AZ-500 Practice Questions

Question 1

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. Azure Storage Service Encryption (SSE) with customer-managed keys integrates with Azure Key Vault, which can be configured to log key operations such as encrypt, decrypt, wrap, and unwrap. These logs are sent to Azure Monitor or a storage account, enabling auditing of key usage for compliance and security monitoring.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 2

A team wants to automatically deploy Defender for Cloud settings across new subscriptions under a management group. Which Azure capability should they use?

Accepted Answer

Azure Policy initiative assignment. Azure Policy initiative assignments allow you to bundle multiple policy definitions (such as those for Defender for Cloud) and assign them at the management group scope. This ensures that all new subscriptions under that management group automatically inherit and enforce the Defender for Cloud settings, including enabling security monitoring and threat detection. This is the correct approach because Azure Policy provides continuous compliance evaluation and remediation at scale across the entire resource hierarchy.

Answer

Application security groups

Answer

Conditional Access templates

Answer

Sentinel workbooks

Question 3

Refer to the exhibit. You have an Azure Application Gateway WAF policy with the above JSON configuration. A user from IP address 10.1.2.3 reports they cannot access the web application. What is the most likely cause?

Accepted Answer

The custom rule blocks all private IP addresses.. The custom rule in the WAF policy explicitly blocks all traffic from IP addresses in the 10.0.0.0/8 private range. Since the user's IP address (10.1.2.3) falls within this range, the rule matches and blocks the request. The WAF policy is in prevention mode, so the rule actively blocks the request rather than just logging it.

Answer

The WAF policy is in prevention mode and detected a SQL injection.

Answer

The WAF policy is set to detection mode and logs the request.

Answer

The custom rule is disabled due to a syntax error.

Question 4

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Microsoft Entra Connect

Question 5

A storage account should be reachable only from a specific subnet over the Microsoft backbone, while keeping the public endpoint firewall restricted. Which feature should be used?

Accepted Answer

Service endpoint for Microsoft.Storage with storage firewall rules. A service endpoint for Microsoft.Storage extends your virtual network private address space and the identity of your VNet to the Azure Storage service over the Microsoft backbone. By combining the service endpoint with a storage firewall rule that restricts access to only that specific subnet, you ensure the storage account is reachable only from that subnet while keeping the public endpoint firewall restricted to deny all other traffic.

Answer

Application Security Group

Answer

Azure Bastion

Answer

Public IP prefix

Question 6

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections to the database use at least TLS 1.2 encryption. What configuration change must be made to enforce this requirement?

Accepted Answer

Configure the minimum TLS version in the SQL server's settings.. To enforce that all client connections to Azure SQL Database use at least TLS 1.2, you must configure the minimum TLS version at the SQL server level. This setting overrides the default behavior, which allows older, less secure TLS versions, and ensures that any connection attempt using TLS 1.0 or 1.1 is rejected. The configuration is made in the Azure portal under the SQL server's 'Connectivity' settings or via the 'Minimal TLS Version' property in ARM templates or PowerShell.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Update the server firewall rules to allow only specific IP addresses.

Answer

Implement Always Encrypted for all sensitive columns.

Question 7

You are deploying a web application that stores user-uploaded files in Azure Blob Storage. You need to ensure that only authenticated users can upload files, and that uploaded files are automatically scanned for malware. What should you use?

Accepted Answer

Enable Microsoft Entra ID authentication for the storage account and enable Microsoft Defender for Storage. Enabling Microsoft Entra ID authentication for the storage account ensures that only authenticated users (via Microsoft Entra ID) can upload files, while Microsoft Defender for Storage provides built-in malware scanning for uploaded blobs. This combination directly addresses both requirements without additional infrastructure.

Answer

Use Azure Event Grid to trigger a function for malware scanning

Answer

Configure Azure Firewall to allow only the web app's IP address

Answer

Use shared access signatures (SAS) with stored access policies

Question 8

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Privileged Identity Management (PIM) enforces just-in-time (JIT) access by requiring approval for role activation, which aligns with the zero-trust principle of 'never trust, always verify' by eliminating standing privileges. Option E is correct because Conditional Access policies that require MFA and device compliance enforce continuous verification of user identity and device health before granting access, a core tenet of zero-trust identity.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Microsoft Entra ID

Answer

Assign permanent Global Administrator roles to IT staff

Question 9

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically respond to phishing emails detected by Microsoft Defender XDR. They want to create a playbook that, when triggered, will delete the email from all recipients' mailboxes. Which integration should the playbook use?

Accepted Answer

Microsoft Graph API. The Microsoft Graph API provides the necessary endpoints to programmatically access and manipulate Exchange Online mail items, including deleting emails from user mailboxes. A Sentinel playbook can use an HTTP trigger with the Graph API to perform the deletion action on behalf of the security team, enabling automated remediation of phishing emails across all recipients.

Answer

Microsoft Power Automate

Answer

Exchange Online PowerShell

Answer

Microsoft 365 Defender API

Question 10

You are designing a privileged identity management strategy for Microsoft Entra ID. You need to ensure that eligible role assignments require approval from a designated group before activation. What configuration is required?

Accepted Answer

In PIM, configure the role settings to require approval and specify an approver group. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role settings to require approval for activation. By specifying an approver group, you ensure that eligible role assignments cannot be activated without explicit approval from designated members, enforcing a just-in-time (JIT) access control model.

Answer

Configure the role as eligible and set activation duration

Answer

Configure a Conditional Access policy with approval control

Answer

Create an access review for the role

Question 11

A security analyst uses Microsoft Defender for Cloud. They need to assess their Azure environment's compliance against the Payment Card Industry Data Security Standard (PCI DSS). Which dashboard in Defender for Cloud should they use to view the compliance status?

Accepted Answer

Regulatory Compliance. The Regulatory Compliance dashboard in Microsoft Defender for Cloud provides a pre-built assessment of your Azure environment against specific compliance standards, including PCI DSS. It maps your security controls to the requirements of the standard and shows a compliance score based on the results of continuous assessments. This is the correct tool for viewing compliance status against PCI DSS.

Answer

Secure Score

Answer

Security Alerts

Answer

Workbooks

Question 12

Which TWO actions should you take to secure a virtual network in Azure? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets.. Network security groups (NSGs) are a fundamental Azure security control that filter traffic at the subnet or network interface level. Applying an NSG to a subnet allows you to define inbound and outbound security rules based on source/destination IP, port, and protocol, effectively segmenting and protecting the virtual network from unauthorized access.

Answer

Configure Azure DNS zones.

Answer

Deploy Azure Bastion for VM access.

Answer

Set up Azure Monitor alerts.

Question 13

A company wants to ensure that users can only access Microsoft 365 services (e.g., Exchange Online, SharePoint Online) from devices that are confirmed to be compliant with corporate security policies (e.g., encryption enabled, antivirus active). Which Azure AD policy type should they create?

Accepted Answer

Conditional Access policy with the 'Require compliant device' grant control.. A is correct because a Conditional Access policy with the 'Require compliant device' grant control enforces device-based access restrictions by checking the device's compliance status reported by Microsoft Intune. This ensures that only devices meeting corporate security policies (e.g., encryption enabled, antivirus active) can access Microsoft 365 services like Exchange Online and SharePoint Online.

Answer

Identity Protection policy with a sign-in risk policy.

Answer

Access review policy for groups.

Answer

Privileged Identity Management (PIM) activation policy.

Question 14

A Conditional Access policy requiring compliant devices does not apply to Azure PowerShell access. Sign-in logs show the cloud app is excluded. What should be changed?

Accepted Answer

Include the relevant cloud app or target all cloud apps after testing exclusions. Conditional Access policies apply only to cloud apps explicitly included in the policy. Since Azure PowerShell is excluded, the policy does not enforce the 'Require device to be marked as compliant' condition for that app. To fix this, you must either include the specific cloud app (Microsoft Azure PowerShell) or set the policy to target 'All cloud apps' and then test exclusions to ensure the compliant device requirement is applied to Azure PowerShell access.

Answer

Disable device compliance in Intune

Answer

Convert the policy to a named location policy

Answer

Remove MFA from all users

Question 15

A Defender for Cloud secure score recommendation says storage accounts allow public blob access. What remediation best addresses the root issue?

Accepted Answer

Disable public blob access at the storage account level and review container ACLs. The secure score recommendation indicates that storage accounts allow public blob access, which is a security risk. The root cause is that anonymous access is enabled at the storage account level, and individual container ACLs may also permit public access. Disabling public blob access at the storage account level (via the 'AllowBlobPublicAccess' property) immediately blocks all anonymous requests, and reviewing container ACLs ensures no residual permissions exist. This directly addresses the vulnerability by enforcing a deny-by-default posture.

Answer

Enable storage account static website hosting

Answer

Increase Log Analytics retention

Answer

Create an Azure Front Door profile

Microsoft Azure Security Engineer Associate AZ-500 practice test

Three ways to study

Study AZ-500 by domain

Study AZ-500 by topic

Secure compute, storage, and databases practice questions

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel practice questions

Secure identity and access practice questions

Manage identity and access practice questions

Secure networking practice questions

AZ-500 fundamentals practice questions

AZ-500 scenario practice questions

AZ-500 troubleshooting practice questions

Top AZ-500 questions

Microsoft Azure Security Engineer Associate AZ-500 practice questions