Free Microsoft AZ-500 Practice Questions & Answers 2026 Part1 | Microsoft Azure Security Technologies

Your company uses Azure DevOps with branch policies configured.Which of the following is TRUE with regards to branch policies? (Choose all that apply.)

Your company's Azure subscription includes Windows Server 2016 Azure virtual machines.You are informed that every virtual machine must have a custom antimalware virtual machine extension installed. You are writing the necessary code for a policy that will help you achieve this.Which of the following is an effect that must be included in your code?

Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.After syncing all on-premises identities to Azure AD, you are informed that users with a givenName attribute starting with LAB should not be allowed to sync toAzure AD.Which of the following actions should you take?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a hybrid configuration of Azure Active Directory (Azure AD).You have an Azure HDInsight cluster on a virtual network.You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.You need to configure the environment to support the planned authentication.Solution: You deploy Azure Active Directory Domain Services (Azure AD DS) to the Azure subscription.Does this meet the goal?

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.The User administrator role is assigned to a user named Admin1.An external partner has a Microsoft account that uses the user1@outlook.com sign in.Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: `Unable to invite user user1@outlook.com Generic authorization exception.`You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.What should you do?

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD).The process involves assessing the risk events and risk levels.Which of the following is the risk level that should be configured for users that have leaked credentials?

Your company's Azure subscription includes an Azure Log Analytics workspace.Your company has a hundred on-premises servers that run either Windows Server 2012 R2 or Windows Server 2016, and is linked to the Azure Log Analytics workspace. The Azure Log Analytics workspace is set up to gather performance counters associated with security from these linked servers.You have been tasked with configuring alerts according to the information gathered by the Azure Log Analytics workspace.You have to make sure that alert rules allow for dimensions, and that alert creation time should be kept to a minimum. Furthermore, a single alert notification must be created when the alert is created and when the alert is sorted out.You need to make use of the necessary signal type when creating the alert rules.Which of the following is the option you should use?

Your company has an Azure subscription that includes two virtual machines, named VirMac1 and VirMac2, which both have a status of Stopped (Deallocated).The virtual machines belong to different resource groups, named ResGroup1 and ResGroup2.You have also created two Azure policies that are both configured with the virtualMachines resource type. The policy configured for ResGroup1 has a policy definition of Not allowed resource types, while the policy configured for ResGroup2 has a policy definition of Allowed resource types.You then create a Read-only resource lock on VirMac1, as well as a Read-only resource lock on ResGroup2.Which of the following is TRUE with regards to the scenario? (Choose all that apply.)

You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant.From the Azure portal, you register an enterprise application.Which additional resource will be created in Azure AD?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced.Solution: You recommend the use of password hash synchronization and seamless SSO.Does the solution meet the goal?

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant and a user named User1.The App registrations settings for the tenant are configured as shown in the following exhibit.You plan to deploy an app named App1.You need to ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege.Which role should you assign to User1?

You need to consider the underlined segment to establish whether it is accurate.You have configured an Azure Kubernetes Service (AKS) cluster in your testing environment.You are currently preparing to deploy the cluster to the production environment.After disabling HTTP application routing, you want to replace it with an application routing solution that allows for reverse proxy and TLS termination for AKS services via a solitary IP address.You must create an AKS Ingress controller.Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription named Sub1.You have an Azure Storage account named sa1 in a resource group named RG1.Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.You discover that unauthorized users accessed both the file service and the blob service.You need to revoke all access to sa1.Solution: You regenerate the Azure storage account access keys.Does this meet the goal?

Your company has an Azure Container Registry.You have been tasked with assigning a user a role that allows for the uploading of images to the Azure Container Registry. The role assigned should not require more privileges than necessary.Which of the following is the role you should assign?

While configuring Azure Application Gateway for your company, you want to ensure that the user experiences no performance degradation even during peak times. Which of the following setting would you configure?

Being the network engineer at your company, you need to ensure that communications with Azure Storage pass through the Service Endpoint. How would you ensure it?

You have an Azure subscription that contains an Azure SQL database named SQL1 and an Azure key vault named KeyVault1. KeyVault1 stores the keys shown in the following table.You reed to configure Transparent Data Encryption (TDE). TDE will use a customer-managed key for SQL1?

From Azure Security Center, you need to deploy SecPol1.What should you do first?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

You have been tasked with configuring an access review, which you plan to assigned to a new collection of reviews. You also have to make sure that the reviewscan be reviewed by resource owners.You start by creating an access review program and an access review control.You now need to configure the Reviewers.Which of the following should you set Reviewers to?

You have an Azure subscription that contains a storage account and an Azure web app named App1.App1 connects to an Azure Cosmos DB database named Cosmos1 that uses a private endpoint named Endpoint1. Endpoint1 has the default settings.You need to validate the name resolution to Cosmos1.Which DNS zone should you use?

You need to consider the underlined segment to establish whether it is accurate.Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it.Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type.The mobile application must be registered in Azure AD.You require a redirect URI from the developer for registration purposes.Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

You plan to use Azure Resource Manager templates to perform multiple deployments of identically configured Azure virtual machines. The password for the administrator account of each deployment is stored as a secret in different Azure key vaults.You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment.The name of the key vault and the name of the secret will be provided as inline parameters.What should you use to construct the resource ID?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription named Sub1.You have an Azure Storage account named sa1 in a resource group named RG1.Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.You discover that unauthorized users accessed both the file service and the blob service.You need to revoke all access to sa1.Solution: You generate new SASs.Does this meet the goal?

Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled.You have been tasked with analyzing the security events of a Windows Server 2016 virtual machine. You have already accessed Azure Monitor.Which of the following options should you use?

You are in the process of configuring an Azure policy via the Azure portal.Your policy will include an effect that will need a managed identity for it to be assigned.Which of the following is the effect in question?

You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1.

You need to ensure that users can access VM0. The solution must meet the platform protection requirements. What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a hybrid configuration of Azure Active Directory (Azure AD).You have an Azure HDInsight cluster on a virtual network.You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.You need to configure the environment to support the planned authentication.Solution: You deploy an Azure AD Application Proxy.Does this meet the goal?

Your company recently created an Azure subscription. You have, subsequently, been tasked with making sure that you are able to secure Azure AD roles by making use of Azure Active Directory (Azure AD) Privileged Identity Management (PIM).Which of the following actions should you take FIRST?

You have an Azure subscription that contains a virtual machine named VM1. You create an Azure key vault that has the following configurations: Name: Vault5 Region: West US Resource group: RG1 You need to use Vault5 to enable Azure Disk Encryption on VM1. The solution must support backing up VM1 by using Azure Backup. Which key vault settings should you configure?

Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.After syncing all on-premises identities to Azure AD, you are informed that users with a givenName attribute starting with LAB should not be allowed to sync toAzure AD.Which of the following actions should you take?

You have an Azure subscription.You configure the subscription to use a different Azure Active Directory (Azure AD) tenant.What are two possible effects of the change? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD).The process involves assessing the risk events and risk levels.Which of the following is the risk level that should be configured for sign ins that originate from IP addresses with dubious activity?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You deploy an Azure AD Application Proxy. Does this meet the goal?

Your company recently created an Azure subscription.You have been tasked with making sure that a specified user is able to implement Azure AD Privileged Identity Management (PIM).Which of the following is the role you should assign to the user?

You have a hybrid configuration of Azure Active Directory (Azure AD) that has Single Sign-On (SSO) enabled. You have an Azure SQL Database instance that is configured to support Azure AD authentication.Database developers must connect to the database instance from the domain joined device and authenticate by using their on-premises Active Directory account.You need to ensure that developers can connect to the instance by using Microsoft SQL Server Management Studio. The solution must minimize authentication prompts.Which authentication method should you recommend?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a hybrid configuration of Azure Active Directory (Azure AD).You have an Azure HDInsight cluster on a virtual network.You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.You need to configure the environment to support the planned authentication.Solution: You deploy the On-premises data gateway to the on-premises network.Does this meet the goal?

You have an Azure virtual machine that runs Windows Server R2.You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine.Which of the following is TRUE with regards to Azure Disk Encryption for a Windows VM?

Your company recently created an Azure subscription.You have been tasked with making sure that a specified user is able to implement Azure AD Privileged Identity Management (PIM).Which of the following is the role you should assign to the user?