CertsPoint
Sign In Get Started
See all results for ""
Exams About Us
Sign In Get Started
Exam Overview
Exam Code AZ-500
Exam Name Microsoft Azure Security Technologies
Vendor Microsoft
Total Questions 492
Last Updated 26-Oct, 2026
Free AZ-500 Questions Get Premium Access
Why CertsPoint?
  • Latest & Verified Questions
  • Detailed Explanations
  • Regular Updates
  • Full-Length Practice Tests
  • Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent
4.6 (398 Up Votes)
Secure Payment Privacy Protected Money Back Guarantee

Free AZ-500 Practice Questions

Explore 7 free practice questions for the Microsoft AZ-500 exam and review the answers and explanations to support your preparation.

  1. Question 1

    Single answer

    You need to configure WebApp1 to meet the data and application requirements.
    Which two actions should you perform? Each correct answer presents part of the solution.
    NOTE: Each correct selection is worth one point.

    • Option A:
      Upload a public certificate.
      Correct
    • Option B:
      Turn on the HTTPS Only protocol setting.
      Correct
    • Option C:
      Set the Minimum TLS Version protocol setting to 1.2.
      Correct
    • Option D:
      Change the pricing tier of the App Service plan.
      Correct
    • Option E:
      Turn on the Incoming client certificates protocol setting.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    The correct answers are B. Turn on the HTTPS Only protocol setting and E. Turn on the Incoming client certificates protocol setting. Enabling HTTPS Only ensures that all communication between users and WebApp1 is encrypted by forcing requests to use HTTPS instead of HTTP, helping to protect sensitive data during transmission. Enabling Incoming client certificates allows the application to receive and validate client certificates from users or devices, which is required when certificate-based authentication is part of the application requirements. The other options do not fully meet the stated requirements. Uploading a public certificate is primarily used for custom domain SSL configuration, setting the minimum TLS version only controls the security protocol version, and changing the App Service pricing tier is unnecessary unless a specific feature requires it. Therefore, turning on HTTPS Only and Incoming client certificates is the correct solution.

  2. Question 2

    Single answer

    You need to ensure that you can meet the security operations requirements.
    What should you do first?

    • Option A:
      Turn on Auto Provisioning in Security Center.

      Correct
    • Option B:
      Integrate Security Center and Microsoft Cloud App Security.

      Correct
    • Option C:
      Upgrade the pricing tier of Security Center to Standard.
      Correct
    • Option D:
      Modify the Security Center workspace configuration.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C

    Explanation

    The Standard tier extends the capabilities of the Free tier to workloads running in private and other
    public clouds, providing unified security management and threat protection across your hybrid cloud
    workloads. The Standard tier also adds advanced threat detection capabilities, which uses built-in
    behavioral analytics and machine learning to identify attacks and zero-day exploits, access and
    application controls to reduce exposure to network attacks and malware, and more.
    Scenario: Security Operations Requirements
    Litware must be able to customize the operating system security configurations in Azure Security
    Center.

  3. Question 3

    Single answer

    You need to ensure that users can access VM0. The solution must meet the platform
    protection requirements. What should you do?

    • Option A:
      Move VM0 to Subnet1.
      Correct
    • Option B:
      On
      Firewall, configure a network traffic filtering rule.
      Correct
    • Option C:
      Assign RT1 to
      AzureFirewallSubnet.
      Correct
    • Option D:
      On Firewall, configure a DNAT rule.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation

    The correct answer is D. On Firewall, configure a DNAT (Destination Network Address Translation) rule. When a virtual machine is protected behind Azure Firewall, inbound internet traffic cannot reach the VM directly. To allow users to access VM0 while still meeting the platform protection requirements, Azure Firewall must translate incoming requests on its public IP address to the private IP address of the VM. This is achieved by configuring a DNAT rule. The other options do not provide external access to the VM. Moving the VM to another subnet, assigning a route table to AzureFirewallSubnet, or configuring a network traffic filtering rule alone will not publish the VM for inbound connections. Therefore, a DNAT rule is required to securely enable user access to VM0 through Azure Firewall.

  4. Question 4

    Drag & Drop

    HOTSPOT
    You need to create Role1 to meet the platform protection requirements.
    How should you complete the role definition of Role1? To answer, select the appropriate options in
    the answer area.
    NOTE: Each correct selection is worth one point.

    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer


    Explanation

    Explanation:
    1) Microsoft.Compute/
    2) disks
    3) /subscrption/{subscriptionId}/resourceGroups/{Resource Group Id}
    A new custom RBAC role named Role1 must be used to delegate the administration of the managed
    disks in Resource Group1. Role1 must be available only for Resource Group1.

  5. Question 5

    Single answer

    You need to meet the identity and access requirements for Group1.
    What should you do?

    • Option A:
      Add a membership rule to Group1.
      Correct
    • Option B:
      Delete Group1. Create a new group named Group1 that has a membership type of Office 365. Add
      users and devices to the group.
      Correct
    • Option C:
      Modify the membership rule of Group1.
      Correct
    • Option D:
      Change the membership type of Group1 to Assigned. Create two groups that have dynamic
      memberships. Add the new groups to Group1.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation


    https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamicmembership
    Scenario:
    Litware identifies the following identity and access requirements: All San Francisco users and their
    devices must be members of Group1.
    The tenant currently contain this group:


  6. Question 6

    Single answer

    You need to provide connectivity to storage1. The solution must meet the PaaS networking
    requirements and the business requirements.
    What should you include in the solution?
    HOTSPOT
    You need to recommend a configuration for the ExpressRoute connection from the Boston
    datacenter. The solution must meet the hybrid networking requirements and business requirements.
    What should you recommend? To answer, select the appropriate options in the answer area.
    NOTE: Each correct selection is worth one point.

    • Option A:
      a service endpoint
      Correct
    • Option B:
      Azure Front Door
      Correct
    • Option C:
      a private endpoint
      Correct
    • Option D:
      Azure Traffic Manager
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: A

    Explanation

    The correct answer is A. a service endpoint. A service endpoint extends the private address space of an Azure virtual network to an Azure PaaS service such as Azure Storage. This allows resources in the virtual network to access storage1 directly over the Microsoft backbone network while maintaining secure connectivity and meeting PaaS networking requirements. Service endpoints are commonly used when access to a storage account must be restricted to specific virtual networks without requiring a private IP address for the storage service. The other options do not fit the requirement: Azure Front Door and Azure Traffic Manager are used for application delivery and traffic routing, while a private endpoint would be chosen only if the requirement specifically called for private IP-based access to the storage account. Therefore, a service endpoint is the correct solution.

  7. Question 7

    Multiple answers

    You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements
    and the business requirements.
    Which two actions should you include in the solution? Each correct answer presents part of the
    solution.
    NOTE: Each correct selection is worth one point

    • Option A:
      An the peerings from Vnet2 and Vnet3, select Use remote
      gateways.
      Correct
    • Option B:
      On the peering from Vnet1, select Allow forwarded
      traffic.
      Correct
    • Option C:
      On the peering from Vnet1, select Use remote
      gateways.
      Correct
    • Option D:
      On the peering from Vnet1, select Allow gateway
      transit.
      Correct
    • Option E:
      On the peerings from Vnet2 and Vnet3, select Allow
      gateway transit.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B, D

    Explanation

    To connect Vnet2 and Vnet3 through Vnet1 in a hub-and-spoke topology, Vnet1 acts as the hub network that contains the gateway. Enabling Allow gateway transit on the peering from Vnet1 allows the gateway in Vnet1 to be shared with the peered virtual networks. Enabling Allow forwarded traffic on the peering from Vnet1 permits traffic that is forwarded through the hub network to reach other connected networks, which is necessary for communication between Vnet2 and Vnet3 through Vnet1.
    The other options are incorrect because Use remote gateways is configured on the spoke virtual networks (Vnet2 and Vnet3) only when they need to use the gateway in the hub network, while Allow gateway transit should be enabled on the hub network, not on the spokes. Therefore, the required actions are B and D.