Microsoft Azure Security Engineer Certification Microsoft AZ-500 5 — Questions and Answers
Question 1: You need to ensure that Azure Kubernetes Service (AKS) pods cannot communicate with the Azure Instance Metadata Service (IMDS) endpoint. Which control achieves this?
- Apply a Kubernetes NetworkPolicy blocking 169.254.169.254 (Correct answer)
- Enable Azure AD workload identity on the cluster
- Disable the system-assigned managed identity on the node pool
- Configure Azure Firewall egress rules
Correct answer: Apply a Kubernetes NetworkPolicy blocking 169.254.169.254
A Kubernetes NetworkPolicy with an egress deny rule to 169.254.169.254/32 prevents pods from accessing IMDS, which can expose node-level credentials.
Question 2: Which log type in Microsoft Sentinel is most useful for detecting lateral movement via Pass-the-Hash attacks against on-premises domain controllers?
- Azure Activity logs
- Azure AD Sign-in logs
- Windows Security Event logs (Event ID 4624 type 3) (Correct answer)
- Microsoft 365 audit logs
Correct answer: Windows Security Event logs (Event ID 4624 type 3)
Windows Security Event ID 4624 with Logon Type 3 (network logon) records NTLM-based lateral movement events that indicate Pass-the-Hash activity.
Question 3: An administrator accidentally deleted an Azure Key Vault. Which feature allows recovery within a retention period without recreating the vault?
- Key Vault backup and restore
- Soft delete (Correct answer)
- Purge protection
- Key Vault replication
Correct answer: Soft delete
Soft delete retains deleted Key Vaults (and their objects) in a recoverable state for a configurable retention period (7–90 days) before permanent deletion.
Question 4: Your company policy requires that all Azure AD user passwords expire every 60 days. Where is this password expiration policy configured for cloud-only users?
- Azure AD Password Protection settings
- Microsoft 365 admin center password expiration policy (Correct answer)
- Azure AD Conditional Access policy
- Azure AD Identity Protection
Correct answer: Microsoft 365 admin center password expiration policy
Password expiration policies for cloud-only Azure AD users are configured in the Microsoft 365 admin center under Security & Privacy > Password expiration policy.
Question 5: You need to monitor Azure AD for sign-ins using legacy authentication protocols like SMTP and IMAP, which bypass MFA. Which workbook in Microsoft Sentinel helps identify this?
- Azure AD Audit Logs workbook
- Insecure Protocols workbook (Correct answer)
- Sign-in Analysis workbook
- Entity Behavior Analytics workbook
Correct answer: Insecure Protocols workbook
The Insecure Protocols workbook in Microsoft Sentinel visualizes legacy authentication usage across your tenant, showing which users and protocols are bypassing MFA.
Question 6: When configuring Microsoft Defender for Cloud's just-in-time (JIT) VM access, what happens to NSG rules during an approved access request?
- Permanent inbound rules are added for the requester's IP
- Temporary inbound rules are added for the source IP and auto-removed after the time window (Correct answer)
- The NSG is detached from the VM's NIC during the session
- All NSG rules are replaced with an allow-all rule temporarily
Correct answer: Temporary inbound rules are added for the source IP and auto-removed after the time window
JIT access creates time-bound NSG inbound rules scoped to the approved source IP and port; the rules are automatically removed when the access window expires.
Question 7: You are designing a Zero Trust architecture for Azure workloads. Which principle dictates that every access request should be verified regardless of network location?
- Least privilege access
- Assume breach
- Verify explicitly (Correct answer)
- Defense in depth
Correct answer: Verify explicitly
The 'Verify explicitly' Zero Trust principle requires authenticating and authorizing every request based on all available signals, never trusting network location alone.
Microsoft Azure Security Engineer Certification Microsoft AZ-500 5
You need to ensure that Azure Kubernetes Service (AKS) pods cannot communicate with the Azure Instance Metadata Service (IMDS) endpoint.
Which control achieves this?