Scenario practice questions

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Trap 1: Geo-redundant backup storage

Does not extend retention period.

Trap 2: Point-in-Time Restore

PITR max retention is 35 days.

Trap 3: Active Geo-Replication

Used for read-scale, not backup retention.

A
Geo-redundant backup storage
Why wrong: Does not extend retention period.
B
Long-Term Retention (LTR)
LTR retains backups for up to 10 years.
C
Point-in-Time Restore
Why wrong: PITR max retention is 35 days.
D
Active Geo-Replication
Why wrong: Used for read-scale, not backup retention.

Question 2easymultiple choice

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

Trap 1: Enable Azure Security Center's just-in-time access for storage…

JIT is for management ports, not for storage account configuration.

Trap 2: Change the policy effect to 'Deny' to prevent creation of…

This would block new non-compliant accounts but not fix existing ones.

Trap 3: Ask the developer to manually enable HTTPS-only on the storage…

Not automated; the goal is automatic remediation.

A
Enable Azure Security Center's just-in-time access for storage accounts.
Why wrong: JIT is for management ports, not for storage account configuration.
B
Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.
Why wrong: This would block new non-compliant accounts but not fix existing ones.
C
Ask the developer to manually enable HTTPS-only on the storage account.
Why wrong: Not automated; the goal is automatic remediation.
D
Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.
This automatically remediates non-compliant accounts.

Question 3hardmultiple choice

A company uses Azure Security Center and Azure Sentinel. They want to prioritize remediation of vulnerabilities based on risk. Which metric should they use to rank vulnerabilities?

Trap 1: Common Vulnerability Scoring System (CVSS) score

CVSS is a factor but not the only one; Secure Score incorporates additional context.

Trap 2: Compliance status from Azure Policy

Compliance status indicates adherence to policy, not vulnerability severity.

Trap 3: Number of security alerts triggered

Alerts indicate incidents, not vulnerability risk.

A
Common Vulnerability Scoring System (CVSS) score
Why wrong: CVSS is a factor but not the only one; Secure Score incorporates additional context.
B
Azure Secure Score impact
Secure Score reflects the risk and remediation priority.
C
Compliance status from Azure Policy
Why wrong: Compliance status indicates adherence to policy, not vulnerability severity.
D
Number of security alerts triggered
Why wrong: Alerts indicate incidents, not vulnerability risk.

Question 4hardmultiple choice

A company uses Azure Policy to enforce compliance. They want to automatically remediate non-compliant resources by deploying a custom template. Which effect should they use in the policy definition?

Trap 1: Audit

Audit only logs compliance status.

Trap 2: Disabled

Disabled turns off the policy.

Trap 3: Deny

Deny prevents creation but does not fix existing resources.

A
DeployIfNotExists
DeployIfNotExists triggers deployment of a template when a resource is non-compliant.
B
Audit
Why wrong: Audit only logs compliance status.
C
Disabled
Why wrong: Disabled turns off the policy.
D
Deny
Why wrong: Deny prevents creation but does not fix existing resources.

Read the full NAT/PAT explanation →

Question 5hardmultiple choice

A company is designing a hybrid identity solution with Microsoft Entra ID. They need to ensure that users can access resources from unmanaged devices while maintaining security. The security team requires that all access from unmanaged devices must be limited to browser-only access to web apps and must block native client apps. Which conditional access grant control should you configure?

Trap 1: Require multi-factor authentication

MFA does not differentiate between managed and unmanaged devices.

Trap 2: Require approved client app

Approved client app allows native apps, not browser-only.

Trap 3: Require hybrid Azure AD joined device

Hybrid join is for domain-joined devices, not unmanaged.

A
Require multi-factor authentication
Why wrong: MFA does not differentiate between managed and unmanaged devices.
B
Require device to be marked as compliant
This grant control ensures only compliant devices (managed) get access; for unmanaged devices, you can combine with a session control to allow browser-only access.
C
Require approved client app
Why wrong: Approved client app allows native apps, not browser-only.
D
Require hybrid Azure AD joined device
Why wrong: Hybrid join is for domain-joined devices, not unmanaged.

Question 6mediummultiple choice

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

Trap 1: Use SMS-based authentication for all users

SMS is not passwordless; OATH tokens are an extra cost.

Trap 2: Implement Windows Hello for Business for all Windows devices

Smart cards are not practical for mobile devices; mobile devices need Authenticator.

Trap 3: Use the Microsoft Authenticator app for all users

Authenticator alone does not cover Windows Hello for Business for Windows devices.

A
Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.
Why wrong: SMS is not passwordless; OATH tokens are an extra cost.
B
Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.
Why wrong: Smart cards are not practical for mobile devices; mobile devices need Authenticator.
C
Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.
Comprehensive passwordless approach covering all device types.
D
Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.
Why wrong: Authenticator alone does not cover Windows Hello for Business for Windows devices.

Question 7easymultiple choice

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

Trap 1: Microsoft Identity Manager (MIM)

MIM is used for advanced identity management, not primarily for synchronization.

Trap 2: Microsoft Entra Connect Cloud Sync

Cloud Sync is for specific scenarios like merging multiple forests, but the standard sync tool is Entra Connect.

Trap 3: Active Directory Federation Services (AD FS)

AD FS provides federation, not directory synchronization.

A
Microsoft Identity Manager (MIM)
Why wrong: MIM is used for advanced identity management, not primarily for synchronization.
B
Microsoft Entra Connect
Microsoft Entra Connect is the primary tool for synchronizing on-premises AD to Entra ID.
C
Microsoft Entra Connect Cloud Sync
Why wrong: Cloud Sync is for specific scenarios like merging multiple forests, but the standard sync tool is Entra Connect.
D
Active Directory Federation Services (AD FS)
Why wrong: AD FS provides federation, not directory synchronization.

Question 8mediummultiple choice

Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?

Trap 1: Create a trainable classifier to detect credit cards

Classifier detects but does not automatically apply a label with encryption.

Trap 2: Create a default label policy for SharePoint

Default label applies to all documents, not based on content.

Trap 3: Create a manual sensitivity label that users apply

Manual labeling does not automatically apply.

A
Create a trainable classifier to detect credit cards
Why wrong: Classifier detects but does not automatically apply a label with encryption.
B
Create an auto-labeling policy that applies a label with encryption for external sharing
Automatically detects credit card numbers and applies encryption when shared externally.
C
Create a default label policy for SharePoint
Why wrong: Default label applies to all documents, not based on content.
D
Create a manual sensitivity label that users apply
Why wrong: Manual labeling does not automatically apply.

Question 9mediummultiple choice

Your organization uses Microsoft Defender for Cloud Apps. You need to identify users who are downloading large amounts of data from a sanctioned cloud app in a short period. What should you configure?

Trap 1: Create an app permission policy to block downloads.

App permission policies control OAuth app permissions, not user behavior.

Trap 2: Create an activity policy to monitor downloads.

Activity policies can monitor, but anomaly detection is better for unusual patterns.

Trap 3: Create a file policy to detect mass download.

File policies check metadata, not volume over time.

A
Create an anomaly detection policy for impossible travel or unusual activity.
Anomaly detection can detect unusual download patterns.
B
Create an app permission policy to block downloads.
Why wrong: App permission policies control OAuth app permissions, not user behavior.
C
Create an activity policy to monitor downloads.
Why wrong: Activity policies can monitor, but anomaly detection is better for unusual patterns.
D
Create a file policy to detect mass download.
Why wrong: File policies check metadata, not volume over time.

Question 10mediummulti select

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Trap 1: Intune app protection policy

App protection policies are for app-level data protection, not device access.

Trap 2: Conditional Access policy with 'Require multifactor authentication'

MFA is not specified in the requirements.

Trap 3: Intune device enrollment

Enrollment is a prerequisite but does not enforce access control.

A
Intune app protection policy
Why wrong: App protection policies are for app-level data protection, not device access.
B
Conditional Access policy with 'Require multifactor authentication'
Why wrong: MFA is not specified in the requirements.
C
Conditional Access policy with 'Require hybrid Azure AD joined device'
This ensures only hybrid Azure AD joined devices can access the application.
D
Intune device enrollment
Why wrong: Enrollment is a prerequisite but does not enforce access control.
E
Intune device compliance policy
Compliance policies define the security requirements for devices.

Question 11easymultiple choice

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

Trap 1: Data Loss Prevention (DLP) policies

DLP blocks sharing but does not detect exfiltration attempts from user actions.

Trap 2: eDiscovery (Premium)

eDiscovery is for legal discovery, not real-time detection.

Trap 3: Communication Compliance

Communication Compliance monitors communications, not data copying.

A
Data Loss Prevention (DLP) policies
Why wrong: DLP blocks sharing but does not detect exfiltration attempts from user actions.
B
eDiscovery (Premium)
Why wrong: eDiscovery is for legal discovery, not real-time detection.
C
Communication Compliance
Why wrong: Communication Compliance monitors communications, not data copying.
D
Insider Risk Management
Insider Risk Management identifies risks like data exfiltration to personal cloud storage.

Question 12hardmultiple choice

Your organization is planning to use Microsoft Entra ID for identity management. You need to design a solution that enforces conditional access policies for sensitive applications while minimizing user friction. The solution must support offline access for mobile devices and require step-up authentication only when accessing high-risk data. What should you recommend?

Trap 1: Implement Microsoft Entra ID Protection to automatically remediate…

Identity Protection requires online connectivity and does not address offline access.

Trap 2: Configure risk-based Conditional Access policies with user risk and…

Risk-based policies require online connectivity and do not natively support offline access.

Trap 3: Require device compliance via Intune and block non-compliant devices

Device compliance does not support offline access with step-up auth.

A
Implement Microsoft Entra ID Protection to automatically remediate risky users
Why wrong: Identity Protection requires online connectivity and does not address offline access.
B
Use Conditional Access session controls with app-enforced restrictions and grant controls for high-risk sign-ins
Session controls allow step-up authentication and support offline via app-based policies.
C
Configure risk-based Conditional Access policies with user risk and sign-in risk
Why wrong: Risk-based policies require online connectivity and do not natively support offline access.
D
Require device compliance via Intune and block non-compliant devices
Why wrong: Device compliance does not support offline access with step-up auth.

Question 13mediummulti select

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Trap 1: Configure data export to a storage account in a different region…

Exporting data to another region would violate data residency.

Trap 2: Use Azure Policy to audit workspace region for compliance.

Azure Policy can audit but does not enforce data residency at the storage level.

A
Disable cross-region replication in the Log Analytics workspace settings.
By default, workspaces do not replicate across regions, but disabling any built-in replication ensures data stays in the US.
B
Create the Log Analytics workspace in an Azure region in the United States (e.g., East US).
Sentinel data resides in the workspace region; selecting a US region ensures data stays in the US.
C
Configure data export to a storage account in a different region for redundancy.
Why wrong: Exporting data to another region would violate data residency.
D
Enable customer-managed keys (CMK) using Azure Key Vault in the same region.
CMK ensures data is encrypted with keys stored in the US, meeting compliance requirements.
E
Use Azure Policy to audit workspace region for compliance.
Why wrong: Azure Policy can audit but does not enforce data residency at the storage level.