You save $69.98
A cloud security team finds the following condition: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle. What is the BEST next technical control?
Configure a customer-managed encryption key from Key Vault or managed HSM and grant the storage service its required key access. This is the most direct response to: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle. The security mechanism is: Customer-managed keys for Azure Storage depend on the key service and managed identity authorized for encryption operations. Expected verification: Key usage and rotation work through the approved identity while storage remains accessible under supported conditions.
Plan a supported private AKS cluster and private DNS or authorized network paths for administrators. This is a valid action in another context: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane.
Select a supported identity-based authentication mode and configure share-level roles and file ACLs. This is a valid action in another context: An Azure Files share uses SMB but the organization requires on-premises identity integration and per-user permissions.
Configure supported AKS authentication integration and appropriate Kubernetes RBAC role bindings for the identity. This is a valid action in another context: A Kubernetes administrator can list deployment status through Entra authentication but cannot update resource objects as expected.
A security design review describes: A Conditional Access policy is created for administrators but left in report-only mode while the team assumes its grant controls are enforced. Which unresolved failure risk is MOST relevant?
Mistaking report-only evaluation for an active access block can leave risky sessions permitted. The current case is: A Conditional Access policy is created for administrators but left in report-only mode while the team assumes its grant controls are enforced. The risk follows because: Conditional Access report-only mode evaluates outcomes without enforcing the grant and session controls. The appropriate mitigative action is: Review the policy state and evaluate report-only sign-in results before deliberately enabling enforcement for the intended scope.
Confusing an app registration with service principal instances can leave access gaps or stale trust assumptions. This hazard concerns another scenario: An administrator deletes an app registration but expects the existing enterprise application in another tenant to retain all delegated grants indefinitely.
Uncoordinated client credential replacement can break non-interactive workloads or preserve exposed secrets. This hazard concerns another scenario: An app owner changes an application's secret but dependent jobs continue authenticating with the retired credential.
Treating eligible access in one resource scope as tenant-wide access can lead to failed tasks or an excessive workaround. This hazard concerns another scenario: A security operator is granted PIM eligibility to an Azure role but the role never appears when viewing another subscription.
A security design review describes: A Sentinel incident is automatically assigned to the wrong response team because an automation rule uses a stale resource-group label. Which unresolved failure risk is MOST relevant?
Incorrect automation conditions can route critical incidents away from the analysts able to resolve them. The current case is: A Sentinel incident is automatically assigned to the wrong response team because an automation rule uses a stale resource-group label. The risk follows because: Sentinel automation rule actions depend on the accuracy and stability of their configured conditions. The appropriate mitigative action is: Use reliable incident attributes or entity context to scope the assignment rule and test its conditions.
Trigger-type incompatibility can make an apparently configured automation chain fail to run. This hazard concerns another scenario: An incident playbook is built with an alert trigger, but its automation rule invokes the playbook for newly created incidents.
Without suitable deletion and purge safeguards, a privileged error or attack can destroy key material needed for data recovery. This hazard concerns another scenario: A Key Vault is configured without purge protection and the security team worries a privileged deletion could destroy critical recovery material.
Recreating certificate material ad hoc can lose private key continuity or produce mismatched configurations. This hazard concerns another scenario: An important TLS certificate is deleted from Key Vault but the team attempts to recreate it from memory instead of restoring its stored object.
An Azure security engineer investigates: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated. Which action most directly addresses this requirement?
Define global security admin rules with the correct behavior and test downstream NSG processing where appropriate. This is the most direct response to: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated. The security mechanism is: Azure Virtual Network Manager security admin rules apply centrally with actions that determine later NSG evaluation. Expected verification: Traffic tests and effective policy show admin-level enforcement while applicable NSG rules retain their role.
Check plan and regional VNet integration support and select a supported hosting configuration. This is a valid action in another context: A Function app needs outbound connectivity to a private Azure SQL endpoint but its current hosting plan lacks the required networking capability.
Evaluate the applicable Azure DDoS Protection coverage and service configuration alongside HTTP-level WAF controls. This is a valid action in another context: A regional web application is overwhelmed by volumetric traffic and an engineer assumes WAF request rules alone prevent all network-layer attacks.
Revoke or replace the affected authentication credential and validate the point-to-site gateway authorization method. This is a valid action in another context: Remote users connect to Azure via point-to-site VPN, but a legacy certificate remains accepted after an employee departure.
An operational security assessment discovers: A compliance analyst sees a failed PCI control in Defender for Cloud and assumes that an external auditor has already declared the organization noncompliant. Which hazard best describes the gap?
A cloud security dashboard alone cannot establish complete legal or external audit compliance. The current case is: A compliance analyst sees a failed PCI control in Defender for Cloud and assumes that an external auditor has already declared the organization noncompliant. The risk follows because: Defender for Cloud regulatory compliance views map technical assessments to standards without replacing independent audit. The appropriate mitigative action is: Review the underlying regulatory compliance assessments and distinguish automated technical findings from full audit evidence.
Default benchmarks do not automatically include every organization-specific security obligation. This hazard concerns another scenario: An Azure enterprise needs a custom organizational cloud security requirement that is absent from its default compliance benchmark.
Manually noticing periodic recommendations can delay risk ownership and remediation during high event volume. This hazard concerns another scenario: A Defender for Cloud recommendation should open a ticket automatically after a resource becomes noncompliant, but no automation exists.
Updating a base template alone may not fix machines already deployed from that template. This hazard concerns another scenario: A machine assessment reports vulnerabilities from an old VM image, but the team closes the finding without updating the running instance.
A security implementation review identifies: An Application Gateway WAF policy starts in detection mode, but administrators assume identified attack patterns are already blocked. Which remediation is most defensible?
Review WAF mode and rule exclusions, validate detections, then enable prevention under approved change control. This is the most direct response to: An Application Gateway WAF policy starts in detection mode, but administrators assume identified attack patterns are already blocked. The security mechanism is: WAF policy modes distinguish observing suspicious traffic from actively denying matching requests. Expected verification: Controlled malicious requests are rejected in prevention mode and logged with the matched rule IDs.
Configure a valid approved custom domain certificate and supported TLS security settings for the gateway. This is a valid action in another context: A company publishes an API through API Management but a developer uses an untrusted self-signed public-facing certificate.
Choose the supported internal load balancer configuration and scope VNet and NSG boundaries accordingly. This is a valid action in another context: An App Service Environment is configured for isolated applications, but the team leaves a public ingress design despite a private-only requirement.
Compare compatible IKE/IPsec parameters, shared keys and gateway connection status across both endpoints. This is a valid action in another context: A hybrid site-to-site VPN tunnel reports intermittent outages after the on-premises firewall rotates the IKE policy.
The response is: Use Defender for Cloud recommendations and inventory filters to resolve each finding to the actual resource. Given the original problem: A subscription shows many security recommendations but engineers cannot find which virtual machines are affected. Which design principle is most applicable?
Defender for Cloud inventory links discovered resources to recommendations and security state. This principle explains why the control addresses: A subscription shows many security recommendations but engineers cannot find which virtual machines are affected. The recommended action is: Use Defender for Cloud recommendations and inventory filters to resolve each finding to the actual resource. Observable evidence: The team has a list of impacted VMs, their recommendations and accountable remediation owners.
Azure resource inventory queries support governance by correlating live resource properties across authorized scopes. This mechanism is associated with a different case: A cloud governance team cannot identify unowned public IP addresses because resource inventories are stored in manually maintained spreadsheets.
Defender CSPM correlation and graph tools can connect configuration findings with cloud resource relationships. This mechanism is associated with a different case: A security team wants to investigate whether sensitive database resources are exposed through network paths to the internet.
Azure Policy assignments associate policy definitions or initiatives with evaluation scope and enforcement settings. This mechanism is associated with a different case: An Azure administrator wants to prevent new publicly accessible storage accounts but only creates an Azure Policy definition without an assignment.
The approved security action is: Coordinate version use, secret references and application refresh behavior before revoking the old version. It addresses: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version. Which observation BEST proves the outcome?
Authorized applications retrieve the current version and operate without relying on a disabled obsolete value. This observation demonstrates that the control meets the case: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version. It validates the intended result of: Coordinate version use, secret references and application refresh behavior before revoking the old version.
The investigation query links representative source events accurately and excludes unrelated matches. That would be evidence for the separate situation: A security engineer writes a KQL join across two large Sentinel tables but ignores event timestamps and resource identity.
The app reads the required secret while prohibited management or deletion operations are denied. That would be evidence for the separate situation: An application identity needs to read a Key Vault secret but the developer assigns a broad vault administrator role.
Defender findings and independent Kubernetes access tests confirm both monitoring and preventive controls. That would be evidence for the separate situation: A security team onboards Defender for Containers but assumes the plan automatically replaces all Kubernetes network and RBAC hardening.
After the team performs: Revoke or replace the affected authentication credential and validate the point-to-site gateway authorization method. the original issue remains: Remote users connect to Azure via point-to-site VPN, but a legacy certificate remains accepted after an employee departure. What evidence should confirm success?
The retired user credential fails to authenticate, and approved users continue establishing secure VPN sessions. This observation demonstrates that the control meets the case: Remote users connect to Azure via point-to-site VPN, but a legacy certificate remains accepted after an employee departure. It validates the intended result of: Revoke or replace the affected authentication credential and validate the point-to-site gateway authorization method.
Authorized spoke workloads resolve and connect to the private endpoint while unrelated networks are blocked. That would be evidence for the separate situation: An application needs private access to a PaaS service through a central hub, but the owner creates a Private Endpoint only in an isolated VNet.
Traffic on the required path is protected by the approved encryption mechanism independently of ExpressRoute private routing. That would be evidence for the separate situation: An organization buys an ExpressRoute circuit and assumes all private peering traffic is automatically encrypted end-to-end.
An in-network lookup returns the approved private IP and workload traffic reaches the service without public exposure. That would be evidence for the separate situation: An Azure Storage account allows only private access but its application still resolves the blob hostname to the public service endpoint.
An Azure security engineer investigates: An Azure Policy assignment covers only one subscription while the documented baseline is intended for every subscription in a management group. Which action most directly addresses this requirement?
Apply the initiative at the correct management group and verify inherited assignment and legitimate exclusions. This is the most direct response to: An Azure Policy assignment covers only one subscription while the documented baseline is intended for every subscription in a management group. The security mechanism is: Azure Policy assignments can inherit through the management-group hierarchy based on their assigned scope. Expected verification: Policy compliance data covers all intended descendant subscriptions without affecting unrelated management groups.
Create a scoped, time-limited exemption with justification, owner and review evidence under approved governance. This is a valid action in another context: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record.
Evaluate supported agentless machine scanning in the selected Defender for Servers or CSPM plan and scope. This is a valid action in another context: A security team wants vulnerability coverage of Azure virtual machines without deploying a traditional scanning agent on every host.
Use approved Defender External Attack Surface Management discovery to investigate exposed assets and confirm ownership. This is a valid action in another context: An Azure security team finds a risky internet-facing service that is not part of a managed subscription or cloud account inventory.
A cloud security team finds the following condition: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope. What is the BEST next technical control?
Check onboarding, plan, subscriptions and inventory filters before concluding the virtual machines are unmanaged. This is the most direct response to: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope. The security mechanism is: Defender for Cloud posture coverage depends on enabled scopes, connectors and asset discovery paths. Expected verification: Inventory and security findings consistently include the intended new VMs after configuration correction.
Use approved Azure Resource Graph or Defender for Cloud inventory queries to identify resources and ownership metadata. This is a valid action in another context: A cloud governance team cannot identify unowned public IP addresses because resource inventories are stored in manually maintained spreadsheets.
Use approved Defender External Attack Surface Management discovery to investigate exposed assets and confirm ownership. This is a valid action in another context: An Azure security team finds a risky internet-facing service that is not part of a managed subscription or cloud account inventory.
Scope the intended protection plans and validate feature readiness and operational ownership for each subscription. This is a valid action in another context: A Defender for Cloud plan change is approved for one subscription but is rolled out to every subscription without reviewing cost and service dependencies.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
