Question bank
Azure Security Engineer Associate
42 Azure Security Engineer Associate questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
14 questions in this domain
- Question 1Single Choice
What is the primary purpose of Microsoft Defender for Cloud?
- ACloud security posture management and workload protectionCorrect answer
- BSecurity information and event management
- CDomain name system filtering
- DVirtual private network gateway
Why this is the answer
Microsoft Defender for Cloud is a cloud-native security posture management and workload protection platform that helps secure cloud resources.
- Question 2Multiple Select
Which resources can be protected by Microsoft Defender for Cloud enhanced security plans? (Select all that apply.)
- AVirtual machinesCorrect answer
- BAzure SQL databasesCorrect answer
- CAzure Kubernetes Service clustersCorrect answer
- DMicrosoft 365 mailboxes
Why this is the answer
Enhanced security plans in Microsoft Defender for Cloud protect compute, data, and services such as VMs, SQL databases, and Kubernetes clusters; mailboxes are covered by Microsoft 365 Defender.
- Question 3Interactive
The code block contains a KQL query. Which statement correctly describes the query output?
- ATop 10 accounts with the most security events in the last 24 hoursCorrect answer
- BSecurity events with a severity higher than 10
- CAll security events from the last 10 days
- DA list of computers unavailable in the last 24 hours
Why this is the answer
The query filters the last 24 hours of SecurityEvent data, counts events per account, and returns the top 10 accounts by count.
- Question 4Single Choice
What kind of solution is Microsoft Sentinel?
- ACloud-native SIEM and SOAR solutionCorrect answer
- BCloud access security broker
- CWeb application firewall
- DContainer orchestration platform
Why this is the answer
Microsoft Sentinel is a cloud-native SIEM and SOAR solution that provides intelligent security analytics and automated response across the enterprise.
- Question 5Multiple Select
Which of the following are built-in data connectors in Microsoft Sentinel? (Select all that apply.)
- AAzure Active DirectoryCorrect answer
- BOffice 365Correct answer
- CAzure ActivityCorrect answer
- DSQL Server Management Studio
Why this is the answer
Microsoft Sentinel provides built-in connectors for Azure AD, Office 365, Azure Activity, and many others; SQL Server Management Studio is not a data source connector.
- Question 6Interactive
The KQL query in the code block is run in Microsoft Sentinel. What does it produce?
- AA pie chart showing the count of alerts by severityCorrect answer
- BA bar chart of alerts over time
- CA table of all security alerts
- DA line chart of alerts by workspace
Why this is the answer
The query counts SecurityAlert records by Severity and renders a pie chart, giving a visual distribution of alert severity.
- Question 7Single Choice
What does the secure score in Microsoft Defender for Cloud indicate?
- ASecurity posture based on completed recommendationsCorrect answer
- BNumber of workloads currently running
- CVolume of security logs ingested
- DNumber of active alerts
Why this is the answer
Secure score aggregates the status of security recommendations, measuring how well an organization has improved its security posture.
- Question 8Multiple Select
Which of the following are SOAR capabilities provided by Microsoft Sentinel? (Select all that apply.)
- APlaybooksCorrect answer
- BAutomation rulesCorrect answer
- CIncident managementCorrect answer
- DNetwork packet capture
Why this is the answer
Microsoft Sentinel SOAR uses playbooks, automation rules, and incident management to orchestrate and automate investigations; packet capture is not a Sentinel feature.
- Question 9Interactive
The KQL query in the code block is intended to identify which information?
- AComputers with more than 10 heartbeat recordsCorrect answer
- BComputers with fewer than 10 heartbeat records
- CThe 10 most recent heartbeat records
- DHeartbeats that occurred in the last 10 minutes
Why this is the answer
The query groups heartbeat records by computer and keeps only computers whose count is greater than 10.
- Question 10Single Choice
Which Azure service is used as the data store for Microsoft Sentinel?
- ALog Analytics workspaceCorrect answer
- BAzure Data Lake Storage
- CAzure SQL Database
- DBlob storage
Why this is the answer
Microsoft Sentinel is built on top of Log Analytics workspaces, where logs and alerts are stored and queried.
- Question 11Multiple Select
Which features are included in Microsoft Defender for Cloud's foundational CSPM tier? (Select all that apply.)
- ASecurity recommendationsCorrect answer
- BSecure scoreCorrect answer
- CAsset inventoryCorrect answer
- DJust-in-time VM access
Why this is the answer
Foundational CSPM includes continuous assessment, security recommendations, secure score, and inventory; just-in-time VM access requires an enhanced security plan.
- Question 12Interactive
Examine the KQL query in the code block. Which fields will appear in the result set?
- ATimeGenerated, AlertName, and WorkspaceId columnsCorrect answer
- BAll columns from the SecurityAlert table
- COnly alerts with high severity
- DMalware files detected on VMs
Why this is the answer
The project operator restricts the result to TimeGenerated, AlertName, and WorkspaceId, filtered to alerts named Malware.
- Question 13Single Choice
What is the primary query language used by Microsoft Sentinel?
- AKusto Query Language (KQL)Correct answer
- BT-SQL
- CPython
- DYAML
Why this is the answer
Kusto Query Language, or KQL, is the primary language for querying data in Microsoft Sentinel and Azure Data Explorer.
- Question 14Multiple Select
Which Microsoft Sentinel features are used to automate response actions? (Select all that apply.)
- APlaybooksCorrect answer
- BAutomation rulesCorrect answer
- CWorkbooks
- DHunting queries
Why this is the answer
Playbooks provide predefined response actions and automation rules trigger those responses; workbooks and hunting queries are for visibility and investigation.
Secure Identity and Access
8 questions in this domain
- Question 15Single Choice
What is Microsoft Entra ID (formerly Azure Active Directory) used for in Azure?
- ACloud identity and access managementCorrect answer
- BDomain name system (DNS) hosting
- CVirtual machine snapshot backup
- DNetwork packet filtering
Why this is the answer
Microsoft Entra ID is Microsoft's cloud-based identity and access management service. It supports authentication, single sign-on, and application access control.
- Question 16Multiple Select
Which of the following are capabilities of Microsoft Entra ID? (Select all that apply.)
- AConditional AccessCorrect answer
- BIdentity ProtectionCorrect answer
- CPrivileged Identity ManagementCorrect answer
- DAzure Traffic Manager
Why this is the answer
Conditional Access, Identity Protection, and Privileged Identity Management are all Microsoft Entra ID capabilities. Azure Traffic Manager is a networking service.
- Question 17Interactive
The command in the code block is executed by an administrator. What is the result?
- ACreates a new user in Microsoft Entra IDCorrect answer
- BCreates an Azure resource group
- CAssigns a Contributor role
- DDeletes an application registration
Why this is the answer
the command az ad user create provisions a new user object in Microsoft Entra ID. It does not manage Azure infrastructure roles or resource groups.
- Question 18Single Choice
What is a service principal in Microsoft Entra ID?
- AAn identity created for an applicationCorrect answer
- BA virtual machine image
- CA global Azure region
- DA storage account key
Why this is the answer
A service principal is the identity that an application uses to access Azure resources. It can be used for authentication and authorization.
- Question 19Multiple Select
Which of the following are Azure AD/Entra ID multi-factor authentication verification methods? (Select all that apply.)
- AMobile app notificationCorrect answer
- BPhone callCorrect answer
- COATH hardware tokenCorrect answer
- DEmail confirmation
Why this is the answer
Microsoft Entra ID MFA supports mobile app notifications, phone calls, SMS, and OATH tokens. Email is not an MFA verification method for interactive sign-in.
- Question 20Interactive
An administrator defines the Conditional Access policy in the code block. What does this policy require?
- AMulti-factor authentication for all included cloud appsCorrect answer
- BBlocking all application sign-ins
- CA mandatory password change
- DRequiring a hybrid Azure AD join
Why this is the answer
The policy includes all applications and configures MFA as a grant control. It does not block access, require a password change, or enforce device join.
- Question 21Single Choice
Which built-in Azure role is specifically designed to manage user access to Azure resources?
- AUser Access AdministratorCorrect answer
- BReader
- CContributor
- DSecurity Reader
Why this is the answer
The User Access Administrator role can manage user access to Azure resources through role assignments. Reader and Contributor do not manage permissions for others.
- Question 22Multiple Select
Which of the following are common elements of a Microsoft Entra ID Conditional Access policy? (Select all that apply.)
- AUser and group assignmentsCorrect answer
- BTarget cloud applications or actionsCorrect answer
- CConditions such as device state or riskCorrect answer
- DPassword hash synchronization
Why this is the answer
A Conditional Access policy includes signals, assignments to users and cloud apps, and access controls. Password hash synchronization is an authentication mechanism, not a policy component.
Secure compute, storage, and databases
10 questions in this domain
- Question 23Single Choice
Which Microsoft Azure service provides centralized security management and advanced threat protection across cloud workloads?
- AMicrosoft Defender for CloudCorrect answer
- BAzure Sentinel
- CAzure Monitor
- DAzure Policy
Why this is the answer
Microsoft Defender for Cloud provides centralized security posture management and advanced threat protection for cloud workloads, making it the correct answer.
- Question 24Multiple Select
Which two of the following are recommended security practices for securing an Azure Storage account?
- ARequire secure transfer for the storage accountCorrect answer
- BDisable public blob accessCorrect answer
- CAllow all IP addresses through the storage firewall
- DStore account keys in application source code
Why this is the answer
Requiring secure transfer enforces HTTPS, and disabling public blob access prevents anonymous access. Allowing all IPs and embedding keys increases exposure.
- Question 25Interactive
The following Azure CLI command creates a storage account. Which security configuration is being applied by this command?
- ADisables public blob access and requires TLS 1.2Correct answer
- BEnables Azure AD authentication and disables TLS
- CConfigures a private endpoint only
- DStores storage account keys in Azure Key Vault
Why this is the answer
The command uses --allow-blob-public-access false to block anonymous access and --min-tls-version TLS1_2 to require secure TLS connections.
- Question 26Single Choice
Which Azure SQL Database feature encrypts a database and its backups without requiring changes to the application?
- ATransparent Data EncryptionCorrect answer
- BAlways Encrypted
- CDynamic Data Masking
- DAuditing
Why this is the answer
Transparent Data Encryption encrypts SQL Server, Azure SQL Database, and backup files at rest while requiring no change to application code.
- Question 27Multiple Select
Which two statements about Azure managed identities are true?
- AThey provide an automatically managed identity in Azure ADCorrect answer
- BThey allow applications to authenticate without storing credentialsCorrect answer
- CThey require a client secret to be stored in source code
- DThey can only be assigned to on-premises virtual machines
Why this is the answer
Managed identities are backed by Azure AD service principals and remove the need to manage credentials. They are used by Azure resources, not on-premises VMs.
- Question 28Interactive
Consider the following Azure CLI command. What is the primary purpose of this command?
- AProvisions a new Azure SQL database in an existing serverCorrect answer
- BCreates a new Azure SQL logical server
- CDeletes an existing Azure SQL database
- DScales a database to a higher service tier
Why this is the answer
The command includes az sql db create and a server name, indicating it creates a new database in an existing logical SQL server.
- Question 29Single Choice
Which Azure Storage feature prevents Blob data from being modified or deleted for a specified time interval?
- AImmutability policiesCorrect answer
- BSoft delete
- CShared access signatures
- DStorage account failover
Why this is the answer
Immutability policies enforce WORM storage, preventing blobs from being modified or deleted for the configured retention period.
- Question 30Multiple Select
Which two options can be used to restrict network access to an Azure SQL database?
- ASQL Database firewall rulesCorrect answer
- BAzure Private EndpointCorrect answer
- CAzure CDN rules
- DDNS forwarding rules
Why this is the answer
SQL Database firewall rules filter by IP address, and Private Endpoints connect privately to the database without exposing a public endpoint.
- Question 31Interactive
Examine the following Azure CLI command. What does this command accomplish?
- AGrants a user data-plane access to a storage accountCorrect answer
- BCreates a new storage account
- CAssigns a user the Azure AD Global Administrator role
- DRemoves an existing role assignment
Why this is the answer
The az role assignment create command assigns the Storage Blob Data Contributor role, giving the user data-plane access at the storage account scope.
- Question 32Single Choice
Which Azure component acts as a virtual firewall for filtering traffic to and from Azure virtual machines?
- ANetwork Security GroupCorrect answer
- BAzure DDoS Protection
- CApplication Gateway
- DRoute table
Why this is the answer
Network security groups contain security rules that filter inbound and outbound traffic for Azure VMs and virtual network subnets.
Secure networking
10 questions in this domain
- Question 33Single Choice
Which Azure resource uses security rules to allow or deny inbound and outbound network traffic for subnets and network interfaces?
- ANetwork Security GroupCorrect answer
- BAzure Firewall
- CAzure DDoS Protection
- DAzure Bastion
Why this is the answer
A Network Security Group filters traffic with security rules assigned to subnets or network interfaces. Azure Firewall is a separate cloud-delivered network security service.
- Question 34Multiple Select
Which two abilities are provided by an Azure Network Security Group?
- AFilter traffic based on source IP and portCorrect answer
- BApply allow and deny rules at subnet or NIC levelCorrect answer
- CProvide SQL injection attack protection
- DAutomatically encrypt all network packets
Why this is the answer
Network Security Groups enforce allow and deny rules based on IP, port, and protocol at the subnet or NIC level. SQL injection protection is a Web Application Firewall feature, not an NSG function.
- Question 35Interactive
Refer to the command in the code block. What does this command accomplish?
- AAllows inbound TCP traffic to port 80 for a specific IP addressCorrect answer
- BBlocks outbound TCP traffic to all destinations
- CCreates a virtual network with a new subnet
- DDeletes an existing network security group rule
Why this is the answer
The command creates an inbound security rule that allows TCP traffic on port 80 to the destination IP 10.0.0.4 from any source.
- Question 36Single Choice
Which Azure service provides continuous monitoring and mitigation for volumetric network DDoS attacks?
- AAzure DDoS ProtectionCorrect answer
- BAzure Firewall
- CNetwork Security Group
- DAzure Front Door
Why this is the answer
Azure DDoS Protection provides always-on traffic monitoring and mitigation for volumetric DDoS attacks. Azure Firewall and NSGs focus on traffic filtering rather than DDoS defense.
- Question 37Multiple Select
Which two statements accurately describe Azure DDoS Protection?
- AAlways-on traffic monitoring and mitigationCorrect answer
- BProtects Azure resources from volumetric DDoS attacksCorrect answer
- CReplaces private endpoint encryption
- DGenerates public SSL certificates
Why this is the answer
Azure DDoS Protection continuously monitors traffic and mitigates volumetric attacks. It does not replace encryption or issue SSL certificates.
- Question 38Interactive
Refer to the command in the code block. What is the command doing?
- AAttaches an NSG to the named subnetCorrect answer
- BCreates a new virtual network
- CRemoves all rules from an NSG
- DAssigns a public IP address to a VM
Why this is the answer
The command updates the subnet named SubnetA in VNet by associating the network security group MyNsg with that subnet.
- Question 39Single Choice
Which Azure service creates a managed jump host for securely connecting to virtual machines without public endpoints?
- AAzure BastionCorrect answer
- BAzure DNS
- CTraffic Manager
- DNetwork Watcher
Why this is the answer
Azure Bastion is a fully managed service that provides secure and seamless RDP and SSH access to virtual machines directly from the Azure portal without public IPs.
- Question 40Multiple Select
Which two benefits are provided by Azure Private Link?
- APrivate connectivity to Azure services from a virtual networkCorrect answer
- BKeeps service traffic on the Microsoft network instead of the public internetCorrect answer
- CAutomates virtual machine patch management
- DProvides a public load balancer for web applications
Why this is the answer
Azure Private Link enables private connectivity between a virtual network and Azure services, keeping traffic within the Microsoft backbone and avoiding public internet exposure.
- Question 41Interactive
Refer to the code block. Which type of Azure Firewall rule is being configured?
- AApplication ruleCorrect answer
- BNetwork rule
- CNAT rule
- DRoute table rule
Why this is the answer
The command creates an Azure Firewall application rule because it specifies FQDN tags, HTTP/HTTPS protocols, and source addresses for outbound access from an application.
- Question 42Single Choice
Which Azure networking component provides an encrypted site-to-site VPN tunnel between an on-premises network and an Azure virtual network?
- AVPN GatewayCorrect answer
- BExpressRoute
- CAzure Front Door
- DApplication Security Group
Why this is the answer
Azure VPN Gateway supports encrypted site-to-site connectivity between on-premises networks and Azure virtual networks over the public internet.
Frequently asked questions
Everything about the Azure Security Engineer Associate question bank and how to use it.