Microsoft Azure Security Engineer Certification Microsoft AZ-500 4

Question 1

A security engineer needs to analyze all Azure resource configuration changes over the past 90 days for compliance evidence. Which service provides this audit trail?

Accepted Answer

Azure Monitor Activity Log

Answer

The Azure Monitor Activity Log records all control-plane operations (create, update, delete) on Azure resources and retains them for up to 90 days by default.

Question 2

You want to prevent users from creating Azure resources outside of approved regions. Which Azure Policy effect should your policy definition use?

Accepted Answer

Deny

Answer

The Deny effect blocks the resource creation or update request at deployment time if it doesn't meet the policy conditions.

Question 3

Which component of Microsoft Defender for Endpoint is responsible for blocking malicious processes based on behavioral analysis on Azure VMs?

Accepted Answer

Attack surface reduction rules

Answer

Attack surface reduction (ASR) rules proactively block behaviors commonly used by malware, such as Office apps spawning child processes or obfuscated script execution.

Question 4

An Azure Storage account must be accessed only from a specific on-premises IP range. Which feature enforces this at the storage service level?

Accepted Answer

Storage account firewall with selected networks and IP ranges

Answer

The Azure Storage account firewall lets you restrict access to specific public IP ranges or VNets, blocking all other incoming requests.

Question 5

You need to give an Azure Function read access to an Azure SQL Database without storing credentials in the function's configuration. What is the recommended approach?

Accepted Answer

Use a system-assigned managed identity and grant it db_datareader role in SQL

Answer

A system-assigned managed identity eliminates credentials entirely — Azure automatically manages the identity lifecycle and the Function authenticates to SQL using Azure AD tokens.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft AZ-500 4