AZ-500 Practice Questions 2 — 50 Questions

Question 1

A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.. Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.

Answer

Data Collection Rules (DCR) in Azure Monitor.

Answer

Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.

Answer

Use Azure Automation State Configuration.

Question 2

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

Accepted Answer

Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.. Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.

Answer

Configure a firewall rule to allow only corporate IP ranges.

Answer

Use storage account access keys to mount the file share.

Answer

Generate a shared access signature (SAS) with read permissions.

Question 3

A company has deployed Azure Firewall in a hub virtual network with forced tunneling enabled. Spoke virtual networks are peered to the hub. The security team reports that outbound traffic from the spoke VMs is bypassing the firewall. What is the most likely reason?

Accepted Answer

The spoke subnets do not have a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall.. Forced tunneling on Azure Firewall requires that all outbound traffic from spoke VMs is routed to the firewall via a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop. Without this route, traffic from spoke subnets will use the default system route and bypass the firewall, even if the firewall itself is configured with forced tunneling.

Answer

The Azure Firewall policy has an allow-all network rule.

Answer

Azure Firewall is deployed in the same virtual network as the spoke VMs.

Answer

The spoke virtual networks are not peered to the hub.

Question 4

Which TWO actions can be performed using Microsoft Defender for Cloud's 'Regulatory Compliance' dashboard?

Accepted Answer

Upload evidence documents for manual controls.. Options A and C are correct. The Regulatory Compliance dashboard in Microsoft Defender for Cloud displays compliance scores against specific regulatory standards and allows uploading evidence documents for manual controls. Option B is incorrect because automatic remediation of non-compliant resources is handled through Azure Policy, not directly from the compliance dashboard. Option D is incorrect because continuous export of compliance data is configured in the continuous export settings, not from the dashboard. Option E is incorrect because direct integration with third-party GRC tools is not available from the dashboard.

Answer

Automatically remediate non-compliant resources.

Answer

Configure continuous export of compliance data.

Answer

Integrate with third-party GRC tools directly from the dashboard.

Question 5

A security operations team uses Microsoft Sentinel. They want to create an automation that automatically changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is observed in the incident's entities. The playbook should run immediately when the incident is created. Which type of automation rule trigger should they configure?

Accepted Answer

When incident is created. The requirement specifies that the automation should run immediately when the incident is created. In Microsoft Sentinel, an automation rule with the trigger 'When incident is created' executes a playbook as soon as the incident is generated, before any updates occur. This allows the playbook to evaluate the incident's entities (e.g., IP addresses, hashes) and change the severity from 'Medium' to 'High' if a specific IOC is present, meeting the real-time response need.

Answer

When incident is updated

Answer

When alert is generated

Answer

Scheduled

Question 6

An analyst investigates a Defender for Cloud alert for suspicious process execution on a VM. Which next step best preserves evidence while enabling deeper endpoint investigation?

Accepted Answer

Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required. Pivoting to the Microsoft Defender for Endpoint device timeline allows the analyst to investigate the suspicious process execution in a forensically sound manner without disrupting the live environment. Isolating the device from the network, if needed, contains the threat while preserving volatile evidence such as running processes, memory, and registry state. This approach aligns with incident response best practices and leverages Defender for Endpoint's deep endpoint visibility.

Answer

Delete the VM immediately to stop the process

Answer

Disable all analytics rules in Sentinel

Answer

Rotate every subscription key before reviewing the process tree

Question 7

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Accepted Answer

Implement Azure Web Application Firewall (WAF). Azure Web Application Firewall (WAF) can inspect incoming HTTP/HTTPS traffic and block malicious payloads, including SQL injection attempts, before they reach the application or database. It provides a perimeter defense that filters out common attack patterns, reducing the attack surface for SQL injection.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure Azure SQL Database firewall rules

Answer

Enable Always Encrypted for sensitive columns

Question 8

You are designing a network security strategy for an Azure Kubernetes Service (AKS) cluster. You need to restrict egress traffic from the cluster to only allow connections to specific Azure services (e.g., Microsoft Container Registry, Azure Key Vault). The solution must minimize administrative overhead. What should you use?

Accepted Answer

Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.. Azure Firewall with FQDN tags allows you to define outbound network rules based on fully qualified domain names (FQDNs) for Azure services like Microsoft Container Registry and Azure Key Vault. This approach minimizes administrative overhead because FQDN tags are automatically updated as Azure service IP ranges change, eliminating the need for manual IP maintenance. It provides a centralized, managed firewall solution that integrates natively with AKS for egress filtering.

Answer

Configure Azure Policy to deny egress to non-approved destinations.

Answer

Use Kubernetes network policies for egress.

Answer

Define NSG rules to allow outbound traffic to the service IP ranges.

Question 9

You need to securely connect an on-premises network to Azure over the internet with encrypted traffic. The connection must be site-to-site and use IPsec. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway supports site-to-site (S2S) VPN connections over the internet using IPsec/IKE (IKEv1 or IKEv2) to encrypt traffic between an on-premises VPN device and Azure. This matches the requirement for an encrypted, internet-based site-to-site connection. ExpressRoute bypasses the internet entirely, Virtual WAN is a higher-level orchestration service that still relies on VPN Gateway for S2S IPsec, and Bastion is for RDP/SSH access to VMs without public IPs.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 10

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

Accepted Answer

Implement Always Encrypted and store the column encryption key in Azure Key Vault. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.

Answer

Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

Answer

Use Dynamic Data Masking to mask the credit card column for non-privileged users

Answer

Implement Azure SQL Database's Always Encrypted with enclaves

Question 11

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

Accepted Answer

Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Answer

Enable Azure AD Domain Services authentication and join the storage account to the managed domain.

Answer

Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.

Answer

Use storage account keys to mount the share and rely on Windows ACLs.

Question 12

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation. Option B is wrong because Azure Disk Encryption encrypts VM disks, not the Azure SQL Database. It does not meet the requirement for encrypting the database at rest. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access. Option D is wrong because Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Question 13

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Accepted Answer

Create suppression rules to automatically dismiss alerts that meet specific criteria.. Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts matching specific criteria, such as alert name, resource, or severity. This is useful for reducing noise from known benign activities without disabling the underlying security detection. Suppression rules are configured per alert type and can be set to expire after a defined period.

Answer

Directly modify the affected Azure resource's configuration from the alert.

Answer

Export alerts to a third-party SIEM using continuous export.

Answer

Change the severity of an alert after it is generated.

Question 14

You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?

Accepted Answer

Azure Monitor Logs (Log Analytics workspace). Azure Monitor Logs (Log Analytics workspace) is correct because it serves as the central ingestion and storage destination for network monitoring data. NSG flow logs capture IP traffic through Network Security Groups, and Traffic Analytics processes those raw flow logs to provide visualizations, top-talkers, and anomaly detection. Together, these three components enable comprehensive network traffic monitoring and security analysis for Azure VMs.

Answer

Azure Firewall logs

Answer

VNet flow logs

Question 15

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

Accepted Answer

The 'Use remote gateway' setting is disabled on the spoke VNet peering.. In a hub-spoke topology with Azure Firewall, the 'Use remote gateway' setting on the spoke VNet peering must be disabled. This setting is only for using a VPN or ExpressRoute gateway in the hub; it does not enable routing through Azure Firewall. With this setting disabled, the configured UDRs on the spoke subnets can direct spoke-to-spoke traffic to the firewall for inspection.

Answer

Azure Firewall does not support traffic between spoke VNets.

Answer

The UDR on the firewall subnet does not include the spoke address spaces.

Answer

The 'Allow gateway transit' setting is disabled on the spoke peering.

Question 16

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

Accepted Answer

The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.. When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.

Answer

The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

Answer

The NSG is not associated with the NIC because the command did not specify the NIC correctly.

Answer

The NSG rule should be an inbound rule to block outbound traffic.

Question 17

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 18

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 19

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

Accepted Answer

The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group. PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Answer

Users have permanent eligible assignments that bypass approval

Answer

The audit log is not enabled for PIM

Answer

Users are assigned the role directly instead of through eligibility

Question 20

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Answer

Playbooks

Answer

Incident settings in analytics rule

Answer

Workbooks