AZ-500 Practice Test 7 — 10 Questions

Question 1

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

Accepted Answer

Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Answer

Enable Azure AD Domain Services authentication and join the storage account to the managed domain.

Answer

Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.

Answer

Use storage account keys to mount the share and rely on Windows ACLs.

Question 2

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation. Option B is wrong because Azure Disk Encryption encrypts VM disks, not the Azure SQL Database. It does not meet the requirement for encrypting the database at rest. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access. Option D is wrong because Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Question 3

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Accepted Answer

Create suppression rules to automatically dismiss alerts that meet specific criteria.. Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts matching specific criteria, such as alert name, resource, or severity. This is useful for reducing noise from known benign activities without disabling the underlying security detection. Suppression rules are configured per alert type and can be set to expire after a defined period.

Answer

Directly modify the affected Azure resource's configuration from the alert.

Answer

Export alerts to a third-party SIEM using continuous export.

Answer

Change the severity of an alert after it is generated.

Question 4

You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?

Accepted Answer

Azure Monitor Logs (Log Analytics workspace). Azure Monitor Logs (Log Analytics workspace) is correct because it serves as the central ingestion and storage destination for network monitoring data. NSG flow logs capture IP traffic through Network Security Groups, and Traffic Analytics processes those raw flow logs to provide visualizations, top-talkers, and anomaly detection. Together, these three components enable comprehensive network traffic monitoring and security analysis for Azure VMs.

Answer

Azure Firewall logs

Answer

VNet flow logs

Question 5

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

Accepted Answer

The 'Use remote gateway' setting is disabled on the spoke VNet peering.. In a hub-spoke topology with Azure Firewall, the 'Use remote gateway' setting on the spoke VNet peering must be disabled. This setting is only for using a VPN or ExpressRoute gateway in the hub; it does not enable routing through Azure Firewall. With this setting disabled, the configured UDRs on the spoke subnets can direct spoke-to-spoke traffic to the firewall for inspection.

Answer

Azure Firewall does not support traffic between spoke VNets.

Answer

The UDR on the firewall subnet does not include the spoke address spaces.

Answer

The 'Allow gateway transit' setting is disabled on the spoke peering.

Question 6

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

Accepted Answer

The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.. When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.

Answer

The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

Answer

The NSG is not associated with the NIC because the command did not specify the NIC correctly.

Answer

The NSG rule should be an inbound rule to block outbound traffic.

Question 7

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 8

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 9

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

Accepted Answer

The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group. PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Answer

Users have permanent eligible assignments that bypass approval

Answer

The audit log is not enabled for PIM

Answer

Users are assigned the role directly instead of through eligibility

Question 10

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Answer

Playbooks

Answer

Incident settings in analytics rule

Answer

Workbooks