Microsoft Azure Security Engineer Certification Microsoft AZ-500 3

Question 1

Which Azure DDoS Protection tier provides adaptive tuning, attack analytics, and integration with Azure Monitor alerts?

Accepted Answer

DDoS Standard (Network Protection)

Answer

DDoS Network Protection (formerly DDoS Standard) provides adaptive real-time tuning, attack metrics, telemetry, and Azure Monitor integration for protected VNets.

Question 2

A developer accidentally committed an Azure Storage SAS token to a public GitHub repository. What should be the FIRST remediation step?

Accepted Answer

Rotate the storage account access keys to invalidate the SAS token

Answer

Rotating the underlying storage account keys immediately invalidates all existing SAS tokens derived from those keys, stopping unauthorized access.

Question 3

You are configuring Azure AD Conditional Access. Which condition allows you to block access from countries where your company does not operate?

Accepted Answer

Named locations with country/region

Answer

Named locations based on countries/regions can be used in Conditional Access policies to block or require additional verification for sign-ins from specific geographies.

Question 4

Which Azure Key Vault object type should you use to store an asymmetric RSA private key used for code signing?

Accepted Answer

Key

Answer

Key Vault Keys store cryptographic keys (RSA, EC) and support operations like sign/verify without exposing the raw key material.

Question 5

An Azure subscription has a mix of IaaS VMs and PaaS services. Which Microsoft Defender for Cloud feature provides a unified security score reflecting the subscription's security posture?

Accepted Answer

Secure Score

Answer

Secure Score in Microsoft Defender for Cloud aggregates security recommendation results into a single percentage score representing the overall security posture.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft AZ-500 3