Microsoft Certification
60 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Microsoft Azure Security Engineer (AZ-500) certification validates professional expertise in Microsoft technologies. This study guide covers all 60 practice questions from our AZ-500 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to implement a solution that allows Azure resources to authenticate to each other without storing credentials in code. Which Azure service should you use?
Managed Identities provide automatic authentication between Azure resources without requiring credential management in code. This is the recommended approach for service-to-service authentication in Azure.
Your organization requires that all data at rest in Azure Storage be encrypted using customer-managed keys. Which encryption method should you implement?
Customer-managed keys stored in Azure Key Vault provide the highest level of control over encryption. Server-side encryption with CMK allows organizations to manage their own encryption keys while Azure handles the encryption/decryption process.
You are configuring Azure Policy to enforce that all virtual machines must have the endpoint protection extension installed. What type of policy effect should you use?
The DeployIfNotExists effect will automatically deploy the missing extension if it doesn't exist, ensuring compliance. Audit would only report non-compliance, Deny would prevent VM creation, and Append would add tags but not deploy extensions.
Your company needs to ensure that Azure SQL Database backups are retained for 35 days for compliance purposes. Where should you configure this retention policy?
Azure SQL Database has built-in backup retention policies that can be configured directly on the database to meet specific retention requirements. The default retention is 7 days, but can be extended up to 35 days for standard databases.
You need to implement network segmentation for a multi-tier application. Which Azure service should you use to control traffic between subnets?
Application Security Groups allow logical grouping of resources and simplify NSG rule management by allowing rules based on application tier rather than specific IP addresses. This combination provides better scalability and maintainability for network segmentation.
Your organization is implementing a zero-trust security model. Which Azure service would you use to verify device compliance before allowing access to resources?
Azure AD Conditional Access integrated with device compliance policies enforces zero-trust principles by evaluating device health status before granting access. This ensures only compliant devices can access resources regardless of location.
You are designing a DDoS protection strategy for a critical web application. What is the primary difference between Azure DDoS Protection Standard and Basic?
DDoS Protection Standard provides proactive attack mitigation, real-time attack analytics, and DDoS rapid response support. Basic only monitors and passively defends against obvious attacks.
You need to configure Azure AD B2B guest access for external partners. What security control should you implement to restrict guest access?
Azure AD entitlement management combined with conditional access policies provides granular control over guest access, including MFA requirements, device compliance, and access reviews. This ensures least-privilege access for external partners.
Your company stores sensitive data in Azure Storage and requires encryption in transit. Which protocol configuration is mandatory?
The 'Secure transfer required' setting on storage accounts enforces HTTPS-only access, ensuring data is encrypted in transit. This prevents downgrade attacks and eavesdropping of sensitive data.
You are implementing Azure Sentinel to monitor security events. Which data connector should you use to ingest Azure activity logs?
The Azure Activity connector is the native connector for ingesting Azure activity logs into Azure Sentinel, providing visibility into control plane operations and administrative changes across Azure resources.
Your organization requires that all Azure Key Vault access be logged and monitored. How should you configure this?
Diagnostic settings on Azure Key Vault provide detailed audit logs of all access attempts and operations, which should be sent to Log Analytics for centralized monitoring and analysis. Activity Logs alone don't capture all Key Vault operations.
You need to ensure that Azure resources can be accessed only from specific IP ranges. Which Azure service should you configure?
Network ACLs (also called firewall rules) on services like Azure Storage and SQL Database allow you to explicitly define allowed IP ranges. This is more granular than service endpoints which work at the service level.
Your company implements role-based access control (RBAC) in Azure. A user needs read access to virtual machines but not the ability to create new ones. Which built-in role would you assign?
The Virtual Machine User Login role allows users to login to virtual machines without having administrative or contributor permissions. This provides read and execution access without creation or modification capabilities.
You need to implement multi-factor authentication (MFA) for Azure AD users. What is the most secure MFA method for preventing phishing attacks?
The Microsoft Authenticator app with push notifications or passwordless sign-in is resistant to phishing as it requires user approval on a trusted device. SMS and email can be intercepted, and security questions are vulnerable to social engineering.
Your organization needs to detect and respond to security threats in real-time across Azure resources. Which Azure service provides playbook automation for incident response?
Azure Sentinel playbooks enable automated incident response workflows that can trigger actions like creating tickets, sending notifications, or blocking resources based on detected threats. This provides both detection and automated response capabilities.
You are configuring Azure AD Application Proxy to provide secure remote access to an on-premises web application. What is a key security benefit of this approach?
Azure AD Application Proxy publishes on-premises applications through Azure AD without exposing internal network ports or requiring VPN access. This reduces the attack surface and simplifies access management while maintaining security.
Your company requires that all Azure subscriptions undergo regular security assessments. Which Azure service provides automated security recommendations?
Microsoft Defender for Cloud continuously assesses Azure resources, provides security recommendations, and identifies vulnerabilities. It offers both compliance checks and actionable security guidance for improving your security posture.
You need to ensure that sensitive files in Azure Storage are not accidentally deleted. Which feature should you enable?
Soft delete allows recovery of deleted blobs within a specified retention period (up to 365 days). This protects against accidental or malicious deletion without requiring separate backup solutions.
Your organization uses Azure Arc to manage hybrid resources. How should you apply Azure policies to Arc-enabled servers?
Azure Arc extends Azure management capabilities to hybrid and multi-cloud environments, allowing you to apply Azure policies to Arc-enabled machines using the same policy framework as native Azure resources.
You need to implement network isolation for a containerized application in Azure Kubernetes Service (AKS). Which networking feature should you use?
Kubernetes network policies provide fine-grained control over pod-to-pod communication within an AKS cluster, enabling network segmentation at the application level. This is the Kubernetes-native approach to network isolation.
Your company implements Azure AD Privileged Identity Management (PIM). What is the primary security benefit of using just-in-time (JIT) access?
Just-in-time access in PIM grants temporary elevated privileges only when requested and approved, reducing the risk of compromised standing privileges. This follows the principle of least privilege and limits exposure windows.
You need to secure communication between your application and Azure Cosmos DB. Which connection method provides the highest security?
Managed Identity eliminates the need to store and rotate credentials, as Azure handles authentication automatically. This is more secure than storing connection strings or SAS tokens in configuration.
Your organization requires audit logging for changes to Azure resources. Which service should you use to capture and analyze these logs?
The Azure Activity Log captures all control plane operations, and Log Analytics provides query capabilities for analysis, alerting, and long-term retention of these audit logs for compliance purposes.
You need to implement data residency compliance where data must remain in a specific geographic region. How should you configure this in Azure?
Azure Policy can enforce resource creation only in approved regions, and service-specific settings (like storage account replication type) ensure data residency compliance. This provides automated governance for data location requirements.
Your company needs to protect against threats like ransomware in Azure VMs. Which combination of services provides comprehensive protection?
Microsoft Defender for Servers provides endpoint detection and response (EDR) capabilities, behavioral threat detection, and advanced threat analysis to protect against ransomware and other sophisticated attacks on VMs.
You need to implement Azure AD Multi-Factor Authentication (MFA) for all users accessing sensitive resources. Which Azure service provides the primary MFA capabilities?
Azure Multi-Factor Authentication Server is the dedicated service for implementing MFA, though modern deployments often use Azure AD with MFA capabilities. Both A and B are valid, but B is the primary dedicated MFA service.
Which encryption method does Azure Storage Service Encryption (SSE) use by default for data at rest?
Azure Storage Service Encryption uses AES-256 encryption by default for all data stored in Azure Storage accounts, providing strong protection for data at rest.
You are implementing a zero-trust security model in your Azure environment. Which Azure service should you primarily use to enforce identity and device compliance before granting access?
Azure AD Conditional Access is the core service for implementing zero-trust principles by evaluating identity, device state, location, and risk before granting access to resources.
Your organization requires encryption of database passwords and connection strings used by applications. Which Azure service is best suited for this purpose?
Azure Key Vault is designed specifically for managing secrets, keys, and certificates, and when integrated with managed identities, provides secure retrieval of credentials without hardcoding them in applications.
When implementing Azure Disk Encryption on a virtual machine, which prerequisite must be met?
The Key Vault must be located in the same region as the VM and specifically configured with the enabledForDiskEncryption property set to enable Azure Disk Encryption.
You need to audit all changes to Azure resources across your subscription. Which Azure service provides this capability?
Azure Monitor Activity Log tracks all control plane operations and changes to Azure resources, providing a complete audit trail of who did what and when.
Your organization uses Azure Virtual Networks with multiple subnets. You need to restrict traffic between subnets based on specific ports and protocols. What is the most appropriate solution?
Network Security Groups provide subnet-level filtering capabilities that allow you to define inbound and outbound rules based on ports, protocols, and IP addresses, which is the standard approach for east-west traffic control.
When configuring Azure Key Vault access policies, which identity should you use for applications running on Azure VMs to retrieve secrets without storing credentials?
Managed Identity is the recommended approach as it eliminates the need to manage credentials; Azure automatically handles the authentication and credentials for the application.
You need to implement Just-In-Time (JIT) access to virtual machine ports. Which Azure Security Center feature should you use?
Azure Security Center's Just-In-Time VM Access feature allows you to reduce exposure to brute-force attacks by opening RDP/SSH ports only when needed, with automatic closure after approval.
Your organization needs to implement role-based access control (RBAC) for Azure resources. A user should be able to read all resources but only modify resources in specific resource groups. How should you configure this?
To achieve least privilege, assign the Reader role at the subscription level for read access across all resources, then assign Contributor role only at the specific resource groups where modification is needed.
You are implementing Azure AD B2B collaboration for external partners. Which identity provider can external users NOT directly use for authentication in Azure AD B2B?
Azure AD B2B supports Microsoft accounts, social identities, and federated Azure AD tenants, but does not directly support on-premises LDAP directories unless they are synchronized to Azure AD.
Which Azure service should you use to detect and respond to security threats and suspicious activities on your Azure resources?
Azure Security Center (now called Microsoft Defender for Cloud) provides continuous monitoring, threat detection, and security recommendations to identify and respond to security threats.
You need to ensure that all data transmitted between your application and Azure SQL Database is encrypted. What should you configure?
Enforcing encrypted connections using the Encrypt=true parameter in the connection string ensures that data in transit between the application and database is encrypted using TLS/SSL.
You are configuring Azure AD conditional access policies to block sign-in attempts from high-risk locations. Which signal does Conditional Access use to determine risk?
Azure AD Conditional Access integrates with Azure AD Identity Protection to evaluate multiple risk signals including user risk, sign-in risk, and device risk to make access decisions.
What is the primary purpose of Azure Policy in a security context?
Azure Policy enables you to create and assign policies that enforce rules for resource creation and configuration, ensuring compliance with organizational and regulatory standards.
You need to implement network segmentation for a multi-tier application in Azure. You want to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate communication with the web tier. Which solution best achieves this?
Network Security Groups with stateful rules allow you to permit unidirectional communication by allowing inbound rules on the application tier from the web tier only, blocking reverse traffic without explicit outbound rules.
When implementing Azure AD Password Protection, which scenario would trigger blocking of a password change?
Azure AD Password Protection checks passwords against a global banned password list and optionally against a custom banned password list, blocking passwords that match entries in either list.
You are implementing Azure SQL Database security. A user needs to perform only SELECT operations on specific tables. What is the best approach?
Creating a custom database role with SELECT permission on specific tables provides the least privilege access model, limiting the user's capabilities to exactly what is needed.
Your organization requires that all VMs in Azure must be encrypted with customer-managed keys. Which service enables this requirement?
Azure Disk Encryption with customer-managed keys allows you to bring your own encryption keys stored in Azure Key Vault, providing full control over the encryption keys used for VM disks.
When configuring Azure Firewall, you need to allow traffic from a specific on-premises network to Azure resources while blocking all other traffic. Which firewall rule type should you use?
Network rules in Azure Firewall operate at layer 4 (transport layer) and allow you to specify source IP ranges, ports, and protocols, making them ideal for permitting traffic from specific on-premises networks.
You need to ensure that sensitive data in Azure SQL Database is masked from non-authorized users. Which feature should you implement?
Dynamic Data Masking masks sensitive data values in query results for non-privileged users while keeping the data unmasked for authorized users with ALTER permissions, without changing actual data.
When implementing Azure AD sign-in logs analysis, which Azure service should you use to query and analyze the logs at scale?
Azure Log Analytics combined with KQL (Kusto Query Language) allows you to query and analyze Azure AD sign-in logs at scale, enabling complex investigations and pattern detection.
You are configuring Azure Key Vault for high availability. What is a critical consideration for key vault redundancy?
Azure Key Vault provides local redundancy within a region but does not automatically replicate across regions; for multi-region high availability, you should implement your own replication strategy or use Key Vault's backup and restore capabilities.
Which Azure service provides real-time monitoring and alerting for potential security vulnerabilities in your container images?
Azure Defender for Container Registries (now part of Microsoft Defender for Cloud) provides vulnerability scanning and security assessment for container images stored in Azure Container Registry.
You need to implement a security control that prevents users from accessing resources outside of business hours. Which Azure service provides this capability?
Azure AD Conditional Access can be combined with Azure AD Identity Protection or custom controls to implement time-based access restrictions, though native time-based conditions are limited and typically require custom implementation.
Your organization needs to implement Just-in-Time (JIT) VM access for Windows virtual machines in Azure. Which Azure service provides this capability?
Microsoft Defender for Cloud provides Just-in-Time VM access functionality that restricts inbound traffic to Azure VMs and reduces exposure to attacks while providing easy access when needed.
You are configuring Azure Key Vault to store encryption keys for your organization's data. You need to ensure that keys cannot be exported and operations are logged. Which two settings must you enable?
To prevent key export and ensure operations are logged, you should enable purge protection (prevents accidental deletion) and configure diagnostic logging to audit all Key Vault operations.
Your company uses Azure AD Connect to synchronize on-premises Active Directory with Azure AD. You want to prevent password synchronization while maintaining directory sync. What should you configure?
To synchronize directories without synchronizing password hashes, you can implement pass-through authentication (validates passwords against on-premises AD) or federation with AD FS rather than password hash sync.
You need to ensure that all storage account access is logged and monitored. An auditor requires visibility into who accessed what data and when. Which Azure service should you configure?
Storage Account diagnostic settings enable logging of all read, write, and delete operations to Azure Monitor, Log Analytics, or Event Hubs, providing comprehensive audit trails for compliance requirements.
You are implementing Azure DDoS Protection for a web application. After enabling Standard tier protection, you notice legitimate traffic from a known partner IP range is being rate-limited. How should you resolve this while maintaining DDoS protection?
DDoS Protection Standard allows you to configure policies and whitelist rules for known good traffic sources, and you can adjust rate-limiting thresholds to accommodate legitimate traffic while maintaining protection against attacks.
Your organization requires that Azure resources be encrypted with customer-managed keys stored in Azure Key Vault. For Azure SQL Database, which feature enables this requirement?
Azure SQL Database supports Transparent Data Encryption (TDE) with customer-managed keys (BYOK) stored in Azure Key Vault, enabling organizations to control encryption key management.
You are configuring Azure Sentinel to detect suspicious sign-in activities. You create a custom analytics rule that triggers when a user signs in from multiple geographic locations within an impossible travel timeframe. What is this type of detection called?
Impossible travel detection identifies when a user logs in from two different geographic locations within a timeframe that makes physical travel impossible, indicating potential account compromise.
Your organization needs to audit and control who can create Azure resources in specific subscriptions. You want to use a service principal with limited permissions and track all changes made. Which combination of Azure services should you implement?
Azure RBAC controls service principal permissions at a granular level, while Azure Activity Log (integrated with Azure Monitor) tracks all resource creation and modifications for audit compliance.
You are implementing a security baseline for Azure virtual machines. You need to ensure that unencrypted disks are identified and remediated automatically. Which Azure service should you use?
Microsoft Defender for Cloud provides security recommendations for unencrypted disks and can be configured with auto-remediation (where available) or used with Azure Policy for automated enforcement.
You configure Azure AD Conditional Access to require multi-factor authentication for all users accessing cloud applications. However, a legacy application cannot support MFA. How should you handle this exception securely?
You should either use Azure Application Proxy to add MFA enforcement at the proxy layer (best practice) or create an exclusion with documented approval and compensating controls like IP restriction or network segmentation.
You've reviewed all 60 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free