Microsoft Certified: Azure Security Engineer Associate (AZ-500) — Questions and Answers

Question 1: Which Microsoft Defender for Servers alert type indicates suspicious access to the Azure Instance Metadata Service that could enable credential theft?

Outbound network port scan
SQL injection attempt detected
Suspicious cryptomining activity
Credential Access - IMDS service abuse (Correct answer)

Correct answer: Credential Access - IMDS service abuse

Defender for Servers alerts on abnormal IMDS queries because attackers on compromised VMs query this endpoint to steal managed identity tokens.

Question 2: What is the best practice for reducing false positives in a Microsoft Sentinel scheduled analytics rule?

Disable the rule until threats are confirmed
Switch the rule to Detection mode
Remove the associated data connector
Tune the KQL query with additional where clauses and adjusted thresholds (Correct answer)

Correct answer: Tune the KQL query with additional where clauses and adjusted thresholds

Adding KQL filters to exclude known-good activity and adjusting alert thresholds reduces noise while preserving detection coverage.

Question 3: What is the primary security benefit of using VNet service endpoints for Azure PaaS services?

Extend VNet identity to PaaS services so access can be restricted to specific VNets (Correct answer)
Enable private DNS resolution for the service
Block all public internet access to the PaaS service
Assign private IPs to PaaS services

Correct answer: Extend VNet identity to PaaS services so access can be restricted to specific VNets

Service Endpoints allow PaaS service firewalls to recognize and allow traffic specifically from designated VNets while blocking others.

Question 4: You are creating a container's folder structure for Azure Data Lake Storage Gen2. Several services, such as Azure Databricks and Azure Synapse Analytics serverless SQL pools, will be used by users to query data. Subject area will secure the data. The majority of inquiries will contain information from the current month or year. Which folder organization would you suggest supporting quick queries and streamlined folder security?

/{SubjectArea}/{DataSource}/{YYYY}/{MM}/{DD}/{FileData}_{YYYY}_{MM}_{DD}.csv (Correct answer)
/{SubjectArea}/{DataSource}/{DD}/{MM}/{YYYY}/{FileData}_{YYYY}_{MM}_{DD}.csv
/{YYYY}/{MM}/{DD}/{SubjectArea}/{DataSource}/{FileData}_{YYYY}_{MM}_{DD}.csv
/{DD}/{MM}/{YYYY}/{SubjectArea}/{DataSource}/{FileData}_{YYYY}_{MM}_{DD}.csv

Correct answer: /{SubjectArea}/{DataSource}/{YYYY}/{MM}/{DD}/{FileData}_{YYYY}_{MM}_{DD}.csv

The suggested folder organization, /{SubjectArea}/{DataSource}/{YYYY}/{MM}/{DD}/{FileData}..., is ideal for both quick queries and streamlined security. Placing `SubjectArea` and `DataSource` at the top allows for easy application of security controls (like POSIX ACLs or RBAC) at a high level, securing entire data domains. Partitioning data by `YYYY/MM/DD` (year, month, day) enables query engines to efficiently prune data, significantly speeding up queries that filter by time, especially for current month/year data, as specified in the requirements.

Question 5: An organization needs to enforce column-level encryption on sensitive data stored in Azure SQL Database. Which feature should they implement?

Always Encrypted (Correct answer)
Row-Level Security
Transparent Data Encryption (TDE)
Dynamic Data Masking

Correct answer: Always Encrypted

Always Encrypted protects sensitive data at the column level, ensuring the database engine never has access to plaintext values.

Question 6: What is the maximum size of a single secret value that can be stored in Azure Key Vault?

10 KB
25 KB (Correct answer)
1 KB
64 KB

Correct answer: 25 KB

Azure Key Vault secrets are limited to 25 KB per value; use Azure Blob Storage with envelope encryption for larger payloads.

Question 7: An Azure SQL Database must reject connections from all IP addresses except those from within an Azure Virtual Network. What is the most secure configuration?

Private endpoint with public endpoint disabled (Correct answer)
Azure AD authentication only
Virtual network service endpoint with firewall rule
IP-based firewall rule for the VNet address space

Correct answer: Private endpoint with public endpoint disabled

A private endpoint assigns a private IP to the SQL server within the VNet, and disabling the public endpoint eliminates all public internet access.

Question 8: What is the default hot data retention period for a Microsoft Sentinel Log Analytics workspace?

90 days (Correct answer)
60 days
180 days
30 days

Correct answer: 90 days

Sentinel stores data in Log Analytics with a default interactive retention of 90 days before moving older data to lower-cost archive storage.

Question 9: Which combination provides global edge protection against OWASP Top 10 vulnerabilities for geographically distributed web applications?

Azure DDoS Network Protection
Azure Firewall Premium with IDPS
Azure Front Door with WAF policy (Correct answer)
NSG with application security groups

Correct answer: Azure Front Door with WAF policy

Azure Front Door combined with a WAF policy provides globally distributed inspection and blocking at the edge closest to users.

Question 10: Which Azure SQL security feature filters the rows returned by a query based on the identity of the user executing the query?

Always Encrypted
Row-Level Security (Correct answer)
Column encryption policy
Dynamic Data Masking

Correct answer: Row-Level Security

Row-Level Security uses security predicates to filter query results to only the rows the executing user is authorized to see.

Question 11: Which Azure feature captures source and destination IP, port, protocol, and allow/deny decision for traffic through an NSG?

Traffic Analytics
NSG Flow Logs (Correct answer)
Network Watcher Connection Monitor
Azure Monitor Diagnostic Settings

Correct answer: NSG Flow Logs

NSG Flow Logs record every flow decision made by the NSG and store the data in Azure Storage for analysis.

Question 12: Which service provides centralized security policy and route management for multiple Azure Firewalls across regions and subscriptions?

Microsoft Defender for Cloud
Azure Firewall Manager (Correct answer)
Azure Policy
Azure Monitor

Correct answer: Azure Firewall Manager

Azure Firewall Manager centralizes policy authoring and firewall deployment management across hub-and-spoke topologies.

Question 13: Which Azure Key Vault pricing tier is required to use HSM-backed (Hardware Security Module) keys?

Enterprise
Premium (Correct answer)
Basic
Standard

Correct answer: Premium

The Premium tier is required to store keys in FIPS 140-2 Level 2 validated HSMs, providing hardware-level key protection.

Question 14: Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). The integration of Active Directory with the Azure AD tenancy is your responsibility. You want to introduce Azure AD Connect. Your integration approach must ensure that user accounts that are synchronized to the Azure AD tenant are affected by password rules and user login limitations, and that the number of required servers is kept to a minimum. You suggest using Active Directory Federation Services (AD FS) for federation as a solution. Is the aim being met by the solution?

No (Correct answer)
Yes
Maybe

Correct answer: No

While Active Directory Federation Services (AD FS) can ensure on-premises password rules and login limitations apply, it requires a substantial infrastructure of multiple servers (AD FS servers and Web Application Proxy servers). This directly contradicts the requirement to keep the number of required servers to a minimum. Thus, AD FS does not meet all the specified aims.

Question 15: Which Azure Firewall rule collection type filters HTTP and HTTPS outbound traffic based on fully qualified domain names?

IP Group rules
NAT rules
Application rules (Correct answer)
Network rules

Correct answer: Application rules

Azure Firewall application rules inspect HTTP/HTTPS traffic and allow or deny it based on FQDNs with support for wildcard patterns.

Question 16: Which Azure Firewall Premium capability decrypts outbound TLS traffic, inspects it for threats, then re-encrypts it before forwarding?

Network rules with IP Groups
TLS inspection (Correct answer)
Intrusion Detection and Prevention System
Application rules with FQDN filtering

Correct answer: TLS inspection

Azure Firewall Premium TLS inspection acts as a transparent proxy that breaks and inspects encrypted sessions using an intermediate CA certificate.

Question 17: What is Microsoft Sentinel primarily classified as in the security operations space?

Network firewall and DDoS protection service
Cloud-native SIEM and SOAR platform (Correct answer)
Vulnerability scanner and patch manager
Identity governance and access management tool

Correct answer: Cloud-native SIEM and SOAR platform

Microsoft Sentinel is a cloud-native Security Information and Event Management and Security Orchestration, Automation, and Response platform.

Question 18: What is the purpose of Azure Private Link when used with Azure Storage?

It enforces IP firewall rules on the Azure Storage service
It creates a dedicated storage account accessible only to a single subscription
It allows access to Azure Storage over a private endpoint within the virtual network, avoiding public internet exposure (Correct answer)
It encrypts all data transferred to Azure Storage using private keys

Correct answer: It allows access to Azure Storage over a private endpoint within the virtual network, avoiding public internet exposure

Azure Private Link maps a private IP address in your VNet to the Azure Storage service, so traffic never traverses the public internet.

Question 19: Which Azure Network Watcher feature captures network packets to and from VMs for diagnostics and forensic analysis?

Packet Capture (Correct answer)
NSG Flow Logs
Connection Monitor
Traffic Analytics

Correct answer: Packet Capture

Network Watcher Packet Capture records raw packets flowing to and from a VM, useful for troubleshooting and security investigations.

Question 20: Which Microsoft Defender for Cloud recommendation alerts you when a subscription has no security contact email configured?

Provide security contact details for your subscription (Correct answer)
Enable Microsoft Defender for Cloud on the subscription
Apply system updates to virtual machines
Enable MFA for all subscription owners

Correct answer: Provide security contact details for your subscription

Defender for Cloud recommends configuring a security contact so Microsoft can notify your organization directly during a security incident.

Question 21: A company's compliance team requires that all Azure management operations be logged and retained for 1 year. Which combination of services should be configured?

Microsoft Sentinel + Azure Event Hub with long-term archive
Azure Activity Log + Diagnostic Settings exporting to a Log Analytics workspace with 1-year retention (Correct answer)
Azure AD Audit Logs + Azure Blob Storage with lifecycle management
Azure Monitor Metrics + Azure Storage with a 1-year retention policy

Correct answer: Azure Activity Log + Diagnostic Settings exporting to a Log Analytics workspace with 1-year retention

Configuring Diagnostic Settings on the Azure Activity Log to export to a Log Analytics workspace, then setting workspace retention to 365 days, captures all ARM management operations for one year.

Question 22: A security team wants to review and approve role assignments for privileged Azure AD roles before they become active. Which feature enables this?

Azure AD entitlement management
Conditional Access authentication context
PIM approval workflow (Correct answer)
Azure AD access reviews

Correct answer: PIM approval workflow

Privileged Identity Management (PIM) approval workflows require designated approvers to authorize role activation requests.

Question 23: What is the purpose of enabling soft delete on an Azure Key Vault?

Prevent read operations from unauthorized identities
Block all secret expiration events
Retain deleted objects in a recoverable state for a configurable retention period (Correct answer)
Encrypt secrets at rest with an additional key

Correct answer: Retain deleted objects in a recoverable state for a configurable retention period

Soft delete keeps deleted Key Vault objects in a recoverable deleted state for 7 to 90 days before they are permanently removed.

Question 24: Which Azure service should you use to receive automated alerts and trigger rotation when a Key Vault secret is approaching its expiration date?

Azure Policy deny effect on expired secrets
Microsoft Defender for Key Vault policies
Azure Monitor metric alerts on the vault
Azure Event Grid Key Vault near-expiry event with an Azure Function subscriber (Correct answer)

Correct answer: Azure Event Grid Key Vault near-expiry event with an Azure Function subscriber

Key Vault emits near-expiry events to Azure Event Grid, which can trigger a Function or Logic App to rotate the secret automatically.

Question 25: Which Azure Key Vault feature prevents even an administrator from permanently deleting a vault or its contents before a mandatory retention period expires?

Expiration dates on secrets
Soft delete
Purge protection (Correct answer)
Private endpoint

Correct answer: Purge protection

Purge protection enforces a configurable retention window (7-90 days) during which deleted Key Vault objects cannot be permanently purged.

Question 26: What does Microsoft Defender for Cloud's Just-in-Time (JIT) VM Access feature do to reduce attack surface?

Continuously patches VMs with security updates
Automatically scales down idle VMs
Creates temporary NSG rules opening management ports only on authorized request (Correct answer)
Takes hourly VM snapshots for rollback

Correct answer: Creates temporary NSG rules opening management ports only on authorized request

JIT creates time-bound NSG rules that open RDP/SSH ports only for the requesting user's IP, then automatically closes them after expiration.

Question 27: An organization wants to enforce MFA for all Azure AD users only when signing in from outside their corporate network. Which feature should they configure?

Azure AD Identity Protection risk policies
Privileged Identity Management just-in-time access
Azure AD Password Protection
Conditional Access policy with named locations (Correct answer)

Correct answer: Conditional Access policy with named locations

Conditional Access policies with named locations allow you to require MFA only when users sign in from IP ranges outside the trusted corporate network.

Question 28: Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?

Azure App Configuration
Azure Managed HSM
Azure Key Vault (Correct answer)
Azure Storage with encryption

Correct answer: Azure Key Vault

Azure Key Vault securely stores and manages secrets, keys, and certificates with Azure AD-based access control and full audit logging.

Question 29: Which Azure feature allows an organization to enforce that all storage accounts in a subscription must have 'Secure transfer required' (HTTPS only) enabled?

Azure Blueprints with a compliance dashboard
Azure Policy with a deny effect on insecure storage configurations (Correct answer)
Azure Advisor with automated remediation
Azure Security Center hardening recommendations

Correct answer: Azure Policy with a deny effect on insecure storage configurations

Azure Policy with a 'deny' effect can be configured to block creation or modification of storage accounts that do not have the 'Secure transfer required' property set to enabled.

Question 30: What is an Application Security Group (ASG) in Azure primarily used for?

Grouping VNets into peering sets
Grouping VMs logically so NSG rules can reference the group instead of IPs (Correct answer)
Defining Azure Firewall rule collections
Managing WAF policy associations

Correct answer: Grouping VMs logically so NSG rules can reference the group instead of IPs

ASGs let you tag VMs and write NSG rules referencing the tag, eliminating the need to maintain explicit IP address lists.

Question 31: Your organization has an Azure Active Directory (Azure AD) tenant with the same name as their Active Directory forest, which is weylandindustries.com. You are informed that users with a givenName attribute commencing with LAB should not be permitted to sync to Azure AD once all on-premises identities have been synced to it. AD Azure. Which of the subsequent steps ought you to take?

You should make use of the Synchronization Rules Editor to create an attribute-based filtering rule. (Correct answer)
You should configure a DNAT rule on the Firewall.
You should configure a network traffic filtering rule on the Firewall.
You should make use of Active Directory Users and Computers to create an attribute-based filtering rule.

Correct answer: You should make use of the Synchronization Rules Editor to create an attribute-based filtering rule.

To control which objects synchronize from on-premises Active Directory to Azure AD based on specific attributes like 'givenName', you must configure filtering within Azure AD Connect. The Synchronization Rules Editor is the dedicated tool for creating or modifying synchronization rules, allowing you to define custom attribute-based filtering criteria to prevent unwanted objects from syncing.

Question 32: Which Azure Sentinel (Microsoft Sentinel) component is responsible for collecting security data from connected sources?

Analytics rules
Workbooks
Playbooks
Data connectors (Correct answer)

Correct answer: Data connectors

Data connectors in Microsoft Sentinel ingest logs and alerts from Microsoft services, third-party products, and custom sources into the Log Analytics workspace.

Question 33: Which Azure SQL Database feature encrypts entire columns so that even database administrators cannot see the plaintext data during query processing?

Always Encrypted (Correct answer)
Transparent Data Encryption
Row-Level Security
Dynamic Data Masking

Correct answer: Always Encrypted

Always Encrypted stores column encryption keys client-side, so SQL Server only ever processes ciphertext — DBAs cannot access the plaintext.

Question 34: You have an Apache Spark pool called Pool1 in your WS1 Azure Synapse Analytics workspace. You want to set up a database in Pool1 called DB1. You must make sure that when tables are created in DB1, they become instantly accessible to the internal serverless SQL pool as external tables. Which format ought to be applied to the DB1 tables?

JSON
Parquet (Correct answer)
CSV
ORC

Correct answer: Parquet

To ensure tables created in an Apache Spark pool (Pool1) become instantly accessible to the internal serverless SQL pool as external tables, the tables should be in Parquet format. Parquet is a columnar storage format highly optimized for analytical queries and is natively supported by both Apache Spark and Azure Synapse serverless SQL pools. This native compatibility allows for seamless integration and direct querying of Spark-generated Parquet files by the serverless SQL pool without any additional conversion or complex setup.

Question 35: Which Key Vault access model should be used when you need to allow a specific service principal to read only one specific secret, without any access to other secrets in the same vault?

Key Vault Access Policies scoped to that secret
Key Vault firewall rules restricting the service principal's IP
Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource (Correct answer)
Managed Identity with vault-wide Reader permissions

Correct answer: Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource

Azure RBAC supports role assignments scoped to individual secret, key, or certificate resources within a vault, enabling least-privilege access at the object level.

Question 36: You need to implement a medallion architecture in Azure Data Lake Storage Gen2. Which layer should contain cleaned, validated, and conformed data ready for analytics?

Bronze layer
Silver layer (Correct answer)
Gold layer
Platinum layer

Correct answer: Silver layer

The Silver layer in the medallion architecture contains cleansed, validated, and conformed data that has been processed from the raw Bronze layer.

Question 37: Which Azure service provides a centralized view of security alerts and recommendations across multiple Azure subscriptions?

Microsoft Sentinel
Azure Monitor
Microsoft Defender for Cloud (Correct answer)
Azure Security Benchmark

Correct answer: Microsoft Defender for Cloud

Microsoft Defender for Cloud aggregates security alerts, recommendations, and Secure Score across multiple Azure subscriptions in a unified dashboard.

Question 38: Which Microsoft Defender for Cloud feature maps your environment's controls against regulatory frameworks like PCI DSS, NIST, and ISO 27001?

Security Alerts panel
Regulatory Compliance dashboard (Correct answer)
Workload Protections blade
Secure Score

Correct answer: Regulatory Compliance dashboard

The Regulatory Compliance dashboard shows pass and fail status for each control across selected compliance standards in your environment.

Question 39: What is the role of Microsoft Sentinel data connectors?

Define detection rule logic in KQL
Deploy Azure Firewall policies to connected subscriptions
Synchronize threat intelligence feeds only
Ingest security logs from Microsoft and third-party sources into the workspace (Correct answer)

Correct answer: Ingest security logs from Microsoft and third-party sources into the workspace

Data connectors pull log data from sources such as Azure AD, Microsoft Defender, Syslog, and third-party security products into Sentinel.

Question 40: What does UEBA stand for in the context of Microsoft Sentinel?

User and Entity Behavior Analytics (Correct answer)
Unified Event-Based Alerting
Unified Enterprise Backup Architecture
User Environment Baseline Assessment

Correct answer: User and Entity Behavior Analytics

UEBA in Sentinel uses machine learning to baseline normal activity for users, hosts, and IPs, then flags anomalous deviations.

Question 41: What does the Secure Score in Microsoft Defender for Cloud represent?

A DDoS attack risk probability rating
An industry compliance certification status
A threat intelligence confidence level for alerts
A percentage reflecting how many security recommendations have been implemented (Correct answer)

Correct answer: A percentage reflecting how many security recommendations have been implemented

Secure Score aggregates the results of all security assessments into a single percentage showing your overall security posture.

Microsoft Certified: Azure Security Engineer Associate (AZ-500)

This certification validates the skills of Azure security engineers to implement security controls, maintain the security posture, manage identity and access, and protect data, applications, and networks in cloud and hybrid environments as part of an end-to-end infrastructure.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds