AZ-500 Practice Test 8 — 10 Questions

Question 1

Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR. The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.

Answer

The UDR must be applied to the subnet that hosts the Azure Firewall

Answer

The spoke subnet does not have 'GatewaySubnet' route propagation enabled

Answer

The Azure Firewall is not configured with a route to the on-premises network

Question 2

A security analyst uses Microsoft Sentinel. They want to create a scheduled analytics rule that runs every hour and queries Azure Activity logs to detect deployment of VMs in non-approved regions. They want to generate an incident automatically when suspicious activity is found. Which configuration is required to automatically create an incident?

Accepted Answer

Enable 'Create incident from alerts triggered by this rule' in the Incident settings. The 'Create incident from alerts triggered by this rule' setting in the Incident settings tab is the specific toggle that instructs Microsoft Sentinel to automatically generate a security incident whenever the scheduled analytics rule fires an alert. Without this setting enabled, the rule will only produce raw alerts that must be manually triaged or routed through a separate automation rule to become incidents. This is the direct configuration required for automatic incident creation from a scheduled query rule.

Answer

Configure the 'Alert details' section with the appropriate severity and description

Answer

Define entity mapping in the 'Entity mapping' tab

Answer

Connect Azure Activity log to Sentinel via Event Hub

Question 3

A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key (CMK). Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.

Answer

Enable infrastructure encryption

Answer

Enable soft delete for the storage account

Answer

Enable Azure AD authentication for Blob Storage

Question 4

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Accepted Answer

1. Navigate to the Key Vault in the Azure portal. 2. Under Settings, select Networking. 3. In the Firewalls and virtual networks tab, add the desired virtual network. 4. Click Save.. The firewall configuration is under networking, and you must add the virtual network to allow traffic.

Answer

1. Navigate to the Key Vault. 2. Click Save. 3. Then go to Networking. 4. Add virtual network.

Answer

1. Navigate to the Key Vault. 2. Select Networking. 3. Save the current firewall settings. 4. Then add virtual network.

Answer

1. Navigate to the Key Vault. 2. Add virtual network. 3. Select Networking. 4. Save.

Question 5

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Accepted Answer

1. Navigate to Azure AD Security
2. Configure user risk policy
3. Configure sign-in risk policy
4. Review risk detections. Identity Protection policies are configured under Security, with user risk policy settings.

Answer

1. Configure sign-in risk policy
2. Configure user risk policy
3. Navigate to Azure AD Security
4. Review risk detections

Answer

1. Review risk detections
2. Navigate to Azure AD Security
3. Configure user risk policy
4. Configure sign-in risk policy

Answer

1. Configure user risk policy
2. Navigate to Azure AD Security
3. Configure sign-in risk policy
4. Review risk detections

Question 6

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall that blocks all public access. The SQL server is a managed service that needs to access the key to perform TDE operations. The Key Vault is in the same Azure region as the SQL server. Which additional configuration is needed?

Accepted Answer

Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings. When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.

Answer

Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet

Answer

Assign the SQL server's server identity the 'Contributor' role on the Key Vault

Answer

Create a private endpoint for the Key Vault in the SQL server's virtual network

Question 7

A company has multiple on-premises web applications that need to be securely published for remote employees. The company uses Azure AD for identity management and wants to apply Conditional Access policies, including multi-factor authentication, to these applications. The security team wants to avoid exposing the on-premises infrastructure to the internet directly. Which Azure service should they deploy to meet these requirements?

Accepted Answer

Azure AD Application Proxy. Azure AD Application Proxy is the correct service because it provides secure remote access to on-premises web applications without requiring a VPN or opening inbound firewall ports. It integrates natively with Azure AD, enabling Conditional Access policies such as multi-factor authentication (MFA) to be applied to these applications. The service works by establishing an outbound-only connection from the on-premises Application Proxy connector to Azure AD, ensuring the on-premises infrastructure is never directly exposed to the internet.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 8

A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?

Accepted Answer

Create an automation rule that triggers when an incident is created and sets the severity and owner fields.. Automation rules in Microsoft Sentinel allow you to centrally manage incident handling by triggering actions when incidents are created or updated. By configuring an automation rule that triggers on incident creation from the specific analytics rule, you can automatically set the severity and assign the incident to a security operations group (via an Azure AD group or user) without custom scripting or manual intervention.

Answer

Modify the analytics rule to include a custom script that runs upon alert generation.

Answer

Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.

Answer

Configure a workbook to filter and manually assign incidents.

Question 9

A company uses Microsoft Defender for Cloud to manage its security posture. The compliance team wants to monitor the subscription's compliance with the Payment Card Industry Data Security Standard (PCI DSS). They need to view a detailed compliance report and track progress over time. What should they do in Defender for Cloud?

Accepted Answer

Add the PCI DSS standard from the regulatory compliance dashboard.. The regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in compliance standards like PCI DSS. Once added, the dashboard automatically assesses your subscription against the standard's controls, provides a detailed compliance report, and tracks progress over time with a compliance score and historical trend. This is the direct method to monitor PCI DSS compliance without needing to enable specific Defender plans or create custom initiatives.

Answer

Enable the relevant Defender for Cloud plans (e.g., Defender for Servers, Defender for SQL).

Answer

Create a custom regulatory compliance initiative based on PCI DSS controls.

Answer

Configure continuous export to send compliance data to a Log Analytics workspace.

Question 10

A security team uses Microsoft Defender for Cloud to monitor the security posture of a hybrid environment that includes on-premises servers connected via Azure Arc. They want to enable a vulnerability assessment solution that automatically scans all servers (both Azure VMs and on-premises Arc-enabled servers) for OS vulnerabilities. Which solution should they enable directly from Defender for Cloud?

Accepted Answer

Enable the integrated vulnerability assessment solution (Qualys) in Defender for Cloud. The integrated vulnerability assessment (VA) solution in Defender for Cloud, powered by Qualys, is the correct choice because it is a native, built-in capability that can be automatically enabled for both Azure VMs and Azure Arc-enabled on-premises servers. It requires no additional licensing or external configuration, and it automatically discovers and scans OS vulnerabilities without manual intervention, directly from the Defender for Cloud portal.

Answer

Enable Microsoft Defender for Endpoint and integrate it with Defender for Cloud

Answer

Configure Azure Update Management to assess missing patches

Answer

Use Azure Policy to deploy the Log Analytics agent and manually enable scanning