Select Two (Multi-Select) Questions

Enable container soft delete with a retention period of 30 days

Why wrong: Container soft delete only protects the container resource itself, not the blobs inside it. If a blob is deleted while the container remains intact—the most likely scenario for accidental deletion of a single financial file—container soft delete does nothing because it only triggers when the entire container is removed. Moreover, it does not handle overwritten blobs or storage account deletion, so relying on it alone leaves the sensitive records exposed to both data corruption and account loss.

Enable blob versioning

Why wrong: Blob versioning keeps a history of each blob's contents as it is overwritten, enabling rollback to a previous version after an unintended modification. However, versioning does not capture deletions: a deleted blob is not turned into a version unless blob soft delete is also enabled, so the destroyed file would be unrecoverable. It also offers no protection against the storage account being deleted, because versions live inside the account and vanish with it.

Implement Always Encrypted for the PII columns.

Why wrong: Always Encrypted is a client-side encryption feature where the database engine operates on ciphertext but never has the keys; it requires client driver support and can break legacy applications that don't support the feature. It cannot satisfy a server-level encrypt-in-transit requirement because it doesn't control the TLS handshake or connection security. Moreover, it limits queryability (e.g., equality checks only) and is not a substitute for forcing all connections to use TLS 1.2.

Apply Azure Information Protection labels to the database.

Why wrong: Azure Information Protection (AIP) is an information-protection solution that applies classification labels and optional usage restrictions to documents/emails, not to an Azure SQL Database at rest or in transit. It does not change the database's connection security settings, nor does it mask or encrypt T-SQL result-set values. Enabling AIP labels on a database is not a supported mechanism to enforce TLS or protect PII within SQL tables; it merely adds metadata.

Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.

Why wrong: Assigning the 'Kubernetes cluster should be accessible only through private endpoint' policy enforces network-level isolation of the API server, which is a compliance and security control, but it does not activate any Defender for Cloud monitoring. Defender for Containers can operate on a cluster with public or private endpoints; the plan must be enabled independently. Therefore, this action is not a prerequisite and would not satisfy the requirement to protect the AKS cluster with Defender for Containers.

Connect the AKS cluster to Azure Arc.

Why wrong: Connecting the AKS cluster to Azure Arc is intended for managing Kubernetes clusters running outside Azure by projecting them as Azure resources. An AKS cluster is already a first-class Azure resource, so Azure Arc does not apply and does not influence Defender for Cloud. Enabling Defender for Containers is a subscription-level plan activation, not a hybrid-management task, making this step irrelevant for the scenario.

Install the Log Analytics agent on each AKS node.

Why wrong: The Log Analytics agent (OMS agent) on each node is a legacy approach for collecting VM performance and syslog data; it is not the mechanism used by Defender for Containers. Defender for Containers instead uses Kubernetes audit logs and a dedicated host/control-plane data collection pipeline, including Azure Policy for Kubernetes, to detect threats. Installing the Log Analytics agent is therefore both unnecessary and insufficient for this plan.

Azure Bastion

Why wrong: Incorrect. Azure Bastion provides secure RDP/SSH access to VMs without exposing them to the internet, but it does not filter general inbound traffic.

Azure Front Door

Why wrong: Incorrect. Azure Front Door is a global load balancer and application delivery controller; it can filter traffic based on WAF policies but is not primarily designed to filter all inbound internet traffic to a virtual network.

VPN gateway

Why wrong: Incorrect. VPN gateway handles encrypted traffic between on-premises and Azure, not general inbound internet traffic filtering.

Automatically remediate non-compliant resources.

Why wrong: Remediation is via policy, not the dashboard.

Configure continuous export of compliance data.

Why wrong: Continuous export is a separate configuration.

Integrate with third-party GRC tools directly from the dashboard.

Why wrong: Integration is not directly from the dashboard.

Enable Transparent Data Encryption (TDE)

Why wrong: TDE encrypts data at rest, does not prevent SQL injection.

Configure Azure SQL Database firewall rules

Why wrong: Firewall rules control network access, not application-level injection.

Enable Always Encrypted for sensitive columns

Why wrong: Always Encrypted encrypts data, does not prevent injection.

Directly modify the affected Azure resource's configuration from the alert.

Why wrong: Alerts do not allow direct resource modification; they can trigger playbooks that modify resources.

Export alerts to a third-party SIEM using continuous export.

Why wrong: Alerts can be exported, but continuous export is for raw data, not alerts directly.

Change the severity of an alert after it is generated.

Why wrong: Alert severity is predefined by the detection logic and cannot be changed.

Azure Firewall logs

Why wrong: Firewall logs only capture traffic passing through the firewall.

VNet flow logs

Why wrong: There is no such feature; NSG flow logs are used.

Disable soft delete permanently

Why wrong: This does not meet the stated requirement as directly as the correct option.

Store secrets as plain text tags

Why wrong: This does not meet the stated requirement as directly as the correct option.

Soft-delete and resource locks

Why wrong: Incorrect. While soft-delete is necessary, resource locks on the Key Vault do not prevent purging of soft-deleted keys. Purging is an operation on the key resource, not on the vault itself.

Purge protection and access policies

Why wrong: Incorrect. Purge protection alone without soft-delete would not allow recovery; access policies control permissions, not deletion recovery or purge prevention.

Soft-delete and backup

Why wrong: Incorrect. Soft-delete alone allows recovery but does not prevent purging; backup does not prevent purging or provide the same recovery guarantee.

Azure Load Balancer

Why wrong: Azure Load Balancer is layer 4 (TCP/UDP), not layer 7.

Azure Traffic Manager

Why wrong: Traffic Manager is DNS-based load balancing, not a proxy; it does not terminate HTTP traffic.

Azure VPN Gateway

Why wrong: VPN Gateway is for encrypted tunnels, not load balancing.

Enable service endpoints for the Cosmos DB account

Why wrong: Incorrect. Service endpoints allow access from selected subnets but do not enforce TLS version or restrict to same region.

Disable public network access

Why wrong: Incorrect. Disabling public network access is a prerequisite for private endpoints but does not alone enforce TLS 1.2 or regional access.

Configure firewall rules to allow only Azure services

Why wrong: Incorrect. Firewall rules to allow only Azure services do not enforce TLS version or regional restriction.

Deploy each tier in a separate VNet

Why wrong: Possible but overkill; subnets within a VNet are sufficient.

Use VNet peering to connect the tiers

Why wrong: Peering is for connecting separate VNets, not for isolation within a VNet.

Place all VMs in the same subnet

Why wrong: Same subnet allows unrestricted traffic.

Configure an NSG directly on the AKS node subnet to filter pod-to-pod traffic.

Why wrong: An NSG applied directly to the AKS node subnet filters traffic at the VM NIC and subnet level, not at the ephemeral pod IP level. Pods in AKS are allocated IP addresses from the subnet, but NSG rules cannot distinguish individual pod IPs or pod labels—they only see the node's IP. Consequently, NSGs cannot enforce layer-7-aware or label-based pod-to-pod security policies, and arbitrary NSG rules can also interfere with Azure's essential platform traffic, making NetworkPolicy the only valid approach for pod-level filtering.

Set the AKS cluster to use Calico network policies instead of Azure NPM for better performance.

Why wrong: Calico is a legitimate alternative for enforcing Kubernetes NetworkPolicy, but the claim that it offers better performance than Azure NPM is not universally true. Azure NPM is specifically optimized for the Azure CNI plugin and leverages ipset to handle large-scale rule sets efficiently; Calico's performance depends on its mode (e.g., iptables vs. eBPF) and may introduce additional operational overhead as a third-party component. The choice between NPM and Calico should be based on feature requirements (like policy-spec extensions) and operational support, not a blanket performance advantage.

Assign public IP addresses to each pod for direct internet access without a load balancer.

Why wrong: Assigning a public IP address to each pod is not feasible or secure because pod IPs are ephemeral and scale dynamically with replicas and node churn, creating massive public IP demand and exposure. AKS pods communicate over private IPs by default; external inbound traffic is handled through a Service with a LoadBalancer or an Ingress controller, while egress is achieved via SNAT (node NAT) or Azure Firewall. Giving each pod a public IP also bypasses centralized network security controls like NAT rules and DDoS protection, directly exposing container workloads to the internet.

Configure federation with AD FS.

Why wrong: Federation does not affect password sync frequency.

Enable password writeback in Microsoft Entra Connect.

Why wrong: Incorrect. Password writeback synchronizes password changes from the cloud to on-premises, not to the cloud. It does not help with syncing to the cloud.

Enable Azure AD Connect Health to monitor synchronization.

Why wrong: Monitoring does not change sync frequency.

Configure pass-through authentication for user sign-ins.

Why wrong: Pass-through authentication does not synchronize passwords.

DM-Crypt

Why wrong: DM-Crypt is for Linux VMs.

Microsoft Entra ID (Azure AD)

Why wrong: Entra ID is for authentication, not encryption.

Use Azure Lighthouse to connect Defender XDR to Sentinel

Why wrong: Azure Lighthouse is for managing multiple tenants.

Deploy a playbook that polls Defender XDR APIs

Why wrong: Playbooks are for response, not integration.

Create a custom log analytics workspace query

Why wrong: Custom queries do not integrate with Defender XDR.

Workbooks

Why wrong: Workbooks provide visualizations, not automated responses.

Watchlists

Why wrong: Watchlists are collections of data for correlation, not for automated response.

Hunting queries

Why wrong: Hunting queries are used for proactive threat hunting, not automated responses.

Vulnerability scanning of containers

Why wrong: Vulnerability scanning is a workload protection feature.

Threat detection for VMs

Why wrong: Threat detection is part of workload protection, not CSPM.

The Microsoft Monitoring Agent installed on all endpoints

Why wrong: Incorrect: Not required for Microsoft 365 Defender integration.

An Azure Sentinel workspace in the same region as the Microsoft 365 tenant

Why wrong: Incorrect: No region requirement.