AZ-500 Practice Test 45 — 15 Questions

Question 1

You need to restrict access to a storage account containing sensitive financial data. The storage account is used by multiple Azure VMs and Azure App Service web apps. Only authorized applications and users should be able to access the storage account. Which TWO options should you implement?

Accepted Answer

Use managed identities for Azure resources to authenticate from App Service and VMs to the storage account.. Option A: Storage service endpoints restrict access to the storage account from specific VNets. Option C: Managed identities allow App Service to authenticate to storage without storing credentials. Option B (shared access keys) is broad and not recommended for fine-grained control. Option D (storage account keys) is even broader. Option E (Azure AD user delegation) is for user-level access, not service access.

Answer

Grant Azure AD user delegation permissions for each user accessing the storage account.

Answer

Configure shared access signature (SAS) tokens with a long expiration time for all applications.

Answer

Distribute storage account access keys to all application developers.

Question 2

Your company is deploying a new application on Azure Kubernetes Service (AKS). The application needs to read and write data to an Azure Storage account. Security requirements mandate that no storage account keys or connection strings be stored in the application code or configuration files. Which TWO actions should you take?

Accepted Answer

Configure the storage account firewall to allow access only from the AKS cluster's virtual network and subnet.. Option A: Using a managed identity for the pod (via AAD Pod Identity or Workload Identity) allows the pod to authenticate without secrets. Option D: Setting the storage account firewall to allow access only from the AKS cluster's VNet provides network-level security. Option B (service principal with client secret) still requires a secret. Option C (SAS token) also requires a secret. Option E (RBAC with storage account key) is not possible; RBAC does not use keys.

Answer

Generate a shared access signature (SAS) token and embed it in the application code.

Answer

Assign the 'Storage Account Key Operator Service Role' RBAC role to the AKS cluster.

Answer

Create a service principal with a client secret and use that secret in the application configuration.

Question 3

Your company uses Azure Managed Disks for VMs running a production database. The disks are encrypted with Azure Disk Encryption (ADE) using Azure Key Vault. Security policy requires that all encryption keys be rotated every 90 days. You have automated key rotation in Key Vault. However, after rotating the key, you find that the disks are still using the old key. You need to ensure that the disks use the new key after rotation. What should you do?

Accepted Answer

Disable encryption on the VM, then re-enable ADE specifying the new key version.. Option B is correct: ADE does not automatically re-encrypt disks after key rotation. You must disable encryption on the VM and then re-enable it with the new key version to force re-encryption. Option A: ADE does not support automatic re-encryption. Option C: Deleting the old key would break the VM. Option D: Updating the disk encryption set only affects new disks, not existing ones.

Answer

Delete the old key version from Key Vault to force the disk to use the new key.

Answer

No action is needed; ADE automatically re-encrypts disks with the new key after rotation.

Answer

Update the disk encryption set to reference the new key version; the disk will automatically use it.

Question 4

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Accepted Answer

Create suppression rules to automatically dismiss alerts that meet specific criteria.. Options A and B are correct. Defender for Cloud alerts support suppression rules and automated response via playbooks. Option C is wrong because Defender for Cloud does not directly modify resources; it triggers actions via playbooks. Option D is wrong because alerts can be dismissed. Option E is wrong because alert severity is set by Defender for Cloud, not by users.

Answer

Directly modify the affected Azure resource's configuration from the alert.

Answer

Export alerts to a third-party SIEM using continuous export.

Answer

Change the severity of an alert after it is generated.

Question 5

A company uses Microsoft Defender for Cloud to manage the security posture of multiple Azure subscriptions. The security team wants to ensure that all subscriptions are covered by the same Microsoft Defender for Cloud policy initiative, but one subscription is not showing compliance data. The subscription is in the same Azure AD tenant and has the same tags. What is the most likely cause?

Accepted Answer

The subscription is not registered with the Microsoft.Security resource provider.. Option C is correct because a subscription must be registered with the Microsoft Defender for Cloud resource provider (Microsoft.Security) to be assessed. Option A is wrong because user permissions do not affect compliance data generation. Option B is wrong because tags are not required for compliance scanning. Option D is wrong because the default policy initiative applies automatically; there is no need to assign it manually.

Answer

The user does not have Security Admin permissions on the subscription.

Answer

The subscription does not have any tags applied.

Answer

The subscription does not have the default policy initiative assigned.

Question 6

An organization uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that several VMs are not receiving vulnerability assessment findings, even though they are in a scope where the integrated Qualys VA solution is enabled. What should they verify first?

Accepted Answer

The VM does not have the Log Analytics agent installed.. Option B is correct because if the VM does not have the Log Analytics agent (or Azure Monitor Agent) installed, the Qualys extension cannot communicate findings. Option A is wrong because the vulnerability assessment solution is deployed at the subscription level, not per VM. Option C is wrong because the Qualys solution is included with Defender for Servers P2; no separate license is needed. Option D is wrong because network security groups are not the primary reason for missing findings; the agent is required.

Answer

The VM is in a resource group that is excluded from the vulnerability assessment solution.

Answer

The VM is behind a network security group that blocks outbound traffic.

Answer

The VM does not have a valid Qualys license.

Question 7

A security analyst needs to create a custom alert in Microsoft Defender for Cloud that triggers when a user creates a public IP address in the 'production' resource group. Which type of alert should they use?

Accepted Answer

Custom recommendation based on Azure Policy. Option D is correct because custom alerts in Defender for Cloud are created using custom recommendations based on Azure Policy. Option A is wrong because Azure Activity Log alerts are in Azure Monitor, not Defender for Cloud. Option B is wrong because Azure Sentinel analytics rules are for Sentinel, not Defender for Cloud. Option C is wrong because Microsoft Defender for Cloud does not have native custom alert rules via a portal wizard; it uses Azure Policy.

Answer

Azure Sentinel analytics rule

Answer

Azure Activity Log alert

Answer

Custom alert rule in Defender for Cloud

Question 8

Your company uses Microsoft Sentinel to monitor security events. You need to detect brute-force attacks against Azure VMs that are not yet onboarded to Sentinel. What should you do?

Accepted Answer

Use the Windows Security Events connector via Azure Monitor Agent.. Option C is correct because Windows and Linux VMs can be connected to Sentinel via the Azure Monitor Agent to stream security events. Option A is wrong because the connector for Azure Activity logs captures management plane events, not OS-level sign-in attempts. Option B is wrong because the Office 365 connector is for Microsoft 365 logs. Option D is wrong because the Common Event Format connector is for on-premises appliances, not Azure VMs.

Answer

Use the Office 365 connector to collect sign-in logs.

Answer

Use the Common Event Format connector to forward syslog.

Answer

Use the Azure Activity connector to collect sign-in logs.

Question 9

A security team uses Microsoft Defender for Cloud's regulatory compliance dashboard to track compliance with PCI DSS. They notice that some controls are marked as 'N/A' even though they have relevant resources. What is the most likely reason?

Accepted Answer

The resources are in a subscription that is not included in the scope of the compliance standard.. Option A is correct because the regulatory compliance dashboard by default only assesses resources that are in scope for the selected standard. If a subscription or resource group is not included in the scope, controls will show as 'N/A'. Option B is wrong because the dashboard only assesses resources, not manual claims. Option C is wrong because the dashboard uses built-in assessments; it does not require custom assessments. Option D is wrong because the dashboard is available even without a compliance manager license.

Answer

The resources do not have the required custom assessment.

Answer

The compliance dashboard requires a Microsoft Purview Compliance Manager license.

Answer

The resources have not been manually claimed as compliant.

Question 10

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory. Which two data connectors are necessary to collect sign-in logs and audit logs?

Accepted Answer

Azure Active Directory Sign-in logs and Azure Active Directory Audit logs. Option A is correct because Azure Active Directory logs require two connectors: one for Sign-in logs and one for Audit logs. Option B is wrong because the Office 365 connector does not include Azure AD logs. Option C is wrong because the Azure Activity connector is for Azure subscription management logs. Option D is wrong because the Security Events connector is for VMs.

Answer

Azure Activity and Azure Active Directory Audit logs

Answer

Office 365 and Azure Active Directory Sign-in logs

Answer

Security Events and Azure Active Directory Sign-in logs

Question 11

An organization uses Microsoft Defender for Cloud to protect Azure SQL databases. They want to receive alerts when a SQL database is accessed from a suspicious location. What should they enable?

Accepted Answer

Enable Microsoft Defender for Cloud for Azure SQL databases. Option D is correct because Microsoft Defender for Cloud for Azure SQL databases includes threat detection that alerts on anomalous access patterns, including suspicious locations. Option A is wrong because Advanced Threat Protection is the feature name, but it is enabled under Microsoft Defender for Cloud. Option B is wrong because Azure SQL Database auditing logs activity but does not generate alerts. Option C is wrong because Azure Firewall logs network traffic but does not generate SQL-specific alerts.

Answer

Enable Azure Firewall on the SQL server

Answer

Enable Azure SQL Database Advanced Threat Protection

Answer

Enable Azure SQL Database Auditing

Question 12

Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?

Accepted Answer

Create a Fusion analytics rule. Option A is correct because the best approach is to create a fusion rule, which uses machine learning to correlate multiple signals like unfamiliar sign-in and Azure activity. Option B is wrong because scheduled query rules require writing KQL and can correlate but fusion is simpler for this scenario. Option C is wrong because NRT rules are for near-real-time single events. Option D is wrong because anomaly rules detect outliers but not multi-step correlation.

Answer

Run a custom anomaly detection job

Answer

Create a Scheduled analytics rule with a KQL query

Answer

Create a Near-Real-Time (NRT) analytics rule

Question 13

A security analyst needs to view all incidents generated by Microsoft Defender for Cloud across multiple subscriptions in a single pane of glass. What should they use?

Accepted Answer

Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud provides a unified dashboard that aggregates security alerts and incidents from all subscriptions in the tenant. Option A is wrong because Azure Security Center has been replaced by Defender for Cloud. Option C is wrong because Azure Monitor alerts are separate from Defender for Cloud incidents. Option D is wrong because Microsoft Sentinel can ingest Defender for Cloud alerts but is not required for a unified view.

Answer

Azure Monitor

Answer

Azure Security Center

Answer

Microsoft Sentinel

Question 14

You need to ensure that Microsoft Sentinel can detect threats across your Azure environment, including virtual machines, network traffic, and user activities. Which TWO data sources should you connect?

Accepted Answer

Windows Security Events via AMA. Option A and Option B are correct because Azure Activity logs provide management plane activities, and Windows Security Events provide OS-level events from VMs. Option C is wrong because Azure DNS logs are not a standard Sentinel connector. Option D is wrong because Azure Firewall logs are for specific firewall traffic, not broad network traffic. Option E is wrong because Office 365 logs are for Microsoft 365, not Azure VMs.

Answer

Azure DNS

Answer

Office 365

Answer

Azure Firewall

Question 15

A security analyst reports that Microsoft Sentinel is not receiving Windows Security Events from Azure VMs that have the Log Analytics agent installed. The agent shows as connected, and other data sources (e.g., performance counters) are flowing. What is the most likely cause?

Accepted Answer

The Windows Security Events connector is not configured to collect the required event IDs.. Option D is correct because the Windows Security Events connector in Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Log Analytics workspace key or certificate issue would affect all data, not just security events. Option B is wrong because if the agent is connected, network connectivity is fine. Option C is wrong because the Microsoft Sentinel solution is installed at the workspace level, not per VM.

Answer

The Microsoft Sentinel solution is not installed on the VM.

Answer

The Azure VM has a network security group blocking port 443.

Answer

The Log Analytics workspace key is incorrect.