Community Q&A
AZ-500 — frequently asked questions
Community-vetted answers to 10 common questions about this exam, each traced back to a specific practice question.
Questions from real practice questions
Each Q&A comes from a specific question — follow the link for the full analysisEntra Permissions Management Highly Privileged Roles
Is Exchange Administrator considered highly privileged?
No. While powerful, Exchange Administrator is not listed as a highly privileged role for the Azure AD Insights tab.
Why is User Administrator not shown?
User Administrator is an administrative role but is not classified as 'highly privileged' in the context of Entra Permissions Management insights.
Azure DDoS Protection Plan Resource Eligibility
Can I add an Azure Web App directly to a DDoS Protection Plan?
No. Web Apps are PaaS services and do not have their own public IP address managed by the user. They must be protected via an Application Gateway with WAF.
Can a DDoS Protection Plan include VNets from different regions?
Yes. Although the plan itself is created in a specific region, it can protect VNets across multiple regions and subscriptions within the same tenant.
Defender for Cloud Protected Resources
Does Defender for Cloud protect Virtual Networks?
Yes, Defender for Cloud monitors network traffic and configurations within Azure Virtual Networks to detect anomalies and threats.
Can I use Defender for Cloud with Azure Key Vault?
Yes, Defender for Cloud provides threat protection for Key Vaults, detecting unusual access patterns and potential vulnerabilities.
Azure Defender for Servers Adaptive Application Controls Support
Why doesn't Server Core support Adaptive Application Controls?
Server Core lacks a Graphical User Interface (GUI), which is required for the feature to present allowlist recommendations and manage settings.
Can AppLocker and Defender Application Control work together?
No, they are incompatible. If AppLocker is enabled, Defender for Servers disables Adaptive Application Controls to prevent policy conflicts.
Azure Functions VNET Integration and NSG Control
Do all Azure Functions tiers support VNET integration?
No. Only Basic, Standard, Premium, Premium v2, Premium v3, and Elastic Premium tiers support Virtual Network Integration. Free and Basic (older) may not.
How does NSG1 affect Function App traffic?
If a Function App uses VNET integration, its outbound traffic enters the specified subnet. NSGs attached to that subnet then filter this traffic.