Microsoft Azure Security Engineer Certification Microsoft AZ-500 4 — Questions and Answers
Question 1: A security engineer needs to analyze all Azure resource configuration changes over the past 90 days for compliance evidence. Which service provides this audit trail?
- Azure Monitor Activity Log (Correct answer)
- Azure Resource Graph
- Microsoft Defender for Cloud
- Azure Policy compliance history
Correct answer: Azure Monitor Activity Log
The Azure Monitor Activity Log records all control-plane operations (create, update, delete) on Azure resources and retains them for up to 90 days by default.
Question 2: You want to prevent users from creating Azure resources outside of approved regions. Which Azure Policy effect should your policy definition use?
- Audit
- Deny (Correct answer)
- DeployIfNotExists
- Append
Correct answer: Deny
The Deny effect blocks the resource creation or update request at deployment time if it doesn't meet the policy conditions.
Question 3: Which component of Microsoft Defender for Endpoint is responsible for blocking malicious processes based on behavioral analysis on Azure VMs?
- Attack surface reduction rules (Correct answer)
- Endpoint detection and response (EDR)
- Vulnerability management
- Network protection
Correct answer: Attack surface reduction rules
Attack surface reduction (ASR) rules proactively block behaviors commonly used by malware, such as Office apps spawning child processes or obfuscated script execution.
Question 4: An Azure Storage account must be accessed only from a specific on-premises IP range. Which feature enforces this at the storage service level?
- Azure AD Conditional Access
- Storage account firewall with selected networks and IP ranges (Correct answer)
- Private endpoint
- Service endpoint policy
Correct answer: Storage account firewall with selected networks and IP ranges
The Azure Storage account firewall lets you restrict access to specific public IP ranges or VNets, blocking all other incoming requests.
Question 5: You need to give an Azure Function read access to an Azure SQL Database without storing credentials in the function's configuration. What is the recommended approach?
- Store the connection string in Azure Key Vault and reference it via app settings
- Use a system-assigned managed identity and grant it db_datareader role in SQL (Correct answer)
- Embed the SQL admin password as an environment variable
- Use an Azure AD service principal with a client secret
Correct answer: Use a system-assigned managed identity and grant it db_datareader role in SQL
A system-assigned managed identity eliminates credentials entirely — Azure automatically manages the identity lifecycle and the Function authenticates to SQL using Azure AD tokens.
Question 6: Which Azure AD PIM setting requires a justification and optionally an approval workflow before a user can activate an eligible role assignment?
- Require MFA on activation
- Require approval to activate (Correct answer)
- Require justification on activation
- Set activation maximum duration
Correct answer: Require approval to activate
The 'Require approval to activate' PIM role setting routes activation requests through designated approvers before the privileged role is granted.
Question 7: A web application hosted in Azure App Service is vulnerable to SQL injection. Which Azure service can detect and block these attacks at the HTTP layer?
- Azure Firewall Premium with IDPS
- Azure DDoS Network Protection
- Azure Application Gateway with WAF (OWASP rule set) (Correct answer)
- Network Security Group
Correct answer: Azure Application Gateway with WAF (OWASP rule set)
Azure Application Gateway WAF with OWASP Core Rule Set detects and blocks SQL injection, XSS, and other Layer 7 attacks before they reach the application.
Microsoft Azure Security Engineer Certification Microsoft AZ-500 4
A security engineer needs to analyze all Azure resource configuration changes over the past 90 days for compliance evidence.
Which service provides this audit trail?