AZ-500 Practice Test 8 — 10 Questions

Question 1

You need to provide secure remote administration access to Azure virtual machines in a production environment. You want to eliminate public RDP/SSH endpoints and provide just-in-time access. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Just-in-time (JIT) VM access in Microsoft Defender for Cloud is the correct choice because it specifically provides time-bound, policy-controlled access to Azure VMs via RDP/SSH while eliminating permanent public endpoints. JIT dynamically opens NSG rules for a specified duration only when an authorized user requests access, then automatically closes them, enforcing the principle of least privilege for remote administration.

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Answer

Azure Bastion

Question 2

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Microsoft Entra PIM can integrate with Conditional Access via authentication context. By enabling 'Require Microsoft Entra Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 3

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Microsoft Entra ID, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Microsoft Entra ID tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 4

A company uses Azure Firewall to inspect traffic between a spoke VNet hosting a web application and a hub VNet hosting a SQL database. The web application fails to connect to the database after a recent network topology change. You verify that the Azure Firewall rules allow the traffic. Which Azure Network Watcher feature should you use to identify the root cause?

Accepted Answer

Connection troubleshoot. Connection troubleshoot (Option A) is the correct choice because it performs an end-to-end connectivity test from the source VM to the destination, evaluating the actual path, including Azure Firewall rules, NSGs, and route tables. Since the firewall rules are confirmed to allow the traffic, Connection troubleshoot can identify if a UDR misrouting or an NSG on the source or destination subnet is blocking the connection. IP flow verify only checks NSG rules at a single network interface and does not evaluate route tables or the entire path.

Answer

Next hop

Answer

Network Performance Monitor

Answer

IP flow verify

Question 5

Your company uses Azure Virtual WAN with a secured virtual hub (Azure Firewall). You have branch offices connected via ExpressRoute. You need to ensure that traffic from a branch to a VNet in the same region is inspected by the firewall. You configure the default route (0.0.0.0/0) advertisement from the hub to the branch, but the traffic is not being inspected. What is the most likely reason?

Accepted Answer

Routing intent for private traffic is not enabled.. Routing intent for private traffic must be enabled on the Virtual WAN hub to ensure that inter-VNet and branch-to-VNet traffic (private IP ranges) is routed through the Azure Firewall. Without routing intent, only internet-bound traffic (0.0.0.0/0) is forced through the firewall by the default route, while private traffic between branches and VNets bypasses inspection. Enabling routing intent for private traffic overrides the default behavior and injects the firewall as the next hop for all private traffic.

Answer

The 'Inter-hub' setting is disabled.

Answer

The branch does not have a route table associated with the connection.

Answer

The VNet has a network virtual appliance (NVA) that overrides the firewall.

Question 6

You need to secure traffic between two VNets in different Azure regions. The VNets contain virtual machines that must communicate over private IP addresses. Which Azure service should you use?

Accepted Answer

VNet peering. VNet peering enables direct, private IP connectivity between two VNets in different Azure regions (global VNet peering). Traffic flows over the Microsoft backbone network, not the public internet, ensuring low-latency and secure communication between virtual machines using private IP addresses without requiring a gateway or additional appliance.

Answer

Azure Firewall

Answer

Azure VPN Gateway

Answer

ExpressRoute

Question 7

You need to securely connect two Azure virtual networks in the same region to allow VM-to-VM communication using private IP addresses. The solution must minimize latency and administrative overhead. What should you use?

Accepted Answer

VNet peering. VNet peering is the correct choice because it connects two Azure virtual networks in the same region using the Microsoft backbone infrastructure, enabling VM-to-VM communication over private IP addresses with near-zero latency and no intermediate hops. It requires no additional gateways or bandwidth charges within the same region, minimizing administrative overhead as it is a simple, one-time configuration.

Answer

Azure VPN Gateway

Answer

Azure Front Door

Answer

ExpressRoute

Question 8

You are designing a network security solution for a multi-tier application in Azure. The web tier must be accessible from the internet, the application tier only from the web tier, and the database tier only from the application tier. All tiers are in different subnets of the same VNet. What is the minimum configuration?

Accepted Answer

Configure NSGs on each subnet with appropriate allow rules.. Network Security Groups (NSGs) applied to each subnet can enforce least-privilege network access: allow inbound from Internet to the web tier subnet, allow inbound only from the web tier subnet to the application tier subnet, and allow inbound only from the application tier subnet to the database tier subnet. This is the minimum configuration as it uses built-in, no-cost Azure constructs without additional services or complex routing.

Answer

Use service endpoints for each tier.

Answer

Create separate VNets for each tier and use VNet peering.

Answer

Deploy Azure Firewall in the VNet and route all traffic through it.

Question 9

A company needs to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) for their Azure workloads. They use Microsoft Defender for Cloud for security management. Which feature should they use to view their current compliance status against PCI DSS controls and track progress over time?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance posture against standards like PCI DSS. It maps Azure resource configurations to specific PCI DSS controls, shows pass/fail status per control, and tracks compliance score over time, enabling continuous monitoring and evidence collection for auditors.

Answer

Security policy

Answer

Recommendations

Answer

Security incidents

Question 10

Refer to the exhibit. You are reviewing an NSG rule configuration for a subnet. The source subnet is 10.0.0.0/24 and the destination subnet is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

Allows inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.. The rule shown in the exhibit is an inbound security rule with source 10.0.0.0/24, destination 10.0.1.0/24, protocol TCP, destination port 22 (SSH), and action Allow. This explicitly permits inbound SSH traffic from the source subnet to the destination subnet. Therefore, option D is correct.

Answer

Allows outbound SSH traffic from 10.0.1.0/24 to 10.0.0.0/24.

Answer

Blocks inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.

Answer

Allows all inbound traffic from 10.0.0.0/24 to 10.0.1.0/24.