AZ-500 practice questions
Microsoft · AZ-500 · 300 questions
Original practice questions for Exam AZ-500: Microsoft Azure Security Technologies, covering identity and access security with Microsoft Entra ID, PIM, MFA, and Conditional Access; network security with NSGs, firewalls, and private endpoints; compute, storage, and database security; and security operations with Microsoft Defender for Cloud and Microsoft Sentinel.
This course contains the use of artificial intelligence.
About the AZ-500 exam
- Time allowed
- 1 hour 40 minutes
- Questions
- 40-60 (typical for Microsoft exams)
- Passing score
- 700 (scale 1-1000)
- Format
- Proctored, may include interactive components; 10 languages
Schedule this exam The certification this earns
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Secure identity and access · 55 questions
- A canal-authority night shift must restart only the virtual machine that opens Lock 7, but last week an operator received rights on the entire subscription. Which Azure RBAC assignment scope still lets that operator restart the VM while following least privilege?
- A harbor-pilot desk must view every tugboat resource in one resource group but must not resize VMs or create role assignments for contractors. Which built-in Azure role matches that view-only job?
- A grain-elevator cooperative wants a security engineer to assign Virtual Machine Contributor at a resource group without making that person a subscription Owner. Which built-in Azure role can create that role assignment?
- A municipal-water lab assigns Backup Contributor at the subscription and then finds the same principal can start backup jobs in every child resource group. How should the team shrink that blast radius while keeping Azure RBAC inheritance behavior accurate?
- A botanical-garden ticketing crew only needs to start and restart VMs in one resource group after an intern with Contributor deleted a public IP. Which assignment best restores least privilege for that crew?
- A ferry-terminal security desk re-creates the same Reader assignment for twelve individual users whenever a seasonal worker starts. What should the desk do instead so membership changes do not require new role assignments?
- A canal-survey team may restart VMs and read metrics but must not create disks or change NICs, and every nearby built-in compute role still includes extra write actions. What should the security engineer do?
- A credit-union vault team needs a custom role that can read blob data inside a storage account but must not change the storage account resource itself. Where should those permission strings be placed in the custom role definition?
- A harbor-radar shop adds Microsoft.Compute/ to Actions and lists several delete operations under NotActions. A reviewer claims that creates a subscription-wide deny. What is the accurate statement about NotActions?
- A regional compost authority created a custom role with AssignableScopes listing only subscription A, then could not assign it in subscription B in the same tenant. Which statement correctly describes AssignableScopes?
- A municipal-records clerk needs to reset passwords and restart a single VM. A teammate tries to add microsoft.directory password actions to an Azure custom role JSON. What should the security engineer do instead?
- A seed-catalog lab tries to delete a custom Azure role definition, but the portal refuses because three resource groups still list it. What must happen before the definition can be removed?
- A night-harbor superintendent should become subscription Owner only while a lock is jammed, not for the entire month. Which PIM assignment type for that Azure resource role fits?
- An automation account’s managed identity needs Contributor on a resource group so a nightly job can resize a scale set. Why should the security engineer avoid an eligible PIM assignment for that identity?
- A canal-lock Owner role is eligible in PIM, and the security engineer wants a second factor plus a typed business reason before activation. Where should those requirements be configured?
- A grain-elevator Owner activation last quarter remained valid until the next calendar day, and a contractor kept rights overnight. Which PIM control limits how long an activated Azure resource role stays effective?
- Three platform engineers still have permanent active Owner on production. Which PIM assignment setting should the security engineer change for that Azure resource role?
- A water-lab admin required approval to activate Contributor at the subscription, then assigned Contributor at a child resource group where activation needed no approver. What explains that behavior?
- Lock operators already signed in with Windows Hello, so requiring MFA on PIM activation never prompts them. How can the engineer enforce a stronger check during Azure resource role activation?
- A small ferry cooperative still on Microsoft Entra security defaults wants per-group MFA exceptions for a vendor. What must the security engineer understand before creating Conditional Access policies?
- Operators reach production through the Azure portal, Azure CLI, and PowerShell, and MFA must cover that management plane. Which Conditional Access cloud app target is appropriate?
- A compost-authority tabletop showed both Global Administrators would be locked out if the sole MFA method vendor failed. What should the security engineer configure for Azure-management MFA enforcement?
- A legacy runbook still enables per-user MFA for fifteen engineers who open the Azure portal. What is the preferred modern enforcement path for MFA to Azure resources?
- Subscription Owners still satisfy MFA with SMS, and a contractor replayed a text. How should the security engineer raise MFA quality for users who manage Azure without turning the item into an authenticator how-to?
- A botanical-garden platform team can still open the Azure portal from a coffee shop with only a password. Which Conditional Access policy shape enforces MFA for Azure management while sparing break-glass accounts?
- Harbor contractors may open a nonproduction Azure subscription only from Intune-compliant laptops, and everyone else must be denied. Which Conditional Access design meets that requirement for Azure cloud resources?
- A credit-union security lead wants Azure portal users to authenticate again every few hours even after MFA already succeeded at sign-in. Which Conditional Access control re-challenges the session on that schedule?
- A water-lab nearly locked operators out of the Azure portal the last time a Conditional Access policy for Azure management went straight to On. What should the security engineer do before enforcing the new policy?
- Grain-elevator engineers may manage Azure only from the plant’s egress IP ranges; traffic from any other network must require MFA and a compliant device or be blocked. Which Conditional Access element expresses that network boundary for Azure portal work?
- A new hire scoped a Conditional Access block for legacy authentication to All cloud apps and accidentally disrupted directory token flows the team still needed. How should Azure management access be targeted instead while keeping emergency accounts usable?
- A ferry-booking SaaS appeared in the tenant and every employee can launch it from My Apps. What should the security engineer configure on that enterprise application so only the booking group can use it?
- A weekend review shows a gallery CRM still holds a tenant-wide Mail.ReadWrite OAuth grant from a pilot last year. What should the security engineer do in this tenant?
- A botanical-garden SaaS has no enterprise-application owners, so every SSO certificate renewal waits on a Global Administrator. What assignment fixes day-to-day ownership of that app’s tenant settings?
- A compost-vendor app must create user accounts in its own directory when staff are assigned in Microsoft Entra ID. Which enterprise-application capability addresses that requirement, as distinct from OAuth permission grants?
- A seasonal ticket-kiosk enterprise application must stop accepting sign-ins this week, but the security engineer must keep the service principal and its grants for a later audit. What action meets both needs?
- A municipal-records team registered an API under App registrations, but a contractor searched only Enterprise applications and reported that the app does not exist. How should the security engineer explain the relationship in this tenant?
- A harbor-radio companion app is a public mobile client, yet its app registration lists only a web redirect URI and treats the app as a confidential client with a client secret. What should the security engineer correct on the registration?
- A grain-elevator API registration still uses a two-year client secret pasted into a Function app setting. What credential approach should the security engineer prefer on the app registration?
- Developers in a water-lab tenant can register new apps and immediately request Microsoft Graph permissions. Which tenant setting should the security engineer tighten so only authorized administrators can create app registrations?
- A ferry kiosk must read only the signed-in clerk’s profile, not every user in the tenant. Which permission type should be added on the app registration?
- A botanical-garden inventory API is called by an internal SPA, and the team plans to reuse User.Read as the only scope. What should the security engineer configure on the inventory app registration instead?
- A compost-tracking app registration lists Directory.ReadWrite.All delegated and Sites.ReadWrite.All application permissions “just in case.” What should the security engineer do?
- A daemon that syncs lock schedules needs application Mail.Send with no signed-in user. What must the security engineer understand when adding that permission on the app registration?
- A clerk tries to sign into a new inventory app that requests Directory.ReadWrite.All, but no usable consent prompt appears for that clerk. What is the most likely consent requirement?
- A harbor-operations API needs every employee to use reviewed scopes without a per-user consent prompt. Which consent action should the security engineer take?
- A water-lab user consented to a random multi-tenant app that then read mail. Which tenant control should the security engineer tighten?
- Developers still need a path to request Graph scopes after user consent is disabled. Which Entra feature should the security engineer enable?
- A multi-tenant ticketing vendor’s app registration lives in the vendor tenant, but the grain elevator must assign Azure RBAC and review grants locally. Where should the security engineer work?
- A lock-scheduling daemon authenticates as a service principal yet still stores a storage account key on disk. What should the security engineer do?
- A compost-lab service principal still has a password credential created three years ago, and nobody can determine who generated it. What should the security engineer do?
- A retired radar integration’s service principal still has Contributor on a production resource group, even though the team says the app registration lives in another tenant. What should the security engineer do first?
- A single water-quality VM must read one storage account, and the team does not want a leftover identity after the VM is decommissioned. Which identity approach should the security engineer enable?
- A canal authority recycles VM scale-set instances weekly but needs the same identity and the same Azure role assignments to survive instance replacement. What should the security engineer create?
- A municipal Function app has a system-assigned managed identity enabled, but blob reads still return 403. What should the security engineer do?
- A harbor-pilot runbook asks for “the password of the VM’s managed identity” so it can be stored next to other secrets. How should the security engineer respond?
Secure networking · 71 questions
- A lock-chamber VM sits on a subnet that already has an NSG, and operators also pinned a second NSG to the NIC. Inbound SSH from the harbor-pilot jump host still fails. What should the security engineer understand about effective rules?
- A grain-elevator NSG has an Allow on TCP 443 at priority 400 and a Deny on TCP 443 at priority 200. Operators argue the Allow should win because it was added last. Which rule takes effect?
- A water-lab subnet must reach Azure Storage on the Microsoft backbone and must not be opened to the whole Internet. How should the NSG destination be expressed?
- Tugboat-app VMs are added and removed weekly, and the NSG that lets the web tier talk to the API tier keeps breaking because someone edits IP prefixes. What should the security engineer use instead?
- Compost-lab front-end VMs must reach only the mid-tier VMs on TCP 8443, not every NIC covered by the VirtualNetwork service tag. What NSG design should the security engineer apply?
- A canal authority wants FQDN filtering, threat-intelligence-based deny, and SNAT for many spokes. A contractor proposes adding more NSG rules. What should the security engineer choose?
- A spoke team allowed RDP from the Internet on their subnet NSG. The central security engineer must close that path on every spoke without chasing each NSG. What should they deploy?
- Night-shift monitoring must reach every lock VM on TCP 443 from a jump subnet, but app teams keep adding Deny rules that break the probes. Which Azure Virtual Network Manager action should the security engineer use?
- Production lock VNets across three subscriptions must share one network security baseline, while a sandbox VNet must stay out. Where should the security engineer apply the Azure Virtual Network Manager security admin configuration?
- A water-lab engineer saved a security admin configuration that denies inbound Internet to a network group, then opened a test VM and found the port still reachable. What step is missing?
- Spoke subnets still go straight to the Internet and bypass the hub Azure Firewall. What user-defined route should the security engineer attach?
- A retired partner prefix must not leave the compost-lab subnet at all, even toward the hub firewall. Which user-defined route next hop should the security engineer configure for that prefix?
- A lock-app subnet has a default system route to Internet, but the security engineer needs PaaS-bound traffic to take the firewall path instead. What routing behavior should they rely on?
- Spoke A and spoke B each peer to the hub. A harbor-pilot VM in A cannot reach a water-lab VM in B. What should the security engineer conclude?
- Only the hub has a VPN gateway to the grain elevator. Spokes must use that hybrid path without each deploying a gateway. Which peering settings should the security engineer enable?
- A credit-union reviewer asks for “encryption on the peering” between two Azure regions. How should the security engineer respond?
- A municipal yard has no ExpressRoute and must send lock telemetry into a hub VNet over the Internet. Which connectivity path should the security engineer plan?
- The canal authority is moving from a DIY hub-spoke to Virtual WAN and still needs a central inspect-and-deny point. What should the security engineer implement?
- Branch and spoke traffic in Virtual WAN can skip the hub firewall if routing is left at defaults. What control should the security engineer set so inspection is mandatory?
- A municipality has many branches, many regions, and a requirement for a managed any-to-any hub with integrated firewall. What architecture should the security engineer recommend?
- A grain-elevator auditor rejects the VPN gateway’s default IPsec/IKE proposal as a legacy cipher set. What should the security engineer apply on the site-to-site connection?
- Harbor contractors on laptops must reach a VNet without a site-to-site appliance at their desks. How should the security engineer configure point-to-site authentication?
- A lock-operator shop has no Entra-joined laptops but can issue device certificates from its CA for VPN clients. Which point-to-site authentication method fits that shop?
- A botanical garden needs the whole on-premises yard always connected to Azure, and a few traveling inspectors also need laptop tunnels. How should the security engineer split the VPN patterns?
- A canal reviewer treats ExpressRoute private peering as encrypted because the path is private. What should the security engineer state first?
- The canal authority has ExpressRoute Direct and a regulator who wants Layer-2 encryption on the physical ports toward Microsoft. What should the security engineer enable?
- They have a standard ExpressRoute circuit (not Direct) and still need network-layer encryption from the yard to the VNet. Which approach meets that need?
- A water-quality archive storage account is reachable from any Internet IP. Which resource firewall change should the security engineer make first?
- An Azure SQL Database accepts clients from the whole office because Allow Azure services is checked and a 0.0.0.0–255.255.255.255 firewall rule exists. What network control should the security engineer tighten?
- A storage account must accept writes from an Azure Backup vault without opening the Internet to all networks. What should the security engineer use on the storage firewall?
- A tugboat VM cannot reach an API VM on TCP 8443, and the night shift needs to know which NSG rule is to blame. Which Network Watcher check should they run first?
- The security lead needs multi-day visibility into which spokes still talk to the Internet and which NSG rules are hit. What should the engineer enable?
- A lock subnet was supposed to send 0.0.0.0/0 to Azure Firewall, but a VM still egresses directly to the Internet. How should the security engineer prove the routing miss?
- A water-lab subnet must reach Storage on the Azure backbone, and a reviewer asks whether a Service Endpoint makes the account private. What should the security engineer explain?
- After Microsoft.Storage is enabled on a grain-elevator subnet, every regional storage account becomes reachable from that subnet. How should the engineer allow only the elevator’s account?
- A lock-app subnet in East US still cannot use the Service Endpoint path to Storage until the service is opted in. What must the security engineer configure?
- The compost-lab storage account must be reachable only at an IP inside the VNet. Which control should the security engineer implement?
- A Private Endpoint for Blob is up, but lock-app VMs still resolve .blob.core.windows.net to a public IP and fail after public access is disabled. What DNS fix is required?
- A partner subscription created a Private Endpoint toward the canal authority’s SQL logical server, and the connection sits at Pending. What should the data-plane owner do?
- A water-quality storage account has a working Private Endpoint, but public network access is still Enabled from all networks. What judgment should the security engineer apply?
- The canal authority wants to publish an internal lock-scheduling API behind a Standard load balancer so another tenant can reach it without VNet peering, a public IP, or site-to-site VPN. What should they create?
- Sister subscriptions in the same tenant should connect to a Private Link service without a ticket, while everyone else must wait for approval. What should the engineer configure?
- A botanical-garden subscription in another Microsoft Entra tenant needs the lock-scheduling API exposed by a Private Link service. What consumer path should the security engineer describe?
- A lock-status App Service must call a VM and a Private Endpoint SQL NIC inside the VNet, while inbound Internet to the app must stay closed. How should networking be split?
- An App Service still egresses to public Storage even though VNet integration is on, so traffic misses the hub Azure Firewall. What should the security engineer enable?
- A consumption-plan Azure Function that posts canal lock telemetry still cannot reach a VNet-injected internal API. The Function already has the same outbound-versus-inbound split pattern as App Service documented for private access. What should the security engineer change first?
- Canal-operations web apps must not receive a public inbound VIP. Which App Service Environment design meets that inbound-isolation requirement?
- An ASE v3 deployment fails management connectivity after an engineer strips the ASE subnet NSG and points 0.0.0.0/0 at an NVA without the documented ASE exceptions. What should the security engineer restore?
- A public botanical-garden site runs on an External App Service Environment. What inbound-security conclusion should the security engineer draw?
- A new Azure SQL Managed Instance will store lock telemetry and must stay off the public Internet. Which network placement and endpoint setting should the security engineer use?
- After someone deleted platform NSG rules and forced all MI subnet traffic through a firewall without documented exceptions, the Managed Instance lost management connectivity. What should the security engineer restore, and which port applies if a public endpoint is truly required?
- A reviewer checklist treats “disable MI public endpoint,” “enable TDE,” and “set a Microsoft Entra admin” as one networking task. Which items belong in the Domain 2 network-security configuration for Azure SQL Managed Instance?
- The public lock-status App Service still answers HTTP and accepts TLS 1.0. What should the security engineer configure on App Service?
- locks.canal.example must present a trusted certificate to browsers on App Service. What should the security engineer implement for TLS on the app?
- The public API Management gateway still serves only the default .azure-api.net host and allows a weak TLS version. What should the security engineer configure?
- The hub Azure Firewall must allow a spoke VM to login.microsoftonline.com over HTTPS, allow TCP 1433 to a known SQL IP, and publish an internal RDP host to one operator IP. How should those be mapped to firewall rule kinds?
- The canal authority wants Azure Firewall to drop traffic to or from known malicious IPs and domains, not only log them. Which threat-intelligence mode should the security engineer set?
- Every hub firewall must share a baseline (deny Internet RDP, threat intel on) while each region adds its own FQDNs. What should the security engineer use?
- Outbound HTTPS from spokes must be opened, inspected for malware, and evaluated with an intrusion-detection signature set. Which Azure Firewall choice meets that requirement?
- A night-shift design review stacks NSG, Azure Firewall, and Application Gateway on the same flow without clear roles. How should the security engineer assign jobs?
- A lock-booking web app in one region needs path-based routing, a private backend pool of VMs, and a single public HTTPS listener. Which service should the security engineer choose?
- Browsers reach Application Gateway over HTTPS, but the gateway opens HTTP to backend VMs on the VNet. Auditors require encryption all the way to the backends. What should the security engineer configure?
- The water-lab portal must use Layer-7 routing but must not have a public IP. What Application Gateway frontend design should the security engineer deploy?
- The lock-booking site now has users on two continents and needs anycast HTTPS at the edge with a single global hostname. Which entry-point choice should the security engineer make?
- Clients must enter at Azure Front Door while the origin (internal App Service, Storage static website, or ILB) must not be on the public Internet. What should the security engineer implement?
- A Front Door/CDN rule caches /api/lock-status and a harbor contractor sees another operator’s payload. What cache behavior should the security engineer set?
- A new OWASP managed-rule pack is about to go live on the lock-booking site’s WAF. How should the security engineer introduce the policy mode?
- One site is regional-only behind Application Gateway; another is global behind Front Door. Where should the security engineer attach WAF policies?
- A legitimate lock-form POST trips a managed SQL-injection rule, and a contractor wants the entire WAF policy disabled. What should the security engineer do?
- A reviewer says Azure already includes DDoS protection so nothing more is needed for a public Application Gateway and a public Azure Firewall. What distinction should the security engineer make?
- A canal authority’s production public IPs sit in front of Application Gateway and Azure Firewall, and a past flood exhausted scale-out without anyone being paged. When should the security engineer recommend Azure DDoS Protection Standard?
Secure compute, storage, and databases · 71 questions
- Harbor pilots still RDP to lock-chamber virtual machines over the Internet because each VM has a public IP. How should the security engineer provide remote access while removing those public IPs?
- A contractor tries to deploy Azure Bastion into the same subnet as the lock-chamber virtual machines and the deployment fails. What must the security engineer create for Bastion?
- Some lock operators must use a local SSH or RDP client instead of only the Azure portal browser. Which Bastion capability should the security engineer select?
- Lock-chamber NSGs currently allow TCP 3389 from Any so night shift can always reach the VMs. How should just-in-time (JIT) VM access change that posture?
- Just-in-time VM access will not enable on a grain-elevator virtual machine because the subscription lacks a workload protection plan. What should the security engineer identify as the prerequisite?
- A reviewer treats Azure Bastion and just-in-time VM access as the same control for lock-chamber servers. How should the security engineer describe their relationship?
- A contractor requests just-in-time access to a lock-chamber VM from a coffee-shop IP that is not on the allowed prefix and leaves the window open for days. Which JIT configuration should the security engineer enforce?
- The tugboat-scheduler AKS API server is on a public IP and appears on Internet scanners. How should the security engineer isolate the control plane?
- Harbor laptops must keep using kubectl against a public AKS API FQDN, but only from known office prefixes. What should the security engineer configure?
- A contractor tries to add API server authorized IP ranges to an AKS cluster that is already private. What should the security engineer explain?
- The canal authority wants the AKS API server projected into the cluster virtual network so hub firewall and custom DNS see that traffic, not only a private-link endpoint in a managed network. Which isolation pattern should the security engineer choose?
- Nobody is alerted when a privileged tugboat pod or a suspicious kube-api call appears on AKS. Which product should the security engineer enable for cluster security monitoring?
- Night-shift charts keep deploying privileged pods and hostPath volumes on AKS. How should the security engineer enforce Kubernetes guardrails without writing a custom admission-controller manifest?
- After a kubeconfig leak, nobody can determine who deleted the lock-gate deployment on AKS. What should the security engineer configure for API-server accountability?
- A reviewer answers “secure AKS” with a twelve-chart service mesh for the canal scheduler. Which host and cluster security controls should the security engineer prioritize instead?
- The tugboat AKS cluster still hands every contractor the same cluster-admin kubeconfig certificate. How should the security engineer change authentication?
- Entra sign-in works on the harbor AKS cluster, but every authenticated user is still effectively cluster-admin. What should the security engineer enable for authorization?
- After Entra ID integration and Azure RBAC for Kubernetes are live, the old admin kubeconfig certificate still works on the canal AKS cluster. What follow-through should the security engineer perform?
- A burst lock-sensor container in Azure Container Instances crashed and nobody has stdout or security-relevant events. What should the security engineer configure?
- Security wants runtime security signals on Azure Container Instances groups that pull images from the harbor registry. Which monitoring product should the security engineer enable?
- The canal public API runs on Azure Container Apps and security cannot see ingress or console logs. What should the security engineer configure?
- A reviewer answers “secure Azure Container Apps” with a Dapr secret-store tutorial for the canal API. Which security-engineer controls should be emphasized instead?
- AKS cannot pull tugboat images because someone pasted the Azure Container Registry admin password into a Kubernetes secret. How should the security engineer fix registry access?
- The harbor Azure Container Registry still has the admin user enabled and two long-lived passwords shared in chat. What should the security engineer do first for registry identity hygiene?
- A partner CI pipeline for the harbor lock-gate images must push only to repositories under lockgate/ and must not list every registry repository. Which access approach meets least privilege for Azure Container Registry?
- A reviewer closes a lock-chamber VM encryption finding because Azure Disk Storage server-side encryption with platform-managed keys is already on. What should the security engineer explain about that baseline versus Domain 3 disk encryption options?
- An older lock-chamber virtual machine must encrypt OS and data volumes inside the guest with BitLocker or dm-crypt and store encryption secrets in Key Vault. Which control should the security engineer select?
- Compliance requires end-to-end encryption of temporary disks, caches, and the compute-to-storage path for lock VMs without burning guest CPU on BitLocker. Which control should the security engineer enable?
- A lock-controller VM must keep its OS disk sealed so the host and hypervisor cannot read it. Which approach meets that requirement?
- A contractor tries to enable encryption at host on a lock-chamber VM that already uses Azure Disk Encryption. What should the security engineer tell them?
- The lock-status API in Azure API Management is protected only by a subscription key passed in the query string. What should the security engineer recommend for stronger inbound authentication?
- Azure API Management still presents a username and password from a named value when calling the canal backend. What should the security engineer recommend?
- A harbor analyst has Contributor on the lock-photo storage account but still cannot list blobs in the portal or tools. What should the security engineer assign?
- Night-shift staff only need to read blobs in one lock-photo container. Which access design follows least privilege?
- A lock-photo container was set to Blob anonymous read so a website could load images, and the storage account still allows public access. What should the security engineer do first for access control?
- Scripts still call the lock-photo account with the account key even though identities already have Storage Blob Data roles. Which end-state access-control change should the security engineer make?
- The grain-silo storage account key appeared in a support ticket. How should the security engineer rotate keys with minimal downtime?
- A contractor treats a storage account access key as a read-only password for lock photos. What should the security engineer emphasize?
- Help-desk staff with Reader can open the storage account blade but cannot reveal access keys, while a custom role that includes Microsoft.Storage/storageAccounts/listKeys/action can. What should the security engineer do?
- Lock operators map \\account.file.core.windows.net\share by pasting the storage account key into Windows. Which access method should the security engineer select instead?
- Microsoft Entra Kerberos is enabled for an Azure Files share, yet everyone who can mount it still sees every lock plan. What authorization layers should the security engineer configure?
- A Linux job must read one Azure Files file over HTTPS and must not mount SMB or join AD DS. Which access approach fits?
- A partner needs time-boxed read access to one lock-photo container, and the team was about to sign an account SAS with the storage account key. What should the security engineer mint instead?
- A service SAS for lock photos was emailed with expiry baked into the URI; the contractor left and the URI still works. How should the security engineer make future service SAS revocable?
- Someone minted an account SAS with read, write, delete, and list on blob, file, and queue for one year and allowed HTTP. What should the security engineer issue instead?
- The lock-photo API on App Service still stores a SAS in application settings. What should the security engineer do instead?
- An operator deleted the wrong lock-photo blob and needs a retention window to undelete it. Which protection should the security engineer enable?
- A lock-photo blob was overwritten with an empty file; soft delete did not help because the blob still exists. Which feature restores the previous content?
- Canal bylaws require lock-camera footage to remain unaltered and undeleted for seven years. Which storage protection should the security engineer configure?
- A canal-authority lawsuit needs lock-camera blobs frozen with no planned end date. Which immutable-storage control keeps those objects write-once until counsel explicitly clears the hold?
- Compliance wants an off-account recoverable copy of the lock-photo storage account, not only a same-account recycle bin. Soft delete and versioning are already on. What should you configure next?
- The grain-silo storage account still uses Microsoft-managed keys, and auditors want the canal authority to hold the encryption key. How do you configure Bring Your Own Key for Storage encryption?
- A reviewer starts answering the grain-silo BYOK task by drafting Key Vault access-policy JSON, private-endpoint rules, and a rotation schedule. For Domain 3 storage encryption, what is the correct focus?
- A regulator wants two independent encryption layers under Microsoft’s storage infrastructure for the lock-photo account, not only the default SSE with a platform-managed or customer-managed key. Which control meets that requirement?
- A contractor tries to turn on infrastructure encryption for an existing grain-silo storage account that was created without it. What should you tell them?
- Lock-lab Azure SQL still has only the SQL server admin password. What must you configure so Microsoft Entra identities can become database principals?
- Auditors want no SQL passwords on the water-quality database. Which server authentication setting enforces that goal?
- The Entra admin can connect to lock-lab Azure SQL, but the lock-lab analysts cannot. What should you create so the analysts’ Entra security group can sign in with least privilege?
- The lock-lab API still embeds a SQL username and password for Azure SQL. How should the app authenticate instead?
- Only one water-quality database was audited; a new database was added later and nobody noticed. How do you ensure new databases inherit audit coverage?
- Security needs durable records of failed logins and SELECT activity on the lock-chemistry table. Where should Azure SQL auditing send those events?
- A DBA disables server auditing on the lock-lab SQL server “because the water-quality database already has its own audit.” What is the correct guidance?
- Help-desk analysts run SELECT on lock-operator email addresses and see full values. Which control obfuscates those emails in the result set without rewriting the data at rest?
- After dynamic data masking is applied, the lock-lab DBA still sees plaintext while analysts see masked emails. How should you let a specific support lead see real values without removing the mask?
- A reviewer treats dynamic data masking, Transparent Data Encryption, and Always Encrypted as interchangeable “SQL encryption.” Which distinction should you apply for the lock-lab database?
- A migration checklist says “enable TDE” as if the water-quality Azure SQL Database were unprotected. What should you verify first?
- Auditors want the canal authority to hold the TDE protector for lock-lab Azure SQL. What change meets that requirement without turning this into Key Vault administration?
- A reviewer claims Transparent Data Encryption stops the lock-lab DBA from reading operator Social Security numbers with SELECT. Why is that claim wrong?
- Lock-operator national IDs and card numbers must stay hidden from DBAs and from the SQL engine itself, and TDE is already enabled. What should you recommend?
- A contractor wants Always Encrypted “turned on at the server” for lock-lab Azure SQL the same way TDE is enabled. What must you explain?
- The lock-lab app must equality-search on a hashed employee ID but must never support grouping on card numbers. Always Encrypted will protect both columns. What should you recommend?
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel · 103 questions
- The canal authority wants every new Key Vault in every subscription to have purge protection. Where should you assign the built-in Azure Policy (or initiative that includes it) so child subscriptions inherit?
- Security wants several house rules—HTTPS on storage, no anonymous blobs, and Key Vault firewall—assigned once across the canal estate. Which Azure Policy construct should you use?
- A contractor still creates a public-access storage account after “the policy is on.” Which Azure Policy effect actually blocks that create or update?
- A lock-authority compliance review shows an Azure Policy initiative at 60 percent compliant, and a reviewer treats that figure as Microsoft Defender for Cloud Secure Score. How should the security engineer interpret the initiative percentage?
- A Deny-public-IP Azure Policy assignment at the management group must stay in force, but one lock-lab sandbox resource group needs temporary relief. What should the security engineer create?
- Existing lock-lab Key Vaults remain Non-compliant for diagnostic settings even after a DeployIfNotExists policy assignment is live. What does the security engineer need so already-deployed vaults become compliant?
- After the lock-lab Key Vault firewall is set to Deny by default, a contractor can still change vault networking and access settings from the Azure portal. What should the security engineer conclude about the firewall’s scope?
- Canal-authority secrets in Key Vault must not be reachable from the public Internet. Which configuration best meets that requirement?
- Azure SQL TDE and Storage BYOK fail to unwrap keys after the lock-lab Key Vault firewall is set to Deny all. The services appear on Microsoft’s trusted services list. What else must the security engineer do?
- App-subnet virtual machines must Get secrets from Key Vault while the public Internet must not. Which network setting should the security engineer apply on the vault?
- A lock-lab Key Vault still shows vault access policies, and an engineer also assigned Key Vault Secrets Officer through Azure RBAC. How should the security engineer treat the permission models?
- A subscription Contributor opened the lock-lab Key Vault and added themselves Get, List, and Set through an access policy. Why does Microsoft recommend Azure RBAC over access policies for this risk, and what is the mitigation direction?
- The lock-lab app managed identity only needs to read one secret from Key Vault. Which assignment follows least privilege?
- Help desk needs Get on only the Key Vault secret named lock-operator-pin. Which approach provides that object-level scope?
- An engineer flips the lock-lab Key Vault permission model to Azure role-based access control and every application immediately loses secret access. What order should the security engineer have followed?
- A contractor stores a PFX as a generic Key Vault secret string and pastes a 4096-bit RSA value into another secret. How should the security engineer choose Key Vault object types instead?
- An operator accidentally deletes the Key Vault secret canal-sql-cs. The vault still exists. What should the security engineer do first?
- An insider deletes the lock-lab Key Vault and attempts to purge it the same day. Which control prevents that immediate purge even for a subscription Owner?
- Canal-app password rotation will land a new value in Key Vault. How should the security engineer stage the change?
- An auditor requires lock-lab cryptographic keys in a single-tenant FIPS-validated HSM pool rather than a multi-tenant software-protected key. What should the security engineer recommend?
- The customer-managed key that protects lock-lab SQL TDE has never rotated. What should the security engineer configure in Key Vault?
- A Key Vault certificate and a storage customer-managed key are nearing expiry. How should the security engineer reduce break-glass surprises for callers?
- Estate policy requires every RSA key in Key Vault to be scheduled to rotate within 730 days. Which governance approach should the security engineer use?
- Before deleting or moving a Key Vault key used as a customer-managed key, what backup action should the security engineer take?
- The lock-lab Key Vault is gone, but an encrypted Key Vault backup blob remains. How should the security engineer recover the objects?
- A Key Vault secret was deleted ten minutes ago and the vault still exists. Soft-delete retention has not expired. What should the security engineer do first?
- A reviewer claims weekly Key Vault backups make purge protection optional for the lock-lab vault. How should the security engineer respond?
- A ransomware playbook assumes an attacker who already has Contributor will try to delete Recovery Services vault backup points. Which security controls should the security engineer enable for Azure Backup?
- An auditor requires Recovery Services vault backup points for the lock-lab estate that a compromised admin cannot expire early. Which control best meets that requirement?
- Backup operators on the canal estate were given Owner on the Recovery Services vault and can delete the vault itself. Which change restores least privilege for daily backup work?
- Defender for Cloud Inventory cannot show which lock-lab application owns each virtual machine during incident review. Which asset-management control should the security engineer apply first?
- The production Key Vault and Recovery Services vault for the canal must survive an accidental delete by a privileged operator. Which control should be applied?
- The canal director asks for “the number” that shows how complete the estate’s security recommendations are. What does Microsoft Defender for Cloud Secure Score represent?
- The lock-lab Secure Score is 42 percent. How should the security engineer choose which Defender for Cloud recommendations to remediate first?
- Deallocated lock-lab VMs and a Databricks workspace flood Secure Score with recommendations that do not apply. What should the engineer do instead of treating Secure Score as broken?
- Security leadership asks how many Windows VMs, storage accounts, and Key Vaults are in Defender for Cloud scope for the canal estate. Which feature should the engineer use?
- The lock-lab subscription currently has only the free posture experience. Which distinction is accurate?
- An operator opens a Microsoft Sentinel incident for every Secure Score recommendation on the lock-lab subscription. What is the correct distinction?
- An auditor asks which framework the canal estate’s Defender for Cloud Secure Score primarily uses by default. What should the engineer answer?
- A PCI assessor needs evidence for the cardholder lock-lab subscriptions. Which Defender for Cloud capability should the engineer open first?
- An ISO control shows red on the canal Defender for Cloud regulatory dashboard. What should the engineer do next?
- A GCP project is part of the canal estate, but the ISO regulatory dashboard shows Azure resources only. Why are GCP assessments missing?
- The board adopted CIS Azure Foundations for the lock-lab subscriptions. What should the engineer do in Microsoft Defender for Cloud?
- HIPAA shows roughly 40 percent compliance because someone enabled it on a non-PHI lock-lab subscription. What should the engineer do?
- Only the payments management group must show PCI assessments. How should the engineer scope the standard?
- A reviewer wants to turn off Azure Policy assignments because Defender for Cloud regulatory compliance is enabled. What is the accurate guidance?
- The canal authority has house rules such as no public IPs on lock-lab resource groups and Key Vault purge protection. How should those appear as a Defender for Cloud standard?
- About eighty percent of the canal need is covered by CIS; three house controls remain. What is the preferred approach?
- A custom Defender for Cloud standard exists in the tenant, but lock-lab dashboards stay empty for those controls. What is the most likely missing step?
- Windows servers in the lock house sit on-premises in the plant and must appear in Microsoft Defender for Cloud. What is the correct onboarding path?
- The canal estate also runs EC2 and S3 in AWS and needs Defender for Cloud recommendations on those resources. What should the engineer do?
- The data team’s GCP project with Compute Engine and Cloud SQL must appear in Microsoft Defender for Cloud. Which action is required?
- After the AWS account is connected, operators expect Defender for Servers alerts on every EC2 instance immediately. What should the engineer explain?
- A canal-authority CISO wants one Secure Score and Inventory view after Azure, AWS, GCP, and Arc are already connected. How should the Azure security engineer use Microsoft Defender for Cloud as the multi-cloud posture pane?
- Shadow lock-lab DNS and a forgotten public IP never appear in Defender for Cloud Inventory. Which capability should the Azure security engineer use to discover what the Internet can already see?
- The first Microsoft Defender External Attack Surface Management run for the canal authority is noisy with candidate assets. What should the Azure security engineer configure next at security-engineer depth?
- Microsoft Defender External Attack Surface Management flags an expired TLS certificate on a public marketing site for the lock authority. How should the Azure security engineer classify that finding?
- Microsoft Defender External Attack Surface Management finds a public storage static website that Defender Inventory never listed. What should the Azure security engineer do to close the discover-then-manage loop?
- Canal Secure Score looks healthy, yet there are no malware or storage-threat alerts on the lock estate. What should the Azure security engineer enable so cloud workload threat protection actually runs?
- Only two lock-lab resource groups need Microsoft Defender for Servers, but billing and enablement are subscription-wide. How should the Azure security engineer think about plan enablement scope?
- A consultant wants every Microsoft Defender for Cloud plan enabled “just in case,” including products outside the January 22, 2026 AZ-500 skill list. Which plans should the Azure security engineer prioritize from the lock-lab workload mix?
- An operator remediates the Defender for Cloud recommendation “disk encryption should be enabled” and believes Microsoft Defender for Servers is now on. What distinction should the Azure security engineer make?
- Lock-lab virtual machines need threat detection, and auditors also require agentless secret and vulnerability scanning. Which Microsoft Defender for Servers selection should the Azure security engineer make?
- The canal estate mixes Azure virtual machines and Arc-connected plant servers. Where should the Azure security engineer enable Microsoft Defender for Servers for coverage?
- A stem for the lock-lab estate tempts the engineer to “enable just-in-time VM access on each virtual machine” as the Domain 4 Defender for Servers answer. What is the correct Domain 4 focus instead?
- The canal estate runs Azure SQL Database, SQL Server on an Arc machine, and Azure Database for PostgreSQL. How should the Azure security engineer enable Microsoft Defender for Databases?
- A DBA believes enabling Microsoft Defender for SQL will encrypt the water-quality database at rest. What is the plan actually for?
- Unusual anonymous enumeration and a hash-reputation hit appear on lock-photo blobs. What should the Azure security engineer enable so those storage threat alerts fire?
- Uploads to a public lock-photo container must be scanned for malware on ingest. What should the Azure security engineer configure first?
- Finance wants Microsoft Defender for Storage only on production lock-photo accounts, not on every account in the subscription. How should the Azure security engineer configure that?
- Plant virtual machines cannot take another agent, yet auditors require machine scanning for secrets and vulnerabilities. What should the Azure security engineer enable?
- Security wants exposed connection strings on lock-lab disks without logging into the guest OS. Which agentless results in Microsoft Defender for Cloud should the engineer use?
- Lock-lab virtual machines are deallocated overnight and agentless findings look stale. What limitation should the Azure security engineer account for?
- Each week leadership asks which CVEs sit on lock-lab Azure virtual machines. Which named product in Microsoft Defender for Cloud should the Azure security engineer use?
- A critical CVE sits on IIS on a lock-lab virtual machine and appears as a Microsoft Defender Vulnerability Management recommendation. What should the Azure security engineer do first?
- Some lock-lab virtual machines run Microsoft Defender for Endpoint; others rely on agentless-only coverage under Servers Plan 2. How do Microsoft Defender Vulnerability Management findings reach Defender for Cloud?
- After one critical CVE is patched on a lock-lab virtual machine, the director expects Secure Score to jump immediately. How should the Azure security engineer explain the relationship?
- Lock-lab infrastructure-as-code and application repositories live in GitHub and Azure DevOps. What should the Azure security engineer do to bring them under Microsoft Defender for Cloud DevOps Security?
- A lock-lab CI pipeline is about to apply Terraform that opens a storage account to the Internet. As the Azure security engineer reviewing Microsoft Defender for Cloud DevOps Security, what should you focus on first?
- The canal authority’s DevOps estate includes GitHub, Azure DevOps, GitLab, and Bitbucket. Which platforms does Microsoft Defender for Cloud DevOps Security treat as first-class connectors on the January 22, 2026 AZ-500 outline?
- A consultant enables Microsoft Defender for Cloud Apps “for GitHub” to cover lock-lab repositories. Which product should the Azure security engineer use instead to connect and configure DevOps security findings for those repos?
- The GitHub connector in Microsoft Defender for Cloud DevOps Security shows Connected, but the critical lock-lab repository still has no findings. What should the Azure security engineer do next?
- Microsoft Defender for Cloud raises a High storage-malware alert on the lock-photo storage account. What should the Azure security engineer do first as part of managing the alert?
- An operator dismisses every Medium Microsoft Defender for Cloud alert so the lock-lab blade looks clean. How should the Azure security engineer handle dismissals instead?
- The canal SOC will respond from Microsoft Sentinel rather than living in the Microsoft Defender for Cloud alerts blade. What should the Azure security engineer configure?
- On the same Microsoft Defender for Cloud blade, the lock-lab team sees a “secure transfer required” recommendation and a “crypto-mining on VM” alert. How should the Azure security engineer treat them?
- High Microsoft Defender for Cloud alerts on lock-lab resources must open a ticket and email the on-call engineer. Which automation should the Azure security engineer configure?
- A Defender for Cloud workflow automation is creating ticket storms from Low recommendations across the canal subscriptions. How should the Azure security engineer scope the automation?
- The lock-lab team already runs Microsoft Sentinel playbooks and also needs ticket creation when High alerts appear in Microsoft Defender for Cloud. Which statement correctly separates the two automation controls?
- Security needs Windows Security events and syslog from lock-lab virtual machines in a Log Analytics workspace. What should the Azure security engineer create for Azure Monitor Agent?
- Capacity planning needs CPU counters from canal VMs while the SOC needs failed logon events in the same Log Analytics workspace. How should the Azure security engineer configure collection?
- A new lock-lab virtual machine has Azure Monitor Agent installed, but security events never appear even though a data collection rule already exists. What is the most likely missing step?
- The canal authority is standing up a greenfield Microsoft Sentinel SOC. In which order should the Azure security engineer enable data ingestion?
- Defender for Cloud alerts remain visible only in the Defender for Cloud blade and never become Microsoft Sentinel incidents. What should the Azure security engineer enable?
- The Microsoft Entra ID connector in Microsoft Sentinel stays disconnected for the lock-lab tenant. What should the Azure security engineer verify first?
- Lock-lab workspace cost spiked after every Microsoft Sentinel Content Hub connector was enabled. How should the Azure security engineer choose connectors?
- The SOC wants detections for suspicious resource deployments on lock-lab subscriptions. What should the Azure security engineer do in Microsoft Sentinel?
- A Microsoft Sentinel analytics rule is enabled but never fires for lock-lab activity that should match. What should the Azure security engineer check next?
- An analyst’s on-demand hunting query found repeatable unusual Key Vault access from a new ASN against lock-lab vaults. What should the Azure security engineer do so the pattern pages the SOC going forward?
- One Microsoft Sentinel analytics rule created two hundred lock-lab incidents overnight. What should the Azure security engineer do?
- High-severity Microsoft Sentinel incidents for lock-lab must tag the resource owner and run an isolate-virtual-machine Logic App. What should the Azure security engineer create?
- The isolate-virtual-machine Microsoft Sentinel playbook fails with HTTP 403 when it tries to change a lock-lab VM. What should the Azure security engineer fix?
- Management wants every High Microsoft Defender for Cloud incident in Microsoft Sentinel assigned to the SOC queue automatically. What should the Azure security engineer configure?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.