AZ-500 Quick Quiz — 10 Questions

Question 1

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. Azure Storage Service Encryption (SSE) with customer-managed keys integrates with Azure Key Vault, which can be configured to log key operations such as encrypt, decrypt, wrap, and unwrap. These logs are sent to Azure Monitor or a storage account, enabling auditing of key usage for compliance and security monitoring.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 2

A team wants to automatically deploy Defender for Cloud settings across new subscriptions under a management group. Which Azure capability should they use?

Accepted Answer

Azure Policy initiative assignment. Azure Policy initiative assignments allow you to bundle multiple policy definitions (such as those for Defender for Cloud) and assign them at the management group scope. This ensures that all new subscriptions under that management group automatically inherit and enforce the Defender for Cloud settings, including enabling security monitoring and threat detection. This is the correct approach because Azure Policy provides continuous compliance evaluation and remediation at scale across the entire resource hierarchy.

Answer

Application security groups

Answer

Conditional Access templates

Answer

Sentinel workbooks

Question 3

Refer to the exhibit. You have an Azure Application Gateway WAF policy with the above JSON configuration. A user from IP address 10.1.2.3 reports they cannot access the web application. What is the most likely cause?

Accepted Answer

The custom rule blocks all private IP addresses.. The custom rule in the WAF policy explicitly blocks all traffic from IP addresses in the 10.0.0.0/8 private range. Since the user's IP address (10.1.2.3) falls within this range, the rule matches and blocks the request. The WAF policy is in prevention mode, so the rule actively blocks the request rather than just logging it.

Answer

The WAF policy is in prevention mode and detected a SQL injection.

Answer

The WAF policy is set to detection mode and logs the request.

Answer

The custom rule is disabled due to a syntax error.

Question 4

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Azure AD Connect

Question 5

A storage account should be reachable only from a specific subnet over the Microsoft backbone, while keeping the public endpoint firewall restricted. Which feature should be used?

Accepted Answer

Service endpoint for Microsoft.Storage with storage firewall rules. A service endpoint for Microsoft.Storage extends your virtual network private address space and the identity of your VNet to the Azure Storage service over the Microsoft backbone. By combining the service endpoint with a storage firewall rule that restricts access to only that specific subnet, you ensure the storage account is reachable only from that subnet while keeping the public endpoint firewall restricted to deny all other traffic.

Answer

Application Security Group

Answer

Azure Bastion

Answer

Public IP prefix

Question 6

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections to the database use at least TLS 1.2 encryption. What configuration change must be made to enforce this requirement?

Accepted Answer

Configure the minimum TLS version in the SQL server's settings.. To enforce that all client connections to Azure SQL Database use at least TLS 1.2, you must configure the minimum TLS version at the SQL server level. This setting overrides the default behavior, which allows older, less secure TLS versions, and ensures that any connection attempt using TLS 1.0 or 1.1 is rejected. The configuration is made in the Azure portal under the SQL server's 'Connectivity' settings or via the 'Minimal TLS Version' property in ARM templates or PowerShell.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Update the server firewall rules to allow only specific IP addresses.

Answer

Implement Always Encrypted for all sensitive columns.

Question 7

You are deploying a web application that stores user-uploaded files in Azure Blob Storage. You need to ensure that only authenticated users can upload files, and that uploaded files are automatically scanned for malware. What should you use?

Accepted Answer

Enable Azure AD authentication for the storage account and enable Microsoft Defender for Storage. Enabling Microsoft Entra ID authentication for the storage account ensures that only authenticated users (via Microsoft Entra ID) can upload files, while Microsoft Defender for Storage provides built-in malware scanning for uploaded blobs. This combination directly addresses both requirements without additional infrastructure.

Answer

Use Azure Event Grid to trigger a function for malware scanning

Answer

Configure Azure Firewall to allow only the web app's IP address

Answer

Use shared access signatures (SAS) with stored access policies

Question 8

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Privileged Identity Management (PIM) enforces just-in-time (JIT) access by requiring approval for role activation, which aligns with the zero-trust principle of 'never trust, always verify' by eliminating standing privileges. Option E is correct because Conditional Access policies that require MFA and device compliance enforce continuous verification of user identity and device health before granting access, a core tenet of zero-trust identity.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Azure AD

Answer

Assign permanent Global Administrator roles to IT staff

Question 9

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically respond to phishing emails detected by Microsoft Defender XDR. They want to create a playbook that, when triggered, will delete the email from all recipients' mailboxes. Which integration should the playbook use?

Accepted Answer

Microsoft Graph API. The Microsoft Graph API provides the necessary endpoints to programmatically access and manipulate Exchange Online mail items, including deleting emails from user mailboxes. A Sentinel playbook can use an HTTP trigger with the Graph API to perform the deletion action on behalf of the security team, enabling automated remediation of phishing emails across all recipients.

Answer

Microsoft Power Automate

Answer

Exchange Online PowerShell

Answer

Microsoft 365 Defender API

Question 10

You are designing a privileged identity management strategy for Microsoft Entra ID. You need to ensure that eligible role assignments require approval from a designated group before activation. What configuration is required?

Accepted Answer

In PIM, configure the role settings to require approval and specify an approver group. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role settings to require approval for activation. By specifying an approver group, you ensure that eligible role assignments cannot be activated without explicit approval from designated members, enforcing a just-in-time (JIT) access control model.

Answer

Configure the role as eligible and set activation duration

Answer

Configure a Conditional Access policy with approval control

Answer

Create an access review for the role