Your company runs a production AKS cluster. You need to ensure that the Kubernetes API server is not accessible from the internet, and you want to receive alerts when a pod attempts to mount the host filesystem. What should you do?

Create a public AKS cluster and use Azure Policy to deny host filesystem mounts.

Use an NSG on the AKS subnet to block internet access to the API server and enable Azure Monitor.

Create a private AKS cluster and enable Microsoft Defender for Containers.

Enable Azure AD integration and use RBAC to restrict API server access.

Which disk encryption solution uses BitLocker on Windows and DM-Crypt on Linux to encrypt Azure VM disks?

Azure Storage Service Encryption

Your company has a production virtual machine that runs a legacy line-of-business application. The VM is in a VNet with no public IP address. A support engineer needs to connect to the VM using RDP from their corporate laptop, but the corporate firewall only allows outbound HTTPS traffic. You need to enable the connection without exposing the VM to the internet. What should you do?

Deploy Azure Bastion in the same VNet and connect through the Bastion service using the Azure portal.

Assign a public IP address to the VM and create an NSG rule that allows RDP from the engineer's public IP.

Use Azure AD Domain Services to enable RDP through the Azure portal.

Create a site-to-site VPN connection and have the engineer connect to the VM's private IP over the VPN.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 1

Plan and Implement Advanced Security for Compute AZ-500 Practice Questions (Page 6)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

10concepts

20–25%of the exam

Questions 26–30

26application · medium
Your company runs a production AKS cluster. You need to ensure that the Kubernetes API server is not accessible from the internet, and you want to receive alerts when a pod attempts to mount the host filesystem. What should you do?
Select an answer first
27foundation · easy
Which Azure service can be used to monitor Azure Container Instances (ACI) for security threats and collect activity logs?
Select an answer first
28foundation · easy
Which disk encryption solution uses BitLocker on Windows and DM-Crypt on Linux to encrypt Azure VM disks?
Select an answer first
29foundation · easy
Which Azure Container Registry feature allows you to restrict access to the registry from specific IP addresses or virtual networks?
Select an answer first
30application · medium
Your company has a production virtual machine that runs a legacy line-of-business application. The VM is in a VNet with no public IP address. A support engineer needs to connect to the VM using RDP from their corporate laptop, but the corporate firewall only allows outbound HTTPS traffic. You need to enable the connection without exposing the VM to the internet. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Advanced Security for Compute AZ-500 Practice Questions (Page 6)

Questions 26–30

Your company runs a production AKS cluster. You need to ensure that the Kubernetes API server is not accessible from the internet, and you want to receive alerts when a pod attempts to mount the host filesystem. What should you do?

Which Azure service can be used to monitor Azure Container Instances (ACI) for security threats and collect activity logs?

Which disk encryption solution uses BitLocker on Windows and DM-Crypt on Linux to encrypt Azure VM disks?

Which Azure Container Registry feature allows you to restrict access to the registry from specific IP addresses or virtual networks?

Keep studying — Secure compute, storage, and databases