Microsoft Certified: Azure Security Engineer Associate (AZ-500) — Questions and Answers

Question 1: Azure Diagnostics is enabled on 100 virtual machines that are part of your company's Azure subscription. You've been given the assignment of finding out who uninstalled a virtual machine fifteen days ago. Azure Monitor has already been visited by you. Which choice from the list below ought to you pick?

Application Log
Metrics
Activity Log (Correct answer)
Logs

Correct answer: Activity Log

The Azure Activity Log records all subscription-level events, including administrative operations like creating, updating, or deleting resources (e.g., uninstalling a virtual machine). It provides information on who performed the action, when it occurred, and the status of the operation. Therefore, to determine who uninstalled a VM, the Activity Log in Azure Monitor is the correct place to look.

Question 2: Which Azure Key Vault feature allows you to define a rotation schedule so that cryptographic keys are automatically regenerated at set intervals?

Purge Protection schedule
Key rotation policy (Correct answer)
Certificate auto-renewal
Key expiry date enforcement

Correct answer: Key rotation policy

Key rotation policies (generally available for RSA and EC keys) let you define time-based schedules that automatically create new key versions and optionally trigger notifications.

Question 3: Which Microsoft Defender for Cloud recommendation alerts you when a subscription has no security contact email configured?

Enable MFA for all subscription owners
Provide security contact details for your subscription (Correct answer)
Enable Microsoft Defender for Cloud on the subscription
Apply system updates to virtual machines

Correct answer: Provide security contact details for your subscription

Defender for Cloud recommends configuring a security contact so Microsoft can notify your organization directly during a security incident.

Question 4: Which Azure feature assigns a private IP address from your VNet directly to a PaaS service, eliminating exposure over the public internet?

Private Endpoints (Correct answer)
Service Endpoints
Azure Relay
VNet Integration

Correct answer: Private Endpoints

Private Endpoints provision a network interface with a private IP in your VNet that maps to the PaaS service, keeping traffic fully private.

Question 5: Which Azure service provides a managed, stateful, cloud-native firewall with built-in high availability and unrestricted cloud scalability?

Network Security Group
Azure Firewall (Correct answer)
Azure Front Door
Application Gateway

Correct answer: Azure Firewall

Azure Firewall is a managed cloud-native firewall service that provides stateful packet inspection, FQDN filtering, and threat intelligence.

Question 6: Which diagnostic log category in Azure Key Vault records all data-plane operations such as reading, writing, and deleting secrets, keys, and certificates?

ActivityLog
DiagnosticEvent
AllMetrics
AuditEvent (Correct answer)

Correct answer: AuditEvent

The AuditEvent log category captures all authenticated requests to the Key Vault data plane, including who accessed which object and when.

Question 7: Which Microsoft Defender plan detects anomalous Azure Storage access patterns such as data exfiltration, access from Tor nodes, or malware uploads?

Defender for Servers
Defender for Key Vault
Defender for Storage (Correct answer)
Defender for SQL

Correct answer: Defender for Storage

Microsoft Defender for Storage monitors blob and file access patterns and generates alerts for suspicious activities against storage accounts.

Question 8: Which configuration enables automatic failover from an ExpressRoute circuit to a VPN Gateway connection in the same VNet?

ExpressRoute and VPN Gateway coexistence (Correct answer)
VNet peering with gateway transit
VPN Gateway zone redundancy
ExpressRoute FastPath routing

Correct answer: ExpressRoute and VPN Gateway coexistence

Deploying both an ExpressRoute gateway and a VPN gateway in the same VNet enables VPN to serve as a failover path when ExpressRoute fails.

Question 9: What is the maximum size of a single secret value that can be stored in Azure Key Vault?

64 KB
10 KB
1 KB
25 KB (Correct answer)

Correct answer: 25 KB

Azure Key Vault secrets are limited to 25 KB per value; use Azure Blob Storage with envelope encryption for larger payloads.

Question 10: A web application on Azure App Service is receiving SQL injection attacks. Which service should you enable to detect and block these attacks?

Azure Front Door with bot protection
Azure Application Gateway with WAF in Prevention mode (Correct answer)
Azure DDoS Protection Standard
Microsoft Defender for App Service

Correct answer: Azure Application Gateway with WAF in Prevention mode

Azure Application Gateway WAF in Prevention mode actively blocks requests matching OWASP CRS rules including SQL injection signatures.

Question 11: You are designing network security for an Azure Kubernetes Service cluster. Which feature enforces network policies between pods?

Azure Firewall Premium with IDPS
Azure Application Gateway Ingress Controller
Azure NSG applied to the AKS node subnet
Kubernetes Network Policy with Azure CNI or Calico (Correct answer)

Correct answer: Kubernetes Network Policy with Azure CNI or Calico

Kubernetes Network Policies enforce pod-to-pod traffic rules and require a compatible CNI plugin like Azure CNI with Calico.

Question 12: Which Azure Firewall Premium capability decrypts outbound TLS traffic, inspects it for threats, then re-encrypts it before forwarding?

Network rules with IP Groups
Application rules with FQDN filtering
TLS inspection (Correct answer)
Intrusion Detection and Prevention System

Correct answer: TLS inspection

Azure Firewall Premium TLS inspection acts as a transparent proxy that breaks and inspects encrypted sessions using an intermediate CA certificate.

Question 13: Which Azure Firewall rule collection type filters HTTP and HTTPS outbound traffic based on fully qualified domain names?

NAT rules
Network rules
IP Group rules
Application rules (Correct answer)

Correct answer: Application rules

Azure Firewall application rules inspect HTTP/HTTPS traffic and allow or deny it based on FQDNs with support for wildcard patterns.

Question 14: Which Azure Network Watcher feature captures network packets to and from VMs for diagnostics and forensic analysis?

NSG Flow Logs
Connection Monitor
Traffic Analytics
Packet Capture (Correct answer)

Correct answer: Packet Capture

Network Watcher Packet Capture records raw packets flowing to and from a VM, useful for troubleshooting and security investigations.

Question 15: Which built-in RBAC role allows a principal to manage Key Vault properties (create, update, delete the vault) but grants NO access to secrets, keys, or certificates?

Key Vault Secrets Officer
Key Vault Administrator
Contributor
Key Vault Contributor (Correct answer)

Correct answer: Key Vault Contributor

Key Vault Contributor is a control-plane role that manages the vault resource itself but intentionally has no data-plane permissions to read or write secrets, keys, or certificates.

Question 16: Single Sign-On (SSO) is enabled in your hybrid configuration of Azure Active Directory (Azure AD). You have an Azure SQL Database instance with Azure AD authentication functionality enabled. The domain-joined device must be used to establish a connection to the database instance, and database developers must authenticate using their local Active Directory accounts. Use Microsoft SQL Server Management Studio to check if developers can connect to the instance. The issue must be solved by reducing authentication requests. Which authentication technique ought to you suggest?

Active Directory - Universal with MFA support
SQL Server Authentication
Active Directory - Password
Active Directory - Integrated (Correct answer)

Correct answer: Active Directory - Integrated

For domain-joined devices and users leveraging their on-premises Active Directory accounts to connect to Azure SQL Database via SSMS, 'Active Directory - Integrated' authentication is the optimal choice. This method uses Windows authentication, allowing for a seamless single sign-on experience where users are authenticated automatically based on their current Windows login, minimizing authentication prompts.

Question 17: What does the Secure Score in Microsoft Defender for Cloud represent?

An industry compliance certification status
A percentage reflecting how many security recommendations have been implemented (Correct answer)
A DDoS attack risk probability rating
A threat intelligence confidence level for alerts

Correct answer: A percentage reflecting how many security recommendations have been implemented

Secure Score aggregates the results of all security assessments into a single percentage showing your overall security posture.

Question 18: Which combination provides global edge protection against OWASP Top 10 vulnerabilities for geographically distributed web applications?

Azure Firewall Premium with IDPS
NSG with application security groups
Azure DDoS Network Protection
Azure Front Door with WAF policy (Correct answer)

Correct answer: Azure Front Door with WAF policy

Azure Front Door combined with a WAF policy provides globally distributed inspection and blocking at the edge closest to users.

Question 19: Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?

Azure Key Vault (Correct answer)
Azure App Configuration
Azure Managed HSM
Azure Storage with encryption

Correct answer: Azure Key Vault

Azure Key Vault securely stores and manages secrets, keys, and certificates with Azure AD-based access control and full audit logging.

Question 20: What is the best practice for reducing false positives in a Microsoft Sentinel scheduled analytics rule?

Tune the KQL query with additional where clauses and adjusted thresholds (Correct answer)
Switch the rule to Detection mode
Remove the associated data connector
Disable the rule until threats are confirmed

Correct answer: Tune the KQL query with additional where clauses and adjusted thresholds

Adding KQL filters to exclude known-good activity and adjusting alert thresholds reduces noise while preserving detection coverage.

Question 21: How do you configure Microsoft Sentinel to automatically run a playbook whenever a new incident is created?

Add a Recurrence trigger in the Logic App
Create an Azure Event Grid subscription to the Sentinel topic
Create a Sentinel automation rule with a playbook action on incident creation (Correct answer)
Configure a direct webhook in the analytics rule

Correct answer: Create a Sentinel automation rule with a playbook action on incident creation

Sentinel automation rules evaluate trigger conditions such as incident creation and run the specified Logic App playbook automatically.

Question 22: Which Microsoft Sentinel component contains KQL-based detection logic that runs on a schedule and generates alerts when triggered?

Playbooks
Hunting queries
Workbooks
Analytics rules (Correct answer)

Correct answer: Analytics rules

Scheduled analytics rules run KQL queries against ingested data at defined intervals and create incidents when the query returns results.

Question 23: What does Microsoft Defender for Cloud's Just-in-Time (JIT) VM Access feature do to reduce attack surface?

Continuously patches VMs with security updates
Creates temporary NSG rules opening management ports only on authorized request (Correct answer)
Takes hourly VM snapshots for rollback
Automatically scales down idle VMs

Correct answer: Creates temporary NSG rules opening management ports only on authorized request

JIT creates time-bound NSG rules that open RDP/SSH ports only for the requesting user's IP, then automatically closes them after expiration.

Question 24: Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). You are informed that users with a givenName attribute commencing with LAB should not be permitted to sync to Azure AD once all on-premises identities have been synced to it. Cloud AD. Which of the subsequent actions ought you to perform?

You should configure a network traffic filtering rule on the Firewall.
You should make use of the Synchronization Rules Editor to create an attribute-based filtering rule. (Correct answer)
You should configure a DNAT rule on the Firewall.
You should make use of Active Directory Users and Computers to create an attribute-based filtering rule.

Correct answer: You should make use of the Synchronization Rules Editor to create an attribute-based filtering rule.

To prevent specific users from synchronizing to Azure AD based on an attribute like 'givenName', you must configure filtering within Azure AD Connect. The Synchronization Rules Editor is the dedicated tool used to create or modify inbound and outbound synchronization rules, allowing you to define attribute-based filtering criteria to control which objects are synchronized. Firewall rules or Active Directory Users and Computers are not designed for this purpose.

Question 25: Microsoft Sentinel is configured to ingest Azure AD sign-in logs. Which built-in analytics rule type uses machine learning to detect anomalous sign-in patterns?

Scheduled KQL query rules
Fusion rules for multi-stage attacks
Microsoft Security incident creation rules
Anomaly detection rules (UEBA) (Correct answer)

Correct answer: Anomaly detection rules (UEBA)

UEBA (User and Entity Behavior Analytics) anomaly rules use machine learning baselines to detect deviations from normal user behavior.

Question 26: Azure Active Directory (Azure AD) is used by your organisation in a hybrid configuration. All users use hybrid Windows 10 devices that are connected to Azure AD. You are in charge of a SQL Azure database that supports Azure AD authentication. You must ensure that Microsoft SQL Server Management Studio (SSMS) can connect to the SQL database for database developers. Additionally, you must ensure that the developers authenticate using their on-premises Active Directory accounts. Your plan should provide for a minimal amount of authentication prompts. Which of the following authentication techniques ought to be employed by developers?

Azure Multi-Factor authentication.
Active Directory integrated authentication. (Correct answer)
Azure AD token.
None of the above

Correct answer: Active Directory integrated authentication.

For domain-joined devices and users authenticating with on-premises Active Directory accounts to an Azure SQL Database, 'Active Directory integrated authentication' provides the most seamless experience with minimal prompts. This method leverages the user's existing Windows login credentials from their domain-joined device, allowing for single sign-on without requiring them to re-enter credentials.

Question 27: Which Azure key management service provides FIPS 140-2 Level 3 validated, single-tenant managed HSM capacity for organizations with strict compliance requirements?

Azure Managed HSM (Correct answer)
Azure Dedicated HSM
Azure Key Vault Premium tier
Azure Key Vault Standard tier

Correct answer: Azure Managed HSM

Azure Managed HSM delivers a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 validation for exclusive customer key control.

Question 28: A company must ensure all Azure VMs in a subscription use managed disks with customer-managed keys. Which control enforces this at scale?

Azure Policy with a 'deny' effect (Correct answer)
Azure Security Center recommendation
ARM template deployment
Azure Blueprints assignment

Correct answer: Azure Policy with a 'deny' effect

An Azure Policy with a deny effect prevents the creation of VMs with unencrypted or platform-managed-key disks.

Question 29: Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). The integration of Active Directory with the Azure AD tenancy is your responsibility. You want to introduce Azure AD Connect. Your integration approach must ensure that user accounts that are synchronized to the Azure AD tenant are affected by password rules and user login limitations, and that the number of required servers is kept to a minimum. You suggest using Active Directory Federation Services (AD FS) for federation as a solution. Is the aim being met by the solution?

Maybe
Yes
No (Correct answer)

Correct answer: No

While Active Directory Federation Services (AD FS) can ensure on-premises password rules and login limitations apply, it requires a substantial infrastructure of multiple servers (AD FS servers and Web Application Proxy servers). This directly contradicts the requirement to keep the number of required servers to a minimum. Thus, AD FS does not meet all the specified aims.

Question 30: Which Azure DDoS Protection tier provides adaptive tuning, attack analytics, and SLA guarantees beyond the free platform protection?

DDoS Basic
Application Gateway WAF tier
Azure Firewall Premium
DDoS Network Protection (Correct answer)

Correct answer: DDoS Network Protection

Azure DDoS Network Protection provides per-resource adaptive tuning, real-time attack metrics, and a financial guarantee SLA.

Question 31: Which Azure AD Identity Governance feature allows administrators to periodically certify that user access to resources remains appropriate?

Access Reviews (Correct answer)
Identity Protection
Conditional Access
Privileged Identity Management

Correct answer: Access Reviews

Access Reviews enable admins or resource owners to run recertification campaigns and revoke stale access assignments.

Question 32: Which Microsoft Defender for Cloud plan scans container images in Azure Container Registry for vulnerabilities?

Container Security Groups add-on
Azure Security Benchmark policy
Defender for Containers (Correct answer)
Defender for Servers

Correct answer: Defender for Containers

Microsoft Defender for Containers triggers vulnerability assessment for images pushed to or pulled from ACR and surfaces findings in Defender for Cloud.

Question 33: Which Azure service provides browser-based RDP and SSH access to VMs through the Azure portal without requiring public IP addresses on the VMs?

Just-in-Time VM Access
Azure VPN Gateway
Azure Firewall DNAT rules
Azure Bastion (Correct answer)

Correct answer: Azure Bastion

Azure Bastion is a PaaS service deployed inside your VNet that provides secure RDP/SSH over TLS on port 443 from the Azure portal.

Question 34: Which Azure AD feature evaluates sign-in signals such as user location, device, and app to enforce policies like MFA or block access?

Identity Protection
Privileged Identity Management
Conditional Access (Correct answer)
Access Reviews

Correct answer: Conditional Access

Conditional Access acts as a policy engine that evaluates signals and enforces access controls like requiring MFA or blocking sign-ins.

Question 35: Which Microsoft Defender for Servers alert type indicates suspicious access to the Azure Instance Metadata Service that could enable credential theft?

SQL injection attempt detected
Credential Access - IMDS service abuse (Correct answer)
Outbound network port scan
Suspicious cryptomining activity

Correct answer: Credential Access - IMDS service abuse

Defender for Servers alerts on abnormal IMDS queries because attackers on compromised VMs query this endpoint to steal managed identity tokens.

Question 36: With Azure Data Lake Store Gen1, you are engaged. You now realize how important it is to understand the external data's schema. Which plug-in from the list below would you use to learn the external data schema?

mysql_request
Pivot
Narrow
infer_storage_schema (Correct answer)

Correct answer: infer_storage_schema

The `infer_storage_schema` plug-in in Azure Data Explorer (KQL) is used to automatically detect and understand the schema of external data stored in Azure Data Lake Store Gen1 (or other external storage). This plug-in helps in quickly creating external tables by suggesting column names and data types based on the data's structure. It simplifies the process of querying external data without manual schema definition.

Question 37: Which Azure Storage feature generates time-limited, permission-scoped URIs that grant access to specific resources without sharing the master account key?

Storage access keys
Storage firewall rules
Azure AD authentication tokens
Shared Access Signatures (SAS) (Correct answer)

Correct answer: Shared Access Signatures (SAS)

SAS tokens encode permissions, start time, expiry, and allowed operations into a signed URI for scoped temporary access.

Question 38: Which Microsoft Defender for Cloud workload protection plan provides threat detection and EDR integration for Azure and on-premises VMs?

Defender for Servers (Correct answer)
Defender for Containers
Defender for Storage
Defender for Key Vault

Correct answer: Defender for Servers

Microsoft Defender for Servers provides behavioral analytics, threat detection, and Microsoft Defender for Endpoint EDR integration for VMs.

Question 39: Which Microsoft Sentinel capability uses ML to correlate multiple lower-fidelity alerts from different sources into a single high-fidelity incident representing a multi-stage attack?

Scheduled analytics rules
Hunting bookmarks
Fusion detection (Correct answer)
UEBA entity pages

Correct answer: Fusion detection

Fusion detection correlates signals across Microsoft products to identify multi-stage attack patterns like credential compromise followed by exfiltration.

Question 40: In SQL Server Analysis Services, data semantic models must be created. One should adhere to a few best practices for data modeling that are advised. Which of the following procedures would you believe to be the ideal procedures to follow when developing data semantic models?

Only include the integer surrogate keys or value encoding in the model and exclude all the natural keys from the dimension tables.
Decrease cardinality to reduce the uniqueness of the values and allow much better compression.
Create a dimension model snowflake or/and star, even if you need to ingest data from various sources.
All of the above (Correct answer)

Correct answer: All of the above

Adhering to best practices for data semantic models is crucial for performance and usability. Creating star or snowflake schemas (A) is fundamental for analytical models, simplifying queries and improving performance. Including only integer surrogate keys (B) reduces storage, optimizes joins, and isolates the model from changes in natural keys. Decreasing cardinality (C) by reducing unique values leads to better data compression and faster query execution, making 'All of the above' the correct approach.

Question 41: Which KQL operator is used in Microsoft Sentinel to combine rows from two log tables based on a matching field?

summarize
project
join (Correct answer)
where

Correct answer: join

The KQL `join` operator merges two tables on specified key columns, supporting kinds like inner, leftouter, and rightouter.

Microsoft Certified: Azure Security Engineer Associate (AZ-500)

This certification validates the skills of Azure security engineers to implement security controls, maintain the security posture, manage identity and access, and protect data, applications, and networks in cloud and hybrid environments as part of an end-to-end infrastructure.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Test delivery, retake policy, time limit, score validity, eligibility, renewal, exam information · verified Nov 2026