Microsoft Azure Security Engineer Associate AZ-500 (AZ-500) — Questions 601–675

Which TWO of the following are authentication methods supported by Microsoft Entra ID?

A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?

You need to ensure that an Azure Storage account's blob data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. What should you do first?

Which TWO Azure services can be used to distribute incoming traffic across multiple virtual machines in a backend pool while providing layer 7 load balancing? (Choose two.)

You are configuring Microsoft Defender for Cloud for a multi-subscription environment. You need to ensure that security alerts are aggregated in a central location and that a single team can manage recommendations across all subscriptions. What should you use?

You need to monitor network traffic to detect anomalies and potential security threats. Which THREE Azure services can you use to achieve this? (Choose three.)

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement? (Choose TWO.)

Your organization uses Microsoft Defender for Cloud to protect Azure VMs. You notice that some VMs are not reporting security data. You verify that the Log Analytics agent is installed and running. What is the most likely cause?

Which THREE features are part of Microsoft Defender XDR (formerly Microsoft 365 Defender) integration with Microsoft Sentinel?

Your organization uses Microsoft Defender for Cloud to secure a multi-subscription environment. You have a subscription named 'Prod' that hosts critical applications. The security team requires that any new resource group created in the Prod subscription must automatically be protected by Microsoft Defender for Cloud at the 'Defender for Servers' plan P2 level. You need to implement a solution that ensures this compliance without manual intervention. You consider using Azure Policy, Azure Blueprints, or management group settings. Which option should you choose?

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

You are configuring Azure DDoS Network Protection for your VNet. Which TWO benefits does enabling DDoS Protection Standard provide?

You are investigating a security incident in Microsoft Sentinel. A KQL query returns results indicating that a user logged in from an IP address that is not in the organization's approved list. The user's account has been compromised. You need to automatically disable the user account in Microsoft Entra ID when such an alert is triggered. What should you configure?

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

Refer to the exhibit. You are evaluating an Azure Policy definition. What is the effect of this policy when assigned to a subscription?

You are configuring Microsoft Defender for Cloud to protect your Azure virtual machines. You need to enable just-in-time (JIT) VM access to reduce the attack surface. What prerequisite must be met?

Your company deploys Microsoft Sentinel for security operations. You need to configure just-in-time (JIT) access for Azure VMs. Which Azure security feature should you integrate with Sentinel?

A security analyst reports that a high-priority alert in Microsoft Sentinel for 'Malware detected on VM' was closed without investigation. You need to ensure that all alerts of severity High and above cannot be closed without adding a comment. What should you configure in Sentinel?

What is the primary purpose of this KQL query?

Which TWO actions can you perform using Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) feature? (Choose two.)

A company is migrating a sensitive database to Azure SQL Managed Instance. The security team requires that the managed instance is not accessible from the public internet and that only specific Azure services, such as Azure Data Factory, can connect. Which configuration should the team implement to meet these requirements?

A company has Azure AD Conditional Access policies that require multi-factor authentication (MFA) for all users accessing sensitive cloud apps. The security team wants to extend this protection by monitoring and controlling user activities within those applications (e.g., preventing data exfiltration during a session). Which Conditional Access session control should they implement?

You need to block outbound internet access from all VMs in a VNet except for specific allowed destinations (e.g., Microsoft updates). You cannot use a third-party NVA. Which Azure service should you use to meet this requirement?

A security operations team uses Microsoft Sentinel for security monitoring. They want to automatically create an incident and send an email to the on-call security engineer when a specific event occurs in Azure Activity Log, such as someone disabling a key vault firewall. Which automation feature should they configure?

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

A security operations team uses Microsoft Sentinel. They have created a playbook that sends an email notification to the security team when a high-severity incident is created by a specific analytics rule named 'CriticalRDPAccess'. They want the playbook to trigger automatically only when the incident has severity 'High' AND the incident was created by the rule named 'CriticalRDPAccess'. Which automation rule configuration should they use?

A company uses Microsoft Defender for Cloud to manage the security posture of their Azure workloads. The compliance officer needs to generate a report that shows the current compliance status against the SOC 2 standard, including the pass/fail status of each control. Which feature in Defender for Cloud should they use?

A company uses Defender for Servers Plan 2. Which two capabilities are included compared with a basic posture-only configuration?

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to investigate denied application rule traffic through Azure Firewall. The query returns no results, but you know that application rules are being applied and some traffic is being denied. What is the most likely cause?

A company has an Azure SQL Database that contains sensitive financial data. They want to audit all successful and failed login attempts for the database. What should they configure?

You have an Azure virtual machine that runs a line-of-business application. You need to ensure that the disks attached to the VM are encrypted at rest using platform-managed keys. What should you do?

Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?

Your organization has enabled Microsoft Defender for Cloud on all subscriptions. You need to ensure that the security score is improved by implementing recommendations. Which TWO actions would directly improve the secure score?

Your organization uses Microsoft Entra ID and wants to provide external partners with access to a specific SharePoint Online site. You need to ensure that partners authenticate using their own corporate credentials (SAML/WS-Fed) and that access is automatically revoked when the partner's account is disabled. Which solution should you use?

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

You need to configure Microsoft Defender for Cloud to automatically remediate misconfigurations in Azure resources. Which feature should you enable?

Your company uses Microsoft Sentinel to monitor security events. You need to detect brute-force attacks against Azure VMs that are not yet onboarded to Sentinel. What should you do?

Which two actions should you take to secure Azure Storage accounts against data exfiltration?

You have an Azure virtual machine that hosts a web application on port 443 and a management interface on port 8443. You need to allow inbound HTTPS traffic from the internet to port 443, and allow inbound traffic on port 8443 only from the company's office public IP range (203.0.113.0/24). You want to use a managed service that provides basic DDoS protection at no additional cost. What should you use?

You need to ensure that Azure SQL Database automatically detects and alerts on potential SQL injection attacks. Which Microsoft Defender for Cloud plan should you enable?

You run the above Kusto query in Azure Monitor Logs for an Azure Storage account. The query returns results showing multiple failed attempts to access PDF blobs with 403 errors from various IP addresses. What is the most likely cause of these failures?

Your company runs a critical application on Azure Virtual Machines. You need to ensure that the OS disks and data disks are encrypted to meet compliance requirements. The solution must use Azure Key Vault to store encryption keys and support automated backup. What should you implement?

You have an Azure subscription with a virtual network (VNet1) that hosts a SQL Managed Instance. You need to connect from an on-premises application to the SQL Managed Instance using a private IP address, with minimal latency and without traversing the public internet. The on-premises network has a high-speed ExpressRoute connection to Microsoft. What should you configure?

You need to ensure that Azure Disk Encryption (ADE) is enabled on all Azure VMs in a subscription. Which THREE actions are required to implement ADE? (Choose THREE.)

You are designing a hub-and-spoke network topology with Azure Firewall in the hub VNet. Which TWO components are essential for routing traffic from spoke VNets through the firewall? (Choose two.)

Your company uses Microsoft Defender for Cloud to protect Azure resources. You notice that some Azure VMs are not showing any security recommendations. You verify that the VMs are running and have network connectivity. What is the most likely cause?

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Which TWO actions can you perform using Microsoft Defender for Cloud's 'Security Alerts' page?

Your organization uses Microsoft Entra ID. You need to recommend solutions to reduce the risk of privileged role abuse. Which TWO actions should you recommend? (Choose two.)

Your company uses Microsoft Defender for Cloud with the default auto-provisioning configuration. A security engineer reports that critical vulnerabilities in Azure Virtual Machines are being detected but not automatically remediated. The engineer wants to enable automatic remediation for all supported findings. What should the engineer configure?

A healthcare company stores sensitive patient data in Azure SQL Database. They want to encrypt specific columns containing Personally Identifiable Information (PII) so that even database administrators cannot view the data. The security team also needs to perform equality searches (e.g., WHERE SSN = '123-45-6789') on the encrypted columns. Which encryption technology should they implement?

A company uses Azure SQL Database with Azure Active Directory authentication. To meet compliance requirements, they need to audit all failed login attempts and store the audit logs in a storage account located in a different Azure region for disaster recovery. What should they configure?

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Choose three.)

You are troubleshooting connectivity issues from an Azure VM to an on-premises server. The VM is in a VNet that uses a custom DNS server. The on-premises network is connected via ExpressRoute. You can ping the on-premises server by IP address but not by name. What is the most likely cause?

A company has an Azure virtual network with two subnets: Frontend and Backend. They deploy a network virtual appliance (NVA) in a subnet named NVA_Subnet. They want to route all traffic from the Frontend subnet to the Backend subnet through the NVA for inspection. What is the minimum number of route tables required to achieve this traffic steering?

Which TWO services can be used to filter traffic between virtual networks in Azure? (Choose two.)

Which TWO types of data can Microsoft Sentinel ingest from Microsoft Defender XDR?

Which TWO of the following are required to implement a successful Just-In-Time (JIT) access strategy using Microsoft Entra Privileged Identity Management (PIM) for Azure resources?

You have a Microsoft Sentinel workspace that ingests data from multiple sources, including Azure Activity, Microsoft Entra ID, and Azure Firewall. You need to create a custom analytics rule that detects when a user signs in from an IP address that has been flagged as malicious in a threat intelligence feed. You have already imported threat intelligence indicators into Sentinel using the 'Threat Intelligence - TAXII' data connector. The threat intelligence indicators are stored in the 'ThreatIntelligenceIndicator' table. Which KQL function should you use in the analytics rule to match sign-in logs against the threat indicators?

Security analysts in your company use Microsoft Sentinel to manage incidents. They want to automatically assign any incident with a severity of 'High' or 'Critical' to the senior analyst on duty. Which Microsoft Sentinel feature should they configure to accomplish this?

Which THREE are valid methods to ingest data into Microsoft Sentinel? (Select three.)

A company has a hub-spoke network topology in Azure. The hub virtual network contains an Azure Firewall. Spoke virtual networks are peered to the hub. The security team wants to inspect all traffic between virtual machines in different spoke virtual networks. What is the minimum configuration required?

An organization has deployed Microsoft Sentinel as their SIEM. They need to ingest audit logs from their Amazon Web Services (AWS) environment, including CloudTrail logs. Which data connector should they use in Microsoft Sentinel to collect these logs?

Refer to the exhibit. You are evaluating an Azure Policy definition that enables Defender for Cloud on a subscription. The policy uses 'DeployIfNotExists' effect. Which role must be assigned to the managed identity used by this policy to successfully deploy the pricing resource?

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to restrict a user to only view data from the 'Sales' schema, without granting permissions to other schemas. What should you do?

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

You need to restrict access to a storage account containing sensitive financial data. The storage account is used by multiple Azure VMs and Azure App Service web apps. Only authorized applications and users should be able to access the storage account. Which TWO options should you implement?

A company uses Microsoft Defender for Cloud to protect Azure resources. The security team wants to automatically remediate certain recommendations without manual intervention. They decide to use Azure Policy to enforce secure configurations. Which feature in Defender for Cloud allows them to create policy assignments directly from the recommendation?

Your organization uses Azure Files shares with Azure AD DS authentication. You need to ensure that users can access the file share from on-premises Windows clients using their on-premises AD credentials, without exposing the storage account to the internet. The on-premises network is connected to Azure via a site-to-site VPN. What should you configure?

A small business has a single Azure subscription with one virtual network containing two subnets: 'Frontend' for web servers and 'Backend' for database servers. The web servers need to access the internet to download updates, but the database servers must not have any outbound internet access. The business also needs to allow remote administration of the web servers from the internet via RDP (port 3389) but only from the IT department's public IP range (203.0.113.0/24). You need to configure network security to meet these requirements using Azure-native services. What should you do?

Which TWO of the following data connectors are available by default in Microsoft Sentinel?

Which THREE Microsoft Entra ID roles can be assigned to a user to manage Microsoft Defender XDR (formerly Microsoft 365 Defender) incidents? (Choose three.)

You are designing network security for a multi-tier application. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. Both tiers are in the same virtual network. Which Azure service should you use to restrict traffic between the tiers?

You are a security engineer for a large enterprise that uses Azure Virtual WAN with multiple ExpressRoute circuits connecting on-premises data centers to Azure. The company has recently acquired a subsidiary that uses a different Azure tenant. The subsidiary has its own virtual networks and wants to connect to the parent company's Azure Virtual WAN to share resources. The security requirement is that traffic must be encrypted over the public internet, and the connection must be established without any on-premises hardware. You need to recommend a solution to securely connect the subsidiary's Azure virtual network to the parent's Virtual WAN. The solution should minimize administrative overhead and use Azure-native services.

A company uses Azure Firewall to inspect traffic between a spoke VNet hosting a web application and a hub VNet hosting a SQL database. The web application fails to connect to the database after a recent network topology change. You verify that the Azure Firewall rules allow the traffic. Which Azure Network Watcher feature should you use to identify the root cause?