Free Microsoft Certified: Azure Security Engineer Associate (AZ-500) Sample Questions

Correct answer: A — Enable a system-assigned managed identity on VM1.

• A. Correct. Enabling a system-assigned managed identity gives the VM an identity within Microsoft Entra ID (formerly Azure AD). This identity can be used to authenticate to Azure Key Vault and other services without needing to manage or store credentials (like client secrets) in your code or configuration files.
• B. Incorrect. While a service principal is an identity used by applications, creating one manually typically requires generating and managing a Client ID and Secret (or certificate). Using these would require storing credentials in the application or environment, which violates the scenario's requirement.
• C. Incorrect. Azure Key Vault access policies are granted to Microsoft Entra ID identities (users, groups, service principals, or managed identities). Local administrator accounts exist only on the VM's operating system and are not recognized by the Key Vault control plane for access policies.
• D. Incorrect. Storing tenant IDs and client secrets in environment variables is a form of credential storage. The requirement explicitly asks to avoid storing credentials. Managed identities eliminate the need for this entirely.

Correct answer: B — Upon completion settings > If reviewers don't respond > Remove access.

• A. Incorrect. 'Auto apply results to resource' ensures that the decisions reached during the review are enforced automatically when the review completes. However, it does not define the fallback decision for when a reviewer fails to respond. Without configuring the specific behavior for non-responses, the system does not know to remove the access.
• B. Correct. To meet the requirement that users lose access if they do not respond, you must specifically configure the 'If reviewers don't respond' setting to 'Remove access'. While enabling 'Auto apply' is also necessary for the removal to happen without manual intervention, this setting is the critical configuration that translates a lack of response into a denial of access.
• C. Incorrect. This setting determines who performs the review (specifically enabling self-review), but it does not control the outcome or logic applied when the designated reviewer fails to complete the review within the specified timeframe.
• D. Incorrect. Disabling email notifications simply prevents the system from sending emails; it has no impact on the decision logic or the automatic removal of permissions for non-responsive users.

Correct answer: B — False

• A. The solution does not meet the goal because the combined security information registration experience only consolidates the registration process for Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR). It does not provide controls to block or manage legacy authentication protocols.
• B. The solution does not meet the goal. To effectively prevent users from using legacy authentication protocols like POP3 and IMAP, you must implement Conditional Access policies configured to block legacy authentication clients, enable Security Defaults, or disable basic authentication directly within Exchange Online settings.

Correct answer: B — Certificate

• A. Incorrect. A client secret is a symmetric key (essentially a password string). While commonly used, it is considered less secure than a certificate because secrets are often stored in plain text configuration files, have limited management capabilities, and are easier to expose or leak accidentally.
• B. Correct. Certificates utilize asymmetric cryptography (public/private key pair). The private key can be stored securely (e.g., in the local Certificate Store or a Hardware Security Module) and is significantly harder to compromise than a shared secret string. Microsoft explicitly recommends using certificates over secrets for daemon applications and automated services in production.
• C. Incorrect. Username and password credentials imply the use of a user identity or the Resource Owner Password Credentials (ROPC) flow, which is insecure, discouraged by Microsoft, and typically incompatible with modern security baselines like Multi-Factor Authentication (MFA).
• D. Incorrect. A Redirect URI is a configuration parameter used during interactive authentication flows to determine where to send the authentication response. It is not a credential used to authenticate the application itself.

Correct answer: B — Create a contained user in the database using the Managed Identity name.

• A. Incorrect. While server-level logins can be created for Azure AD principals in some configurations (like Managed Instance), the standard best practice for granting an application access to a specific Azure SQL Database is to use a contained database user. Additionally, this method creates unnecessary dependency on server-level permissions.
• B. Correct. To authorize a Managed Identity in Azure SQL Database, you connect to the database (usually as the Azure Active Directory Admin) and run the command `CREATE USER [<IdentityName>] FROM EXTERNAL PROVIDER`. This creates a contained user mapped to the Managed Identity, allowing you to assign specific database roles (e.g., db_datareader).
• C. Incorrect. Configuring the firewall controls network connectivity, ensuring the traffic can reach the server. However, it does not handle authentication or authorization within the database itself. The identity still requires a user object in the database to authenticate.
• D. Incorrect. Sharing credentials defeats the primary security benefit of Managed Identities, which is to allow authentication without managing or storing secrets in the application code or configuration.

Correct answers: A, B — Set 'Users can register applications' to No in User settings.; Assign the 'Application Developer' or 'Cloud Application Administrator' role to the specific developers.

• A. Correct. By default, the 'Users can register applications' setting is often set to 'Yes', allowing all users to register applications. To limit this capability to a specific group, you must first disable this general permission by setting it to 'No'.
• B. Correct. When the general 'Users can register applications' setting is set to 'No', only users with specific administrative roles can register applications. Assigning the 'Application Developer' or 'Cloud Application Administrator' role to the specific developers grants them the necessary permissions to register applications while keeping the restriction in place for all other users.
• C. Incorrect. The 'Global Reader' role provides read-only access to administrative features and does not grant permissions to register or manage applications.
• D. Incorrect. The Admin Consent Workflow manages how users request consent for applications that require administrative approval; it does not control the ability to create new application registrations.
• E. Incorrect. Setting 'Users can register applications' to 'Yes' allows every user in the directory to register applications, which contradicts the requirement to limit the capability to a specific group.

Correct answer: B — Azure Bastion

• A. Incorrect. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources by filtering traffic. It is not designed to facilitate interactive RDP or SSH sessions directly from the Azure Portal.
• B. Correct. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP and SSH connectivity to your virtual machines directly through the Azure Portal over TLS (port 443). When using Azure Bastion, your VMs do not require a public IP address.
• C. Incorrect. Application Gateway is a web traffic load balancer (Layer 7) that enables you to manage traffic to your web applications. It is not used for administrative access via RDP or SSH.
• D. Incorrect. NAT Gateway is a managed service used to provide outbound internet connectivity for resources in a virtual network. It does not support inbound RDP or SSH connections for management purposes.

Correct answers: A, B — Network Security Group (NSG) attached to the NIC; Network Security Group (NSG) attached to the Subnet

• A. Correct. A Network Security Group (NSG) attached directly to the network interface (NIC) is a primary source of security rules. These rules are evaluated combined with subnet-level rules to determine the effective access.
• B. Correct. A Network Security Group (NSG) attached to the subnet applies to all resources within that subnet. Azure merges the rules from the subnet NSG with those from the NIC NSG to create the final list of effective security rules visible in the blade.
• C. Incorrect. Application Security Groups (ASGs) are used within NSG rules to group virtual machines for easier management (as sources or destinations), but they are not independent sources of rules themselves. Additionally, ASGs are associated with NICs, not directly attached to subnets as a rule container.
• D. Incorrect. Azure Firewall Policies manage traffic at the Azure Firewall resource level. While they impact traffic flow, they do not appear in the 'Effective security rules' blade of a VM's NIC, which specifically displays NSG and platform default rules.
• E. Incorrect. Azure AD Conditional Access policies operate at the identity layer for authentication and authorization. They do not define network-layer packet filtering rules and are not part of the NIC's effective security configuration.

Correct answer: A — True

• A. The statement is true because Azure Virtual Network Manager (AVNM) Security Admin Configurations allow you to define centralized security rules that are applied to network groups (which can be scoped to the 'Production' management group). These admin rules are evaluated before Network Security Groups (NSGs) and cannot be modified or removed by subscription owners, effectively enforcing the required security posture.
• B. The statement is false because AVNM Security Admin Configurations are specifically designed to provide a governance layer above standard NSGs. Unlike standard NSGs, which subscription owners can edit, security admin rules are managed centrally and enforce immutable baseline security policies across the targeted virtual networks.

Correct answer: B — Private Endpoint

• A. Incorrect. A Private Link Service is the provider-side resource created by the partner to expose their application. As a consumer, you do not create the Private Link Service; you connect to it.
• B. Correct. To connect to a partner's service using Azure Private Link, you must create a Private Endpoint in your subscription. This endpoint projects the service into your virtual network using a private IP address, and you configure it using the Alias provided by the partner.
• C. Incorrect. A Service Endpoint allows you to secure Azure service resources to your virtual network, but traffic still uses the public endpoint of the PaaS service. It is not used to establish a private connection to a specific Private Link Service alias.
• D. Incorrect. A Virtual Network Gateway is used for encrypted traffic between an Azure virtual network and an on-premises location (VPN) or another virtual network. It is not the resource used for Private Link connectivity.

Correct answer: D — The Route Table has 'BGP Route Propagation' disabled.

• A. Incorrect. While a route to the Internet (0.0.0.0/0) is typically required for the proper functioning of a SQL Managed Instance, missing this specific route generally affects connectivity or deployment health rather than generating an immediate error during the association of the Route Table object itself.
• B. Incorrect. While SQL Managed Instance requires a dedicated subnet, the presence of other resources (like VMs) would prevent the *delegation* of the subnet or the *deployment* of the Instance. However, standard Azure networking allows associating a Route Table to a subnet containing resources. The specific error described in the scenario usually stems from a policy conflict.
• C. Incorrect. This is a factual statement: SQL Managed Instance subnets do require delegation to 'Microsoft.Sql/managedInstances', which in turn applies Network Intent Policies. However, this option describes the architectural requirement rather than the specific misconfiguration causing the error.
• D. Correct. When a subnet is delegated to 'Microsoft.Sql/managedInstances', a Network Intent Policy is applied to ensure the network configuration supports the management of the instance. This policy strictly requires that 'Virtual network gateway route propagation' (BGP Route Propagation) is Enabled on the associated Route Table. If you attempt to associate a Route Table with this setting disabled, the operation is blocked with an error.

Correct answer: B — False

• A. The statement is false. The proposed solution to use Service Endpoints will not work. While Service Endpoints do provide secure connectivity to Azure PaaS services, they are not supported for traffic originating from an Azure SQL Managed Instance.
• B. The statement is true. The proposed solution will not work because Azure SQL Managed Instance is deployed into a dedicated, delegated subnet within a virtual network. Due to this specific architecture, traffic from the Managed Instance does not carry the virtual network identity required for Service Endpoint rules on the target Storage Account to function. The correct and recommended method for securing this connection is to use a Private Endpoint for the Storage Account.

Correct answer: A — Multi-site listeners

• A. Correct. Multi-site listeners allow you to configure multiple distinct host names (domains) on the same public IP address and port. The Application Gateway relies on the HTTP 1.1 Host header to route traffic to the correct backend pool and listener based on the requested domain name.
• B. Incorrect. Basic listeners are designed for a single site configuration. They listen for all traffic on a specific IP address and port combination without distinguishing between different host headers, making them unsuitable for hosting multiple unique domains on the same IP/port.
• C. Incorrect. While Application Gateway supports wildcard host names (e.g., *.contoso.com), this is configured within a Multi-site listener. 'Wildcard listener' is not a distinct listener configuration type in Azure; the correct configuration mode is Multi-site.
• D. Incorrect. 'Private listeners' refers to using a private IP address for the frontend configuration (internal load balancing). While you can host internal sites, the requirement specifically addresses hosting multiple websites on a single IP using domain names, which is a function of the Multi-site listener type regardless of whether the IP is public or private.

Correct answers: A, B — Enable the OWASP 3.2 rule set.; Set the WAF to Prevention mode.

• A. Correct. Azure Web Application Firewall (WAF) v2 on Application Gateway uses Core Rule Sets (CRS) to detect common vulnerabilities. Enabling the OWASP 3.2 rule set (or the latest available version) applies the specific signatures and rules required to mitigate the OWASP Top 10 threats, such as SQL injection and Cross-Site Scripting (XSS).
• B. Correct. WAF policies operate in either Detection or Prevention mode. Detection mode only logs suspicious activity, whereas Prevention mode actively blocks requests that trigger the enabled rules. To effectively protect the application, the WAF must be set to Prevention mode.
• C. Incorrect. Creating a custom rule to allow all traffic would bypass the managed rules and effectively disable the security protections provided by the WAF, leaving the application vulnerable.
• D. Incorrect. Disabling request body inspection prevents the WAF from analyzing the data sent in the body of HTTP requests (e.g., POST data). Since many attacks (like SQL injection) are delivered via the request body, disabling inspection weakens security.
• E. Incorrect. Rewrite sets are used to modify HTTP request/response headers or URLs for routing or compatibility purposes. While they can add security headers, they do not provide the signature-based inspection necessary to block OWASP Top 10 attacks.

Correct answers: A, B — Origin Group with Latency load balancing preference; Health Probes

• A. Correct. An Origin Group is the collection of backends (origins) to which traffic is routed. Configuring it with a latency-based load balancing preference (or relying on the default lowest-latency behavior in Front Door) ensures that traffic is directed to the backend with the lowest network latency relative to the client.
• B. Correct. Health Probes are essential for determining the availability of each backend. If the closest backend fails health checks, the health probe status triggers Front Door to route traffic to the next closest healthy backend, fulfilling the failover requirement.
• C. Incorrect. The Weighted routing method distributes traffic across backends based on administrator-assigned percentages or weights, rather than dynamically selecting the backend with the lowest network latency.
• D. Incorrect. The Priority routing method is typically used for active-passive scenarios (primary/secondary) where traffic is sent to a specific backend based on priority order, regardless of latency, until that backend becomes unavailable.
• E. Incorrect. Session Affinity ensures requests from the same client are sent to the same backend for the duration of a session, but it is not the mechanism used to initially determine the closest backend or handle failover based on latency.

Correct answer: B — AzureBastionSubnet

• A. Incorrect. While 'BastionSubnet' is a valid name for a generic subnet, Azure Bastion specifically requires the subnet to be named 'AzureBastionSubnet' to function. Custom names are not recognized by the service deployment.
• B. Correct. Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet'. This is a strict naming convention required by the Azure platform. Additionally, the subnet must be at least /26 in size and contain no other resources.
• C. Incorrect. 'GatewaySubnet' is a reserved subnet name used specifically for Azure Virtual Network Gateways (VPN Gateway or ExpressRoute), not for Azure Bastion.
• D. Incorrect. 'ManagementSubnet' is not a reserved name required by Azure Bastion. Deploying the service into a subnet with this name will fail.

Correct answer: C — Azure Storage Account

• A. Incorrect. While Azure Log Analytics is excellent for querying and monitoring, it is significantly more expensive for long-term data retention (7 years) compared to storage accounts. It is best suited for active analysis and shorter retention periods.
• B. Incorrect. Azure Event Hubs is a streaming platform designed to ingest data and route it to other systems (like a SIEM). It has very short data retention periods (typically days) and is not a storage solution for long-term archival.
• C. Correct. An Azure Storage Account is the most cost-effective destination for long-term retention. It supports writing audit logs directly and allows for the use of lifecycle management policies to move older logs to Cool or Archive access tiers, drastically reducing storage costs over the 7-year period.
• D. Incorrect. Storing audit logs in an Azure SQL Database table is deprecated for modern auditing and is highly cost-prohibitive. It consumes expensive database storage and compute resources, making it unsuitable for multi-year archival.

Correct answer: A — Grant the UNMASK permission to the 'HR_Managers' role

• A. Correct. Granting the UNMASK permission is the specific, granular permission designed to allow users or roles to bypass Dynamic Data Masking rules and view actual data. This adheres to the principle of least privilege.
• B. Incorrect. While members of the db_owner role can view unmasked data by default, adding the 'HR_Managers' role to db_owner grants excessive administrative privileges over the entire database, violating the principle of least privilege.
• C. Incorrect. Column Encryption Keys are used for the Always Encrypted feature, which provides strong encryption for data at rest and in transit. This is distinct from Dynamic Data Masking, which obfuscates data at the presentation layer.
• D. Incorrect. Row-Level Security (RLS) is used to filter which rows a user can see based on logic (e.g., user department), but it does not control whether the data within those rows is masked or unmasked.

Correct answer: A — The developer does not have access to the Column Master Key (CMK) in the key store

• A. Correct. Always Encrypted relies on client-side decryption. The client driver (SSMS) needs to access the Column Master Key (CMK) residing in an external key store (such as Azure Key Vault or the Windows Certificate Store) to unwrap the Column Encryption Key (CEK). Even with SQL SELECT permissions, if the developer's identity lacks the specific access policies or permissions for the CMK in the key store, decryption will fail.
• B. Incorrect. The UNMASK permission is specific to Dynamic Data Masking (DDM), which is a feature that obfuscates data presentation but does not encrypt the underlying data storage. Always Encrypted uses cryptographic keys, not the UNMASK permission.
• C. Incorrect. Transparent Data Encryption (TDE) encrypts the database files at rest (physical storage) and is transparent to the client application. It operates independently of Always Encrypted and does not affect client-side column decryption logic.
• D. Incorrect. While the parameter `Column Encryption Setting=Enabled` is required in the connection string for SSMS to attempt decryption, the phrasing 'encrypted connection string parameter' usually refers to transport layer encryption (`Encrypt=True`). Furthermore, in a security context, the lack of access rights to the key (CMK) is the primary permission-based reason for decryption failure.

Correct answers: B, C — Use a Virtual Network Integration for API Management and Private Endpoint for the App Service.; Enable Mutual Certificate Authentication between APIM and the App Service.

• A. Incorrect. While whitelisting the Public IP of the API Management instance is a possible configuration for Basic, Standard, or Premium tiers (which have static IPs), it is less secure than network isolation or mutual authentication. It relies on the public endpoint of the App Service remaining exposed, and IP-based restrictions can be more brittle than cryptographic or physical network isolation. Additionally, the Consumption tier of APIM does not have a dedicated static IP, making this solution invalid for all scenarios.
• B. Correct. Using Virtual Network Integration (or VNet Injection) for API Management allows it to communicate within a private network. Configuring a Private Endpoint for the App Service exposes the app on a private IP within that network and disables public internet access. This ensures that traffic remains entirely on the Microsoft backbone and the App Service is only accessible by resources within the VNet, such as the APIM instance.
• C. Correct. Enabling Mutual Certificate Authentication (client certificate authentication) provides strong, application-level security. By configuring the App Service to require a client certificate and configuring APIM to present a specific certificate during the handshake, you ensure that the App Service rejects any request that does not possess the correct credential, effectively restricting access to only the API Management instance.
• D. Incorrect. Cross-Origin Resource Sharing (CORS) is a browser security feature that restricts web applications running in a browser from making requests to a different domain. It does not restrict server-to-server traffic, such as requests coming from API Management to the App Service.
• E. Incorrect. Enabling Anonymous authentication turns off authentication requirements, allowing unauthenticated access to the App Service. This is the opposite of securing the connectivity.

Correct answer: A — True

• A. The statement is true because Soft Delete ensures that deleted keys are held in a recoverable state for a specified retention period rather than being immediately removed. Purge Protection enforces this retention by preventing the permanent deletion (purging) of soft-deleted keys until the retention period has fully elapsed. Together, these features prevent accidental or malicious permanent loss of encryption keys.
• B. The statement is false because the combination of Soft Delete and Purge Protection specifically addresses the requirement to prevent permanent loss. Without Purge Protection, a soft-deleted key could still be manually purged (permanently deleted) by an administrator before the retention period ends, which would fail to meet the goal.

Correct answers: A, C — Enable a Service Endpoint for Microsoft.Storage on the subnet.; Add a Virtual Network rule in the Storage Account firewall settings allowing the specific subnet.

• A. Correct. Enabling a Service Endpoint for Microsoft.Storage on the subnet is a prerequisite. It routes traffic from the subnet to the storage service over the Azure backbone network and allows the storage service to identify the traffic coming from that specific subnet.
• B. Incorrect. An NSG rule controls traffic flow at the subnet level (outbound/inbound) but does not restrict the storage account itself to accept connections only from a specific subnet. The storage account requires its own firewall configuration.
• C. Correct. Adding a Virtual Network rule in the Storage Account firewall settings is required to explicitly allow traffic from the specific subnet. This works in conjunction with the Service Endpoint to restrict access to only that authorized subnet.
• D. Incorrect. While a Private Endpoint does provide connectivity via a private IP on the backbone, the specific requirement to allow traffic from a subnet via the backbone is most directly accomplished via Service Endpoints and firewall rules. Private Endpoints are a different connectivity model often used to disable public endpoints entirely.
• E. Incorrect. This setting allows specific trusted Azure platform services (like Azure Backup or Site Recovery) to bypass network rules. It does not grant access to a general-purpose subnet within a Virtual Network.

Correct answer: B — The connection will fail because Azure Files requires SMB 3.0 or later with encryption for access from outside the Azure region.

• A. Incorrect. While Azure Files does enforce encryption by default (Secure Transfer Required), SMB 2.1 does not support the required encryption protocols. Therefore, the connection will not work securely; it will be rejected.
• B. Correct. Azure Files requires SMB 3.0 or later to support encryption in transit. For connections originating from outside the Azure region (such as on-premises over the public internet), Azure denies unencrypted traffic. Since SMB 2.1 does not support encryption, the connection attempt will fail.
• C. Incorrect. Azure Files blocks connections from outside the datacenter if encryption is not used. Since SMB 2.1 cannot encrypt the traffic, Azure will not establish the connection, preventing clear text transfer over the public internet.
• D. Incorrect. While configuring a VPN is a valid remediation to enable SMB 2.1 access by tunneling traffic, the question asks for the security implication of the scenario where the connection occurs over the public internet. The immediate implication is that the connection fails.

Correct answer: B — Enable Microsoft Defender for Servers Plan 2 and configure File Integrity Monitoring (FIM)

• A. Incorrect. Adaptive Network Hardening is designed to secure network traffic by hardening Network Security Groups (NSGs), not to monitor system files or registry entries. Additionally, File Integrity Monitoring (FIM) is not available in Microsoft Defender for Servers Plan 1.
• B. Correct. File Integrity Monitoring (FIM) is specifically designed to examine operating system files and registry keys for changes that might indicate an attack. This feature is available only in Microsoft Defender for Servers Plan 2.
• C. Incorrect. Just-In-Time (JIT) VM Access is used to secure management ports (RDP/SSH) by opening them only when needed, which does not address file or registry tampering. Furthermore, FIM requires Plan 2.
• D. Incorrect. Adaptive Application Control helps control which applications can run on your VMs by creating allowlists. While it is a feature of Plan 2, it does not monitor changes to system files or registry entries like FIM does.

Correct answer: B — Agentless scanning in Microsoft Defender for Servers

• A. Incorrect. This method requires the installation of the Azure Monitor Agent on the virtual machines to function, which violates the requirement for an agent-free solution.
• B. Correct. Agentless scanning in Microsoft Defender for Servers assesses vulnerabilities by creating and analyzing disk snapshots of the virtual machine. This process occurs outside the running VM environment, ensuring no agents are required and there is no performance impact on the machine's workload.
• C. Incorrect. The built-in Qualys vulnerability scanner requires the deployment of an extension (agent) onto the virtual machine to execute the scans, failing the no-agent requirement.
• D. Incorrect. Adaptive Application Control is a security feature designed to control which applications are allowed to run on your VMs (application allow-listing); it is not a vulnerability scanning tool.

Correct answer: B — In the JIT VM access configuration window for the specific VM

• A. Incorrect. Azure Firewall policies allow you to define rules for network traffic filtering across subscriptions and virtual networks, but they do not manage the Just-In-Time access workflow or its request parameters.
• B. Correct. The JIT VM access configuration window (or the JIT policy definition in Defender for Cloud) is where you define the parameters for access, such as ports, protocol, allowed source IPs, and maximum request duration. The requirement to provide a justification is part of the JIT request workflow managed and configured within this interface.
• C. Incorrect. Network Security Groups (NSGs) are the mechanism JIT uses to enforce access (by creating temporary allow rules), but the NSG itself does not store the configuration for the JIT policy, request logic, or justification requirements.
• D. Incorrect. Conditional Access policies in Microsoft Entra ID are used to enforce access controls based on signals like user identity, device compliance, or location (e.g., requiring MFA). They do not configure the internal settings of the Defender for Cloud JIT feature, such as requiring a text justification for VM access.

Correct answer: B — Create a Policy Exemption for the 'rg-dmz' resource group.

• A. Incorrect. Changing the policy effect to 'Audit' would stop blocking Public IP creation across the entire subscription, only logging non-compliance. This fails the requirement to maintain the 'Deny' policy for the rest of the subscription.
• B. Correct. A Policy Exemption is the specific feature designed for this scenario. It allows you to exempt a specific scope (such as the 'rg-dmz' resource group) from a policy assignment without modifying or removing the assignment for the rest of the subscription.
• C. Incorrect. Azure Policy controls resource properties and compliance independently of Role-Based Access Control (RBAC). Assigning the 'Owner' role grants permissions to perform actions, but it does not bypass a 'Deny' policy assignment; the deployment would still fail.
• D. Incorrect. While Management Groups are used to organize resources and scopes for policy assignments, restructuring the hierarchy is an unnecessary and disruptive administrative overhead for a single exception. Policy Exemptions are the intended method for handling exceptions at a granular level.

Correct answer: C — Azure RBAC, because it supports scope assignment at the individual Key/Secret level.

• A. Incorrect. Vault Access Policies function at the vault scope. If you grant a permission (e.g., 'Get Key') via an access policy, that user receives that permission for every key within the vault. They do not support granular object-level permissions.
• B. Incorrect. This does not address the requirement for individual key permissions. Furthermore, PIM is designed to manage Azure AD and Azure Resource RBAC roles; it does not natively manage legacy Vault Access Policy entries directly.
• C. Correct. Azure RBAC for Key Vault data plane allows you to assign roles (such as Key Vault Crypto User) at the specific scope of an individual Key, Secret, or Certificate, enabling the required granular access control.
• D. Incorrect. Both Vault Access Policies and Azure RBAC support Managed Identities. The distinguishing factor for the requirement is the ability to scope permissions to individual resources, which only RBAC provides.

Correct answer: A — Yes

• A. The statement is true because the `Undo-AzKeyVaultRemoval` cmdlet in Azure PowerShell, or its Azure CLI equivalent `az keyvault recover`, is the designated method for recovering a deleted Key Vault that had Soft Delete enabled. This action restores the vault and all its contents, including keys, secrets, and certificates, provided the recovery is attempted within the configured retention period.
• B. The statement is false because the proposed solution is the correct procedure for the given scenario. The `Undo-AzKeyVaultRemoval` command is specifically designed to recover a soft-deleted Key Vault and its contents, thereby successfully meeting the stated goal.

Correct answer: A — Create a custom Policy definition and add it to a new Policy Initiative, then assign the Initiative in Defender for Cloud

• A. Correct. Microsoft Defender for Cloud's Regulatory Compliance dashboard is built on top of Azure Policy. To track a custom requirement (like a proprietary tag), you must create a custom Policy definition, wrap it in a custom Policy Initiative, and then add/assign that custom initiative within the Defender for Cloud 'Security Policy' settings. This ensures the requirement is continuously assessed and reported alongside other compliance standards.
• B. Incorrect. Microsoft Sentinel is a SIEM (Security Information and Event Management) and SOAR solution used for log analytics, threat detection, and incident response. It is not the primary tool for managing resource configuration compliance or cloud security posture (CSPM).
• C. Incorrect. The 'Azure Security Benchmark' (now the Microsoft Cloud Security Benchmark) is a built-in initiative managed by Microsoft. Built-in initiatives are read-only and cannot be directly edited to add new policy definitions. You must create a new custom initiative to include your specific requirements.
• D. Incorrect. While you can use the Inventory filter to find resources missing tags at a specific moment, this is a manual, ad-hoc process. It does not provide continuous compliance monitoring, scoring, or integration into the Regulatory Compliance dashboard.

Correct answers: C, D — Public Domains; IP Blocks (CIDR)

• A. Incorrect. Internal Private IP ranges (e.g., RFC1918 addresses) are not routable on the public internet and cannot be used for external attack surface discovery, which focuses on public-facing assets.
• B. Incorrect. Active Directory User Principal Names (UPNs) are identity objects used for authentication and are not valid network seeds for discovering external infrastructure assets.
• C. Correct. Public Domains are a primary seed type in Defender EASM. Providing a domain allows the service to discover associated subdomains, hosts, and services exposed to the internet.
• D. Correct. IP Blocks provided in CIDR notation are supported seeds. EASM uses these public IP ranges to scan and identify active assets belonging to the organization within those blocks.
• E. Incorrect. Azure Resource Manager IDs represent specific internal Azure resources and are not used as seeds for the external discovery engine, which relies on public internet identifiers like domains, IPs, and ASNs.

Correct answer: B — Use the 'Add Filter' option in the Inventory blade to filter by Recommendation status and name

• A. Incorrect. Exporting logs to Event Hub to query in a third-party tool like Splunk requires significant configuration, additional cost, and time. It is an overly complex solution for a task that can be handled natively within the Azure portal.
• B. Correct. The Inventory blade in Microsoft Defender for Cloud provides an 'Add Filter' capability. You can specifically filter by 'Recommendations' to select the 'SQL encryption should be enabled' recommendation. This instantly filters the view to show only the affected resources, making it the most efficient method.
• C. Incorrect. Manually checking every resource is inefficient, time-consuming, and prone to error, especially in environments with a large number of resources.
• D. Incorrect. While Azure Resource Graph (ARG) is powerful and can query this data, writing and executing a custom KQL query is less efficient than using the built-in visual filters provided directly in the Inventory blade where you are already working.

Correct answers: A, B, C — Install the Azure Monitor Agent (AMA) on a Linux log forwarder.; Configure the firewall to send logs to the log forwarder via Syslog.; Create a Data Collection Rule (DCR) in Azure Monitor.

• A. Correct. Installing the Azure Monitor Agent (AMA) on a dedicated Linux log forwarder is the current standard method for ingesting CEF/Syslog data into Sentinel. The forwarder acts as an intermediary between the appliance and Azure.
• B. Correct. You must configure the source firewall to send its Syslog/CEF messages to the IP address or hostname of the Linux log forwarder so the agent can capture them.
• C. Correct. When using the Azure Monitor Agent (AMA), creating a Data Collection Rule (DCR) is mandatory. The DCR defines which log facilities and severities to collect and routes them to the Sentinel Log Analytics workspace.
• D. Incorrect. Installing an agent directly on a firewall appliance is typically not supported or recommended. The standard architecture uses a separate log forwarder server.
• E. Incorrect. Writing logs to a Storage Account is an archiving method, not the standard real-time ingestion path for analyzing CEF logs in Microsoft Sentinel.

Correct answer: A — The Root URL and Collection ID.

• A. Correct. To configure the Threat Intelligence - TAXII data connector in Microsoft Sentinel, you must provide the API Root URL (to locate the TAXII server) and the Collection ID (to identify the specific set of threat intelligence data to pull).
• B. Incorrect. A Shared Access Signature (SAS) token is typically used to grant limited access to Azure Storage resources, not for authentication or configuration of the TAXII protocol.
• C. Incorrect. The Azure AD Tenant ID is not a required field for the standard TAXII connector configuration. TAXII servers usually require an API Root, Collection ID, and specific credentials (such as username/password or API key), rather than Azure AD context.
• D. Incorrect. The Workspace Key and ID are required when connecting agents (like the Azure Monitor Agent or Log Analytics Agent) to a workspace, but they are not used within the configuration blade for the TAXII data connector in Sentinel.

Correct answer: B — Use the 'Create sample alerts' feature in the Defender for Cloud portal.

• A. Incorrect. Downloading actual virus samples to a production VM is highly unsafe, violates security best practices, and risks compromising your environment. Testing should always be done safely without introducing real malware.
• B. Correct. The 'Create sample alerts' feature within the Defender for Cloud portal is the supported and recommended method to validate configurations. It allows you to generate specific synthetic alerts immediately to test SIEM integrations, email notifications, and Workflow Automation without putting resources at risk.
• C. Incorrect. While running scripts to modify the registry might trigger certain behavioral alerts, it is risky, could destabilize the VM, and is not the standard method for testing Workflow Automation. The built-in sample alert feature is safer and more precise.
• D. Incorrect. Waiting for a real scan is passive and non-deterministic. It does not allow for immediate or controlled testing of your automation logic.