AZ-500 Practice Questions 1 — 50 Questions

Question 1

A company plans to enable Azure Disk Encryption (ADE) on a fleet of Windows virtual machines. They want to use a key stored in Azure Key Vault to encrypt the disks. Which additional access configuration must be made in the Key Vault to allow ADE to succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Azure Disk Encryption service principal (Microsoft.Azure.Security) appropriate key permissions in the Key Vault access policy.. Azure Disk Encryption (ADE) uses the Azure platform's built-in service principal (Microsoft.Azure.Security) to access the Key Vault and retrieve the disk encryption key. Without granting this service principal the necessary 'Get', 'WrapKey', and 'UnwrapKey' key permissions in the Key Vault access policy, ADE cannot authenticate and perform the encryption operations. This is a mandatory configuration step for ADE to succeed.

Answer

Assign a managed identity to each VM and grant that identity key permissions in the Key Vault.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Assign the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal.

Question 2

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.. Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Answer

Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.

Answer

Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.

Answer

Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

Question 3

A company is designing a hub-spoke network topology with Azure Firewall in the hub virtual network. Spoke virtual networks are peered to the hub. They want to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. However, traffic is still bypassing the firewall. What is the most likely cause?

Accepted Answer

The route table is not associated to the spoke subnet.. The most likely cause is that the route table with the default route (0.0.0.0/0) pointing to the Azure Firewall's private IP has not been associated to the spoke subnet. Without this association, the route table is not applied to the subnet's traffic, so the default system route (which directs internet traffic directly to the internet) remains in effect, bypassing the firewall. Associating the route table to the subnet is a required step for user-defined routes (UDRs) to influence traffic flow.

Answer

The Azure Firewall is in a different region than the spoke VNet.

Answer

The Azure Firewall does not have the correct network and application rules configured.

Answer

The spoke VNet has the 'Use remote virtual network gateways' setting disabled.

Question 4

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

Accepted Answer

The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.. The workbook likely has a time range filter set to 'Last 7 days', but the underlying KQL query uses a hardcoded 24-hour filter. This mismatch causes the query to return data only for the last 24 hours, but the dashboard filter may interfere or the query may be incorrectly referencing the time parameter. As a result, no data is displayed. Option A is incorrect because workbooks rely on KQL queries regardless of visualization type. Option B is incorrect because the Log Analytics gateway is used for on-premises data, not for Azure AD sign-in logs which stream directly to the workspace. Option D is incorrect because the problem statement confirms sign-in logs are being received.

Answer

The workbook uses a different visualization type that requires KQL.

Answer

The Log Analytics gateway is blocking the sign-in logs.

Answer

The Log Analytics workspace is not receiving sign-in logs from Azure AD.

Question 5

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.. When Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Answer

Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.

Answer

Enable soft-delete on the Key Vault.

Answer

Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

Question 6

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

Accepted Answer

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'. Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Answer

Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

Answer

Use Identity Protection's 'User risk policy' instead of Conditional Access

Answer

Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'

Question 7

A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks and have a single web application. Which Azure DDoS Protection tier should they use?

Accepted Answer

DDoS Protection Basic (default). DDoS Protection Basic is automatically enabled for all Azure resources at no additional cost, providing always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks. Since the company has a single web application and only needs protection against Layer 3/4 DDoS attacks, the Basic tier is sufficient and requires no configuration or extra cost.

Answer

DDoS Protection Standard

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Front Door with DDoS Protection Standard

Question 8

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

Accepted Answer

Blob Storage change feed.. The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Answer

Azure Blob Storage soft delete.

Answer

Azure Blob Storage versioning.

Answer

Azure Storage analytics logs.

Question 9

Drag and drop the steps to configure Azure Disk Encryption for a Windows VM using Azure Key Vault into the correct order.

Accepted Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.. The correct sequence for configuring Azure Disk Encryption for a Windows VM using Azure Key Vault is to first create or configure the Key Vault with soft-delete and purge protection, then set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions, and finally enable disk encryption on the VM specifying the Key Vault and key. This order ensures that all prerequisites are met, preventing errors during the encryption process.

Answer

1. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.

Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Answer

1. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Question 10

A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?

Accepted Answer

Two inbound rules: one to allow HTTPS, and one to deny all other traffic. Network Security Groups (NSGs) contain default inbound security rules: AllowVNetInBound (priority 65000) and AllowAzureLoadBalancerInBound (priority 65001). These default rules would permit HTTPS traffic from sources within the virtual network or from Azure Load Balancer, violating the requirement to allow HTTPS only from the specific IP range 198.51.100.0/24. Therefore, an explicit deny-all rule must be added with a higher priority (lower numerical value) than the default allow rules to block all other traffic, including that from VNet and Azure Load Balancer. The minimal set is: one rule to allow HTTPS from 198.51.100.0/24 (high priority), and one rule to deny all inbound traffic from any source (at a slightly lower priority but still above the default rules). Option A is insufficient because it relies on the default deny rule (priority 65500), which is processed after the default allow rules, so VNet and Load Balancer traffic would still be permitted.

Answer

One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'

Answer

Three inbound rules: allow HTTPS, allow RDP for management, and deny all

Answer

One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'

Question 11

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 12

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Question 13

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 14

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Azure AD, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Azure AD tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 15

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

Accepted Answer

Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score. The Microsoft Defender for Cloud dashboard in the Azure portal naturally aggregates secure scores at the management group level when you select the root management group. This provides a single dashboard view with drill-down capability into individual management groups without any additional configuration, minimizing administrative overhead. Option A is incorrect because exporting to a Log Analytics workspace and creating a custom workbook adds unnecessary complexity and overhead for a simple aggregated view. Option B is incorrect because integrating with Power BI requires additional setup and licensing, and is not the simplest approach. Option D is incorrect because building a custom dashboard using the REST API requires development effort and maintenance, which is more overhead than using the built-in dashboard.

Answer

Export the secure score to a Log Analytics workspace and create a custom workbook

Answer

Integrate Defender for Cloud with Microsoft Power BI and create a report

Answer

Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard

Question 16

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

A default encryption scope is configured on the blob container that uses a Microsoft-managed key.. When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Answer

The Key Vault is in a different Azure region than the storage account.

Answer

The storage account does not have a system-assigned managed identity enabled.

Answer

The customer-managed key in Key Vault is disabled or expired.

Question 17

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

Accepted Answer

Azure AD Application Proxy.. Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Answer

Azure AD B2C (Business-to-Consumer).

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Front Door.

Question 18

A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.

Answer

Enable container soft delete with a retention period of 30 days

Answer

Enable blob versioning

Question 19

A company is enabling Azure Disk Encryption (ADE) on Windows virtual machines. They have enabled soft-delete on Azure Key Vault and configured a Key Encryption Key (KEK). However, the disk encryption fails with an error indicating that the key vault does not have the required permissions. What is the most likely missing configuration?

Accepted Answer

The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.. Azure Disk Encryption (ADE) requires the Azure Disk Encryption service principal (also known as the Azure Disk Encryption service) to have 'unwrap key' and 'wrap key' permissions on the Key Vault. These permissions allow the service to encrypt and decrypt the disk encryption keys using the Key Encryption Key (KEK). Without these specific cryptographic permissions, the encryption operation fails, even if soft-delete and a KEK are correctly configured.

Answer

The Key Vault firewall is blocking the Azure platform.

Answer

The VM does not have a managed identity assigned.

Answer

The KEK is in a different Azure region than the VM.

Question 20

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

Accepted Answer

No, Azure does not support CMK from a different region than the storage account.. Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Answer

Yes, but the storage account must use a different key vault per region; no other implications.

Answer

Yes, but you must enable cross-region replication for the key vault and pay additional costs.

Answer

Yes, but you must use a managed identity from the storage account's region to access the key vault.