Microsoft Azure Security Engineer Certification Microsoft AZ-500 2 — Questions and Answers
Question 1: An organization needs to ensure that Azure VMs can only communicate with specific Azure PaaS services without traversing the public internet. Which feature should you configure?
- Service endpoints
- Private endpoints (Correct answer)
- Network security groups
- Azure Firewall DNAT rules
Correct answer: Private endpoints
Private endpoints assign a private IP from your VNet to the PaaS service, keeping traffic entirely off the public internet.
Question 2: You need to rotate the access keys for an Azure Storage account used by multiple applications without causing downtime. What is the safest approach?
- Regenerate both keys simultaneously and update all apps at once
- Update all apps to use Azure AD authentication instead of keys
- Regenerate key2, update apps to key2, then regenerate key1 (Correct answer)
- Enable soft delete and then rotate both keys
Correct answer: Regenerate key2, update apps to key2, then regenerate key1
Rotating one key at a time while updating apps to use the new key ensures zero downtime during the rotation process.
Question 3: A security audit reveals that guest users in your Azure AD tenant can enumerate all group memberships. Which setting restricts this behavior?
- Set 'Guest users permissions are limited' to Yes in External collaboration settings (Correct answer)
- Disable B2B collaboration in the tenant
- Remove all guest users from security groups
- Enable Privileged Identity Management for guests
Correct answer: Set 'Guest users permissions are limited' to Yes in External collaboration settings
Enabling restricted guest permissions in External collaboration settings prevents guests from enumerating users, groups, and other directory objects.
Question 4: Which Azure Sentinel (Microsoft Sentinel) component is responsible for collecting security data from connected sources?
- Workbooks
- Data connectors (Correct answer)
- Analytics rules
- Playbooks
Correct answer: Data connectors
Data connectors in Microsoft Sentinel ingest logs and alerts from Microsoft services, third-party products, and custom sources into the Log Analytics workspace.
Question 5: You want to enforce that all new Azure SQL Databases in a subscription must have Transparent Data Encryption enabled. What is the most scalable enforcement mechanism?
- Azure Security Center recommendation
- Azure Policy with DeployIfNotExists effect (Correct answer)
- ARM template deployment script
- Azure Automation runbook
Correct answer: Azure Policy with DeployIfNotExists effect
An Azure Policy with DeployIfNotExists effect automatically remediates non-compliant resources and enforces TDE on all new databases at scale.
Question 6: An attacker has compromised an Azure AD account. Which Microsoft Sentinel feature can automatically disable that user account in response?
- Analytics rule
- Workbook
- Playbook triggered by an automation rule (Correct answer)
- Hunting query
Correct answer: Playbook triggered by an automation rule
Playbooks (Azure Logic Apps) triggered by Sentinel automation rules can call the Microsoft Graph API to disable a compromised user account automatically.
Question 7: You need to provide a third-party auditor read-only access to your Azure subscription for 30 days without creating a permanent user account. Which approach is best?
- Create a service principal with Reader role
- Invite the auditor as a guest user and assign Reader role with an access review (Correct answer)
- Share your global admin credentials temporarily
- Grant access via Azure AD B2C
Correct answer: Invite the auditor as a guest user and assign Reader role with an access review
Inviting the auditor as a B2B guest and scheduling an access review ensures time-limited access with automatic expiry and audit trail.
Microsoft Azure Security Engineer Certification Microsoft AZ-500 2
An organization needs to ensure that Azure VMs can only communicate with specific Azure PaaS services without traversing the public internet.
Which feature should you configure?