You save $69.98
An Azure security engineer investigates: A cryptographic signing service uses a Key Vault key whose expiration is near, but the team has no rotation schedule. Which action most directly addresses this requirement?
Configure the supported key rotation policy and test dependent consumers against a new key version. This is the most direct response to: A cryptographic signing service uses a Key Vault key whose expiration is near, but the team has no rotation schedule. The security mechanism is: Key Vault key rotation manages cryptographic key versions while applications must handle resulting lifecycle changes. Expected verification: The key version changes on schedule and the signing or decryption workflow continues as designed.
Configure supported Key Vault network access or Private Endpoint settings and the required application identity permissions. This is a valid action in another context: An Azure Key Vault is placed behind a firewall but its application still accesses a public endpoint without an approved network rule.
Configure a supported AWS environment connection with required trust roles and selected Defender coverage. This is a valid action in another context: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.
Review connector scope, project permissions and repository discovery to ensure new repositories are onboarded. This is a valid action in another context: A Defender DevOps Security connection includes an Azure DevOps project but ignores newly added repositories.
The approved security action is: Use the correct public-client authentication flow and keep any confidential credentials only in trusted server components. It addresses: A team registers a confidential client application but puts the client secret in a public single-page application bundle. Which observation BEST proves the outcome?
No secret appears in browser assets, and the application uses an approved secure sign-in flow. This observation demonstrates that the control meets the case: A team registers a confidential client application but puts the client secret in a public single-page application bundle. It validates the intended result of: Use the correct public-client authentication flow and keep any confidential credentials only in trusted server components.
A controlled sign-in from an unmanaged device is blocked while an authorized compliant device satisfies the policy. That would be evidence for the separate situation: An Azure portal administrative session on an unmanaged device should be blocked even if the user knows valid credentials.
The team manages only the approved application credentials, while tests confirm it cannot administer unrelated tenant identities. That would be evidence for the separate situation: An application team requests permanent Global Administrator privileges so it can rotate credentials for one registration.
Test tokens with user scopes and app-only roles receive exactly the operations explicitly allowed to each. That would be evidence for the separate situation: A custom API supports both user-level delegated access and daemon application calls, but its authorization code checks only the scope claim.
The recommended technical control is: Configure PIM activation requirements, including an appropriate MFA requirement and recorded business justification for the role. The triggering issue is: A privileged directory role is eligible in PIM but the user can activate it without an MFA check or justification. Which security principle BEST explains this decision?
PIM role settings define activation duration and security requirements independently of eligibility assignment. This principle explains why the control addresses: A privileged directory role is eligible in PIM but the user can activate it without an MFA check or justification. The recommended action is: Configure PIM activation requirements, including an appropriate MFA requirement and recorded business justification for the role. Observable evidence: A sample activation is blocked until approved verification is satisfied and produces auditable activation history.
Microsoft Entra access tokens commonly distinguish delegated scp claims from application-only roles claims. This mechanism is associated with a different case: A custom API supports both user-level delegated access and daemon application calls, but its authorization code checks only the scope claim.
Azure role-based access control combines a role definition with an assignment scope and inherits permissions down the resource hierarchy. This mechanism is associated with a different case: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group.
Microsoft Entra app registration platform settings constrain legitimate OAuth redirect locations. This mechanism is associated with a different case: A developer configures redirect URIs for a production application using a broad wildcard and an untrusted host.
An Azure engineer proposes: Create a scoped, time-limited exemption with justification, owner and review evidence under approved governance. In the case: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record. What underlying mechanism justifies the action?
Azure Policy exemptions document exceptions to assigned policy compliance at selected scopes. This principle explains why the control addresses: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record. The recommended action is: Create a scoped, time-limited exemption with justification, owner and review evidence under approved governance. Observable evidence: The exemption applies only to the affected resource and expires or is reviewed at the recorded date.
Key Vault RBAC roles differentiate secret use from key administration and vault management. This mechanism is associated with a different case: An application identity needs to read a Key Vault secret but the developer assigns a broad vault administrator role.
Defender for Cloud applies provider-appropriate default standards and supports additional selected benchmarks. This mechanism is associated with a different case: A compliance engineer chooses the wrong standard for an Azure scope because its displayed benchmark names differ between AWS and Azure.
Defender for Cloud posture coverage depends on enabled scopes, connectors and asset discovery paths. This mechanism is associated with a different case: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope.
An Azure security engineer investigates: An Azure Monitor data collection rule is defined for virtual machine security logs but nothing arrives in Log Analytics. Which action most directly addresses this requirement?
Associate the DCR with the intended supported machine resources and validate the data source and destination settings. This is the most direct response to: An Azure Monitor data collection rule is defined for virtual machine security logs but nothing arrives in Log Analytics. The security mechanism is: Azure Monitor data collection rules govern selected data sources, transformation and target destinations for supported agents. Expected verification: Current security events appear in the expected table with resource identity and appropriate timestamps.
Enable the appropriate Microsoft Defender for Servers plan at the authorized scope and validate supported protection components. This is a valid action in another context: A production Azure VM fleet appears in Defender for Cloud posture inventory but no server-specific runtime threat protection is enabled.
Scope the intended protection plans and validate feature readiness and operational ownership for each subscription. This is a valid action in another context: A Defender for Cloud plan change is approved for one subscription but is rolled out to every subscription without reviewing cost and service dependencies.
Configure an authorized Defender for Cloud workflow automation with a suitable Logic App or supported action. This is a valid action in another context: A Defender for Cloud recommendation should open a ticket automatically after a resource becomes noncompliant, but no automation exists.
An Azure engineer implements: Assign the appropriate application ownership or scoped application administrator rights instead of tenant-wide privileged administration. for this situation: An application team requests permanent Global Administrator privileges so it can rotate credentials for one registration. Which verification is most relevant?
The team manages only the approved application credentials, while tests confirm it cannot administer unrelated tenant identities. This observation demonstrates that the control meets the case: An application team requests permanent Global Administrator privileges so it can rotate credentials for one registration. It validates the intended result of: Assign the appropriate application ownership or scoped application administrator rights instead of tenant-wide privileged administration.
The enterprise app's effective permission grant is recorded and the approved API request succeeds without overbroad privileges. That would be evidence for the separate situation: A security engineer grants an application registration directory read permissions without obtaining the required administrator consent.
Each credential has an accountable owner and tested expiration path, with unused credentials removed. That would be evidence for the separate situation: A team creates multiple client secrets for one application without recording which service uses each credential.
A sample activation is blocked until approved verification is satisfied and produces auditable activation history. That would be evidence for the separate situation: A privileged directory role is eligible in PIM but the user can activate it without an MFA check or justification.
An Azure engineer implements: Review directory API permissions separately from Azure management role assignments and reduce excess app grants. for this situation: An application has broad Graph permissions and a developer assumes its Azure subscription Reader role limits which directory records it can retrieve. Which verification is most relevant?
The Graph token contains only authorized permissions, independently of the app's Azure resource RBAC scope. This observation demonstrates that the control meets the case: An application has broad Graph permissions and a developer assumes its Azure subscription Reader role limits which directory records it can retrieve. It validates the intended result of: Review directory API permissions separately from Azure management role assignments and reduce excess app grants.
The approved app receives only necessary permissions, and risky or unnecessary consent requests are rejected. That would be evidence for the separate situation: A third-party SaaS app requests tenant-wide consent for an unrelated set of privileged directory operations.
The team manages only the approved application credentials, while tests confirm it cannot administer unrelated tenant identities. That would be evidence for the separate situation: An application team requests permanent Global Administrator privileges so it can rotate credentials for one registration.
The exposed token is no longer usable and the incident review identifies all permitted resource scopes it could reach. That would be evidence for the separate situation: A developer stores an Azure management token in a shared build log, assuming the user's narrow role makes exposure harmless.
An operational security assessment discovers: An Azure Policy assignment covers only one subscription while the documented baseline is intended for every subscription in a management group. Which hazard best describes the gap?
A correctly written policy with incomplete assignment scope leaves unmanaged subscriptions outside governance. The current case is: An Azure Policy assignment covers only one subscription while the documented baseline is intended for every subscription in a management group. The risk follows because: Azure Policy assignments can inherit through the management-group hierarchy based on their assigned scope. The appropriate mitigative action is: Apply the initiative at the correct management group and verify inherited assignment and legitimate exclusions.
An expired or disabled active key version can break workloads that depend on it for protected operations. This hazard concerns another scenario: A cryptographic signing service uses a Key Vault key whose expiration is near, but the team has no rotation schedule.
Posture assessment and SQL advanced threat protection are separate capabilities that must be configured. This hazard concerns another scenario: An Azure SQL Database hosts sensitive records but the team enables only baseline vulnerability recommendations and assumes threat alerts are already active.
Overbroad incident automation can destroy response workflow visibility or incorrectly suppress active threats. This hazard concerns another scenario: A SOC automation rule should tag high-severity incidents but instead closes every incident before investigation.
The recommended technical control is: Review exemption rationale, approval, expiry and alternative controls before allowing the exception to remain. The triggering issue is: A Defender recommendation is marked exempt for a legacy system without a documented business owner or remediation plan. Which security principle BEST explains this decision?
Security recommendations and policy exemptions require risk acceptance governance beyond status suppression. This principle explains why the control addresses: A Defender recommendation is marked exempt for a legacy system without a documented business owner or remediation plan. The recommended action is: Review exemption rationale, approval, expiry and alternative controls before allowing the exception to remain. Observable evidence: The accepted exception is scoped and documented, and its residual risk receives periodic owner review.
Defender for Cloud multicloud connectors establish managed access to AWS resources for supported CSPM and protection capabilities. This mechanism is associated with a different case: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.
Microsoft Sentinel playbooks use Azure Logic Apps and require both invocation rights and destination authorization. This mechanism is associated with a different case: A Sentinel playbook successfully invokes a Logic App but cannot update an incident because its managed identity lacks rights.
Cloud threat response uses contextual investigation of alerts and resource activity before containment decisions. This mechanism is associated with a different case: Defender for Cloud reports a high-severity alert about suspicious outbound traffic, but responders close it without checking the affected resource or timeline.
The recommended technical control is: Review the appropriate PIM activation records, Azure activity logs and role assignment history for the incident window. The triggering issue is: An auditor requests evidence that a temporary privileged role was activated for a legitimate incident and then expired. Which security principle BEST explains this decision?
PIM activation histories and resource activity logs support audit of privileged identity use when properly retained. This principle explains why the control addresses: An auditor requests evidence that a temporary privileged role was activated for a legitimate incident and then expired. The recommended action is: Review the appropriate PIM activation records, Azure activity logs and role assignment history for the incident window. Observable evidence: The evidence associates the person, approved time window, scope, activation reason and subsequent expiration.
PIM supports eligible role assignments and just-in-time activation for supported Azure resource roles and directory roles. This mechanism is associated with a different case: An incident response team needs elevated Azure resource access only during approved investigations, but administrators have standing Owner access all week.
Public OAuth clients cannot securely retain shared secrets, unlike protected server-side confidential clients. This mechanism is associated with a different case: A team registers a confidential client application but puts the client secret in a public single-page application bundle.
OAuth delegated permissions act on behalf of a signed-in user, while application permissions allow app-only access. This mechanism is associated with a different case: A daemon service needs unattended access to a Microsoft Graph API but developers request a user-delegated permission requiring sign-in.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
