CertArea
All Microsoft exams

Free AZ-500 practice test: 30 questions with answers

30 original questions for Microsoft Azure Security Technologies, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

AZ-500 exam guide: topics, cost and format

All 30 AZ-500 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel (8 questions)

  1. Question 1

    What is the difference between an Azure Policy definition and an initiative?

    1. AA definition is a single rule, and an initiative groups several definitions so they can be managed together
    2. BA definition is a billing plan, and an initiative is the discount that applies to the billing plan
    3. CA definition runs only on virtual machines, and an initiative runs only on storage accounts
    4. DA definition is a user role, and an initiative is a group of users who share one sign-in password
    Show answer and explanation
    Correct answer: A

    A policy definition is a single rule, and an initiative groups definitions for assignment and management together. The other descriptions confuse policy with billing and identity concepts.

  2. Question 2

    What does a Microsoft Defender for Cloud secure score represent?

    1. AThe speed of the network connection between the resources and the Defender service endpoints
    2. BThe number of alerts that were raised in the last 24 hours across all subscriptions in the tenant
    3. CThe total cost of the security plans enabled on a subscription, expressed as a percentage of spend
    4. DA measure of security posture based on the recommendations that have been completed across resources
    Show answer and explanation
    Correct answer: D

    The secure score reflects how many recommendations are completed across resources. Alert counts, cost and network speed are not what the score measures.

  3. Question 3

    Which practice reduces the impact of a leaked Key Vault secret?

    1. AKeeping the same secret for many years so that applications never need a configuration change
    2. BRotating the secret on a schedule and updating consumers to use the new version
    3. CCopying the secret into every application's source code so that it is available offline to them
    4. DPublishing the secret in the team wiki so that new developers can find it quickly each day
    Show answer and explanation
    Correct answer: B

    Scheduled rotation limits how long a leaked secret stays useful. Long-lived, copied or published secrets increase the exposure and the damage.

  4. Question 4

    What does a data connector do in Microsoft Sentinel?

    1. AIt deletes old alerts from the workspace automatically each night to save storage space
    2. BIt creates a new virtual network that isolates the workspace from all other Azure services
    3. CIt encrypts the analytics rules so that only the security team can read them later on
    4. DIt ingests logs and events from a data source into the Sentinel workspace for analysis
    Show answer and explanation
    Correct answer: D

    A data connector brings logs and events from a source into the workspace. Networking, rule encryption and alert deletion are not its purpose.

  5. Question 5

    Which Sentinel component runs a query on a schedule and creates alerts and incidents when conditions are met?

    1. AA watchlist, which stores reference data that queries can use but does not run queries itself
    2. BA workbook, which displays charts and tables for review but never generates incidents from logs
    3. CAn analytics rule, which runs a query on a schedule and generates alerts and incidents
    4. DA playbook, which runs only in response to an incident that an analyst has already created manually
    Show answer and explanation
    Correct answer: C

    Analytics rules run scheduled queries and create alerts and incidents. Workbooks, watchlists and playbooks serve visualisation, reference data and response.

  6. Question 6

    In Defender for Cloud, what does a workflow automation do?

    1. AIt schedules a full backup of every virtual machine in the subscription once each week
    2. BIt triggers a Logic App in response to a security alert or a recommendation
    3. CIt changes the subscription billing currency based on the region of the resources deployed
    4. DIt deletes resources automatically when the secure score falls below a threshold value
    Show answer and explanation
    Correct answer: B

    A workflow automation triggers a Logic App when alerts or recommendations match its conditions. Backups, billing and automatic deletion are not what it does.

  7. Question 7

    Which Defender for Cloud plan detects suspicious access and malware uploads to Azure Storage accounts?

    1. AMicrosoft Defender for DNS, which detects suspicious DNS queries made by resources in the network
    2. BMicrosoft Defender for Containers, which protects Kubernetes clusters and the container images they run
    3. CMicrosoft Defender for App Service, which monitors the web applications hosted on app service plans
    4. DMicrosoft Defender for Storage, which detects suspicious access and malware uploads to storage
    Show answer and explanation
    Correct answer: D

    Defender for Storage detects suspicious access and malware uploads to storage accounts. The other plans protect containers, web apps and DNS traffic.

  8. Question 8

    Which TWO are benefits of using Microsoft Sentinel analytics and automation together? (Choose two.)

    1. ACorrelating events from several connectors into one incident for investigation
    2. BDeleting raw logs after the first alert so that storage is free for new events
    3. CRunning response playbooks automatically when an incident matches an automation rule
    4. DReplacing the need for any data connector configuration in the workspace
    5. EShowing only alerts from the last hour with no history kept for later review
    Show answer and explanation
    Correct answer: A, C

    Correlation into incidents and automated playbook responses are core Sentinel benefits. Deleting logs, skipping connectors and discarding history each reduce investigative value.

Secure compute, storage, and databases (8 questions)

  1. Question 9

    What does just-in-time VM access in Microsoft Defender for Cloud do?

    1. AIt encrypts the disks of a virtual machine at the moment it is first started by an operator
    2. BIt creates a virtual machine on demand from a template when a user requests a development environment
    3. CIt opens management ports for a limited time for approved requests and closes them afterwards
    4. DIt installs security patches on virtual machines at the first sign-in of each day automatically
    Show answer and explanation
    Correct answer: C

    Just-in-time access opens management ports for approved, time-limited requests and closes them afterwards. Provisioning, disk encryption and patching are different features.

  2. Question 10

    Which access model is recommended for granting data-plane access to Azure Key Vault secrets?

    1. AA shared access key stored in the application configuration so that any caller can read it
    2. BAzure role-based access control, with roles assigned to the users or identities that need them
    3. CA single vault access policy granted to every user in the tenant, including guest accounts
    4. DAnonymous access enabled on the vault so that applications can read secrets without signing in
    Show answer and explanation
    Correct answer: B

    Azure role-based access control lets you grant least-privilege roles to specific identities. Shared keys, tenant-wide policies and anonymous access all weaken control over secrets.

  3. Question 11

    Which storage feature prevents blobs from being deleted or modified for a fixed legal retention period?

    1. ASoft delete, which keeps deleted blobs recoverable for a period but does not block changes to them
    2. BBlob lifecycle management, which moves blobs to cooler access tiers after a set number of days
    3. CImmutable storage with a time-based retention policy, which blocks changes for the retention period
    4. DA storage account firewall, which restricts the network addresses that can reach the account
    Show answer and explanation
    Correct answer: C

    Immutable storage with a time-based retention policy blocks deletion and modification for the period. Lifecycle rules, soft delete and firewalls do not enforce that immutability.

  4. Question 12

    Which feature encrypts Azure SQL Database files and backups at rest without any change to the application?

    1. AAuditing, which records database events to a log destination for review and compliance checks
    2. BDynamic data masking, which hides values from low-privileged users in the results of queries
    3. CAlways Encrypted, which needs client-side encryption changes in the application code to work
    4. DTransparent Data Encryption, which encrypts the database files and backups at rest
    Show answer and explanation
    Correct answer: D

    Transparent Data Encryption encrypts data at rest transparently, so the application does not change. Always Encrypted needs client changes, and masking and auditing do not encrypt storage.

  5. Question 13

    What does dynamic data masking do in Azure SQL Database?

    1. AIt obscures sensitive column values in query results for users without the unmask permission
    2. BIt encrypts the entire database file so that the file cannot be read by the operating system
    3. CIt deletes sensitive rows from the table after a configured retention period has passed
    4. DIt blocks all queries from non-administrator accounts to the database server at the network layer
    Show answer and explanation
    Correct answer: A

    Dynamic data masking obscures sensitive values in query results for users who lack the unmask permission. The stored data is not encrypted, deleted or blocked by masking.

  6. Question 14

    Which approach is recommended for controlling user access to the Kubernetes API in AKS?

    1. AEnable Microsoft Entra integration and use Azure role-based access control for Kubernetes authorisation
    2. BShare the cluster admin kubeconfig file among the development team so that everyone uses one account
    3. CDisable authentication on the API server so that workloads can call it without credentials at all
    4. DCreate one service account with cluster-admin rights and embed its token in every pipeline script
    Show answer and explanation
    Correct answer: A

    Microsoft Entra integration with Azure RBAC gives individual, auditable access to the cluster API. Shared admin files, disabled authentication and embedded cluster-admin tokens each remove accountability.

  7. Question 15

    Which TWO are recommended measures for securing an AKS cluster? (Choose two.)

    1. ARestricting API server access to authorised IP ranges or using a private cluster
    2. BRunning every workload as root in privileged containers for compatibility with older images
    3. CStoring container registry admin credentials in the cluster manifests for easy pipeline access
    4. DUsing Microsoft Entra authentication together with role-based access control
    5. EDisabling network policies so that pods can reach each other freely across namespaces
    Show answer and explanation
    Correct answer: A, D

    Restricting API server access and using Entra authentication with RBAC both reduce exposure. Privileged root containers, stored registry credentials and open pod networking each weaken the cluster.

  8. Question 16

    Which TWO features protect Azure Storage blob data against accidental deletion or overwrite? (Choose two.)

    1. ASoft delete for blobs and containers, which keeps deleted items recoverable for a set period
    2. BPublic blob access so that backups can be restored from any device on the internet
    3. CShared access keys that never expire, so that access is never lost during an outage
    4. DBlob versioning, which keeps previous versions of a blob when it is overwritten
    5. ELifecycle rules that delete blobs after one day regardless of any retention requirement
    Show answer and explanation
    Correct answer: A, D

    Soft delete and blob versioning keep recoverable copies of deleted or overwritten data. Public access, non-expiring keys and short lifecycle deletion each put the data at risk.

Secure identity and access (7 questions)

  1. Question 17

    Which built-in Azure role lets a user manage role assignments for others without changing the resources themselves?

    1. AUser Access Administrator, which manages role assignments for other users on a scope
    2. BContributor, which creates and changes resources but cannot assign roles to other users
    3. CReader, which views resources and their configuration without making any changes to them
    4. DSecurity Reader, which views security data in Defender for Cloud without assigning any roles
    Show answer and explanation
    Correct answer: A

    User Access Administrator can manage role assignments without managing the resources. Contributor cannot assign roles, and Reader and Security Reader cannot change assignments.

  2. Question 18

    What does an eligible assignment in Microsoft Entra Privileged Identity Management provide?

    1. AA guest invitation that adds an external user to the directory with no role on any resource
    2. BA permanent active role that applies at all times without any approval, expiry or review step
    3. CA role the user can activate for a limited time when needed, usually with approval or justification
    4. DA long-lived client secret that lets an application sign in to the directory with a password
    Show answer and explanation
    Correct answer: C

    An eligible assignment lets the user activate the role only when needed, for a limited period. Permanent roles, guest invitations and client secrets do not provide just-in-time activation.

  3. Question 19

    Which Conditional Access grant control requires a user to complete multifactor authentication when a policy matches a sign-in?

    1. APersistent browser session, which keeps the user signed in for a long period on the device used
    2. BRequire multifactor authentication, which is applied as a grant control when the conditions match
    3. CSign-in frequency, which sets how often the user is asked to sign in again to the application
    4. DNamed location, which records the trusted network ranges that the policy conditions can refer to
    Show answer and explanation
    Correct answer: B

    The require multifactor authentication grant control enforces MFA when the policy conditions match. Persistent sessions, sign-in frequency and named locations are session or condition settings rather than the MFA grant.

  4. Question 20

    What is the main advantage of a managed identity over an app registration with a client secret?

    1. AIt lets the identity sign in interactively with a typed password each time the application starts
    2. BIt removes the need for any role assignment on the resource that the identity needs to access
    3. CAzure manages the credential lifecycle, so the team does not store or rotate a secret for it
    4. DIt gives the identity permanent global administrator rights across every subscription in the tenant
    Show answer and explanation
    Correct answer: C

    Azure manages the credentials for a managed identity, so there is no secret to store or rotate. Managed identities still need role assignments, and they do not sign in interactively or receive global administrator rights.

  5. Question 21

    What must happen when an app registration requests delegated permissions that only an administrator can approve?

    1. AThe application must move into a different subscription that has no permission restrictions
    2. BEach user must delete the app registration and recreate it with the same permission scopes
    3. CThe application must rotate its client secret every time a user signs in for the first time
    4. DAn administrator grants admin consent for those permissions on behalf of the organisation
    Show answer and explanation
    Correct answer: D

    Permissions that require admin approval need an administrator to grant admin consent for the organisation. Recreating the registration, rotating secrets and moving subscriptions do not provide consent.

  6. Question 22

    Which TWO are benefits of Microsoft Entra Privileged Identity Management? (Choose two.)

    1. ATime-limited role activation with approval options for privileged roles
    2. BPermanent global administrator assignments for every user to reduce sign-in friction
    3. CAccess reviews that can remove privileged access that is no longer needed
    4. DDisabling multifactor authentication for privileged roles so that activation is quicker
    5. EAutomatic deletion of user accounts after a set time with no review step
    Show answer and explanation
    Correct answer: A, C

    Time-limited activation and access reviews reduce standing privilege. Permanent assignments, disabled MFA and automatic deletion each increase risk.

  7. Question 23

    What is the difference between a system-assigned and a user-assigned managed identity?

    1. AA user-assigned identity is deleted with the first resource that uses it, while a system-assigned identity persists
    2. BA system-assigned identity is tied to one resource, while a user-assigned identity can be shared
    3. CA system-assigned identity can be used only by human users, while user-assigned identities serve only applications
    4. DBoth types require a client secret that is stored in the resource configuration for each sign-in
    Show answer and explanation
    Correct answer: B

    A system-assigned identity is created with and deleted with one resource, while a user-assigned identity is a standalone resource that several resources can share. The other statements reverse the lifecycle or wrongly require secrets.

Secure networking (7 questions)

  1. Question 24

    What is the purpose of an application security group in Azure?

    1. AIt groups network interfaces by workload role so that NSG rules can refer to the group rather than to IP addresses
    2. BIt encrypts traffic between two virtual machines in the same subnet by using a shared encryption key
    3. CIt routes traffic between subscriptions through a central hub with no filtering applied to the flows
    4. DIt stores application logs for the virtual machines in one central workspace for later analysis
    Show answer and explanation
    Correct answer: A

    Application security groups let NSG rules refer to workloads by role instead of by IP address. They do not encrypt traffic, route it between subscriptions or store logs.

  2. Question 25

    Which feature gives a supported Azure PaaS service a private IP address inside your virtual network?

    1. ARoute table, which sends traffic to a next hop chosen by the administrator for the subnet
    2. BPublic IP address, which exposes the service to the internet on a fixed address for all clients
    3. CPrivate Endpoint, which maps a private IP address from your virtual network to the service
    4. DNetwork Watcher, which captures packets for analysis without changing where traffic is routed
    Show answer and explanation
    Correct answer: C

    A private endpoint maps a private IP address from your virtual network to the service. Public addresses, route tables and Network Watcher do not give the service a private address.

  3. Question 26

    Which service inspects HTTP requests for common web attacks such as SQL injection and cross-site scripting?

    1. AAzure Bastion, which provides secure remote desktop and SSH access to virtual machines in the subnet
    2. BWeb Application Firewall, which inspects HTTP requests and blocks common web attacks
    3. CAzure DDoS Protection, which absorbs volumetric attacks without inspecting application requests
    4. DNetwork Watcher, which records flow logs and captures packets for later analysis of traffic
    Show answer and explanation
    Correct answer: B

    A Web Application Firewall inspects HTTP requests for injection and scripting attacks. Bastion, DDoS Protection and Network Watcher address different needs.

  4. Question 27

    Which connection type lets an individual client device connect securely to an Azure virtual network?

    1. APoint-to-site VPN, which connects a single client device to the virtual network
    2. BSite-to-site VPN, which connects an entire on-premises network through a VPN gateway
    3. CExpressRoute private peering, which connects a dedicated circuit between two data centres
    4. DVirtual network peering, which joins two virtual networks inside the same Azure region
    Show answer and explanation
    Correct answer: A

    A point-to-site VPN connects one client device to the virtual network. Site-to-site, ExpressRoute and peering connect networks rather than individual devices.

  5. Question 28

    What is the purpose of a user-defined route in Azure?

    1. AIt blocks all inbound traffic to the subnet unless a rule explicitly allows the traffic on the port
    2. BIt overrides the default system routes so that traffic to a prefix goes to a chosen next hop such as a firewall
    3. CIt assigns a public IP address to a virtual machine that has only a private address in the subnet
    4. DIt replicates the virtual network into another region for disaster recovery purposes only
    Show answer and explanation
    Correct answer: B

    A user-defined route overrides system routes so that selected traffic is sent to a next hop such as a firewall. Inbound filtering, public addressing and replication are handled by other features.

  6. Question 29

    Which TWO are valid ways to restrict outbound internet traffic from a subnet? (Choose two.)

    1. ARoute internet-bound traffic through Azure Firewall with a user-defined route
    2. BAssign a public IP to every virtual machine so that outbound traffic is easier to trace
    3. CApply an NSG outbound rule that denies internet traffic except to explicitly allowed destinations
    4. DDisable the NSG so that the firewall sees the traffic first without any filtering in the subnet
    5. EAllow all outbound rules by default and rely on endpoint antivirus software alone
    Show answer and explanation
    Correct answer: A, C

    A user-defined route to Azure Firewall and an NSG outbound deny rule both restrict outbound traffic. Public IPs, disabled NSGs and open rules all widen exposure.

  7. Question 30

    How are network security group rules evaluated when more than one rule matches a flow?

    1. AAll matching rules are applied together, and the most permissive rule wins for the traffic
    2. BThe matching rule with the highest priority number is always applied first, regardless of the others
    3. CThe matching rule with the lowest priority number is applied and processing stops
    4. DRules are applied in alphabetical order of their names, and the first match decides the outcome
    Show answer and explanation
    Correct answer: C

    NSG rules are processed by priority, and the lowest number that matches decides the outcome. Highest-number precedence, permissive-wins and alphabetical order are not how NSGs evaluate rules.