AZ-500 Practice Exam 64 — 20 Questions

Question 1

You executed the PowerShell script shown in the exhibit to set a token lifetime policy for an application. What is the effect on users accessing the application?

Accepted Answer

Access tokens expire after 2 hours. The PowerShell script sets an access token lifetime of 2 hours via the `New-AzureADPolicy` cmdlet with `TokenLifetimePolicy` type. This policy is then assigned to a specific service principal (application) using `Add-AzureADServicePrincipalPolicy`. Therefore, for users accessing that application, access tokens will expire after 2 hours, requiring a new token to be obtained once the lifetime is exceeded.

Answer

Session tokens expire after 1 hour

Answer

The policy applies to all applications in the tenant

Answer

Users are forced to reauthenticate every hour

Question 2

Refer to the exhibit. You are reviewing user sign-in activity using Microsoft Graph API. The user has not performed an interactive sign-in since December 1, but had a non-interactive sign-in on December 5. You need to determine if the user should be considered inactive for a policy that defines inactivity as no interactive sign-in for 30 days. Today is December 15. What should you do?

Accepted Answer

Use the lastSignInDateTime of December 1, which is only 14 days ago, so the user is not inactive.. Option C is correct because the policy defines inactivity as no interactive sign-in for 30 days. The user's last interactive sign-in was on December 1, which is only 14 days ago as of December 15, so the user is not inactive. Microsoft Graph API's lastSignInDateTime property specifically tracks interactive sign-ins, while non-interactive sign-ins are tracked separately via lastNonInteractiveSignInDateTime and do not reset the interactive inactivity timer.

Answer

Check if the user has any sign-in in the last 30 days; since there is a non-interactive sign-in, the user is active.

Answer

Use the lastNonInteractiveSignInDateTime as the last sign-in time, so the user is not inactive.

Answer

The user is inactive because the account is enabled but there is no interactive sign-in in the last 30 days.

Question 3

Users report that they are prompted for MFA every time they sign in, even on trusted devices. You need to reduce the frequency of MFA prompts while maintaining security. What should you configure?

Accepted Answer

Enable the 'Remember MFA for trusted devices' setting in MFA settings.. Option C is correct because enabling 'Remember MFA for trusted devices' allows users to bypass MFA prompts for a configurable number of days on devices the user marks as trusted. This reduces the frequency of MFA prompts while maintaining security, as the trust is tied to a persistent token stored on the device. The setting is configured in the Azure AD MFA service settings, not in Conditional Access policies.

Answer

Set the 'Number of days before reauthentication' to 0.

Answer

Disable MFA for trusted locations.

Answer

Adjust the sign-in session lifetime in Conditional Access.

Question 4

Your company has deployed Microsoft Defender for Cloud in all subscriptions. You need to ensure that all Azure SQL databases are protected by Advanced Threat Protection (ATP). You want to enable ATP at the subscription level so that new databases are automatically protected. The security policy must be enforced to prevent administrators from disabling ATP on individual databases. What should you do?

Accepted Answer

Create a custom Azure Policy with a 'Deny' effect that prevents setting the Advanced Threat Protection setting to 'Disabled' on SQL databases.. Option B is correct because it uses a custom Azure Policy with a 'Deny' effect to enforce that Advanced Threat Protection (ATP) cannot be disabled on any SQL database, including new ones. This approach ensures that the security policy is enforced at the subscription level, preventing administrators from turning off ATP on individual databases, which aligns with the requirement for automatic protection and enforcement.

Answer

Create an Azure Policy assignment using the built-in policy 'Advanced Threat Protection should be enabled on your SQL servers' with a 'Deny' effect.

Answer

Enable the 'Azure SQL databases' plan in Defender for Cloud at the subscription level.

Answer

Create an Azure Policy assignment that audits if Advanced Threat Protection is enabled on SQL databases, and remediate non-compliant resources.

Question 5

Your organization, Fabrikam, uses Microsoft Entra ID and has recently deployed Microsoft Copilot for Azure to assist administrators with troubleshooting. You need to ensure that access to Copilot for Azure is restricted to a specific group of security administrators and that all interactions are logged for compliance. You have created a security group named 'Copilot-Admins' and assigned it the appropriate role. However, you notice that users outside this group can still access Copilot for Azure. Additionally, you need to ensure that all Copilot interactions are stored in a Log Analytics workspace for analysis. What should you do?

Accepted Answer

Create a Conditional Access policy that requires the user to be a member of 'Copilot-Admins' and enable diagnostic settings for Copilot to send logs to Log Analytics. Option B is correct because Conditional Access policies in Microsoft Entra ID can enforce access controls based on group membership, ensuring only members of 'Copilot-Admins' can access Copilot for Azure. Additionally, diagnostic settings for Copilot can be configured to stream all interaction logs to a Log Analytics workspace, meeting the compliance requirement for logging and analysis.

Answer

Configure PIM to require approval for Copilot access

Answer

Use Azure Policy to deny access to Copilot for users not in the group

Answer

Assign the 'Copilot-Admins' group the 'Reader' role to the Copilot service

Question 6

You are the security administrator for a company that is integrating a third-party SaaS application (AppA) with Microsoft Entra ID for single sign-on (SSO). The application requires the following permissions: read all users, read all groups, and sign in users. The security team is concerned about over-privileged applications. They require that:

- The application must not be able to read users or groups without an admin's explicit consent.
- Users should be able to sign in to the application without admin consent for basic profile access.
- Admin consent must be granted only for the minimal permissions required.
- You must be able to review and audit all permissions granted to applications.

What should you do?

Accepted Answer

In Microsoft Entra ID, configure user consent settings to require admin consent for permissions classified as 'high risk' (e.g., User.Read.All, Group.Read.All). Allow user consent for low-risk permissions. Grant admin consent for the required Graph permissions.. Option A is correct because you can configure user consent settings to require admin consent for high-risk permissions (User.Read.All, Group.Read.All) while allowing user consent for low-risk permissions like profile access. Admin consent must be granted for Graph permissions. Option B is wrong because blocking all user consent would prevent users from signing in for basic profile. Option C is wrong because allowing all user consent would allow users to consent to high-risk permissions. Option D is wrong because blocking all OAuth apps is too restrictive.

Answer

Allow user consent for all permissions. Grant admin consent for Graph permissions.

Answer

Block all user consent and require admin consent for all permissions. Grant admin consent for all required permissions.

Answer

Block all OAuth 2.0 applications and use SAML-based SSO instead.

Question 7

You are a security administrator for a healthcare organization that uses Microsoft Entra ID and Microsoft 365. The organization must comply with HIPAA regulations, which require that access to protected health information (PHI) is logged and monitored. You need to configure access reviews for all users who have access to SharePoint Online sites containing PHI. The reviews must occur quarterly and be assigned to the respective site owners. Additionally, you need to ensure that inactive guest accounts are automatically removed after 90 days of inactivity. Which actions should you take?

Accepted Answer

Create an access review for the security group containing users with access to PHI sites. Assign reviewers as group owners (site owners). Set frequency to quarterly. Configure external collaboration settings to automatically remove guest accounts that have not signed in for 90 days.. Option A is correct because access reviews can be configured for groups and applications, assigned to site owners, and set to quarterly frequency. Inactive guest cleanup is configured in Entra ID external settings. Option B is wrong because PIM access reviews are for privileged roles, not general access to SharePoint sites. Option C is wrong because Identity Protection does not manage access reviews. Option D is wrong because manual removal of guests is not automated and does not scale.

Answer

Enable Microsoft Entra ID Protection to automatically block guest accounts after 90 days of inactivity. Create manual access reviews for each site using PowerShell.

Answer

Use Microsoft Purview to create an auto-labeling policy for PHI data. Assign site owners as reviewers and manually remove inactive guests.

Answer

Create a PIM access review for the SharePoint administrator role. Set frequency to quarterly. Configure Microsoft Entra ID to automatically delete guest accounts after 90 days of inactivity.

Question 8

You are the security architect for a large enterprise that uses Microsoft Entra ID with 50,000 users. The company recently adopted a cloud-first strategy and is migrating on-premises applications to Azure. You need to design a secure identity and access solution that meets the following requirements:

- All access to cloud applications must be authenticated using modern authentication protocols.
- Legacy authentication protocols (such as POP3, IMAP4, SMTP, and basic authentication) must be blocked.
- Users must be required to use multi-factor authentication (MFA) when accessing any application from outside the corporate network.
- Administrative access to Azure resources must be time-bound and require approval.
- The solution must minimize user friction for internal users on the corporate network.
- All sign-in risks must be detected and automatically remediated.

You have deployed Microsoft Entra ID P2 licensing and configured Microsoft Defender for Cloud Apps. Which of the following is the most appropriate combination of actions to meet all requirements?

Accepted Answer

Create a Conditional Access policy to block legacy authentication and require MFA for all users when accessing from outside the corporate network. Exclude trusted locations from MFA. Use PIM with approval for admin roles. Enable Identity Protection for risk detection and automatic remediation.. Option B is correct because it addresses all requirements: Conditional Access policies block legacy auth, require MFA from outside, and include trusted locations for no MFA. PIM provides time-bound admin access with approval. Identity Protection detects and remediates risks. Option A is wrong because Security defaults would block legacy auth but enforce MFA globally, causing friction for internal users. Option C is wrong because allowing legacy auth for some users violates the requirement to block all legacy auth. Option D is wrong because device compliance does not block legacy auth, and PIM without approval does not meet the approval requirement.

Answer

Enable Security defaults for all users and configure risk-based Conditional Access policies for admin roles. Use PIM for time-bound access.

Answer

Configure device compliance policies in Intune and require compliant devices for access. Use PIM with time-bound roles but without approval. Enable Identity Protection for risk detection.

Answer

Create a Conditional Access policy to require MFA for all cloud apps and allow legacy authentication for non-interactive service accounts. Use PIM without approval for admin roles.

Question 9

You are the identity security engineer for a multinational company that uses Microsoft Entra ID. The company has recently experienced a security breach where an attacker compromised a non-administrator user account and then used that account to enumerate all users in the tenant. The attacker then attempted to brute-force passwords for high-privilege accounts. To prevent such attacks, management requires the following:

- Users with administrative roles must use phishing-resistant MFA.
- Any sign-in from a risky IP address must be blocked.
- Users must not be able to enumerate directory information via the Graph API unless they have a specific role.
- The solution should be implemented using built-in Microsoft Entra ID features.

What should you configure?

Accepted Answer

Configure Conditional Access policy with authentication strength for admins requiring phishing-resistant MFA. Configure Identity Protection sign-in risk policy to block risky sign-ins. Restrict access to the Graph API by requiring a specific role assignment.. Option C is correct. Phishing-resistant MFA can be enforced via Conditional Access with authentication strength. Sign-in risk policies in Identity Protection can block sign-ins from risky IPs. To prevent directory enumeration, you can restrict access to the Graph API using Conditional Access or application permissions. Option A is wrong because Security defaults enforce MFA but do not block all enumeration. Option B is wrong because PIM does not block enumeration. Option D is wrong because access reviews do not block enumeration.

Answer

Enable Security defaults and configure Identity Protection user risk policy to block high-risk users.

Answer

Configure Conditional Access policy for admins to require phishing-resistant MFA. Use PIM to require approval. Enable Identity Protection sign-in risk policy.

Answer

Configure PIM for all admin roles. Create access reviews for all users. Enable Identity Protection to detect risky sign-ins.

Question 10

Your company, Contoso Ltd., has a hybrid network with an on-premises data center in Chicago and an Azure subscription with a single virtual network (VNet1) in the East US region. VNet1 has multiple subnets: Web, App, and Data. The Web subnet hosts a load-balanced web application accessible from the internet via a public IP. The App subnet contains application servers that communicate with an on-premises database server in Chicago. The Data subnet contains Azure SQL databases. You have an ExpressRoute circuit connecting Chicago to East US with private peering. Recently, the security team discovered that some traffic from the App subnet to the on-premises database is bypassing the ExpressRoute and traversing the internet, causing latency and security concerns. You must ensure all traffic between VNet1 and the on-premises network uses the ExpressRoute connection. Additionally, you need to restrict inbound internet traffic to only the Web subnet, and all outbound internet traffic from the App and Data subnets must be inspected by an Azure Firewall deployed in a new subnet called AzureFirewallSubnet in VNet1. You have the following requirements: 1. All traffic to/from on-premises must use ExpressRoute. 2. Only the Web subnet should be directly accessible from the internet. 3. Outbound internet traffic from App and Data subnets must be routed through Azure Firewall. 4. Minimize management overhead. Which of the following is the most appropriate course of action?

Accepted Answer

Add a user-defined route (UDR) to the App and Data subnets with destination 0.0.0.0/0 and next hop set to the Azure Firewall private IP. Ensure the route to on-premises via ExpressRoute is present (system route or UDR).. Option B is correct because system routes already have a 0.0.0.0/0 route to the internet, and a route to the on-premises network via ExpressRoute. To force all outbound internet traffic through Azure Firewall, you need a UDR on the App and Data subnets with next hop to the firewall. For on-premises traffic, the system route via ExpressRoute should be sufficient, but if traffic is bypassing, you may need to propagate more specific routes. Option A is wrong because removing the 0.0.0.0/0 system route is not allowed. Option C is wrong because VPN Gateway adds complexity and cost. Option D is wrong because Azure Firewall alone does not enforce ExpressRoute usage.

Answer

Create a new Azure Firewall policy that blocks all outbound traffic except through ExpressRoute.

Answer

Remove the default 0.0.0.0/0 route from all subnets and add a route for on-premises via ExpressRoute.

Answer

Deploy a VPN Gateway and configure forced tunneling to send all traffic to on-premises for inspection.

Question 11

You have an Azure virtual network (VNet1) with two subnets: SubnetA and SubnetB. SubnetA hosts web servers that must be accessible from the internet. SubnetB hosts application servers that should only be accessible from SubnetA. You need to configure network security groups (NSGs) to enforce this traffic flow. The solution must allow HTTP and HTTPS traffic from the internet to SubnetA, and allow only traffic from SubnetA to SubnetB. All other inbound traffic should be denied. What is the most efficient way to configure the NSGs?

Accepted Answer

Apply an NSG to SubnetA with inbound rules allowing HTTP/HTTPS from Internet, and apply a separate NSG to SubnetB with inbound rules allowing only traffic from SubnetA.. Option B is correct. Apply an NSG to SubnetA with rules allowing HTTP/HTTPS from internet and deny all other inbound. Apply an NSG to SubnetB with a rule allowing traffic from SubnetA and deny all other inbound. This is efficient and meets requirements. Option A is inefficient because rules on SubnetB would still allow traffic from internet if not denied. Option C is incorrect because ASGs alone don't filter traffic. Option D is incorrect because Azure Firewall is overkill.

Answer

Apply one NSG to both subnets with rules allowing HTTP/HTTPS from internet, and allow traffic from SubnetA to SubnetB.

Answer

Use application security groups (ASGs) on the web servers and application servers, and configure NSG rules referencing the ASGs.

Answer

Deploy Azure Firewall in the virtual network and configure application rules to allow HTTP/HTTPS to SubnetA and traffic to SubnetB.

Question 12

Your organization has an Azure SQL Database that stores credit card numbers. The compliance team requires that credit card numbers be encrypted at rest and that only authorized applications can decrypt the data. The applications access the database using different service principals. You decide to implement Always Encrypted with secure enclaves. You create a column master key (CMK) in Azure Key Vault and a column encryption key (CEK) for the credit card column. You configure the column with deterministic encryption. However, after deployment, the applications report that they cannot insert or query the encrypted column. The error indicates that the column cannot be decrypted. You verify that the applications have the necessary permissions to access the CMK in Key Vault. What is the most likely cause of the issue?

Accepted Answer

The applications are using an older version of the SQL client driver that does not support Always Encrypted with secure enclaves.. Option D is correct: Applications must use a client driver that supports Always Encrypted with secure enclaves, such as the latest Microsoft.Data.SqlClient or .NET Framework with the enclave type configured. Option A: The CMK does not need to be in the same region. Option B: Both deterministic and randomized encryption can be used with secure enclaves. Option C: Even with permissions, the driver must support the enclave protocol.

Answer

The service principals do not have the 'Get' and 'Decrypt' permissions on the CMK in Key Vault.

Answer

Deterministic encryption is not supported with secure enclaves; you must use randomized encryption.

Answer

The CMK is stored in a Key Vault in a different region than the SQL Database.

Question 13

Your company uses Azure SQL Database for a line-of-business application. The security team requires that all queries executed against the database be audited, including the actual query text, and that the audit logs be retained for one year. You configure auditing to store logs in an Azure Storage account with a retention policy of 365 days. However, after some time, you notice that the audit logs are being deleted after only 30 days. You verify that the storage account's retention policy is set to 365 days and that the audit configuration is correct. What is the most likely cause of the logs being deleted prematurely?

Accepted Answer

The audit log retention period in Azure SQL Database auditing settings is set to 30 days.. Audit logs for Azure SQL Database can be stored in a storage account, but the retention policy for audit logs is configured within the Azure SQL auditing settings, not the storage account's default retention policy. If the retention period in the audit log settings is set to 30 days, logs will be deleted after that period even if the storage account has a longer retention. Option C is correct. Option A is incorrect because lifecycle management policies are not enabled by default. Option B is incorrect because the storage account retention policy does not apply to blob storage for audit logs unless specifically configured. Option D is incorrect because soft delete does not delete logs; it protects them.

Answer

The storage account has soft delete enabled, which deletes logs after 30 days.

Answer

A lifecycle management policy is deleting blobs after 30 days.

Answer

The storage account's immutable storage policy is overriding the retention setting.

Question 14

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Key Vault meets all requirements: encryption at rest, automatic rotation with Key Vault's key rotation policy, and access by Azure SQL Database without application direct access. Option A is wrong because Always Encrypted encrypts columns but requires the application to handle encryption keys. Option B is wrong because Azure Disk Encryption encrypts VM disks, not SQL database. Option D is wrong because server-side encryption with service-managed keys does not use customer-managed keys.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Question 15

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. A recent assessment shows that a standard-tier storage account (storageaccount1) used for backup data has the following findings: 1) 'Storage account should use a private endpoint' is unhealthy; 2) 'Storage account should use customer-managed keys (CMK) for encryption' is healthy; 3) 'Storage account should restrict network access' is unhealthy; 4) 'Storage account should enable soft delete for blobs' is healthy. Management requires that all storage accounts used for backup be protected against accidental deletion and have network access restricted to a specific virtual network (vnet-backup). Currently, the storage account is accessible from all networks. You need to remediate the unhealthy findings while maintaining the healthy status of the other controls. Which combination of actions should you take?

Accepted Answer

Create a private endpoint in the vnet-backup subnet for the storage account and set the public network access to 'Disabled'.. Option C is correct: Enabling a private endpoint and disabling public network access will remediate both the private endpoint and network access findings. Soft delete is already enabled, and CMK is already in place. Option A: Enabling a service endpoint does not remediate the private endpoint finding and may not satisfy the recommendation. Option B: Configuring firewall rules allows public IPs, which does not meet the private endpoint recommendation. Option D: Enabling a service endpoint and firewall rules does not address the private endpoint requirement.

Answer

Enable a service endpoint for Microsoft.Storage on vnet-backup and configure the firewall to allow only that subnet, then create a private endpoint as well.

Answer

Enable a service endpoint for Microsoft.Storage on the vnet-backup subnet and update the storage account firewall to allow access only from that subnet.

Answer

Configure the storage account firewall to allow access only from the vnet-backup subnet's public IP range.

Question 16

You work for a financial institution that uses Azure Cosmos DB with API for NoSQL to store transaction data. The security requirements mandate: (1) All data at rest must be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. (2) The encryption keys must be automatically rotated every 60 days. (3) Network access to the Cosmos DB account must be restricted to only specific virtual networks. (4) Access to the keys must be logged and monitored. (5) The Cosmos DB account must be configured to use private endpoints. You have configured the Cosmos DB account with CMK and private endpoints. However, after setting up automatic key rotation in Key Vault, the Cosmos DB account starts returning 403 (Forbidden) errors for some requests. What is the most likely cause?

Accepted Answer

The key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version.. Option D is correct because when using CMK with automatic key rotation, the Cosmos DB account must have access to the new key version. If the account does not have the correct permissions (e.g., get, wrap, unwrap) on the new key version, it will fail. Option A is wrong because private endpoints do not cause 403 errors. Option B is wrong because firewall rules are separate from CMK. Option C is wrong because Cosmos DB does not have a 'key version' property to update manually.

Answer

The private endpoint connection is not approved.

Answer

The Cosmos DB account's key version property is outdated and must be updated manually.

Answer

The firewall rules are blocking the Cosmos DB account from accessing Key Vault.

Question 17

Your company is migrating a legacy on-premises application to Azure VMs. The application writes log files to a local folder. You need to collect these logs centrally for security analysis using Microsoft Sentinel. The application runs on Windows Server 2022 and is expected to generate about 50 GB of logs per day. The security team requires that logs be encrypted at rest and in transit, and that log collection has minimal latency. You set up Azure Monitor Agent (AMA) on the VM and configure a Data Collection Rule (DCR) to stream custom logs to a Log Analytics workspace. However, after 24 hours, no custom logs appear in the workspace. The AMA is reporting as healthy. You need to troubleshoot and resolve the issue. What is the most likely cause?

Accepted Answer

The DCR does not include the correct table name for the custom log, or the table does not exist in the Log Analytics workspace.. Option B is correct: The DCR must reference the custom log table created in the Log Analytics workspace; if the table name does not match, logs will not be ingested. Option A: AMA can collect custom logs from a file path; the path does not need to be a network share. Option C: The agent does not require local admin privileges for custom log collection. Option D: The log file format is not limited to JSON; AMA can collect plain text logs with a defined pattern.

Answer

The custom log file path specified in the DCR is a local path, but AMA requires a network share for custom log collection.

Answer

The log file format is not JSON, but AMA only supports custom logs in JSON format.

Answer

The VM does not have local administrator privileges required for the AMA to read the log files.

Question 18

You are the security administrator for a company that uses Azure Blob Storage to store sensitive documents. You need to ensure that all blob data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You have enabled encryption with CMK on the storage account. However, after a key rotation in Key Vault, you notice that newly uploaded blobs are encrypted with the new key, but existing blobs are still encrypted with the old key. You need to ensure that all blobs are re-encrypted with the new key. What should you do?

Accepted Answer

Re-upload the existing blobs using the new key version by calling the Put Blob operation with the new encryption key.. Option C is correct: Re-uploading blobs using the new key triggers re-encryption with the latest key version. Option A: Azure Storage automatically rewrites blobs on read/write only if the blob is accessed; re-uploading ensures all blobs are re-encrypted. Option B: Key rotation does not automatically re-encrypt existing blobs; you must explicitly re-encrypt by rewriting. Option D: The storage account encryption setting applies to new blobs only; existing blobs retain the old key until rewritten.

Answer

Update the storage account's encryption scope to use the new key version and then call the 'Rewrite' operation on each blob.

Answer

Set the storage account encryption to use a different key, then revert to the original key to force re-encryption.

Answer

No action is needed; Azure Storage automatically re-encrypts existing blobs with the new key after rotation.

Question 19

You are the security engineer for a healthcare company that uses Azure to store electronic health records (EHR) in Azure Blob Storage. Compliance requires that all data be encrypted at rest with customer-managed keys stored in a hardware security module (HSM), that the storage account be accessible only from a specific virtual network, and that all access to the storage account be logged and sent to a central security information and event management (SIEM) system. Additionally, you must ensure that any blobs containing protected health information (PHI) are automatically labeled with a sensitivity label that prevents them from being shared externally. You have decided to use Azure Key Vault Managed HSM for key storage, Azure Private Endpoint for network access, and Azure Monitor for logging. However, you are unsure how to automatically apply sensitivity labels to blobs based on content inspection. Which service should you use to achieve automatic labeling of PHI data in Azure Blob Storage?

Accepted Answer

Microsoft Purview Information Protection with auto-labeling policies for Azure Blob Storage. Microsoft Purview Information Protection can automatically classify and label sensitive data in Azure Blob Storage using content scanning and machine learning. Option C is correct. Option A is incorrect because Azure Policy enforces rules but does not inspect content for labeling. Option B is incorrect because Microsoft Sentinel is a SIEM, not a labeling service. Option D is incorrect because Microsoft Defender for Storage provides threat detection but does not apply sensitivity labels.

Answer

Microsoft Defender for Storage with sensitivity labeling integration

Answer

Azure Policy with custom policies to tag blobs containing PHI

Answer

Microsoft Sentinel with analytics rules to detect PHI and apply labels via automation

Question 20

Your company uses Azure Files shares for user home directories. Security policy requires that all data be encrypted at rest and in transit. You have enabled encryption at rest using Azure Storage Service Encryption (SSE). For encryption in transit, you require SMB clients to use SMB 3.0 or later with encryption. You configure the storage account to require secure transfer. A user reports that they cannot mount the file share from a Windows 10 machine that is not domain-joined. The user can mount other file shares without issues. What is the most likely reason for the failure?

Accepted Answer

The client machine does not support SMB 3.0 encryption, which is required when secure transfer is enabled.. Option B is correct: When secure transfer is required, SMB 3.0 with encryption is mandatory. If the client does not support SMB encryption (e.g., due to older OS or misconfiguration), the mount will fail. Option A: Azure Files supports SMB mount from non-domain-joined machines. Option C: Azure Files supports both SMB protocols. Option D: DNS resolution is not the issue if they can mount other shares.

Answer

The storage account firewall is blocking the client's public IP address.

Answer

The user's machine is not domain-joined, so it cannot authenticate to Azure Files.

Answer

Azure Files only supports SMB 2.1, and the client is trying to use SMB 3.0.

AZ-500 Practice Exam 64 — 20 Questions

Exhibit

AZ-500 Practice Exam 64 — 20 Questions

Exhibit