CCNA Design security solutions for infrastructure Questions

Multi-Selecteasy

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Select 2 answers

A.Microsoft Purview Audit.

B.Insider Risk Management.

C.Sensitivity labels and policies.

D.Microsoft Purview eDiscovery.

E.Data Loss Prevention (DLP) policies.

AnswersC, E

Labels classify and protect data with encryption and markings.

Why this answer

The correct answers are Sensitivity labels and policies (C) and Data Loss Prevention (DLP) policies (E). Sensitivity labels allow classification and protection of sensitive data at rest and in transit, while DLP policies help prevent unauthorized sharing of sensitive data. Option A (Audit) is incorrect because it only provides logging and monitoring, not direct data protection.

Option B (Insider Risk Management) is incorrect as it focuses on detecting risky user behavior but does not directly protect data. Option D (eDiscovery) is designed for legal discovery and does not protect data.

Practice this question →

Multi-Selecteasy

A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?

Select 2 answers

A.Use Azure Key Vault with Secrets Store CSI driver for secret management.

B.Apply Azure Policy to restrict container image sources.

C.Define Kubernetes network policies to restrict pod-to-pod traffic.

D.Enable Container insights for monitoring.

E.Enable Azure AD integration for the AKS cluster.

AnswersA, C

Azure Key Vault with the Secrets Store CSI driver securely injects secrets as mounted volumes, using the Kubernetes CSI interface. It stores secret material in Azure Key Vault—encrypted at rest with managed keys—while pods access it via managed identities or workload identity, eliminating the need to bake secrets into images, etcd, or environment variables. This provides robust secret management, including rotation and audit logging.

Why this answer

Correct answers: A and C. Network policies in Kubernetes can restrict pod-to-pod communication, and Azure Key Vault with CSI driver allows secrets to be encrypted and stored externally. Option B is incorrect: Azure Policy can enforce image source restrictions, but that does not address pod communication or secret encryption.

Option D is incorrect: Container insights is for monitoring, not for network restrictions or encryption. Option E is incorrect: Azure AD integration is for authentication, not for network or encryption.

Practice this question →

MCQmedium

Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?

A.Configure anti-spam policies and enable the Report Message add-in.

B.Configure Safe Links policies and enable the Report Message add-in for user reporting.

C.Configure Safe Attachments policies and enable the Report Message add-in.

D.Enable the Report Message add-in for Outlook and configure a mailbox for submissions.

AnswerB

Safe Links policies, part of Defender for Office 365, provide time-of-click protection by rewriting URLs to route through Microsoft's link-scanning service, blocking known malicious and newly detected phishing links. The Report Message add-in complements this by letting users flag unblocked suspicious links for analyst review, enabling detection and response improvements. Together they deliver both preventive blocking and user-driven feedback, which is the correct combined solution.

Why this answer

Safe Links protects users from clicking malicious links in real time, and the user reporting add-in allows reporting. Attack simulation training helps educate users but is not the primary protection mechanism. Option A is wrong because only the reporting add-in does not protect against links.

Option C is wrong because Safe Attachments protects attachments, not links. Option D is wrong because configuring a mailbox for submissions and enabling the Report Message add-in allows reporting but does not block malicious links; Safe Links is required for URL protection.

Practice this question →

Multi-Selectmedium

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Select 3 answers

A.Disable cross-region replication in the Log Analytics workspace settings.

B.Create the Log Analytics workspace in an Azure region in the United States (e.g., East US).

C.Configure data export to a storage account in a different region for redundancy.

D.Enable customer-managed keys (CMK) using Azure Key Vault in the same region.

E.Use Azure Policy to audit workspace region for compliance.

AnswersA, B, E

Correct. Disabling cross-region replication ensures data stays in the primary region, preventing replication to another region.

Why this answer

To ensure data residency within the United States, you must create the Log Analytics workspace in a US Azure region (Option B) and disable cross-region replication (Option A). Additionally, you should use Azure Policy to audit workspace region for compliance (Option E) to continuously monitor and enforce data residency requirements. Customer-managed keys (Option D) provide encryption control but are not strictly required for data residency.

Data export to a different region (Option C) would violate residency.

Practice this question →

Multi-Selecthard

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Select 3 answers

A.Conditional Access policies

B.Azure AD Application Proxy

C.Site-to-site VPN

D.Microsoft Intune device compliance policies

E.Microsoft Entra Internet Access (Microsoft Global Secure Access)

AnswersA, D, E

Conditional Access policies enforce real-time access decisions based on user, device, location, and risk signals before granting connectivity through Microsoft Entra Internet Access. This satisfies the stem’s requirement for a Zero Trust component by implementing the “explicitly verify” principle—each session is evaluated against policy rather than relying on implicit network trust.

Why this answer

Options A, D, and E are correct. Conditional Access policies enforce access controls based on user, device, and location signals. Microsoft Intune device compliance policies ensure devices meet security requirements before access.

Microsoft Entra Internet Access (formerly Microsoft Global Secure Access) is the core Zero Trust network gateway, providing secure internet and SaaS access. Option B (Azure AD Application Proxy, now Entra Application Proxy) is incorrect because it is designed for publishing legacy on-premises apps, not as a core component of Zero Trust network architecture. Option C (Site-to-site VPN) is incorrect as it represents traditional perimeter-based network access, which Zero Trust aims to replace.

Practice this question →

MCQhard

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

A.Microsoft Purview

B.Microsoft Intune

C.Microsoft Defender for Cloud Apps

D.Microsoft Sentinel

AnswerB

Correct. Microsoft Intune manages device compliance policies and integrates with Entra ID Conditional Access to enforce access based on device compliance and user risk.

Why this answer

Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management.

Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.

Practice this question →

Multi-Selecthard

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Select 3 answers

A.Privilege escalation attempts

B.Lateral movement paths using Pass-the-Hash

C.File integrity changes on domain controllers

D.Reconnaissance attacks using LDAP queries

E.Network traffic to external IP addresses

AnswersA, B, D

Defender for Identity monitors for privilege escalation.

Why this answer

Correct answers: A, B, D. Defender for Identity monitors privilege escalation attempts (A) by detecting suspicious changes in user privileges. Lateral movement paths using Pass-the-Hash (B) are detected by analyzing network activity and authentication patterns.

Reconnaissance attacks using LDAP queries (D) are identified by unusual LDAP search patterns. Option C is incorrect: file integrity changes on domain controllers are monitored by Defender for Servers or Azure Policy, not Defender for Identity. Option E is incorrect: network traffic to external IP addresses is monitored by Defender for Network or network security groups, not Defender for Identity.

Exam trap

A common trap is confusing file integrity monitoring with identity-based monitoring. Defender for Identity focuses on user behaviors and authentication patterns, not file changes.

Practice this question →

Multi-Selectmedium

Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)

Select 2 answers

A.Ensure that 'Auditing' is set to 'On' for SQL Database

B.Ensure that 'TDE' is enabled for SQL Server VMs

C.Audit SQL Server level audit setting

D.Ensure that 'Firewall and virtual network settings' for SQL Database are configured

E.Ensure secure transfer to storage accounts is enabled

AnswersA, D

This policy enables auditing for Azure SQL Database.

Why this answer

Enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.

Exam trap

The trap here is that candidates confuse SQL Server VM policies (like TDE or SQL Server-level audit settings) with Azure SQL Database policies, or they mistakenly apply storage account policies to SQL Database, which is a separate Azure service with its own security controls.

Practice this question →

MCQhard

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

A.Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

B.Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.

C.Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

D.Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.

AnswerB

Correct. Microsoft Entra application proxy publishes on-premises apps and supports passwordless authentication with low latency.

Why this answer

Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It allows users to authenticate using passwordless methods (e.g., Windows Hello, FIDO2, Microsoft Authenticator) and minimizes latency by proxying requests through Microsoft's infrastructure without requiring a VPN. Option A is incorrect because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing applications.

Option C is incorrect because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication and lacks the software-defined perimeter capabilities of Entra application proxy. Option D is incorrect because VPNs introduce latency and do not inherently support passwordless authentication.

Practice this question →

MCQmedium

Refer to the exhibit. The NSG is applied to a subnet containing Azure SQL databases. You notice that traffic from the internet to the databases is not being denied. What is the most likely reason?

A.The rule should be Allow to deny traffic

B.The destinationAddressPrefix should be '*' instead of 'VirtualNetwork'

C.The priority of the Deny rule is too low (100)

D.The direction should be Outbound

AnswerB

SQL databases are not in a VNet by default; use '*' to cover all destinations.

Why this answer

The Deny rule has destinationAddressPrefix set to 'VirtualNetwork', which only matches traffic destined to IPs within the virtual network. Azure SQL databases are PaaS services with public endpoints; internet traffic does not have a destination in the VNet, so the rule never applies. Changing destinationAddressPrefix to '*' would deny all inbound internet traffic.

Option A is incorrect because Allow rules cannot deny traffic. Option C is incorrect because priority 100 is high (lower number = higher priority), so the Deny rule would be evaluated before any lower priority Allow rules. Option D is incorrect because the direction must be Inbound to block incoming traffic.

Practice this question →

MCQhard

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

A.NAT rule

B.Application rule

C.Threat intelligence rule

D.Network rule

AnswerB

Correct. Application rules allow or deny outbound traffic based on FQDNs for HTTP/HTTPS, meeting the requirement.

Why this answer

Application rules in Azure Firewall allow filtering outbound traffic based on fully qualified domain names (FQDNs) for HTTP and HTTPS protocols. Option A is wrong because NAT rules only perform destination network address translation, not FQDN filtering. Option C is wrong because threat intelligence rules are used to block traffic from known malicious IP addresses, not for allowing FQDNs.

Option D is wrong because network rules filter traffic based on IP addresses, ports, and protocols, not FQDNs.

Practice this question →

MCQhard

You are designing a network security architecture for an Azure application that uses Azure Front Door and Azure Application Gateway. The application must be protected from DDoS attacks and common web exploits. Application traffic should be inspected by a web application firewall (WAF) before reaching the backend. What is the recommended deployment order?

A.Azure Front Door with WAF only, no Application Gateway.

B.Azure Front Door without WAF in front of Azure Application Gateway without WAF.

C.Azure Application Gateway with WAF in front of Azure Front Door.

D.Azure Front Door with WAF in front of Azure Application Gateway with WAF.

AnswerD

It places Azure Front Door with WAF at the edge for global DDoS protection and web application firewall, followed by Azure Application Gateway with WAF for regional WAF inspection before the backend. This layered approach provides comprehensive security.

Why this answer

The recommended deployment order is to place Azure Front Door with WAF at the edge, followed by Azure Application Gateway with WAF before the backend. This provides DDoS protection at the global level via Azure Front Door and regional web application firewall inspection via Application Gateway. Option A is incorrect because it lacks the regional WAF inspection.

Option B is incorrect because Azure Front Door without WAF provides no web application firewall protection. Option C is incorrect because Application Gateway with WAF should be behind Front Door for layered defense. Therefore, Option D is correct.

Practice this question →