AZ-500 Practice Exam 60 — 20 Questions

Question 1

A company uses Azure Managed Disks for their virtual machines. They want to ensure that all managed disks are encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also want to automatically revoke access to the disks if the key is disabled or deleted. Which feature should they configure?

Accepted Answer

Server-side encryption with customer-managed keys (SSE-CMK). Server-side encryption with customer-managed keys (SSE-CMK) encrypts Azure Managed Disks at rest using a key stored in Azure Key Vault. When the key is disabled or deleted, Azure automatically revokes access to the disk by failing any I/O operations that require that key, ensuring the disk becomes inaccessible. This directly meets the requirement for both CMK-based encryption and automatic access revocation upon key loss.

Answer

Azure Disk Encryption (ADE) with a Key Encryption Key (KEK)

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys

Answer

Azure Key Vault soft-delete and purge protection

Question 2

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.. Option C is correct because when Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Answer

Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.

Answer

Enable soft-delete on the Key Vault.

Answer

Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

Question 3

An Azure Storage account is configured with server-side encryption (SSE) using a customer-managed key stored in Azure Key Vault. The security team requires that the storage account's identity be used to authenticate to the key vault for key access. Additionally, they want the identity to be automatically deleted when the storage account is deleted. Which type of identity should they assign to the storage account?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied to the lifecycle of the Azure resource (the storage account) and is automatically deleted when the resource is deleted. This identity can be used to authenticate to Azure Key Vault for accessing the customer-managed key used in server-side encryption (SSE), satisfying the security team's requirement for automatic deletion upon storage account deletion.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Azure AD user account

Question 4

You are designing a secure storage strategy for an Azure Storage account that will host sensitive financial data. The solution must protect data at rest, in transit, and during processing. Which three of the following security controls should you implement? (Choose three.)

Accepted Answer

Enable Azure Storage encryption using customer-managed keys (CMK) stored in Azure Key Vault.. Customer-managed keys (CMK) in Azure Key Vault provide an additional layer of protection for data at rest by allowing you to control the encryption keys used by Azure Storage. Azure Defender for Storage detects anomalous access patterns and potential threats, protecting data during processing. Configuring firewalls and virtual network service endpoints restricts network access, securing data in transit by ensuring only trusted networks can communicate with the storage account.

Answer

Enable Azure Storage analytics logging with retention set to 90 days.

Answer

Configure a shared access signature (SAS) token with full account-level permissions for each user.

Answer

Use Azure Traffic Manager to distribute storage requests across multiple regions.

Question 5

You are a Security Engineer for a company that is migrating critical workloads to Azure. You need to ensure the security of compute, storage, and databases. Which of the following actions should you take? (Choose four.)

Accepted Answer

Use Azure Disk Encryption (ADE) to encrypt managed disks attached to virtual machines using BitLocker (Windows) or DM-Crypt (Linux).. Enabling Azure Defender for SQL provides security alerts and vulnerability assessments for Azure SQL databases, which is essential for securing database workloads. This action directly addresses the requirement to ensure the security of databases by detecting threats and identifying misconfigurations.

Answer

Implement Azure Front Door WAF policies to protect against SQL injection and cross-site scripting attacks on virtual machines.

Answer

Use Azure Backup for virtual machines without enabling soft delete to ensure immediate permanent deletion of backup data.

Question 6

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Option B is correct because deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 7

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.. Option B is correct because Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Answer

Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.

Answer

Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.

Answer

Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

Question 8

A company uses Azure Key Vault to store keys and secrets. They want to ensure that even if an administrator accidentally deletes a key, it can be recovered for up to 90 days. Additionally, they want to prevent anyone from permanently purging the key during that period. Which two features must be enabled?

Accepted Answer

Soft-delete and purge protection. Soft-delete must be enabled to retain a deleted key for a configurable retention period (default 90 days), allowing recovery. Purge protection must be enabled to prevent permanent deletion (purging) of the key during that retention period, even by administrators. Together, these two features ensure the key can be recovered and cannot be permanently deleted for up to 90 days.

Answer

Purge protection and access policies

Answer

Soft-delete and backup

Question 9

You are the security engineer for a financial services company that has multiple Azure subscriptions. The company uses Azure Virtual WAN with a secured hub containing Azure Firewall. Recently, the compliance team identified that traffic between two spoke virtual networks (SpokeA and SpokeB) is bypassing the firewall. Investigation shows that SpokeA and SpokeB are directly peered and have not been routed through the hub. The requirement is that all inter-spoke traffic must be inspected by Azure Firewall. You need to enforce this without disrupting existing applications. Also, the company uses Azure Firewall Manager for policy management and wants to use Azure Policy to prevent future direct peering. What should you do first?

Accepted Answer

Remove the VNet peering between SpokeA and SpokeB.. Option B is correct because the immediate issue is the direct peering bypassing the firewall. Removing the peering forces traffic to go through the hub via Virtual WAN routing. Option A is wrong because a UDR would not override the peering. Option C is wrong because Azure Policy prevents future peering but does not fix existing. Option D is wrong because disabling routing would break connectivity.

Answer

Disable 'Use remote virtual network gateways' on both spokes.

Answer

Create an Azure Policy to deny VNet peering between spokes.

Answer

Add a user-defined route in SpokeA and SpokeB pointing to the Azure Firewall for inter-spoke traffic.

Question 10

A small business has a single Azure subscription with one virtual network containing two subnets: 'Frontend' for web servers and 'Backend' for database servers. The web servers need to access the internet to download updates, but the database servers must not have any outbound internet access. The business also needs to allow remote administration of the web servers from the internet via RDP (port 3389) but only from the IT department's public IP range (203.0.113.0/24). You need to configure network security to meet these requirements using Azure-native services. What should you do?

Accepted Answer

Create an NSG for the Frontend subnet with an inbound rule allowing RDP from 203.0.113.0/24, and a default deny for outbound. Then create an NSG for the Backend subnet with a default deny outbound rule.. Option A is correct because an NSG on the Frontend subnet can allow outbound internet (implicit allow) and restrict inbound RDP to the IT IP range. Another NSG on the Backend subnet can deny all outbound internet. Option B is wrong because Azure Firewall is overkill for this simple scenario. Option C is wrong because network virtual appliances add complexity. Option D is wrong because a VPN does not provide outbound internet control.

Answer

Use a network virtual appliance (NVA) for outbound inspection and configure RDP access via a jump box.

Answer

Create a site-to-site VPN from the IT department to Azure and use Azure Bastion for RDP access.

Answer

Deploy Azure Firewall in the virtual network and configure DNAT rules for RDP and outbound rules for internet access.

Question 11

You are a security engineer at Fabrikam Inc. The company has an Azure subscription with a single virtual network (VNet1) that contains a production workload. The network is connected to an on-premises data center via a site-to-site VPN. The security team requires that all Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines in VNet1 must be brokered through Azure Bastion. Additionally, the team wants to ensure that no public IP addresses are assigned to any virtual machines in the production environment. Currently, there are several VMs with public IPs. You need to implement the requirements with minimal downtime. The solution must also ensure that administrators can access the VMs using Azure Bastion without any additional client software. What should you do?

Accepted Answer

Deploy Azure Bastion in the virtual network and then remove the public IP addresses from all VMs.. Option C is correct. Azure Bastion provides RDP/SSH access via the Azure portal without public IPs. To minimize downtime, you should deploy Bastion first, then remove public IPs from VMs. The other options either cause downtime (disassociate first) or don't meet the requirement (JIT still needs public IPs).

Answer

Create a point-to-site VPN for administrators and remove public IPs from VMs.

Answer

Deploy Azure Bastion in the virtual network, then configure Just-In-Time (JIT) VM access for all VMs.

Answer

Disassociate public IPs from all VMs, then deploy Azure Bastion in the same virtual network.

Question 12

Your organization has deployed a multi-region web application using Azure Front Door with WAF policies. The backend origins are Azure App Services in two regions. Recently, a security audit revealed that the WAF is not blocking certain SQL injection attacks. You have identified that the WAF policy is configured in 'Detection' mode instead of 'Prevention' mode. However, the application team is concerned that changing to 'Prevention' mode might block legitimate traffic. You need to switch to 'Prevention' mode while minimizing false positives. Additionally, you want to ensure that any blocked requests are logged for analysis. What should you do?

Accepted Answer

Create a custom WAF policy with SQL injection rules in Prevention mode, and enable diagnostic logs.. Option D is correct because using a WAF policy with prevention mode and custom rules for the SQL injection signatures allows fine-tuning, and enabling diagnostic logs captures blocked requests. Option A is wrong because rate limiting does not address SQL injection. Option B is wrong because changing mode without custom rules may cause false positives. Option C is wrong because Bot Protection does not address SQL injection.

Answer

Change the WAF policy to Prevention mode and enable logging.

Answer

Use the WAF policy's Bot Protection rule set and Prevention mode.

Answer

Enable rate limiting in the WAF policy and switch to Prevention mode.

Question 13

You have a Microsoft Sentinel workspace that ingests data from multiple sources, including Azure Activity, Microsoft Entra ID, and Azure Firewall. You need to create a custom analytics rule that detects when a user signs in from an IP address that has been flagged as malicious in a threat intelligence feed. You have already imported threat intelligence indicators into Sentinel using the 'Threat Intelligence - TAXII' data connector. The threat intelligence indicators are stored in the 'ThreatIntelligenceIndicator' table. Which KQL function should you use in the analytics rule to match sign-in logs against the threat indicators?

Accepted Answer

threat_intelligence_check_ip. The function that matches IP addresses against threat intelligence indicators is 'threat_intelligence_check_ip'. Option C is correct. Option A is for matching URLs. Option B is not a valid function. Option D checks for IP matches but is not specific to threat intelligence.

Answer

threat_intelligence_check_url

Answer

threat_intelligence_check_hash

Answer

ipv4_lookup

Question 14

You are configuring Microsoft Defender for Cloud's 'Workload protections' for a Kubernetes cluster that is already using Azure Kubernetes Service (AKS). The cluster has 'Azure Policy' enabled. You need to enable the 'Microsoft Defender for Containers' plan to protect the cluster. You have already enabled the plan at the subscription level. However, the cluster is not showing as protected in the 'Inventory' blade. You have confirmed that the 'Azure Policy for Kubernetes' add-on is installed. What should you do to ensure the cluster is protected?

Accepted Answer

Install the 'Defender profile' on the AKS cluster.. Even with the subscription-level plan enabled, you need to install the 'Defender profile' on the AKS cluster. Option D is correct. Option A is incorrect because the cluster is not protected yet. Option B is incorrect because enabling Azure Policy for Kubernetes is a separate step. Option C is incorrect because the agents are deployed via the Defender profile.

Answer

Enable the 'Azure Policy for Kubernetes' add-on on the cluster.

Answer

Wait for 24 hours for the protection to automatically apply.

Answer

Install the Log Analytics agent on the cluster nodes.

Question 15

Your company has a hub-spoke network topology in Azure. The hub VNet contains an Azure Firewall. Spoke VNets are peered to the hub. You need to ensure that all outbound traffic from virtual machines in a spoke VNet passes through the Azure Firewall for inspection. Which two configurations are required? (Choose two.)

Accepted Answer

Configure an application rule or network rule on Azure Firewall to allow outbound traffic. Option B is correct because a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP must be associated with the spoke subnet. Option D is correct because the firewall must be configured to allow or deny outbound traffic. Option A is wrong because VNet peering is already in place; no additional peering is needed. Option C is wrong because Azure Firewall doesn't require a public IP for outbound inspection if using private IP; also NAT rules are for inbound. Option E is wrong because forced tunneling is a different concept; the route table handles this.

Answer

Configure a DNAT rule on Azure Firewall to translate outbound traffic

Answer

Create a new VNet peering between the spoke and hub

Answer

Enable forced tunneling on the spoke VNet

Question 16

Which TWO of the following are authentication methods supported by Microsoft Entra ID?

Accepted Answer

Certificate-based authentication (CBA). Certificate-based authentication (CBA) is a supported authentication method in Microsoft Entra ID that allows users to authenticate using X.509 certificates issued by a trusted Certificate Authority (CA). This method is commonly used for passwordless authentication, especially in hybrid environments where smart cards or device certificates are deployed. Entra ID validates the certificate chain and maps the certificate to a user object, enabling secure sign-in without a password.

Answer

Security questions

Answer

Smart card with PIN

Answer

OAuth 2.0 authorization code flow

Question 17

Which THREE Microsoft Entra ID roles can be assigned to a user to manage Microsoft Defender XDR (formerly Microsoft 365 Defender) incidents? (Choose three.)

Accepted Answer

Security Administrator. The Security Administrator role (Option B) can manage Microsoft Defender XDR incidents because it grants full access to security features, including the ability to view, investigate, and respond to incidents in the Microsoft 365 Defender portal. This role is designed for users who need to manage security policies and incidents without having full administrative control over the tenant.

Answer

Exchange Administrator

Answer

Global Reader

Question 18

Which THREE are best practices for securing network traffic in Azure? (Choose three.)

Accepted Answer

Use private endpoints for Azure services. Private endpoints assign a private IP address from your virtual network to an Azure service (e.g., Azure Storage, SQL Database), effectively bringing the service into your VNet. This ensures traffic to the service traverses the Microsoft backbone network rather than the public internet, eliminating data exposure to the public endpoint and reducing the attack surface. It is a core network segmentation best practice for securing PaaS resources.

Answer

Assign public IP addresses to every VM

Answer

Allow direct outbound internet access from VMs

Question 19

Which TWO are valid connection methods for Azure VPN Gateway? (Choose two.)

Accepted Answer

Point-to-Site. Point-to-Site (P2S) is a valid connection method for Azure VPN Gateway because it allows individual client computers to connect securely to an Azure virtual network from anywhere using the SSTP, IKEv2, or OpenVPN protocols. This method is ideal for remote workers who need encrypted access without requiring a site-level VPN device.

Answer

VNet-to-VNet

Answer

Azure Bastion

Answer

ExpressRoute

Question 20

Which TWO of the following are valid methods to secure outbound traffic from an Azure virtual network to the internet?

Accepted Answer

Azure Firewall. Azure Firewall is a fully managed, cloud-native network security service that provides stateful inspection of outbound traffic. It can enforce application and network rules based on FQDN, IP addresses, ports, and protocols, making it a valid method to secure outbound internet traffic from an Azure virtual network.

Answer

Private endpoints

Answer

Service endpoints

Answer

Azure VPN Gateway