AZ-500 Timed Practice Test 2 — 10 Questions

Question 1

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

10 minute time limit — choose an answer to begin.

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 2

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Question 3

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 4

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Azure AD, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Azure AD tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 5

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

Accepted Answer

Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score. The Microsoft Defender for Cloud dashboard in the Azure portal naturally aggregates secure scores at the management group level when you select the root management group. This provides a single dashboard view with drill-down capability into individual management groups without any additional configuration, minimizing administrative overhead. Option A is incorrect because exporting to a Log Analytics workspace and creating a custom workbook adds unnecessary complexity and overhead for a simple aggregated view. Option B is incorrect because integrating with Power BI requires additional setup and licensing, and is not the simplest approach. Option D is incorrect because building a custom dashboard using the REST API requires development effort and maintenance, which is more overhead than using the built-in dashboard.

Answer

Export the secure score to a Log Analytics workspace and create a custom workbook

Answer

Integrate Defender for Cloud with Microsoft Power BI and create a report

Answer

Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard

Question 6

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

A default encryption scope is configured on the blob container that uses a Microsoft-managed key.. When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Answer

The Key Vault is in a different Azure region than the storage account.

Answer

The storage account does not have a system-assigned managed identity enabled.

Answer

The customer-managed key in Key Vault is disabled or expired.

Question 7

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

Accepted Answer

Azure AD Application Proxy.. Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Answer

Azure AD B2C (Business-to-Consumer).

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Front Door.

Question 8

A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.

Answer

Enable container soft delete with a retention period of 30 days

Answer

Enable blob versioning

Question 9

A company is enabling Azure Disk Encryption (ADE) on Windows virtual machines. They have enabled soft-delete on Azure Key Vault and configured a Key Encryption Key (KEK). However, the disk encryption fails with an error indicating that the key vault does not have the required permissions. What is the most likely missing configuration?

Accepted Answer

The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.. Azure Disk Encryption (ADE) requires the Azure Disk Encryption service principal (also known as the Azure Disk Encryption service) to have 'unwrap key' and 'wrap key' permissions on the Key Vault. These permissions allow the service to encrypt and decrypt the disk encryption keys using the Key Encryption Key (KEK). Without these specific cryptographic permissions, the encryption operation fails, even if soft-delete and a KEK are correctly configured.

Answer

The Key Vault firewall is blocking the Azure platform.

Answer

The VM does not have a managed identity assigned.

Answer

The KEK is in a different Azure region than the VM.

Question 10

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

Accepted Answer

No, Azure does not support CMK from a different region than the storage account.. Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Answer

Yes, but the storage account must use a different key vault per region; no other implications.

Answer

Yes, but you must enable cross-region replication for the key vault and pay additional costs.

Answer

Yes, but you must use a managed identity from the storage account's region to access the key vault.