1500 Questions | Azure Security Engineer (AZ-500) 2026

Implement Threat Protection (20%): Configuring and managing threat protection services across Azure Monitor and Network Security Groups (NSGs).

Implement Workload Security (20%): Protecting specific cloud workloads using advanced tools like Microsoft Defender for Endpoint and Office 365 Threat Intelligence.

Identity and Access, Information Protection, and Governance (15%): Deep-diving into Azure AD (Entra ID), Conditional Access, RBAC, and governance frameworks.

Monitor and Respond to Security Threats (15%): Utilizing Azure Sentinel (Microsoft Sentinel) and Defender for Cloud to detect and remediate active threats.

B. Network Security Group (NSG)

C. Azure Bastion

D. Application Gateway

E. Azure Web Application Firewall (WAF)

F. Service Tags

Correct Answer: B

Explanation:

A (Incorrect): ExpressRoute is for private connections between on-premises and Azure, not internal subnet filtering.

C (Incorrect): Azure Bastion provides secure RDP/SSH access but does not filter inter-subnet traffic.

D (Incorrect): Application Gateway is an L7 load balancer; while it has security features, an NSG is the standard and most efficient way to handle internal port-level filtering.

E (Incorrect): WAF protects web applications from common exploits (L7), not SQL traffic at the network layer (L4).

F (Incorrect): Service Tags simplify rule creation but are not the "resource" that enforces the security policy itself.

Question 2: Your organization requires that all new Virtual Machines created in a specific resource group must have "Disk Encryption" enabled. Which Azure service should I use to automatically audit and enforce this compliance?

B. Azure Blueprints

C. Azure Policy

D. Microsoft Defender for Cloud

E. Azure Monitor

F. Resource Health

Correct Answer: C

Explanation:

A (Incorrect): Sentinel is a SIEM/SOAR tool for threat detection, not for enforcing resource configuration policies.

B (Incorrect): Blueprints help with environment setup, but Azure Policy is the engine that handles the specific enforcement of encryption rules.

D (Incorrect): Defender for Cloud provides recommendations, but it doesn't "enforce" the creation rules in the same declarative way a Policy does.

E (Incorrect): Azure Monitor collects performance data; it does not govern resource settings.

F (Incorrect): Resource Health tracks the availability of services, not their security configuration.

Question 3: You need to implement "Just-In-Time" (JIT) VM access to reduce exposure to brute force attacks. Which license or service is a prerequisite for this feature?

B. Microsoft Defender for Cloud (Enhanced Security features)

C. Azure Basic Load Balancer

D. Azure Backup Vault

E. Microsoft 365 Business Basic

F. Standard Tier Storage Account

Correct Answer: B

Explanation:

A (Incorrect): The free edition of Azure AD does not include advanced cloud workload protection features like JIT.

C (Incorrect): Load balancers distribute traffic but do not manage JIT access policies.

D (Incorrect): Backup services are for data recovery and have no impact on network access control.

E (Incorrect): This is a productivity suite license, not an az 305 azure infrastructure solutions practice tests course security license.

F (Incorrect): Storage tiers are unrelated to the compute security features required for JIT.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app

30-days money-back guarantee if you're not satisfied