AZ-500 Practice Questions: Identity, Network and Application Security Scenarios

Here are 8 multiple-choice questions designed to match the difficulty, style, and domain coverage of the AZ-500 exam. --- These questions cover key domains of the AZ-500 exam, including identity management, platform protection, data security, and governance. Try to answer them without looking at the explanations first to simulate the exam environment.

Question 1

Your company uses Azure AD and has enabled Self-Service Password Reset (SSPR) for all users. You need to ensure that when a user resets their password, the session tokens for any active sessions on mobile devices and browsers are immediately invalidated. What should you do? Looking for more detail? See CEH Practice Questions: Network Scanning and Exploitation Scenarios.

1. A. Configure an Authentication Session Control policy in Conditional Access.
2. B. Enable the "Block user from using legacy authentication" setting in the user properties.
3. C. Configure a User Risk policy in Identity Protection to require a password change.
4. D. Set the "Number of methods required to reset" to 2 in the SSPR settings.

Answer: A

Explanation: Authentication Session Controls in Conditional Access allow you to enforce a sign-in frequency, which forces re-authentication and invalidates existing sessions after a password change. Option B blocks legacy auth but doesn't invalidate existing sessions. Option C is a risk-based policy, not a direct response to an SSPR event. Option D increases the security of the reset process itself but does not invalidate existing tokens.

Question 2

You are deploying a new application to Azure that will store sensitive customer data in Azure Blob Storage. You need to ensure that data at rest is encrypted, but you must maintain your own encryption keys to meet corporate compliance requirements. You want to minimize administrative overhead for key rotation. What should you implement?

1. A. Server-side encryption with Microsoft-managed keys (SSE).
2. B. Azure Disk Encryption (ADE) with Azure Key Vault.
3. C. Server-side encryption with customer-managed keys (CMK) in Azure Key Vault.
4. D. Client-side encryption using the Azure Storage client library.

Answer: C

Explanation: Server-side encryption with customer-managed keys (CMK) allows Azure to encrypt the data, but you control the key in Azure Key Vault, meeting compliance and reducing overhead compared to client-side encryption. Option A uses Microsoft-managed keys, failing the requirement. Option B is for IaaS VM disks, not Blob Storage. Option D requires you to manage the entire encryption/decryption lifecycle, which is higher overhead.

Question 3

Your organization has a hybrid identity environment with Azure AD Connect. You have enabled Password Hash Synchronization. A user reports that they are locked out of their on-premises Active Directory account after multiple failed sign-in attempts to Microsoft 365. You need to ensure that Azure AD lockout events trigger a lockout on the on-premises AD. What should you configure?

1. A. Azure AD Connect Health
2. B. Password Writeback
3. C. Azure AD Smart Lockout
4. D. Seamless Single Sign-On (SSO)

Answer: B

Explanation: Password Writeback allows Azure AD to write password change or unlock events back to the on-premises Active Directory. While Smart Lockout (C) protects against brute-force attacks in the cloud, it doesn't propagate the lockout state on-premises. Azure AD Connect Health (A) monitors health but doesn't sync lockout states. Seamless SSO (D) provides silent authentication but doesn't handle lockout synchronization. This connects to what we discuss in Azure AZ-500 Passing Score: Security Technologies Scoring Explained.

Question 4

You are designing a network security strategy for a new VNet. You need to filter traffic between subnets, and you must ensure the solution is highly available across availability zones and supports Application Rule collections. What should you use?

1. A. Network Security Groups (NSGs) applied to the subnets.
2. B. Azure Firewall Premium deployed with a Standard SKU.
3. C. Azure Firewall Premium deployed with a Premium SKU.
4. D. A User-Defined Route (UDR) pointing to a Network Virtual Appliance (NVA).

Answer: C

Explanation: Azure Firewall Premium is zone-redundant and supports Application Rule Collections (FQDN-based filtering), which NSGs do not. Option B is incorrect because the Premium features (like Application Rules) require the Premium SKU, not the Standard SKU. Option A (NSGs) is stateful but cannot filter based on FQDNs. Option D (NVA) is not a managed Azure service and requires manual configuration for high availability.

Question 5

Your company's security policy requires that all privileged roles in Azure AD be protected by phishing-resistant authentication. You need to enforce this requirement for users assigned to the Global Administrator role. What is the most effective way to achieve this?

1. A. Require the users to register for Azure AD Multi-Factor Authentication (MFA).
2. B. Create a Conditional Access policy targeting the Global Administrator role that requires "Phishing-resistant MFA" as a grant control.
3. C. Enable security defaults for the entire tenant.
4. D. Configure a User Risk policy in Identity Protection to require MFA for all sign-ins.

Answer: B

Explanation: A Conditional Access policy targeting the specific role with the "Phishing-resistant MFA" grant control is the most precise and effective method. Option A (MFA) is not necessarily phishing-resistant (e.g., OTP via SMS). Option C (Security defaults) applies to all users, not just admins, and enforces standard MFA, not phishing-resistant. Option D is risk-based and doesn't specifically target privileged roles or enforce phishing-resistant methods.

Question 6

You have an Azure subscription containing a storage account used for archival data. You discover that a developer accidentally granted the "Storage Blob Data Contributor" role to a new user over a specific container. You need to remove this access immediately. What is the fastest way to revoke this specific assignment?

1. A. Delete the user account in Azure AD.
2. B. Remove the role assignment for that user on the container's Access Control (IAM) blade.
3. C. Change the storage account's firewall settings to deny all traffic.
4. D. Regenerate the storage account access keys.

Answer: B For practical tips on this, see Choosing Between AZ-500 and AWS Security Specialty: The Deciding Factors.

Explanation: Removing the role assignment via the IAM blade is the direct and fastest method to revoke the specific RBAC permission. Option A is drastic and affects other resources. Option C blocks network access but doesn't remove the RBAC grant—it would be a temporary workaround. Option D regenerates keys, which affects shared key access but does not revoke RBAC permissions granted via Azure AD.

Question 7

Your company is using Azure Key Vault to store secrets for applications. A security audit requires that all secrets be automatically rotated every 90 days. You need to implement a solution that minimizes manual intervention and provides a full audit trail. What should you configure?

1. A. A manual rotation process documented in a runbook.
2. B. An Azure Policy that denies the creation of secrets with an expiration date longer than 90 days.
3. C. An Event Grid subscription on the Key Vault to trigger an Azure Automation runbook that rotates the secret.
4. D. A Key Vault access policy that restricts secret read access to the application's managed identity.

Answer: C

Explanation: Using Event Grid to listen for "SecretNearExpiry" events and triggering an Automation runbook to rotate the secret is the standard automated pattern. Option A is manual and violates the "minimizes manual intervention" requirement. Option B enforces expiration but does not rotate the secret. Option D is about access control, not rotation.

Question 8

You are configuring Microsoft Defender for Cloud for a new subscription. You need to ensure that regulatory compliance standards (e.g., CIS, PCI DSS) are continuously assessed for your Azure resources. What is the first step you must take in Defender for Cloud to achieve this?

1. A. Enable the "Foundational CSPM" plan.
2. B. Enable the "Defender for Servers" plan.
3. C. Add the specific regulatory compliance standard to the "Regulatory compliance" blade.
4. D. Configure continuous export to a Log Analytics workspace.

Answer: C

Explanation: To assess against a specific standard like CIS or PCI DSS, you must explicitly add it to the Regulatory compliance blade in Defender for Cloud. Option A (Foundational CSPM) provides Azure security best practices but not the specific regulatory standards. Option B (Defender for Servers) is for workload protection, not compliance frameworks. Option D (Continuous export) is for sending alerts, not for enabling compliance assessment.

---

How did you do? These questions targeted the critical decision-making skills required for the AZ-500. Remember to review the official Microsoft Learn modules on Conditional Access, Key Vault management, and Defender for Cloud, as these are heavily weighted in the exam. Focus on understanding the "why" behind each solution, not just the "what."

Get comfortable with the question style by working through timed Microsoft Azure Security Technologies (AZ-500) practice exams at your own pace.

For a schedule that adapts to your pace and a quick check of weak topics, use the free study plans and readiness checks.