You save $69.98
A cloud security team finds the following condition: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope. What is the BEST next technical control?
Check onboarding, plan, subscriptions and inventory filters before concluding the virtual machines are unmanaged. This is the most direct response to: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope. The security mechanism is: Defender for Cloud posture coverage depends on enabled scopes, connectors and asset discovery paths. Expected verification: Inventory and security findings consistently include the intended new VMs after configuration correction.
Use approved Azure Resource Graph or Defender for Cloud inventory queries to identify resources and ownership metadata. This is a valid action in another context: A cloud governance team cannot identify unowned public IP addresses because resource inventories are stored in manually maintained spreadsheets.
Use approved Defender External Attack Surface Management discovery to investigate exposed assets and confirm ownership. This is a valid action in another context: An Azure security team finds a risky internet-facing service that is not part of a managed subscription or cloud account inventory.
Scope the intended protection plans and validate feature readiness and operational ownership for each subscription. This is a valid action in another context: A Defender for Cloud plan change is approved for one subscription but is rolled out to every subscription without reviewing cost and service dependencies.
An Azure engineer implements: Review the requested delegated or application permission type and complete the consent process through authorized policy. for this situation: A security engineer grants an application registration directory read permissions without obtaining the required administrator consent. Which verification is most relevant?
The enterprise app's effective permission grant is recorded and the approved API request succeeds without overbroad privileges. This observation demonstrates that the control meets the case: A security engineer grants an application registration directory read permissions without obtaining the required administrator consent. It validates the intended result of: Review the requested delegated or application permission type and complete the consent process through authorized policy.
Credential renewal succeeds with tested overlap, and unused long-lived client secrets are removed. That would be evidence for the separate situation: A workload application has both a client secret and a certificate, but operations repeatedly forgets to rotate the shared secret.
The activated role appears for the authorized scope and has no effect on resources outside that scope. That would be evidence for the separate situation: A security operator is granted PIM eligibility to an Azure role but the role never appears when viewing another subscription.
The evidence associates the person, approved time window, scope, activation reason and subsequent expiration. That would be evidence for the separate situation: An auditor requests evidence that a temporary privileged role was activated for a legitimate incident and then expired.
The recommended technical control is: Re-enable or replace the intended identity and reconcile role assignments against the active principal object identifier. The triggering issue is: A virtual machine's system-assigned identity is disabled after a migration, but its old role assignments remain documented in runbooks. Which security principle BEST explains this decision?
Azure role assignments bind to security principal identifiers rather than a workload's display name. This principle explains why the control addresses: A virtual machine's system-assigned identity is disabled after a migration, but its old role assignments remain documented in runbooks. The recommended action is: Re-enable or replace the intended identity and reconcile role assignments against the active principal object identifier. Observable evidence: The active VM can obtain its own token with only intended permissions, and obsolete principal references are removed.
Workload identity protection requires credential hygiene in addition to role and permission governance. This mechanism is associated with a different case: A team creates multiple client secrets for one application without recording which service uses each credential.
Conditional Access combines signals and policy targeting with grant or session controls to enforce contextual access requirements. This mechanism is associated with a different case: A user can complete MFA with a permitted authentication method but an administrator believes MFA alone establishes compliance for every sensitive cloud sign-in.
Azure authorization evaluates applicable allow and deny assignments, and deny assignments can block actions despite role grants. This mechanism is associated with a different case: An Azure operator is denied access by a deny assignment even though a Contributor role appears on the resource.
An Azure engineer implements: Evaluate the confidentiality requirement and implement supported IPsec or other appropriate encryption over the connection. for this situation: An organization buys an ExpressRoute circuit and assumes all private peering traffic is automatically encrypted end-to-end. Which verification is most relevant?
Traffic on the required path is protected by the approved encryption mechanism independently of ExpressRoute private routing. This observation demonstrates that the control meets the case: An organization buys an ExpressRoute circuit and assumes all private peering traffic is automatically encrypted end-to-end. It validates the intended result of: Evaluate the confidentiality requirement and implement supported IPsec or other appropriate encryption over the connection.
The Function resolves the private SQL hostname and establishes an authorized connection through integrated networking. That would be evidence for the separate situation: A Function app needs outbound connectivity to a private Azure SQL endpoint but its current hosting plan lacks the required networking capability.
A controlled malicious HTTP request matches the intended WAF policy and is logged while valid traffic proceeds. That would be evidence for the separate situation: A web application is vulnerable to HTTP request injection, but the team deploys only a Layer 3 and Layer 4 Azure Firewall network rule.
Traffic tests and effective policy show admin-level enforcement while applicable NSG rules retain their role. That would be evidence for the separate situation: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated.
The response is: Revoke or rotate compromised access sessions and credentials while assessing the least-privileged assignments granted to the identity. Given the original problem: A developer stores an Azure management token in a shared build log, assuming the user's narrow role makes exposure harmless. Which design principle is most applicable?
Bearer access tokens carry scoped authorization claims and must be protected as sensitive credentials. This principle explains why the control addresses: A developer stores an Azure management token in a shared build log, assuming the user's narrow role makes exposure harmless. The recommended action is: Revoke or rotate compromised access sessions and credentials while assessing the least-privileged assignments granted to the identity. Observable evidence: The exposed token is no longer usable and the incident review identifies all permitted resource scopes it could reach.
Azure RBAC role assignments at management-group scope inherit to descendant subscriptions and contained resources. This mechanism is associated with a different case: A central team needs read-only security posture visibility across a management group without modifying any descendant subscriptions.
Public OAuth clients cannot securely retain shared secrets, unlike protected server-side confidential clients. This mechanism is associated with a different case: A team registers a confidential client application but puts the client secret in a public single-page application bundle.
Service principal lifecycle governance includes least privilege, activity review and permission revocation. This mechanism is associated with a different case: A security team discovers an unused service principal that still has broad Microsoft Graph application permissions.
An Azure engineer proposes: Filter and transform the selected security events in a supported DCR pipeline while retaining required detection signals. In the case: A cloud administrator configures a DCR to collect all verbose events and unintentionally drives excessive log ingestion costs. What underlying mechanism justifies the action?
Azure Monitor DCR transformations can reduce or shape collected data before ingestion into selected destinations. This principle explains why the control addresses: A cloud administrator configures a DCR to collect all verbose events and unintentionally drives excessive log ingestion costs. The recommended action is: Filter and transform the selected security events in a supported DCR pipeline while retaining required detection signals. Observable evidence: The workspace receives required high-value events with tested parsing and controlled ingestion volume.
Sentinel data-source design should consider duplicate ingestion and correlation across multiple connectors. This mechanism is associated with a different case: A Defender for Cloud alert is forwarded into Sentinel but the SOC cannot distinguish it from a duplicate alert created by a parallel custom connector.
Key Vault soft delete and purge protection provide recovery and deletion-resilience controls for stored objects. This mechanism is associated with a different case: A Key Vault is configured without purge protection and the security team worries a privileged deletion could destroy critical recovery material.
Azure Policy exemptions document exceptions to assigned policy compliance at selected scopes. This mechanism is associated with a different case: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record.
The team identifies this Azure security condition: An application is protected by Azure SQL TDE but sends customer records over an unencrypted client connection. What is the clearest consequence if it persists?
At-rest encryption does not protect plaintext records on unencrypted network sessions. The current case is: An application is protected by Azure SQL TDE but sends customer records over an unencrypted client connection. The risk follows because: SQL transport encryption and TDE protect different stages of the database data lifecycle. The appropriate mitigative action is: Enforce supported encrypted SQL client connections and validate certificate or TLS trust settings.
Soft delete and versioning address different deletion and overwrite recovery scenarios. This hazard concerns another scenario: A Blob container has soft delete enabled, but accidental overwrites still destroy access to earlier versions needed for audit.
Sharing the ACR admin credential removes granular attribution and can permit unintended image mutation. This hazard concerns another scenario: A container registry allows image pulls using its broad administrator credential, shared across several unrelated clusters.
Server-wide administrative roles for routine data queries extend compromise impact across databases. This hazard concerns another scenario: A security review finds SQL databases with broadly assigned server administrators rather than database-specific access for teams.
The approved security action is: Design an Entra Conditional Access policy that also evaluates appropriate users, cloud apps, conditions and grant controls. It addresses: A user can complete MFA with a permitted authentication method but an administrator believes MFA alone establishes compliance for every sensitive cloud sign-in. Which observation BEST proves the outcome?
A sign-in from a targeted risky context receives the documented Conditional Access decision rather than relying on MFA status alone. This observation demonstrates that the control meets the case: A user can complete MFA with a permitted authentication method but an administrator believes MFA alone establishes compliance for every sensitive cloud sign-in. It validates the intended result of: Design an Entra Conditional Access policy that also evaluates appropriate users, cloud apps, conditions and grant controls.
The service obtains a non-user app token whose roles match the authorized API operation. That would be evidence for the separate situation: A daemon service needs unattended access to a Microsoft Graph API but developers request a user-delegated permission requiring sign-in.
The Function retrieves the secret through its identity without storing a client credential in source code or settings. That would be evidence for the separate situation: An Azure Function needs to read a Key Vault secret but developers propose embedding a long-lived client secret in application settings.
A controlled sign-in from an unmanaged device is blocked while an authorized compliant device satisfies the policy. That would be evidence for the separate situation: An Azure portal administrative session on an unmanaged device should be blocked even if the user knows valid credentials.
An Azure engineer proposes: Configure supported diagnostic settings, logging destinations and Defender coverage for the running container workload. In the case: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring. What underlying mechanism justifies the action?
Container security monitoring must preserve workload logs and relevant control-plane events across ephemeral lifecycles. This principle explains why the control addresses: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring. The recommended action is: Configure supported diagnostic settings, logging destinations and Defender coverage for the running container workload. Observable evidence: Authorized responders receive relevant instance operation and security logs for the expected execution interval.
Azure confidential computing uses hardware-backed execution isolation to help protect data while in use. This mechanism is associated with a different case: An Azure virtual machine holds confidential analytics code, but operators can access memory snapshots despite a requirement for hardware-protected processing.
Customer-managed keys for Azure Storage depend on the key service and managed identity authorized for encryption operations. This mechanism is associated with a different case: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle.
Azure Blob Storage anonymous read controls must be configured explicitly at supported account and container scopes. This mechanism is associated with a different case: A storage account permits anonymous access to a blob container used for confidential internal data.
After the team performs: Evaluate supported agentless machine scanning in the selected Defender for Servers or CSPM plan and scope. the original issue remains: A security team wants vulnerability coverage of Azure virtual machines without deploying a traditional scanning agent on every host. What evidence should confirm success?
Eligible VMs show current agentless assessment results with expected resource identity and timestamps. This observation demonstrates that the control meets the case: A security team wants vulnerability coverage of Azure virtual machines without deploying a traditional scanning agent on every host. It validates the intended result of: Evaluate supported agentless machine scanning in the selected Defender for Servers or CSPM plan and scope.
An approved workload reaches the vault through the expected secure path and unauthorized sources are denied. That would be evidence for the separate situation: An Azure Key Vault is placed behind a firewall but its application still accesses a public endpoint without an approved network rule.
Protected servers report relevant security coverage and Defender workload alerts are available as expected. That would be evidence for the separate situation: A production Azure VM fleet appears in Defender for Cloud posture inventory but no server-specific runtime threat protection is enabled.
Authorized applications retrieve the current version and operate without relying on a disabled obsolete value. That would be evidence for the separate situation: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version.
An operational security assessment discovers: A team requires temporary VM management ports opened only during verified change windows, but an NSG continuously permits SSH from the internet. Which hazard best describes the gap?
Standing open management ports create more opportunity for brute force and remote exploitation. The current case is: A team requires temporary VM management ports opened only during verified change windows, but an NSG continuously permits SSH from the internet. The risk follows because: Defender for Cloud just-in-time VM access can temporarily modify network access for approved management sessions. The appropriate mitigative action is: Configure just-in-time VM access through the supported Defender for Cloud workflow and secure its request approvals.
Publishing unrestricted RDP or SSH on an internet-facing IP increases credential-attack and exploit exposure. This hazard concerns another scenario: A production VM must be administered without exposing RDP or SSH over a public IP address.
Disabling or deleting an active customer-managed TDE protector can interrupt protected database availability. This hazard concerns another scenario: An Azure SQL database uses TDE but security policy requires control of the TDE protector key.
Soft delete and versioning address different deletion and overwrite recovery scenarios. This hazard concerns another scenario: A Blob container has soft delete enabled, but accidental overwrites still destroy access to earlier versions needed for audit.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
