Microsoft Azure Security Engineer Associate AZ-500 AZ-500 Questions 151–194 | Page 3/3

151

MCQmedium

A company has an Azure virtual network with multiple subnets. They want to centrally inspect and log all outbound traffic to the internet. They also need to allow or deny traffic based on domain names (FQDNs). Which Azure resource should they deploy?

A.Azure Firewall

B.Network Virtual Appliance (NVA) from Azure Marketplace

C.Azure Application Gateway with Web Application Firewall (WAF)

D.Azure Network Security Groups (NSGs)

AnswerA

Azure Firewall is a fully managed, cloud-native firewall that can filter outbound internet traffic using application rules based on destination FQDNs, allowing or denying requests by hostname rather than only IP. It captures comprehensive diagnostic logs via diagnostic settings to Azure Monitor, where you can query the AzureDiagnostics table for denied/allowed flows. This combination of FQDN-level control and centralized, queryable logging directly meets the stated requirement.

Why this answer

Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It supports application rules based on fully qualified domain names (FQDNs), enabling allow or deny decisions for outbound traffic to the internet using Layer 7 (application layer) filtering, which meets both requirements directly.

Exam trap

The trap here is that candidates often confuse Azure Firewall with Network Security Groups, mistakenly thinking NSGs can filter by domain names because they associate 'network security' with all traffic control, but NSGs lack Layer 7 capabilities and cannot inspect or filter based on FQDNs.

How to eliminate wrong answers

Option B (NVA from Azure Marketplace) is wrong because, while an NVA can inspect and log traffic and filter by FQDNs, it is not a native Azure managed service; it requires manual deployment, maintenance, and scaling, and does not provide the same level of integrated logging and central management as Azure Firewall for this specific use case. Option C (Azure Application Gateway with WAF) is wrong because it is designed for inbound HTTP/HTTPS traffic load balancing and web application protection, not for outbound traffic inspection or domain-based filtering of all outbound internet traffic. Option D (Azure Network Security Groups) is wrong because NSGs operate at Layer 3/4 (network and transport layers) and cannot filter traffic based on domain names (FQDNs); they only support source/destination IP addresses, ports, and protocols.

Full explanation →

152

Multi-Selectmedium

You are designing a network security solution for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must be isolated. Which TWO configurations should you implement?

Select 2 answers

A.Use network security groups (NSGs) on each subnet

B.Deploy each tier in a separate VNet

C.Deploy each tier in a separate subnet

D.Use VNet peering to connect the tiers

E.Place all VMs in the same subnet

AnswersA, C

NSGs filter traffic between subnets.

Why this answer

Network security groups (NSGs) provide stateful filtering of inbound and outbound traffic at the subnet or NIC level. By placing each tier in a separate subnet and applying distinct NSG rules, you can allow inbound HTTP/HTTPS traffic from the internet to the web tier subnet while blocking all inbound traffic from the internet to the application and database subnets. This ensures the application and database tiers are isolated from direct internet access while still allowing necessary traffic between tiers via internal IP addresses.

Exam trap

The trap here is that candidates often assume separate VNets are required for isolation, but Azure's subnet-level NSGs provide the same isolation with lower complexity and cost, making separate subnets the correct approach.

Full explanation →

153

MCQhard

Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?

A.The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR

B.The UDR must be applied to the subnet that hosts the Azure Firewall

C.The spoke subnet does not have 'GatewaySubnet' route propagation enabled

D.The Azure Firewall is not configured with a route to the on-premises network

AnswerA

BGP-learned routes for on-premises networks are more specific than 0.0.0.0/0. They will be used even if a UDR for 0.0.0.0/0 exists. To force through firewall, you must either disable BGP route propagation or create specific UDRs for on-premises ranges.

Why this answer

The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.

Exam trap

The trap here is that candidates assume a default route (0.0.0.0/0) UDR will always override all other routes, but Azure's route selection uses longest prefix match, so more specific BGP-learned routes for on-premises networks will take precedence over the default UDR.

How to eliminate wrong answers

Option B is wrong because the UDR must be applied to the subnet where the workload (spoke) resides, not to the Azure Firewall subnet; the firewall subnet itself uses system routes or BGP for its own traffic. Option C is wrong because 'GatewaySubnet' route propagation is not a property of the spoke subnet; it is a setting on the virtual network gateway subnet, and disabling it would not affect UDR precedence over BGP routes. Option D is wrong because the Azure Firewall does not need a specific route to the on-premises network; it only needs to be the next hop for traffic, and the issue is that traffic is not reaching the firewall due to BGP route override, not a missing route on the firewall.

Full explanation →

154

MCQeasy

You are configuring Azure Private Link for a SQL Database. You want to ensure that all traffic from your virtual network to the SQL Database stays within the Microsoft Azure backbone network. What is the primary benefit of using Azure Private Link over a service endpoint?

A.Private Link provides higher throughput than service endpoints.

B.Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.

C.Private Link enables access to the SQL Database from on-premises via VPN/ExpressRoute without traversing the internet.

D.Private Link allows you to use NSGs to filter traffic to the SQL Database.

AnswerB

Private Link creates a private endpoint, which is a network interface with a private IP address assigned from your virtual network's subnet. When you connect to the SQL Database's FQDN, traffic is resolved and sent to this private IP, bypassing the public endpoint entirely. Combined with the 'Deny public network access' setting, the database is not reachable from the internet.

Why this answer

Azure Private Link exposes the SQL Database as a private endpoint within your virtual network, assigning it a private IP address from your VNet's address space. This ensures that all traffic to the database stays on the Microsoft backbone network and never traverses the public internet, which is the primary benefit over a service endpoint. Service endpoints still route traffic to the public endpoint of the SQL Database, even though the source traffic originates from the VNet.

Exam trap

The trap here is that candidates often confuse service endpoints with Private Link, thinking both provide the same level of isolation, but service endpoints still route to the public endpoint of the Azure service, whereas Private Link assigns a private IP and completely removes public internet exposure.

How to eliminate wrong answers

Option A is wrong because Private Link does not inherently provide higher throughput than service endpoints; throughput is determined by the database tier and network path, not the connectivity method. Option C is wrong because both Private Link and service endpoints can be used with VPN/ExpressRoute to access SQL Database from on-premises without traversing the internet, so this is not a unique benefit of Private Link. Option D is wrong because NSGs can filter traffic to the SQL Database when using service endpoints as well, via service tags, so this is not a distinguishing benefit of Private Link.

Full explanation →

155

Multi-Selectmedium

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Select 2 answers

A.Directly modify the affected Azure resource's configuration from the alert.

B.Export alerts to a third-party SIEM using continuous export.

C.Change the severity of an alert after it is generated.

D.Create suppression rules to automatically dismiss alerts that meet specific criteria.

E.Trigger a logic app playbook automatically when an alert is generated.

AnswersD, E

Suppression rules allow you to suppress alerts based on conditions.

Why this answer

Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts matching specific criteria, such as alert name, resource, or severity. This is useful for reducing noise from known benign activities without disabling the underlying security detection. Suppression rules are configured per alert type and can be set to expire after a defined period.

Exam trap

The trap here is that candidates often confuse the ability to modify alert severity (which is not supported) with the ability to create suppression rules or trigger automated responses, both of which are valid actions but require understanding of Defender for Cloud's specific capabilities.

Full explanation →

156

Multi-Selecthard

Which THREE components are part of Azure Disk Encryption for Windows VMs?

Select 3 answers

A.DM-Crypt

B.Microsoft Entra ID (Azure AD)

C.BitLocker Drive Encryption

D.Azure Key Vault with Key Encryption Key (KEK)

E.Azure Key Vault with Volume Encryption Key (VEK)

AnswersC, D, E

BitLocker is used for Windows VMs.

Why this answer

BitLocker Drive Encryption is the correct component because Azure Disk Encryption for Windows VMs leverages BitLocker to provide volume-level encryption for the OS and data disks. BitLocker is the native Windows technology that encrypts the entire volume, ensuring data at rest is protected within Azure managed disks.

Exam trap

The trap here is that candidates often confuse DM-Crypt with BitLocker, mistakenly selecting DM-Crypt for Windows VMs, or they incorrectly assume Microsoft Entra ID is a required component of the encryption process rather than understanding it is only used for authentication in specific scenarios.

Full explanation →

157

MCQeasy

A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?

A.One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'

B.Two inbound rules: one to allow HTTPS, and one to deny all other traffic

C.Three inbound rules: allow HTTPS, allow RDP for management, and deny all

D.One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'

AnswerB

Correct. The minimal set is two rules: an allow rule for HTTPS from 198.51.100.0/24 with high priority, and a deny-all inbound rule with sufficiently high priority to override the default allow rules, ensuring only traffic from the specified IP range is allowed.

Why this answer

Network Security Groups (NSGs) contain default inbound security rules: AllowVNetInBound (priority 65000) and AllowAzureLoadBalancerInBound (priority 65001). These default rules would permit HTTPS traffic from sources within the virtual network or from Azure Load Balancer, violating the requirement to allow HTTPS only from the specific IP range 198.51.100.0/24. Therefore, an explicit deny-all rule must be added with a higher priority (lower numerical value) than the default allow rules to block all other traffic, including that from VNet and Azure Load Balancer.

The minimal set is: one rule to allow HTTPS from 198.51.100.0/24 (high priority), and one rule to deny all inbound traffic from any source (at a slightly lower priority but still above the default rules). Option A is insufficient because it relies on the default deny rule (priority 65500), which is processed after the default allow rules, so VNet and Load Balancer traffic would still be permitted.

Exam trap

The trap is that candidates assume the default deny rule implicitly blocks all unwanted traffic, but they forget that NSGs also have default allow rules for virtual network and Azure Load Balancer traffic. These default allow rules have higher priority than the default deny rule, so traffic from those sources would be allowed unless explicitly denied. Therefore, to restrict traffic to a specific external IP range, an explicit deny rule is needed to override those default allows.

How to eliminate wrong answers

Option B is wrong because it includes an explicit 'deny all' rule, which is redundant and unnecessary — NSGs already have an implicit deny rule at the end of the rule list, so adding another deny rule does not change behavior and violates the 'minimal set' requirement. Option C is wrong because it adds an RDP rule (TCP 3389) that is not required by the scenario and would allow management traffic beyond the specified HTTPS-only restriction, plus the explicit deny is again redundant. Option D is wrong because it allows HTTPS from 'Any' (which violates the requirement to restrict to 198.51.100.0/24) and then attempts to deny that same source range, which would be ineffective since the allow rule has higher priority (lower number) than the deny rule, and the deny rule would block the very traffic you want to allow.

Full explanation →

158

MCQmedium

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

A.Azure AD B2C (Business-to-Consumer).

B.Azure Application Gateway with Web Application Firewall (WAF).

C.Azure AD Application Proxy.

D.Azure Front Door.

AnswerC

Azure AD Application Proxy is the appropriate service here because it is purpose-built to publish on-premises HTTP/HTTPS apps to external users through Azure AD. A lightweight connector installed on the corporate network establishes an outbound connection to the Azure AD Application Proxy service, eliminating the need for inbound firewall ports or a VPN; the external endpoint is an Azure AD URL that performs full Azure AD pre-authentication, including MFA and Conditional Access, before passing the authenticated request back through the connector to the internal web application. It effectively acts as an HTTPS reverse proxy bridged by an outbound-only tunnel, which is exactly what is required to securely expose an on-premises web app without making it publicly reachable.

Why this answer

Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Exam trap

The trap here is that candidates often confuse Azure AD Application Proxy with Azure Application Gateway, assuming that WAF provides authentication, but Application Gateway does not integrate with Azure AD for Modern Authentication or Conditional Access enforcement.

How to eliminate wrong answers

Option A is wrong because Azure AD B2C is designed for customer-facing identity management with social logins and custom policies, not for publishing internal on-premises applications with Conditional Access enforcement. Option B is wrong because Azure Application Gateway with WAF provides layer 7 load balancing and web application firewall protection but does not handle Modern Authentication or Conditional Access policies for legacy apps. Option D is wrong because Azure Front Door is a global load balancer and CDN service that accelerates web traffic but does not provide identity-based authentication or Conditional Access integration for on-premises applications.

Full explanation →

159

MCQhard

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

A.Yes, but the storage account must use a different key vault per region; no other implications.

B.Yes, but you must enable cross-region replication for the key vault and pay additional costs.

C.No, Azure does not support CMK from a different region than the storage account.

D.Yes, but you must use a managed identity from the storage account's region to access the key vault.

AnswerC

Correct. Azure Storage customer-managed keys require the key vault (or managed HSM) to be in the same Azure region as the storage account. Azure Key Vault is a regional service, and the key material cannot be used for encryption operations outside that region, so a CMK from a different region is simply not supported. This is a documented architectural constraint, and no configuration or feature—such as geo-replication or multi-region vaults—bypasses this requirement.

Why this answer

Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Exam trap

The trap here is that candidates assume Azure's global infrastructure allows cross-region key vault access for CMK, but Azure explicitly restricts CMK to the same region to maintain low-latency encryption operations and avoid cross-region dependency for data at rest.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that a different key vault per region is acceptable; Azure does not allow CMK from a different region at all, regardless of the number of key vaults. Option B is wrong because cross-region replication for the key vault does not enable cross-region CMK usage—the storage account's encryption service still requires the key vault to be in the same region, and Azure does not offer a feature to bypass this restriction. Option D is wrong because while a managed identity is required for the storage account to access the key vault, it does not override the regional constraint; the key vault must still be in the same region as the storage account.

Full explanation →

160

MCQhard

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?

A.Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.

B.Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.

C.Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.

D.Configure the role settings to require approval and set the approval timeout to 0 minutes.

AnswerB

This ensures the manager must approve within the activation window, or the request expires.

Why this answer

In Microsoft Entra ID PIM, the 'Maximum activation duration' setting in role settings controls the time window within which an approval must be granted. If the approver does not respond within that duration, the activation request is denied. By setting this to 30 minutes, requiring approval, and adding the user's manager as an approver, you ensure the manager must approve within 30 minutes or the activation is automatically denied.

This directly meets the requirement.

Exam trap

The trap here is thinking that a separate 'Approval timeout' setting exists, when in fact the 'Maximum activation duration' serves as the timeout for the approval request itself. Candidates may incorrectly look for a distinct approval timeout setting, leading them to choose options that do not exist or are misconfigured.

How to eliminate wrong answers

Option A is wrong because enabling just-in-time access and configuring a group approval with a 30-minute timeout does not specifically assign the user's manager as the approver; group approval requires a predefined group, not dynamic manager assignment. Option C is wrong because creating an approval workflow in Microsoft Entra ID is not a native PIM feature; PIM uses role settings for approval, not separate workflows, and the timeout must be configured in the role settings, not in a workflow. Option D is wrong because setting the approval timeout to 0 minutes would cause the approval request to expire immediately, not wait 30 minutes for the manager's response, and it does not specify the manager as the approver.

Full explanation →

161

Multi-Selecthard

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Select 2 answers

A.Configure Key Vault networking with private endpoint or selected networks

B.Disable soft delete permanently

C.Use firewall and virtual network restrictions

D.Store secrets as plain text tags

AnswersA, C

Correct for the stated requirement.

Why this answer

Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Exam trap

The trap here is that candidates often confuse data protection features like soft delete (Option B) with network access controls, or mistakenly think that storing secrets in tags (Option D) is a valid configuration, when in fact tags are unencrypted metadata and never intended for secret storage.

Full explanation →

162

MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

A.Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.

B.Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.

C.Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.

D.Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

AnswerB

Enabling 'Allow trusted Microsoft services to bypass this firewall' is the correct solution because Azure SQL Database is a trusted Microsoft service and its managed identity can authenticate to the Key Vault using Azure AD, then fetch the encryption key for TDE. With this setting, the Key Vault firewall remains enabled for public internet traffic, but Azure services like SQL Database are permitted to bypass the IP restrictions. This is the intended pattern for TDE with customer-managed keys, as SQL Database runs outside your virtual network and its outbound IPs cannot be reliably scoped.

Why this answer

Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Exam trap

The trap here is that candidates often confuse network-level access controls (firewall rules) with authorization (RBAC or access policies), leading them to select Option D, which addresses permissions but not the network restriction imposed by the Key Vault firewall.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database does not have a static public IP range; its outbound IPs can change and are not predictable, so adding a public IP range would be unreliable and insecure. Option C is wrong because a private endpoint would require the Azure SQL Database to be in the same virtual network or have connectivity to it, but Azure SQL Database is a PaaS service that does not reside in a customer's virtual network by default, and creating a private endpoint for Key Vault does not grant the SQL Database access unless the SQL Database itself is network-integrated (e.g., via Azure SQL Managed Instance or a private endpoint for SQL). Option D is wrong because role-based access control (RBAC) is used for authorization, not network access; the 'Key Vault Crypto Service Encryption User' role grants permissions to use the key, but it does not bypass the Key Vault firewall, which is a network-level restriction.

Full explanation →

163

MCQeasy

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

A.Configure Azure Automation State Configuration to push the agent.

B.Set up data connectors in Microsoft Sentinel.

C.Enable 'Auto-provisioning' in Defender for Cloud's environment settings.

D.Create an Azure Policy assignment to deploy the Log Analytics agent.

AnswerC

In Defender for Cloud's environment settings, enabling 'Auto-provisioning' deploys the Log Analytics agent extension automatically to new VMs without manual intervention. This satisfies the stem's requirement for a subscription-wide, automated mechanism that ensures all new VMs receive the agent, as opposed to per-VM manual installation or policy-based assignment.

Why this answer

Defender for Cloud's environment settings include a dedicated 'Auto-provisioning' toggle for the Log Analytics agent. When enabled, Defender for Cloud automatically installs the agent on any new Azure VM that is provisioned in the selected subscriptions, ensuring continuous monitoring without manual intervention. This is the native mechanism within Defender for Cloud to enforce agent deployment at scale.

Exam trap

The trap here is that candidates often confuse the Azure Policy-based deployment of the Log Analytics agent (which is a valid method but not the one specified in the question) with Defender for Cloud's native auto-provisioning toggle, leading them to select option D instead of C.

How to eliminate wrong answers

Option A is wrong because Azure Automation State Configuration (DSC) is a configuration management tool that can install software, but it is not the built-in method for auto-provisioning the Log Analytics agent across all subscriptions; it requires custom DSC configurations and does not integrate with Defender for Cloud's auto-provisioning logic. Option B is wrong because data connectors in Microsoft Sentinel are used to ingest logs from various sources into Sentinel, not to enable auto-provisioning of the Log Analytics agent on new VMs; Sentinel relies on the agent being already present or deployed separately. Option D is wrong because while an Azure Policy assignment can deploy the Log Analytics agent via the 'Deploy Log Analytics agent' built-in policy, it is a separate mechanism from Defender for Cloud's auto-provisioning setting; the question specifically asks for the configuration within Defender for Cloud, not a policy-based approach.

Full explanation →

164

Multi-Selecthard

You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?

Select 3 answers

A.Azure Monitor Logs (Log Analytics workspace)

B.Azure Firewall logs

C.NSG flow logs

D.Traffic Analytics

E.VNet flow logs

AnswersA, C, D

Flow logs are sent to Log Analytics for querying.

Why this answer

Azure Monitor Logs (Log Analytics workspace) is correct because it serves as the central ingestion and storage destination for network monitoring data. NSG flow logs capture IP traffic through Network Security Groups, and Traffic Analytics processes those raw flow logs to provide visualizations, top-talkers, and anomaly detection. Together, these three components enable comprehensive network traffic monitoring and security analysis for Azure VMs.

Exam trap

The trap here is that candidates confuse Azure Firewall logs (which only log traffic passing through the firewall) with NSG flow logs (which log all traffic allowed or denied by a Network Security Group), and mistakenly think 'VNet flow logs' is a real Azure feature when it does not exist.

Full explanation →

165

MCQeasy

A company has a subscription with Azure Active Directory (Azure AD). They want to enable a conditional access policy that requires all users to use multi-factor authentication (MFA) when accessing the Azure portal. The policy should only apply to users who are members of a group called 'AllUsers'. Which assignment should they configure in the policy?

A.Assign the 'AllUsers' group to the 'Cloud apps' section and select 'Azure portal' as the application

B.Assign the 'AllUsers' group to the 'Users' section and select 'Azure portal' as the cloud app

C.Add a condition for 'Client apps' specifying 'Browser' only

D.Create two policies: one for users and one for the Azure portal

AnswerB

This is the correct configuration because a Conditional Access policy requires both a user scope and an application scope. Adding the AllUsers group in the Users section targets all user identities, and selecting Azure portal as the cloud app limits the policy to sign-ins to that specific application. This combination ensures that every user is evaluated when accessing the Azure portal, allowing you to apply access controls such as MFA.

Why this answer

In an Azure AD Conditional Access policy, the 'Users' section is where you specify which users or groups the policy applies to, and the 'Cloud apps' section is where you select the target application (Azure portal). By assigning the 'AllUsers' group to 'Users' and selecting 'Azure portal' as the cloud app, the policy enforces MFA for all members of that group when they access the Azure portal.

Exam trap

The trap here is that candidates confuse the 'Users' assignment with the 'Cloud apps' assignment, mistakenly thinking that groups are assigned to applications rather than to the user scope of the policy.

How to eliminate wrong answers

Option A is wrong because the 'AllUsers' group should be assigned to the 'Users' section, not the 'Cloud apps' section; the 'Cloud apps' section is for selecting the target application (e.g., Azure portal), not for user assignment. Option C is wrong because restricting to 'Browser' client apps would only enforce MFA for browser-based access, but the requirement is to enforce MFA for all access to the Azure portal, including PowerShell, CLI, or mobile apps; this condition would be too narrow. Option D is wrong because a single Conditional Access policy can include both user assignment and cloud app selection; creating two separate policies is unnecessary and could lead to conflicting or overlapping rules.

Full explanation →

166

MCQmedium

A company enables Azure SQL Database auditing to log database events to a storage account. The security policy requires that the audit logs be protected from tampering and deletion after they are written. Which storage account feature should the company enable to ensure that audit log files cannot be modified or deleted by anyone for a specified retention period?

A.Soft delete

B.Immutable storage

C.Hierarchical namespace

D.Firewall and virtual networks

AnswerB

Immutable storage is correct because it enforces a Write-Once-Read-Many (WORM) policy at the container or version level, blocking any delete or modify operation on blobs for a set retention period. This time-based retention lock makes the stored audit logs tamper-proof and compliant with regulatory frameworks such as SEC 17a-4f. After the policy is locked, even an account administrator cannot shorten the retention interval or disable immutability, ensuring that Azure SQL Database audit records remain intact until the policy expires.

Why this answer

Immutable storage for Azure Blob Storage provides a WORM (Write Once, Read Many) policy that prevents audit log files from being modified or deleted by any user, including administrators, for a specified retention period. This directly meets the security requirement to protect audit logs from tampering and deletion after they are written.

Exam trap

The trap here is that candidates often confuse soft delete with immutable storage, thinking that soft delete's ability to recover deleted blobs is sufficient for tamper-proofing, but soft delete does not prevent modification or deletion in the first place.

How to eliminate wrong answers

Option A is wrong because soft delete only protects against accidental deletion by retaining deleted blobs for a configurable period, but it does not prevent intentional modification or deletion by authorized users during the retention period. Option C is wrong because hierarchical namespace is a feature of Azure Data Lake Storage Gen2 that organizes blobs into a directory hierarchy, but it provides no data immutability or tamper-proof protection. Option D is wrong because firewall and virtual networks restrict network access to the storage account but do not prevent modification or deletion of blobs by users who have legitimate access through the network.

Full explanation →

167

MCQmedium

A company uses Microsoft Defender for Cloud to manage security posture. The security team wants to receive alerts when a virtual machine has a vulnerability rated as 'Critical' by the integrated vulnerability assessment solution. Which Defender for Cloud plan must be enabled for the subscription to receive these alerts?

A.Defender for Servers Plan 1

B.Defender for Servers Plan 2

C.Defender for Storage

D.Defender for Databases

AnswerB

Defender for Servers Plan 2 builds on Plan 1 by adding integrated vulnerability assessment (Defender Vulnerability Management), just-in-time VM access, and allowlisting. This tier continuously scans Azure VMs for missing security updates, known CVEs, and OS misconfigurations, then raises security alerts and recommendations. For a company using Defender for Cloud to manage server security, Plan 2 is the correct choice to generate alerts for critical vulnerabilities.

Why this answer

Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment solution that automatically scans VMs and generates security alerts for critical vulnerabilities. Plan 1 only provides basic threat detection and does not include the vulnerability assessment engine or the corresponding alerting capability.

Exam trap

The trap here is that candidates often assume Defender for Servers Plan 1 is sufficient because it provides basic threat alerts, but they overlook that the integrated vulnerability assessment (Qualys) and its critical vulnerability alerts are exclusive to Plan 2.

How to eliminate wrong answers

Option A is wrong because Defender for Servers Plan 1 only offers basic threat detection and does not include the integrated vulnerability assessment solution (Qualys) that generates alerts for critical vulnerabilities. Option C is wrong because Defender for Storage is designed to protect Azure Storage accounts from threats like malware and data exfiltration, not to assess VM vulnerabilities. Option D is wrong because Defender for Databases focuses on database services (e.g., Azure SQL, Azure Database for PostgreSQL) and does not provide vulnerability scanning for virtual machines.

Full explanation →

168

MCQeasy

A security analyst uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to receive an email notification whenever a high-severity security alert is generated for any of their Azure resources. What should they configure in Defender for Cloud?

A.Create an alert rule in Azure Monitor that triggers an email when a security alert is raised.

B.Configure email notifications in the Defender for Cloud settings under 'Notifications'.

C.Use a Logic Apps playbook to send an email when a new alert is generated.

D.Set up a workflow automation rule in Microsoft Sentinel to forward alerts to email.

AnswerB

Configuring email notifications directly in Microsoft Defender for Cloud is the native, built-in mechanism for receiving security alert emails. In the Defender for Cloud portal, you navigate to Environment Settings, select the relevant subscription, and under 'Notifications' you can specify recipient email addresses and the severity levels (e.g., High, Medium, Low) that trigger emails. This setting is managed within Defender for Cloud itself, so it does not require external services like Azure Monitor, Logic Apps, or a separate SIEM, and it is the exact option designed for this scenario.

Why this answer

Microsoft Defender for Cloud has a built-in 'Email notifications' setting under its environment settings that allows you to configure email recipients for high-severity alerts directly, without needing external services. This feature sends real-time email notifications for security alerts based on severity levels you define, making it the simplest and most direct method for this requirement.

Exam trap

The trap here is that candidates often confuse Defender for Cloud's native email notification settings with Azure Monitor alert rules or Logic Apps playbooks, assuming that security alerts must be routed through external services to trigger email, when in fact Defender for Cloud provides a direct configuration option for this purpose.

How to eliminate wrong answers

Option A is wrong because Azure Monitor alert rules can trigger on metrics or logs, but they cannot directly consume Defender for Cloud security alerts as a signal source; security alerts are managed within Defender for Cloud's own alert pipeline, not Azure Monitor metric/log alerts. Option C is wrong because Logic Apps playbooks are typically used for automated response actions (e.g., remediation) triggered by Defender for Cloud alerts, but they require additional configuration and are not the native email notification mechanism for alert generation. Option D is wrong because Microsoft Sentinel workflow automation rules are designed for incident creation and orchestration within Sentinel, not for forwarding Defender for Cloud alerts to email; Sentinel can ingest Defender for Cloud alerts, but email notification for those alerts is not a direct feature of Sentinel's automation rules.

Full explanation →

169

MCQmedium

A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?

A.Modify the analytics rule to include a custom script that runs upon alert generation.

B.Create an automation rule that triggers when an incident is created and sets the severity and owner fields.

C.Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.

D.Configure a workbook to filter and manually assign incidents.

AnswerB

Automation rules in Sentinel are purpose-built to perform immediate actions, such as changing severity or assigning an owner, when an incident is created (e.g., when triggered by a specific analytics rule's incident generation). They support conditions and multiple actions and can be prioritized to ensure the desired incident properties are set consistently. This makes automation rules the correct way to enforce classification and ownership at the point of incident creation, without custom code or external integration.

Why this answer

Automation rules in Microsoft Sentinel allow you to centrally manage incident handling by triggering actions when incidents are created or updated. By configuring an automation rule that triggers on incident creation from the specific analytics rule, you can automatically set the severity and assign the incident to a security operations group (via an Azure AD group or user) without custom scripting or manual intervention.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks, assuming that any automation requires a Logic Apps playbook, but automation rules are the correct, lightweight feature for simple field assignments like severity and owner.

How to eliminate wrong answers

Option A is wrong because analytics rules do not support embedding custom scripts directly; they generate alerts or incidents, and automation is handled separately via automation rules or playbooks. Option C is wrong because while a Logic Apps playbook can be triggered by an analytics rule, it is typically used for complex, multi-step orchestration (e.g., enrichment or response actions), not for simply setting severity and owner fields, which is more efficiently done with an automation rule. Option D is wrong because workbooks are visualization and reporting tools, not automation mechanisms; they cannot assign severity or ownership to incidents.

Full explanation →

170

MCQmedium

A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?

A.Azure Application Gateway with Web Application Firewall (WAF) policy.

B.Azure Firewall.

C.Network Security Groups on the VM subnet.

D.Azure DDoS Protection.

AnswerA

Azure Application Gateway is a Layer 7 load balancer that can terminate TLS, route HTTP traffic, and enforce a Web Application Firewall policy using the Open Web Application Security Project (OWASP) Core Rule Set. The WAF inspects headers, body, cookies, and URL parameters to detect and block common attacks such as SQL injection, cross-site scripting, and remote file inclusion. This is the appropriate service because it operates at the application layer and can be integrated directly into the application delivery path for the VMs.

Why this answer

Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.

Exam trap

The trap here is that candidates confuse Azure Firewall (a Layer 3-4 network firewall) with a web application firewall, mistakenly believing it can inspect HTTP payloads, when in fact only a Layer 7 WAF (like Application Gateway WAF or Azure Front Door WAF) can protect against SQL injection and XSS.

How to eliminate wrong answers

Option B (Azure Firewall) is wrong because it is a stateful, Layer 3-4 network firewall that filters traffic based on IP addresses, ports, and protocols, but it does not inspect HTTP application-layer payloads for SQL injection or XSS patterns. Option C (Network Security Groups on the VM subnet) is wrong because NSGs provide stateless or stateful Layer 3-4 filtering (IP/port rules) and cannot perform deep packet inspection at the application layer to detect web attack signatures. Option D (Azure DDoS Protection) is wrong because it only mitigates volumetric DDoS attacks at the network layer (Layer 3-4) and does not inspect or block application-layer threats like SQL injection or XSS.

Full explanation →

171

MCQmedium

You are designing network security for a multi-tier application deployed in Azure. The application consists of a front-end web tier, a middle-tier API, and a back-end database. All tiers must be isolated from the internet except the front-end, which must accept HTTPS traffic from the internet. You need to ensure that no traffic can bypass the network security controls. What should you implement?

A.Place all tiers in the same virtual network and use Azure Front Door with WAF for the web tier, and rely on NSGs for internal traffic.

B.Deploy Network Security Groups (NSGs) on each subnet and allow only necessary traffic between tiers.

C.Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.

D.Use Azure Application Gateway with Web Application Firewall (WAF) in front of the web tier, and use NSGs for the other tiers.

AnswerC

This is the correct approach because Azure Firewall is a managed, stateful firewall service designed for centralized inspection and control of all traffic, including east-west traffic between tiers. By placing Azure Firewall in a hub virtual network and configuring user-defined routes to force all inter-tier traffic through it, you create a security choke point that enforces consistent policies, provides FQDN filtering, and generates comprehensive logs for auditing. This gives you a single, centrally managed security boundary across the entire application.

Why this answer

Deploying Azure Firewall in a hub virtual network and routing all traffic between tiers through the firewall for inspection ensures that no traffic can bypass network security controls. This design enforces a forced tunneling architecture where all inter-tier traffic (e.g., from front-end to API to database) must traverse the firewall, allowing centralized inspection, logging, and filtering. This meets the requirement for complete isolation and control, as NSGs alone cannot prevent traffic from bypassing inspection if routes are not explicitly forced.

Exam trap

The trap here is that candidates often assume NSGs alone are sufficient for full traffic control, but they fail to recognize that NSGs cannot enforce mandatory inspection or prevent traffic from bypassing controls when routes are not explicitly forced through a central firewall.

How to eliminate wrong answers

Option A is wrong because placing all tiers in the same virtual network and relying solely on NSGs for internal traffic does not prevent traffic from bypassing network security controls; NSGs are stateless or stateful at the subnet/NIC level but do not provide centralized inspection or logging, and Azure Front Door with WAF only protects the web tier from internet traffic, not internal traffic between tiers. Option B is wrong because deploying NSGs on each subnet and allowing only necessary traffic between tiers is insufficient to ensure no traffic bypasses controls; NSGs cannot inspect or log traffic at the application layer, and they do not prevent a compromised tier from sending unauthorized traffic directly to another tier without inspection. Option D is wrong because using Azure Application Gateway with WAF in front of the web tier and NSGs for the other tiers does not enforce mandatory inspection of traffic between the middle-tier API and back-end database; NSGs alone cannot provide the centralized, forced routing required to ensure all inter-tier traffic is inspected, and the Application Gateway only handles inbound internet traffic to the web tier.

Full explanation →

172

MCQmedium

A security team uses Microsoft Sentinel. They want to create a custom detection rule that identifies a potential data exfiltration scenario: when a user signs in from an unusual location and then, within 30 minutes, performs a large download from Azure Blob Storage. They need to correlate sign-in logs from Azure AD with storage diagnostic logs. Which type of analytics rule should they create in Microsoft Sentinel?

A.A scheduled query rule using KQL

B.An NRT (near-real-time) rule

C.A fusion rule

D.A machine learning-based analytics rule

AnswerA

Scheduled rules can run KQL queries that join multiple tables (e.g., SigninLogs and StorageBlobLogs) to correlate events and trigger alerts when the pattern is detected.

Why this answer

A scheduled query rule is correct because it allows you to write a KQL query that joins Azure AD sign-in logs (SigninLogs) with Azure Storage diagnostic logs (StorageBlobLogs) based on a user identifier, and then uses a time window (e.g., 30 minutes) to correlate the two events. This is the only rule type that supports custom KQL logic for multi-table joins and time-based correlation, which is essential for detecting the described exfiltration pattern.

Exam trap

The trap here is that candidates often confuse NRT rules with scheduled queries, assuming NRT's low latency is better for time-sensitive correlations, but NRT rules cannot handle multi-table joins or extended time windows, making scheduled queries the only viable option for this scenario.

How to eliminate wrong answers

Option B is wrong because NRT (near-real-time) rules run every minute with a 1-minute lookback and cannot perform complex joins across multiple tables or use time windows longer than a few minutes, making them unsuitable for correlating sign-in and storage logs over a 30-minute window. Option C is wrong because fusion rules are based on Microsoft's built-in machine learning models that correlate alerts from multiple products, not custom KQL queries; they cannot be tailored to join specific Azure AD sign-in logs with storage diagnostic logs. Option D is wrong because ML-based analytics rules use pre-built anomaly detection models (e.g., for unusual sign-in patterns) and do not support custom correlation logic across different data sources like sign-in logs and storage logs.

Full explanation →

173

MCQmedium

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?

A.Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.

B.Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.

C.Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.

D.Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.

AnswerB

This enforces both device compliance and reauthentication frequency.

Why this answer

A Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.

Exam trap

The trap here is that candidates confuse device compliance policies with Conditional Access session controls, assuming sign-in frequency can be set directly in a compliance policy, when it is actually a separate Conditional Access setting.

How to eliminate wrong answers

Option A is wrong because requiring MFA does not enforce device compliance; it only adds an authentication factor, so non-compliant devices could still access Exchange Online. Option C is wrong because app protection policies (MAM) manage data protection within apps, not device-level compliance, and they do not support a sign-in frequency setting. Option D is wrong because a device compliance policy itself does not include a 'Reauthenticate every 12 hours' setting; sign-in frequency is a Conditional Access session control, not a compliance policy setting.

Full explanation →

174

MCQhard

A company stores business records in Azure Blob Storage. Due to a legal investigation, they must prevent any modification or deletion of the blobs for an indefinite period until the legal hold is released. They also need to ensure that even storage account owners cannot alter the data during the hold. Which blob storage feature should they enable?

A.Time-based retention policy

B.Legal hold

C.Soft delete

D.Blob versioning

AnswerB

Legal hold is the correct choice because it applies an indefinite, immutable lock on blob storage, preventing any modification or deletion until the hold is explicitly released by an authorized user. This hold is designed for legal and compliance scenarios where records must be preserved for an unknown or open-ended duration, such as active litigation or an ongoing investigation. Unlike time-based retention, legal hold does not expire automatically and continues protecting data until the hold is removed, ensuring that records remain untouched for as long as legally required.

Why this answer

Legal hold (option B) is the correct choice because it is designed to protect blobs from any modification or deletion for an indefinite period, even by storage account owners. Unlike time-based retention policies, a legal hold has no expiration and cannot be removed until explicitly cleared by an authorized user, making it ideal for indefinite legal investigations.

Exam trap

The trap here is that candidates often confuse time-based retention policies (which have a fixed duration) with legal holds (which are indefinite), or assume that soft delete or versioning can prevent modification or deletion by privileged users, when in fact they only provide recovery options and do not block destructive operations.

How to eliminate wrong answers

Option A is wrong because a time-based retention policy enforces a fixed retention period (e.g., 1–146,000 days) and automatically expires, which does not meet the indefinite hold requirement. Option C is wrong because soft delete only protects against accidental deletion by retaining deleted blobs for a configurable retention period (default 7 days), but it does not prevent modification or allow indefinite holds, and storage account owners can still permanently delete blobs if soft delete is disabled. Option D is wrong because blob versioning preserves previous versions of blobs but does not prevent modification or deletion of the current version; storage account owners can still overwrite or delete blobs, and versioning alone cannot enforce an indefinite legal hold.

Full explanation →

175

MCQeasy

You are the identity security engineer for a multinational company that uses Microsoft Entra ID. The company has recently experienced a security breach where an attacker compromised a non-administrator user account and then used that account to enumerate all users in the tenant. The attacker then attempted to brute-force passwords for high-privilege accounts. To prevent such attacks, management requires the following: - Users with administrative roles must use phishing-resistant MFA. - Any sign-in from a risky IP address must be blocked. - Users must not be able to enumerate directory information via the Graph API unless they have a specific role. - The solution should be implemented using built-in Microsoft Entra ID features. What should you configure?

A.Enable Security defaults and configure Identity Protection user risk policy to block high-risk users.

B.Configure Conditional Access policy with authentication strength for admins requiring phishing-resistant MFA. Configure Identity Protection sign-in risk policy to block risky sign-ins. Restrict access to the Graph API by requiring a specific role assignment.

C.Configure Conditional Access policy for admins to require phishing-resistant MFA. Use PIM to require approval. Enable Identity Protection sign-in risk policy.

D.Configure PIM for all admin roles. Create access reviews for all users. Enable Identity Protection to detect risky sign-ins.

AnswerB

This is the correct answer because it layers three complementary controls that directly counter the attacker's tactic. Conditional Access with an authentication strength policy requiring phishing-resistant MFA (such as FIDO2 or Windows Hello) prevents credential theft and token replay that bypass ordinary MFA. The Identity Protection sign-in risk policy blocks sign-ins in real time when the risk level is high, such as those coming from anonymous IP addresses or anomalous locations. Restricting access to the Microsoft Graph API by requiring a specific role assignment ensures that only authorized identities can enumerate directory objects, closing the enumeration vector.

Why this answer

Phishing-resistant MFA can be enforced via Conditional Access with authentication strength. Sign-in risk policies in Identity Protection can block sign-ins from risky IPs. To prevent directory enumeration, you can restrict access to the Graph API by requiring a specific role assignment.

Option A is wrong because Security defaults enforce MFA but do not block all enumeration. Option C is wrong because PIM does not block enumeration. Option D is wrong because access reviews do not block enumeration.

Full explanation →

176

Drag & Dropmedium

Drag and drop the steps to configure Azure Application Gateway with SSL termination using a Key Vault certificate into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

SSL termination requires a certificate from Key Vault, configured on the listener.

Full explanation →

177

MCQmedium

A company stores highly sensitive data in Azure Blob Storage. The security policy requires that all data is encrypted at rest using a key that is stored in Azure Key Vault, and that the storage account uses its system-assigned managed identity to access the key. Which encryption configuration should they use?

A.Server-side encryption with service-managed keys

B.Server-side encryption with customer-managed keys (CMK)

C.Client-side encryption

D.Azure Disk Encryption

AnswerB

Server-side encryption with customer-managed keys (CMK) encrypts data at rest using a data encryption key wrapped by a customer-controlled key encryption key stored in Azure Key Vault. The storage account's system-assigned managed identity authenticates to Key Vault to perform encryption and decryption of the underlying data key, giving the organization direct control over key rotation, auditing, and revocation. This satisfies the requirement of using a customer-managed key stored in Key Vault and is the appropriate mechanism for enforcing separation of duties and meeting compliance obligations.

Why this answer

Server-side encryption with customer-managed keys (CMK) is required because the security policy mandates that the encryption key be stored in Azure Key Vault and that the storage account uses its system-assigned managed identity to access that key. CMK allows you to bring your own key (BYOK) into Key Vault and grants the storage account access via a managed identity, ensuring the key is under your control and not managed by Azure. Service-managed keys (option A) use Microsoft-managed keys, which do not satisfy the requirement for customer-controlled key storage.

Exam trap

The trap here is that candidates confuse 'encryption at rest' with 'client-side encryption' or 'Azure Disk Encryption', failing to recognize that the requirement for a managed identity to access a Key Vault key directly points to server-side CMK, not client-side or disk-level encryption.

How to eliminate wrong answers

Option A is wrong because server-side encryption with service-managed keys uses keys managed entirely by Microsoft, not stored in the customer's Azure Key Vault, and does not involve a managed identity for access. Option C is wrong because client-side encryption encrypts data before it is sent to Azure Blob Storage, meaning the storage account never accesses the key via its managed identity; the key is managed on the client side. Option D is wrong because Azure Disk Encryption is used to encrypt virtual machine disks (OS and data disks) using BitLocker or DM-Crypt, not Azure Blob Storage data.

Full explanation →

178

MCQmedium

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

A.Configure a firewall rule to allow only corporate IP ranges.

B.Use storage account access keys to mount the file share.

C.Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.

D.Generate a shared access signature (SAS) with read permissions.

AnswerC

Identity-based authentication maps users to share permissions.

Why this answer

Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.

Exam trap

The trap here is that candidates often confuse network-level restrictions (firewall rules) or token-based access (SAS) with identity-based access control, mistakenly believing that restricting IP ranges or using SAS tokens satisfies the requirement for explicit user permissions, when in fact only identity-based authentication with Microsoft Entra ID provides per-user authorization.

How to eliminate wrong answers

Option A is wrong because configuring a firewall rule to allow only corporate IP ranges restricts access based on network location, not on user identity or explicit permissions; any user from a corporate IP could still access the share if they have the storage account key or SAS. Option B is wrong because using storage account access keys grants full administrative access to the entire storage account, not just the file share, and cannot be scoped to individual users or groups, violating the principle of least privilege. Option D is wrong because a shared access signature (SAS) with read permissions provides time-limited, token-based access that is not tied to a specific user identity and cannot enforce per-user explicit permissions; it also exposes the share to anyone possessing the SAS token.

Full explanation →

179

MCQhard

A security analyst uses Microsoft Defender for Cloud. They need to continuously monitor the security posture of their Azure subscription against the Microsoft cloud security benchmark (MCSB). They want to see the current compliance score and specific recommendations for failing controls. Which Defender for Cloud feature should they use?

A.Regulatory compliance dashboard

B.Security posture

C.Workbooks

D.Advanced hunting

AnswerA

Correct. The Regulatory compliance dashboard provides a view of compliance against selected standards like MCSB, showing scores and detailed recommendations for non-compliant controls.

Why this answer

The Regulatory compliance dashboard in Microsoft Defender for Cloud is specifically designed to track compliance against standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score and lists specific recommendations for failing controls, enabling continuous monitoring and remediation tracking. This dashboard aggregates assessment results from the secure score and maps them to the controls defined in the selected regulatory standard.

Exam trap

The trap here is that candidates often confuse the 'Security posture' feature (which shows a general secure score) with the 'Regulatory compliance dashboard' (which maps that score to a specific regulatory standard like MCSB), leading them to choose the wrong option because they overlook the requirement for standard-specific compliance tracking.

How to eliminate wrong answers

Option B (Security posture) is wrong because the Security posture feature focuses on the overall secure score and security recommendations based on best practices, not on mapping to a specific regulatory standard like MCSB. Option C (Workbooks) is wrong because Workbooks are customizable Azure Monitor dashboards that can visualize data from multiple sources, but they do not natively provide the out-of-the-box compliance score and control mapping against MCSB. Option D (Advanced hunting) is wrong because Advanced hunting is a query-based threat hunting tool in Microsoft 365 Defender for investigating security incidents, not for monitoring compliance posture or regulatory benchmarks.

Full explanation →

180

MCQmedium

A company runs a global web application on Azure App Service instances deployed in multiple Azure regions. They want to protect the application from common web attacks such as SQL injection and cross-site scripting (XSS) using a centralized set of managed rules that can be automatically updated. They also need to improve performance by terminating traffic at the nearest point of presence (POP) to end users. Which Azure service should they deploy in front of the App Service?

A.Azure Application Gateway with Web Application Firewall (WAF)

B.Azure Front Door with Web Application Firewall (WAF)

C.Azure Traffic Manager

D.Azure CDN (Content Delivery Network)

AnswerB

Azure Front Door with WAF is a global layer-7 service that uses the Microsoft global edge network with anycast, ensuring connections are terminated at the nearest point of presence (POP) rather than the origin region. It applies Web Application Firewall rules, including OWASP managed rule sets, at that edge, which blocks malicious requests before they traverse the backbone to your web app. This combination of global load balancing, TLS termination, and built-in WAF protection directly addresses both performance and security requirements for a worldwide audience.

Why this answer

Azure Front Door with WAF is correct because it provides global, centralized protection against common web attacks (SQL injection, XSS) using managed rule sets that are automatically updated, and it terminates traffic at the nearest point of presence (POP) to end users, improving performance through global load balancing and TLS termination. This meets both the security and performance requirements for a multi-region App Service deployment.

Exam trap

The trap here is that candidates often confuse Azure Application Gateway (regional, Layer 7 load balancer with WAF) with Azure Front Door (global, multi-region, with WAF), failing to recognize that only Front Door provides both global POP termination and centralized WAF for multi-region deployments.

How to eliminate wrong answers

Option A is wrong because Azure Application Gateway with WAF is a regional service, not a global one; it cannot terminate traffic at the nearest POP across multiple Azure regions and does not provide the global performance optimization needed. Option C is wrong because Azure Traffic Manager is a DNS-based traffic routing service that does not include a Web Application Firewall or any application-layer attack protection, and it does not terminate traffic at POPs. Option D is wrong because Azure CDN is primarily a content caching and delivery service; while it can improve performance via POPs, it does not include a built-in WAF with managed rules for SQL injection and XSS protection, and its security capabilities are limited to DDoS protection and access restrictions.

Full explanation →

181

MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

A.Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.

B.Enable soft-delete on the Key Vault.

C.Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.

D.Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

AnswerC

This setting allows Azure services like Azure SQL Database, which are trusted by Azure, to access the Key Vault even when the firewall is enabled to deny public traffic. It is the required configuration to allow TDE operations.

Why this answer

When Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Exam trap

The trap here is that candidates often confuse network-level controls (private endpoints, firewall rules) with the Azure platform's built-in trust mechanism, mistakenly thinking that a private endpoint or a static IP rule is required when the simpler 'trusted Microsoft services' bypass is the correct and intended solution for PaaS services like Azure SQL Database.

How to eliminate wrong answers

Option A is wrong because a private endpoint for Key Vault would require the SQL server to be on the same virtual network, but Azure SQL Database is a PaaS service that does not reside in a customer's virtual network by default; the SQL server's managed identity accesses Key Vault over the Azure backbone, not via a private endpoint. Option B is wrong because soft-delete is a data protection feature that prevents permanent deletion of keys, secrets, or certificates, but it does not control network access or firewall bypass for TDE operations. Option D is wrong because Azure SQL Database does not have a static public IP address; its outbound IPs can change and are not assigned to the logical server, making a firewall rule based on a public IP unreliable and unnecessary when the trusted Microsoft services bypass is available.

Full explanation →

182

Drag & Dropmedium

Drag and drop the steps to assign an Azure RBAC role to a user at the resource group scope into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

IAM is used for RBAC, and you add a role assignment by selecting the role and assigning it to a user.

Full explanation →

183

MCQmedium

A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?

A.Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.

B.Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.

C.Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.

D.Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.

AnswerB

This is correct because it combines the specific condition—User risk High—with a location exclusion for all trusted IP ranges, ensuring the block only applies to sign-ins that originate from untrusted locations. Conditional Access evaluates the user risk condition and the location condition together, and with the grant control set to Block access, any matching sign-in is denied. This matches the requirement precisely: only high user risk accounts attempting sign-in from outside the corporate network are blocked.

Why this answer

It combines a condition for 'User risk' set to 'High' with an exclusion of 'All trusted locations' under the 'Locations' condition, then grants 'Block access'. This ensures that the block only applies when the sign-in originates from an untrusted location, meeting the requirement to automatically block sign-ins for high-risk users only from locations not in the company's trusted IP list.

Exam trap

The trap here is that candidates often confuse 'User risk' with 'Sign-in risk' or incorrectly combine 'Block access' with other grant controls, failing to realize that 'Block access' must be the sole grant control and that excluding trusted locations is the correct way to scope the policy to untrusted locations only.

How to eliminate wrong answers

Option A is wrong because it adds a condition for 'Sign-in risk' set to 'High', which is unnecessary and not required; the requirement only specifies 'User risk', and adding 'Sign-in risk' would narrow the policy to only block when both risks are high, potentially missing the intended scenario. Option C is wrong because it selects 'Require multi-factor authentication' alongside 'Block access' under Grant; 'Block access' cannot be combined with other grant controls, and MFA would not block access but instead require additional verification, which does not achieve the automatic block goal. Option D is wrong because it sets 'Locations' to 'Any location' without excluding trusted locations, and grants 'Block access' for all users; this would block all sign-ins from any location, ignoring the requirement to only block when the location is not trusted.

Full explanation →

184

MCQeasy

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

A.System-assigned managed identity

B.User-assigned managed identity

C.Azure AD application registration with a client secret

D.Azure AD service principal with certificate-based authentication

AnswerA

A system-assigned managed identity is automatically provisioned for the App Service and is tied to the resource's lifecycle. It can be granted access to Key Vault via RBAC or access policies, and the application code uses Azure SDK to obtain tokens without handling secrets.

Why this answer

A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Azure AD, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Azure AD tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Exam trap

The trap here is that candidates often confuse user-assigned managed identities (Option B) as the only managed identity option, overlooking that system-assigned managed identities are simpler and fully meet the requirement to avoid service principals or connection strings without additional resource management.

How to eliminate wrong answers

Option B is wrong because a user-assigned managed identity, while also avoiding service principals and connection strings, is a standalone resource that must be explicitly created and assigned to the App Service, adding management overhead that the security team's requirement to avoid service principals or connection strings does not necessitate; the simpler system-assigned identity suffices. Option C is wrong because an Azure AD application registration with a client secret is a form of service principal that requires storing and rotating a secret, directly violating the security team's directive to avoid service principals or connection strings. Option D is wrong because an Azure AD service principal with certificate-based authentication is still a service principal, requiring certificate management and lifecycle, which contradicts the requirement to avoid service principals entirely.

Full explanation →

185

MCQmedium

A company has an Azure virtual network with a subnet that contains virtual machines. They have deployed Azure Firewall in a hub VNet and peered the spoke VNet to the hub. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. However, traffic from the VMs is still going directly to the internet. What is the most likely cause?

A.The route table is not associated with the subnet.

B.The Azure Firewall's private IP is not configured as the next hop; it should be the public IP.

C.The VNet peering is not configured correctly.

D.The Azure Firewall has a default route that bypasses itself.

AnswerA

Correct. A route table only influences traffic after it is associated with a subnet. Without that association, the subnet's effective routes remain the system defaults, so internet-bound traffic bypasses the Azure Firewall and egresses directly via the virtual NIC's default SNAT. The forced-tunneling UDR must be attached to the specific spoke subnet to redirect its default route to the firewall's private IP.

Why this answer

The most likely cause is that the route table containing the default route (0.0.0.0/0) with the Azure Firewall's private IP as the next hop has not been associated with the spoke subnet. Without this association, the subnet's VMs will use the system default route, which sends internet-bound traffic directly out via the Azure default gateway (0.0.0.0/0, next hop type Internet), bypassing the firewall entirely.

Exam trap

The trap here is that candidates often assume that simply creating a route table with a default route to the firewall is sufficient, but they overlook the critical step of associating that route table with the subnet, which is a separate action in the Azure portal or via PowerShell/CLI.

How to eliminate wrong answers

Option B is wrong because the next hop for forced tunneling through Azure Firewall must be the firewall's private IP address, not its public IP; using a public IP would cause asymmetric routing and break the firewall's stateful inspection. Option C is wrong because VNet peering is correctly configured (the spoke is peered to the hub), and peering alone does not redirect traffic to the firewall—a route table with the firewall as next hop is required. Option D is wrong because Azure Firewall does not have a default route that bypasses itself; it uses the effective routes from its subnet, and a default route on the firewall would point to the internet via its public IP, which is normal and does not cause traffic to bypass the firewall.

Full explanation →

186

MCQmedium

A company uses Azure Front Door to accelerate and secure its public web application. The security team wants to limit the number of requests from a single client IP address to 100 per minute to prevent a single user from overwhelming the backend. Which configuration should they add to the Web Application Firewall (WAF) policy associated with the Front Door?

A.Add a custom rule with a rate limit condition.

B.Enable a managed rule set for the WAF policy.

C.Configure a bot protection rule set.

D.Set a geolocation filter to block all traffic except from allowed countries.

AnswerA

Azure Front Door's WAF supports custom rules with a rate limit condition, which tracks the number of requests from a client IP address within a defined time window (e.g., 60 seconds). Once the threshold is exceeded, you can specify an action such as Block to immediately drop subsequent requests until the window resets. This is the only option that directly implements per-IP request throttling to protect against aggressive scraping or brute-force attempts, making it the correct choice for the stated requirement.

Why this answer

Azure Front Door's WAF supports custom rate limit rules that can restrict the number of requests from a single client IP address within a specified time window. By creating a custom rule with a rate limit condition set to 100 requests per minute, the security team can prevent a single client from overwhelming the backend while allowing legitimate traffic. This is the only option that directly addresses the requirement to limit requests per client IP.

Exam trap

The trap here is that candidates often confuse rate limiting with bot protection or managed rule sets, assuming that enabling a managed rule set or bot protection will automatically handle request throttling, but neither provides per-IP rate limiting—they focus on attack signatures and bot detection, respectively.

How to eliminate wrong answers

Option B is wrong because enabling a managed rule set (e.g., OWASP or Microsoft default rule set) provides pre-configured signatures to block common web attacks like SQL injection or XSS, but it does not enforce per-IP request rate limits. Option C is wrong because bot protection rule sets are designed to identify and mitigate automated bot traffic (e.g., by categorizing known bots or detecting anomalies), not to cap the number of requests from a single client IP. Option D is wrong because a geolocation filter restricts traffic based on geographic origin (e.g., blocking all countries except allowed ones), which does not limit the request rate from any specific client IP.

Full explanation →

187

MCQhard

A custom Azure role should allow operators to restart virtual machines but not delete them or change networking. Which permission design is most appropriate?

A.Assign Contributor at the resource group scope

B.Create a custom role with Microsoft.Compute/virtualMachines/restart/action and required read permissions at the narrowest scope

C.Assign Virtual Machine Contributor at subscription scope

D.Assign Reader and ask operators to use Run Command

AnswerB

This is the correct approach because a custom role definition containing exactly Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/read provides only the control-plane action needed to restart a VM and the read permission required for the resource to be displayed and identified in Azure. By then assigning this custom role at the narrowest scope, such as the specific virtual machine resource, you guarantee operators cannot affect any other VM or resource. This satisfies the stated requirement while adhering to least privilege and is the most direct, security-focused solution.

Why this answer

It grants the specific 'restart/action' permission on virtual machines while excluding destructive actions like delete or network changes. Custom roles in Azure RBAC allow fine-grained control by including only the required data actions and read permissions, ensuring operators can restart VMs without the ability to delete them or modify networking.

Exam trap

The trap here is that candidates often confuse built-in roles like Contributor or Virtual Machine Contributor with the ability to restrict actions, not realizing these roles include delete and network write permissions that exceed the narrow restart-only requirement.

How to eliminate wrong answers

Option A is wrong because the Contributor role at any scope includes full management rights, allowing deletion and network changes, which violates the requirement. Option C is wrong because Virtual Machine Contributor at subscription scope includes permissions to delete VMs and modify networking (e.g., Microsoft.Network/*), exceeding the allowed actions. Option D is wrong because Reader only provides read access and does not include the restart action; Run Command is a separate feature that requires additional permissions and does not grant the restart capability.

Full explanation →

188

MCQeasy

A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?

A.Enable Azure Storage encryption with a customer-managed key (CMK)

B.Enable infrastructure encryption

C.Enable soft delete for the storage account

D.Enable Azure AD authentication for Blob Storage

AnswerA

Customer-managed keys (CMK) give you explicit control over the key hierarchy used to encrypt Azure Storage. Under envelope encryption, the CMK is a key encryption key (KEK) stored in Azure Key Vault that protects the data encryption key (DEK) used for blob encryption. Revoking or disabling the CMK in Key Vault causes Azure Storage to reject any attempt to decrypt the DEK, effectively making the data inaccessible almost immediately. This provides a deliberate, auditable kill switch that meets the requirement to block access on demand.

Why this answer

Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.

Exam trap

The trap here is that candidates often confuse soft delete (which protects against accidental deletion) with the ability to make data inaccessible via key revocation, or they assume infrastructure encryption or Azure AD authentication provide the same control as CMK, but only CMK with key revocation in Key Vault gives the customer direct, immediate control over data accessibility.

How to eliminate wrong answers

Option B is wrong because infrastructure encryption provides an additional layer of encryption at the storage infrastructure level using platform-managed keys, but it does not use customer-managed keys and does not allow the customer to revoke access to make data inaccessible. Option C is wrong because soft delete for the storage account protects against accidental deletion by retaining deleted data for a retention period, but it does not provide encryption with customer-managed keys or the ability to immediately make data inaccessible during a breach. Option D is wrong because Azure AD authentication for Blob Storage controls access to data via identity-based authorization, but it does not encrypt data at rest with customer-managed keys or provide a mechanism to revoke encryption keys to make data inaccessible.

Full explanation →

189

MCQmedium

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team wants to implement a continuous compliance monitoring solution using Microsoft Defender for Cloud's regulatory compliance dashboard. They need to monitor compliance against the 'CIS Microsoft Azure Foundations Benchmark' and 'PCI DSS v3.2.1'. Currently, the subscription has the 'Azure Security Benchmark' initiative assigned. You need to configure the compliance dashboard to show both CIS and PCI DSS standards. The subscription already has Microsoft Defender for Cloud's CSPM plan enabled. You have also enabled the 'Defender for Cloud' plan for servers. What should you do to meet the requirements?

A.Add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 policy initiatives to the regulatory compliance dashboard.

B.Enable the CIS benchmark in the Microsoft Defender for Cloud settings.

C.Enable Microsoft Defender for Cloud's regulatory compliance add-on.

D.Remove the Azure Security Benchmark initiative and assign the CIS and PCI DSS initiatives.

AnswerA

You can add multiple compliance standards by assigning their policy initiatives.

Why this answer

To add compliance standards to the regulatory compliance dashboard, you need to add the corresponding policy initiatives. Option A is correct because you can add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 initiatives to the existing dashboard without removing the Azure Security Benchmark. Option B is incorrect because the CIS benchmark is not a setting but a policy initiative that must be added.

Option C is incorrect because there is no separate regulatory compliance add-on; you add initiatives directly. Option D is incorrect because removing the Azure Security Benchmark is unnecessary and would cause loss of monitoring for that standard.

Full explanation →

190

MCQmedium

A company has several Azure virtual machines (VMs) in a VNet that host a legacy application. IT support staff need to perform remote administration using RDP. The security team wants to avoid exposing the VMs to the public internet and also enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions. Which Azure service should they deploy to meet these requirements?

A.Just-in-Time (JIT) VM Access from Microsoft Defender for Cloud

B.Azure Bastion

C.Network Security Groups (NSGs) with allow rules for RDP only from a trusted IP

D.Azure Firewall with DNAT rules to forward RDP traffic

AnswerB

Azure Bastion is correct because it provides RDP/SSH access directly in the Azure portal over TLS, so the VM never gets a public IP address and is never directly exposed to the internet. Since Bastion authenticates the user through Azure AD before launching the session, it natively integrates with Conditional Access, allowing you to enforce MFA as a prerequisite for any remote connection. This fulfills both stated requirements: no public IP exposure and mandatory MFA.

Why this answer

Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing the VMs to a public IP address. It also integrates with Azure AD and Conditional Access to enforce Azure Multi-Factor Authentication (MFA) for all RDP sessions, meeting both the security and compliance requirements.

Exam trap

The trap here is that candidates often confuse Just-in-Time (JIT) VM Access with MFA enforcement, but JIT only controls network-level access timing and does not natively enforce Azure MFA for the RDP session itself.

How to eliminate wrong answers

Option A is wrong because Just-in-Time (JIT) VM Access from Microsoft Defender for Cloud reduces the attack surface by locking down inbound traffic to VMs and granting timed access, but it does not natively enforce Azure MFA for the RDP session itself; MFA would need to be separately configured on the VM or via a different service. Option C is wrong because Network Security Groups (NSGs) with allow rules for RDP only from a trusted IP can restrict source IPs but cannot enforce Azure MFA; they operate at the network layer (Layer 3/4) and have no mechanism to require multi-factor authentication. Option D is wrong because Azure Firewall with DNAT rules can forward RDP traffic to internal VMs while hiding their private IPs, but it does not provide built-in MFA enforcement; MFA would require additional components like an RD Gateway or Azure AD Application Proxy.

Full explanation →

191

MCQhard

A company plans to enable Azure Disk Encryption (ADE) on a fleet of Windows virtual machines. They want to use a key stored in Azure Key Vault to encrypt the disks. Which additional access configuration must be made in the Key Vault to allow ADE to succeed?

A.Grant the Azure Disk Encryption service principal (Microsoft.Azure.Security) appropriate key permissions in the Key Vault access policy.

B.Assign a managed identity to each VM and grant that identity key permissions in the Key Vault.

C.Enable soft-delete and purge protection on the Key Vault.

D.Assign the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal.

AnswerA

ADE relies on the Azure Disk Encryption service principal to access the encryption key. You must grant this principal the 'get', 'wrapKey', and 'unwrapKey' permissions in the access policy.

Why this answer

Azure Disk Encryption (ADE) uses the Azure platform's built-in service principal (Microsoft.Azure.Security) to access the Key Vault and retrieve the disk encryption key. Without granting this service principal the necessary 'Get', 'WrapKey', and 'UnwrapKey' key permissions in the Key Vault access policy, ADE cannot authenticate and perform the encryption operations. This is a mandatory configuration step for ADE to succeed.

Exam trap

The trap here is that candidates often confuse the need to grant permissions to the VM's managed identity (Option B) with the actual requirement to grant permissions to the Azure Disk Encryption service principal, because ADE does not use the VM's identity to access the Key Vault.

How to eliminate wrong answers

Option B is wrong because assigning a managed identity to each VM and granting that identity key permissions is not the required access configuration for ADE; ADE uses the Azure platform service principal, not the VM's identity, to access the Key Vault. Option C is wrong because enabling soft-delete and purge protection is a recommended security feature for Key Vault but is not an additional access configuration required for ADE to succeed; ADE can work without these settings. Option D is wrong because assigning the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal grants management plane permissions (e.g., to modify the vault itself), not the data plane key permissions (e.g., WrapKey, UnwrapKey) that ADE needs to encrypt disks.

Full explanation →

192

MCQhard

Your company uses Azure Front Door to globally distribute traffic to a web app. You need to ensure that only traffic from Front Door can reach the web app, and all other traffic is blocked. The web app is behind an Azure Application Gateway. What is the most secure and reliable configuration?

A.Place the web app behind a private endpoint and connect Front Door via private link.

B.Use an NSG on the Application Gateway subnet with a deny-all rule and allow the AzureFrontDoor.Backend service tag.

C.Configure an NSG on the Application Gateway subnet to allow traffic only from the Front Door backend IP ranges.

D.Restrict the Application Gateway to only accept traffic from the Front Door frontend IP.

AnswerC

Front Door publishes backend IP ranges that can be used in NSGs.

Why this answer

Azure Front Door uses a set of backend IP ranges that are documented and change over time. By configuring an NSG on the Application Gateway subnet to allow traffic only from these specific IP ranges, you ensure that only Front Door-originated traffic reaches the Application Gateway, while all other traffic is blocked. This approach is reliable because it uses network-layer filtering that the Application Gateway subnet enforces, and it avoids the complexity of private endpoints or service tags that may not apply to the Front Door-to-Application Gateway path.

Exam trap

The trap here is that candidates often confuse the Front Door frontend IP (used by clients to reach Front Door) with the backend IP ranges (used by Front Door to reach the origin), leading them to choose Option D, which is incorrect because the Application Gateway receives traffic from Front Door's backend IPs, not its frontend IPs.

How to eliminate wrong answers

Option A is wrong because placing the web app behind a private endpoint and connecting Front Door via private link is not directly applicable here; Front Door does not support private link connectivity to an Application Gateway backend, and the web app is behind the Application Gateway, not directly exposed. Option B is wrong because the AzureFrontDoor.Backend service tag is not valid for use in NSG rules on the Application Gateway subnet; Front Door does not expose a service tag for its backend IPs, and using a deny-all rule with an incorrect service tag would block all traffic, including legitimate Front Door traffic. Option D is wrong because restricting the Application Gateway to accept traffic only from the Front Door frontend IP is impractical and insecure; Front Door frontend IPs are public and can change, and this approach would require constant updates and does not account for the fact that Front Door routes traffic through its backend IPs, not its frontend IPs, to the Application Gateway.

Full explanation →

193

MCQeasy

A company has multiple on-premises web applications that need to be securely published for remote employees. The company uses Azure AD for identity management and wants to apply Conditional Access policies, including multi-factor authentication, to these applications. The security team wants to avoid exposing the on-premises infrastructure to the internet directly. Which Azure service should they deploy to meet these requirements?

A.Azure Application Gateway

B.Azure Front Door

C.Azure AD Application Proxy

D.Azure VPN Gateway

AnswerC

Azure AD Application Proxy is the correct choice because it publishes on-premises web applications externally without opening inbound firewall ports: a lightweight connector runs inside the on-premises network and makes outbound connections to Azure AD, so the app never needs a public inbound path. It performs Azure AD pre-authentication at the cloud layer before any request reaches the on-premises application, enabling integration with Conditional Access policies and MFA. It also supports single sign-on to web apps via Kerberos constrained delegation, making it the purpose-built service for securely exposing on-premises apps to remote users.

Why this answer

Azure AD Application Proxy is the correct service because it provides secure remote access to on-premises web applications without requiring a VPN or opening inbound firewall ports. It integrates natively with Azure AD, enabling Conditional Access policies such as multi-factor authentication (MFA) to be applied to these applications. The service works by establishing an outbound-only connection from the on-premises Application Proxy connector to Azure AD, ensuring the on-premises infrastructure is never directly exposed to the internet.

Exam trap

The trap here is that candidates often confuse Azure AD Application Proxy with Azure Application Gateway or Azure Front Door, assuming any reverse proxy can secure on-premises apps, but only Application Proxy uses an outbound-only connector that keeps the internal network completely hidden from the internet.

How to eliminate wrong answers

Option A is wrong because Azure Application Gateway is a layer 7 load balancer and web application firewall (WAF) that typically requires the backend applications to be internet-facing or accessible via a public IP, which violates the requirement to avoid direct internet exposure. Option B is wrong because Azure Front Door is a global load balancer and content delivery network (CDN) that also requires the backend to be publicly reachable or connected via private link, but it does not provide the outbound-only connector model needed to keep on-premises infrastructure hidden. Option D is wrong because Azure VPN Gateway creates a site-to-site or point-to-site VPN tunnel, which exposes the on-premises network to the internet via the VPN endpoint and does not natively integrate with Azure AD Conditional Access or MFA for individual web applications.

Full explanation →

194

MCQhard

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They have configured the role activation to require Azure Multi-Factor Authentication and a support ticket number. However, users are reporting that they can activate the role without entering a ticket number. What is the most likely cause?

A.The 'Require ticket information on activation' setting is not enabled in the role settings

B.Users are activating through the Azure AD overview page instead of the PIM blade

C.The activation policy requires approval but the approvers ignore the ticket field

D.The role is configured for 'Active' assignment instead of 'Eligible'

AnswerA

The 'Require ticket information on activation' setting is a per-role toggle in PIM's role settings. When disabled, the activation flow omits the ticket number field entirely, so users can activate without supplying any justification. Even if the organization expects tickets, PIM will not enforce or even ask for one unless this specific setting is turned on. In the Azure portal, navigate to Privileged Identity Management > Roles > [Role] > Settings > Edit, and enable the 'Require ticket information on activation' checkbox per role.

Why this answer

The 'Require ticket information on activation' setting is a separate toggle in the PIM role settings that must be explicitly enabled. Even if the support ticket number field is displayed in the activation form, the system will not enforce its entry unless this specific setting is turned on. Without it, users can leave the field blank and still successfully activate the role.

Exam trap

The trap here is that candidates assume the presence of a ticket number field in the activation form means it is required, but PIM separates the UI display from the enforcement toggle, so the setting must be explicitly enabled for the field to be mandatory.

How to eliminate wrong answers

Option B is wrong because the Azure AD overview page does not provide role activation capabilities; all PIM activations must go through the PIM blade or the Azure AD Roles and Administrators blade, and the enforcement of ticket information is controlled by the role settings regardless of the entry point. Option C is wrong because if the activation policy requires approval, the approver's behavior does not override the system's enforcement of the ticket field; the system itself would block activation if the setting were enabled. Option D is wrong because the assignment type (Active vs.

Eligible) determines whether the user needs to activate the role at all, but it does not affect the enforcement of ticket information during activation; an Eligible assignment is required for PIM activation, but the ticket setting is independent.

Full explanation →

Microsoft Azure Security Engineer Associate AZ-500 (AZ-500) — Questions 151–194