You save $69.98
An operational security assessment discovers: A VM uses standard managed-disk encryption but the security design requires encryption of temporary disks and host-side caches. Which hazard best describes the gap?
Assuming default managed disk encryption necessarily protects all temporary host data can leave a requirement unmet. The current case is: A VM uses standard managed-disk encryption but the security design requires encryption of temporary disks and host-side caches. The risk follows because: Azure encryption at host extends encryption coverage to host-side disk processing paths for supported VMs. The appropriate mitigative action is: Evaluate and enable supported encryption at host for the eligible VM size and disk combination.
Enabling multiple incompatible encryption mechanisms can prevent VM provisioning or recovery. This hazard concerns another scenario: A team attempts to enable Azure Disk Encryption on a confidential VM using unsupported combinations of encryption features.
Unrestricted backup deletion rights can allow accidental or malicious destruction of recovery points. This hazard concerns another scenario: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval.
Revoking a shared account key before consumer migration can cause broad service outages. This hazard concerns another scenario: A storage account's access key may have leaked into a support ticket while production apps still depend on both key slots.
After the team performs: Use Azure Firewall Manager and governed Firewall Policies with correctly scoped rule collection groups. the original issue remains: A multi-subscription platform needs consistent firewall rules but each project team maintains independent copies. What evidence should confirm success?
Policy deployment and effective rules show intended common controls across managed firewalls. This observation demonstrates that the control meets the case: A multi-subscription platform needs consistent firewall rules but each project team maintains independent copies. It validates the intended result of: Use Azure Firewall Manager and governed Firewall Policies with correctly scoped rule collection groups.
Affected virtual networks match the approved inventory and no unplanned production network receives rules. That would be evidence for the separate situation: A Virtual Network Manager configuration targets the wrong network group and unexpectedly includes a sensitive production subnet.
A request succeeds only to expected trusted backend identities and fails for an invalid certificate chain. That would be evidence for the separate situation: A cloud API uses end-to-end HTTPS, but Application Gateway has no validation of the backend server certificate.
Only approved subnet-origin requests succeed under the service's network access rules. That would be evidence for the separate situation: A virtual network service endpoint is active for Azure Storage, but the storage account still permits traffic from every public source.
A cloud security team finds the following condition: A team creates multiple client secrets for one application without recording which service uses each credential. What is the BEST next technical control?
Inventory app credentials, map consumers, use least-privileged service identities where feasible and schedule safe revocation. This is the most direct response to: A team creates multiple client secrets for one application without recording which service uses each credential. The security mechanism is: Workload identity protection requires credential hygiene in addition to role and permission governance. Expected verification: Each credential has an accountable owner and tested expiration path, with unused credentials removed.
Target the relevant Azure management cloud application in Conditional Access and require a compliant or otherwise approved device condition. This is a valid action in another context: An Azure portal administrative session on an unmanaged device should be blocked even if the user knows valid credentials.
Register exact approved redirect URIs for the application platform and remove unnecessary callback locations. This is a valid action in another context: A developer configures redirect URIs for a production application using a broad wildcard and an untrusted host.
Review the policy state and evaluate report-only sign-in results before deliberately enabling enforcement for the intended scope. This is a valid action in another context: A Conditional Access policy is created for administrators but left in report-only mode while the team assumes its grant controls are enforced.
The approved security action is: Create a supported Private Link service on the provider side and control private endpoint connection approvals. It addresses: An internal customer hosts a privately exposed application behind a standard load balancer and wants other tenants to access it over Private Link. Which observation BEST proves the outcome?
An authorized consumer establishes a private endpoint connection to the provider service with the intended approval state. This observation demonstrates that the control meets the case: An internal customer hosts a privately exposed application behind a standard load balancer and wants other tenants to access it over Private Link. It validates the intended result of: Create a supported Private Link service on the provider side and control private endpoint connection approvals.
Only approved subnet-origin requests succeed under the service's network access rules. That would be evidence for the separate situation: A virtual network service endpoint is active for Azure Storage, but the storage account still permits traffic from every public source.
Traffic tests and effective policy show admin-level enforcement while applicable NSG rules retain their role. That would be evidence for the separate situation: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated.
The VPN establishes stable SAs and permitted private routes pass during representative connectivity tests. That would be evidence for the separate situation: A hybrid site-to-site VPN tunnel reports intermittent outages after the on-premises firewall rotates the IKE policy.
An Azure engineer implements: Enable a supported Microsoft Defender for Storage malware scanning configuration and route detections to the response process. for this situation: A Blob Storage account receives frequent uploads from external users but has no malware scanning controls configured. Which verification is most relevant?
Known controlled malware test objects produce the expected scan results and downstream quarantine workflow. This observation demonstrates that the control meets the case: A Blob Storage account receives frequent uploads from external users but has no malware scanning controls configured. It validates the intended result of: Enable a supported Microsoft Defender for Storage malware scanning configuration and route detections to the response process.
The team has a list of impacted VMs, their recommendations and accountable remediation owners. That would be evidence for the separate situation: A subscription shows many security recommendations but engineers cannot find which virtual machines are affected.
Eligible VMs show current agentless assessment results with expected resource identity and timestamps. That would be evidence for the separate situation: A security team wants vulnerability coverage of Azure virtual machines without deploying a traditional scanning agent on every host.
Representative login bursts produce one useful incident with the relevant accounts and hosts rather than uncontrolled duplicates. That would be evidence for the separate situation: A Sentinel detection query matches every failed login separately, generating hundreds of low-value incidents from one failed authentication burst.
A security design review describes: An AKS service account has cluster-admin privileges even though its workload only reads ConfigMaps in one namespace. Which unresolved failure risk is MOST relevant?
Cluster-admin service account privileges can enable lateral movement or control-plane compromise after pod intrusion. The current case is: An AKS service account has cluster-admin privileges even though its workload only reads ConfigMaps in one namespace. The risk follows because: Kubernetes RBAC roles and bindings should scope service account permissions to necessary API verbs and resources. The appropriate mitigative action is: Replace the broad ClusterRoleBinding with a narrowly scoped Role and RoleBinding for the actual namespace.
A healthy deployment state does not imply container images or host packages are free of known vulnerabilities. This hazard concerns another scenario: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.
Soft delete and versioning address different deletion and overwrite recovery scenarios. This hazard concerns another scenario: A Blob container has soft delete enabled, but accidental overwrites still destroy access to earlier versions needed for audit.
Ordinary access controls alone may permit privileged users to modify records that require WORM protection. This hazard concerns another scenario: A regulated archive requires that retained records cannot be changed before their approved retention period ends.
A cloud security team finds the following condition: Two peered virtual networks can reach each other, but the architect assumes peering is automatically transitive across a third network. What is the BEST next technical control?
Design explicit supported hub routing, gateway or virtual appliance transit rather than relying on transitive peering. This is the most direct response to: Two peered virtual networks can reach each other, but the architect assumes peering is automatically transitive across a third network. The security mechanism is: Virtual network peering provides connectivity between directly peered networks but not generic transit routing by itself. Expected verification: A path test confirms authorized communication across the intended hub path without accidental open transit.
Evaluate the applicable Azure DDoS Protection coverage and service configuration alongside HTTP-level WAF controls. This is a valid action in another context: A regional web application is overwhelmed by volumetric traffic and an engineer assumes WAF request rules alone prevent all network-layer attacks.
Validate Private Endpoint network-policy support, route specificity and the approved inspection architecture. This is a valid action in another context: An administrator tries to force all Private Link traffic through a centralized firewall without checking supported subnet network policies and effective routes.
Revoke or replace the affected authentication credential and validate the point-to-site gateway authorization method. This is a valid action in another context: Remote users connect to Azure via point-to-site VPN, but a legacy certificate remains accepted after an employee departure.
An Azure engineer implements: Inspect effective security rules at both the subnet and network interface and identify the highest-priority matching deny. for this situation: A subnet has NSG allow rules that seem correct, but connectivity to an application is still denied after a VM NIC NSG change. Which verification is most relevant?
The effective rule set and a targeted connectivity test explain the decision and show authorized traffic restored. This observation demonstrates that the control meets the case: A subnet has NSG allow rules that seem correct, but connectivity to an application is still denied after a VM NIC NSG change. It validates the intended result of: Inspect effective security rules at both the subnet and network interface and identify the highest-priority matching deny.
A path trace and firewall log show the matching connection traversing the intended inspection device. That would be evidence for the separate situation: An Azure Firewall is deployed but a workload egress connection bypasses it through an existing default route.
Effective routes show the intended firewall virtual appliance next hop for permitted destination prefixes. That would be evidence for the separate situation: A team creates a user-defined route sending egress traffic toward a firewall but sees the default system route still used for a workload subnet.
Policy deployment and effective rules show intended common controls across managed firewalls. That would be evidence for the separate situation: A multi-subscription platform needs consistent firewall rules but each project team maintains independent copies.
A security implementation review identifies: A Defender for Cloud plan change is approved for one subscription but is rolled out to every subscription without reviewing cost and service dependencies. Which remediation is most defensible?
Scope the intended protection plans and validate feature readiness and operational ownership for each subscription. This is the most direct response to: A Defender for Cloud plan change is approved for one subscription but is rolled out to every subscription without reviewing cost and service dependencies. The security mechanism is: Defender for Cloud plan enablement has subscription scope and workload-specific configuration requirements. Expected verification: Only authorized subscriptions show the selected Defender plans, expected protection state and assigned owners.
Configure the supported Defender DevOps Security connector with authorized GitHub organization and repository permissions. This is a valid action in another context: A GitHub repository contains infrastructure secrets but no Defender for Cloud DevOps Security connection exists for the organization.
Create an approved custom security standard and associate the intended policy definitions with the relevant scope. This is a valid action in another context: An Azure enterprise needs a custom organizational cloud security requirement that is absent from its default compliance benchmark.
Onboard the necessary Google Cloud organization or project scope using supported multicloud connector permissions. This is a valid action in another context: A hybrid environment includes several Google Cloud projects but only the Azure estate appears in Defender posture reporting.
The response is: Compare compatible IKE/IPsec parameters, shared keys and gateway connection status across both endpoints. Given the original problem: A hybrid site-to-site VPN tunnel reports intermittent outages after the on-premises firewall rotates the IKE policy. Which design principle is most applicable?
Azure VPN Gateway site-to-site connectivity depends on compatible IKE/IPsec negotiation and configured network prefixes. This principle explains why the control addresses: A hybrid site-to-site VPN tunnel reports intermittent outages after the on-premises firewall rotates the IKE policy. The recommended action is: Compare compatible IKE/IPsec parameters, shared keys and gateway connection status across both endpoints. Observable evidence: The VPN establishes stable SAs and permitted private routes pass during representative connectivity tests.
Private Link endpoint connections can require explicit approval by the target resource owner. This mechanism is associated with a different case: A storage Private Endpoint connection is pending approval, but developers expect it to accept traffic immediately.
Advanced Azure Firewall inspection features depend on selected service tier, policy and certificate configuration. This mechanism is associated with a different case: A security operations team sees threat indicators indicating malicious TLS traffic through Azure Firewall and assumes all tiers inspect encrypted payloads equally.
Virtual network peering provides connectivity between directly peered networks but not generic transit routing by itself. This mechanism is associated with a different case: Two peered virtual networks can reach each other, but the architect assumes peering is automatically transitive across a third network.
An Azure security engineer investigates: An application team asks whether enabling Defender for Storage can replace its container access control and immutability requirements. Which action most directly addresses this requirement?
Retain storage identity, network and retention controls while enabling appropriate threat protection and malware scanning. This is the most direct response to: An application team asks whether enabling Defender for Storage can replace its container access control and immutability requirements. The security mechanism is: Workload threat protection supplements Azure Storage preventive data-access and data-resilience controls. Expected verification: Tests confirm unauthorized storage access and deletion are denied while supported malicious activity triggers security findings.
Configure a supported AWS environment connection with required trust roles and selected Defender coverage. This is a valid action in another context: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.
Prioritize remediation by exposure, sensitivity, attack paths and actual business risk rather than score increase alone. This is a valid action in another context: A Defender secure score improves after low-impact controls are fixed, but high-exposure internet-facing resources remain unaddressed.
Check the device and extension or agentless feature status, inventory freshness and relevant security alerts. This is a valid action in another context: A new VM has the correct Defender for Servers plan at subscription level but security analysts never verify which machine-specific features became active.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
