Microsoft Azure Security Engineer Certification Microsoft AZ-500 5

Question 1

You need to ensure that Azure Kubernetes Service (AKS) pods cannot communicate with the Azure Instance Metadata Service (IMDS) endpoint. Which control achieves this?

Accepted Answer

Apply a Kubernetes NetworkPolicy blocking 169.254.169.254

Answer

A Kubernetes NetworkPolicy with an egress deny rule to 169.254.169.254/32 prevents pods from accessing IMDS, which can expose node-level credentials.

Question 2

Which log type in Microsoft Sentinel is most useful for detecting lateral movement via Pass-the-Hash attacks against on-premises domain controllers?

Accepted Answer

Windows Security Event logs (Event ID 4624 type 3)

Answer

Windows Security Event ID 4624 with Logon Type 3 (network logon) records NTLM-based lateral movement events that indicate Pass-the-Hash activity.

Question 3

An administrator accidentally deleted an Azure Key Vault. Which feature allows recovery within a retention period without recreating the vault?

Accepted Answer

Soft delete

Answer

Soft delete retains deleted Key Vaults (and their objects) in a recoverable state for a configurable retention period (7–90 days) before permanent deletion.

Question 4

Your company policy requires that all Azure AD user passwords expire every 60 days. Where is this password expiration policy configured for cloud-only users?

Accepted Answer

Microsoft 365 admin center password expiration policy

Answer

Password expiration policies for cloud-only Azure AD users are configured in the Microsoft 365 admin center under Security & Privacy > Password expiration policy.

Question 5

You need to monitor Azure AD for sign-ins using legacy authentication protocols like SMTP and IMAP, which bypass MFA. Which workbook in Microsoft Sentinel helps identify this?

Accepted Answer

Insecure Protocols workbook

Answer

The Insecure Protocols workbook in Microsoft Sentinel visualizes legacy authentication usage across your tenant, showing which users and protocols are bypassing MFA.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft AZ-500 5