AZ-500: Azure Security Engineer Associate Practice Exam

What the AZ-500 exam covers

• Manage Identity and Access242 questions
• Implement Platform Protection226 questions
• Manage Security Operations229 questions
• Secure Data and Applications241 questions

Free AZ-500 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 938.

1. Question 1Manage Identity and Access

   A company has recently migrated to Microsoft Entra ID and wants to ensure that all employees must register for multi-factor authentication within 14 days of their first sign-in. The security team also wants to exclude a break-glass emergency access account from this requirement. Which approach should the security engineer take?

   • AAssign an Azure Policy 'DeployIfNotExists' initiative that enforces MFA registration on all user objects and exempts the break-glass account from the assignment scope
   • BConfigure a Conditional Access policy that blocks sign-in after 14 days for users who have not completed MFA registration, and exclude the break-glass account from the block
   • CCreate a Conditional Access policy requiring MFA registration for all users, exclude the break-glass account, and set a 14-day registration grace period using the Microsoft Entra ID Protection MFA registration policyCorrect
   • DEnable legacy per-user MFA for every account in the tenant, then manually disable the MFA state on the break-glass account after the 14-day window elapses
   ✓ Correct answer: C

   The Microsoft Entra ID Protection MFA registration policy is purpose-built to drive initial MFA enrollment. It prompts unregistered users to set up authentication methods and enforces a configurable grace period (such as 14 days) during which sign-in continues before registration becomes mandatory. Because it is implemented as a policy in Entra ID, it supports user and group scoping so a break-glass emergency account can be explicitly excluded, preserving guaranteed access if all other admins are locked out. This combination of phased enrollment, grace period, and exclusion is exactly what the scenario requires.

   Why the other options are wrong

   • AAzure Policy governs Azure Resource Manager resources and cannot enforce MFA registration on Entra ID user objects; identity enrollment is driven by the ID Protection registration policy, not by DeployIfNotExists.
   • BBlocking sign-in after 14 days evicts users instead of prompting registration; the requirement is to make users register within a grace period, which the registration policy delivers rather than a hard block.
   • DPer-user MFA has no concept of a 14-day registration grace period, is being deprecated in favor of Conditional Access, and manual toggling per account does not scale or meet the grace-period requirement.
2. Question 2Manage Identity and Access

   Fourth Coffee needs to delegate management of users and groups in specific departments without granting tenant-wide administrative rights. Which Microsoft Entra ID feature should they use?

   • AAdministrative unitsCorrect
   • BManagement groups
   • CAccess packages
   • DCustom RBAC roles
   ✓ Correct answer: A

   Microsoft Entra administrative units enable scoped administration by limiting the scope of administrative permissions to specific organizational units. Instead of making an administrator a global admin with permissions across the entire tenant, organizations can assign administrators to manage only the users and groups within their assigned administrative units. This implements the principle of least privilege by ensuring that department managers or regional administrators have only the permissions necessary for their specific organizational areas. Administrative units support nested organizational structures and can be used in combination with custom RBAC roles to create granular governance models.

   Why the other options are wrong

   • BManagement groups is incorrect because these are Azure-specific constructs used to organize subscriptions for governance and policy enforcement, not for scoping Microsoft Entra ID administrative permissions.
   • CAccess packages is incorrect because these are used for entitlement management and provisioning access through templated packages, not for delegating administrative permissions.
   • DCustom RBAC roles is incorrect because while custom roles can define specific permissions, they do not provide organizational unit scoping without administrative units.
3. Question 3Implement Platform Protection

   Wide World Importers runs containerized workloads on Azure Kubernetes Service (AKS). The security team needs to restrict pod-to-pod communication so that only the front-end pods can communicate with the API pods. What should they implement?

   • AAzure Private Link for the API pods
   • BService mesh with mutual TLS only
   • CAzure Network Security Groups on the AKS subnet
   • DKubernetes network policiesCorrect
   ✓ Correct answer: D

   Kubernetes network policies are the native mechanism for implementing micro-segmentation and controlling traffic between pods within a cluster. Network policies allow you to define ingress and egress rules based on pod labels, namespaces, and ports, enabling fine-grained control over pod-to-pod communication. In this scenario, you would create a network policy that allows front-end pods to communicate with API pods on specific ports while denying all other pod-to-pod traffic, providing application-level network isolation.

   Why the other options are wrong

   • AAzure Private Link for the API pods is incorrect because Private Link is used for accessing Azure PaaS services from private networks; it does not control pod-to-pod communication within a cluster.
   • BService mesh with mutual TLS only is incorrect because while a service mesh provides additional capabilities, mutual TLS alone does not restrict pod-to-pod communication-you need network policies for that restriction.
   • CAzure Network Security Groups on the AKS subnet is incorrect because NSGs operate at the subnet level and cannot distinguish between individual pods; they cannot enforce the granular pod-to-pod communication rules required.
4. Question 4Manage Security Operations

   The IT team at Fabrikam Residences receives a Microsoft Defender for Cloud alert indicating a suspicious process execution on one of their Azure VMs running Windows Server. Which Defender for Cloud feature should they use to investigate the full attack chain?

   • AAzure Advisor security recommendations
   • BAzure Network Watcher packet capture
   • CAzure Service Health
   • DSecurity alert investigation graph (attack path analysis)Correct
   ✓ Correct answer: D

   Microsoft Defender for Cloud's security alert investigation graph provides a visual representation of the attack chain, showing how an attacker progressed from initial suspicious activity through increasingly privileged actions. This feature displays the relationship between alerts, affected resources, and attack progression, enabling security teams to understand the complete scope of the attack and identify all compromised or at-risk resources.

   Why the other options are wrong

   • AAzure Advisor security recommendations is incorrect because it provides general hardening recommendations rather than attack chain investigation.
   • BAzure Network Watcher packet capture is incorrect because while useful for network forensics, it does not specifically show attack chain progression.
   • CAzure Service Health is incorrect because it shows service availability status rather than security investigation capabilities.
5. Question 5Secure Data and Applications

   You are implementing Azure Key Vault access policies. An application needs to read secrets but should not be able to delete or create them. Which permission should you grant?

   • ASecret Management (full permissions including create, delete, list, get)
   • BSecret Get and List permissions onlyCorrect
   • CKey Vault Contributor RBAC role
   • DKey Vault Administrator RBAC role
   ✓ Correct answer: B

   Azure Key Vault access policies support granular permission management at the secret level. For an application that needs read-only access to secrets without modification capabilities, granting only the Get permission (retrieve secret values) and List permission (enumerate secrets) provides the minimum necessary access. This principle of least privilege prevents the application from performing sensitive operations like creating, updating, or deleting secrets.

   Why the other options are wrong

   • ASecret Management (full permissions including create, delete, list, get) is incorrect because it grants excessive permissions including delete and create operations not required for read-only access.
   • CKey Vault Contributor RBAC role is incorrect because Contributor roles provide too many permissions and are not appropriate for read-only secret access.
   • DKey Vault Administrator RBAC role is incorrect because Administrator roles grant full permissions incompatible with read-only access requirements.
6. Question 6Implement Platform ProtectionSelect all that apply

   Litware Inc wants administrators to reach management ports on its virtual machines over TLS from the Azure portal without exposing RDP or SSH to the internet, and to open those ports only for a limited window when access is explicitly requested. Which TWO capabilities should the administrator configure? (Choose two.)

   • AAzure BastionCorrect
   • BJust-in-time VM access in Defender for CloudCorrect
   • CAzure Firewall DNAT rules to public IPs
   • DA site-to-site VPN gateway
   • EPublic IP addresses on each VM
   ✓ Correct answer: A, B

   Azure Bastion lets administrators connect to VM RDP and SSH sessions over TLS directly in the portal without assigning public IPs or exposing those ports to the internet. Just-in-time VM access in Microsoft Defender for Cloud keeps the management ports closed and opens them through an NSG rule only for an approved requester and time window. Using both delivers private, on-demand administrative access.

   Why the other options are wrong

   • CAzure Firewall DNAT rules translating to public IPs would still publish the management ports to the internet, the opposite of the requirement.
   • DA site-to-site VPN gateway connects networks but does not itself provide brokered TLS console access or time-limited port opening.
   • EAssigning public IP addresses to each VM directly exposes management ports and increases the attack surface.
7. Question 7Secure Data and Applications

   When configuring SAS token best practices at Lucerne Publishing, administrators must also consider Microsoft Purview for data as part of the overall architecture.

   • TrueTrueCorrect
   • FalseFalse
   ✓ Correct answer: True

   Microsoft Purview for data must be considered when implementing SAS token best practices. At publishing organizations, SAS token configuration must align with Purview's data governance policies to ensure that temporary access tokens comply with organizational data classification and sensitivity requirements. Purview provides the governance framework that informs which data can be accessed via SAS tokens and under what conditions.

   Why the other options are wrong

   • FalseFalse is incorrect. The statement is true. Microsoft Purview for data must be considered when implementing SAS token best practices. At publishing organizations, SAS token configuration must align with Purview's data governance policies to ensure that temporary access tokens comply with organizational data classification and sensitivity requirements.
8. Question 8Secure Data and Applications

   A regulated workload requires that the cryptographic keys used to encrypt Azure Storage data never leave a FIPS 140-2 Level 3 single-tenant boundary that the customer fully controls, and that Microsoft cannot access the keys. Which Azure service should hold the keys?

   • AAzure Key Vault Managed HSMCorrect
   • BAzure Key Vault Standard tier (software-protected keys)
   • CAzure Key Vault Premium tier (multi-tenant HSM-backed keys)
   • DAzure Storage Microsoft-managed keys
   ✓ Correct answer: A

   Managed HSM is a fully managed, highly available, single-tenant service that uses FIPS 140-2 Level 3 validated HSMs. Keys are isolated to the customer's pool, and Microsoft has no access to the key material, satisfying strict regulatory custody requirements.

   Why the other options are wrong

   • BStandard tier protects keys in software, not in a FIPS 140-2 Level 3 HSM.
   • CPremium tier uses HSM-backed keys but in a multi-tenant HSM, not a single-tenant boundary fully controlled by the customer.
   • DMicrosoft-managed keys are controlled by Microsoft, which directly violates the requirement that Microsoft cannot access the keys.
9. Question 9Implement Platform Protection

   A WAF policy on Application Gateway is in Prevention mode using the OWASP managed rule set. Legitimate API requests that include a large JSON body are being blocked by a SQL injection rule that misfires on a specific field. Security wants to stop blocking that pattern while keeping the rest of the managed rule set fully enforced. What is the best action?

   • ACreate a managed rule exclusion scoped to the specific request attribute, or disable only the individual offending rule by its rule IDCorrect
   • BSwitch the entire WAF policy to Detection mode so requests are logged but never blocked
   • CRemove the OWASP managed rule set and rely solely on hand-written custom rules for protection
   • DRaise the maximum request body inspection size limit on the WAF policy to admit the large payload
   ✓ Correct answer: A

   The OWASP managed rule set supports granular tuning: you can add an exclusion that tells the WAF to skip inspection of a named header, cookie, or argument, or you can disable a single rule by its rule ID. Either approach addresses the false positive on that one field while every other rule continues to protect the application in Prevention mode.

   Why the other options are wrong

   • BDetection mode stops blocking every request across the whole policy, disabling protection entirely; the requirement is to keep the rest of the managed rule set enforcing while excluding one pattern.
   • CDeleting the managed rule set throws away broad OWASP coverage to fix a single false positive; a targeted exclusion or rule disable removes only the misfiring rule.
   • DThe block is a SQL injection signature misfiring on field content, not a size limit; increasing the body size limit does not stop the specific rule from flagging that pattern.
10. Question 10Manage Security OperationsSelect all that apply

    A security engineer must connect Microsoft Sentinel to a third-party firewall that emits Common Event Format (CEF) messages over syslog. Which TWO components are required so the events reach the Sentinel workspace using the current recommended architecture? (Choose two.)

    • AA Linux machine running the Azure Monitor Agent configured as a log forwarderCorrect
    • BA data collection rule that defines the CEF/syslog stream and destination workspaceCorrect
    • CThe on-premises data gateway installed on the firewall
    • DA self-hosted integration runtime registered to the workspace
    ✓ Correct answer: A, B

    In the AMA-based architecture, the firewall sends CEF over syslog to a Linux log-forwarder VM running the Azure Monitor Agent. A data collection rule tells the agent which facilities/severities to collect and routes the parsed CEF records to the Sentinel (Log Analytics) workspace, where they appear in CommonSecurityLog.

    Why the other options are wrong

    • CThe on-premises data gateway is used by Logic Apps and Power Platform connectors, not for CEF/syslog ingestion into Sentinel.
    • DThe self-hosted integration runtime is an Azure Data Factory/Synapse component and has no role in CEF collection.

Related Microsoft resources

• AZ-500 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-500 practice exam FAQ