Microsoft Certified: Azure Security Engineer Associate — Practice Set 1

Question 1

Your organization needs to ensure that privileged role assignments for Azure resources require approval before activation. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM) allows you to configure approval workflows for role activation, including requiring an approver before a user can activate a privileged role. Conditional Access controls sign-in conditions, Identity Protection detects risky sign-ins, and Access Reviews are used for periodic access certification.

Question 2

You are a security administrator. A developer needs to allow an application running in Azure App Service to access Azure Key Vault secrets without storing credentials in code. What should you configure?

Accepted Answer

A system-assigned managed identity is the recommended approach for allowing Azure resources to authenticate to other Azure services without managing credentials. The identity is tied to the App Service lifecycle and can be granted Key Vault access via RBAC or vault access policies, eliminating the need to store any secrets in code.

Question 3

Your organization is configuring Microsoft Entra Privileged Identity Management for Azure subscription roles. Which two settings can you configure for eligible role assignments in PIM? Choose 2.

Accepted Answer

PIM role settings allow you to configure maximum activation duration (how long a role can be active) and require MFA on activation. You can also require justification and approval, but MFA enforcement and duration limits are core PIM-specific settings. Automatic license assignment and password reset are not PIM activation settings.

Question 4

You are implementing a Conditional Access policy that must block access to all cloud apps from any location that is not a named location, except for break-glass administrator accounts. What is the correct approach to exclude the break-glass accounts?

Accepted Answer

Break-glass accounts should be excluded directly as users (not via group membership) in the Conditional Access policy to ensure they can always sign in during emergencies. Group membership can be changed accidentally or by automated processes. Report-only mode does not actually block any access. Conditional Access policies do not have an order of precedence that guarantees one policy overrides another — the most restrictive applicable policy wins.

Question 5

Your organization has an Azure virtual network containing web servers. You need to allow inbound HTTPS traffic from the internet and deny all other inbound traffic. Which Azure resource should you use to enforce this at the subnet level?

Accepted Answer

A Network Security Group (NSG) can be associated with a subnet to filter inbound and outbound network traffic. You can create a rule to allow TCP port 443 (HTTPS) from any source and deny all other inbound traffic using the default deny-all rule. ASGs are used to group VMs for easier rule management within NSGs. Azure Firewall is a managed network security service that operates at a higher level. DDoS Protection mitigates volumetric attacks but does not filter specific ports.

Question 6

You are a security engineer. Your organization hosts a web application in Azure and needs to protect it against OWASP Top 10 vulnerabilities. The solution must inspect HTTP/HTTPS traffic and block malicious requests. Which Azure service should you deploy?

Accepted Answer

A Web Application Firewall (WAF) deployed on Azure Application Gateway inspects inbound HTTP/HTTPS traffic and can block requests matching OWASP Core Rule Set rules, protecting against SQL injection, XSS, and other common web attacks. Azure Firewall Premium provides IDPS capabilities for network traffic but is not purpose-built for Layer 7 HTTP inspection against OWASP rules. DDoS Protection mitigates volumetric attacks. Network Watcher is a monitoring and diagnostic service.

Question 7

Your company has an Azure virtual network with several subnets. A new compliance requirement states that all outbound internet traffic from virtual machines must be inspected and logged before leaving Azure. Virtual machines must not have direct internet access via their public IP addresses. Which solution best meets this requirement?

Accepted Answer

Azure Firewall deployed in a hub network with UDRs forcing all outbound traffic through the firewall provides centralized inspection, filtering, and logging of internet-bound traffic. The firewall's threat intelligence and FQDN filtering rules control what traffic is allowed. NSG flow logs provide visibility but do not inspect or block traffic. Denying all outbound traffic via NSGs would break legitimate business traffic. Defender for Cloud provides threat detection but does not control network routing.

Question 8

Your organization needs to provide secure access to an Azure SQL Database from an on-premises application without routing traffic over the public internet. Which Azure networking feature should you use?

Accepted Answer

Azure Private Endpoint creates a private IP address in your virtual network that maps to the Azure SQL Database, allowing access over a private connection without traversing the public internet. Service Endpoints extend the virtual network identity to the service but do not provide a private IP and traffic still leaves the virtual network's address space. VPN Gateway is appropriate for site-to-site connectivity but Private Endpoint provides the most direct private path. NSG rules can restrict access but do not eliminate public internet exposure.

Question 9

Your organization is designing a hub-and-spoke network topology in Azure. The security team requires that all inter-spoke traffic be inspected and that DNS queries from spoke virtual networks resolve through a central DNS forwarder in the hub. Which two resources should you deploy in the hub virtual network? Choose 2.

Accepted Answer

Azure Firewall in the hub provides centralized inspection of inter-spoke and internet-bound traffic, enforced via UDRs in spoke virtual networks. Azure DNS Private Resolver allows DNS queries from spoke virtual networks to be forwarded to on-premises DNS or resolved centrally without deploying custom DNS VMs. Application Gateway is a Layer 7 load balancer for web applications. Bastion provides secure RDP/SSH but is not relevant to traffic inspection or DNS. Virtual WAN is a networking service for global transit but is an alternative topology, not a component within a hub VNet.

Question 10

You are configuring ExpressRoute connectivity for your hybrid environment. The compliance team requires that data traversing the ExpressRoute circuit be encrypted. Which approach should you implement?

Accepted Answer

MACsec (Media Access Control Security) is supported on ExpressRoute Direct connections and encrypts data at the Layer 2 level between your edge routers and Microsoft's edge routers, satisfying encryption-in-transit requirements for the physical layer. NSGs cannot be applied to GatewaySubnet in a supported manner and do not provide encryption. DDoS Protection does not encrypt traffic. Azure Firewall inspects traffic but does not encrypt the physical ExpressRoute circuit.

Question 11

Your organization needs to provide secure, browser-based RDP and SSH access to Azure virtual machines without exposing the VMs to the public internet or requiring a public IP address on the VMs. Which Azure service should you use?

Accepted Answer

Azure Bastion provides secure, seamless RDP and SSH connectivity to virtual machines directly through the Azure portal over TLS, without requiring public IP addresses on VMs or opening RDP/SSH ports to the internet. JIT VM access reduces the attack surface by temporarily opening management ports only when needed, but still requires a public IP on the VM. VPN Gateway and Azure Firewall DNAT rules require additional infrastructure and still involve exposing VMs.

Question 12

You are a security engineer configuring storage account security. Your organization requires that all data at rest in Azure Blob Storage be encrypted with a customer-managed key (CMK) stored in Azure Key Vault, and the key must be rotated annually. Which feature should you configure?

Accepted Answer

Customer-managed keys (CMK) allow you to bring your own encryption key stored in Azure Key Vault (BYOK) and configure automatic key rotation to meet compliance requirements. Azure Key Vault supports key rotation policies that automatically create new key versions on a schedule. Microsoft-managed keys do not give the customer control over key lifecycle. Double infrastructure encryption adds a second layer of encryption with Microsoft-managed keys but does not use customer keys. SAS tokens control access, not encryption.

Question 13

Your organization runs containerized workloads on Azure Kubernetes Service (AKS). A security audit finds that the AKS nodes are accessible from the internet via their public IP addresses, and pods can communicate with any endpoint without restriction. You need to remediate both issues. Which two changes should you make?

Accepted Answer

Enabling private cluster mode removes the public API server endpoint, isolating the control plane from the internet. Azure CNI with Calico (or Azure Network Policy) enables Kubernetes network policies that restrict pod-to-pod and pod-to-external communication. Defender for Containers adds threat detection but does not restrict network access. An NSG on the node subnet helps but does not address pod-level east-west traffic. A Standard load balancer is already the default. Pod identity and pod disruption budgets address different concerns.

Question 14

Your organization stores sensitive financial data in Azure SQL Database. The compliance team requires that database administrators cannot see the actual values in specific columns containing credit card numbers, even when querying them directly. Which Azure SQL feature should you implement?

Accepted Answer

Azure SQL Always Encrypted ensures that sensitive data is encrypted on the client side before it is sent to the database server. The database engine never sees the plaintext data, so even privileged database administrators or Microsoft employees cannot access the plaintext values. Dynamic Data Masking obfuscates data in query results but DBAs with UNMASK permission can still view the real values. TDE encrypts data at rest on disk but not in query results. Row-Level Security filters which rows a user can access, not the column values.

Question 15

Your organization is implementing a defense-in-depth strategy for Azure Blob Storage containing confidential documents. The security team requires that data cannot be deleted or modified for 90 days after upload, and that all access attempts are logged. Which two features should you configure on the storage account? Choose 2.

Accepted Answer

Immutable storage with a time-based retention policy enforces a write-once, read-many (WORM) state, preventing modification or deletion of blobs for the specified retention period — meeting the 90-day tamper-proof requirement. Azure Storage diagnostic logging (resource logs) captures all read, write, and delete operations and can be sent to Log Analytics for auditing. Soft delete enables recovery of deleted blobs but does not prevent deletion. Lifecycle management automates tiering and deletion, which could conflict with the requirement. SAS tokens control access but do not enforce immutability.

Question 16

You are configuring disk encryption for Azure virtual machines that process highly sensitive data. The requirement is that the encryption keys must never leave the hardware security module (HSM) and must be protected at the FIPS 140-2 Level 3 boundary. Which disk encryption option should you recommend?

Accepted Answer

Confidential disk encryption leverages Azure confidential computing and Azure Key Vault Managed HSM to ensure that keys are protected within an HSM at FIPS 140-2 Level 3 and that disk encryption and decryption happens within the VM's trusted execution environment, so keys never leave the HSM boundary in plaintext. ADE with Key Vault Standard tier does not provide HSM-level key protection. Server-side encryption with Key Vault Premium (HSM-backed) protects keys in an HSM but does not provide the confidential computing guarantees. Encryption at host with Microsoft-managed keys does not give the customer control over the HSM boundary.

Question 17

Your organization is onboarding Azure subscriptions to Microsoft Defender for Cloud. The security team wants to understand which Azure resources are at risk and see a prioritized list of recommendations. Which Defender for Cloud feature provides this view?

Accepted Answer

The Secure Score in Microsoft Defender for Cloud provides a quantitative measure of an organization's security posture based on implemented security recommendations. The Asset Inventory view shows all resources discovered by Defender for Cloud along with their security state and outstanding recommendations, providing a prioritized view of risks. The Workload protections dashboard shows alerts from enabled Defender plans. Regulatory compliance tracks adherence to frameworks. EASM focuses on internet-exposed assets.

Question 18

Your organization needs to centralize secrets, connection strings, and certificates used by Azure applications. You must ensure that access to secrets is audited and that secrets can be rotated without redeploying applications. Which Azure service should you use?

Accepted Answer

Azure Key Vault is the purpose-built service for securely storing and managing secrets, keys, and certificates. It provides audit logging via Azure Monitor, access control via RBAC and access policies, and supports secret rotation with versioning so applications can always reference the latest version without redeployment. App Configuration stores feature flags and application settings but is not designed for sensitive secrets management. Storing secrets in Azure Storage lacks native secret management features. Managed Identity handles authentication identity, not secret storage.

Question 19

Your organization's security operations center (SOC) receives hundreds of security alerts daily from multiple Microsoft security products including Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The SOC team is overwhelmed and needs a single place to investigate correlated incidents across all products. Which Microsoft service should you implement?

Accepted Answer

Microsoft Sentinel is a cloud-native SIEM that ingests alerts and signals from Microsoft Defender XDR (which unifies Defender for Endpoint, Defender for Identity, Defender for Office 365, and more) via the Microsoft Defender XDR data connector. Sentinel correlates alerts into incidents, provides investigation tools, and automates responses via playbooks, giving the SOC a single pane of glass. Defender for Cloud focuses on Azure workload protection. Azure Monitor can forward alerts but lacks the SIEM correlation capabilities. Defender for Cloud Apps focuses on cloud app visibility.

Question 20

You are configuring Azure Key Vault for a production environment. The compliance team requires that the Key Vault is not accessible from the public internet and that only resources within a specific virtual network subnet can access it. Which Key Vault configuration should you apply?

Accepted Answer

Deploying Azure Key Vault with a Private Endpoint creates a private IP address in the virtual network, and disabling public network access ensures the Key Vault is completely inaccessible from the internet. This provides the strongest isolation. Using Service Endpoints with the firewall allows the subnet to access Key Vault but traffic still routes through the Azure backbone — the vault is still technically reachable from the internet unless public access is disabled separately. Access policies control who can access secrets, not network connectivity. Soft delete and purge protection protect against accidental deletion.

Question 21

Your organization wants to automatically respond to high-severity Microsoft Defender for Cloud alerts by creating a ticket in a third-party ITSM system. Which Defender for Cloud feature enables this automation?

Accepted Answer

Workflow automation in Microsoft Defender for Cloud allows you to trigger Azure Logic Apps in response to security alerts or recommendations. Logic Apps can then call the ITSM system's API to create a ticket, send notifications, or perform other automated actions. Continuous export to Event Hubs streams data but requires additional processing. While Sentinel playbooks (also Logic Apps) can respond to Sentinel incidents, the question asks about a Defender for Cloud native feature. Azure Policy manages compliance posture, not alert response.

Question 22

Your organization is deploying Microsoft Defender for Cloud across a multi-cloud environment that includes Azure, AWS, and GCP workloads. Which two actions are required to bring AWS workloads under Defender for Cloud management? Choose 2.

Accepted Answer

To manage AWS workloads in Microsoft Defender for Cloud, you connect the AWS account using the native cloud connector (which uses AWS IAM roles and CloudFormation for authentication) and then enable the desired Defender plans (such as Defender for Servers, Defender for Containers, etc.) for the connected AWS environment. Defender for Cloud can automatically provision the Azure Arc agent on EC2 instances as part of the Defender for Servers plan — you do not need to do this manually before connecting. AWS accounts are not Azure subscriptions, so Azure Policy cannot target them directly.

Question 23

Your organization uses Microsoft Sentinel and receives a large volume of alerts. The SOC team notices that many alerts from the same source IP address are generated within a 5-minute window and should be correlated into a single incident rather than creating separate alerts for each event. Which Microsoft Sentinel feature should you configure to achieve this?

Accepted Answer

Microsoft Sentinel analytics rules include an alert grouping configuration that allows you to group alerts triggered by the same rule into a single incident based on matching entity values (such as source IP address) within a configurable time window. This reduces alert fatigue and creates more actionable incidents. Fusion rules correlate alerts across different data sources for multi-stage attack detection — they do not provide per-rule entity grouping. Automation rules can merge incidents but this is a post-creation action, not a grouping mechanism. Anomaly detection rules detect unusual patterns, not group existing alerts.

Question 24

Your organization has an Azure Policy assigned at the management group level that requires all Azure resources to use a specific tag. Microsoft Defender for Cloud is showing this policy in the regulatory compliance dashboard as non-compliant for several resources. As a security engineer, you need to bring these resources into compliance without manually tagging each resource. Which approach should you use?

Accepted Answer

Azure Policy remediation tasks are the native mechanism for bringing existing non-compliant resources into compliance. A policy with the deployIfNotExists or modify effect can automatically apply the required tag, and a remediation task triggers that effect on currently non-compliant resources at scale. A Deny effect only prevents future non-compliant resources but does not fix existing ones. Workflow automation and Automation runbooks are valid but are workarounds rather than the intended Azure Policy mechanism for remediation.

Question 25

You are configuring Microsoft Sentinel data collection. Your organization has Windows servers both on-premises and in Azure that must forward Windows Security events to the Sentinel workspace. The solution must minimize the performance impact on the servers and use the latest recommended agent. Which connector and agent combination should you configure?

Accepted Answer

The Windows Security Events via AMA connector uses the Azure Monitor Agent (AMA), which is the current recommended agent replacing the legacy Log Analytics agent (MMA). AMA uses Data Collection Rules (DCRs) to precisely define which events to collect, reducing unnecessary data ingestion and minimizing performance impact. The legacy MMA agent is deprecated and should not be used for new deployments. Syslog is for Linux systems. The Azure Diagnostics connector is used for Azure platform logs, not Windows security events on server OS.

AZ-500 — Azure Security Engineer Associate