryption at host requires additional configuration. Option C is wrong because SSE with PMK is for storage accounts, not VM disks. Option D is wrong because Azure Disk Encryption with KEK requires a key encryption key from Key Vault, which is customer-managed.

Answer

Configure a disk encryption set with a customer-managed key

Answer

Enable encryption at host on the VM

Answer

Enable Storage Service Encryption (SSE) on the storage account

Question 12

Which THREE components are required to enable Azure Disk Encryption for Windows VMs using Azure Key Vault? (Choose three.)

Accepted Answer

Azure Key Vault with an access policy granting permissions to the Azure Disk Encryption service. Options A, B, and D are correct. Option A: A Key Vault is required to store encryption keys. Option B: The VM must have a key encryption key (KEK) or be configured to use a BEK. Option D: The VM must have the AzureDiskEncryption extension installed. Option C is wrong because a recovery vault is for Azure Backup, not disk encryption. Option E is wrong because a storage account is not required; Azure Disk Encryption uses managed disks.

Answer

A Recovery Services vault

Answer

A storage account to store the encryption logs

Question 13

You are securing an Azure Kubernetes Service (AKS) cluster that runs a microservices application. You need to ensure that pods can only communicate with other pods in the same namespace, and that all egress traffic from the cluster is inspected for malicious content. Which three components should you include in the solution?

Accepted Answer

Kubernetes Network Policies. Option A is correct because Network Policies in AKS control pod-to-pod communication. Option C is correct because Azure Firewall can inspect egress traffic. Option D is correct because the egress traffic must be routed through the firewall. Option B (Azure DDoS Protection) is for DDoS attacks, not content inspection. Option E (Application Gateway) is for inbound traffic, not egress inspection.

Answer

Azure Application Gateway

Answer

Azure DDoS Protection

Question 14

You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?

Accepted Answer

Use Azure Private Link to connect via a private endpoint. Option A is correct because Azure Private Link creates a private endpoint in a virtual network, allowing on-premises connectivity via VPN or ExpressRoute without public exposure. Option B is wrong because firewall rules with public IP still expose the database to the internet. Option C is wrong because always encrypted does not affect network access. Option D is wrong because service endpoints still use a public IP for the service, though traffic stays on the backbone.

Answer

Configure a firewall rule to allow the on-premises public IP address

Answer

Enable Always Encrypted on the database

Answer

Use a virtual network service endpoint for Azure SQL Database

Question 15

Your organization uses Azure Files shares with Azure AD DS authentication. You need to ensure that users can access the file share from on-premises Windows clients using their on-premises AD credentials, without exposing the storage account to the internet. The on-premises network is connected to Azure via a site-to-site VPN. What should you configure?

Accepted Answer

Enable AD DS authentication and configure a private endpoint for the storage account. Option D is correct because to use on-premises AD credentials, you need to enable AD DS authentication on the storage account, and use a private endpoint for connectivity. Option A is wrong because Azure AD DS uses cloud-only identities, not on-premises AD. Option B is wrong because firewall rules with IP expose the storage account to the internet. Option C is wrong because service endpoints still use a public endpoint.

Answer

Enable AD DS authentication and configure a virtual network service endpoint

Answer

Enable AD DS authentication and configure a firewall rule to allow the on-premises VPN gateway public IP

Answer

Enable Azure AD DS authentication and configure a service endpoint