Home/Directory/az 500

az 500 Practice Questions

Page 1 of 1 (25 total questions)

A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?
View Question & Answer ➔
Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?
View Question & Answer ➔
You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?
View Question & Answer ➔
Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?
View Question & Answer ➔
You have a web application running on Azure VMs behind an Azure Application Gateway. You need to protect the application from SQL injection and cross-site scripting (XSS) attacks. Which feature of Application Gateway provides this?
View Question & Answer ➔
Your organization has multiple VNets across different Azure regions. You need to ensure all traffic between VNets is inspected by a centralized Azure Firewall before being forwarded. Which Azure networking topology supports this at scale?
View Question & Answer ➔
You need to allow Azure Virtual Machines in a subnet to access Azure Storage and Azure Key Vault without traversing the public internet, and without assigning public IP addresses to the VMs. Which Azure feature achieves this?
View Question & Answer ➔
An application running as an Azure App Service needs to retrieve secrets from Azure Key Vault. You want to avoid storing any credentials in the application code or configuration. What is the most secure approach?
View Question & Answer ➔
A developer accidentally deleted a secret from Azure Key Vault that is needed by a production application. The application is now failing. What is the quickest recovery action, assuming soft-delete is enabled on the vault?
View Question & Answer ➔
Your organization's compliance policy requires that encryption keys for Azure SQL Database are managed by the organization, not Microsoft. The keys must be stored in a Hardware Security Module (HSM). What should you implement?
View Question & Answer ➔
Microsoft Defender for Cloud shows several security recommendations but you are overwhelmed by the volume. You need to focus first on the recommendations that would have the greatest impact on your Secure Score. Which approach should you take?
View Question & Answer ➔
Microsoft Defender for Cloud has detected a brute force RDP attack on one of your Azure VMs. The VM is a development machine and you cannot immediately patch it. Which Defender for Cloud feature can you enable to reduce the attack surface immediately without shutting down the VM?
View Question & Answer ➔
You need to ensure all Azure VMs in a subscription have Microsoft Defender for Endpoint automatically installed as they are provisioned, including VMs created by other teams. You manage security centrally. Which Defender for Cloud feature provides this?
View Question & Answer ➔
You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?
View Question & Answer ➔
Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?
View Question & Answer ➔
You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?
View Question & Answer ➔
A third-party vendor needs read-only access to specific blobs in a container for exactly 48 hours. You must not give them any Azure credentials or permanent access. Which approach should you use?
View Question & Answer ➔
Your security team needs to ensure that all new Azure resources across the organization are tagged with 'CostCenter' and 'Environment' tags. Resources without these tags must be blocked from deployment. Which Azure feature enforces this?
View Question & Answer ➔
You need to investigate which Azure AD user made changes to an Azure RBAC role assignment two weeks ago. Which service provides this audit trail?
View Question & Answer ➔
Your Azure VMs run Windows Server. You need to ensure that only approved applications can run on these VMs and any unknown executables are blocked. Which Defender for Cloud feature provides this application control?
View Question & Answer ➔
A security audit reveals that Azure VMs in your environment have public IP addresses with RDP port 3389 open to the internet in their NSGs. You need to provide emergency access for administrators while eliminating the persistent exposure. What is the recommended solution?
View Question & Answer ➔
Your organization must comply with ISO 27001. You need to continuously assess your Azure environment against ISO 27001 controls and get a compliance score with evidence. Which Defender for Cloud feature provides this?
View Question & Answer ➔
You need to retain Azure Activity Logs for 2 years to meet compliance requirements. The default 90-day retention is insufficient. What is the most cost-effective Azure-native solution?
View Question & Answer ➔
You need to scan container images in Azure Container Registry (ACR) for known vulnerabilities before they are deployed to Azure Kubernetes Service (AKS). You also want to block vulnerable images from being deployed to AKS. What is the recommended approach?
View Question & Answer ➔
Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?
View Question & Answer ➔

Page 1 of 1

az 500 Practice Questions

A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?

Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?

You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?

Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?

You have a web application running on Azure VMs behind an Azure Application Gateway. You need to protect the application from SQL injection and cross-site scripting (XSS) attacks. Which feature of Application Gateway provides this?

Your organization has multiple VNets across different Azure regions. You need to ensure all traffic between VNets is inspected by a centralized Azure Firewall before being forwarded. Which Azure networking topology supports this at scale?

You need to allow Azure Virtual Machines in a subnet to access Azure Storage and Azure Key Vault without traversing the public internet, and without assigning public IP addresses to the VMs. Which Azure feature achieves this?

An application running as an Azure App Service needs to retrieve secrets from Azure Key Vault. You want to avoid storing any credentials in the application code or configuration. What is the most secure approach?

A developer accidentally deleted a secret from Azure Key Vault that is needed by a production application. The application is now failing. What is the quickest recovery action, assuming soft-delete is enabled on the vault?

Your organization's compliance policy requires that encryption keys for Azure SQL Database are managed by the organization, not Microsoft. The keys must be stored in a Hardware Security Module (HSM). What should you implement?

Microsoft Defender for Cloud shows several security recommendations but you are overwhelmed by the volume. You need to focus first on the recommendations that would have the greatest impact on your Secure Score. Which approach should you take?

Microsoft Defender for Cloud has detected a brute force RDP attack on one of your Azure VMs. The VM is a development machine and you cannot immediately patch it. Which Defender for Cloud feature can you enable to reduce the attack surface immediately without shutting down the VM?

You need to ensure all Azure VMs in a subscription have Microsoft Defender for Endpoint automatically installed as they are provisioned, including VMs created by other teams. You manage security centrally. Which Defender for Cloud feature provides this?

You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?

Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?

You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?

A third-party vendor needs read-only access to specific blobs in a container for exactly 48 hours. You must not give them any Azure credentials or permanent access. Which approach should you use?

Your security team needs to ensure that all new Azure resources across the organization are tagged with 'CostCenter' and 'Environment' tags. Resources without these tags must be blocked from deployment. Which Azure feature enforces this?

You need to investigate which Azure AD user made changes to an Azure RBAC role assignment two weeks ago. Which service provides this audit trail?

Your Azure VMs run Windows Server. You need to ensure that only approved applications can run on these VMs and any unknown executables are blocked. Which Defender for Cloud feature provides this application control?

A security audit reveals that Azure VMs in your environment have public IP addresses with RDP port 3389 open to the internet in their NSGs. You need to provide emergency access for administrators while eliminating the persistent exposure. What is the recommended solution?

Your organization must comply with ISO 27001. You need to continuously assess your Azure environment against ISO 27001 controls and get a compliance score with evidence. Which Defender for Cloud feature provides this?

You need to retain Azure Activity Logs for 2 years to meet compliance requirements. The default 90-day retention is insufficient. What is the most cost-effective Azure-native solution?

You need to scan container images in Azure Container Registry (ACR) for known vulnerabilities before they are deployed to Azure Kubernetes Service (AKS). You also want to block vulnerable images from being deployed to AKS. What is the recommended approach?

Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?