Microsoft Azure Security Engineer Certification Microsoft AZ-500 3 — Questions and Answers
Question 1: Which Azure DDoS Protection tier provides adaptive tuning, attack analytics, and integration with Azure Monitor alerts?
- DDoS Basic
- DDoS Standard (Network Protection) (Correct answer)
- DDoS IP Protection
- Azure Front Door WAF only
Correct answer: DDoS Standard (Network Protection)
DDoS Network Protection (formerly DDoS Standard) provides adaptive real-time tuning, attack metrics, telemetry, and Azure Monitor integration for protected VNets.
Question 2: A developer accidentally committed an Azure Storage SAS token to a public GitHub repository. What should be the FIRST remediation step?
- Rotate the storage account access keys to invalidate the SAS token (Correct answer)
- Delete the GitHub repository
- Enable Azure Defender for Storage
- Update the storage firewall rules
Correct answer: Rotate the storage account access keys to invalidate the SAS token
Rotating the underlying storage account keys immediately invalidates all existing SAS tokens derived from those keys, stopping unauthorized access.
Question 3: You are configuring Azure AD Conditional Access. Which condition allows you to block access from countries where your company does not operate?
- Device platform condition
- Named locations with country/region (Correct answer)
- Sign-in risk condition
- User risk condition
Correct answer: Named locations with country/region
Named locations based on countries/regions can be used in Conditional Access policies to block or require additional verification for sign-ins from specific geographies.
Question 4: Which Azure Key Vault object type should you use to store an asymmetric RSA private key used for code signing?
- Secret
- Certificate
- Key (Correct answer)
- Managed Identity
Correct answer: Key
Key Vault Keys store cryptographic keys (RSA, EC) and support operations like sign/verify without exposing the raw key material.
Question 5: An Azure subscription has a mix of IaaS VMs and PaaS services. Which Microsoft Defender for Cloud feature provides a unified security score reflecting the subscription's security posture?
- Regulatory compliance dashboard
- Secure Score (Correct answer)
- Workload protections
- Attack path analysis
Correct answer: Secure Score
Secure Score in Microsoft Defender for Cloud aggregates security recommendation results into a single percentage score representing the overall security posture.
Question 6: You need to ensure that all outbound internet traffic from Azure VMs in a subnet is inspected and filtered. Which solution is most appropriate?
- Network Security Group with outbound deny rules
- Azure Firewall with forced tunneling
- User-defined routes pointing to Azure Firewall (Correct answer)
- Web Application Firewall on Application Gateway
Correct answer: User-defined routes pointing to Azure Firewall
User-defined routes (UDRs) on the subnet redirect outbound traffic to Azure Firewall, which then inspects and filters it before forwarding to the internet.
Question 7: Which Azure AD feature allows you to detect when a user's credentials have been leaked on the dark web and automatically enforce a password reset?
- Azure AD Identity Protection — leaked credentials risk detection (Correct answer)
- Microsoft Defender for Identity
- Azure AD Smart Lockout
- Privileged Identity Management
Correct answer: Azure AD Identity Protection — leaked credentials risk detection
Azure AD Identity Protection's leaked credentials detection cross-references user credentials against known breach databases and triggers risk-based Conditional Access policies.
Microsoft Azure Security Engineer Certification Microsoft AZ-500 3
Which Azure DDoS Protection tier provides adaptive tuning, attack analytics, and integration with Azure Monitor alerts?