AZ-500 Practice Exam 56 — 20 Questions

Question 1

Refer to the exhibit. You are reviewing a Conditional Access policy JSON definition. What is the MOST likely result of this policy?

Accepted Answer

All users accessing Office 365 from trusted locations will be blocked.. Option B is correct: The policy targets Office 365 applications and blocks access from trusted locations, which is the opposite of typical security requirements. Option A is wrong because the policy blocks access, not requires MFA. Option C is wrong because external identities are not explicitly included; the policy applies to 'All' users. Option D is wrong because low sign-in risk is not a condition here.

Answer

Users with low sign-in risk accessing Office 365 from trusted locations will be blocked.

Answer

Only external guest users accessing Office 365 from any location will be blocked.

Answer

All users accessing Office 365 from trusted locations will be required to perform MFA.

Question 2

You are reviewing an Azure Policy definition. You need to determine the effect of this policy when a user attempts to create a new storage account with 'Secure transfer required' set to 'Disabled'. What happens?

Accepted Answer

The creation request is denied.. Option A is correct because the policy denies creation of storage accounts where 'supportsHttpsTrafficOnly' is false (i.e., 'Secure transfer required' is disabled). Option B is wrong because the policy does not audit; it denies. Option C is wrong because the policy does not modify. Option D is wrong because it denies the operation.

Answer

The storage account is created but 'Secure transfer required' is automatically enabled.

Answer

The creation is allowed but an audit event is generated.

Answer

The creation is allowed and no action is taken.

Question 3

You are a security engineer for a large enterprise that uses Azure Virtual WAN with multiple ExpressRoute circuits connecting on-premises data centers to Azure. The company has recently acquired a subsidiary that uses a different Azure tenant. The subsidiary has its own virtual networks and wants to connect to the parent company's Azure Virtual WAN to share resources. The security requirement is that traffic must be encrypted over the public internet, and the connection must be established without any on-premises hardware. You need to recommend a solution to securely connect the subsidiary's Azure virtual network to the parent's Virtual WAN. The solution should minimize administrative overhead and use Azure-native services.

Accepted Answer

Deploy a VPN gateway in the subsidiary's virtual network and connect it to the parent's Virtual WAN VPN gateway using site-to-site VPN.. Option B is correct. A VPN gateway can be deployed in the subsidiary's virtual network and connected to the Virtual WAN's VPN gateway over the internet using IPsec, meeting the encryption requirement and without any on-premises hardware. Option A is wrong because ExpressRoute is a private connection that does not traverse the public internet and requires on-premises equipment. Option C is wrong because Virtual WAN supports transitive routing, but the subsidiary's VNet must be connected via a VPN gateway or ExpressRoute; VNet peering alone does not provide encryption. Option D is wrong because Azure Bastion is for RDP/SSH access, not for network connectivity.

Answer

Deploy Azure Bastion in both VNets and use it to route traffic between them.

Answer

Use Virtual WAN's built-in VNet-to-VNet transitive routing by peering the subsidiary's VNet to the parent's VNet.

Answer

Establish an ExpressRoute circuit from the subsidiary's Azure region to the parent's region.

Question 4

You are designing network security for a multi-tier application. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. Both tiers are in the same virtual network. Which Azure service should you use to restrict traffic between the tiers?

Accepted Answer

Network Security Group (NSG). Option C is correct because a Network Security Group (NSG) can be associated with the subnet or NIC of the database tier to allow only inbound traffic from the web tier's private IP addresses or subnet. Option A is wrong because Application Security Groups (ASGs) are used to group VMs but still require NSG rules. Option B is wrong because Azure Firewall is a managed firewall, but it's overkill and costlier than an NSG for simple subnet-to-subnet filtering. Option D is wrong because a route table controls routing, not filtering.

Answer

Route table

Answer

Azure Firewall

Answer

Application Security Groups (ASGs)

Question 5

A company is deploying Azure Bastion to provide secure RDP/SSH access to VMs in a virtual network. The security requirement is that all administrative access must be logged and audited. What additional configuration is needed to meet this requirement?

Accepted Answer

Enable diagnostic settings on Azure Bastion to send logs to a Log Analytics workspace.. Option D is correct because Azure Bastion integrates with Azure Monitor to capture logs of connections (e.g., who connected, from where, and duration). Option A is wrong because NSG flow logs do not capture Bastion activity; they log traffic to/from VMs. Option B is wrong because Azure Activity Log captures management plane operations, not data plane RDP/SSH sessions. Option C is wrong because enabling diagnostics on the VM itself would log OS-level events, but Bastion sessions are proxied; the VM logs would not include Bastion metadata.

Answer

Enable NSG flow logs on the subnet containing the target VMs.

Answer

Enable Azure Activity Log for the Bastion resource.

Answer

Configure diagnostic settings on the target VMs to send logs to Log Analytics.

Question 6

Your organization uses Azure Storage to host sensitive financial data. You need to ensure that all access to the storage account is encrypted in transit and that access keys are rotated automatically every 90 days. You also need to prevent access from public IP addresses. Which combination of configurations should you implement?

Accepted Answer

Enable 'Secure transfer required', configure key rotation policy, and set 'Public network access' to 'Disabled'. Option B is correct because enabling 'Secure transfer required' enforces HTTPS, automatic key rotation can be configured in the storage account settings, and the 'Selected networks' firewall with a deny-all default rule blocks public IPs. Option A is wrong because disabling public network access alone does not enforce HTTPS. Option C is wrong because firewall rules do not enforce HTTPS. Option D is wrong because disabling anonymous access does not enforce HTTPS.

Answer

Configure a network firewall rule to block all traffic, enable 'Secure transfer required', and rotate keys manually every 90 days

Answer

Enable 'Allow trusted Microsoft services', configure key rotation policy, and disable 'Allow storage account key access'

Answer

Enable 'Secure transfer required', configure key rotation policy, and disable 'Allow Blob public access'

Question 7

A company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. The security team wants to ensure that all outbound internet traffic from VMs in the spokes flows through the Azure Firewall. What should be configured?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. Option B is correct because a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall as the next hop, applied to the subnets in the spoke VNets, forces all outbound traffic through the firewall. Option A is wrong because Azure Firewall does not support network security group (NSG) next hops. Option C is wrong because the route table must be associated with the spoke subnets, not the hub subnet. Option D is wrong because VPN gateway does not filter traffic; Azure Firewall is needed.

Answer

Configure forced tunneling on the VPN gateway to route all traffic through the Azure Firewall.

Answer

Create a route table with a default route to the VPN gateway and associate it with the hub subnet.

Answer

Configure an NSG on the spoke subnets with a rule that sends traffic to the Azure Firewall.

Question 8

A company uses Azure Front Door (AFD) with WAF policy in front of a web application. The security team notices that some requests from a specific IP range are being blocked incorrectly. The WAF policy uses custom rules. The team wants to allow a specific IP range while still having the WAF inspect other traffic. What is the most efficient way to configure this?

Accepted Answer

Create a custom rule with priority 1, action 'Allow', and match condition for the source IP range.. Option A is correct because custom rules are evaluated before managed rule sets, and a rule with priority 1 and action 'Allow' for the IP range will allow that traffic, bypassing later rules (including managed rules). Option B is wrong because managed rule sets apply to all traffic after custom rules, so disabling them for that range is not granular. Option C is wrong because rate limiting is for limiting request rates, not for allowing specific IPs. Option D is wrong because 'Block' action would block the IP range, not allow it.

Answer

Add a custom rule with priority 100, action 'Block', and match condition for the IP range.

Answer

Add a rate limit rule that allows traffic from the IP range.

Answer

Disable the managed rule sets for the specific IP range using a geo-match condition.

Question 9

A company uses Microsoft Sentinel to centralize security logs. They need to ensure that incidents from Microsoft Defender XDR are synchronized into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Defender XDR connector. Option B is correct because the Microsoft Defender XDR connector ingests incidents and alerts from Defender XDR into Sentinel. Option A is wrong because the Office 365 connector is for Office logs. Option C is wrong because the Azure Activity connector is for Azure resource logs. Option D is wrong because the Windows Security Events connector is for Windows events.

Answer

Office 365 connector

Answer

Windows Security Events connector

Answer

Azure Activity connector

Question 10

A company uses Azure Firewall Premium to inspect outbound traffic. They want to deploy a web application that must comply with the Payment Card Industry Data Security Standard (PCI DSS). Which TWO capabilities should be enabled to meet PCI DSS requirements for network security?

Accepted Answer

Intrusion Detection and Prevention System (IDPS). Options A and D are correct. TLS inspection allows the firewall to decrypt and inspect HTTPS traffic, which is often required for compliance. IDPS provides signature-based detection of threats, meeting the requirement for intrusion detection/prevention. Option B is wrong because DNS proxy is not a PCI DSS requirement. Option C is wrong because URL filtering is about web categories, not specifically required by PCI DSS. Option E is wrong because SNAT is a function of NAT, not a compliance feature.

Answer

URL filtering

Answer

DNS proxy

Answer

Source Network Address Translation (SNAT)

Question 11

A SOC team uses Microsoft Sentinel. They want to create an analytics rule that detects excessive failed logons from a single IP address. The rule must run every 5 minutes and look back 1 hour. Which THREE components are required to configure this scheduled query rule?

Accepted Answer

Kusto Query Language (KQL) query. Options A, C, and E are correct. A KQL query defines the detection logic (A). An incident configuration is required to create incidents from alerts (C). An alert threshold (e.g., 'Generate alert based on number of results') is required to specify the number of failed logons that trigger an alert (E). Option B is wrong because a playbook is optional, not required. Option D is wrong because a fusion rule is a different type of analytics rule, not a component of a scheduled query rule.

Answer

Fusion rule

Answer

Playbook

Question 12

Refer to the exhibit. An Azure Firewall Policy snippet is shown. A security administrator deploys this policy to the Azure Firewall. However, they receive reports that some VMs can still access the internet. What is the most likely reason?

Accepted Answer

There is another rule collection with a higher priority that allows traffic.. Option C is correct. In Azure Firewall Policy, rules within a rule collection are evaluated in priority order, but a rule collection group contains multiple rule collections. If there is another rule collection with a higher priority (lower number) that allows traffic, that rule will be evaluated first and the traffic will be allowed, bypassing the deny rule. Additionally, the rule collection group itself must be assigned to the firewall policy. Option A is wrong because the source address "*" covers all VMs. Option B is wrong because the destination "Internet" is a valid service tag. Option D is wrong because the rule explicitly uses the Deny action.

Answer

The destination "Internet" is not a valid service tag; it should be "*" for all destinations.

Answer

The action type "Deny" is misspelled; it should be "Deny".

Answer

The sourceAddresses field uses "*" which is not supported for outbound rules.

Question 13

Your company has a large number of Azure SQL databases that contain personally identifiable information (PII). You need to classify and protect sensitive columns across all databases. The solution must automatically discover and label sensitive data, and enable auditing of access to that data. What should you implement?

Accepted Answer

Data Discovery & Classification. Option D is correct because Azure SQL Database's Data Discovery & Classification automatically discovers sensitive columns, allows labeling, and integrates with auditing and vulnerability assessment. Option A is wrong because Dynamic Data Masking only masks data, it does not classify. Option B is wrong because Always Encrypted encrypts data at rest, but does not classify or audit. Option C is wrong because Microsoft Defender for SQL provides security alerts and vulnerability assessment, but not classification.

Answer

Always Encrypted with secure enclaves

Answer

Microsoft Defender for SQL

Answer

Dynamic Data Masking

Question 14

You need to secure a Linux virtual machine running a web application in Azure. The solution must ensure that only traffic on port 443 (HTTPS) is allowed from the internet, and that SSH access is restricted to a management subnet. What should you configure?

Accepted Answer

Network Security Group (NSG) on the VM NIC with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound. Option A is correct because an NSG with inbound rules that allow HTTPS from any source and SSH only from the management subnet achieves the goal. Option B is wrong because Azure Firewall is more complex and costly than needed. Option C is wrong because a network security group attached to the subnet would affect all VMs. Option D is wrong because Application Security Groups are used for grouping VMs, not for filtering traffic.

Answer

Azure Firewall with application rules to allow HTTPS and SNAT SSH traffic

Answer

Application Security Group with a network security group that allows HTTPS and SSH

Answer

Network Security Group on the subnet with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound

Question 15

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to ensure that only approved container images from a private Azure Container Registry (ACR) can run in the cluster. The solution must also enforce that pods run with least privilege. What should you configure?

Accepted Answer

Apply Azure Policy with built-in initiatives 'Kubernetes cluster containers should only use allowed images' and 'Kubernetes cluster pods should use specified service account'. Option C is correct because Azure Policy for AKS can enforce image source from ACR and restrict pod security policies (via built-in initiatives). Option A is wrong because ACR tasks are for building images, not enforcement. Option B is wrong because Azure AD pod-managed identities are for authentication, not image enforcement. Option D is wrong because Kubernetes network policies control traffic, not image source or privileges.

Answer

Create a Kubernetes NetworkPolicy to restrict pod-to-pod communication and use Secrets for image pull

Answer

Configure ACR tasks to scan images for vulnerabilities and use AKS pod security policies

Answer

Use Azure AD pod-managed identities to authenticate to ACR and assign RBAC roles

Question 16

Your organization has enabled Microsoft Defender for Cloud on all subscriptions. You need to ensure that the security score is improved by implementing recommendations. Which TWO actions would directly improve the secure score?

Accepted Answer

Remediate a high-severity recommendation for a SQL database. Options A and E are correct because remediating a high-severity recommendation increases the secure score, and enabling automatic provisioning of the Log Analytics agent is a recommendation that, when implemented, increases the score. Option B is wrong because enabling Just-In-Time VM access is a security control but does not directly affect the score; it may be a recommendation, but not all controls are scored. Option C is wrong because assigning Azure Policy does not directly improve the score; the score improves when resources comply. Option D is wrong because configuring email notifications does not affect the score.

Answer

Enable Just-In-Time VM access on all virtual machines

Answer

Configure email notifications for high-severity alerts

Answer

Assign a custom Azure Policy initiative

Question 17

Your company plans to use Azure SQL Managed Instance to store customer data. You need to comply with regulatory requirements for data encryption at rest and in transit, and you must ensure that only authorized applications can access the database. Which TWO actions should you take? (Choose two.)

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys. Options B and D are correct. Transparent Data Encryption (TDE) encrypts data at rest. 'Force encryption' in the connection string ensures data in transit is encrypted. Option A is wrong because Always Encrypted protects specific columns, not the entire database at rest. Option C is wrong because Azure AD authentication provides identity, not encryption. Option E is wrong because VNet rules control network access, not encryption.

Answer

Configure a virtual network rule to allow only specific subnets

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure Azure AD authentication for the managed instance

Question 18

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

Accepted Answer

Enable the 'SQL servers on machines' plan in Microsoft Defender for Cloud. Option B is correct because for on-premises SQL servers with Azure Arc, the SQL servers must be registered as Azure Arc-enabled SQL Server instances and the Microsoft Defender for Cloud plan for SQL servers must be enabled at the subscription level. Option A is wrong because Azure Policy can enforce but doesn't directly cause missing alerts. Option C is wrong because Log Analytics workspace is used for data collection, but the core issue is plan enablement. Option D is wrong because Azure Firewall logs are unrelated to SQL specific alerts.

Answer

Deploy the Log Analytics agent to the SQL servers

Answer

Configure Azure Firewall logs for SQL traffic

Answer

Assign the 'Configure Azure Defender for SQL agents on virtual machines' policy

Question 19

A company uses Microsoft Defender for Cloud to protect Azure resources. The security team wants to automatically remediate certain recommendations without manual intervention. They decide to use Azure Policy to enforce secure configurations. Which feature in Defender for Cloud allows them to create policy assignments directly from the recommendation?

Accepted Answer

Enforce. Option C is correct because the 'Enforce' button on a recommendation allows creating a policy assignment that enforces the recommendation via Azure Policy. Option A is wrong because 'Quick fix' remediates a single resource, not enforces policy. Option B is wrong because 'Assign policy' button directly does this; 'View policy definition' only shows the definition. Option D is wrong because 'Remediate' triggers a remediation task on existing resources, not enforcing policy on new resources.

Answer

Remediate

Answer

View policy definition

Answer

Quick fix

Question 20

A security operations team uses Microsoft Sentinel to monitor sign-in logs. They receive frequent false positive alerts for 'Anonymous IP address sign-in' from a specific external IP range used by a trusted partner. The analysts want to suppress these alerts without reducing detection coverage. What is the most efficient approach?

Accepted Answer

Create an alert suppression rule for the specific IP range in the analytics rule. Option C is correct because creating an alert suppression rule in Microsoft Sentinel allows analysts to suppress alerts from specific IP ranges without modifying the underlying analytics rule. Option A is wrong because disabling the analytics rule removes detection entirely. Option B is wrong because watchlists are used for correlation, not suppression. Option D is wrong because automation rules can run actions but not suppress alerts directly; suppression is a built-in feature of analytics rules.

Answer

Add the trusted IP range to a watchlist and reference it in the analytics rule query

Answer

Use an automation rule to close the incidents automatically

Answer

Disable the analytics rule that generates the alert

AZ-500 Practice Exam 56 — 20 Questions

Exhibit

AZ-500 Practice Exam 56 — 20 Questions

Exhibit