Microsoft Azure Security Engineer Associate AZ-500 AZ-500 Questions 76–150 | Page 2/3

MCQmedium

A company uses Microsoft Defender for Cloud to manage its security posture. The compliance team wants to monitor the subscription's compliance with the Payment Card Industry Data Security Standard (PCI DSS). They need to view a detailed compliance report and track progress over time. What should they do in Defender for Cloud?

A.Enable the relevant Defender for Cloud plans (e.g., Defender for Servers, Defender for SQL).

B.Add the PCI DSS standard from the regulatory compliance dashboard.

C.Create a custom regulatory compliance initiative based on PCI DSS controls.

D.Configure continuous export to send compliance data to a Log Analytics workspace.

AnswerB

Adding the PCI DSS standard from the regulatory compliance dashboard is the correct action because Defender for Cloud includes a built-in regulatory compliance initiative pre-mapped to PCI DSS controls. This initiative automatically runs assessments against your environment and presents the results in a dedicated compliance view, allowing you to track progress against each control requirement. This is the straightforward, intended method to start monitoring PCI DSS compliance.

Why this answer

The regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in compliance standards like PCI DSS. Once added, the dashboard automatically assesses your subscription against the standard's controls, provides a detailed compliance report, and tracks progress over time with a compliance score and historical trend. This is the direct method to monitor PCI DSS compliance without needing to enable specific Defender plans or create custom initiatives.

Exam trap

The trap here is that candidates often confuse enabling Defender plans (which provide threat detection) with adding a compliance standard (which provides a compliance assessment), leading them to select Option A instead of the correct dashboard action in Option B.

How to eliminate wrong answers

Option A is wrong because enabling Defender for Cloud plans (e.g., Defender for Servers, Defender for SQL) provides security alerts and advanced threat protection but does not by itself add or display a PCI DSS compliance report; the regulatory compliance dashboard must be explicitly configured with the standard. Option C is wrong because creating a custom regulatory compliance initiative based on PCI DSS controls is unnecessary and more complex; Microsoft provides a built-in PCI DSS initiative that is automatically updated and maintained, and custom initiatives are typically used for organization-specific controls, not for adopting a standard already available in the dashboard. Option D is wrong because configuring continuous export to a Log Analytics workspace sends raw security data (e.g., alerts, recommendations) for external analysis or retention, but it does not generate or display the PCI DSS compliance report or track progress within Defender for Cloud's dashboard.

Full explanation →

MCQhard

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

A.Azure Firewall does not support traffic between spoke VNets.

B.The UDR on the firewall subnet does not include the spoke address spaces.

C.The 'Allow gateway transit' setting is disabled on the spoke peering.

D.The 'Use remote gateway' setting is disabled on the spoke VNet peering.

AnswerD

Spoke VNets must use remote gateway to route traffic through the hub firewall.

Why this answer

In a hub-spoke topology with Azure Firewall, the 'Use remote gateway' setting on the spoke VNet peering must be disabled. This setting is only for using a VPN or ExpressRoute gateway in the hub; it does not enable routing through Azure Firewall. With this setting disabled, the configured UDRs on the spoke subnets can direct spoke-to-spoke traffic to the firewall for inspection.

Exam trap

The trap is that candidates may think 'Use remote gateway' must be enabled to force traffic through the hub firewall; in fact, it should remain disabled because it applies to VPN/ExpressRoute gateways, not Azure Firewall. UDRs are the correct mechanism for routing spoke-to-spoke traffic through the firewall.

How to eliminate wrong answers

Option A is wrong because Azure Firewall fully supports traffic inspection between spoke VNets when properly configured with UDRs and peering settings. Option B is wrong because the UDR on the firewall subnet is not required for spoke-to-spoke routing; the firewall subnet itself does not need UDRs to forward traffic—it uses its own routing table. Option C is wrong because 'Allow gateway transit' is a setting on the hub VNet peering (not the spoke) and is used to allow the hub to advertise routes to the spoke; it does not directly control spoke-to-spoke traffic routing through the firewall.

Full explanation →

MCQhard

You are designing a network security strategy for an Azure Kubernetes Service (AKS) cluster. You need to restrict egress traffic from the cluster to only allow connections to specific Azure services (e.g., Microsoft Container Registry, Azure Key Vault). The solution must minimize administrative overhead. What should you use?

A.Configure Azure Policy to deny egress to non-approved destinations.

B.Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.

C.Use Kubernetes network policies for egress.

D.Define NSG rules to allow outbound traffic to the service IP ranges.

AnswerB

FQDN tags simplify allowing traffic to popular Azure services without managing IPs.

Why this answer

Azure Firewall with FQDN tags allows you to define outbound network rules based on fully qualified domain names (FQDNs) for Azure services like Microsoft Container Registry and Azure Key Vault. This approach minimizes administrative overhead because FQDN tags are automatically updated as Azure service IP ranges change, eliminating the need for manual IP maintenance. It provides a centralized, managed firewall solution that integrates natively with AKS for egress filtering.

Exam trap

The trap here is that candidates often assume Kubernetes network policies can control egress to external services, but they only apply to traffic between pods within the cluster, not to outbound traffic leaving the AKS node's virtual network.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool for enforcing compliance rules on resource configurations, not a network security mechanism to filter or block egress traffic at the packet level. Option C is wrong because Kubernetes network policies operate at the pod level within the cluster and cannot control egress traffic to external Azure services outside the cluster's virtual network. Option D is wrong because NSG rules require specifying static IP ranges for Azure services, which change frequently and would require constant manual updates, increasing administrative overhead and risking connectivity failures.

Full explanation →

MCQhard

An organization uses Microsoft Defender for Cloud. They want to implement just-in-time (JIT) VM access for a set of production VMs. However, the security team needs to ensure that JIT access requests are always approved by a manager before opening ports. Which configuration should they use?

A.Enable JIT in Defender for Cloud and configure a logic app to send approval emails

B.Use Azure AD Privileged Identity Management (PIM) for JIT activation

C.Enable JIT and configure a custom workflow automation with an approval step

D.Use Conditional Access with session controls

AnswerC

The correct approach is to enable Defender for Cloud's JIT VM access and then create a custom workflow automation rule that triggers an Azure Logic App containing an approval step. The Logic App can use an approval connector (e.g., Send approval request through email or Teams) to pause the workflow until a manager or security officer approve or rejects the request. Only after approval does the Logic App signal Defender for Cloud to apply the JIT policy and open the requested ports, thereby enforcing a true approval gate before network access is granted.

Why this answer

Microsoft Defender for Cloud's JIT VM access can be integrated with a custom workflow automation that includes an approval step. This allows the security team to enforce manager approval before ports are opened, meeting the requirement for a formal approval process. The workflow automation can trigger an Azure Logic App or other action that requires a designated approver to authorize the request.

Exam trap

The trap here is confusing Azure AD PIM (which manages role activation) with JIT VM access (which manages network port openings), leading candidates to incorrectly select PIM for VM-level access control.

How to eliminate wrong answers

Option A is wrong because while a logic app can send approval emails, it does not enforce a mandatory approval step before JIT access is granted; the JIT request would still be automatically approved unless the logic app is configured to block it, which is not a native capability. Option B is wrong because Azure AD PIM is designed for managing and approving privileged role activations, not for controlling JIT VM access requests to specific ports on VMs. Option D is wrong because Conditional Access with session controls governs access to applications and data based on conditions like location or device compliance, not for approving JIT port openings on VMs.

Full explanation →

Drag & Dropmedium

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The firewall configuration is under networking, and you must add the virtual network to allow traffic.

Full explanation →

MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall that blocks all public access. The SQL server is a managed service that needs to access the key to perform TDE operations. The Key Vault is in the same Azure region as the SQL server. Which additional configuration is needed?

A.Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings

B.Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet

C.Assign the SQL server's server identity the 'Contributor' role on the Key Vault

D.Create a private endpoint for the Key Vault in the SQL server's virtual network

AnswerA

The Key Vault firewall blocks all data plane access by default, which would break TDE key operations. Enabling 'Allow trusted Microsoft services to bypass this firewall' explicitly authorizes Azure SQL Database (as a trusted Microsoft service) to reach the vault for wrap/unwrap operations, provided the SQL server's managed identity is also granted the correct RBAC role or access policy. This is the standard configuration when using customer-managed keys for TDE on Azure SQL Database while the vault firewall is turned on.

Why this answer

When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.

Exam trap

The trap here is that candidates often assume a private endpoint or service endpoint is always required for secure access, but for PaaS services like Azure SQL Database that use managed identities, the 'Allow trusted Microsoft services' setting is the simplest and correct solution when the Key Vault firewall blocks public access.

How to eliminate wrong answers

Option B is wrong because configuring a service endpoint for Microsoft.KeyVault on the SQL server's subnet is not applicable—Azure SQL Database is a PaaS service that does not have a subnet in a virtual network by default; service endpoints are used for VNet-integrated resources like VMs or App Service, not for SQL Database's managed identity access to Key Vault. Option C is wrong because assigning the 'Contributor' role on the Key Vault grants excessive permissions (e.g., ability to modify keys) and is not required; the SQL server's identity only needs the 'Get' and 'Unwrap Key' permissions on the key itself, which are granted via a Key Vault access policy, not RBAC roles. Option D is wrong because creating a private endpoint for Key Vault in the SQL server's virtual network would require the SQL server to be integrated into a VNet, which is not the default configuration for Azure SQL Database; private endpoints are used for network isolation but do not solve the firewall bypass issue for a managed service that needs to reach Key Vault over the public endpoint.

Full explanation →

MCQmedium

A company stores critical business data in an Azure Storage account (Blob Storage). They want to ensure that all data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data quickly if a breach is suspected. Which feature should they enable on the storage account to enforce CMK?

A.Enable infrastructure encryption for the storage account

B.Enable Azure Storage encryption with customer-managed keys

C.Enable soft delete for blobs

D.Enable versioning for blobs

AnswerB

This configures the storage account to use a CMK from Key Vault. Revocation is done by disabling the key in Key Vault, making the data inaccessible.

Why this answer

Enabling Azure Storage encryption with customer-managed keys (CMK) allows you to use your own key stored in Azure Key Vault to encrypt all data at rest in the storage account. This also provides the ability to revoke access to the data quickly by disabling, deleting, or rotating the key in Key Vault, which renders the data inaccessible until the key is restored.

Exam trap

The trap here is that candidates often confuse infrastructure encryption (which adds a second encryption layer but uses Microsoft-managed keys) with customer-managed key encryption, or they mistakenly think soft delete or versioning can enforce encryption key control and revocation.

How to eliminate wrong answers

Option A is wrong because infrastructure encryption provides an additional layer of encryption at the infrastructure level using platform-managed keys, not customer-managed keys, and does not support revocation via Key Vault. Option C is wrong because soft delete for blobs protects against accidental deletion by retaining deleted data for a specified retention period, but it does not enforce encryption with customer-managed keys or provide revocation capabilities. Option D is wrong because versioning for blobs preserves previous versions of blobs for data recovery and point-in-time restore, but it does not relate to encryption key management or revocation.

Full explanation →

MCQmedium

You have an Azure Web Application Firewall (WAF) policy associated with an Azure Front Door instance. You want to block requests from a specific country (e.g., Country X) unless the request includes a valid API key. How should you configure this?

A.Use a geo-match custom rule to allow all countries except Country X, and use a rate limit rule to block Country X.

B.Configure IP restriction on the origin to block Country X IPs.

C.Configure the WAF policy to use 'Prevention' mode and add a managed rule set that includes the country block.

D.Use a geo-match custom rule to block Country X, and create a separate custom rule with higher priority to allow traffic from Country X if the request contains the API key header.

AnswerD

This approach works because Azure WAF evaluates custom rules in strict priority order, with lower numeric priority values evaluated first. Create an allow custom rule with a higher priority (for example, priority 1) that matches requests from Country X only when the required API key header is present and sets the action to Allow; then create a lower-priority block rule (for example, priority 2) with a geo-match condition for Country X. When a request from Country X contains the API key, the allow rule matches first and stops further evaluation, bypassing the block rule. Requests from Country X without the API key do not match the allow rule, fall through to the block rule, and are denied.

Why this answer

Azure WAF custom rules are evaluated in priority order, and a higher-priority 'allow' rule can override a lower-priority 'block' rule. By creating a geo-match rule to block Country X, and then a separate custom rule with a higher priority (lower numeric value) that allows requests from Country X if they contain a valid API key header, you achieve the conditional access requirement. This leverages WAF's ability to inspect request headers and apply logic based on multiple conditions within a single policy.

Exam trap

The trap here is that candidates often think geo-blocking must be done with a single rule or that managed rule sets can handle geography, but Azure WAF requires custom rules for geo-filtering and relies on rule priority to implement conditional overrides.

How to eliminate wrong answers

Option A is wrong because a geo-match custom rule to allow all countries except Country X would still allow Country X traffic (since it's not explicitly blocked), and a rate limit rule limits request frequency, not blocks based on geography or API key presence. Option B is wrong because IP restrictions on the origin are applied after the WAF, cannot inspect API keys, and would block all traffic from Country X IPs regardless of API key, which does not meet the conditional requirement. Option C is wrong because managed rule sets do not include a 'country block' capability; geo-filtering is only available through custom rules, and 'Prevention' mode simply enables action on matched rules, it does not add geo-blocking logic.

Full explanation →

Multi-Selectmedium

Which TWO of the following are valid ways to integrate Microsoft Sentinel with Microsoft Defender XDR?

Select 2 answers

A.Configure the Microsoft Defender XDR data connector

B.Use Azure Lighthouse to connect Defender XDR to Sentinel

C.Deploy a playbook that polls Defender XDR APIs

D.Enable automatic incident creation in the Microsoft Defender XDR connector

E.Create a custom log analytics workspace query

AnswersA, D

The data connector ingests alerts and incidents.

Why this answer

The Microsoft Defender XDR data connector is the official and supported method to ingest alerts and incidents from Microsoft Defender XDR into Microsoft Sentinel. This connector enables bi-directional synchronization, allowing incidents created in Defender XDR to appear in Sentinel and vice versa, with automatic correlation and enrichment.

Exam trap

The trap here is that candidates may confuse Azure Lighthouse (a cross-tenant management tool) with a data integration method, or think that any API-based polling (Option C) is a valid alternative to the native connector, when in fact only the official connector provides the required synchronization and automation features.

Full explanation →

MCQmedium

A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?

A.Enable Azure Storage encryption with customer-managed keys (CMK)

B.Use service-managed keys (SSE) with platform-managed keys

C.Enable Azure Disk Encryption on VMs that access the storage account

D.Configure Azure Information Protection for the storage account

AnswerA

Azure Storage always encrypts data at rest with AES-256, but enabling customer-managed keys (CMK) lets you supply your own key in Azure Key Vault or Managed HSM. You control the key lifecycle, rotation, and revocation; if you disable or delete the key, Azure Storage begins rejecting blob operation requests and the data becomes inaccessible. There is a short delay of up to 24 hours before the cached key is evicted, which is why revocation is not instantaneous. This meets the requirement of giving the customer the ability to revoke access on demand, which is the core control needed here.

Why this answer

Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.

Exam trap

The trap here is that candidates often confuse Azure Disk Encryption (which encrypts VM disks) with storage account encryption, or assume that platform-managed keys (SSE) provide the same revocation capability as customer-managed keys.

How to eliminate wrong answers

Option B is wrong because service-managed keys (SSE) with platform-managed keys do not allow the customer to control or disable the key; Microsoft manages the keys, so the customer cannot revoke access in a breach scenario. Option C is wrong because Azure Disk Encryption encrypts the OS and data disks of VMs, not the data stored in Azure Storage accounts; it does not provide encryption at rest for the storage account itself. Option D is wrong because Azure Information Protection is a classification and labeling service for documents and emails, not a storage encryption mechanism; it does not encrypt data at rest in Azure Storage accounts.

Full explanation →

MCQhard

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

A.Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

B.Use Dynamic Data Masking to mask the credit card column for non-privileged users

C.Implement Azure SQL Database's Always Encrypted with enclaves

D.Implement Always Encrypted and store the column encryption key in Azure Key Vault

AnswerD

Always Encrypted is a client-side encryption technology that encrypts sensitive column data before it is sent to Azure SQL Database, so the database engine and its administrators never see plaintext. The application's driver uses the column encryption key (CEK) to encrypt and decrypt, while the CEK is wrapped by a column master key (CMK); storing the CMK in Azure Key Vault provides centralized, audited key management without exposing the CEK to the database server. Because only client applications possessing the necessary key material can decrypt the credit card values, database administrators and cloud operators are prevented from viewing the data.

Why this answer

Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.

Exam trap

The trap here is confusing Transparent Data Encryption (TDE) with Always Encrypted; TDE protects at rest but not from database administrators or during query processing, whereas Always Encrypted provides client-side encryption that prevents even the database engine from seeing plaintext data.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest but does not protect data from database administrators or during query execution; it also does not enforce application-layer decryption. Option B is wrong because Dynamic Data Masking only obfuscates data in query results for non-privileged users but does not encrypt data at rest or prevent privileged users from accessing plaintext. Option C is wrong because Always Encrypted with enclaves allows computations on encrypted data within a secure enclave, which is unnecessary here and introduces additional complexity; the core requirement of application-layer decryption with key separation is met by standard Always Encrypted.

Full explanation →

Multi-Selecthard

Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)

Select 3 answers

A.Appropriate permissions (Security Administrator or Global Administrator)

B.The Microsoft 365 Defender data connector must be enabled in Sentinel

C.The Microsoft Monitoring Agent installed on all endpoints

D.A valid license for Microsoft 365 Defender (or individual workloads)

E.An Azure Sentinel workspace in the same region as the Microsoft 365 tenant

AnswersA, B, D

Correct: Required to enable the connector.

Why this answer

Integrating Microsoft Sentinel with Microsoft Defender XDR requires the user to have either Security Administrator or Global Administrator roles in Azure Active Directory. These permissions are necessary to grant consent for the data connector and to configure cross-tenant or cross-service access policies that enable Defender XDR to send incident and alert data to Sentinel.

Exam trap

The trap here is that candidates often assume the Microsoft Monitoring Agent is required for all Microsoft security integrations, but the Sentinel–Defender XDR connector is API-based and does not use MMA, and they also mistakenly think the workspace must be in the same region as the tenant, which is not enforced by the integration.

Full explanation →

Multi-Selectmedium

Which TWO Azure services can be used to filter inbound internet traffic to a virtual network? (Choose two.)

Select 2 answers

A.Azure Firewall

B.Azure Bastion

C.Azure Front Door

D.Network security group (NSG)

E.VPN gateway

AnswersA, D

Correct. Azure Firewall can filter inbound internet traffic using network and application rules at Layers 3-7.

Why this answer

Both Azure Firewall and Network Security Groups (NSGs) can filter inbound internet traffic to a virtual network. Azure Firewall provides centralized, stateful filtering at Layers 3-7 with features like threat intelligence and application rules. NSGs are distributed, stateful packet filters that apply to subnets or NICs, filtering traffic based on source/destination IP, port, and protocol rules, and are commonly used to block inbound internet traffic at the subnet boundary.

Exam trap

The trap here is that candidates may overlook NSGs because they are a basic security feature, thinking only a dedicated firewall service can filter inbound traffic. However, NSGs are perfectly capable of filtering inbound internet traffic at the network layer. Another common mistake is selecting Azure Bastion, which is a secure jump box for management traffic, not a general traffic filter.

Full explanation →

MCQmedium

A company uses Azure Active Directory (Azure AD) and has a conditional access policy that requires multi-factor authentication (MFA) for all external users accessing SharePoint Online. However, the security team wants to enforce that external users must re-authenticate every 30 minutes when accessing SharePoint. Which control should they configure in a new conditional access policy targeting SharePoint Online?

A.Assign the policy to 'All cloud apps' and use a grant control to require multi-factor authentication.

B.Configure a condition for sign-in risk level and set it to 'High'.

C.Add a session control and set 'Sign-in frequency' to 30 minutes.

D.Configure a session control to use 'App enforced restrictions' for SharePoint.

AnswerC

The 'Sign-in frequency' session control in Azure AD Conditional Access defines how long a user's session remains valid before they must sign in again. Setting it to 30 minutes forces reauthentication every half hour for the targeted cloud app, exactly matching the stated requirement. This is the appropriate control because it is enforced by Azure AD at the session level, independent of the application's own settings.

Why this answer

The 'Sign-in frequency' session control in a Conditional Access policy allows administrators to enforce re-authentication at a specified interval. By setting this to 30 minutes and targeting the SharePoint Online app, external users will be prompted to re-authenticate every 30 minutes, meeting the security team's requirement. This control is independent of MFA and specifically addresses the frequency of authentication sessions.

Exam trap

The trap here is that candidates often confuse 'Sign-in frequency' with 'Grant controls' (like MFA) or 'Conditions' (like risk), not realizing that session controls specifically manage the duration of authentication sessions rather than the method of authentication.

How to eliminate wrong answers

Option A is wrong because assigning the policy to 'All cloud apps' and requiring MFA does not enforce a re-authentication frequency; it only mandates MFA at initial sign-in, not every 30 minutes. Option B is wrong because configuring a condition for sign-in risk level set to 'High' triggers MFA or block based on risk, not a fixed 30-minute re-authentication interval. Option D is wrong because 'App enforced restrictions' is a session control that delegates session management to the application (e.g., SharePoint), but it does not enforce a specific re-authentication frequency like 30 minutes.

Full explanation →

MCQmedium

A security team uses Microsoft Sentinel. They want to create a custom analytics rule that detects when a user account is created in Azure AD and then within 5 minutes attempts to access a sensitive SharePoint site. What should they use to correlate these two events?

A.KQL query with join on UserId

B.Watchlist

C.Automation rule

D.Playbook

AnswerA

A KQL query with a join on UserId is the correct choice because it directly correlates events from multiple Sentinel tables, such as SigninLogs and AuditLogs, on a common field to detect suspicious patterns. The join operator in KQL supports different join kinds (inner, leftouter, etc.) to capture matching or non-matching records, enabling the security team to define precise detection logic. This alignment between the query's data correlation and the scenario makes it the only option that fulfills the requirement for real-time detection.

Why this answer

A KQL query with a join on UserId allows you to correlate two separate tables—such as AuditLogs for user creation and SharePoint access logs—based on a common field (UserId) within a specified time window (5 minutes). This is the standard method in Microsoft Sentinel for creating multi-event detection rules that require temporal correlation between distinct activities.

Exam trap

The trap here is that candidates may confuse a Watchlist (used for static lookups) with a correlation mechanism, or mistakenly think Automation rules or Playbooks can perform event correlation, when in fact only KQL queries with joins can correlate multiple events in a single detection rule.

How to eliminate wrong answers

Option B is wrong because a Watchlist is a static list of items (e.g., IP addresses or account names) used for reference or filtering, not for correlating dynamic events across time. Option C is wrong because an Automation rule in Sentinel triggers a response (e.g., incident creation or playbook execution) based on a single alert or incident, not for correlating two separate events. Option D is wrong because a Playbook is a set of automated actions (often using Azure Logic Apps) triggered by an alert, not a mechanism to correlate events in a detection query.

Full explanation →

MCQmedium

A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?

A.Data Collection Rules (DCR) in Azure Monitor.

B.Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.

C.Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.

D.Use Azure Automation State Configuration.

AnswerB

This setting automatically installs the agent on new VMs and monitors for compliance.

Why this answer

Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.

Exam trap

The trap here is that candidates often confuse Azure Policy-based deployment (Option C) with Defender for Cloud's native auto-provisioning, but the question specifically asks for the feature within Defender for Cloud's environment settings, which is auto-provisioning, not a separate policy assignment.

How to eliminate wrong answers

Option A is wrong because Data Collection Rules (DCRs) in Azure Monitor are used to define data collection for the Azure Monitor Agent (AMA), not for the Log Analytics agent, and they do not automatically install agents on new VMs. Option C is wrong because the Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM' is a built-in policy that can deploy the agent, but it requires assignment and evaluation, and it does not automatically trigger on new VM provisioning without policy compliance checks; it is a policy-based remediation, not a native auto-provisioning feature of Defender for Cloud. Option D is wrong because Azure Automation State Configuration is used for managing PowerShell DSC configurations and ensuring VM state compliance, not for automatically installing the Log Analytics agent for security log collection.

Full explanation →

MCQhard

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

A.Enable Azure AD Domain Services authentication and join the storage account to the managed domain.

B.Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.

C.Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.

D.Use storage account keys to mount the share and rely on Windows ACLs.

AnswerC

This allows on-prem AD authentication.

Why this answer

Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Exam trap

The trap here is that candidates confuse Azure AD DS (a managed domain) with on-premises AD DS, or they assume RBAC roles alone are sufficient for SMB file access, forgetting that NTFS permissions are required for actual file-level control.

How to eliminate wrong answers

Option A is wrong because Azure AD Domain Services (Azure AD DS) is a managed domain service that does not use on-premises AD credentials; it uses Azure AD identities, and the scenario explicitly requires on-premises AD credentials. Option B is wrong because RBAC roles (like Storage File Data SMB Share Contributor) control Azure management-plane access to the share, not the actual SMB file-level access; NTFS permissions are required for file/directory-level control. Option D is wrong because using storage account keys bypasses identity-based access entirely, granting full administrative access to the share and preventing per-user access control with on-premises AD credentials.

Full explanation →

Multi-Selectmedium

Your organization uses Microsoft Entra ID and has a hybrid identity with Microsoft Entra Connect. You need to ensure that all user password changes and resets are synchronized to the cloud within 30 minutes. Which TWO actions should you take? (Choose two.)

Select 1 answer

A.Configure federation with AD FS.

B.Set the Azure AD Connect synchronization frequency to 30 minutes.

C.Enable password writeback in Microsoft Entra Connect.

D.Enable Azure AD Connect Health to monitor synchronization.

E.Configure pass-through authentication for user sign-ins.

AnswersB

Correct. Setting the synchronization frequency to 30 minutes ensures that password changes on-premises are replicated to the cloud within the required time.

Why this answer

The requirement is to synchronize password changes and resets to the cloud within 30 minutes. Option B is correct because setting the Azure AD Connect synchronization frequency to 30 minutes ensures that password changes made on-premises are synced to Microsoft Entra ID within that timeframe. Option C (password writeback) is not required because it handles syncing cloud-initiated password resets to on-premises, which is the opposite direction.

Options A, D, and E do not address synchronization frequency. Therefore, only option B meets the requirement.

Exam trap

Candidates may think both password hash synchronization and password writeback are needed, but the requirement is only for syncing changes to the cloud, not from the cloud. Password writeback is for the reverse direction.

Full explanation →

MCQmedium

A company has Azure AD Identity Protection enabled. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on Identity Protection risk?

A.Add a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access'.

B.Add a condition for 'Locations' and specify the known malicious IP ranges as 'Blocked locations'.

C.Add a condition for 'User risk' set to 'High' and a grant control of 'Require multi-factor authentication'.

D.Add a condition for 'Device state' set to 'Not compliant' and a grant control of 'Block access'.

AnswerA

In Azure AD Identity Protection, a sign-in from a known malicious IP is one of the real-time sign-in risk detections that raises the sign-in risk level to High. A Conditional Access policy with the 'Sign-in risk' condition set to High and a grant control of 'Block access' enforces a block on that specific risky sign-in, exactly meeting the requirement. This is the correct risk-based control because it relies on Identity Protection's detection rather than a static list.

Why this answer

Identity Protection detects sign-ins from known malicious IP addresses and assigns a 'Sign-in risk' level (e.g., High). By adding a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access', the Conditional Access policy will automatically block those sign-ins. This directly uses Identity Protection's risk detection to enforce the block without needing to manually maintain IP address lists.

Exam trap

The trap here is that candidates often confuse 'Sign-in risk' (based on the sign-in event's characteristics like IP) with 'User risk' (based on user account compromise likelihood), leading them to incorrectly choose Option C or to think that manually listing IPs in Locations (Option B) is the correct approach.

How to eliminate wrong answers

Option B is wrong because specifying known malicious IP ranges as 'Blocked locations' in the Locations condition would require manual maintenance of IP lists and does not leverage Identity Protection's dynamic risk detection; it also does not use the 'Sign-in risk' condition. Option C is wrong because 'User risk' is based on user behavior patterns (e.g., leaked credentials), not on the IP address of the sign-in, and 'Require multi-factor authentication' does not block access. Option D is wrong because 'Device state' set to 'Not compliant' checks device compliance status, not the IP address or sign-in risk, and is unrelated to Identity Protection's malicious IP detection.

Full explanation →

MCQeasy

You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?

A.Configure a firewall rule to allow the on-premises public IP address

B.Use Azure Private Link to connect via a private endpoint

C.Enable Always Encrypted on the database

D.Use a virtual network service endpoint for Azure SQL Database

AnswerB

Azure Private Link creates a private endpoint inside your virtual network, assigning the database a private IP address that is reachable only through your network. On-premises clients can securely connect to this endpoint via a VPN gateway or ExpressRoute, ensuring traffic never traverses the public internet. This eliminates exposure to the public endpoint and provides the highest level of network security for connecting to Azure SQL Database.

Why this answer

Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address from your on-premises network via ExpressRoute or VPN. This ensures traffic never traverses the public internet, meeting the requirement for secure, non-public connectivity.

Exam trap

The trap here is that candidates often confuse service endpoints (which still use the public endpoint) with private endpoints (which provide truly private connectivity), leading them to choose Option D thinking it eliminates internet exposure.

How to eliminate wrong answers

Option A is wrong because configuring a firewall rule to allow the on-premises public IP address still exposes the database to the public internet, as traffic flows over the internet and the database endpoint remains publicly resolvable. Option C is wrong because Always Encrypted is a client-side encryption feature that protects data at rest and in transit, but it does not control network connectivity or prevent public internet exposure. Option D is wrong because a virtual network service endpoint for Azure SQL Database still uses the database's public endpoint, and traffic from on-premises would need to traverse the internet unless routed through a VPN/ExpressRoute, which still leaves the endpoint publicly accessible.

Full explanation →

MCQmedium

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that when a user activates this role, they must provide a support ticket number and a brief justification. Additionally, the activation should have a maximum duration of 4 hours. Which PIM role setting should they configure?

A.Require approval

B.Require MFA

C.Require justification on activation

D.Require Azure AD Identity Protection

AnswerC

This setting, often labeled 'Require justification' in PIM role settings, makes the justification text box mandatory during role activation. When enabled, the user must type a reason (and typically a support ticket number, depending on the ticketing requirement) before the activation request is submitted, and this value is then recorded in the PIM audit log. It directly satisfies the business requirement to enforce entering a ticket number and justification; activation duration is configured separately and does not affect this enforcement.

Why this answer

The 'Require justification on activation' setting in Azure AD PIM allows you to mandate that users provide a support ticket number and a brief justification when activating a role. This setting enforces the collection of business-specific details during activation, which aligns with the requirement. The maximum activation duration of 4 hours is configured separately via the 'Activation maximum duration' setting, not through justification.

Exam trap

The trap here is that candidates confuse 'Require justification on activation' with 'Require approval', mistakenly thinking that a support ticket number implies an approval workflow, but justification is a mandatory input field, not an approval step.

How to eliminate wrong answers

Option A is wrong because 'Require approval' enforces a workflow where a designated approver must approve the activation request, which is not the same as requiring a support ticket number and justification; it adds an approval step rather than a mandatory input field. Option B is wrong because 'Require MFA' enforces multi-factor authentication during activation, which addresses security verification but does not collect a support ticket number or justification. Option D is wrong because 'Require Azure AD Identity Protection' is not a valid PIM role setting; Azure AD Identity Protection is a separate service for risk-based policies and does not apply to PIM activation requirements.

Full explanation →

MCQhard

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

A.Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'

B.Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

C.Use Identity Protection's 'User risk policy' instead of Conditional Access

D.Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'

AnswerA

A separate policy for medium user risk applied to all users will require MFA when medium risk is detected. The existing policy will continue to block Finance users with high risk. Policy evaluation is not mutually exclusive; the block takes precedence for high risk, and the MFA requirement applies for medium risk.

Why this answer

Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Exam trap

The trap here is that candidates often think a single policy can handle multiple risk levels with different grant controls, but Conditional Access policies enforce a single grant control per policy, so separate policies are required for different risk level actions.

How to eliminate wrong answers

Option B is wrong because modifying the existing policy to include 'User risk level: Medium' and changing the grant control to 'Require multi-factor authentication' would remove the block for high-risk Finance users, violating the requirement to block high-risk sign-ins for Finance. Option C is wrong because Identity Protection's 'User risk policy' is a legacy, tenant-wide risk-based policy that cannot target specific departments like Finance; it also does not support the granularity of Conditional Access for combining risk levels with other conditions. Option D is wrong because creating a new policy with 'User risk level: Medium' and grant control 'Block access' would block medium-risk users instead of requiring MFA, which contradicts the requirement to require MFA for medium risk.

Full explanation →

MCQhard

A company has two Azure virtual networks, VNet-A and VNet-B, connected via VNet peering. They want all traffic between the VNets to be inspected by a network virtual appliance (NVA) deployed in a subnet in VNet-A. They have configured a user-defined route (UDR) on the subnet in VNet-B that points the destination address space of VNet-A to the private IP of the NVA. However, traffic between the VNets is still not passing through the NVA. What is the most likely cause?

A.The UDR is not associated with the subnet in VNet-B.

B.The NVA's network interface (NIC) does not have IP forwarding enabled.

C.The VNet peering connection is not in a 'Connected' state.

D.The NVA is deployed in the same subnet as the source VMs.

AnswerB

IP forwarding must be explicitly enabled on the network interface (NIC) of the NVA before Azure will deliver packets whose destination IP is not assigned to that NIC. Without it, the Azure fabric drops packets that are addressed to other IPs, so even if the NVA's operating system is configured to route traffic, the packets never reach it. This is the most common omission when deploying NVAs with UDRs, and it precisely explains why traffic flows end-to-end via peering but not through the NVA — the NVA silently discards (or never receives) the forwarded packets.

Why this answer

The most likely cause is that the NVA's network interface (NIC) does not have IP forwarding enabled. Even with a correctly configured UDR on VNet-B pointing traffic to the NVA's private IP, the NVA will drop any traffic not destined for its own IP unless IP forwarding is enabled on its NIC. This setting allows the NVA to accept packets with a destination other than itself and forward them based on its routing table, which is essential for traffic inspection scenarios.

Exam trap

The trap here is that candidates often focus on UDR configuration or peering state, overlooking the critical NIC-level IP forwarding setting that is required for any NVA to function as a transit hop in Azure.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that a UDR has been configured on the subnet in VNet-B, implying it is associated; if it were not associated, the UDR would have no effect, but the core issue here is the NVA's inability to forward traffic. Option C is wrong because if the VNet peering were not in a 'Connected' state, no traffic would flow between the VNets at all, but the question indicates traffic is still passing (just not through the NVA), so peering is functional. Option D is wrong because the NVA being in the same subnet as source VMs does not inherently prevent traffic inspection; UDRs can still direct traffic to the NVA, but the NVA's NIC must have IP forwarding enabled to process and forward that traffic.

Full explanation →

MCQmedium

A company wants to use Microsoft Defender for Cloud to continuously assess their Azure resources against the Microsoft cloud security benchmark (MCSB). They need to view the current compliance score and specific recommendations for failing controls. Which feature in Defender for Cloud should they use?

A.Security Policy

B.Regulatory Compliance dashboard

C.Secure Score

D.Workload Protections

AnswerB

The Regulatory Compliance dashboard is the dedicated reporting interface within Microsoft Defender for Cloud that continuously aggregates assessment results for assigned standards like MCSB. It provides a compliance score per standard, a per-control breakdown of pass and fail status, and drill-down details for each recommendation that impacts a control. This dashboard directly answers the requirement to assess compliance against a chosen regulatory framework by showing exactly which controls are not met and why. It is the correct tool because it maps Azure Security benchmark recommendations to regulatory compliance controls and offers a visual, actionable score.

Why this answer

The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess resources against compliance standards like the Microsoft cloud security benchmark (MCSB). It provides a current compliance score, a breakdown of failing controls, and actionable recommendations to remediate those controls, directly meeting the company's requirement.

Exam trap

The trap here is confusing Secure Score (which shows overall security posture) with Regulatory Compliance (which shows adherence to a specific benchmark), leading candidates to pick Secure Score when the question explicitly asks for compliance against MCSB.

How to eliminate wrong answers

Option A is wrong because Security Policy defines the rules and initiatives applied to resources (e.g., allowed VM SKUs), but it does not display a compliance score or specific failing controls against a benchmark. Option C is wrong because Secure Score aggregates security posture based on security recommendations, but it is not tied to a specific compliance standard like MCSB and does not show per-control compliance status. Option D is wrong because Workload Protections focuses on advanced threat detection and protection for workloads (e.g., servers, databases), not on compliance assessment against benchmarks.

Full explanation →

100

MCQhard

An analyst investigates a Defender for Cloud alert for suspicious process execution on a VM. Which next step best preserves evidence while enabling deeper endpoint investigation?

A.Delete the VM immediately to stop the process

B.Pivot to Microsoft Defender for Endpoint device timeline and isolate the device if containment is required

C.Disable all analytics rules in Sentinel

D.Rotate every subscription key before reviewing the process tree

AnswerB

Correct for the stated requirement.

Why this answer

Pivoting to the Microsoft Defender for Endpoint device timeline allows the analyst to investigate the suspicious process execution in a forensically sound manner without disrupting the live environment. Isolating the device from the network, if needed, contains the threat while preserving volatile evidence such as running processes, memory, and registry state. This approach aligns with incident response best practices and leverages Defender for Endpoint's deep endpoint visibility.

Exam trap

The trap here is that candidates may confuse immediate containment with evidence preservation, mistakenly choosing to delete or disable resources instead of using the platform's native investigation and isolation capabilities.

How to eliminate wrong answers

Option A is wrong because deleting the VM immediately destroys all volatile evidence (memory, running processes, network connections) and prevents any forensic analysis or root cause determination. Option C is wrong because disabling analytics rules in Microsoft Sentinel does not preserve evidence or aid investigation; it only stops future alert generation, potentially allowing the threat to propagate undetected. Option D is wrong because rotating subscription keys is a credential hygiene action unrelated to endpoint investigation and does not preserve process execution evidence or enable containment.

Full explanation →

101

MCQhard

A company has two Azure virtual networks (VNet-A and VNet-B) connected via VNet peering. They need to ensure that all traffic between the two VNets is encrypted using IPsec and that no traffic can bypass the encryption. The security team has enabled the 'Use remote virtual network gateways' setting on the peering. However, traffic is still flowing unencrypted. What additional configuration is required to enforce encryption for all traffic between the VNets?

A.Enable 'Azure virtual network encryption' on both VNets and configure the encryption policy.

B.Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.

C.Configure a network security group (NSG) rule on each subnet to deny traffic that is not IPsec encapsulated.

D.Enable 'Allow gateway transit' on VNet-A and 'Use remote virtual network gateways' on VNet-B, and then create a VPN gateway in VNet-A.

AnswerA

Azure virtual network encryption (currently in preview) encrypts all traffic between VNets using IPsec. Enabling it on both sides ensures traffic is encrypted.

Why this answer

Azure Virtual Network Encryption provides a platform-level encryption mechanism that encrypts all traffic between virtual networks, including VNet peering traffic, without requiring a VPN gateway. Enabling this feature on both VNets and configuring the encryption policy ensures that all inter-VNet traffic is encrypted using IPsec, and since it is enforced at the infrastructure level, no traffic can bypass the encryption. The 'Use remote virtual network gateways' setting alone does not encrypt traffic; it only allows a VNet to use a remote gateway for transit routing.

Exam trap

The trap here is that candidates often assume that enabling 'Use remote virtual network gateways' on VNet peering automatically encrypts traffic, when in fact it only allows gateway transit and does not provide any encryption; the real solution is Azure Virtual Network Encryption, which is a separate feature that must be explicitly enabled.

How to eliminate wrong answers

Option B is wrong because deploying Azure VPN Gateways and creating a site-to-site VPN connection would encrypt traffic between the VNets, but it does not prevent unencrypted traffic from flowing through the VNet peering if the peering is still active; the question requires that no traffic can bypass encryption, and a VPN gateway does not disable the existing peering path. Option C is wrong because NSG rules operate at the network layer and cannot inspect or enforce IPsec encapsulation; they can only filter based on IP addresses, ports, and protocols, not the presence of IPsec headers, so they cannot ensure that all traffic is encrypted. Option D is wrong because enabling 'Allow gateway transit' and 'Use remote virtual network gateways' allows a VNet to use a VPN gateway in another VNet for outbound connectivity, but it does not encrypt traffic between the VNets themselves; the peering traffic remains unencrypted unless Azure Virtual Network Encryption or a direct VPN connection is configured.

Full explanation →

102

MCQeasy

Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?

A.Microsoft Defender for Databases

B.Microsoft Defender for Servers

C.Microsoft Defender for Storage

D.Microsoft Defender for Key Vault

AnswerB

Microsoft Defender for Servers is the only plan that includes Just-in-Time VM access, which locks down inbound management ports by default and lets defenders request temporary, time-bound access through Defender for Cloud. The feature works by automatically configuring and updating NSG rules to allow a specific source IP and port pair for a defined window, then reverting to close the port. This makes Defender for Servers the correct choice for a security team seeking JIT capabilities for their virtual machines.

Why this answer

Just-In-Time (JIT) VM access is a feature of Microsoft Defender for Cloud that requires the Microsoft Defender for Servers plan to be enabled on the subscription. This plan provides the advanced threat protection and access control capabilities, including JIT, which dynamically locks down inbound traffic to VMs and opens ports only when authorized users request access via Azure Policy or the portal.

Exam trap

The trap here is that candidates often confuse the 'Microsoft Defender for Servers' plan with other Defender plans (like Databases or Storage) because they assume any 'Defender' plan can enable JIT, but only the Servers plan provides the necessary VM-level access control and network security group management.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Databases is designed to protect database services (e.g., Azure SQL, Azure Database for PostgreSQL) and does not include JIT VM access functionality. Option C is wrong because Microsoft Defender for Storage protects Azure Blob Storage, Azure Files, and Data Lake Storage from threats, but it has no role in managing VM network access. Option D is wrong because Microsoft Defender for Key Vault provides advanced threat protection for Azure Key Vault, focusing on secrets and key management, not VM network-level just-in-time access.

Full explanation →

103

MCQeasy

A company deploys Azure virtual machines in a virtual network. A security policy requires that only Remote Desktop Protocol (RDP) traffic from the corporate VPN's public IP address (203.0.113.0/26) is allowed. All other inbound RDP traffic must be denied. Which configuration should be applied to the network security group (NSG) associated with the VM subnet?

A.Add an inbound rule to allow RDP from the Internet and a deny rule for RDP from the corporate IP.

B.Add an inbound rule to deny RDP from the corporate IP and a default deny all inbound.

C.Add an inbound rule to allow RDP from the corporate IP range, and add a default deny rule for all other inbound RDP traffic.

D.No additional rules are needed because the default NSG rules already deny RDP.

AnswerC

To allow RDP only from the corporate IP range, you must create an inbound NSG rule with priority number lower than any competing deny rule, permitting traffic from that source to TCP port 3389. Then a second inbound rule with a higher priority number (lower precedence) should deny RDP from all other sources, ensuring that any traffic not matching the corporate allow rule is blocked. This pair of rules works with the default DenyAllInbound rule to restrict unauthorized access while preserving the required administrative path.

Why this answer

The requirement is to allow RDP (TCP port 3389) only from the corporate VPN's public IP range (203.0.113.0/26) and deny all other inbound RDP traffic. An NSG processes rules in priority order; by adding an inbound allow rule for the corporate IP range with a high priority (e.g., 100) and relying on the default deny rule (which denies all inbound traffic not explicitly allowed), only RDP from the specified range is permitted. This matches the security policy precisely.

Exam trap

The trap here is that candidates often forget that NSGs have default rules that allow inbound traffic from the virtual network and Azure load balancer, and they mistakenly think a default deny rule already blocks all RDP, when in fact you must explicitly allow the specific source IP and rely on the default deny to block everything else.

How to eliminate wrong answers

Option A is wrong because it allows RDP from the Internet (which violates the policy) and then denies RDP from the corporate IP (which would block the allowed traffic). Option B is wrong because it denies RDP from the corporate IP (the only source that should be allowed) and relies on a default deny all inbound, which would block all RDP traffic entirely. Option D is wrong because the default NSG rules allow inbound RDP from the virtual network and Azure load balancer, but not from the Internet; they do not restrict RDP to a specific public IP range, so additional rules are required.

Full explanation →

104

MCQmedium

A company is designing a hub-spoke network topology with Azure Firewall in the hub virtual network. Spoke virtual networks are peered to the hub. They want to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. However, traffic is still bypassing the firewall. What is the most likely cause?

A.The Azure Firewall is in a different region than the spoke VNet.

B.The route table is not associated to the spoke subnet.

C.The Azure Firewall does not have the correct network and application rules configured.

D.The spoke VNet has the 'Use remote virtual network gateways' setting disabled.

AnswerB

A user-defined route table only takes effect when it is explicitly associated with a subnet; simply creating a route table and adding a route to the firewall's private IP does nothing otherwise. Without that association, the subnet uses Azure's default system routes, which send traffic between peered VNets directly, bypassing the firewall entirely. This is the classic cause of 'spoke traffic isn't going through the firewall' when the routes appear to be configured correctly.

Why this answer

The most likely cause is that the route table with the default route (0.0.0.0/0) pointing to the Azure Firewall's private IP has not been associated to the spoke subnet. Without this association, the route table is not applied to the subnet's traffic, so the default system route (which directs internet traffic directly to the internet) remains in effect, bypassing the firewall. Associating the route table to the subnet is a required step for user-defined routes (UDRs) to influence traffic flow.

Exam trap

The trap here is that candidates often assume creating a route table and adding a default route is sufficient, overlooking the critical step of associating the route table to the subnet, which is a distinct configuration action in the Azure portal or CLI.

How to eliminate wrong answers

Option A is wrong because Azure Firewall can be in a different region than the spoke VNet and still function correctly; cross-region peering supports traffic routing through the firewall as long as the route table is properly associated. Option C is wrong because network and application rules on the firewall control which traffic is allowed or denied, but they do not affect whether traffic is routed to the firewall in the first place; the routing issue occurs before the firewall inspects packets. Option D is wrong because the 'Use remote virtual network gateways' setting is relevant only for VPN/ExpressRoute gateway transit scenarios, not for routing traffic to an Azure Firewall via a UDR.

Full explanation →

105

MCQmedium

A company uses Azure Firewall to filter outbound traffic. They want to ensure that all DNS queries from virtual machines in a spoke VNet are routed through the Azure Firewall for logging and inspection. They have already configured the firewall to use a custom DNS server. Which additional Azure Firewall feature must be enabled to ensure that the VMs use the firewall as a DNS proxy?

A.Enable DNS proxy on the firewall policy

B.Configure a DNS forwarding rule

C.Enable Threat Intelligence DNS logging

D.Create a NAT rule for DNS traffic

AnswerA

Enabling DNS proxy on the Azure Firewall policy is the correct choice because it makes the firewall's private IP address the DNS server for virtual networks. VMs send DNS queries to the firewall, which then forwards them to the configured DNS server, ensuring that all outbound DNS traffic traverses the firewall for inspection and filtering. This gives a single, consistent path for DNS egress and enables FQDN-based rules to be applied to outbound traffic.

Why this answer

Enabling DNS proxy on the Azure Firewall policy allows the firewall to act as a DNS proxy for the virtual machines in the spoke VNet. When DNS proxy is enabled, the firewall listens on port 53 and forwards DNS queries from the VMs to the configured custom DNS server, ensuring all DNS traffic is logged and inspected. This is required even after setting a custom DNS server on the firewall, as the VMs must be configured to use the firewall's private IP address as their DNS server, and the proxy handles the forwarding.

Exam trap

The trap here is that candidates often confuse enabling DNS proxy with simply configuring a custom DNS server on the firewall, or they think that a NAT rule or forwarding rule alone will route DNS traffic through the firewall, but without the DNS proxy feature, the firewall does not listen on port 53 and cannot intercept DNS queries from VMs.

How to eliminate wrong answers

Option B is wrong because configuring a DNS forwarding rule is used to forward specific DNS queries to different DNS servers based on domain names, but it does not enable the firewall to act as a DNS proxy for all VM DNS traffic; the VMs still need to point to the firewall's IP, and the proxy feature must be enabled. Option C is wrong because enabling Threat Intelligence DNS logging only logs DNS queries that match threat intelligence indicators, but it does not route or proxy DNS traffic through the firewall; it is a logging feature, not a routing mechanism. Option D is wrong because creating a NAT rule for DNS traffic would translate the destination IP of DNS queries, but it does not make the firewall a DNS proxy; the VMs would still need to send DNS queries directly to the firewall's IP, and without DNS proxy, the firewall does not listen on port 53 for DNS queries.

Full explanation →

106

MCQhard

Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?

A.Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.

B.Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.

C.Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.

D.Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.

AnswerC

A storage account firewall is a network-level access control that evaluates the source IP of every request to the Azure Files endpoint, so locking it to the corporate IP range prevents all other clients from reaching the share over SMB or REST. Enabling diagnostic settings exports StorageRead and StorageWrite operation logs to a Log Analytics workspace, giving you a queryable record of access attempts, successful reads, and failures. Together, they enforce the IP restriction and provide the visibility needed to audit and alert on file share activity.

Why this answer

Azure Files supports network security via storage account firewalls, which can restrict access to specific IP ranges. Enabling diagnostic settings allows sending logs (e.g., to a Log Analytics workspace) for auditing. Option C correctly combines both requirements.

Option A is incorrect because Private Endpoints and service endpoints provide network isolation but do not filter by IP source. Option B is incorrect because while a SAS token can include an IP restriction, it is not designed for persistent user access to home directories and complicates management. Option D is incorrect because Azure AD DS and conditional access control authentication but do not enforce network-level IP restrictions.

Full explanation →

107

MCQmedium

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?

A.Create a private endpoint on the Key Vault for the SQL server

B.Disable the Key Vault firewall

C.Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault

D.Assign the SQL server a system-assigned managed identity and grant it access to the key vault

AnswerC

This setting permits Azure Key Vault to accept requests from Azure SQL Database and other first-party Microsoft services even when the firewall is enabled, without opening the vault to public internet traffic. The service's request originates from Azure's internal infrastructure, and the firewall bypass is combined with strict identity-based authorization via the SQL server's managed identity and access policies. It directly addresses the network-layer restriction for TDE operations while keeping the vault protected against all other external clients.

Why this answer

Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.

Exam trap

The trap here is that candidates often think a private endpoint is required for PaaS services to access a firewalled Key Vault, but they overlook that Azure SQL Database is a trusted Microsoft service that can bypass the firewall with the appropriate setting, and that a private endpoint would require the SQL server to be network-integrated, which it is not by default.

How to eliminate wrong answers

Option A is wrong because creating a private endpoint on the Key Vault for the SQL server would require the SQL server to be in a virtual network, but Azure SQL Database is a platform-as-a-service (PaaS) resource that does not reside in a customer VNet by default; a private endpoint on Key Vault does not directly grant the SQL server network access. Option B is wrong because disabling the Key Vault firewall would expose the vault to all public network traffic, violating the security requirement to deny all public network access. Option D is wrong because while assigning a system-assigned managed identity and granting it access to the key vault is necessary for authentication and authorization, it does not solve the network connectivity issue caused by the Key Vault firewall blocking all public traffic; the managed identity alone cannot bypass the firewall without the 'Allow trusted Microsoft services' setting.

Full explanation →

108

MCQhard

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

A.Export the secure score to a Log Analytics workspace and create a custom workbook

B.Integrate Defender for Cloud with Microsoft Power BI and create a report

C.Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score

D.Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard

AnswerC

The Defender for Cloud dashboard in the Azure portal provides built-in aggregation at the management group level, allowing you to view the secure score for the root management group and drill down. This is the simplest approach with minimal overhead.

Why this answer

The Microsoft Defender for Cloud dashboard in the Azure portal naturally aggregates secure scores at the management group level when you select the root management group. This provides a single dashboard view with drill-down capability into individual management groups without any additional configuration, minimizing administrative overhead. Option A is incorrect because exporting to a Log Analytics workspace and creating a custom workbook adds unnecessary complexity and overhead for a simple aggregated view.

Option B is incorrect because integrating with Power BI requires additional setup and licensing, and is not the simplest approach. Option D is incorrect because building a custom dashboard using the REST API requires development effort and maintenance, which is more overhead than using the built-in dashboard.

Full explanation →

109

MCQhard

A company uses Azure SQL Database to store personally identifiable information (PII). They need to encrypt specific columns containing social security numbers so that even database administrators with the 'db_owner' role cannot view the plaintext. The application must be able to perform equality searches on the encrypted columns. Which encryption technology should they implement?

A.Transparent Data Encryption (TDE)

B.Always Encrypted with deterministic encryption

C.Dynamic Data Masking

D.Row-Level Security

AnswerB

Always Encrypted encrypts sensitive columns in the client driver using a column encryption key, which is protected by a column master key held outside SQL Server in Azure Key Vault or Windows Certificate Store. The SQL Server Database Engine receives only ciphertext and never sees the plaintext, so DBAs cannot read the data. With deterministic encryption, the same plaintext always produces the same ciphertext, allowing the server to perform equality comparisons (e.g., WHERE clause lookups) without exposing the values.

Why this answer

Always Encrypted with deterministic encryption is the correct choice because it encrypts specific columns at the client-side, ensuring that even database administrators with db_owner cannot view plaintext data. Deterministic encryption generates the same ciphertext for a given plaintext value, enabling equality searches (e.g., WHERE SSN = '123-45-6789') directly on the encrypted column without decrypting the data on the server.

Exam trap

The trap here is that candidates often confuse encryption at rest (TDE) with client-side column encryption, mistakenly believing TDE protects against privileged users, but TDE only protects against physical theft of the database files, not against authorized database access.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest (pages written to disk) but does not protect data from users or DBAs who have access to the database; plaintext is visible to anyone with query permissions. Option C is wrong because Dynamic Data Masking obfuscates data in query results for non-privileged users but does not encrypt the underlying data; DBAs with db_owner can still view the unmasked values by altering the masking rule or querying directly. Option D is wrong because Row-Level Security restricts access to rows based on a predicate function but does not encrypt column values; DBAs with db_owner can bypass or modify the security policy to see all data.

Full explanation →

110

Drag & Dropmedium

Drag and drop the steps to configure Azure Disk Encryption for a Windows VM using Azure Key Vault into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for configuring Azure Disk Encryption for a Windows VM using Azure Key Vault is to first create or configure the Key Vault with soft-delete and purge protection, then set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions, and finally enable disk encryption on the VM specifying the Key Vault and key. This order ensures that all prerequisites are met, preventing errors during the encryption process.

Full explanation →

111

MCQeasy

A company has Azure virtual machines that need to download updates from specific external websites (e.g., *.microsoft.com and *.windowsupdate.com). The security team wants to centrally manage and allow outbound HTTPS traffic only to these FQDNs, while blocking all other outbound internet access. Which Azure networking service should they deploy to achieve this?

A.Azure Firewall

B.Azure Application Gateway

C.Azure Front Door

D.Azure VPN Gateway

AnswerA

Azure Firewall is the only option that can control outbound traffic based on FQDN. You deploy it in a dedicated AzureFirewallSubnet and configure application rules with FQDN targets such as *.windowsupdate.com to allow or deny VM-initiated downloads. Unlike NSGs, which filter by IP/port, Azure Firewall inspects Layer 7 DNS and HTTP/S headers to enforce FQDN-based outbound filtering, making it the correct service for this requirement.

Why this answer

Azure Firewall is a managed, cloud-native network security service that can centrally enforce outbound FQDN-based rules. It allows you to create application rules that permit HTTPS traffic to specific FQDNs (e.g., *.microsoft.com) while blocking all other outbound internet access, meeting the security team's requirement for granular, centralized control.

Exam trap

The trap here is that candidates often confuse Azure Firewall with Azure Application Gateway, mistakenly thinking the latter can filter outbound traffic, but Application Gateway is strictly an inbound reverse proxy and cannot enforce outbound FQDN rules.

How to eliminate wrong answers

Option B (Azure Application Gateway) is wrong because it is a Layer 7 load balancer designed for inbound HTTP/HTTPS traffic routing and Web Application Firewall (WAF) protection, not for centrally controlling outbound traffic to specific FQDNs. Option C (Azure Front Door) is wrong because it is a global load balancer and application delivery controller for inbound traffic, optimizing performance and providing WAF, but it does not manage outbound traffic from virtual networks. Option D (Azure VPN Gateway) is wrong because it establishes encrypted tunnels between on-premises networks and Azure, or between VNets, and does not provide FQDN-based filtering or internet traffic control.

Full explanation →

112

MCQhard

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

A.Users have permanent eligible assignments that bypass approval

B.The audit log is not enabled for PIM

C.Users are assigned the role directly instead of through eligibility

D.The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group

AnswerD

Role settings can be configured at different scopes (management group, subscription, resource group). If the approval requirement is not set at the specific scope, inherited settings may not require approval.

Why this answer

PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Exam trap

The trap here is that candidates assume PIM role settings are applied globally or uniformly across all scopes, but Azure resource PIM settings are scoped and inherited, so a missing approval configuration at a higher scope (like a management group) can silently bypass approval requirements at lower scopes.

How to eliminate wrong answers

Option A is wrong because permanent eligible assignments still require activation and are subject to the role settings (including approval) configured for that role; there is no concept of 'bypassing approval' for eligible assignments. Option B is wrong because the audit log being disabled would prevent logging of activations, but it does not affect whether approval is required during activation. Option C is wrong because if users are assigned the role directly (permanent active assignment), they do not need to activate at all, so they would not see an activation approval prompt; however, the question states users are 'able to activate roles without approval,' implying they are using activation, which means they have eligible assignments, not direct assignments.

Full explanation →

113

MCQmedium

A company uses Azure AD B2B collaboration to invite external partner users to collaborate on a project. The security team wants to ensure that when a partner user's account is disabled in their home Azure AD tenant, the user should immediately lose access to the company's resources, even if the user had a valid session token. Which configuration should they implement in cross-tenant access settings?

A.Configure cross-tenant access settings to trust the user's account status from the home tenant.

B.Configure external collaboration settings to restrict B2B users to specific apps.

C.Assign a conditional access policy that requires device compliance for B2B users.

D.Enable Azure AD Identity Protection for B2B users.

AnswerA

Enabling 'Trust user's account' in Azure AD cross-tenant access inbound settings causes Azure AD to call the user's home tenant directory during each interactive token acquisition to verify the accountEnabled attribute. If the account is disabled or deleted in the home tenant, the sign-in is blocked immediately, regardless of any previously issued tokens. This is the only option that directly and continuously checks the external account's status, not just policies or device state.

Why this answer

Configuring cross-tenant access settings to trust the user's account status from the home tenant enables Azure AD to evaluate the external user's account state (enabled/disabled) in their home tenant at each authentication. When the partner user's account is disabled in their home tenant, Azure AD will deny access even if a valid session token exists, because the token's validity is rechecked against the home tenant's account status via the cross-tenant trust policy.

Exam trap

The trap here is that candidates often confuse session token revocation with conditional access policies or app restrictions, failing to realize that only the cross-tenant trust setting directly ties the external user's access to their home tenant's account status, enabling immediate revocation without waiting for token expiry.

How to eliminate wrong answers

Option B is wrong because restricting B2B users to specific apps controls which applications they can access, not whether their account status is honored from the home tenant; it does not enforce immediate revocation when the account is disabled. Option C is wrong because a conditional access policy requiring device compliance checks the device state, not the user account status in the home tenant; it cannot detect or react to a disabled account in the external tenant. Option D is wrong because enabling Azure AD Identity Protection for B2B users provides risk-based conditional access (e.g., risky sign-ins), but it does not directly trust the home tenant's account disabled state; it relies on Microsoft's risk signals, not the partner tenant's directory status.

Full explanation →

114

MCQhard

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

A.The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

B.The NSG is not associated with the NIC because the command did not specify the NIC correctly.

C.The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.

D.The NSG rule should be an inbound rule to block outbound traffic.

AnswerC

If the subnet has no NSG, the default outbound allow rule permits traffic, and the NIC NSG rule is not evaluated because the first match (subnet default allow) applies.

Why this answer

When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.

Exam trap

The trap here is that candidates often assume NIC-level NSG rules always take precedence over subnet-level NSG rules, but in reality, subnet-level rules are evaluated first and can allow traffic that NIC-level rules would deny.

How to eliminate wrong answers

Option A is wrong because the 'Internet' service tag is correctly used to represent all public IP addresses reachable via the Internet, and specifying an IP range would be impractical and less secure. Option B is wrong because the Azure CLI command to create a VM with a single NIC and apply an NSG rule typically associates the NSG with the NIC correctly if the command syntax is correct; the question states the command was run, so the NSG is likely associated. Option D is wrong because outbound traffic is controlled by outbound NSG rules, not inbound rules; inbound rules only control traffic entering the NIC or subnet.

Full explanation →

115

MCQeasy

A security analyst uses Microsoft Sentinel. They want to create a scheduled analytics rule that runs every hour and queries Azure Activity logs to detect deployment of VMs in non-approved regions. They want to generate an incident automatically when suspicious activity is found. Which configuration is required to automatically create an incident?

A.Enable 'Create incident from alerts triggered by this rule' in the Incident settings

B.Configure the 'Alert details' section with the appropriate severity and description

C.Define entity mapping in the 'Entity mapping' tab

D.Connect Azure Activity log to Sentinel via Event Hub

AnswerA

The 'Create incident from alerts triggered by this rule' toggle resides in the Incident settings tab of the analytics rule wizard in Microsoft Sentinel. When enabled, every alert generated by the rule is automatically fed into the incident creation pipeline, where alert grouping rules determine whether alerts are merged into a single incident or create separate ones. This is the definitive switch that controls whether the rule produces incidents at all; without it, alerts are stored in the Sentinel alerts table but no incident is created.

Why this answer

The 'Create incident from alerts triggered by this rule' setting in the Incident settings tab is the specific toggle that instructs Microsoft Sentinel to automatically generate a security incident whenever the scheduled analytics rule fires an alert. Without this setting enabled, the rule will only produce raw alerts that must be manually triaged or routed through a separate automation rule to become incidents. This is the direct configuration required for automatic incident creation from a scheduled query rule.

Exam trap

The trap here is that candidates often confuse the 'Alert details' configuration (which only sets alert metadata) with the incident creation toggle, assuming that defining severity and description automatically generates an incident, when in fact a separate explicit setting is required.

How to eliminate wrong answers

Option B is wrong because configuring the 'Alert details' section (severity and description) only defines the metadata of the alert itself, not the automatic creation of an incident from that alert. Option C is wrong because entity mapping enriches alerts with entity types (e.g., IP, host) for correlation and investigation, but does not control whether an incident is automatically generated. Option D is wrong because connecting Azure Activity log to Sentinel via Event Hub is a data ingestion method, not a configuration for incident creation; the log source must already be connected for the rule to query it, but that step is separate from the incident creation setting.

Full explanation →

116

MCQmedium

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

A.The Key Vault is in a different Azure region than the storage account.

B.The storage account does not have a system-assigned managed identity enabled.

C.A default encryption scope is configured on the blob container that uses a Microsoft-managed key.

D.The customer-managed key in Key Vault is disabled or expired.

AnswerC

Encryption scopes can be set at the container level. A default encryption scope overrides the storage account-level encryption. If the scope uses Microsoft-managed keys, new blobs in that container will not use the customer-managed key.

Why this answer

When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Exam trap

The trap here is that candidates assume the storage account-level CMK setting applies uniformly to all blobs, but they overlook that encryption scopes at the container level can override that setting, causing a silent fallback to Microsoft-managed keys.

How to eliminate wrong answers

Option A is wrong because Azure Key Vault and the storage account can be in different regions; cross-region CMK is supported as long as the Key Vault is in the same Azure Active Directory tenant. Option B is wrong because a system-assigned managed identity is not required for CMK; a user-assigned managed identity can be used, or the storage account can use its own identity implicitly when granted access to Key Vault via access policies or RBAC. Option D is wrong because if the customer-managed key were disabled or expired, the storage account would fail to encrypt or decrypt blobs, resulting in errors (e.g., 403 Forbidden) rather than silently falling back to Microsoft-managed keys.

Full explanation →

117

MCQmedium

A company deploys Azure Firewall in a hub VNet to inspect all outbound traffic from a spoke VNet. They enable VNet peering between the hub and spoke. They create a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop, and associate it with the spoke subnets. However, outbound traffic from the spoke subnets is still going directly to the internet, bypassing the firewall. What is the most likely cause?

A.The route table's next hop type is not set to 'Virtual appliance'

B.The route table is not associated with the subnet

C.The hub-spoke peering is not configured correctly

D.Azure Firewall is in a different resource group

AnswerA

For an Azure Firewall to inspect traffic via a user-defined route, the route's next hop type must be set to 'Virtual appliance' and the next hop address must be the firewall's private IP. If the next hop type is instead set to 'Internet', Azure treats the destination as directly reachable through the default route, so traffic egresses without ever hitting the firewall, even if the IP address field still contains the firewall's IP. This configuration error produces exactly the symptom described: traffic continues to flow, but none of it is actually inspected by the firewall.

Why this answer

The most likely cause is that the route table's next hop type is not set to 'Virtual appliance'. When creating a custom route in Azure, the next hop type must be explicitly set to 'Virtual appliance' and the next hop address must be the firewall's private IP. If the next hop type is left as 'Internet' or another value, Azure will ignore the custom route and use the default system route for 0.0.0.0/0, which sends traffic directly to the internet without inspection.

Exam trap

The trap here is that candidates assume any custom route with a firewall IP will work, but Azure requires the next hop type to be explicitly set to 'Virtual appliance' to override the default system route for 0.0.0.0/0.

How to eliminate wrong answers

Option B is wrong because if the route table were not associated with the subnet, the custom route would not apply at all, and traffic would use the default system route—but the question states the route table is associated with the spoke subnets, so this is not the issue. Option C is wrong because VNet peering is correctly enabled between hub and spoke; peering configuration does not affect the next hop type of a route table, and traffic can still flow through the firewall if the route is correct. Option D is wrong because Azure Firewall can be in a different resource group without impacting routing; resource group placement has no effect on network traffic flow or route table functionality.

Full explanation →

118

MCQeasy

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

A.Azure Disk Encryption

B.Azure Storage Service Encryption (SSE) with platform-managed key

C.Azure Storage Service Encryption with customer-managed key

D.Azure Information Protection

AnswerC

Allows you to use your own key from Azure Key Vault for encryption at rest.

Why this answer

Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Exam trap

The trap here is that candidates often confuse Azure Disk Encryption (which encrypts VM disks) with Storage Service Encryption (which encrypts the storage account's blob, file, queue, and table data), leading them to select Option A instead of the correct SSE with CMK.

How to eliminate wrong answers

Option A is wrong because Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt OS and data disks of virtual machines, not the data at rest in an Azure Storage account. Option B is wrong because SSE with platform-managed key uses Microsoft-managed keys, not customer-managed keys, so it does not satisfy the requirement for customer-managed key control. Option D is wrong because Azure Information Protection (AIP) is a classification and labeling service for documents and emails, not an encryption mechanism for data at rest in Azure Storage.

Full explanation →

119

MCQhard

Refer to the exhibit. You have an Azure Firewall policy with the shown rules. Traffic from 10.0.0.0/8 to www.google.com on HTTPS (443) is being blocked. What is the most likely reason?

A.The network rule collection with priority 100 denies all traffic, and it is evaluated before the application rule collection.

B.The application rule collection has an action of Deny.

C.The source address 10.0.0.0/8 is not included in the application rule.

D.The application rule collection does not allow *.google.com.

AnswerA

Network rules have higher priority than application rules when the action is Deny.

Why this answer

Azure Firewall policy rule collections are evaluated in order of priority, with lower numbers evaluated first. The network rule collection with priority 100 denies all traffic, and since network rules are evaluated before application rules, this deny rule matches the HTTPS traffic from 10.0.0.0/8 to www.google.com before the application rule collection (which would allow it) is ever reached. Therefore, the traffic is blocked by the higher-priority network rule.

Exam trap

The trap here is that candidates often assume application rules are evaluated first or that a deny action in the application rule collection is the cause, but Azure Firewall evaluates network rules before application rules, so a low-priority network deny rule can override a higher-priority application allow rule.

How to eliminate wrong answers

Option B is wrong because the application rule collection's action is Allow (as shown in the exhibit), not Deny, so it would not block traffic. Option C is wrong because the application rule collection does not require the source address to be explicitly listed; application rules apply to all sources unless a specific source condition is configured, and the exhibit shows no source restriction. Option D is wrong because the application rule collection does allow *.google.com (as shown in the exhibit), so that is not the reason for blocking.

Full explanation →

120

MCQhard

A security operations team uses Microsoft Sentinel. They have a scheduled analytics rule that generates an incident when a user signs in from an unusual location. They want to automatically assign the incident to the 'Security Engineering' team and set its severity to 'High' when it is created. Which feature should they use?

A.Automation rules

B.Playbooks

C.Incident settings in analytics rule

D.Workbooks

AnswerA

Automation rules can automatically assign incidents to a team owner and change the severity at the time of incident creation.

Why this answer

Automation rules in Microsoft Sentinel allow you to centrally manage the automated handling of incidents, including assigning them to a specific team and setting their severity. When a scheduled analytics rule generates an incident, an automation rule can trigger on incident creation to perform these actions without requiring a playbook or manual intervention.

Exam trap

The trap here is that candidates often confuse playbooks with automation rules, thinking that playbooks are required for any automated action, when in fact automation rules are the native, simpler mechanism for assignment and severity changes without needing Logic Apps.

How to eliminate wrong answers

Option B is wrong because playbooks are collections of actions based on Azure Logic Apps that run in response to alerts or incidents, but they are typically used for more complex, multi-step orchestration and require additional configuration; automation rules are the simpler, built-in feature for direct assignment and severity changes. Option C is wrong because incident settings within an analytics rule only allow you to configure group-related settings (e.g., alert grouping) and entity mapping, not post-creation actions like assignment or severity override. Option D is wrong because workbooks are interactive dashboards for visualizing data and reports, not for automating incident response actions.

Full explanation →

121

MCQhard

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with the 'sysadmin' role cannot view the plaintext data. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

A.Transparent Data Encryption (TDE)

B.Always Encrypted with randomized encryption

C.Always Encrypted with deterministic encryption

D.Dynamic Data Masking

AnswerC

Always Encrypted with deterministic encryption derives a fixed initialization vector from the plaintext value, so identical plaintexts always yield identical ciphertexts, enabling the server to perform equality comparisons, joins, and exact-match lookups without ever seeing the plaintext. The column encryption key is stored and used only on the client side (for example, in Windows Certificate Store or Azure Key Vault), meaning SQL Server and DBAs see only opaque ciphertext and cannot decrypt the data. This achieves the dual goal of secure patient data protection while retaining the ability to query by known identifiers.

Why this answer

Always Encrypted with deterministic encryption is correct because it encrypts specific columns at the client side, ensuring that even database administrators with 'sysadmin' role cannot view plaintext data. Deterministic encryption generates the same ciphertext for identical plaintext values, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting both requirements.

Exam trap

The trap here is that candidates confuse Dynamic Data Masking with encryption, thinking it prevents privileged users from seeing data, when in fact it only masks output and does not protect data at rest or from direct queries by sysadmins.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest but does not protect data from database administrators who have access to the database engine; they can still query plaintext data. Option B is wrong because Always Encrypted with randomized encryption does not support equality comparisons (WHERE clauses) on encrypted columns, as it produces different ciphertext for the same plaintext each time. Option D is wrong because Dynamic Data Masking only obfuscates data at query result time but does not encrypt the underlying data, so administrators with 'sysadmin' role can still access plaintext by running queries without masking.

Full explanation →

122

MCQeasy

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

A.The workbook uses a different visualization type that requires KQL.

B.The Log Analytics gateway is blocking the sign-in logs.

C.The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.

D.The Log Analytics workspace is not receiving sign-in logs from Azure AD.

AnswerC

This is correct. The workbook's time range filter might be set to a broader range (e.g., last 7 days) while the query uses a 24-hour filter. If the query does not correctly use the time parameter, it may return no results when the dashboard filter is applied.

Why this answer

The workbook likely has a time range filter set to 'Last 7 days', but the underlying KQL query uses a hardcoded 24-hour filter. This mismatch causes the query to return data only for the last 24 hours, but the dashboard filter may interfere or the query may be incorrectly referencing the time parameter. As a result, no data is displayed.

Option A is incorrect because workbooks rely on KQL queries regardless of visualization type. Option B is incorrect because the Log Analytics gateway is used for on-premises data, not for Azure AD sign-in logs which stream directly to the workspace. Option D is incorrect because the problem statement confirms sign-in logs are being received.

Exam trap

The most common trap is assuming that if logs are flowing into the Log Analytics workspace, the workbook will automatically show data. However, workbook queries often have their own time filters that must align with the dashboard's time range. Misconfigured time parameters are a frequent hidden issue.

Full explanation →

123

MCQmedium

A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?

A.Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.

B.Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.

C.Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.

D.Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.

AnswerB

This is correct because with a customer-managed key (CMK) in Azure Key Vault, you can define a key rotation policy that automatically generates new key versions on a schedule. The storage account must reference the key URI without a specific version so it automatically uses the latest key version. This provides the required automatic rotation of the encryption key, fully managed through Azure Key Vault, without manual intervention.

Why this answer

Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.

Exam trap

The trap here is that candidates confuse where the rotation policy is configured—thinking it is on the storage account (Option A) rather than in Azure Key Vault, or they assume platform-managed keys can be scheduled for rotation (Option D), which is not supported.

How to eliminate wrong answers

Option A is wrong because a rotation policy cannot be configured on the storage account itself; key rotation is managed in Azure Key Vault, not on the storage account resource. Option C is wrong because it requires manual rotation every 90 days, which contradicts the requirement for automatic rotation without manual intervention. Option D is wrong because platform-managed keys (PMK) cannot be rotated on a custom schedule; they are managed entirely by Microsoft, and Azure Policy cannot enforce a specific rotation interval for PMKs.

Full explanation →

124

MCQhard

A company has an Azure SQL Database with a private endpoint connection. The database is accessed from on-premises via ExpressRoute and from other Azure virtual networks (VNets) via VNet peering. The security team wants to ensure that all queries from both on-premises and peered VNets go through the private endpoint and NEVER use the public endpoint, even as a fallback. Which additional configuration is required to enforce this?

A.Configure a Network Security Group (NSG) on the subnet hosting the private endpoint to deny outbound traffic to the public endpoint's IP addresses.

B.Enable Azure SQL Auditing and configure a log analytics workspace to monitor for public endpoint calls, then manually block them.

C.Disable public network access on the Azure SQL server.

D.Configure a service endpoint for Azure SQL on the VNet and associate a firewall rule allowing only the VNet traffic.

AnswerC

Correct. Disabling public network access on the SQL server blocks all traffic from the public internet, leaving only the private endpoint as the entry point. This ensures all traffic from on-premises and peered VNets must use the private endpoint.

Why this answer

Disabling public network access on the Azure SQL server explicitly blocks all traffic that does not originate from a private endpoint. This setting ensures that even if a client attempts to connect using the public endpoint (e.g., via a misconfigured connection string or DNS resolution fallback), the server will reject the connection. This is the only configuration that enforces the requirement that all queries—from on-premises via ExpressRoute or from peered VNets—must go through the private endpoint and never use the public endpoint.

Exam trap

The trap here is that candidates often confuse 'private endpoint' with 'service endpoint' or think that NSGs or monitoring can enforce private-only access, when in fact the only way to guarantee that no traffic uses the public endpoint is to disable public network access at the server level.

How to eliminate wrong answers

Option A is wrong because NSGs are not supported on subnets hosting private endpoints; Azure blocks NSG association on private endpoint subnets, and even if applied, an NSG cannot block outbound traffic from the private endpoint to the public endpoint because the private endpoint itself does not route traffic to the public IP—the issue is client-side DNS resolution. Option B is wrong because auditing and monitoring only detect public endpoint usage after the fact; they do not prevent the connection from using the public endpoint as a fallback, which violates the 'never use' requirement. Option D is wrong because service endpoints allow traffic from the VNet to the Azure SQL public endpoint, which is exactly what the security team wants to avoid; service endpoints do not enforce private endpoint usage and would permit public endpoint access from peered VNets.

Full explanation →

125

Multi-Selectmedium

Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?

Select 3 answers

A.Vulnerability scanning of containers

B.Security recommendations for resources

C.Secure Score

D.Threat detection for VMs

E.Regulatory compliance assessments

AnswersB, C, E

CSPM generates recommendations to improve security.

Why this answer

CSPM in Microsoft Defender for Cloud continuously assesses Azure resources against built-in security policies and industry best practices, generating actionable security recommendations to harden the environment. These recommendations are derived from the Azure Security Benchmark and are displayed in the Recommendations blade, directly influencing the Secure Score.

Exam trap

The trap here is that candidates confuse CSPM's configuration-based recommendations and Secure Score with the threat detection and vulnerability scanning features that belong to separate Defender for Cloud workload protection plans, leading them to select options A or D as CSPM features.

Full explanation →

126

Multi-Selecteasy

Which TWO Azure services can be used to distribute incoming traffic across multiple virtual machines in a backend pool while providing layer 7 load balancing? (Choose two.)

Select 2 answers

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure VPN Gateway

E.Azure Front Door

AnswersB, E

Application Gateway is a layer 7 load balancer with HTTP/HTTPS support.

Why this answer

Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple virtual machines in a backend pool based on HTTP/HTTPS attributes such as URL path, host headers, and cookies. It also provides SSL termination, Web Application Firewall (WAF), and session affinity, making it suitable for web application traffic.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (layer 4) with Azure Application Gateway (layer 7), assuming both can perform HTTP-based routing, but only Application Gateway can inspect and route based on application-layer data.

Full explanation →

127

MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

A.Configure a private endpoint for the SQL server to the Key Vault.

B.Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.

C.Change the Key Vault firewall to allow all Azure services.

D.Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.

AnswerB

This setting allows trusted Azure services, including Azure SQL Database, to access the Key Vault even when the firewall is enabled. Since the SQL server's managed identity already has the cryptographic role, this is the missing piece to allow TDE operations.

Why this answer

When Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Exam trap

The trap here is that candidates often assume a private endpoint or VNet service endpoint is always required for Key Vault access when firewalls are enabled, but they overlook the 'Allow trusted Microsoft services' bypass which is specifically designed for Azure PaaS services like SQL Database to access Key Vault without additional network configuration.

How to eliminate wrong answers

Option A is wrong because configuring a private endpoint for the SQL server to the Key Vault would require the SQL server to be in a VNet with a private endpoint connection, but the SQL server is not VNet-injected by default and the question does not indicate VNet integration; additionally, the system-assigned managed identity and role assignment are already in place, so the issue is firewall bypass, not network connectivity. Option C is wrong because 'Allow all Azure services' is a legacy setting that is overly permissive and deprecated in favor of the more specific 'Allow trusted Microsoft services' option; it would also allow all Azure services, not just trusted ones, which violates least-privilege principles. Option D is wrong because a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet would only help if the SQL server were deployed in a VNet (which it is not by default for Azure SQL Database), and service endpoints do not bypass the Key Vault firewall's deny-all rule unless the firewall explicitly allows the specific VNet/subnet, which is not mentioned.

Full explanation →

128

MCQmedium

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

A.Deploy the Log Analytics agent to the SQL servers

B.Configure Azure Firewall logs for SQL traffic

C.Assign the 'Configure Azure Defender for SQL agents on virtual machines' policy

D.Enable the 'SQL servers on machines' plan in Microsoft Defender for Cloud

AnswerD

Enabling the 'SQL servers on machines' plan in Microsoft Defender for Cloud is the prerequisite that activates threat detection for Azure Arc-enabled SQL Server instances. This plan, part of Defender for Cloud's enhanced security features, turns on SQL-specific alerts, vulnerability assessments, and advanced threat protection for on-premises and multi-cloud SQL servers. Without this plan enabled, no SQL server security alerts will be generated regardless of other configurations, so this is the required first step.

Why this answer

For on-premises SQL servers with Azure Arc, the 'SQL servers on machines' plan must be enabled in Microsoft Defender for Cloud to surface alerts. Without enabling this plan, alerts for SQL servers will not appear. Options A and C are related to agent deployment and policy assignment, but the first step is to ensure the plan is enabled.

Option B is unrelated as Azure Firewall logs are not required for SQL-specific alerts.

Full explanation →

129

MCQeasy

You need to block outbound internet access from all VMs in a VNet except for specific allowed destinations (e.g., Microsoft updates). You cannot use a third-party NVA. Which Azure service should you use to meet this requirement?

A.Azure Bastion

B.Azure Firewall

C.Network Security Groups (NSGs)

D.Azure Virtual Network NAT

AnswerB

Azure Firewall is a managed, stateful firewall service that acts as a central egress filter in a hub VNet. By creating a route table with a default route (0.0.0.0/0) to the firewall's private IP, all outbound VM traffic can be forced through it. Azure Firewall supports application rules with fully qualified domain names (FQDNs) and network rules with IP/port/protocol, allowing you to deny all outbound internet traffic while selectively permitting only specific FQDNs. This makes it the appropriate solution for the requirement to block outbound internet access except for approved destinations.

Why this answer

Azure Firewall is a managed, cloud-native network security service that can filter outbound traffic from VMs in a VNet based on fully qualified domain names (FQDNs), IP addresses, and port/protocol rules. It supports application rules (e.g., allow *.update.microsoft.com) and network rules, enabling you to block all outbound internet access except for specific allowed destinations like Microsoft Updates. Unlike NSGs, Azure Firewall provides stateful inspection and centralized logging, making it the correct choice for this requirement without a third-party NVA.

Exam trap

The trap here is that candidates often confuse NSGs with a firewall, thinking NSGs can filter outbound traffic by FQDN or application identity, but NSGs only support IP-based rules and cannot inspect application-layer protocols like HTTPS to allow specific destinations such as Microsoft Updates.

How to eliminate wrong answers

Option A is wrong because Azure Bastion is a PaaS service that provides secure RDP/SSH connectivity to VMs inside a VNet without exposing public IPs; it does not filter outbound internet traffic. Option C is wrong because Network Security Groups (NSGs) can filter traffic only at Layer 3 (IP) and Layer 4 (port/protocol), not at the application layer (FQDN), and they cannot selectively allow outbound traffic to specific destinations like Microsoft Updates while blocking all other internet access. Option D is wrong because Azure Virtual Network NAT (VNet NAT) provides outbound connectivity with source network address translation but does not include any filtering or firewall capabilities to block or allow specific destinations.

Full explanation →

130

MCQhard

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

A.Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.

B.Set the key vault's 'enabledForDiskEncryption' property to true.

C.Grant the virtual machine's managed identity 'Contributor' role on the key vault.

D.Configure soft-delete and purge protection on the key vault.

AnswerB

The 'enabledForDiskEncryption' boolean property on the key vault is a specific vault-level flag that tells Azure's compute platform that the vault is allowed to be used by the Azure Disk Encryption service. When set to true, it grants the ADE service (which runs as part of the Microsoft.Compute resource provider) the necessary access to read secrets and use keys wrapped in the vault during the encryption workflow. This is the standard prerequisite because neither a user-assigned identity nor a service principal with RBAC on the vault alone can suffice without this setting.

Why this answer

Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.

Exam trap

The trap here is that candidates often confuse the 'enabledForDiskEncryption' property with RBAC roles or managed identity permissions, assuming that granting a role to the VM or service principal is sufficient, when in fact the platform requires this specific vault-level flag to be enabled.

How to eliminate wrong answers

Option A is wrong because granting the Azure Disk Encryption service principal the 'Reader' role on the key vault is unnecessary; the platform uses the 'enabledForDiskEncryption' property, not an RBAC role, to authorize access. Option C is wrong because granting the VM's managed identity 'Contributor' role on the key vault is not required; ADE does not use the VM's identity to access the KEK—it uses the platform's identity authorized by the vault property. Option D is wrong because soft-delete and purge protection are important for recovery and compliance but are not required for the platform to access the KEK during encryption; they are separate prerequisites for some scenarios but not the specific configuration needed here.

Full explanation →

131

MCQhard

Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?

A.Use Azure Blueprints to define the initiative and assign it to the management group.

B.Assign the initiative as an Azure Policy at the management group scope.

C.Create a custom RBAC role that includes the initiative and assign it to the management group.

D.Assign the initiative to each subscription individually using the Defender for Cloud interface.

AnswerB

Correct: Policy assignment at management group scope applies to all subscriptions under it.

Why this answer

Assigning the initiative as an Azure Policy at the management group scope is the correct approach because Azure Policy can be applied at the management group, subscription, or resource group level, and it will be inherited by all child subscriptions. This ensures a consistent security policy across all subscriptions without manual per-subscription configuration. Microsoft Defender for Cloud uses Azure Policy initiatives (such as the Microsoft Cloud Security Benchmark) to enforce security controls, and assigning at the management group scope is the most efficient method for bulk compliance.

Exam trap

The trap here is that candidates often confuse Azure Blueprints with Azure Policy inheritance, thinking Blueprints can apply policies across a management group hierarchy, when in fact Blueprints require per-subscription assignment and do not support automatic inheritance like Azure Policy does.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints are used for deploying repeatable sets of Azure resources and policies, but they require explicit assignment to each subscription and do not automatically inherit down the management group hierarchy like Azure Policy does. Option C is wrong because RBAC roles control permissions to Azure resources, not the assignment of policy initiatives; a custom RBAC role cannot assign or enforce a Defender for Cloud initiative. Option D is wrong because assigning the initiative to each subscription individually is inefficient and error-prone, and it does not leverage the management group inheritance that Azure Policy provides for consistent application.

Full explanation →

132

MCQmedium

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

A.Transparent Data Encryption (TDE)

B.Always Encrypted

C.Dynamic Data Masking (DDM)

D.Row-Level Security (RLS)

AnswerB

Always Encrypted encrypts sensitive columns at the client side, ensuring that the data is never exposed in plaintext to the server or DBAs. Only the client application with the column master key can decrypt the data.

Why this answer

Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Exam trap

The trap here is that candidates often confuse Transparent Data Encryption (TDE) with Always Encrypted because both involve encryption, but TDE does not protect data from database administrators or encrypt data in transit, which is the core requirement in this scenario.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts data at rest but does not protect data in transit, and the database engine has access to the encryption keys, so DBAs can still see plaintext data. Option C is wrong because Dynamic Data Masking (DDM) only obfuscates data at query results for unauthorized users, but the underlying data remains unencrypted in storage and in transit, and DBAs can bypass masking. Option D is wrong because Row-Level Security (RLS) controls access to rows based on user context but does not encrypt data at rest or in transit, and DBAs with elevated permissions can still read all data.

Full explanation →

133

MCQeasy

You have an Azure virtual machine that hosts a web application on port 443 and a management interface on port 8443. You need to allow inbound HTTPS traffic from the internet to port 443, and allow inbound traffic on port 8443 only from the company's office public IP range (203.0.113.0/24). You want to use a managed service that provides basic DDoS protection at no additional cost. What should you use?

A.Azure Application Gateway with WAF

B.Azure Front Door

C.Azure Firewall

D.Network Security Group (NSG)

AnswerD

An NSG can be associated with the VM's subnet or network interface. You can create rules to allow inbound HTTPS on port 443 from any source, and allow inbound on port 8443 only from the office IP range. NSGs are free and the default DDoS Protection Basic is included at no additional cost.

Why this answer

A Network Security Group (NSG) is the correct choice because it is a free, managed Azure service that provides basic DDoS protection at no additional cost. NSGs allow you to define inbound security rules to permit HTTPS traffic (port 443) from any source and restrict management traffic (port 8443) to a specific public IP range (203.113.0.0/24). This meets all requirements without incurring extra charges for advanced services.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing a paid, advanced service (like Application Gateway or Azure Firewall) when a simple, free NSG with basic DDoS protection fully satisfies the requirements, especially since the question explicitly states 'at no additional cost'.

How to eliminate wrong answers

Option A is wrong because Azure Application Gateway with WAF is a layer-7 load balancer that incurs additional cost and does not provide basic DDoS protection at no extra cost; its WAF SKU is billed separately. Option B is wrong because Azure Front Door is a global layer-7 CDN and load balancer that also has additional cost and is not a free managed service for basic DDoS protection. Option C is wrong because Azure Firewall is a paid, stateful firewall service that provides advanced filtering but is not free and does not include basic DDoS protection as a built-in feature at no cost.

Full explanation →

134

Multi-Selectmedium

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Select 2 answers

A.Enable service endpoints for the Cosmos DB account

B.Configure a private endpoint

C.Set the minimum TLS version to 1.2

D.Disable public network access

E.Configure firewall rules to allow only Azure services

AnswersB, C

Correct. Private endpoint ensures traffic stays within Azure backbone and enforces regional restriction.

Why this answer

Configuring a private endpoint ensures that traffic between the client and Cosmos DB traverses the Microsoft backbone network, enforcing that only Azure services within the same region can access via private IPs. Option C is correct because setting the minimum TLS version to 1.2 enforces encryption in transit for all connections. Option A (service endpoints) does not enforce encryption or regional restriction.

Option D (disable public network access) is a prerequisite for private endpoints but alone does not enforce encryption. Option E (firewall rules to allow only Azure services) does not enforce TLS version.

Full explanation →

135

MCQmedium

A company uses Azure SQL Database with Azure Active Directory authentication. To meet compliance requirements, they need to audit all failed login attempts and store the audit logs in a storage account located in a different Azure region for disaster recovery. What should they configure?

A.Enable SQL Auditing and set the destination to a Log Analytics workspace in a different region.

B.Enable SQL Auditing and set the destination to an Event Hub namespace in the same region.

C.Enable SQL Auditing and set the destination to an Azure Storage account in a different region.

D.Enable Advanced Threat Protection for Azure SQL Database and configure email notifications.

AnswerC

Azure SQL Auditing can write audit logs directly to an Azure Storage account, and placing that account in a different region provides geographic separation for disaster recovery. You can select a storage account configured with geo-redundant storage (GRS) or geo-zone-redundant storage (GZRS), so audit .xel files are replicated to a paired region and remain accessible even if the primary SQL database region fails. This durable, long-term storage model satisfies compliance requirements for failed-login auditing and supports immutable retention policies to prevent tampering.

Why this answer

Azure SQL Database auditing can be configured to write audit logs directly to an Azure Storage account. Storing the logs in a storage account located in a different Azure region meets the disaster recovery requirement by ensuring logs survive a regional outage. The audit logs capture all database events, including failed login attempts, which satisfies the compliance need.

Exam trap

The trap here is that candidates often confuse auditing with threat detection or choose a Log Analytics workspace for centralized logging, overlooking the explicit requirement for durable, cross-region storage for compliance and disaster recovery.

How to eliminate wrong answers

Option A is wrong because a Log Analytics workspace does not provide geo-redundant storage for disaster recovery; it is primarily for log analytics and monitoring, not for long-term archival in a different region. Option B is wrong because an Event Hub namespace is a real-time streaming service, not a durable storage destination for audit logs, and it is specified to be in the same region, which fails the disaster recovery requirement. Option D is wrong because Advanced Threat Protection (ATP) detects suspicious activities and sends email notifications, but it does not audit or store failed login attempts in a storage account for compliance purposes.

Full explanation →

136

MCQeasy

A company has an Azure virtual network with two subnets: Frontend and Backend. They deploy a network virtual appliance (NVA) in a subnet named NVA_Subnet. They want to route all traffic from the Frontend subnet to the Backend subnet through the NVA for inspection. What is the minimum number of route tables required to achieve this traffic steering?

A.1

B.2

C.3

D.4

AnswerA

A single route table associated with the Frontend subnet is all that is required. You define one user-defined route (UDR) with the Backend subnet's address space as the destination and the NVA's private IP as the next hop. Because the traffic flow originates only from Frontend to Backend, outbound traffic on Frontend is steered through the NVA, while return traffic automatically uses the default system routes without requiring a separate route table on the Backend subnet.

Why this answer

A single route table can be associated with the Frontend subnet and configured with a user-defined route (UDR) that has the NVA's private IP as the next hop for traffic destined to the Backend subnet. This ensures all traffic from Frontend to Backend is forwarded to the NVA for inspection. No additional route tables are needed because the NVA itself handles the routing decision after inspection, and the Backend subnet does not require a specific route to return traffic unless asymmetric routing is a concern.

Exam trap

The trap here is that candidates often assume each subnet requires its own route table, or that the NVA subnet itself needs a custom route, but Azure's default routing handles the return path unless asymmetric routing is explicitly required.

How to eliminate wrong answers

Option B is wrong because two route tables would be unnecessary; the requirement is only to steer traffic from Frontend to Backend through the NVA, which can be achieved with a single route table associated with the Frontend subnet. Option C is wrong because three route tables imply a misconception that each subnet or the NVA subnet requires its own route table, but the NVA subnet does not need a custom route for this scenario. Option D is wrong because four route tables would be excessive and suggests a misunderstanding of how Azure routing works; the default system routes handle intra-VNet traffic unless overridden, and only the source subnet (Frontend) needs a custom route.

Full explanation →

137

MCQmedium

A company has a hub-spoke network topology in Azure. The hub virtual network contains an Azure Firewall. Spoke virtual networks are peered to the hub. The security team wants to inspect all traffic between virtual machines in different spoke virtual networks. What is the minimum configuration required?

A.Enable VNet peering gateway transit and allow forwarded traffic.

B.Deploy a VPN gateway in each spoke and configure site-to-site VPNs to the hub.

C.Define user-defined routes (UDRs) in each spoke that direct inter-spoke traffic to the Azure Firewall in the hub.

D.Configure network security groups (NSGs) on each spoke subnet.

AnswerC

Defining user-defined routes (UDRs) on each spoke subnet whose address prefix covers the other spoke's address space and whose next hop is the Azure Firewall's private IP address ensures that any inter-spoke traffic is forced to traverse the hub firewall for inspection and policy enforcement. This is the canonical pattern for a hub-spoke architecture with forced tunneling, as the route table overrides the default system routes that would otherwise use the direct peering path. The firewall's network and application rules then filter, log, and optionally forward the traffic to the destination spoke.

Why this answer

User-defined routes (UDRs) in each spoke subnet are required to force inter-spoke traffic through the Azure Firewall in the hub. Without UDRs, traffic between peered spokes would flow directly over the VNet peering connections, bypassing the firewall. The UDRs must have the Azure Firewall's private IP as the next hop to ensure all inter-spoke traffic is inspected.

Exam trap

The trap here is that candidates often assume VNet peering automatically routes inter-spoke traffic through the hub, but without UDRs, Azure's default system routes allow direct communication between peered spokes, bypassing any inspection appliance.

How to eliminate wrong answers

Option A is wrong because enabling VNet peering gateway transit and allowing forwarded traffic only permits traffic to flow through a VPN gateway or ExpressRoute gateway in the hub, not through an Azure Firewall; it does not force inter-spoke traffic to be inspected. Option B is wrong because deploying VPN gateways in each spoke and configuring site-to-site VPNs to the hub is unnecessary, adds cost and complexity, and does not leverage the existing Azure Firewall for traffic inspection. Option D is wrong because network security groups (NSGs) are stateful, stateless packet filters that can allow or deny traffic but cannot redirect traffic to a firewall for inspection; they lack routing capabilities.

Full explanation →

138

MCQeasy

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

A.The policy will apply only to the VM-Sensitive virtual machine.

B.The policy will apply to all resources in RG-Prod except the entire resource group.

C.The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.

D.The policy will apply to the subscription but not to RG-Prod.

AnswerC

The assignment's scope is RG-Prod, making every contained resource subject to policy evaluation. The notScopes array specifies the VM-Sensitive virtual machine resource ID, so that VM alone is excluded from compliance evaluation. All other resources, regardless of type, remain within the assignment's scope and are evaluated.

Why this answer

'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources.

Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Full explanation →

139

MCQeasy

A small business has a single Azure subscription with one virtual network containing two subnets: 'Frontend' for web servers and 'Backend' for database servers. The web servers need to access the internet to download updates, but the database servers must not have any outbound internet access. The business also needs to allow remote administration of the web servers from the internet via RDP (port 3389) but only from the IT department's public IP range (203.0.113.0/24). You need to configure network security to meet these requirements using Azure-native services. What should you do?

A.Use a network virtual appliance (NVA) for outbound inspection and configure RDP access via a jump box.

B.Create an NSG for the Frontend subnet with an inbound rule allowing RDP from 203.0.113.0/24, and a default deny for outbound. Then create an NSG for the Backend subnet with a default deny outbound rule.

C.Create a site-to-site VPN from the IT department to Azure and use Azure Bastion for RDP access.

D.Deploy Azure Firewall in the virtual network and configure DNAT rules for RDP and outbound rules for internet access.

AnswerD

Azure Firewall with DNAT rules allows RDP access from the IT department IP range (203.0.113.0/24) to the web servers. Outbound rules can be configured to allow internet access from the Frontend subnet while blocking outbound traffic from the Backend subnet, meeting all requirements efficiently and securely.

Why this answer

Azure Firewall provides a managed, scalable solution for controlling outbound internet access and inbound RDP. You can configure DNAT rules to allow RDP access from the IT department IP range (203.0.113.0/24) to the web servers, and set outbound rules to allow internet access from the Frontend subnet while blocking outbound traffic from the Backend subnet. Option B is incorrect because the described NSG configuration includes a default deny outbound rule for the Frontend subnet, which would block the web servers' ability to download updates from the internet without an explicit allow rule.

Options A and C introduce unnecessary complexity and cost, and option C does not address the outbound internet requirement.

Exam trap

A common mistake is to assume that NSGs have a default deny outbound behavior, but they actually have a default allow outbound. The option B explicitly sets a 'default deny outbound', which would block internet access unless an explicit allow rule is added. Candidates may overlook the need for that allow rule.

Full explanation →

140

MCQmedium

A company uses Azure AD Identity Protection. They have detected a user with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user only when the sign-in comes from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy. Which configuration should they use?

A.Assign the user to the policy, set condition 'User risk level: High' and condition 'Locations: All locations except trusted', and set 'Grant' to 'Block access'

B.Assign the user to the policy, set condition 'Sign-in risk level: High' and condition 'Locations: All trusted locations', and set 'Grant' to 'Block access'

C.Assign the user to the policy, set condition 'User risk level: High' and set 'Grant' to 'Require multi-factor authentication'

D.Create a risk detection policy in Identity Protection that triggers a user risk policy, and have Conditional Access use the risk policy

AnswerA

In a Conditional Access policy, conditions are combined with a logical AND, so this configuration triggers only when Identity Protection has computed the user's account risk as High and the sign-in originates from a location that is not on the trusted list. The Grant control is set to Block access, which denies the authentication session outright rather than allowing it with additional challenges. Because user risk is a cumulative account-level signal, pairing it with the trusted-location exception precisely targets high-risk users signing in from untrusted networks while leaving trusted-network activity unaffected.

Why this answer

It combines the 'User risk level: High' condition (triggered by Identity Protection's user risk detection) with the 'Locations: All locations except trusted' condition, and sets 'Grant' to 'Block access'. This ensures that only sign-ins from untrusted locations are blocked when the user's risk is high, meeting the requirement to allow sign-ins from trusted IPs even for high-risk users.

Exam trap

The trap here is confusing 'User risk level' (associated with the user account's overall risk) with 'Sign-in risk level' (associated with a specific authentication attempt), leading candidates to incorrectly choose Option B which uses sign-in risk and targets trusted locations.

How to eliminate wrong answers

Option B is wrong because it uses 'Sign-in risk level: High' instead of 'User risk level: High', and it targets 'All trusted locations' which would block sign-ins from trusted IPs, the opposite of the requirement. Option C is wrong because it sets 'Grant' to 'Require multi-factor authentication' instead of 'Block access', which does not block sign-ins but only prompts for MFA, failing the requirement to block sign-ins from untrusted locations. Option D is wrong because it describes creating a separate risk detection policy in Identity Protection; Conditional Access policies directly use user risk and sign-in risk conditions without needing an additional risk policy, and this approach adds unnecessary complexity without achieving the specific location-based block.

Full explanation →

141

MCQhard

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

A.Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

B.In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

C.In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.

D.Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

AnswerC

This is the correct approach because PIM supports emitting an Azure AD Conditional Access authentication context during role activation. When you enable 'Require Azure AD Conditional Access authentication context' in PIM settings, Azure AD sends that context as a signal to Conditional Access for the activation request. A separate Conditional Access policy can then target that authentication context and apply the 'Require device to be marked as compliant' grant control. This is the documented integration pattern for combining PIM with device-compliance policies, and it satisfies the requirement without relying on unsupported targets like the PIM app itself.

Why this answer

Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Exam trap

The trap here is that candidates often confuse applying a Conditional Access policy to the 'Azure AD Privileged Identity Management' cloud app (which controls access to the PIM portal) with enforcing conditions during the actual role activation process, which requires authentication context integration.

How to eliminate wrong answers

Option A is wrong because targeting the 'Azure AD Privileged Identity Management' cloud app in a Conditional Access policy applies the policy to the PIM service itself (e.g., accessing the PIM portal), not to the role activation process; it would not enforce device compliance during activation. Option B is wrong because enabling 'Require Multi-Factor Authentication on activation' only adds an MFA requirement, not a device compliance check; it does not address the device compliance requirement. Option D is wrong because Azure AD Identity Protection's user risk policy evaluates user risk and can require MFA or password change, but it cannot directly enforce device compliance; it is designed for risk-based remediation, not for role activation-specific device compliance.

Full explanation →

142

MCQmedium

A company has a hub-spoke network topology in Azure. The spoke virtual networks contain Azure virtual machines that need to access the internet. The security team requires that all outbound internet traffic from the spoke VMs passes through the Azure Firewall deployed in the hub virtual network for inspection and logging. Which configuration should be implemented to ensure this traffic is routed through the firewall?

A.Configure an Azure Load Balancer in the hub to distribute traffic from spokes to the firewall.

B.Create a user-defined route (UDR) in the spoke subnet with 0.0.0.0/0 pointing to the private IP of the Azure Firewall.

C.Use Azure Firewall Manager to automatically enforce a global default route on all spokes. This is the only configuration needed.

D.Enable IP forwarding on the NICs of the spoke VMs so they forward traffic to the firewall.

AnswerB

The UDR with default route pointing to the firewall's private IP ensures that all outbound internet traffic from the spoke VMs is forwarded to the firewall for inspection and logging.

Why this answer

A user-defined route (UDR) with the 0.0.0.0/0 prefix and the next hop set to the private IP address of the Azure Firewall forces all outbound internet traffic from the spoke subnet to be routed through the firewall in the hub. This ensures the traffic passes through the firewall for inspection and logging, as required by the security team.

Exam trap

The trap here is that candidates often confuse Azure Firewall Manager's ability to propagate routes in a virtual WAN with the need for explicit UDRs in a traditional hub-spoke topology using a hub virtual network, leading them to incorrectly select option C as a one-click solution.

How to eliminate wrong answers

Option A is wrong because an Azure Load Balancer distributes inbound traffic and does not route outbound traffic; it cannot force spoke VMs to send internet-bound traffic through the firewall. Option C is wrong because Azure Firewall Manager can enforce a default route via a virtual WAN secured hub, but in a hub-spoke topology using a hub virtual network (not a virtual WAN), a UDR must be explicitly configured on the spoke subnets; Firewall Manager alone does not automatically apply the route to all spokes in this topology. Option D is wrong because IP forwarding on the NICs of the spoke VMs is used to allow a VM to act as a router for traffic passing through it, not to direct outbound traffic from the same VM to a firewall; the spoke VMs are the source of the traffic, not intermediate routers.

Full explanation →

143

Multi-Selectmedium

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Select 2 answers

A.Enable Transparent Data Encryption (TDE)

B.Implement Azure Web Application Firewall (WAF)

C.Configure Azure SQL Database firewall rules

D.Use parameterized queries in application code

E.Enable Always Encrypted for sensitive columns

AnswersB, D

WAF can detect and block SQL injection patterns.

Why this answer

Azure Web Application Firewall (WAF) can inspect incoming HTTP/HTTPS traffic and block malicious payloads, including SQL injection attempts, before they reach the application or database. It provides a perimeter defense that filters out common attack patterns, reducing the attack surface for SQL injection.

Exam trap

The trap here is that candidates often confuse network-level controls (firewall rules) or encryption features (TDE, Always Encrypted) with application-layer defenses against SQL injection, leading them to select options that protect data confidentiality or access but do not prevent the injection attack itself.

Full explanation →

144

MCQmedium

A security operations team uses Microsoft Sentinel. They want to automatically assign incidents to different tiers of analysts based on severity when incidents are created. Which feature should they configure?

A.Fusion - Advanced Multistage Attack Detection

B.Analytics rules with scheduled queries

C.Automation rules

D.Playbooks

AnswerC

Automation rules allow you to automatically trigger actions like assigning an incident to a specific user or team, changing severity, adding tags, or running a playbook. This is the correct feature to automatically assign incidents based on severity.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on criteria such as severity. When an incident is created, the automation rule triggers and can set the owner (assignee) to a predefined user or group, enabling tiered assignment without manual intervention.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks, assuming playbooks are required for any automated action, but automation rules are the correct feature for simple, rule-based incident assignment without the overhead of a full Logic App workflow.

How to eliminate wrong answers

Option A is wrong because Fusion - Advanced Multistage Attack Detection is a correlation engine that detects multistage attacks by combining alerts, not a mechanism for incident assignment. Option B is wrong because analytics rules with scheduled queries generate alerts based on log queries, but they do not include incident assignment or ownership logic. Option D is wrong because playbooks are automated workflows (often using Azure Logic Apps) that can respond to incidents, but they are triggered by automation rules or analytics rules and are not the feature used to directly assign incidents to analysts.

Full explanation →

145

Multi-Selectmedium

You are securing an Azure Kubernetes Service (AKS) cluster. You need to restrict network traffic between pods and to external services using Azure network policies. Which three of the following options are valid considerations or steps? (Choose three.)

Select 3 answers

.Enable the Azure Network Policy Manager (Azure NPM) when creating the AKS cluster.

.Define Kubernetes NetworkPolicy objects that use selectors to allow or deny traffic between pods.

.Use Azure Firewall to enforce egress traffic rules for the AKS cluster.

.Configure an NSG directly on the AKS node subnet to filter pod-to-pod traffic.

.Set the AKS cluster to use Calico network policies instead of Azure NPM for better performance.

.Assign public IP addresses to each pod for direct internet access without a load balancer.

Why this answer

Azure Network Policy Manager (Azure NPM) is a required add-on for enforcing Kubernetes NetworkPolicy objects in an AKS cluster. It translates Kubernetes network policies into Azure-specific configurations to filter pod-to-pod traffic. Without enabling Azure NPM (or an alternative like Calico), standard Kubernetes NetworkPolicy objects will not be enforced by Azure.

Exam trap

The trap here is that candidates often confuse NSGs with Kubernetes network policies, thinking NSGs can filter pod-to-pod traffic, but NSGs operate at the subnet level and cannot see pod IPs, making them ineffective for pod-level segmentation.

Full explanation →

146

MCQmedium

A security operations team uses Microsoft Sentinel. They create a playbook that changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is detected within the incident's entities. The team wants this playbook to run automatically as soon as the incident is created, without manual intervention. Which type of automation rule trigger should they configure to invoke the playbook?

A.When incident is created

B.When incident is updated

C.When alert is created

D.On a time schedule

AnswerA

This trigger runs the automation rule immediately when a new incident is generated. The rule can check conditions and then run the playbook to change the severity.

Why this answer

The 'When incident is created' trigger in Microsoft Sentinel automation rules is designed to invoke a playbook immediately upon incident generation, without requiring any manual action. This matches the requirement for automatic execution as soon as the incident is created, allowing the playbook to evaluate entities and change severity from 'Medium' to 'High' based on the IOC detection.

Exam trap

The trap here is that candidates may confuse 'When alert is created' with incident creation, not realizing that incidents are higher-level constructs that can aggregate multiple alerts, and the playbook must run at the incident scope to change severity based on entities across all alerts.

How to eliminate wrong answers

Option B is wrong because 'When incident is updated' triggers only after an incident is modified (e.g., status change or comment), not at creation time, so it would not run automatically on the initial creation. Option C is wrong because 'When alert is created' triggers on alert generation, not incident creation; incidents can aggregate multiple alerts, and the playbook needs to run at the incident level, not per alert. Option D is wrong because 'On a time schedule' is a recurring trigger (e.g., every hour) that does not respond to real-time incident creation events, making it unsuitable for immediate automated response.

Full explanation →

147

MCQeasy

A company has an Azure virtual network with a subnet that hosts a web application. The security team wants to allow inbound HTTPS traffic (port 443) from the internet to the web servers, but block all other inbound traffic. They have a network security group (NSG) associated with the subnet. What is the minimal set of inbound rules required?

A.A rule allowing HTTPS from Internet, and a default deny all rule.

B.A rule allowing HTTPS from Internet, and no other rules (default deny all inbound).

C.A rule allowing HTTPS from Internet, and a rule explicitly denying all other inbound traffic.

D.A rule allowing HTTPS from any source, and a rule denying all other traffic with lower priority.

AnswerB

The default DenyAllInbound rule in every NSG already blocks all inbound traffic from the Internet, so adding only an inbound rule that allows HTTPS (TCP 443) from the Internet source service tag is sufficient. Because NSG rules are evaluated in priority order, HTTPS traffic matches the allow rule before reaching the default deny rule, while all other inbound traffic is implicitly denied. This is the minimal viable configuration because no additional deny rules are needed.

Why this answer

Network security groups (NSGs) in Azure have a default deny-all inbound rule (rule 65500) that is automatically applied to all inbound traffic. Therefore, you only need to add an explicit allow rule for HTTPS (port 443) from the Internet. No additional deny rule is required because the default rule already blocks all other inbound traffic.

Exam trap

The trap here is that candidates often think they must add an explicit deny rule to block all other traffic, not realizing that Azure NSGs already include a default deny-all inbound rule that is automatically applied at the lowest priority.

How to eliminate wrong answers

Option A is wrong because it suggests adding a default deny all rule, but Azure NSGs already include a built-in default deny all inbound rule (rule 65500) that cannot be removed or overridden by a lower-priority rule, making an explicit deny unnecessary. Option C is wrong because it proposes an explicit deny all inbound rule, which is redundant and not minimal; the default deny rule already handles this. Option D is wrong because it suggests a rule allowing HTTPS from 'any source' (which is functionally the same as from Internet) and a lower-priority deny rule, but the default deny rule already exists at the lowest priority, so an explicit deny rule is not needed and would be redundant.

Full explanation →

148

MCQeasy

A company has an Azure virtual network with a single subnet that hosts web servers. The security team needs to allow inbound HTTPS traffic from the internet to the web servers, but block all other inbound traffic. They want to use a single Azure resource to accomplish this at the subnet level. Which resource should they configure?

A.Azure Firewall

B.Azure Front Door

C.Network Security Group (NSG)

D.Application Security Group (ASG)

AnswerC

An NSG contains inbound and outbound security rules that can be associated with a subnet or a network interface. By creating an allow rule for HTTPS (TCP 443) from Internet and a default deny-all rule, the requirement is met efficiently.

Why this answer

A Network Security Group (NSG) is the correct resource because it can be associated with a subnet to filter inbound traffic at Layer 3/4. By creating a rule that allows TCP port 443 (HTTPS) from the Internet service tag and a default deny-all rule, the NSG blocks all other inbound traffic while permitting HTTPS. This meets the requirement of a single Azure resource operating at the subnet level.

Exam trap

The trap here is that candidates often confuse Azure Firewall (a centralized, stateful service) with a simple subnet-level ACL, or they mistakenly think an Application Security Group can independently filter traffic, when in fact it only works as a source or destination in an NSG rule.

How to eliminate wrong answers

Option A is wrong because Azure Firewall is a managed, stateful firewall service that operates at the network and application layers (Layer 3-7) and is typically used for centralized traffic inspection, logging, and advanced filtering across multiple subnets or virtual networks; it is overkill and not the simplest single resource for a basic subnet-level ACL. Option B is wrong because Azure Front Door is a global, Layer 7 load balancer and application delivery controller that routes HTTP/HTTPS traffic based on the closest point of presence; it does not filter traffic at the subnet level and cannot block all other inbound traffic to the subnet. Option D is wrong because an Application Security Group (ASG) is a logical grouping of virtual machines by application workload, used in conjunction with NSG rules to simplify rule management; it is not a standalone filtering resource and cannot be directly associated with a subnet to enforce inbound traffic rules.

Full explanation →

149

MCQhard

A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?

A.The route table is not associated with the spoke subnet.

B.Azure Firewall is not configured with DNAT rules for outbound traffic.

C.The spoke VNet peering does not allow gateway transit.

D.The route table has a higher priority than system routes.

AnswerA

A route table only takes effect when it is explicitly associated with a subnet. In this hub-spoke topology, the spoke subnet still has the default system routes, so traffic destined for the internet follows the default route and bypasses Azure Firewall. You must associate the custom route table—with a UDR that uses the firewall's private IP as the next hop and next hop type 'VirtualAppliance'—to the spoke subnet for forced tunneling to work.

Why this answer

The most likely reason is that the route table containing the default route (0.0.0.0/0) pointing to the Azure Firewall private IP has not been associated with the spoke subnet. Without this association, the subnet continues to use system routes, which include a default route to the internet via the Azure default gateway, allowing traffic to bypass the firewall. Associating the route table with the subnet is a required step to override the system default route.

Exam trap

The trap here is that candidates often assume creating a route table with the correct route is sufficient, forgetting that the route table must be explicitly associated with the subnet to take effect.

How to eliminate wrong answers

Option B is wrong because DNAT rules are used for inbound traffic (destination network address translation), not for controlling outbound traffic routing; outbound traffic through Azure Firewall is handled by forced tunneling via the route table, not DNAT. Option C is wrong because gateway transit is a setting for VPN/ExpressRoute gateway sharing in VNet peering, not for directing outbound internet traffic through a firewall in a hub; the spoke VNet does not need gateway transit to use a user-defined route pointing to the firewall's private IP. Option D is wrong because user-defined routes (UDRs) always have a higher priority than system routes by default; the issue is not priority but the lack of association of the route table to the subnet.

Full explanation →

150

MCQmedium

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

A.Configure a device registration policy

B.Configure a Conditional Access policy that requires that the device be marked as compliant

C.Configure an Identity Protection policy for user risk

D.Configure a Conditional Access policy that requires multi-factor authentication

AnswerB

This enforces device compliance for access to sensitive data.

Why this answer

A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.

Exam trap

The trap here is that candidates often confuse requiring MFA (Option D) with requiring device compliance, but MFA only verifies the user, not the device's security posture, which is the core requirement in this scenario.

How to eliminate wrong answers

Option A is wrong because a device registration policy only controls whether devices can be registered or joined to Entra ID, not whether they are compliant or can access sensitive data. Option C is wrong because an Identity Protection policy for user risk focuses on user sign-in risk (e.g., leaked credentials, anonymous IP) and does not evaluate device compliance status. Option D is wrong because a Conditional Access policy requiring multi-factor authentication strengthens authentication but does not enforce device compliance; an unmanaged device could still access data after MFA.

Full explanation →

Microsoft Azure Security Engineer Associate AZ-500 (AZ-500) — Questions 76–150