Microsoft Azure Security Engineer Associate Practice Test (AZ-500)

Configuring instance-level auditing sends audit logs for every current and future database in the managed instance. By selecting Log Analytics as the audit target, the logs are written directly to the existing workspace, allowing centralized analysis with other Azure Monitor data. Database-level auditing must be enabled separately for each database and would not automatically cover new databases. Advanced Threat Protection produces security alerts but does not create audit records. Diagnostic settings for SQL Insights export performance metrics, not detailed audit events.

Azure DDoS Protection Standard is designed for internet-facing resources that could suffer large-scale network attacks and where rapid, SLA-backed mitigation, cost protection, and access to the DDoS Rapid Response team are valuable. A payment-processing web app exposed through public IP addresses matches these criteria. Development/test VMs, private-only endpoints, and workloads already fronted by a service such as Azure Front Door Premium either have lower risk or include their own edge-level protection, so purchasing the standalone DDoS Standard service is usually unnecessary.

Key Vault Secrets Officer grants permission to list, get, set, and delete secrets within a specific vault but does not allow modification of access policies, keys, or the vault itself. Assigning the role at the Key Vault scope limits the service principal to exactly the resource it must manage. Key Vault Administrator or Contributor would allow broader management capabilities that are unnecessary for the pipeline, and Key Vault Reader cannot create or update secrets.

Enabling a virtual network service endpoint for the Microsoft.Sql service on ProdSubnet extends the subnet's identity to Azure SQL Database over the Azure backbone. Service-endpoint traffic ignores user-defined routes, so SQL packets bypass the 0.0.0.0/0 route to the NVA while all other outbound traffic still follows the existing route table. NAT gateway would override the UDR for all traffic, a private endpoint would not require removing the UDR, and adding a specific Internet route would send traffic over the public Internet rather than the backbone.

Microsoft Defender for Cloud lets you create alert suppression rules that automatically dismiss specific alert types when they match defined conditions, such as particular source IP addresses. By creating a suppression rule scoped to the "Brute force attack against an Azure virtual machine" alert and listing the penetration-testing IP range as the matching entity, the alert will be silently dismissed only for that traffic. Disabling recommendations, excluding the VMs from secure score, or crafting separate Azure Monitor alert rules do not prevent Defender for Cloud from producing the original security alert for other sources.

In an Azure custom role, the Actions array grants permissions, while the NotActions array explicitly excludes operations that would otherwise be allowed. Cloning the Contributor role includes broad permissions such as Microsoft.Compute/virtualMachines/delete by default. To keep all Contributor capabilities except VM deletion, list Microsoft.Compute/virtualMachines/delete in the NotActions property. Removing the operation from Actions is ineffective because inherited wildcard entries (such as Microsoft.Compute/*) still grant it. DataActions and NotDataActions apply only to data-plane operations, so they do not affect management-plane actions like VM deletion. Therefore, placing Microsoft.Compute/virtualMachines/delete in NotActions is the correct approach.

Microsoft Entra (Azure AD) authentication cannot be enabled in a database until an Entra administrator has been assigned at the logical server or managed-instance level. The administrator account is used to establish the first token-based connection and to create or manage subsequent Entra principals inside the databases. Enabling Azure AD-only authentication is optional, because mixed (SQL and Entra) authentication is permitted. Database containment is already set to PARTIAL for every Azure SQL Database, so no additional work is required. Firewall rules control network access but have no bearing on the ability to create Entra principals.

An App Service managed certificate is a free, domain-validated TLS certificate that App Service issues and renews automatically, so it meets the zero-cost and no-downtime renewal requirement. After creating the managed certificate and binding it to the custom domain, you can enforce the required protocol strength by setting the web app's Minimum TLS Version setting to 1.2. Uploading or referencing a third-party certificate incurs purchase costs and manual renewal, and an App Service Environment is unnecessary for these goals.

A private AKS cluster places the API server behind a private endpoint in the node resource group's virtual network, removing any public-facing endpoint. When the cluster is configured with the Azure CNI network plugin, every pod receives an IP address from the virtual network subnet, allowing direct, routable communication to other resources in that subnet without requiring SNAT. Public clusters with authorized IP ranges still expose the API server over the Internet, Kubenet relies on source NAT for pod egress, and an Application Gateway Ingress Controller secures application ingress but does not hide the control-plane endpoint.

Agentless vulnerability assessments in Microsoft Defender for Cloud take snapshots of VM disks and use cloud APIs for out-of-band analysis, so no software is installed or executed inside the guest operating system. This capability is available when Microsoft Defender for Servers Plan 2 (which includes Microsoft Defender Vulnerability Management) is enabled. Defender for Servers Plan 1 can also produce vulnerability findings, but only through agent-based methods that install the Log Analytics agent or the Qualys/MDVM extension inside each VM, violating the stated constraint. Likewise, manually installing the Qualys extension or onboarding the machines to Microsoft Defender for Endpoint would place additional agents in the guest OS and therefore do not meet the requirement.

Azure Bastion connects to the target VM over its private network using the standard management port (TCP 3389 for Windows). The traffic originates from an address inside the same virtual network, which is represented in NSG and JIT rules by the VirtualNetwork service tag. Therefore, the JIT rule should open TCP port 3389 only for the VirtualNetwork tag. Allowing the Internet tag would expose the port publicly, opening port 443 would not let Bastion reach the VM, and opening port 22 targets SSH rather than RDP.

Soft delete for blobs protects data from accidental deletes or overwrites by retaining a recoverable copy for a configurable period of 1-365 days. Because the feature operates entirely within the storage service, client applications need no modification. Blob versioning retains every version unless you add lifecycle rules, potentially increasing storage costs. Immutable storage prevents any updates during the retention window, which would block legitimate writes. Adding snapshot logic requires code changes, violating the requirement.

A policy exemption is designed for temporary or permanent waivers when a resource cannot meet a policy requirement. When an exemption is applied to a specific scope, resources in that scope are excluded from compliance evaluation results, yet the original assignment and its auditing history remain intact and can be re-enabled at any time. Placing the policy inside an initiative does not exclude the resource groups; it only groups definitions. Granting the Policy Contributor role changes who can edit policies, not how they are evaluated. Creating a second assignment with the Disabled effect at a lower scope does not override a Deny assignment at a higher scope because Deny has higher precedence than Disabled.

The Azure Policy add-on for AKS installs the Gatekeeper admission controller in the cluster. Gatekeeper evaluates every resource request against the Azure Policy assignments that target the cluster, can deny non-compliant manifests during admission, and reports compliance data back to Azure Policy and Defender for Cloud. Container Insights only collects metrics and logs. Upstream Pod Security Admission is not integrated with Azure Policy or Defender for Cloud, and enabling Defender for Cloud at the subscription level does not itself block non-compliant deployments inside the cluster.

When Azure Storage is configured to use a customer-managed key, the storage service needs to call Azure Key Vault to wrap and unwrap data-encryption keys. The identity that represents the storage service (Microsoft Storage service principal or the storage account's managed identity) therefore needs Key Vault permissions. Specifically, the storage service must be able to:

• Read the current version of the key (Get)
• Wrap and unwrap data-encryption keys (Wrap Key and Unwrap Key)

Granting these three permissions (Get, Wrap Key, Unwrap Key) via an access policy or Azure RBAC role assignment is a required step before you can select the key for BYOK. Enabling soft-delete, uploading the key as a secret, or restricting the firewall are optional or unrelated to allowing Storage to use the key, so they do not satisfy the requirement.

The Security Reader role grants read-only access to security-related information such as Microsoft Defender for Cloud recommendations, secure score, and Azure AD Identity Protection data. It does not permit any configuration changes. The Reader role can view most Azure resources but lacks permissions for many Microsoft.Security actions, so it may not display all security findings. Security Admin includes write permissions to security settings, which is more access than required. Global Reader is an Azure AD role that provides directory-wide read-only access but does not extend to Defender for Cloud data at the subscription level.

Container lifecycle and resource-limit violations (for example, a container being killed because it ran out of memory) are surfaced as Kubernetes-style events in the ContainerInstanceEvents diagnostic log category. Streaming this category to Log Analytics lets you query for events whose reason equals "OutOfMemory" (or similar) and build an alert. Console output is captured by ContainerInstanceLogs, and there are no categories named ContainerGroupInsights or ContainerSystemLogs for Azure Container Instances.

Virtual Machine Contributor grants rights to create, start, stop, restart, and delete virtual machines and the resources required for them, but it does not permit managing role assignments. Because it is scoped to virtual-machine resources only, it satisfies the least-privilege requirement. Contributor would permit dev1 to manage every resource type in RG1, which is broader than necessary. Owner includes full access plus the ability to delegate permissions, violating the restriction on access management. User Access Administrator can manage role assignments but cannot perform VM operations. Therefore, Virtual Machine Contributor is the correct role.

Because virtual network gateway route propagation is disabled, the BGP-learned prefix 172.16.0.0/16 is not added to the subnet's effective routes. The only matching entry is the user-defined default route, so traffic is sent to the firewall and then dropped. Re-enabling gateway route propagation adds the more specific 172.16.0.0/16 route (next hop Virtual network gateway). Longest-prefix match then directs traffic for 172.16.0.0/16 through the VPN gateway, while all other traffic continues to follow the 0.0.0.0/0 default route through the firewall. The other options either still forward the on-premises traffic to the firewall or remove the desired forced-tunnelling behaviour.

Application Security Groups (ASGs) let you group NICs logically and reference those groups as the source and destination in a single NSG rule. Because membership is evaluated by NIC association at runtime, rules do not change when VMs scale or receive new IP addresses. Creating one ASG for the application VMs and another for the database VMs, then adding a single NSG rule that allows TCP 1433 from the application ASG to the database ASG, meets the requirement with minimal ongoing maintenance. The other options rely on static IP addresses, grant overly broad access, or add unnecessary infrastructure.