AZ-500 practice, week 2: 6 questions

Six exam-style questions I wrote this week (SAS, just-in-time access, private endpoints, Defender CSPM, RBAC scope, CEF through AMA), answers hidden, explanations in plain words.

How to use these: read the question, pick your answer before you open Answer, and write it down (or in the comments). Then check the "why not the others" part even if you got it right: that is where the exam traps live. Every scenario, name and number is made up by me; only the question formats follow the real exam.

Table of contents

• Q005: A SAS when account keys are switched off
• Q006: Just-in-time RDP: which Defender for Servers plan?
• Q007: Private endpoint is up, but the VM still gets a public IP
• Q008: Compliance standards and attack paths: which CSPM plan?
• Q009: Right role, right scope, nothing more
• Q010: CEF from a firewall to Sentinel through AMA, in order
• Cheat sheet
• Coming next

Q005: A SAS when account keys are switched off

Compute, storage and databases · Build list (put in order) · standalone page

The storage account stinvoices01 holds one container, invoices. A partner needs read-only access to it for 8 hours through a SAS URL. The account has Allow storage account key access set to Disabled, and the security team wants to keep it that way.

A small automation job runs with the user-assigned managed identity id-sas-issuer. It will create the SAS and email the link (to the partner, not to everyone in the address book).

Which three actions should you perform in sequence? Move the right actions to the answer area and put them in order.

Actions:

• A. Regenerate key1 on stinvoices01 and sign the SAS with it
• B. Assign id-sas-issuer the Storage Blob Data Reader role at the scope of the storage account stinvoices01
• C. Create a stored access policy on the invoices container and link the SAS to it
• D. With an Entra ID token for id-sas-issuer, call Get User Delegation Key
• E. Set Allow storage account key access to Enabled
• F. Build the SAS with read permission and an expiry 8 hours from now, and sign it with the user delegation key

Answer

B → D → F. This is a user delegation SAS: it is signed with a key that the identity gets from Microsoft Entra ID, not with the account key, so it keeps working while account key access is disabled. The identity first needs a role that includes the generateUserDelegationKey action at storage account scope (Storage Blob Data Reader has it, and also covers the read), then it asks for the user delegation key (valid for up to 7 days), then it builds and signs the SAS.

Why not the others:

• A signs with the account key. That gives a service or account SAS, and those are refused while account key access is disabled. Also, regenerating a key on a Friday is how you learn which apps still used it.
• C sounds tidy, but stored access policies are not supported for a user delegation SAS.
• E undoes the security team's setting just to make a SAS. Wrong direction.

Gotcha: if you give the role on the container only, the key request fails. The generateUserDelegationKey action must be granted at storage account, resource group or subscription scope (or add Storage Blob Delegator there).

Sources: Create a user delegation SAS · Prevent Shared Key authorization for an Azure Storage account
Deep dive: plans, scope and roles on one page, in Defender for Cloud in one page (plus a mock case)

---

Q006: Just-in-time RDP: which Defender for Servers plan?

Defender for Cloud and Sentinel · Yes/No series ("Does this meet the goal?") · standalone page

Yes/No series: same scenario, a different solution each time. Some scenarios have several right solutions, some have none.

Your subscription sub-lab-prod has the Windows VM vm-jump-01. Today an NSG rule allows RDP (3389) from the internet, all day, every day. Bots love it. Goal: RDP stays closed by default, admins request access when they need it, the port opens only for their IP address and closes again after at most 3 hours.

Solution: You enable Microsoft Defender for Servers Plan 1 on sub-lab-prod, delete the old RDP rule, and turn on just-in-time (JIT) VM access for vm-jump-01 on port 3389 with a maximum request time of 3 hours.

Does this meet the goal?

• A. Yes
• B. No

Answer

B. No. Just-in-time VM access is a Defender for Servers Plan 2 feature, and Plan 2 on the subscription is a listed prerequisite. Plan 1 focuses on endpoint detection and response through the Defender for Endpoint integration, so JIT is not included. No Plan 2, no JIT.

Other solutions you might see in the same series:

• "Enable Defender for Servers Plan 2 and configure JIT on port 3389 with a maximum request time of 3 hours" → Yes. JIT adds a deny rule for the port, and when a request is approved it opens the port only for the requester's IP address (or range) for the requested time, then puts the NSG back the way it was.
• "Change the NSG rule priority from 100 to 4096" → No. The port is still open all day. It is just open with lower self-esteem.

Sources: Overview of Defender for Servers (Plan 1 vs Plan 2) · Enable just-in-time access on VMs · Understand just-in-time VM access

Deep dive: how server licensing fits next to Defender for Endpoint plans, in Defender for Endpoint: licensing and permissions

---

Q007: Private endpoint is up, but the VM still gets a public IP

Networking · Hot area · standalone page

The key vault kv-lab-01 got a private endpoint, pe-kv-lab-01, in the subnet snet-pe of the virtual network vnet-lab-app. The connection state is Approved. The app on vm-lab-01, in the same virtual network, reads its secrets from https://kv-lab-01.vault.azure.net.

Then someone runs nslookup kv-lab-01.vault.azure.net on vm-lab-01 and gets a public IP address. The private endpoint is up, and the traffic still takes the scenic route. Your goals:

1. vm-lab-01 resolves the vault name to the private endpoint IP, 10.20.2.4.
2. Nobody on the internet can reach the vault anymore, not even with the right password, token or attitude.

Pick the right value for each line:

What	Your choice
Private DNS zone name	▢ privatelink.vaultcore.azure.net ▢ privatelink.vault.azure.net ▢ vault.azure.net
What the zone needs so vm-lab-01 uses it	▢ A virtual network link to vnet-lab-app ▢ An NSG rule on snet-pe ▢ A service endpoint for Microsoft.KeyVault
A record in the zone	▢ kv-lab-01 → 10.20.2.4 ▢ kv-lab-01.vault.azure.net → the public IP
URL the app uses after the change	▢ https://kv-lab-01.vault.azure.net (no change) ▢ https://kv-lab-01.privatelink.vaultcore.azure.net ▢ https://10.20.2.4
kv-lab-01 › Networking › Public network access	▢ Must be set to Disabled ▢ Nothing to do, the private endpoint already turned it off

Answer

privatelink.vaultcore.azure.net / A virtual network link to vnet-lab-app / kv-lab-01 → 10.20.2.4 / https://kv-lab-01.vault.azure.net (no change) / Must be set to Disabled

In public DNS, kv-lab-01.vault.azure.net is a CNAME to kv-lab-01.privatelink.vaultcore.azure.net. A private DNS zone with exactly that privatelink name, linked to the virtual network, answers that second lookup with the private IP. If the zone is not linked, queries from the virtual network still get the public IP, which is exactly what nslookup showed. Inside the zone, the A record uses the plain vault name, with no suffix.

Why not the other values:

• privatelink.vault.azure.net looks right and is wrong. The recommended zone for key vaults is privatelink.vaultcore.azure.net, and the private endpoint only fills in the DNS records automatically when you use the recommended zone name.
• vault.azure.net as a private zone would take over the whole public zone for that virtual network. Microsoft warns against overriding a zone that is in use for public endpoints.
• NSG rule or service endpoint: those control traffic, not name resolution. DNS does not care how nice your NSG is.
• A record with the full name and the public IP: wrong name and wrong IP, so two wrongs in one line.
• Changing the URL: not needed. Learn is clear that connection URLs for your existing apps do not change: the CNAME chain does the work. The privatelink name is plumbing, and https://10.20.2.4 skips DNS and asks TLS to trust an IP address. It won't.
• "Nothing to do": a private endpoint gives the vault a private IP, but it does not necessarily restrict public network access. You turn that off yourself.

Gotcha: even after all this, kv-lab-01.vault.azure.net still resolves in public DNS from your laptop at home. That is by design. A DNS answer is not access: with public network access disabled, the vault rejects those requests.

Sources: Azure Private Endpoint private DNS zone values · Integrate Key Vault with Azure Private Link · What is a private endpoint?

---

Q008: Compliance standards and attack paths: which CSPM plan?

Defender for Cloud and Sentinel · Single choice · standalone page

The subscription sub-lab-prod has Microsoft Defender for Cloud with only the free Foundational CSPM plan. The secure score is there, the Microsoft cloud security benchmark (MCSB) recommendations are there, and the team is quite proud of both.

Then two requests land on the same Monday:

1. The auditor wants to see sub-lab-prod assessed against ISO IEC 27001:2022 in the Regulatory compliance dashboard.
2. The CISO wants to see attack paths: which internet-exposed resource could lead an attacker to the key vault kv-lab-01.

What should you do to meet both requests?

• A. Nothing. Foundational CSPM already includes both, you just need to wait 24 hours.
• B. Enable the Defender CSPM plan on sub-lab-prod and keep agentless scanning turned on, then add the ISO IEC 27001:2022 standard
• C. Enable Defender for Servers Plan 2 on sub-lab-prod
• D. Set up continuous export of recommendations to a Log Analytics workspace and build a workbook

Answer

B. Both asks are Defender CSPM features. In the feature table, Foundational CSPM gives you asset inventory, MCSB, secure score, recommendations, data export and workflow automation. Regulatory compliance assessments (standards beyond MCSB, such as ISO IEC 27001:2022) and attack path analysis are listed for Defender CSPM only. Attack path analysis also lists agentless scanning as a prerequisite, so don't switch that off to save a few coins.

Why not the others:

• A: waiting is a great strategy for bread dough, not for paid features. MCSB is the default standard, and that is all Foundational CSPM assesses.
• C: Defender for Servers protects servers (just-in-time VM access from Q006 lives there), but the attack path prerequisites name Defender CSPM, not a servers plan.
• D: continuous export is in both plans and is useful for a SIEM, but it only ships the alerts and recommendations you already have. It does not create new compliance assessments or attack paths. A pretty workbook of the wrong data is still the wrong data.

Gotcha: a standard only shows up in the Regulatory compliance dashboard if the subscription has resources relevant to it, even when the standard is assigned. And once you fix an attack path, it can take up to 24 hours to disappear from the list.

Sources: What is Cloud Security Posture Management (CSPM) · Regulatory compliance in Defender for Cloud · Identify and remediate attack paths · Set up continuous export

---

Q009: Right role, right scope, nothing more

Identity and access · Drag and drop · standalone page

The subscription sub-lab-prod has two resource groups: rg-lab-app (the VMs vm-lab-01 and vm-lab-02, and the virtual network vnet-lab-app) and rg-lab-data. vm-lab-01 runs Windows Server 2022 with Microsoft Entra ID sign-in enabled.

Three people want access, and your security team wants least privilege for each:

1. The group grp-vm-ops starts, stops, restarts and resizes the VMs in rg-lab-app. They must not manage the virtual network or assign roles. (They asked for Owner. Everyone asks for Owner.)
2. The developer Linh signs in to vm-lab-01 over RDP with her Entra ID account, as a regular user, not a local admin, and only on that VM.
3. The external auditor [e-mail] looks at everything in sub-lab-prod and changes nothing.

Drag the right value into each numbered box. Each value can be used once, more than once, or not at all.

Values: Owner · Contributor · Reader · Virtual Machine Contributor · Virtual Machine Administrator Login · Virtual Machine User Login · sub-lab-prod · rg-lab-app · vm-lab-01

Who	Role	Scope
grp-vm-ops	[1]	[2]
Linh	[3]	[4]
[e-mail]	[5]	[6]

Answer

[1] Virtual Machine Contributor · [2] rg-lab-app · [3] Virtual Machine User Login · [4] vm-lab-01 · [5] Reader · [6] sub-lab-prod

Scope is where a role assignment applies, and lower levels inherit from higher ones (management group, subscription, resource group, resource). So you pick the smallest role and the smallest scope that still does the job:

• Virtual Machine Contributor manages VMs, but it does not give management access to the virtual network or storage account the VMs use, and it cannot assign roles. At rg-lab-app it covers both VMs and nothing in rg-lab-data.
• Virtual Machine User Login lets you sign in to a VM as a regular user. On the resource vm-lab-01 it is exactly one VM.
• Reader views all resources but changes nothing. At sub-lab-prod it covers both resource groups.

Why not the other values:

• Owner for grp-vm-ops: Owner can assign roles, which breaks rule 1. Saying no to Owner is a skill, practice it.
• Contributor for grp-vm-ops: no role assignments, fine, but it can manage every resource in the group, the virtual network included.
• Virtual Machine Administrator Login for Linh: that signs her in with administrator privileges. She asked for user, she gets user.
• rg-lab-app or sub-lab-prod in [4]: inheritance would let Linh sign in to vm-lab-02 too.
• rg-lab-app in [6]: the auditor would miss rg-lab-data, and auditors always find what they missed.

Gotcha: Owner or Contributor alone does not let anyone sign in to an Entra ID-enabled VM. Sign-in needs Virtual Machine User Login or Virtual Machine Administrator Login. This keeps the people who manage VMs separate from the people who use them, so grp-vm-ops can resize vm-lab-01 all day and still not RDP into it.

Sources: Understand scope for Azure RBAC · Azure built-in roles · Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID

---

Q010: CEF from a firewall to Sentinel through AMA, in order

Defender for Cloud and Sentinel · Build list (put in order) · standalone page

The lab firewall fw-lab-01 speaks CEF and is already configured to send its logs to the Ubuntu VM vm-syslog-01 on port 514. vm-syslog-01 is an Azure VM in rg-lab-sentinel, runs rsyslog, and has no agent at all yet. Microsoft Sentinel runs on the workspace law-lab-sentinel, and nothing for CEF is installed there yet either.

Goal: the firewall's CEF messages land in Sentinel through the Azure Monitor Agent (AMA), and you prove it with a test message before anyone opens a ticket called "Sentinel is broken".

Which four actions should you perform in sequence? Move the right actions to the answer area and put them in order.

Actions:

• A. Install the Log Analytics agent (MMA) on vm-syslog-01 and connect it to law-lab-sentinel
• B. In the Sentinel Content hub, install the Common Event Format solution
• C. On vm-syslog-01, run the Forwarder_AMA_installer.py installation script from the connector page
• D. Open the Common Event Format (CEF) via AMA connector, create a data collection rule (DCR), select vm-syslog-01 on the Resources tab and set the facility and minimum log level
• E. Add an NSG inbound rule on vm-syslog-01 that allows TCP 28330 from fw-lab-01
• F. Send a test CEF message with logger to port 514 on vm-syslog-01, then query CommonSecurityLog
• G. Also create a Syslog via AMA DCR for the same facility, "just in case"

Answer

B → D → C → F. First the solution, which brings the CEF via AMA connector. Then the DCR from the connector page: when you create it, the connector installs AMA on the machines you selected, so vm-syslog-01 gets its agent in the same step. Then the installation script on the forwarder, which configures rsyslog to listen on port 514 (UDP and TCP) for other machines and forward to AMA. Last, a test message: CEF lands in CommonSecurityLog, plain syslog in Syslog. Give it up to 20 minutes before you panic.

Why not the others:

• A: the Log Analytics agent retired on August 31, 2024 and is not supported. Also, two agents on one box is how you get two copies of every event.
• E: port 28330 is local. The syslog daemon hands messages to AMA on the same machine (AMA 1.28.11 and later listen on TCP 28330). The firewall only ever talks to port 514. Opening 28330 to the network adds risk and fixes nothing.
• G: using the same facility for both Syslog and CEF can duplicate data between CommonSecurityLog and Syslog. "Just in case" doubles the bill, not the security.

Gotcha: if the DCR is created through the Logs Ingestion API instead of the portal, you install AMA yourself first. Only the portal connector does it for you.

Sources: Ingest syslog and CEF messages to Microsoft Sentinel with AMA · Syslog and CEF AMA connectors · Log Analytics agent migration

Deep dive: what to check at each hop when the connector says Connected but the table stays empty, in CEF and Syslog to Sentinel through AMA: connected, but no data

---

Cheat sheet

The same six ideas in plain words, for the manager who asks "so what?". Share it with them.

Coming next

Next week brings six more questions across the four domains. All questions live in the AZ-500 practice folder.

Got one wrong? Good. That is one fewer surprise in the exam room. Drop your answers in the comments.