AZ-500: Azure Security Engineer Associate Practice Exam

A company needs to require MFA for all administrator access to the Azure portal while allowing standard users passwordless access from compliant devices. Which identity feature should be configured?

1. Conditional Access policies with separate rules for admin and standard user groups
2. Azure AD Password Protection only
3. Disable MFA and use IP restrictions only
4. A single blanket MFA policy for all users

An Azure-hosted web app needs to read secrets from Key Vault and blobs from a storage account. Security requires that no credential or connection string be stored in the app’s code or configuration. Which approach should be used?

1. Store a service principal client secret in the app’s configuration and rotate it quarterly
2. Assign a managed identity to the app and grant it RBAC access to Key Vault and Storage
3. Embed a shared access signature (SAS) token in the application settings
4. Use the storage account access key retrieved from an environment variable at startup

A company discovers former employees still have Azure access two weeks after leaving. They need automatic deprovisioning triggered by HR events. Which solution automates access removal upon employee departure?

1. Forced password expiration every 30 days requiring all users to create new credentials
2. Quarterly access certification campaigns sending email reminders to resource owners
3. Entra ID lifecycle workflows triggered by HR system termination events for automated offboarding
4. Monthly manual access reviews conducted by each department manager in a spreadsheet

An organization needs to grant a third-party auditor read-only access to specific resources for 30 days with no standing access. Which access approach should be used?

1. Create a permanent Guest account with the Reader role and no expiration date
2. Configure PIM with a time-bound eligible assignment that automatically expires after 30 days
3. Establish a VPN tunnel granting the auditor full network-level connectivity to Azure resources
4. Share an existing administrator account with the auditor for the duration of the engagement

A SOC team needs to detect and investigate multi-stage attacks across endpoints, email, identity, and cloud workloads from a single dashboard. Which Microsoft security solution provides this unified detection?

1. Microsoft Purview compliance portal managing data classification and retention policies
2. Microsoft Defender XDR correlating alerts across endpoints, email, identity, and cloud apps
3. Azure Firewall diagnostic logs providing network-level traffic inspection and analysis
4. Azure Network Watcher providing connectivity diagnostics and packet capture capabilities

A security analyst needs custom detection rules that query log data from multiple sources to find suspicious sign-in patterns. Which tool and language should the analyst use?

1. Azure Advisor security recommendations providing periodic best-practice compliance checks
2. Azure Policy audit-effect definitions evaluating resource configuration against standards
3. Azure Monitor metric alert rules configured with numeric threshold conditions on counters
4. Microsoft Sentinel scheduled analytics rules built with Kusto Query Language log queries

A company wants to automatically isolate compromised VMs and notify the security team when high-severity incidents are detected. Which Sentinel feature enables this automated response?

1. Sentinel workbooks providing interactive data visualization dashboards for analysts
2. Entity behavior analytics detecting anomalous patterns in user and device activity
3. Playbooks built on Logic Apps and triggered automatically by analytics rule incidents
4. Hunting notebooks providing interactive Jupyter-based threat investigation environments

A company needs to inspect and filter outbound internet traffic from Azure VMs, blocking access to known malicious domains. Which service should be deployed?

1. Network Security Groups with outbound IP address and port-based filtering rules
2. Azure DDoS Protection Standard providing volumetric attack mitigation at the network edge
3. Azure Private Link establishing private connectivity between VNets and Azure PaaS services
4. Azure Firewall with FQDN application rules and integrated threat intelligence feeds

A database team needs Azure SQL Database accessible only from specific VNets and never exposed to the public internet. Which configuration achieves this?

1. Configure a Private Endpoint for Azure SQL and disable the public network access setting
2. Deploy SQL Server on a virtual machine behind an internal Azure Load Balancer instance
3. Enable Azure DDoS Protection Standard on the virtual network hosting the database
4. Enable the public endpoint with IP firewall rules restricting access to known addresses

A company stores sensitive financial data in Blob Storage. They need encryption with customer-controlled keys and the ability to revoke access by revoking the key. Which encryption configuration should be implemented?

1. Customer-managed keys stored in Azure Key Vault with access controlled by the customer
2. Default Microsoft-managed encryption keys handled entirely by the Azure Storage platform
3. Client-side encryption using keys embedded directly within the application source code
4. No encryption applied to the storage account with network-level security isolation only