AZ-500 Multiple Select — 40 Questions

Question 1

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. Azure Storage Service Encryption (SSE) with customer-managed keys integrates with Azure Key Vault, which can be configured to log key operations such as encrypt, decrypt, wrap, and unwrap. These logs are sent to Azure Monitor or a storage account, enabling auditing of key usage for compliance and security monitoring.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 2

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Azure AD Connect

Question 3

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Privileged Identity Management (PIM) enforces just-in-time (JIT) access by requiring approval for role activation, which aligns with the zero-trust principle of 'never trust, always verify' by eliminating standing privileges. Option E is correct because Conditional Access policies that require MFA and device compliance enforce continuous verification of user identity and device health before granting access, a core tenet of zero-trust identity.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Azure AD

Answer

Assign permanent Global Administrator roles to IT staff

Question 4

Which TWO actions should you take to secure a virtual network in Azure? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets.. Network security groups (NSGs) are a fundamental Azure security control that filter traffic at the subnet or network interface level. Applying an NSG to a subnet allows you to define inbound and outbound security rules based on source/destination IP, port, and protocol, effectively segmenting and protecting the virtual network from unauthorized access.

Answer

Configure Azure DNS zones.

Answer

Deploy Azure Bastion for VM access.

Answer

Set up Azure Monitor alerts.

Question 5

Which TWO of the following are valid configurations for Microsoft Entra ID Conditional Access policies?

Accepted Answer

Include all users and exclude specific groups. Conditional Access policies allow you to include all users as a baseline and then exclude specific groups (e.g., break-glass emergency accounts) to ensure critical access is never blocked. Option C is correct because you can target a specific cloud application (e.g., Microsoft Azure Management, SharePoint Online) to apply granular access controls only to that app, leaving other apps unaffected.

Answer

Force password change on next sign-in

Answer

Block access for users without MFA registered

Answer

Assign licenses to users based on location

Question 6

You are designing a backup strategy for Azure virtual machines. You need to ensure that backups are encrypted at rest and can be restored in a different Azure region in case of a regional disaster. Which two configurations should you use?

Accepted Answer

Enable encryption at rest for the Recovery Services vault using platform-managed keys. Enabling encryption at rest for the Recovery Services vault using platform-managed keys ensures that backup data is encrypted when stored in Azure's storage layer. This is a default encryption mechanism that protects data at rest without requiring additional key management overhead. Option C is correct because Cross-Region Restore (CRR) allows you to restore backup data to a paired Azure region, providing disaster recovery capability if the primary region fails.

Answer

Configure Azure Site Recovery for the VMs

Answer

Enable Azure Disk Encryption on the VMs

Answer

Use geo-redundant storage (GRS) for the Recovery Services vault

Question 7

Which TWO security controls are automatically provided by enabling Microsoft Defender for Cloud's foundational CSPM (Cloud Security Posture Management) capabilities? (Choose two.)

Accepted Answer

Continuous assessment of Azure resources against the Microsoft cloud security benchmark.. Option C is correct because the foundational CSPM plan in Microsoft Defender for Cloud continuously assesses Azure resources against the Microsoft cloud security benchmark (MCSB), producing a secure score and compliance view without any additional agent or paid plan. Option D is correct because the same foundational CSPM capabilities generate security recommendations for Azure resources based on those assessments, guiding remediation of misconfigurations. Options A, B, and E are not part of the free foundational CSPM offering: Azure Firewall Manager integration is a separate networking service, just-in-time VM access requires the paid Defender for Servers plan (Plan 2), and vulnerability assessment for VMs is also provided by Defender for Servers rather than by foundational CSPM.

Answer

Azure Firewall Manager integration.

Answer

Just-in-time (JIT) VM access.

Answer

Vulnerability assessment for VMs.

Question 8

A company uses Defender for Servers Plan 2. Which two capabilities are included compared with a basic posture-only configuration?

Accepted Answer

File integrity monitoring or equivalent advanced server protection capabilities. Defender for Servers Plan 2 includes advanced server protection capabilities such as file integrity monitoring (FIM), which tracks changes to critical system files and registry keys, and endpoint detection and response (EDR) integration through Microsoft Defender for Endpoint. These capabilities go beyond the basic posture-only configuration, which only provides vulnerability assessment and security recommendations without real-time threat detection or file change monitoring.

Answer

Azure Cost Management budget alerts

Answer

Microsoft 365 message trace

Question 9

Which two actions should you take to secure Azure Storage accounts against data exfiltration?

Accepted Answer

Use Azure Private Endpoints for storage accounts.. Correct: A and C. Firewall and virtual network service endpoints restrict network access, and private endpoints provide secure connectivity. Option B (shared access keys) does not prevent exfiltration. Option D (soft delete) helps recovery but not prevention. Option E (CORS) controls cross-origin requests, not exfiltration.

Answer

Enable shared access key authentication.

Answer

Enable soft delete for blobs.

Answer

Configure CORS rules to allow all origins.

Question 10

A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.

Answer

Enable container soft delete with a retention period of 30 days

Answer

Enable blob versioning

Question 11

A team enables Microsoft Defender for Storage. Which two threats can the plan help detect?

Accepted Answer

Access from suspicious IP addresses to storage accounts. Microsoft Defender for Storage detects anomalous activities that could indicate threats to storage accounts. Option A is correct because the service analyzes incoming requests to identify access from suspicious IP addresses, such as known malicious IPs or Tor exit nodes, using threat intelligence feeds. Option D is correct because when malware scanning is enabled, Defender for Storage can detect malware uploaded to Blob Storage by scanning files for known malicious signatures.

Answer

Expired Azure AD PIM role assignments

Answer

Public IP address creation on virtual machines

Question 12

A company manages Azure AD roles with Privileged Identity Management (PIM). They want to enforce that when a user activates the Global Administrator role, they must provide a justification and also use Multi-Factor Authentication. Which PIM settings should they configure? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication on activation.. PIM allows you to enforce Multi-Factor Authentication (MFA) as a mandatory step during role activation, ensuring the user's identity is verified beyond just a password. Option C is correct because PIM's 'Require justification on activation' setting forces the user to provide a business reason for activating the Global Administrator role, which is a common compliance requirement. Together, these two settings satisfy the requirement for both MFA and justification during activation.

Answer

Require approval on activation.

Answer

Extend activation duration.

Question 13

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Accepted Answer

Configure Dynamic Data Masking (DDM) for the PII columns.. (Dynamic Data Masking) masks PII columns for non-privileged users. Option C (Minimum TLS Version 1.2) ensures data in transit is encrypted. Option D (Transparent Data Encryption) encrypts data at rest. Option B (Always Encrypted) is client-side and requires client support, not suitable for legacy apps. Option E (Azure Information Protection) is not a database security feature for this scenario.

Answer

Implement Always Encrypted for the PII columns.

Answer

Apply Azure Information Protection labels to the database.

Question 14

A KQL query in Microsoft Sentinel detects impossible travel but returns many false positives from known VPN egress IP addresses. Which two changes would best reduce noise while preserving useful detections?

Accepted Answer

Join or filter against a watchlist of approved VPN egress IPs. Integrating a watchlist of known VPN egress IPs allows the KQL query to filter out these trusted IPs, reducing false positives from impossible travel detections. Option C is also correct because excluding events where the source IP is in an approved network list directly removes noise from legitimate VPN traffic, preserving detection of truly anomalous sign-ins. Both approaches leverage Sentinel's watchlist or allowlist capabilities to maintain detection fidelity while minimizing alert fatigue.

Answer

Disable the SigninLogs connector for the tenant

Answer

Raise the query frequency from 1 hour to 24 hours

Question 15

Which TWO of the following are valid ways to encrypt data at rest in Azure SQL Database? (Choose two.)

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) [B] is correct because it performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest using a symmetric database encryption key (DEK) protected by a certificate stored in Azure Key Vault or the service-managed key store, directly satisfying the data-at-rest requirement. Always Encrypted [D] is also correct because it encrypts sensitive columns at rest and in memory, with keys held outside the database (in Windows Certificate Store or Azure Key Vault), so the data stored on disk is ciphertext and never exposed to the SQL Database engine. Dynamic Data Masking [A] is not encryption — it merely obfuscates column values in query results for non-privileged users while the underlying data remains plaintext. Row-Level Security [C] restricts which rows a user can access via predicates but does not encrypt stored data. Azure Disk Encryption (ADE) [E] is not applicable to Azure SQL Database because it targets IaaS virtual machine OS and data disks (BitLocker/DM-Crypt), not the PaaS SQL Database service.

Answer

Dynamic Data Masking

Answer

Row-Level Security

Answer

Azure Disk Encryption (ADE)

Question 16

A managed identity is used by an Azure Function to access Key Vault. Which two configurations are required?

Accepted Answer

A system-assigned or user-assigned managed identity enabled on the function app. A managed identity (either system-assigned or user-assigned) provides an Microsoft Entra ID-authenticated identity for the function app, eliminating the need for credentials like client secrets. This identity is used to obtain an Microsoft Entra ID access token for authenticating to Key Vault. Option D is also required because the managed identity must be granted explicit Key Vault permissions (e.g., via an access policy or RBAC role) to read secrets; without these permissions, token-based authentication will fail with a 403 Forbidden error.

Answer

A client secret stored in the function app settings

Answer

A public IP address on the function app

Question 17

Your company uses Microsoft Defender for Cloud to protect Azure resources. You want to enable the 'Defender for Containers' plan to secure AKS clusters. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.. Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the primary configuration required to activate threat detection and security monitoring for AKS clusters. Option E is correct because audit logs must be enabled and streamed to a Log Analytics workspace to provide the necessary data for Defender for Containers to analyze Kubernetes audit events and detect suspicious activities.

Answer

Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.

Answer

Connect the AKS cluster to Azure Arc.

Answer

Install the Log Analytics agent on each AKS node.

Question 18

You are a security engineer at Litware. The company has an Azure virtual network named VNet1 with a subnet named Subnet1 that hosts several virtual machines. You need to restrict outbound internet access from Subnet1 to only allow traffic to specific FQDNs, such as *.microsoft.com and *.azure.com, while blocking all other outbound internet traffic. You also need to log allowed and denied traffic. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a user-defined route (UDR) in Subnet1 that directs all outbound traffic (0.0.0.0/0) to the Azure Firewall's private IP address as the next hop.. To restrict outbound internet access to specific FQDNs and log traffic, you need Azure Firewall with application rules that allow the desired FQDNs and deny everything else. You also need a user-defined route in Subnet1 that sends all outbound traffic (0.0.0.0/0) to the firewall's private IP. This combination ensures traffic is forced through the firewall and filtered by FQDN, with logging of allowed and denied flows.

Answer

Enable Azure DDoS Protection Standard on VNet1 to filter outbound traffic based on domain names.

Answer

Configure a network security group (NSG) on Subnet1 with outbound rules that allow traffic to the FQDNs and deny all other outbound traffic.

Answer

Deploy an Azure Application Gateway with WAF and configure custom rules to allow the FQDNs for outbound traffic.

Question 19

Which TWO features are available in Microsoft Entra ID Privileged Identity Management (PIM) for managing Azure AD roles? (Choose two.)

Accepted Answer

Just-in-time activation. Option B (Just-in-time activation) is correct because PIM's core capability is making users eligible for Microsoft Entra ID roles and requiring them to activate the role only when needed, granting time-bound, temporary elevation instead of permanent assignment. Option E (Approval workflow for role activation) is correct because PIM role settings allow administrators to require approval before an eligible user's activation request is granted, with designated approvers reviewing the request. The other options do not belong: self-service password reset (A) is an Entra ID authentication feature, not a PIM role-management feature; multi-factor authentication enforcement (C) is configured via Conditional Access or authentication methods, not as a PIM role feature; and automatic role assignment based on group membership (D) is handled by group-based licensing/role-assignable groups, not by PIM activation.

Answer

Self-service password reset

Answer

Multi-factor authentication enforcement

Answer

Automatic role assignment based on group membership

Question 20

Your company wants to implement a least-privilege model for administrative roles in Microsoft Entra ID. Which TWO features should you use?

Accepted Answer

Custom roles in Microsoft Entra ID. Custom roles in Microsoft Entra ID (option B) are correct because they let you define a precise set of directory permissions (for example, scoping actions like microsoft.directory/users/read) so administrators get only the access they need, which is the essence of least privilege. Privileged Identity Management (option E) is also correct because it enforces just-in-time activation of eligible directory roles with approval, MFA, and time-bound assignments, eliminating standing privileged access. Azure RBAC roles (option A) govern Azure resource-plane access, not Microsoft Entra ID administrative roles, so they don't address the directory role model in scope. Conditional Access policies (option C) control sign-in conditions and access to resources but do not define or limit administrative role permissions. Microsoft Entra B2B external identities (option D) is about collaborating with external users, not about constraining administrative privileges.

Answer

Azure RBAC roles

Answer

Conditional Access policies

Answer

Microsoft Entra B2B external identities