Microsoft Azure Security Engineer Associate Practice Test (AZ-500)

Defender for Cloud can only expose a custom regulatory compliance standard when the underlying Azure Policy initiative already exists and is discoverable at the same scope. The initiative has to be created (or uploaded) in Azure Policy, assigned at the Finance management-group scope, and marked with the Regulatory Compliance category. Without this specific initiative definition in place, the Add custom standard wizard has nothing to attach to, so the standard cannot be created. Enabling higher-tier Defender plans, granting additional RBAC roles, or simply tagging individual policies does not meet this prerequisite.

A connectivity configuration in Azure Virtual Network Manager defines how virtual networks in one or more network groups connect to each other. When you choose the mesh topology and deploy the configuration to a region, VNets in the targeted network group are automatically connected by peering links. Security admin rule collections only control traffic; they do not establish connectivity. Hub-and-spoke connections require a designated hub and do not deliver a full mesh automatically, and Azure Virtual WAN hubs are a separate service that is not managed through Virtual Network Manager for VNet-to-VNet peering.

A policy exemption is designed for temporary or permanent waivers when a resource cannot meet a policy requirement. When an exemption is applied to a specific scope, resources in that scope are excluded from compliance evaluation results, yet the original assignment and its auditing history remain intact and can be re-enabled at any time. Placing the policy inside an initiative does not exclude the resource groups; it only groups definitions. Granting the Policy Contributor role changes who can edit policies, not how they are evaluated. Creating a second assignment with the Disabled effect at a lower scope does not override a Deny assignment at a higher scope because Deny has higher precedence than Disabled.

Always Encrypted encrypts designated columns in the client driver before the data reaches Azure SQL Database. Because the encryption keys never leave the client application, the database engine, administrators, and Microsoft personnel cannot view the plaintext data. Using deterministic encryption allows the service to evaluate equality predicates, so existing queries such as WHERE Column = @value continue to work with little or no code change. Transparent Data Encryption protects files and backups on disk only, leaving data visible to anyone who can query the database. Dynamic Data Masking merely obfuscates query results and can be bypassed by privileged users. Row-level security restricts which rows a user can access but does not encrypt the data. Therefore, Always Encrypted with deterministic encryption is the only feature that meets every requirement.

Security admin rules in Azure Virtual Network Manager are evaluated before subnet-level NSG rules and apply to every network that belongs to the selected network group, regardless of subscription. Creating a deny, outbound security admin rule that targets the malicious IP addresses meets the requirement in a single configuration step and does not require modifying individual NSGs. User-defined routes or Azure Firewall would need additional routing changes in every virtual network, and NSG rules referencing an application security group would still have to be added to each NSG individually.

Azure Firewall evaluates rule collections in order of priority, starting with the lowest numerical value. Because Deny-Internet has a lower priority number (100) than Allow-Internal (200), traffic to 10.5.0.4 first matches the broader deny rule and is blocked. Lowering the priority number of Allow-Internal places the allow rule ahead of the deny rule, so packets destined for 10.0.0.0/8 are accepted, and traffic that does not match that prefix continues to be denied by the subsequent Deny-Internet rule. Converting Deny-Internet to an application rule or adding an application rule would not help because network rules are evaluated before application rules. Forced tunneling does not affect intra-virtual-network traffic and would not resolve the issue.

DeployIfNotExists (and Modify) effects rely on the managed identity that is automatically created (or supplied) when the policy assignment is made. During remediation, this identity runs the ARM deployment that adds the required diagnostic setting. If the assignment was created without a managed identity, or with an identity that lacks write permissions such as Contributor on the target scope, any deployment triggered by remediation will be rejected and surface as Unauthorized. Changing the effect, modifying the scope, or waiting for compliance will not grant the necessary permissions, so those actions would not resolve the failure.

For Azure Container Apps, runtime threat detection is provided by Microsoft Defender for Containers. Merely onboarding a subscription to Microsoft Defender for Cloud does not automatically enable any Defender plans. You must explicitly enable the Microsoft Defender for Containers plan at the subscription or resource-group level. Once the plan is enabled, Defender instruments the Container Apps environment and can raise security alerts for suspicious processes, reverse shells, crypto-mining, and other threats. Enabling diagnostic logs, deploying the apps to an App Service Environment, or configuring egress filtering can improve observability or network security but will not activate Defender's runtime analysis or generate the required alerts.

Application Security Groups (ASGs) let you attach VM NICs to logical groups and reference those groups in NSG rules. Create one ASG for the web tier and one for the app tier, then:

• On the NSG for WebSubnet, add an inbound rule that allows source Internet to destination Web-ASG on TCP 443.
• Add a rule that allows traffic from Web-ASG to App-ASG on TCP 8080; the stateful NSG permits the return traffic automatically.
• On the NSG for AppSubnet, add a high-priority deny outbound rule that blocks any destination Internet or Web-ASG, satisfying the isolation requirement. Because new VM instances are automatically added to their ASG when the scale set grows, no extra rules are needed, meeting the minimal-rule and autoscaling requirements. CIDR-based rules, Azure Firewall, or Virtual Network Manager security admin rules would meet the traffic requirements but add unnecessary maintenance or cost.

EASM needs at least one "seed" that represents something your organization already owns on the public Internet. You supply that seed by creating a discovery group and adding one or more root assets (for example, a domain name such as contoso.com, an IP address, or an IP range). The EASM discovery engine then pivots from those seeds-using data sources such as DNS, WHOIS, and TLS certificates-to enumerate additional related assets. Enabling Microsoft Defender for Cloud, deploying agents, or uploading internal networks are not required to start the discovery process.

The microsoft.directory/users/password/update permission allows a principal to perform password resets for any user but does not grant rights to delete users or update other user properties. Therefore, including only this permission in the custom Microsoft Entra role lets Helpdesk staff reset passwords while preventing broader user management capabilities. The other listed permissions either allow additional user changes, such as creating or deleting users, or are unrelated to user password management.

A user delegation SAS is signed with Microsoft Entra (Azure AD) credentials obtained by the storage account, so no storage account keys are exposed. It can be scoped to a single container and given an explicit expiration time such as 72 hours. A service SAS and a stored access policy both require the account key for signing, and supplying the key through Key Vault still exposes it to the pipeline, violating the requirement to keep keys hidden.

Azure SQL Managed Instance relies on Azure-hosted management endpoints that are not reachable through the local virtual network. Microsoft exposes the required addresses through the service tag "SqlManagement" and communicates with them over TCP port 443. If outbound traffic to that tag is blocked, provisioning and subsequent management operations (for example, automated patching) fail. Allowing outbound TCP 443 to the SqlManagement service tag opens only the minimum set of addresses required for the service while continuing to deny all other Internet traffic, so the managed instance can deploy and remain compliant with the security policy. The other options either target the wrong port, an unrelated service tag, or would reopen general Internet access, which violates the policy.

AKS supports Kubernetes network policies through either the Azure or Calico plug-ins. With the Azure CNI network plugin you can enable the Azure network policy add-on (for example, by running "az aks update --network-policy azure") and then apply Kubernetes NetworkPolicy resources that default-deny all traffic and selectively allow approved flows. This provides namespace-level and pod-level isolation inside the cluster. Azure Firewall and NSGs operate at the VNet or subnet boundary and cannot see pod-to-pod traffic that stays on the node's virtual NICs, so they cannot enforce the required isolation. Microsoft Defender for Cloud monitors and raises alerts but does not block traffic. Therefore, enabling network policies is the only action that meets the requirement.

To scope MFA strictly to Azure management operations, the Conditional Access policy must be applied to the built-in cloud app named Microsoft Azure Management.
This cloud app represents every Azure Resource Manager endpoint: the Azure portal, Azure PowerShell, Azure CLI, REST API, and the mobile app. Because Microsoft 365 workloads such as Exchange Online or SharePoint Online are mapped to different cloud-app identifiers, they are not affected when the policy targets Microsoft Azure Management.
Choosing All cloud apps or Office 365 would also include Microsoft 365 workloads, violating the requirement. Selecting a user action such as Register security information does not relate to Azure management sessions and would not enforce MFA for administration tasks.

Setting the policy assignment's enforcement mode to "DoNotEnforce" tells Azure Policy to evaluate the assignment but not apply effects that would stop or change a deployment. For an assignment whose definition uses the Deny effect, Azure Policy logs the non-compliance instead of rejecting the request, giving administrators time to update deployment pipelines. Changing the enforcement mode is done at the assignment level, so the underlying policy definition remains unchanged.

Exemptions exclude specific resources or scopes from evaluation rather than keeping the policy active for all resources. A non-compliance message only customizes the error text that appears when a deny action is triggered; it does not stop the deny. An initiative groups policy assignments but does not override how individual assignments are enforced.

Because soft-delete is active and the key has not been purged, the object still exists in the vault's deleted state. The fastest way to return it to active use is to call the recover operation, which simply changes the key's state from deleted to active and retains every version and attribute. Restoring from a backup is intended for situations where the key or the entire vault has been purged or recreated. Importing a key or recreating one with the same name would generate a new object identifier and break version history or references.

Network Security Group (NSG) flow logs, a Network Watcher feature, capture metadata for every allowed or denied flow that passes through an NSG and store the data in JSON format for further aggregation in services such as Traffic Analytics or Log Analytics. Packet capture records full packet payloads and is typically scoped per NIC and used for short-term troubleshooting, not continuous monitoring. IP flow verify provides an on-demand yes/no reachability test for a single flow and does not generate continuous logs. Connection monitor measures end-to-end connectivity and latency for specified endpoints but does not log every flow traversing the NSG. Therefore, enabling NSG flow logs on nsg-prod best meets the requirement.

In Microsoft Defender for Cloud, each compliance framework is represented by a regulatory standard that contains an Azure Policy initiative. The Regulatory compliance dashboard displays results only for standards that have been enabled for the selected subscription or management group. Enabling the ISO 27001 standard from Environment settings automatically assigns its built-in Azure Policy initiative to the subscription and immediately starts evaluating resources. Export rules, workbooks, or manual policy assignments are unnecessary until after the standard has been enabled, and creating them alone will not surface the framework in the dashboard.

Transparent Data Encryption (TDE) encrypts the entire database, its transaction logs, and all backups while the data is at rest. Because encryption and decryption occur transparently at the storage layer, no application or driver changes are required, and database administrators can still query data in plaintext. Always Encrypted would prevent administrators from seeing sensitive data and needs client-side driver changes. Dynamic Data Masking only obscures query results, leaving storage and backups unencrypted. Enforcing TLS protects data in transit but provides no encryption for database files or backups.