AZ-500 Practice Questions

Question 1

A company plans to enable Azure Disk Encryption (ADE) on a fleet of Windows virtual machines. They want to use a key stored in Azure Key Vault to encrypt the disks. Which additional access configuration must be made in the Key Vault to allow ADE to succeed?

Accepted Answer

Grant the Azure Disk Encryption service principal (Microsoft.Azure.Security) appropriate key permissions in the Key Vault access policy.. Azure Disk Encryption (ADE) uses the Azure platform's built-in service principal (Microsoft.Azure.Security) to access the Key Vault and retrieve the disk encryption key. Without granting this service principal the necessary 'Get', 'WrapKey', and 'UnwrapKey' key permissions in the Key Vault access policy, ADE cannot authenticate and perform the encryption operations. This is a mandatory configuration step for ADE to succeed.

Answer

Assign a managed identity to each VM and grant that identity key permissions in the Key Vault.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Assign the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal.

Question 2

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.. Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Answer

Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.

Answer

Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.

Answer

Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

Question 3

A company is designing a hub-spoke network topology with Azure Firewall in the hub virtual network. Spoke virtual networks are peered to the hub. They want to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. However, traffic is still bypassing the firewall. What is the most likely cause?

Accepted Answer

The route table is not associated to the spoke subnet.. The most likely cause is that the route table with the default route (0.0.0.0/0) pointing to the Azure Firewall's private IP has not been associated to the spoke subnet. Without this association, the route table is not applied to the subnet's traffic, so the default system route (which directs internet traffic directly to the internet) remains in effect, bypassing the firewall. Associating the route table to the subnet is a required step for user-defined routes (UDRs) to influence traffic flow.

Answer

The Azure Firewall is in a different region than the spoke VNet.

Answer

The Azure Firewall does not have the correct network and application rules configured.

Answer

The spoke VNet has the 'Use remote virtual network gateways' setting disabled.

Question 4

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

Accepted Answer

The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.. The workbook likely has a time range filter set to 'Last 7 days', but the underlying KQL query uses a hardcoded 24-hour filter. This mismatch causes the query to return data only for the last 24 hours, but the dashboard filter may interfere or the query may be incorrectly referencing the time parameter. As a result, no data is displayed. Option A is incorrect because workbooks rely on KQL queries regardless of visualization type. Option B is incorrect because the Log Analytics gateway is used for on-premises data, not for Azure AD sign-in logs which stream directly to the workspace. Option D is incorrect because the problem statement confirms sign-in logs are being received.

Answer

The workbook uses a different visualization type that requires KQL.

Answer

The Log Analytics gateway is blocking the sign-in logs.

Answer

The Log Analytics workspace is not receiving sign-in logs from Azure AD.

Question 5

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.. When Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Answer

Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.

Answer

Enable soft-delete on the Key Vault.

Answer

Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

Question 6

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

Accepted Answer

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'. Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Answer

Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

Answer

Use Identity Protection's 'User risk policy' instead of Conditional Access

Answer

Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'

Question 7

A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks and have a single web application. Which Azure DDoS Protection tier should they use?

Accepted Answer

DDoS Protection Basic (default). DDoS Protection Basic is automatically enabled for all Azure resources at no additional cost, providing always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks. Since the company has a single web application and only needs protection against Layer 3/4 DDoS attacks, the Basic tier is sufficient and requires no configuration or extra cost.

Answer

DDoS Protection Standard

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Front Door with DDoS Protection Standard

Question 8

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

Accepted Answer

Blob Storage change feed.. The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Answer

Azure Blob Storage soft delete.

Answer

Azure Blob Storage versioning.

Answer

Azure Storage analytics logs.

Question 9

Drag and drop the steps to configure Azure Disk Encryption for a Windows VM using Azure Key Vault into the correct order.

Accepted Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.. The correct sequence for configuring Azure Disk Encryption for a Windows VM using Azure Key Vault is to first create or configure the Key Vault with soft-delete and purge protection, then set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions, and finally enable disk encryption on the VM specifying the Key Vault and key. This order ensures that all prerequisites are met, preventing errors during the encryption process.

Answer

1. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.

Answer

1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Answer

1. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

Question 10

A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?

Accepted Answer

Two inbound rules: one to allow HTTPS, and one to deny all other traffic. Network Security Groups (NSGs) contain default inbound security rules: AllowVNetInBound (priority 65000) and AllowAzureLoadBalancerInBound (priority 65001). These default rules would permit HTTPS traffic from sources within the virtual network or from Azure Load Balancer, violating the requirement to allow HTTPS only from the specific IP range 198.51.100.0/24. Therefore, an explicit deny-all rule must be added with a higher priority (lower numerical value) than the default allow rules to block all other traffic, including that from VNet and Azure Load Balancer. The minimal set is: one rule to allow HTTPS from 198.51.100.0/24 (high priority), and one rule to deny all inbound traffic from any source (at a slightly lower priority but still above the default rules). Option A is insufficient because it relies on the default deny rule (priority 65500), which is processed after the default allow rules, so VNet and Load Balancer traffic would still be permitted.

Answer

One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'

Answer

Three inbound rules: allow HTTPS, allow RDP for management, and deny all

Answer

One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'

Question 11

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 12

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Question 13

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 14

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Azure AD, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Azure AD tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 15

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

Accepted Answer

Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score. The Microsoft Defender for Cloud dashboard in the Azure portal naturally aggregates secure scores at the management group level when you select the root management group. This provides a single dashboard view with drill-down capability into individual management groups without any additional configuration, minimizing administrative overhead. Option A is incorrect because exporting to a Log Analytics workspace and creating a custom workbook adds unnecessary complexity and overhead for a simple aggregated view. Option B is incorrect because integrating with Power BI requires additional setup and licensing, and is not the simplest approach. Option D is incorrect because building a custom dashboard using the REST API requires development effort and maintenance, which is more overhead than using the built-in dashboard.

Answer

Export the secure score to a Log Analytics workspace and create a custom workbook

Answer

Integrate Defender for Cloud with Microsoft Power BI and create a report

Answer

Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard

Microsoft Azure Security Engineer Associate AZ-500 practice test

Three ways to study

Study AZ-500 by domain

Study AZ-500 by topic

Secure identity and access practice questions

Secure compute, storage, and databases practice questions

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel practice questions

Manage identity and access practice questions

Secure networking practice questions

AZ-500 fundamentals practice questions

AZ-500 scenario practice questions

AZ-500 troubleshooting practice questions

Top AZ-500 questions

Microsoft Azure Security Engineer Associate AZ-500 practice questions

How to use these AZ-500 questions

Quick answer