A company uses Azure API Management (APIM) to expose internal APIs to partner organizations. The APIs are hosted in a VNet. The security team requires that only partners with a valid client certificate can access the APIs, and that the APIM endpoint is protected from DDoS attacks. The company also wants to restrict access to the APIM gateway to only the partners' IP ranges. What should you do?

Use Azure AD authentication for the APIs and enable DDoS Protection on the APIM service.

Deploy Azure Application Gateway with a WAF in front of APIM and require client certificates at the gateway.

Use subscription keys and require partners to send the key in the header, and enable DDoS Protection on the VNet.

Enable mutual TLS (mTLS) in APIM, configure IP-based access restrictions, and enable DDoS Protection on the VNet.

What type of data is collected by Azure Monitor for Azure Container Instances to support security monitoring?

Metrics and logs from container instances

Your development team uses Azure Container Registry (ACR) to store container images for an AKS cluster. You need to ensure that only the AKS cluster can pull images from the registry, and that developers can push images only from the corporate network. What should you do?

Create a shared admin user account and distribute its credentials to the development team and the AKS cluster.

Configure ACR to be accessible only from the AKS cluster's VNet and use a SAS token for developers.

Enable the AKS cluster's managed identity as a pull principal in ACR and configure the registry's network rules to allow only the corporate IP range.

Use Azure AD authentication for the AKS cluster and assign the 'AcrPull' role to the cluster's service principal.

Your organization is deploying a multi-tier application on Azure Kubernetes Service (AKS). The front-end pods must be able to communicate with the back-end pods, but the back-end pods must not be reachable from outside the cluster. You also need to ensure that only authenticated users can access the Kubernetes API server. Which combination of actions should you take?

Use Azure AD integration for the AKS cluster and assign RBAC roles

Configure an NSG on the AKS subnet to block inbound traffic from the internet

Enable network policy and use a private AKS cluster

Deploy a service mesh like Istio and enable mTLS

What is a key characteristic of a private AKS cluster?

The API server endpoint is accessible only from within the virtual network

The cluster can only be managed from the Azure portal

The cluster nodes are not connected to any virtual network

The cluster uses only managed disks for storage

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 1

Plan and Implement Advanced Security for Compute AZ-500 Practice Questions (Page 3)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

20–25%of the exam

Questions 11–15

11expert · hard
A company uses Azure API Management (APIM) to expose internal APIs to partner organizations. The APIs are hosted in a VNet. The security team requires that only partners with a valid client certificate can access the APIs, and that the APIM endpoint is protected from DDoS attacks. The company also wants to restrict access to the APIM gateway to only the partners' IP ranges. What should you do?
Select an answer first
12foundation · easy
What type of data is collected by Azure Monitor for Azure Container Instances to support security monitoring?
Select an answer first
13application · medium
Your development team uses Azure Container Registry (ACR) to store container images for an AKS cluster. You need to ensure that only the AKS cluster can pull images from the registry, and that developers can push images only from the corporate network. What should you do?
Select an answer first
14application · medium
Your organization is deploying a multi-tier application on Azure Kubernetes Service (AKS). The front-end pods must be able to communicate with the back-end pods, but the back-end pods must not be reachable from outside the cluster. You also need to ensure that only authenticated users can access the Kubernetes API server. Which combination of actions should you take?
Select an answer first
15foundation · easy
What is a key characteristic of a private AKS cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Advanced Security for Compute AZ-500 Practice Questions (Page 3)

Questions 11–15

What type of data is collected by Azure Monitor for Azure Container Instances to support security monitoring?

Your development team uses Azure Container Registry (ACR) to store container images for an AKS cluster. You need to ensure that only the AKS cluster can pull images from the registry, and that developers can push images only from the corporate network. What should you do?

What is a key characteristic of a private AKS cluster?

Keep studying — Secure compute, storage, and databases