CCNA Design security solutions for applications and data Questions

Option C is correct: Auto-labeling policies in Purview can automatically classify and apply labels based on sensitive information types. Option A is wrong: Trainable classifiers require training and are for more complex classification, not automatic for PII. Option B is wrong: Manual labeling is not automatic.

Option D is wrong: DLP policies are for enforcement, not automatic labeling.

Option A is correct because Microsoft Sentinel can trigger a playbook (automation rule) that runs an Azure Automation runbook to modify the NSG and isolate the VM. Option B is wrong because Log Analytics workspace doesn't have remediation actions. Option C is wrong because Azure Policy is for compliance, not incident response.

Option D is wrong because Defender for Cloud has some automation, but Sentinel playbook is the designed method for automated response.

Options A, C, and E are correct. Enforcing TLS 1.2 encrypts data in transit, managed identity for Azure Functions provides secretless authentication to Azure SQL, and Enforce minimum TLS version on Blob Storage ensures encrypted connections. Option B is wrong because firewall rules don't encrypt data.

Option D is wrong because CMK is for encryption at rest, not in transit.

Option A is correct because Microsoft Defender for Cloud can scan container images in ACR for vulnerabilities and integrate with GitHub Actions to fail the pipeline on critical findings. Option B is wrong because Azure Security Center is now part of Defender for Cloud. Option C is wrong because Azure Policy can enforce compliance but not scan images.

Option D is wrong because Azure Bastion is for secure remote access.

Using Azure Key Vault Provider for Secrets Store CSI Driver (Option A) allows pods to mount secrets from Key Vault. Enabling pod identity with managed identity (Option C) ensures that only authorized pods can access Key Vault. Option B is wrong because storing secrets in ConfigMaps is not secure.

Option D is wrong because Azure Disk Encryption does not apply to secrets. Option E is wrong because Network Policies control traffic, not secrets access.

Option A is correct because managed identities provide a secure, identity-based authentication for playbooks to access Azure SQL without storing credentials. Option B is wrong because firewall rules are network-level, not identity-based. Option C is wrong because data masking is for query results, not access control.

Option D is wrong because CMK is for encryption at rest, not access control.

Option B is correct because Authorization Code Flow is the recommended flow for web applications that have a backend server. Option A is wrong because Implicit Flow is deprecated for user sign-in. Option C is wrong because Client Credentials Flow is for server-to-server without user.

Option D is wrong because Device Code Flow is for input-constrained devices.

Option B is correct because the query filters EventID 4625 (failed logon) and groups by Account and Computer, then filters accounts with more than 10 failures in the last 7 days. Option A is wrong because it does not show success events. Option C is wrong because it does not group by IP address.

Option D is wrong because it does not include locked accounts.

A sensitive info type for credit card numbers (Option A) is needed to detect the data. A DLP policy (Option C) enforces the rule. A policy tip (Option E) notifies users about the policy.

Option B is wrong because retention labels are for retention, not prevention. Option D is wrong because auto-labeling applies labels, but DLP policies are needed to block sharing.

Option C is correct because a compliance policy in Intune defines device requirements like PIN and encryption. Option A is wrong because app protection policies target apps, not device-level settings. Option B is wrong because device configuration profiles can enforce settings but compliance policy is the standard way to require PIN and encryption for compliance.

Option D is wrong because Conditional Access policies control access based on compliance, not enforce settings directly.

Microsoft Defender for Cloud provides adaptive application controls, file integrity monitoring, and just-in-time access, but not specifically for detecting storage key usage from unexpected locations. Microsoft Defender for Storage (part of Defender for Cloud) provides anomaly detection, including unusual access patterns. You can also use Azure Monitor with alerts on storage metrics, but the most direct is Defender for Storage.

Option D is correct.

Option B is correct: Application Control (Windows Defender Application Control) allows you to specify which applications are allowed to run. Option A is wrong: Antimalware detects and removes malware but does not control which apps can run. Option C is wrong: Just-In-Time VM access controls network access, not application execution.

Option D is wrong: Azure Security Center (now Defender for Cloud) provides recommendations but not direct app control.

Option C is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types. Option A is wrong because trainable classifiers require training and are for more complex patterns. Option B is wrong because manual labeling is not automatic.

Option D is wrong because data loss prevention policies prevent sharing but do not apply labels.

Option C is correct because app protection policies (MAM) can prevent data transfer between managed and unmanaged apps. Option A is wrong because conditional access blocks access but does not control copy/paste. Option B is wrong because compliance policies enforce device health, not app-level data movement.

Option D is wrong because device configuration profiles set device settings, not app restrictions.

Option A is correct because Azure Web Application Firewall (WAF) with Application Gateway or Front Door protects against SQL injection and XSS. Option B is wrong because Network Security Groups (NSGs) filter network traffic, not application layer. Option C is wrong because Azure DDoS Protection protects against DDoS, not web attacks.

Option D is wrong because Azure Firewall is a network firewall, not a web application firewall.

Option B is correct because Microsoft Purview Data Map can scan Azure SQL Database and apply automatic classification using built-in classifiers. Option A is wrong because Microsoft Sentinel is for SIEM, not data classification. Option C is wrong because Microsoft Defender for Cloud is for security posture, not data classification.

Option D is wrong because Microsoft Entra ID is for identity.

Options A, D, and E are correct. Using secure variables, branch protection rules, and secret scanning are key security measures. Option B is wrong because disabling code review reduces security.

Option C is wrong because running pipelines with admin privileges increases risk.

Option B is correct because Session policies in Defender for Cloud Apps can monitor and control user sessions in real-time, including blocking downloads based on device tags. Option A is wrong because access policies control access but not session-level actions like downloads. Option C is wrong because app discovery policies are for discovering shadow IT.

Option D is wrong because anomaly detection policies detect unusual behavior, not block downloads.

Option B is correct because a sensitivity label with auto-labeling for files containing sensitive info types (like patient IDs) can apply encryption automatically. Option A is wrong because a retention label only manages retention, not encryption. Option C is wrong because a DLP policy alerts but does not automatically label.

Option D is wrong because a trainable classifier requires training and does not use a regex pattern.

Option A, Option B, and Option D are correct. A pod identity is needed to assign an identity to pods, Azure Key Vault stores secrets, and Azure AD pod-managed identity (or workload identity) provides the identity. Option C is incorrect because Azure Container Registry is for storing images, not identity.

Option E is incorrect because Azure Firewall is for network security.

Option D is correct because a sensitivity label with auto-labeling for content matching a sensitive information type (like credit card number) and encryption can be applied to SharePoint documents automatically. Option A is wrong because retention labels do not enforce encryption. Option B is wrong because trainable classifiers require custom training.

Option C is wrong because manual labeling is not automatic.

Option C is correct because DataPlaneRequests logs contain all data plane operations. Option A is wrong because QueryRuntimeStatistics logs query execution stats, not operations. Option B is wrong because MongoRequests logs MongoDB operations only.

Option D is wrong because PartitionKeyStatistics logs partition statistics.

Enabling Azure Defender for SQL at the subscription level (Option A) automatically enables threat detection for all SQL databases. Option C is correct because Defender for Cloud can enable Microsoft Defender for SQL as a plan. Option B is wrong because enabling individual audit policies is not necessary for threat detection.

Option D is wrong because Advanced Threat Protection is part of the Azure SQL security settings, but the plan is enabled at the subscription level. Option E is wrong because vulnerability assessment is a separate feature.

Option D is correct because it meets all requirements: HTTPS only enforced, Microsoft Entra ID authentication for the web app, and managed identity for the API to access SQL Database. Option A is wrong because client certificates do not provide user-level authentication. Option B is wrong because the API should use managed identity, not connection strings.

Option C is wrong because SQL authentication is less secure and does not use managed identity.

Options A, C, and D are correct. WAF protects against many OWASP threats, input validation prevents injection, and CSP mitigates XSS. Option B is wrong because RBAC manages access, not application layer attacks.

Option E is wrong because MFA is an identity control.

The Microsoft Entra ID connector (Option B) is the correct data source for ingesting sign-in logs and audit logs from Entra ID. Option A is wrong because the Office 365 connector ingests data from Exchange, SharePoint, etc. Option C is wrong because the Azure Activity connector ingests subscription-level events.

Option D is wrong because the Microsoft Defender XDR connector ingests alerts from Defender products.

Option C is correct because the policy only blocks based on user risk level, but if the user risk is not evaluated or the policy is not in report-only mode, it may not enforce. However, the exhibit shows the policy is enabled, but if the user risk level is not being calculated in real-time (e.g., due to licensing), it may not trigger. Option A is wrong because locations include all.

Option B is wrong because client app types include all. Option D is wrong because the policy is enabled.

Option D is correct because vulnerability assessment baselines define acceptable scan results for specific rules, so that future scans do not report the same findings as vulnerabilities. Option A is wrong because baselines do not fix vulnerabilities. Option B is wrong because the baseline is for a specific database, not all databases.

Option C is wrong because baselines are not about performance.

Option A and Option D are correct. Managed identities allow the App Service to authenticate to other Azure services without credentials. Private endpoints provide network isolation.

Option B is wrong because connection strings with access keys negate the use of managed identities. Option C is wrong because service endpoints are less secure than private endpoints and do not provide the same level of isolation. Option E is wrong because SAS tokens are not recommended when managed identities are available.

Option B is correct because auto-labeling in Microsoft Purview can apply sensitivity labels that enforce encryption based on sensitive data patterns. Option A is wrong because DLP policies can block or warn but not automatically encrypt. Option C is wrong because retention labels manage lifecycle.

Option D is wrong because IRM can protect but requires manual application or DLP integration, not automatic labeling.

Option C is correct because it covers encryption in transit (TLS 1.2), encryption at rest (TDE and Always Encrypted), and access control with managed identities and firewall rules. Option A is wrong because TLS 1.0 is outdated and not PCI DSS compliant. Option B is wrong because Azure SQL Database does not support BYOK for TDE natively without Key Vault integration.

Option D is wrong because application-level encryption alone does not meet compliance requirements for data at rest.

Option A is correct because Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option B is wrong because Defender for Cloud recommendations are not enforced automatically. Option C is wrong because Azure Blueprints are deprecated.

Option D is wrong because RBAC does not enforce resource configuration.

Option C is correct because Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel uses playbooks to automate remediation actions like blocking IPs on Azure Firewall. Option A is wrong because analytics rules only generate alerts. Option B is wrong because workbooks visualize data.

Option D is wrong because UEBA analyzes behavior but does not automate remediation.

Option D is correct because the alert has a user risk level of 'high', which indicates a compromised account. Option A is wrong because risk event types are 'unfamiliarFeatures' and 'atypicalTravel', not 'leakedCredentials'. Option B is wrong because the sign-in risk level is 'medium', not 'high'.

Option C is wrong because the user risk level is 'high', not 'medium'.

Option A is correct because a DLP policy can detect sensitive info types and block the email. Option B is wrong because sensitivity labels are for classification, not blocking. Option C is wrong because retention labels are for data retention.

Option D is wrong because mail flow rules (transport rules) can do similar but DLP is the recommended approach.

Azure SQL Database audit logs contain query details; Azure Activity Logs provide resource management events; Network security group flow logs show network traffic patterns. Option A, Option B, and Option C are correct. Option D is wrong because Azure AD sign-in logs are for user authentication, not database operations.

Option E is wrong because Microsoft Defender for Cloud alerts may cover threats but not raw data exfiltration details.

Using a managed identity, the connection string can be set to use 'Authentication=Active Directory Managed Identity' without any username or password. Option A is wrong because the connection string should not include credentials. Option B is wrong because Key Vault references are used for secrets, but managed identity itself avoids the need for a secret.

Option D is wrong because connection strings are not stored in App Service as secrets.

Option D is correct because you can connect Azure Activity Logs as a data connector in Microsoft Sentinel. Option A is wrong because Log Analytics workspace is the underlying storage, but the connection is made via data connectors. Option B is wrong because Azure Policy can enforce configuration but not directly ingest logs.

Option C is wrong because Azure Monitor is a broader service; the specific connector is needed.

Option B is correct. The policy assignment has enforcementMode set to 'Default', which means it will audit and enforce the policy (e.g., mark non-compliant resources). If enforcementMode were 'DoNotEnforce', it would only audit.

Option A is wrong because enforcementMode is not set to DoNotEnforce. Option C is wrong because the policy does not automatically enable TDE; it only audits. Option D is wrong because the scope is a resource group, not an entire management group.

Microsoft Purview Data Map provides auto-discovery and classification of data assets, and Sensitivity labels can apply protection. Option A and Option C are correct. Option B is wrong because DLP policies are for endpoint and Microsoft 365, not for Azure Blob.

Option D is wrong because Information Barriers are for restricting communication, not classification. Option E is wrong because Azure Policy is for governance, not data classification.

Option A is correct: Transparent Data Encryption (TDE) encrypts data at rest. Option C is correct: Always Encrypted protects data in transit and during processing by keeping encryption keys client-side, preventing administrators from seeing plaintext. Option B is wrong: Azure Information Protection is for labeling and classification, not database encryption.

Option D is wrong: Dynamic Data Masking obfuscates data but does not encrypt it. Option E is wrong: Azure Key Vault is used to store keys but is not the encryption mechanism itself.

Option A and D are correct. Option A: Vulnerability assessment is included in the Defender for SQL plan. Option D: Advanced Threat Protection (ATP) is included.

Option B: Azure SQL Database always encrypts data at rest with TDE by default, but it is not a specific feature of the Defender plan. Option C: Information Protection is a Microsoft Purview feature, not Defender for Cloud. Option E: Azure Policy is a separate governance tool.

Option B is correct because Azure Policy can audit and enforce compliance at scale. Option A is wrong because while Defender for Cloud can detect the issue, it does not automatically enforce. Option C is wrong because Azure Blueprints is deprecated; Azure Policy is the correct tool.

Option D is wrong because RBAC controls permissions, not configuration.

Option A is correct because Microsoft Purview Data Map scans and classifies data across sources. Option B is wrong because Data Catalog is the inventory, not scanning. Option C is wrong because Data Sharing is for sharing data.

Option D is wrong because Data Estate Insights provides monitoring, not scanning.

Option C is correct because Entitlement management with connected organizations allows external users to be provisioned and deprovisioned automatically based on lifecycle. Option A is wrong because B2B direct federation does not enforce deprovisioning. Option B is wrong because self-service sign-up does not manage deprovisioning.

Option D is wrong because Identity Governance includes access reviews but does not automatically deprovision.

Option B is correct because Microsoft Purview Data Map with automatic classification scanning can scan data sources and apply sensitivity labels based on built-in or custom data types. Option A is wrong because Information Protection is for labeling and protection in Microsoft 365, not for scanning data sources. Option C is wrong because DLP policies are for preventing data loss, not for automatic classification.

Option D is wrong because Audit is for logging activities.

Option C is correct because an access policy in Defender for Cloud Apps can enforce real-time controls like blocking downloads based on sensitivity labels. Option A is wrong because session policy controls user sessions but does not natively block downloads by label. Option B is wrong because app discovery policy discovers shadow IT, not controls access.

Option D is wrong because anomaly detection policy detects unusual behavior but does not block downloads.

Options A and D are correct. Sensitivity labels with encryption prevent unauthorized sharing, and Data Loss Prevention (DLP) policies detect and block sharing of sensitive data. Option B is wrong because message encryption protects at rest/in transit but doesn't prevent sharing.

Option C is wrong because retention labels manage data lifecycle, not sharing. Option E is wrong because Privileged Access Management controls administrative access, not end-user sharing.

Option C is correct because Entra ID Application Proxy is designed for secure remote access to on-premises applications without a VPN, and it supports conditional access policies for the loan origination application. Option A is wrong because Azure Front Door is a global load balancer and CDN, not a secure remote access solution. Option B is wrong because Azure VPN Gateway creates site-to-site VPN, not per-user remote access.

Option D is wrong because Microsoft Entra Domain Services provides domain services but not remote application access.

Option B is correct because an access policy in Defender for Cloud Apps can automatically block a user based on risk score. Option A is wrong because session policies control real-time monitoring, not blocking. Option C is wrong because app governance policies manage consent and permissions.

Option D is wrong because Conditional Access app control is for session-level controls.

Option C is correct because the policy denies the creation of a virtual machine if the networkProfile.networkInterfaces field does not exist, meaning no NIC is attached. Option A is wrong because it denies creation, not deletes. Option B is wrong because it checks for NIC existence, not specific settings.

Option D is wrong because it checks at creation time.

Option C is correct because the SQL Server's Defender for Cloud settings include an option to enable Advanced Threat Protection for all databases and configure email notifications. Option A is wrong because Azure Policy can enforce settings but doesn't configure notifications directly. Option B is wrong because Microsoft Sentinel setup is not required for this.

Option D is wrong because enabling at the database level is less efficient and doesn't cover new databases.

Options B and C are correct because Azure App Service authentication can be configured to use Azure AD, and Conditional Access policies can enforce MFA and IP restrictions. Option A is wrong because app registration is part of the setup but not a direct component for access control. Option D is wrong because network security groups are for virtual networks, not App Service.

Option E is wrong because Azure Firewall is for network traffic, not user authentication.

Option D is correct because the role includes dataActions for read, but Azure SQL Database uses SQL authentication or Azure AD authentication; RBAC dataActions are only effective if the user authenticates via Azure AD and the database is configured to support Azure AD authentication. Option A is wrong because the role includes Microsoft.Sql/servers/databases/read action. Option B is wrong because dataActions are present.

Option C is wrong because assignableScopes includes the subscription.

Option A is correct because Microsoft Entra entitlement management allows you to create access packages that grant external users read-only access to SharePoint Online or other resources. Option B is wrong because Azure AD B2C is for customer identity. Option C is wrong because Microsoft Purview Information Protection is for classification and labeling, not for external sharing with read-only access.

Option D is wrong because Azure DevOps is for development collaboration.

Option B is correct because the policy denies creation when networkAcls.defaultAction is not 'Deny'. Option A is wrong because the policy denies, not audits. Option C is wrong because the policy does not modify the resource.

Option D is wrong because the policy explicitly denies.

Option B is correct because Microsoft Defender for Cloud (formerly Azure Security Center) can scan container images in Azure Container Registry for vulnerabilities. Option A is wrong because Azure Policy can enforce compliance but not scan images. Option C is wrong because Azure Key Vault is for secrets.

Option D is wrong because Azure Monitor is for monitoring, not scanning.

Options A, B, and E are required. JIT requires a VM with a network security group (NSG), enabling JIT in Defender for Cloud, and assigning permissions to request access. Option C is wrong because an Azure Bastion host is optional.

Option D is wrong because a Log Analytics workspace is not required.

Option B is correct because 'publicAccess': 'None' ensures no anonymous access, and Azure AD authentication is the default for authorized identities. Option A is wrong because the configuration is correct. Option C is wrong because container-level access is not a separate setting.

Option D is wrong because RBAC is already the default for authorized identities; no additional action needed.

Option A is correct because Power BI row-level security (RLS) can filter data based on user roles, but to mask specific columns, you need dynamic data masking in Azure SQL Database. Option B is wrong because sensitivity labels do not mask data. Option C is wrong because Azure SQL Database auditing logs access, does not mask.

Option D is wrong because Microsoft Purview scans data, does not mask.

Option C is correct because Azure Web Application Firewall (WAF) on APIM protects against OWASP top 10 threats, OAuth 2.0 with Entra ID provides authentication and authorization, and Azure Monitor and Log Analytics provide logging and monitoring. Option A is wrong because NSGs do not protect against application-layer attacks. Option B is wrong because IP whitelisting does not handle authentication/authorization.

Option D is wrong because Application Gateway WAF is redundant if APIM WAF is used, and IP whitelisting is not suitable.

Option B is correct because AKS Secret Store CSI Driver allows mounting secrets from Key Vault into specific pods using pod identity, ensuring only authorized pods can access secrets. Option A is wrong because RBAC on the Key Vault itself is too coarse. Option C is wrong because Azure Policy for AKS can enforce compliance but doesn't manage secret access.

Option D is wrong because managed identity is used for pod identity but needs the CSI driver to mount secrets.

Option C is correct because the authorization code flow with PKCE is the recommended grant for SPAs. Option A is wrong because implicit flow is deprecated due to security concerns. Option B is wrong because client credentials is for server-to-server, not user authentication.

Option D is wrong because resource owner password credentials (ROPC) is not recommended and requires user credentials.

Options A and D are correct. DLP policies can block sharing and show a policy tip to users. Option B is wrong because auto-labeling is a separate feature (auto-labeling policies).

Option C is wrong because DLP policies do not quarantine items. Option E is wrong because encryption is applied via sensitivity labels, not DLP directly.

Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to supply your own encryption keys and rotate them on your own schedule. Option A is wrong because Azure Disk Encryption is for VM disks, not Blob Storage. Option B is wrong because Azure Storage Service Encryption with Microsoft-managed keys does not allow customer control or rotation.

Option D is wrong because Azure Information Protection is for classification and labeling, not encryption at rest.

Option D is correct because Azure Storage with SAS tokens provides time-limited access, encryption at rest (SSE), and encryption in transit (HTTPS). Option A is wrong because Azure File Sync focuses on syncing files, not secure sharing. Option B is wrong because Azure Data Share is more for periodic snapshots, not direct access.

Option C is wrong because SFTP requires more administrative overhead for user management.

Option B is correct because the script uses Get-AzResource which returns resources from all resource groups, but the lock creation uses -ResourceGroupName parameter. If a resource is in a different resource group than the one resolved from the resource object, the lock might fail or apply incorrectly. Option A is wrong because the script does not check for existing locks correctly, but the main issue is the resource group mismatch.

Option C is wrong because the script checks for locks before creating new ones. Option D is wrong because tag inheritance is not the issue.

Option C is correct because Microsoft Purview has built-in scan rules for sensitive data types and can auto-label. Option A is wrong because Azure Policy is for compliance, not scanning. Option B is wrong because Microsoft Defender for Cloud is for security posture.

Option D is wrong because custom Power Automate flows are not the primary method for classification.

Option C is correct: Azure Key Vault with managed identities for AKS allows secure secret retrieval without storing credentials in code or configuration, integrates with Entra ID, and minimizes overhead. Option A is wrong: Kubernetes Secrets are not encrypted by default and require additional configuration. Option B is wrong: Azure App Configuration can store configuration but is not optimized for secrets.

Option D is wrong: HashiCorp Vault adds complexity and is not a native Azure service.

Option B is correct because Key Vault automatic rotation with Event Grid notifications allows the application to be notified before expiration and rotate seamlessly. Option A is wrong because manual rotation requires intervention. Option C is wrong because soft-delete only protects against accidental deletion.

Option D is wrong because RBAC controls access, not rotation.

Option A and D are correct. Option A: Azure WAF protects against common web attacks like SQL injection and XSS. Option D: Azure SQL Database always encrypts data at rest with TDE, and enforcing TLS ensures encryption in transit.

Option B is wrong because DDoS Protection is for network-layer attacks, not application-layer. Option C is wrong because Network Security Groups (NSGs) are for network traffic filtering, not for encrypting data in transit.