AZ-500 Hard Questions — 25 Difficult Questions

Question 1

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. Azure Storage Service Encryption (SSE) with customer-managed keys integrates with Azure Key Vault, which can be configured to log key operations such as encrypt, decrypt, wrap, and unwrap. These logs are sent to Azure Monitor or a storage account, enabling auditing of key usage for compliance and security monitoring.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 2

You are configuring security for an Azure Functions app that processes credit card numbers. You need to ensure that the function can securely access a storage account without storing any credentials in code or configuration, and that all data in the storage account is encrypted with a customer-managed key. Which three actions should you take?

Accepted Answer

Assign the 'Storage Blob Data Contributor' role to the function app's managed identity. Assigning the 'Storage Blob Data Contributor' role to the function app's managed identity authorizes the function to read and write blobs in the storage account using Azure RBAC, without requiring any credentials in code or configuration. This aligns with the requirement to avoid storing credentials, as the managed identity provides a secure identity for the function app to authenticate to Azure services.

Answer

Store the storage account connection string in an application setting

Answer

Use a Key Vault reference in the function app configuration to retrieve the storage account key

Question 3

You are designing a Microsoft Entra ID tenant for a multinational organization. The security team requires that all administrative users must use phishing-resistant MFA. Administrators are located in different regions and may use different devices. Which MFA method should you enforce?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the only option that provides phishing-resistant MFA, as they use public-key cryptography and are bound to a specific web origin, preventing credential theft via man-in-the-middle attacks. This satisfies the security team's requirement for all administrative users, regardless of region or device, because FIDO2 keys are hardware-based and interoperable across platforms.

Answer

SMS-based verification

Answer

Phone call verification

Answer

Microsoft Authenticator with OTP

Question 4

Refer to the exhibit. You have an Azure Application Gateway WAF policy with the above JSON configuration. A user from IP address 10.1.2.3 reports they cannot access the web application. What is the most likely cause?

Accepted Answer

The custom rule blocks all private IP addresses.. The custom rule in the WAF policy explicitly blocks all traffic from IP addresses in the 10.0.0.0/8 private range. Since the user's IP address (10.1.2.3) falls within this range, the rule matches and blocks the request. The WAF policy is in prevention mode, so the rule actively blocks the request rather than just logging it.

Answer

The WAF policy is in prevention mode and detected a SQL injection.

Answer

The WAF policy is set to detection mode and logs the request.

Answer

The custom rule is disabled due to a syntax error.

Question 5

Your organization uses Microsoft Entra ID to manage access for employees and partners. You need to implement a solution that allows partners to self-service request access to specific applications, with approval from their manager, and access expires after 30 days. Which feature should you use?

Accepted Answer

Entitlement Management access packages. Entitlement Management access packages are designed to allow external partners to request access to specific applications through a self-service portal. The feature supports approval workflows (e.g., manager approval) and automatically enforces time-bound access, such as a 30-day expiration. This directly matches the requirement for partner self-service with approval and expiration.

Answer

Azure AD B2B collaboration

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access with session restrictions

Question 6

Which THREE Microsoft Entra ID roles can be assigned to a user to manage Microsoft Defender XDR (formerly Microsoft 365 Defender) incidents? (Choose three.)

Accepted Answer

Security Administrator. The Security Administrator role (Option B) can manage Microsoft Defender XDR incidents because it grants full access to security features, including the ability to view, investigate, and respond to incidents in the Microsoft 365 Defender portal. This role is designed for users who need to manage security policies and incidents without having full administrative control over the tenant.

Answer

Exchange Administrator

Answer

Global Reader

Question 7

Refer to the exhibit. You are reviewing an ARM template for an Azure Storage account. Which of the following is true about the deployment?

Accepted Answer

The storage account will enforce HTTPS traffic and replicate data to a paired region.. The ARM template configures the storage account with the 'supportsHttpsTrafficOnly' property set to true, which enforces HTTPS for all requests. Additionally, the 'sku.name' is set to 'Standard_GRS', which replicates data to a paired region for geo-redundancy. Therefore, option D correctly identifies both HTTPS enforcement and geo-replication to a paired region.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

The storage account will use locally redundant storage (LRS).

Answer

The storage account will have a firewall rule to restrict access to specific IPs.

Question 8

A public web application should be protected from OWASP-style attacks and network-layer DDoS attacks. Which two Azure services are most relevant?

Accepted Answer

Application Gateway WAF or Azure Front Door WAF. Both Azure Application Gateway WAF and Azure Front Door WAF provide managed rule sets (e.g., OWASP Core Rule Set 3.2) that protect against common web vulnerabilities such as SQL injection and cross-site scripting. Option C is correct because Azure DDoS Protection, when enabled on the virtual network hosting the application, mitigates network-layer DDoS attacks (e.g., SYN floods, UDP floods) by leveraging Azure's global infrastructure to absorb and scrub attack traffic.

Answer

Azure Automation State Configuration

Answer

Azure Files premium tier

Question 9

Which THREE of the following are capabilities of Microsoft Defender for Cloud's workload protection plans?

Accepted Answer

Adaptive application controls. Adaptive application controls (A) are a capability of Microsoft Defender for Cloud's workload protection plans. They use machine learning to analyze processes running on Azure and non-Azure machines, allowing you to define allowlists for known safe applications and generate security alerts when unauthorized applications execute, thus reducing the attack surface.

Answer

DDoS protection

Answer

Data Loss Prevention (DLP)

Question 10

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to implement a solution that detects password changes on-premises and forces re-authentication for active sessions within minutes. Which feature should you enable?

Accepted Answer

Password Writeback with password change notification. Password Writeback with password change notification, is correct because it enables on-premises password changes to be synchronized back to Microsoft Entra ID in near real-time. When a password is changed on-premises, the password change notification triggers a re-authentication requirement for active sessions within minutes, ensuring that users with stale tokens are forced to re-authenticate using the new password.

Answer

Azure AD Connect Health

Answer

Azure AD Domain Services

Answer

Seamless SSO

Question 11

Which THREE are valid methods to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Microsoft Sentinel Data Collector API. The Microsoft Sentinel Data Collector API is a valid ingestion method because it allows custom logs and data sources to be sent directly to Sentinel via a RESTful API endpoint. This is commonly used for non-standard data sources that do not have built-in connectors, enabling organizations to ingest data from custom applications or legacy systems.

Answer

Azure CLI

Answer

Azure Data Factory

Question 12

A company uses Microsoft Defender for Cloud's workload protection for Azure Storage. They want to receive alerts when there is suspicious access to blob storage. Which TWO features should they enable?

Accepted Answer

Microsoft Defender for Cloud for Storage. Microsoft Defender for Cloud for Storage (formerly Azure Defender for Storage) is the dedicated threat protection plan that detects suspicious access patterns to blob storage, such as anonymous access, unusual authentication failures, or access from Tor exit nodes. It provides security alerts directly in Defender for Cloud without requiring additional log ingestion.

Answer

Azure Storage Firewall

Answer

Azure Defender for Storage

Answer

Azure Storage Encryption

Question 13

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to ensure that all Azure subscriptions have the 'MFA should be enabled on accounts with owner permissions' security control applied. The compliance dashboard shows this control as 'Unhealthy' for several subscriptions. What should you do to automatically remediate non-compliant subscriptions?

Accepted Answer

Create an Azure Policy initiative that enforces MFA for owner accounts and assign it to the subscriptions.. Azure Policy can enforce MFA for owner accounts at the subscription level by assigning a built-in or custom policy initiative. This ensures continuous compliance by automatically evaluating and remediating non-compliant subscriptions without manual intervention. Defender for Cloud uses Azure Policy as the underlying engine for security controls, so creating and assigning an initiative directly addresses the requirement.

Answer

Enable 'Enforce MFA' in Azure AD Conditional Access policy for all users.

Answer

Run a remediation task from Defender for Cloud for the non-compliant subscriptions.

Answer

Configure a Microsoft Sentinel playbook triggered by a compliance alert to add MFA.

Question 14

Refer to the exhibit. You are reviewing a scheduled analytics rule in Microsoft Sentinel that uses the KQL query shown. The rule is configured to run every hour. A security analyst reports that the rule is generating too many incidents. What is the most likely cause?

Accepted Answer

The query does not filter out known safe IP addresses sufficiently.. The query likely uses a broad filter for sign-in events without excluding known safe IP addresses (e.g., corporate VPNs, trusted services). This causes every sign-in from those IPs to generate an incident, overwhelming the rule with false positives. The rule's frequency (every hour) is not the issue; the query logic is insufficiently scoped.

Answer

The rule is configured to run too frequently.

Answer

The query uses 'ago(1h)' which includes data from the previous hour, causing duplicate incidents.

Answer

The query has a syntax error that causes all sign-ins to match.

Question 15

You work for a software development company that uses GitHub Enterprise and Microsoft Entra ID for identity management. Developers need to access Azure resources from their CI/CD pipelines. You need to configure secure authentication for these service principals used in pipelines. The requirements are:

- No client secrets should be used because they can be leaked.
- The authentication method must be automatically rotated.
- The service principal must have access only to a specific resource group.
- You need to monitor and alert if the service principal is used outside of the expected geographic region.

Which of the following is the most appropriate solution?

Accepted Answer

Use a system-assigned managed identity for the Azure resource running the pipeline. Assign the managed identity the Contributor role at the resource group scope. Configure Conditional Access for workload identities to block sign-ins from unexpected geographic regions.. System-assigned managed identities are automatically managed and rotated by Azure, eliminating the need for secrets. They can be scoped to a specific resource group via RBAC by assigning the Contributor role at that scope. Conditional Access for workload identities can monitor and block sign-ins from unexpected geographic regions, satisfying the monitoring requirement. Option A is wrong because certificate-based credentials still require manual rotation and management. Option B is wrong because PIM is designed for user identities, not service principals or managed identities, and requires approval, which does not address automatic rotation. Option D is wrong because using a client secret, even stored in Key Vault, violates the 'no client secrets' requirement and is not automatically rotated.

Answer

Create a service principal with a certificate-based credential. Assign the service principal the Contributor role at the resource group scope. Use a custom script to rotate the certificate monthly.

Answer

Use a user-assigned managed identity and configure PIM to require approval for each pipeline run. Assign the identity the Contributor role at the resource group scope.

Answer

Create a service principal and use OAuth 2.0 client credentials grant with a client secret stored in Azure Key Vault. Assign the service principal the Contributor role at the resource group scope. Use Key Vault access policies to control secret access.

Question 16

You are reviewing the above Azure Policy definition. What does this policy do?

Accepted Answer

Denies storage accounts that have the default network action set to Deny. This policy denies the creation or update of storage accounts where the default network action is set to 'Deny'. The default network action determines whether traffic is allowed when no network rule matches; setting it to 'Deny' means that only explicitly allowed traffic is permitted, effectively locking down the storage account. The policy enforces a security baseline by preventing storage accounts from being configured with a restrictive default action that could block legitimate access if not properly managed.

Answer

Denies storage accounts that do not have encryption enabled

Answer

Denies storage accounts that have firewall rules configured

Answer

Denies storage accounts that allow all network traffic

Question 17

A security analyst reports that Microsoft Sentinel is not receiving Windows Security Events from Azure VMs that have the Log Analytics agent installed. The agent shows as connected, and other data sources (e.g., performance counters) are flowing. What is the most likely cause?

Accepted Answer

The Windows Security Events connector is not configured to collect the required event IDs.. The Windows Security Events connector in Microsoft Sentinel requires specific event IDs to be collected; if the data collection rule or agent configuration does not include the required event IDs, the events won't be sent. Option A is wrong because the Microsoft Sentinel solution is installed at the workspace level, not on individual VMs, so its absence on the VM is irrelevant. Option B is wrong because if the agent is connected and other data flows, network connectivity (including port 443) is fine. Option C is wrong because an incorrect workspace key would prevent the agent from connecting entirely, but the agent shows as connected.

Answer

The Microsoft Sentinel solution is not installed on the VM.

Answer

The Azure VM has a network security group blocking port 443.

Answer

The Log Analytics workspace key is incorrect.

Question 18

Your company has multiple Azure subscriptions managed through Azure Firewall Manager. You need to deploy Azure Firewall policies that apply to all subscriptions in a region. What is the most efficient way to manage this?

Accepted Answer

Use Azure Firewall Manager to create a parent policy and assign it to all firewalls. Azure Firewall Manager provides a centralized management plane for firewall policies across multiple subscriptions and regions. By creating a parent policy and assigning it to all firewalls, you ensure consistent rule enforcement without duplicating effort. This approach is the most efficient because it leverages inheritance, where child policies can override specific rules while inheriting the parent's base configuration.

Answer

Create a separate firewall policy for each subscription

Answer

Use Azure Policy to enforce firewall rules across subscriptions

Answer

Deploy a single network security group (NSG) to all VNets

Question 19

You are the security engineer for a multinational company that uses Azure to host critical workloads. The company has deployed Microsoft Defender for Cloud with the enhanced security features enabled on all subscriptions. Recently, a security audit revealed that several virtual machines (VMs) in the production environment are missing critical security updates. The audit report indicates that the VMs are not being assessed for missing updates by Defender for Cloud. You need to ensure that all VMs are automatically assessed for missing OS updates using Defender for Cloud's vulnerability assessment capabilities. The solution must minimize administrative overhead and should not require manual installation of agents on existing VMs. What should you do?

Accepted Answer

Enable the 'Servers' plan in Defender for Cloud and ensure that the 'Vulnerability assessment for machines' setting is turned on.

Answer

Enable the 'SQL servers on machines' plan in Defender for Cloud.

Answer

Configure a vulnerability assessment solution from the Azure Marketplace and assign it to the VMs.

Answer

Deploy the Log Analytics agent to all VMs using Azure Policy.

Question 20

You are configuring Microsoft Defender for Cloud's 'Workload protections' for a Kubernetes cluster that is already using Azure Kubernetes Service (AKS). The cluster has 'Azure Policy' enabled. You need to enable the 'Microsoft Defender for Containers' plan to protect the cluster. You have already enabled the plan at the subscription level. However, the cluster is not showing as protected in the 'Inventory' blade. You have confirmed that the 'Azure Policy for Kubernetes' add-on is installed. What should you do to ensure the cluster is protected?

Accepted Answer

Install the 'Defender profile' on the AKS cluster.. Even with the subscription-level plan enabled, you need to install the 'Defender profile' on the AKS cluster to enable protection. The Defender profile deploys the necessary agents for threat detection. Option A is correct. Option B is incorrect because Azure Policy for Kubernetes is already enabled; it is a separate feature. Option C is incorrect because protection does not automatically apply; you must install the profile. Option D is incorrect because the Log Analytics agent is not required for Defender for Containers; the Defender profile handles agent deployment.

Answer

Enable the 'Azure Policy for Kubernetes' add-on on the cluster.

Answer

Wait for 24 hours for the protection to automatically apply.

Answer

Install the Log Analytics agent on the cluster nodes.