You save $69.98
A security implementation review identifies: AKS workloads from different teams share one cluster and require restricted pod-to-pod network communication. Which remediation is most defensible?
Implement the supported network-policy engine and explicit allow policies for required namespace traffic. This is the most direct response to: AKS workloads from different teams share one cluster and require restricted pod-to-pod network communication. The security mechanism is: AKS network policies can restrict pod ingress and egress traffic according to supported policy selectors. Expected verification: A test pod can reach approved services while prohibited cross-namespace connections fail.
Configure Microsoft Entra Workload ID or supported managed identity integration and least-privileged target permissions. This is a valid action in another context: An AKS pod uses a container image with embedded Azure client secrets to access a storage service.
Configure a customer-managed TDE protector in Key Vault with the necessary managed identity permissions. This is a valid action in another context: An Azure SQL database uses TDE but security policy requires control of the TDE protector key.
Replace shared account keys with appropriately restricted user delegation SAS or identity-based authorization where supported. This is a valid action in another context: A system distributes a storage account key to every contractor so they can upload one file each.
A cloud security team finds the following condition: An Azure security team finds a risky internet-facing service that is not part of a managed subscription or cloud account inventory. What is the BEST next technical control?
Use approved Defender External Attack Surface Management discovery to investigate exposed assets and confirm ownership. This is the most direct response to: An Azure security team finds a risky internet-facing service that is not part of a managed subscription or cloud account inventory. The security mechanism is: External Attack Surface Management helps discover exposed assets from an external viewpoint to complement internal inventory. Expected verification: An externally visible domain or service is attributed to an authorized business owner with actionable remediation.
Grant the playbook's identity the necessary scoped Sentinel or Logic App permissions and validate its trigger. This is a valid action in another context: A Sentinel playbook successfully invokes a Logic App but cannot update an incident because its managed identity lacks rights.
Assign the approved policy at the intended subscription or management group scope using a deny effect where supported. This is a valid action in another context: An Azure administrator wants to prevent new publicly accessible storage accounts but only creates an Azure Policy definition without an assignment.
Reconcile connected environment scopes, data freshness and resource identities before aggregating the dashboard. This is a valid action in another context: A security operations team needs a unified view of Azure and off-cloud resources but mistakenly treats each portal's inventory count as identical.
A security design review describes: A policy initiative groups several encryption and network requirements but the team assigns only one underlying definition. Which unresolved failure risk is MOST relevant?
Deploying only one definition can omit controls that stakeholders believed were part of the initiative. The current case is: A policy initiative groups several encryption and network requirements but the team assigns only one underlying definition. The risk follows because: Azure Policy initiatives package multiple policy definitions into a single assignable governance standard. The appropriate mitigative action is: Assign the intended policy initiative to the approved scope and evaluate each member control independently.
A backup system is not resilient to malicious administrators if its deletion controls are unrestricted. This hazard concerns another scenario: A Recovery Services vault permits the same operator who creates backups to disable protections and delete recovery points.
Filtering or coverage gaps can cause security responders to underestimate the actual cloud asset estate. This hazard concerns another scenario: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope.
Creating a DCR without correct associations or destinations does not guarantee telemetry ingestion. This hazard concerns another scenario: An Azure Monitor data collection rule is defined for virtual machine security logs but nothing arrives in Log Analytics.
The approved security action is: Prioritize remediation by exposure, sensitivity, attack paths and actual business risk rather than score increase alone. It addresses: A Defender secure score improves after low-impact controls are fixed, but high-exposure internet-facing resources remain unaddressed. Which observation BEST proves the outcome?
Critical exposed assets receive verified fixes and an evidence-based risk assessment reflects the improvement. This observation demonstrates that the control meets the case: A Defender secure score improves after low-impact controls are fixed, but high-exposure internet-facing resources remain unaddressed. It validates the intended result of: Prioritize remediation by exposure, sensitivity, attack paths and actual business risk rather than score increase alone.
The final inventory distinguishes compliance findings from whether runtime workload protection plans are enabled. That would be evidence for the separate situation: A manager assumes all resources are protected because Microsoft Cloud Security Benchmark checks report high compliance.
One investigation receives all required evidence without repeated identical incidents for the same event. That would be evidence for the separate situation: A Defender for Cloud alert is forwarded into Sentinel but the SOC cannot distinguish it from a duplicate alert created by a parallel custom connector.
Known controlled malware test objects produce the expected scan results and downstream quarantine workflow. That would be evidence for the separate situation: A Blob Storage account receives frequent uploads from external users but has no malware scanning controls configured.
An Azure security engineer investigates: A guest collaborator needs to view a single resource group's deployment state while internal employees have broader subscription rights. Which action most directly addresses this requirement?
Create a separately scoped least-privileged assignment for the guest instead of placing it in an administrator group. This is the most direct response to: A guest collaborator needs to view a single resource group's deployment state while internal employees have broader subscription rights. The security mechanism is: Guest identities can be assigned Azure RBAC roles at the scope required for their authorized work. Expected verification: The guest reads only the approved deployment data without inheriting internal employees' administrative permissions.
Assign the appropriate application ownership or scoped application administrator rights instead of tenant-wide privileged administration. This is a valid action in another context: An application team requests permanent Global Administrator privileges so it can rotate credentials for one registration.
Use the correct public-client authentication flow and keep any confidential credentials only in trusted server components. This is a valid action in another context: A team registers a confidential client application but puts the client secret in a public single-page application bundle.
Introduce a tested credential transition using a permitted overlap window and update all authorized consumers before revocation. This is a valid action in another context: An app owner changes an application's secret but dependent jobs continue authenticating with the retired credential.
The response is: Evaluate an eligible confidential VM SKU and supported guest attestation or confidential disk protections. Given the original problem: An Azure virtual machine holds confidential analytics code, but operators can access memory snapshots despite a requirement for hardware-protected processing. Which design principle is most applicable?
Azure confidential computing uses hardware-backed execution isolation to help protect data while in use. This principle explains why the control addresses: An Azure virtual machine holds confidential analytics code, but operators can access memory snapshots despite a requirement for hardware-protected processing. The recommended action is: Evaluate an eligible confidential VM SKU and supported guest attestation or confidential disk protections. Observable evidence: The workload runs on approved confidential hardware and security evidence confirms selected protections.
AKS network isolation must consider outbound routes and policy enforcement in addition to ingress controls. This mechanism is associated with a different case: A Kubernetes cluster uses one unrestricted outbound path for workloads with different compliance classifications.
Azure SQL supports Microsoft Entra authentication and database authorization separately from SQL logins. This mechanism is associated with a different case: A development team stores SQL authentication passwords in deployment files despite having Microsoft Entra identities for application services.
Storage and backup resilience require protecting the control plane and retained recovery content from destructive changes. This mechanism is associated with a different case: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval.
A security design review describes: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group. Which unresolved failure risk is MOST relevant?
Reader grants view access but not configuration writes; assigning a broad subscription role would expand privileges unnecessarily. The current case is: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group. The risk follows because: Azure role-based access control combines a role definition with an assignment scope and inherits permissions down the resource hierarchy. The appropriate mitigative action is: Identify the scope and assign the least-privileged built-in role that grants the required network operations rather than broad subscription Owner.
Embedding a long-lived app secret introduces rotation, exposure and credential custody risks. This hazard concerns another scenario: An Azure Function needs to read a Key Vault secret but developers propose embedding a long-lived client secret in application settings.
Assuming MFA success overrides all location, device or application restrictions can admit sessions that violate access policy. This hazard concerns another scenario: A user can complete MFA with a permitted authentication method but an administrator believes MFA alone establishes compliance for every sensitive cloud sign-in.
Listing a permission in app registration does not by itself mean consent was granted or usable by the app. This hazard concerns another scenario: A security engineer grants an application registration directory read permissions without obtaining the required administrator consent.
A security design review describes: A database owner enables security auditing but places its audit storage account in an unrestricted public container. Which unresolved failure risk is MOST relevant?
Public or mutable audit storage can expose sensitive SQL activity or permit evidence tampering. The current case is: A database owner enables security auditing but places its audit storage account in an unrestricted public container. The risk follows because: Database auditing is effective only when collected events are safeguarded in the destination service. The appropriate mitigative action is: Protect the audit destination with appropriate access, network controls and retention before relying on its records.
Uncontrolled pod egress can bypass intended service boundaries even when inbound policies are strict. This hazard concerns another scenario: A Kubernetes cluster uses one unrestricted outbound path for workloads with different compliance classifications.
Revoking a shared account key before consumer migration can cause broad service outages. This hazard concerns another scenario: A storage account's access key may have leaked into a support ticket while production apps still depend on both key slots.
Transparent Data Encryption does not replace control over who can reach the database endpoint. This hazard concerns another scenario: An Azure SQL server is public and a DBA tries to secure it solely by enabling Transparent Data Encryption.
The response is: Configure a supported AWS environment connection with required trust roles and selected Defender coverage. Given the original problem: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account. Which design principle is most applicable?
Defender for Cloud multicloud connectors establish managed access to AWS resources for supported CSPM and protection capabilities. This principle explains why the control addresses: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account. The recommended action is: Configure a supported AWS environment connection with required trust roles and selected Defender coverage. Observable evidence: Authorized AWS resources appear in Defender for Cloud inventory with current posture assessments.
Defender CSPM correlation and graph tools can connect configuration findings with cloud resource relationships. This mechanism is associated with a different case: A security team wants to investigate whether sensitive database resources are exposed through network paths to the internet.
SOAR automation should preserve approval gates and safety conditions for disruptive security actions. This mechanism is associated with a different case: A team adds a response playbook that disables a compromised identity automatically but has no approval or allowlist for privileged emergency accounts.
Key Vault access combines identity-based authorization with separately configured network restrictions. This mechanism is associated with a different case: An Azure Key Vault is placed behind a firewall but its application still accesses a public endpoint without an approved network rule.
A cloud security team finds the following condition: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring. What is the BEST next technical control?
Configure supported diagnostic settings, logging destinations and Defender coverage for the running container workload. This is the most direct response to: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring. The security mechanism is: Container security monitoring must preserve workload logs and relevant control-plane events across ephemeral lifecycles. Expected verification: Authorized responders receive relevant instance operation and security logs for the expected execution interval.
Configure Microsoft Entra Workload ID or supported managed identity integration and least-privileged target permissions. This is a valid action in another context: An AKS pod uses a container image with embedded Azure client secrets to access a storage service.
Configure Microsoft Entra authentication for Azure SQL and grant appropriate contained database users or roles. This is a valid action in another context: A development team stores SQL authentication passwords in deployment files despite having Microsoft Entra identities for application services.
Select a supported identity-based authentication mode and configure share-level roles and file ACLs. This is a valid action in another context: An Azure Files share uses SMB but the organization requires on-premises identity integration and per-user permissions.
An Azure engineer proposes: Combine Defender for Cloud resource inventory, exposure findings and supported attack-path or graph views. In the case: A security team wants to investigate whether sensitive database resources are exposed through network paths to the internet. What underlying mechanism justifies the action?
Defender CSPM correlation and graph tools can connect configuration findings with cloud resource relationships. This principle explains why the control addresses: A security team wants to investigate whether sensitive database resources are exposed through network paths to the internet. The recommended action is: Combine Defender for Cloud resource inventory, exposure findings and supported attack-path or graph views. Observable evidence: The assessment identifies actual vulnerable resources and the relevant network path requiring remediation.
Defender for Cloud applies provider-appropriate default standards and supports additional selected benchmarks. This mechanism is associated with a different case: A compliance engineer chooses the wrong standard for an Azure scope because its displayed benchmark names differ between AWS and Azure.
Defender DevOps integrations require controlled connector identity and repository or group permissions. This mechanism is associated with a different case: A team enables a GitLab integration but grants a long-lived unrestricted token without identifying required permissions.
Defender for Servers threat alerts require analyst investigation and contextual disposition rather than automatic trust. This mechanism is associated with a different case: A cloud workload protection alert is raised for suspicious PowerShell execution on an Azure server, but the owner closes it solely because the VM is production.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
