AZ-500 Practice Test 44 — 15 Questions

Question 1

You are configuring Microsoft Defender for Cloud for an Azure subscription. You want to receive email notifications when a high-severity alert is generated. What should you configure?

Accepted Answer

The Email notifications settings in Microsoft Defender for Cloud.. Microsoft Defender for Cloud includes a built-in email notification feature that allows you to specify recipients and severity levels for alerts. This is the simplest and most direct method to receive email notifications for high-severity alerts. It does not require additional services like Azure Monitor, Microsoft Sentinel, or Log Analytics, and it is designed specifically for this purpose.

Answer

Azure Monitor action groups with an email action.

Answer

A Microsoft Sentinel analytics rule with an email playbook.

Answer

A Log Analytics workspace with a scheduled query alert.

Question 2

You are the identity security engineer for a company that uses Microsoft Entra ID. A new security policy requires that any user who is assigned the Global Administrator role must use a phishing-resistant authentication method when signing in. You need to enforce this requirement with the least administrative effort. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the Global Administrator directory role and requires an authentication strength of Phishing-resistant MFA.. A Conditional Access policy scoped to directory roles and combined with an authentication strength requirement is the supported way to mandate phishing-resistant MFA for privileged users. Authentication strengths map to method combinations such as FIDO2 security keys and certificate-based authentication, giving you granular, role-based enforcement.

Answer

Configure a per-user MFA setting for each Global Administrator and disable SMS and voice call methods.

Answer

Enable security defaults for the tenant and require all users to register for Microsoft Authenticator.

Answer

Assign a Microsoft Entra ID P1 license to each Global Administrator and enable self-service password reset with number matching.

Question 3

You are a security engineer for a company that uses Microsoft Defender for Cloud. The security team wants to automatically trigger a Logic App playbook when a high-severity alert is generated for an Azure Storage account. The playbook must run without manual intervention. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender for Cloud that triggers the playbook on alerts with severity High and resource type Storage accounts.. Automation rules in Microsoft Defender for Cloud are the native way to automatically respond to security alerts. They can filter by alert severity, resource type, and other properties, and then trigger a Logic App playbook. This provides a no-code, scalable solution that meets the requirement for automatic execution without manual intervention. Other options either require custom code or apply to the wrong resource type.

Answer

Configure a diagnostic setting to stream alerts to an event hub and use Azure Functions to invoke the playbook.

Answer

Enable just-in-time (JIT) VM access on the storage account and attach the playbook to the JIT policy.

Answer

Create an Azure Monitor action group that triggers the playbook when an alert is fired, and assign the action group to the storage account.

Question 4

You are a security administrator for a company that stores sensitive data in Azure Blob Storage. The data must be encrypted at rest with a customer-managed key (CMK) stored in Azure Key Vault, and the key must be automatically rotated every 90 days. You need to configure the storage account to meet these requirements. What should you do?

Accepted Answer

Configure the storage account to use a customer-managed key from Key Vault and set the key rotation policy in Key Vault to 90 days.. To use a customer-managed key for Azure Storage encryption, you must configure the storage account to reference a key in Key Vault. Key Vault's rotation policy can automatically rotate the key on a schedule, and the storage account will use the latest version if configured to do so. This provides automatic key rotation without manual intervention, satisfying the 90-day requirement.

Answer

Use a customer-provided key (CPK) on each blob upload and configure an Azure Automation runbook to rotate the key every 90 days.

Answer

Enable infrastructure encryption on the storage account and set the key rotation policy in Key Vault to 90 days.

Answer

Create a new customer-managed key in Key Vault every 90 days and manually update the storage account to use the new key.

Question 5

You are a security engineer at Fabrikam. The company has an Azure virtual network that contains a subnet named WebSubnet with a network security group (NSG) named NSG1. You need to ensure that inbound HTTP traffic from the internet is allowed to the web servers in WebSubnet, but only when the traffic originates from a specific set of public IP addresses used by a partner company. The partner's IP addresses are 203.0.113.0/24 and 198.51.100.10. What should you configure in NSG1?

Accepted Answer

Create an inbound security rule with source set to the two partner IP addresses, destination port 80, protocol TCP, and action Allow. Set a lower priority number than any deny rule.. Network security groups evaluate rules by priority, with lower numbers processed first. To allow inbound HTTP only from specific partner IP addresses, you create an Allow rule with those source addresses and a priority lower than any Deny rule that might block other traffic. This ensures the partner traffic is permitted while other internet traffic can be denied by a later, higher-numbered rule.

Answer

Create an outbound security rule with source set to the two partner IP addresses, destination port 80, and action Allow, and apply it to WebSubnet.

Answer

Create an inbound security rule with source set to the two partner IP addresses, destination port 80, protocol TCP, and action Deny, and then create a lower-priority Allow rule for all other traffic.

Answer

Configure a service tag named Internet as the source and use an application security group (ASG) as the destination, with an Allow rule for port 80.

Question 6

You manage a Microsoft Sentinel workspace. Your security operations team wants to automatically notify the on-call analyst via Microsoft Teams whenever a new high-severity incident is created, and also create a corresponding ticket in ServiceNow. The team does not want to write code. Which Microsoft Sentinel feature should you use to accomplish this?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel provide a no-code way to trigger playbooks based on incident creation, severity, or other conditions. By creating an automation rule that runs when a high-severity incident is created, you can launch a playbook that posts to Microsoft Teams and creates a ServiceNow ticket. This satisfies the requirement without writing code.

Answer

Workbooks

Answer

Watchlists

Answer

Analytics rules

Question 7

You are a security engineer for a company that uses Microsoft Entra ID. The company has a policy that users must sign in using Windows Hello for Business or a FIDO2 security key. You need to block legacy authentication protocols that do not support these methods. What should you configure?

Accepted Answer

Create a Conditional Access policy that targets all users and all cloud apps, and set the client apps condition to 'Exchange ActiveSync clients' and 'Other clients', then set access control to 'Block'.. To block legacy authentication, you must use Conditional Access to target client apps that use legacy protocols. The 'Exchange ActiveSync clients' and 'Other clients' conditions specifically cover clients that do not support modern authentication. Setting the access control to 'Block' ensures these clients cannot sign in. Other options do not directly block legacy protocols; they address different security aspects such as risk, baseline defaults, or authentication methods.

Answer

Enable security defaults in Microsoft Entra ID.

Answer

Create an authentication method policy that disables SMS and voice call methods.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block sign-ins with medium or high risk.

Question 8

You are the Azure Security Engineer for a healthcare company that stores patient imaging data in an Azure Storage account. The compliance team requires that all data written to the account be encrypted with a customer-managed key stored in Azure Key Vault, and that this key be automatically rotated every 12 months. You configure a customer-managed key for the storage account. Which additional configuration must you apply to meet the automatic rotation requirement?

Accepted Answer

In Azure Key Vault, configure a key rotation policy on the customer-managed key that rotates the key every 12 months.. Customer-managed keys for Azure Storage encryption are stored in Azure Key Vault. To automatically rotate the key, you configure a rotation policy on the key itself in Key Vault. The storage account should reference the key without a specific version so that it always uses the latest key version. This native integration ensures seamless rotation without manual intervention or custom scripting.

Answer

Create an Azure Automation runbook that updates the storage account encryption key version every 12 months.

Answer

Enable Azure Defender for Storage and set the key rotation period in the Defender for Cloud security policy.

Answer

In the storage account's encryption settings, set the key rotation interval to 12 months and enable auto-rotation.

Question 9

You are a security engineer for a company that uses Azure SQL Database. The database contains sensitive financial data and is currently encrypted with Transparent Data Encryption (TDE) using a service-managed key. A new policy requires that the TDE protector be a customer-managed key stored in Azure Key Vault, and that the key be automatically rotated every 90 days. You have created an Azure Key Vault and generated a key. What should you do next to meet the policy?

Accepted Answer

Configure the SQL server's TDE protector to use the customer-managed key from Key Vault, and enable auto-rotation on the key.. To meet the policy, you must set the Azure SQL logical server's TDE protector to the customer-managed key stored in Azure Key Vault. Azure Key Vault supports automatic key rotation, which can be configured for 90-day rotation. This ensures the database is encrypted with a customer-managed key and the key is rotated regularly. Other options either address different features (Always Encrypted) or involve unnecessary migration.

Answer

Create a new Azure SQL Database with the customer-managed key as the TDE protector, and migrate the data.

Answer

Enable Always Encrypted on the database and use the customer-managed key for column encryption.

Answer

Store the customer-managed key in Azure Key Vault and configure the database to use it for backup encryption.

Question 10

You are the Azure Security Engineer for a company that uses Azure SQL Database. A recent security audit requires that all connections to the database be encrypted and that the database reject any unencrypted connections. You need to enforce this requirement with the least administrative effort. What should you do?

Accepted Answer

Enable the 'Enforce SSL connection' setting on the Azure SQL Database server.. The 'Enforce SSL connection' setting on the Azure SQL Database server forces all connections to use TLS encryption. When enabled, any attempt to connect without encryption is rejected. This directly satisfies the requirement to encrypt all connections and reject unencrypted ones, and it requires only a single configuration change.

Answer

Configure a firewall rule on the Azure SQL Database server to allow only connections from specific IP addresses.

Answer

Implement Always Encrypted on all sensitive columns in the database.

Answer

Enable Transparent Data Encryption (TDE) on the Azure SQL Database.

Question 11

You are a security engineer for a healthcare company that stores patient records in an Azure Storage account. A compliance requirement mandates that all data in the storage account be encrypted at rest using a key that the company controls and can revoke at any time. The storage account is currently configured with Microsoft-managed keys for encryption. You need to change the encryption key management to meet the compliance requirement. What should you do first?

Accepted Answer

Create an Azure Key Vault and generate a customer-managed key, then configure the storage account to use that key for encryption.. To meet the requirement of encrypting data at rest with a customer-managed key, you must create an Azure Key Vault, generate a key, and configure the storage account to use that key for encryption. This ensures the organization controls the key lifecycle, including revocation. Other options either address different encryption aspects (in-transit) or use Microsoft-managed keys, which do not provide the required control.

Answer

Enable Azure Disk Encryption on the storage account to use customer-managed keys.

Answer

Enable Secure transfer required on the storage account to enforce encryption in transit.

Answer

Configure the storage account to use infrastructure encryption with Microsoft-managed keys.

Question 12

You are the Azure Security Engineer for a company that uses Microsoft Entra ID. The security team wants to enforce that any user who is assigned the 'Privileged Role Administrator' role must activate it through Privileged Identity Management (PIM) with multi-factor authentication (MFA) and approval. You have already enabled PIM for the role. Which two actions must you perform to meet these requirements? (Choose two.)

Accepted Answer

In the PIM role settings for 'Privileged Role Administrator', configure the 'Require multi-factor authentication on activation' setting to 'Yes'.. To enforce MFA and approval for PIM role activation, you must configure the role settings: set 'Require multi-factor authentication on activation' to 'Yes' and set 'Require approval to activate' with approvers. These settings apply to the role itself and are enforced when a user attempts activation. Other options like conditional access or eligible assignment do not meet the specific activation-time requirements.

Answer

Enable 'Just-in-time' (JIT) access for the role in PIM.

Answer

Assign the user as an eligible member of the 'Privileged Role Administrator' role.

Answer

Create a conditional access policy that requires MFA for all users when they access the Azure portal.

Question 13

You administer an Azure environment with Microsoft Defender for Cloud enabled. A security analyst reports that a suspicious process was executed on a virtual machine, but no alert was found in the portal. You need to ensure that Defender for Cloud can detect and alert on suspicious activities on the VM. What should you do?

Accepted Answer

Ensure the Microsoft Defender for Servers plan is enabled and that the Azure Monitor Agent is installed on the VM.. To detect suspicious process execution on a VM, Defender for Cloud must have the Defender for Servers plan enabled, which deploys the Azure Monitor Agent and integrates with Microsoft Defender for Endpoint. This combination provides deep endpoint detection and response capabilities, including process-level monitoring. Other options either use outdated agents or focus on network controls, which do not fulfill the requirement.

Answer

Configure a custom alert rule in Azure Monitor to trigger on specific process creation events.

Answer

Enable the Log Analytics agent and configure a data collection rule to forward Security events.

Answer

Enable just-in-time (JIT) VM access to restrict inbound traffic and log connection attempts.

Question 14

You are a security engineer for Litware. The company has an Azure virtual network named VNet1 that contains an Azure Bastion host and several VMs. The VMs have public IP addresses, but the security team wants to eliminate all public IP exposure while still allowing administrators to connect via RDP and SSH from the internet. You need to recommend a solution that meets these requirements with the least administrative effort. What should you do?

Accepted Answer

Remove the public IP addresses from the VMs and configure Azure Bastion in VNet1. Administrators connect to the VMs through the Azure portal using the Bastion host.. Azure Bastion offers secure RDP and SSH access from the Azure portal without public IPs on VMs. Deploying Bastion in VNet1 and removing VM public IPs meets the security requirement with minimal administrative effort, as administrators use the portal directly and no VPN or firewall configuration is needed.

Answer

Remove the public IP addresses from the VMs and create a site-to-site VPN connection from each administrator's workstation to VNet1.

Answer

Keep the public IP addresses but restrict inbound RDP and SSH to the administrators' source IP addresses using a network security group on the VM subnet.

Answer

Remove the public IP addresses from the VMs and deploy an Azure Firewall with DNAT rules to forward RDP and SSH traffic to the VMs.

Question 15

You are a security engineer for a company that uses Microsoft Sentinel. The security operations center (SOC) wants to automatically assign new incidents to the on-call analyst based on the incident's severity and product name. You need to configure this with minimal administrative effort. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created and uses conditions on severity and product name to assign the incident to a specific owner.. Automation rules in Microsoft Sentinel are the native mechanism for automatically triaging incidents. They can trigger on incident creation, evaluate conditions such as severity and product name, and perform actions like assigning an owner. This approach requires minimal configuration and directly addresses the SOC's requirement without the overhead of building a playbook.

Answer

Use an analytics rule that groups related alerts into incidents and sets the owner based on severity and product name.

Answer

Configure a playbook that runs on incident creation and uses the 'Update incident' action to assign the incident to the on-call analyst.

Answer

Modify the incident settings in Microsoft Sentinel to enable automatic assignment of incidents to the on-call analyst based on severity and product name.