Cloud ¡ Microsoft Azure ¡ Certifications
Azure Security Engineer Associate (AZ-500) practice
Choose an answer to reveal the explanation, then use the question navigation to continue.
Question 1
You are designing an identity solution for a company with an on-premises Active Directory forest, corp.local, and an Azure AD tenant, contoso.onmicrosoft.com. The solution must enforce on-premises password policies, minimise servers, and provide seamless sign-on to cloud apps on corporate devices. Which authentication method should you choose?
Correct answer: Use password hash synchronization with Seamless SSO.
Password hash synchronization keeps on-premises Active Directory as the password-policy authority while synchronizing password hashes to Microsoft Entra ID. Seamless SSO automatically signs in users on domain-joined corporate devices. It is the lowest-infrastructure option because cloud sign-ins do not need AD FS servers or pass-through authentication agents.
Exam clue: âMinimise serversâ together with âseamless sign-on on corporate devicesâ points to password hash synchronization with Seamless SSO.
Remember: Choose password hash synchronization for the simplest hybrid authentication setup. Choose pass-through authentication only when cloud sign-ins must be validated directly against on-premises Active Directory, and federation only for a specific federation requirement.
Question 2
You are an Azure administrator tasked with creating a new Azure Active Directory (Azure AD) tenant for a project. The tenant must be named 12345678.onmicrosoft.com and contain a new user named user1@12345678.onmicrosoft.com. After creating the tenant, you must switch to it and provision the user. Which action is the FIRST step you should take in the Azure portal?
Correct answer: Search for and select 'Azure Active Directory', then click 'Manage Tenants' and '+ Create' to set up the new tenant.
A new Microsoft Entra tenant must be created before you can switch to it or create users in it. In the Azure portal, open Azure Active Directory (now Microsoft Entra ID), choose Manage tenants, and then select + Create. The new tenant receives its initial onmicrosoft.com domain during the creation process.
Exam clue: The question asks for the FIRST step, and both the tenant name and user belong to a tenant that does not exist yet.
Remember: Create the tenant first, switch to that directory, then create its users. A subscription is not required to create a Microsoft Entra tenant.
Question 3
Your company runs a web app called AppSecure that delivers product images and videos via https://appsecure.contoso.com. It uses two backend pools: Pool1 for images and Pool2 for videos. To improve performance, you want to offload TLS decryption and route requests based on URL paths at the regional level. Which Azure service should you use?
Correct answer: Use Azure Application Gateway for TLS termination and path-based routing.
Azure Application Gateway is a regional Layer 7 load balancer. It can terminate TLS at the gateway and use URL path-based routing rules to send image requests to Pool1 and video requests to Pool2.
Exam clue: âTLS decryptionâ, âURL pathsâ, âbackend poolsâ, and âregional levelâ point directly to Application Gateway.
Remember: Application Gateway is regional and Layer 7. Azure Front Door is the global Layer 7 option, while Traffic Manager only directs traffic at the DNS layer and cannot terminate TLS or inspect URL paths.
Question 4
You need to configure encryption for an Azure Storage account named rg1lod28681041n1 using a customer-managed key stored in the KeyVault28681041 Azure Key Vault. Which step in the Azure portal ensures the storage account uses the key from the specified Key Vault for encryption?
Correct answer: Go to the storage account, select Encryption under Security + networking, pick Customer-managed keys, then enter the key URI from KeyVault28681041.
Configure the storage account itself to use a customer-managed key by opening Encryption under Security + networking, selecting Customer-managed keys, and choosing or entering the Key Vault key URI. The Key Vault must also be configured with the required permissions for the storage account identity.
Exam clue: The requirement is to make the storage account use a particular Key Vault key. The relevant storage-account setting is Encryption, not Access keys.
Remember: For Storage service encryption with a customer-managed key: configure Customer-managed keys on the storage account and select the Key Vault key. Key Vault permissions are necessary, but do not by themselves switch the storage account to customer-managed keys.
Question 5
Your organization's network includes an on-premises Active Directory domain named adatum.com that synchronizes with Azure Active Directory using Azure AD Connect. The Azure AD Connect tool is installed on Server1. To adhere to the principle of least privilege, you need to assign an Azure AD role to a domain administrator from adatum.com that allows them to modify synchronization options. Which Azure AD role should you assign?
Correct answer: Hybrid Identity Administrator
The Hybrid Identity Administrator role is designed for managing Microsoft Entra hybrid identity features, including Azure AD Connect synchronization settings. It provides the required hybrid identity permissions without assigning the broader Global Administrator role.
Exam clue: âAzure AD Connectâ, âmodify synchronization optionsâ, and âleast privilegeâ point to Hybrid Identity Administrator.
Remember: Use Hybrid Identity Administrator for hybrid identity and synchronization administration. Reserve Global Administrator for tasks that truly require tenant-wide control.
Question 6
You are tasked with creating a custom Azure role-based access control (RBAC) role to allow management of tags for all resources within a management group named Group1. The management group contains an Azure subscription with the ID 11111111-1234-1234-1234-111111111111. Which resource provider should be included in the role definition to enable tag management for all objects in Group1?
Correct answer: Microsoft.Resources
Tag operations are exposed through the Microsoft.Resources resource provider, for example Microsoft.Resources/tags/read and Microsoft.Resources/tags/write. Adding the required Microsoft.Resources tag actions to a custom role allows tag management across resource types at the assigned scope.
Exam clue: Tags are Azure Resource Manager metadata that apply broadly across resource types, so they belong to Microsoft.Resources rather than a service-specific provider.
Remember: Use Microsoft.Resources/tags/* for tag permissions in custom RBAC roles. Microsoft.Authorization manages role assignments and definitions, not resource tags.
Question 7
RG1 contains VM1. Admin1 has the Owner role at RG1, Admin2 has the Reader role at RG1, Admin3 has the Contributor role at the subscription level, and Admin4 has the Owner role at RG2. Assess these statements: 1. Only Admin1 and Admin3 can delete VM1. 2. Only Admin3 can create new resource groups in the subscription. Which option correctly evaluates both statements?
Correct answer: Statement 1: Only Admin1 and Admin3 can delete VM1. Statement 2: Only Admin3 can create new resource groups.
Admin1 is Owner at RG1, so they can delete VM1. Admin3 is Contributor at the subscription scope, which inherits to RG1 and allows resource management, including deleting VM1 and creating resource groups. Admin2 is Reader and cannot modify resources. Admin4's Owner role at RG2 does not grant access to resources in RG1 or to the subscription scope.
Exam clue: Azure RBAC permissions inherit downward from subscription to resource group to resource, but do not extend sideways from one resource group to another or upward to the subscription.
Remember: Scope matters: subscription-level Contributor can create resource groups and manage resources below it; an Owner role on one resource group applies only within that resource group.
Question 8
A company has migrated to Azure and purchased Azure AD Premium P2 licenses. What is the correct order of steps to enable Azure AD Privileged Identity Management (PIM) for Azure AD roles?
Correct answer: Sign up for PIM, consent to PIM, verify identity via MFA.
The initial PIM setup sequence is to sign up for the PIM service, provide the required consent, and then verify the administrator's identity using MFA. After PIM is enabled, privileged role assignments and settings can be managed.
Exam clue: The question asks about enabling PIM, so begin with service registration and consent before identity verification and role-management tasks.
Remember: For initial PIM setup: sign up, consent, then complete MFA verification. Azure AD Premium P2 provides the required licensing.
Question 9
Your organization uses Azure AD Privileged Identity Management (PIM) to manage privileged roles. The security policy requires administrator passwords to be changed every 180 days. However, PIM is generating alerts for administrators who have not changed their passwords in the last 90 days, causing unnecessary noise. Which PIM alert should you modify to align with the 180-day password change requirement and reduce false positives?
Correct answer: Potential stale accounts in a privileged role.
The Potential stale accounts in a privileged role alert identifies privileged accounts that may be stale, including accounts based on password age. Adjusting its threshold to match the organizationâs 180-day password policy reduces alerts that are triggered prematurely at 90 days.
Exam clue: The issue is specifically the age of administrator passwords, which is a stale-account signal rather than an activation, assignment, or role-use condition.
Remember: Tune the stale privileged-account alert when the alert threshold for password age or account activity does not match the organizationâs policy.
Question 10
You need to configure dynamic group membership based on users' City attribute. USER1 has Toronto, USER2 has Montreal, USER3 has London, and USER4 has Ontario. Group1 uses (user.city -contains "ON") and Group2 uses (user.city -match "on"). What will be the membership of Group1 and Group2 after the rules are applied?
Correct answer: GROUP1: USER1, USER2, USER3, USER4 / GROUP2: USER1, USER2, USER3, USER4
The -contains operator performs a case-insensitive substring check for string properties, and -match uses a case-insensitive regular-expression match by default. Every listed city contains the sequence "on": Toronto, Montreal, London, and Ontario. Therefore, all four users are included in both groups.
Exam clue: Do not treat "ON" and "on" as case-sensitive here. Check each city for the substring, not only its starting letters.
Remember: In dynamic membership rules, string -contains is case-insensitive and -match is case-insensitive unless you use the case-sensitive variants. Both can match a substring within the attribute value.
Question 11
You need to provide a user with temporary access to a specific blob in Azure Blob Storage, ensuring the access automatically expires after six days. Which method should you use to grant this time-limited access?
Correct answer: A shared access signature (SAS) with a six-day expiry time.
A SAS can grant narrowly scoped permissions to a single blob and includes an explicit expiry time. Setting the expiry to six days makes the access stop automatically at the required time.
Exam clue: The key requirements are access to a specific blob and automatic expiration after a defined period. These are core SAS capabilities.
Remember: Use a SAS for delegated, time-limited access to Storage resources. RBAC and managed identities are identity-based authorization mechanisms and do not inherently provide an expiry at the individual access-grant level.
Question 12
You are setting up authentication for an Azure HDInsight cluster on a virtual network and want users to authenticate with their on-premises Active Directory credentials. Will deploying Azure AD Application Proxy fulfill this requirement?
Correct answer: No, while the Enterprise Security Package (ESP) is required for HDInsight authentication, Azure AD Application Proxy cannot replace the domain services or Kerberos support needed for on-premises Active Directory integration.
Azure AD Application Proxy publishes on-premises web applications for remote access; it does not provide the domain integration required by HDInsight. For HDInsight authentication with Active Directory credentials, use an Enterprise Security Package cluster and the required Active Directory Domain Services or Azure AD Domain Services and Kerberos integration.
Exam clue: HDInsight needs cluster-level domain and Kerberos integration. Application Proxy is an application publishing service, not a replacement for domain services.
Remember: Application Proxy provides remote access to web applications. HDInsight Enterprise Security Package provides the framework for domain-integrated HDInsight authentication.
Question 13
You are deploying Docker containers on an Azure VM running Ubuntu in a subnet with a Microsoft.Storage service endpoint. The containers cannot access Azure Storage via the service endpoint. What should you do on the VM to enable this?
Correct answer: Change the docker-compose file to use host networking mode.
Docker bridge networking uses NAT, so traffic from containers may not use the VM network identity in the way required for the service endpoint path. Host networking makes the containers use the VMâs network stack, allowing their Storage traffic to use the subnetâs Microsoft.Storage service endpoint.
Exam clue: The service endpoint is already enabled on the VM subnet. The missing link is the container network mode, not public exposure or another access-control layer.
Remember: For Docker workloads on a VM that must use a VNet service endpoint, host networking can make the container traffic use the VMâs VNet networking context.
Question 14
You are configuring access control for a critical application in Azure AD. Group1 must include both dynamically selected users and devices based on specific attributes, but its current configuration does not support this requirement. Which action should you take to meet the identity and access requirements for Group1?
Correct answer: Change the membership type of Group1 to Assigned, create two separate dynamic groups (one for users and one for devices), and add these groups as members to Group1.
A dynamic Microsoft Entra group can have a membership rule for either users or devices, but not both in the same group. Use separate dynamic security groups for the user and device rules, then use an assigned security group as the access-control parent and add the dynamic groups to it.
Exam clue: The requirement explicitly combines dynamically selected users and devices. This is not supported by one dynamic membership rule.
Remember: Dynamic group rule: users OR devices, not users AND devices. Use separate dynamic groups and an assigned parent group when an application must target both.
Question 15
You configure Azure Information Protection (AIP) policies with two conditions based on the text "Black and White" and "Black or white". Two policies with labels Label1 and Label2 are applied to User1. User1 creates a Word document containing "Black and White" and a Notepad file containing "Black or white". Which labels will be automatically applied to each file?
Correct answer: Word file: Label1 only; Notepad file: No label
The Word document is a supported Office file and matches the Label1 condition for "Black and White", so Label1 is automatically applied. A plain Notepad text file is not a supported file type for this automatic AIP labeling action, so it receives no label.
Exam clue: Check both the content condition and whether the file type supports automatic labeling. A matching string alone is not enough for an unsupported file type.
Remember: AIP automatic labeling works only with supported file types. Office documents can be automatically labeled, whereas plain text files such as Notepad files are not automatically labeled in this scenario.
Question 16
Your organization plans to integrate an on-premises Active Directory domain named weylandindustries.com with an Azure AD tenant of the same name. The integration must enforce on-premises password policies and user logon restrictions while minimizing the number of additional servers required. You propose using Azure AD Connect with federation via Active Directory Federation Services (AD FS). Does this solution meet these requirements?
Correct answer: No, it enforces on-premises policies but increases the number of servers needed.
AD FS federation redirects cloud authentication to the on-premises identity infrastructure, so on-premises password policies and logon restrictions can be enforced. However, AD FS requires federation servers and typically Web Application Proxy servers for external access and high availability, increasing the on-premises server footprint.
Exam clue: Federation is strong when sign-ins must be evaluated by on-premises AD, but the wording âminimizing the number of additional serversâ conflicts with the infrastructure required by AD FS.
Remember: AD FS provides federation and on-premises policy enforcement, but adds server infrastructure. Password hash synchronization is usually the simplest hybrid option when minimizing infrastructure is important.
Question 17
Your Azure AD tenant has the setting "Users can register applications" set to No, preventing users from registering apps by default. You need to allow User1 to register a new application called App1 while following the principle of least privilege. Which Azure AD role should you assign to User1?
Correct answer: Application Developer
The Application Developer role allows a user to create application registrations when the tenant setting that permits all users to register applications is disabled. It also allows the user to manage applications they create, without giving broad administration rights over all applications.
Exam clue: The question asks for one user to register a new application while applying least privilege. Choose the role scoped to creating and managing the userâs own app registrations.
Remember: Application Developer is the least-privileged Entra role for allowing selected users to create app registrations. Cloud Application Administrator can manage all application registrations and is broader.
Question 18
You manage cross-tenant access between contoso.com and a partner tenant, fabrikam.com, which enforces MFA. Contoso has cross-tenant access and external collaboration settings, plus a Conditional Access policy requiring compliant devices and MFA for guest users. Evaluate these statements: 1. Fabrikam users with compliant devices get full app access without other restrictions. 2. The policy accepts MFA claims from fabrikam.com users. 3. Fabrikam guest users can view and modify all contoso.com user properties. Which option correctly evaluates these statements?
Correct answer: False, True, False
A compliant device does not by itself bypass all other Conditional Access requirements; the guest policy also requires MFA, and cross-tenant settings can impose additional controls. With the relevant cross-tenant trust configured, Contoso can accept an MFA claim from Fabrikam. Guest users have restricted directory permissions and cannot view and modify all Contoso user properties.
Exam clue: Separate the three controls: device compliance, trust of an external MFA claim, and guest directory permissions. They are independent settings.
Remember: Cross-tenant access can trust partner MFA and device claims, but it does not grant unrestricted app or directory access. Guest users remain limited by external collaboration and directory permissions.
Question 19
You are designing a hybrid identity solution for a company using Azure HDInsight clusters on a virtual network. To enable on-premises Active Directory users to authenticate to the HDInsight cluster with their existing credentials, you propose deploying Azure AD Domain Services in Azure. Does this meet the requirement without additional configuration?
Correct answer: No.
Azure AD Domain Services provides managed domain services, but it must have the required Microsoft Entra users, groups, and password hashes available. For on-premises Active Directory users, configure synchronization to Microsoft Entra ID, typically with Azure AD Connect and password hash synchronization, before Azure AD Domain Services can support the authentication scenario.
Exam clue: The phrase âwithout additional configurationâ is decisive. Deploying Azure AD Domain Services does not by itself synchronize an on-premises AD domain or make its credentials available.
Remember: Azure AD Domain Services is managed domain infrastructure, not an automatic bridge to on-premises AD. Synchronize identities and password hashes first.