You save $69.98
The response is: Use Privileged Identity Management to configure eligible Azure RBAC role assignments with approval and time-bound activation. Given the original problem: An incident response team needs elevated Azure resource access only during approved investigations, but administrators have standing Owner access all week. Which design principle is most applicable?
PIM supports eligible role assignments and just-in-time activation for supported Azure resource roles and directory roles. This principle explains why the control addresses: An incident response team needs elevated Azure resource access only during approved investigations, but administrators have standing Owner access all week. The recommended action is: Use Privileged Identity Management to configure eligible Azure RBAC role assignments with approval and time-bound activation. Observable evidence: Activation logs identify the approving authority, effective scope and automatic expiration of temporary elevated rights.
Microsoft Entra access tokens commonly distinguish delegated scp claims from application-only roles claims. This mechanism is associated with a different case: A custom API supports both user-level delegated access and daemon application calls, but its authorization code checks only the scope claim.
PIM role settings define activation duration and security requirements independently of eligibility assignment. This mechanism is associated with a different case: A privileged directory role is eligible in PIM but the user can activate it without an MFA check or justification.
Enterprise application consent policies are security gates for delegated and app-only access to protected APIs. This mechanism is associated with a different case: A third-party SaaS app requests tenant-wide consent for an unrelated set of privileged directory operations.
An Azure security engineer investigates: A remote workforce frequently travels, and an engineer proposes blocking all countries without distinguishing trusted named locations and actual sign-in risk. Which action most directly addresses this requirement?
Design location-based Conditional Access conditions from approved named locations and test them alongside emergency access exclusions. This is the most direct response to: A remote workforce frequently travels, and an engineer proposes blocking all countries without distinguishing trusted named locations and actual sign-in risk. The security mechanism is: Conditional Access named locations use network or country signals as one condition in a broader risk-based policy. Expected verification: Testing shows documented decisions for approved and disallowed regions without denying legitimate emergency administration.
Separate directory roles from Azure resource roles, then assign a resource-scoped Azure RBAC role if necessary. This is a valid action in another context: A tenant administrator assigns the Entra Security Reader directory role and assumes it grants access to edit an Azure subscription's virtual networks.
Review application publisher, requested scopes, risk and authorized tenant consent settings before granting access. This is a valid action in another context: A third-party SaaS app requests tenant-wide consent for an unrelated set of privileged directory operations.
Distinguish application object and tenant-local service principal and assess the consequences of object lifecycle changes. This is a valid action in another context: An administrator deletes an app registration but expects the existing enterprise application in another tenant to retain all delegated grants indefinitely.
An operational security assessment discovers: A Key Vault administrator enables RBAC authorization but continues editing legacy vault access policies as if they remain the effective data access model. Which hazard best describes the gap?
Confusing vault access policies with Azure RBAC can cause either denied service calls or excessive permissions. The current case is: A Key Vault administrator enables RBAC authorization but continues editing legacy vault access policies as if they remain the effective data access model. The risk follows because: Key Vault supports distinct authorization permission models; the selected model governs data-plane access. The appropriate mitigative action is: Use the selected vault permission model and configure appropriate Key Vault data-plane Azure RBAC roles.
Azure subscription onboarding alone does not grant visibility into an unrelated AWS account. This hazard concerns another scenario: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.
An alert severity label alone cannot establish whether a specific event is an attack or a false positive. This hazard concerns another scenario: Defender for Cloud reports a high-severity alert about suspicious outbound traffic, but responders close it without checking the affected resource or timeline.
A deployIfNotExists assignment without necessary identity permissions may detect but fail to remediate missing settings. This hazard concerns another scenario: An Azure Policy definition using deployIfNotExists reports noncompliant diagnostic settings but no remediation deployment occurs.
After the team performs: Review exemption rationale, approval, expiry and alternative controls before allowing the exception to remain. the original issue remains: A Defender recommendation is marked exempt for a legacy system without a documented business owner or remediation plan. What evidence should confirm success?
The accepted exception is scoped and documented, and its residual risk receives periodic owner review. This observation demonstrates that the control meets the case: A Defender recommendation is marked exempt for a legacy system without a documented business owner or remediation plan. It validates the intended result of: Review exemption rationale, approval, expiry and alternative controls before allowing the exception to remain.
An externally visible domain or service is attributed to an authorized business owner with actionable remediation. That would be evidence for the separate situation: An Azure security team finds a risky internet-facing service that is not part of a managed subscription or cloud account inventory.
Defender findings and independent Kubernetes access tests confirm both monitoring and preventive controls. That would be evidence for the separate situation: A security team onboards Defender for Containers but assumes the plan automatically replaces all Kubernetes network and RBAC hardening.
The incident record identifies the affected host and a supported benign or malicious conclusion with evidence. That would be evidence for the separate situation: Defender for Cloud reports a high-severity alert about suspicious outbound traffic, but responders close it without checking the affected resource or timeline.
The recommended technical control is: Implement approved API access, subscription or identity policies and network restrictions appropriate to the API tier. The triggering issue is: An API Management instance exposes backend administrative APIs to all callers, and one team proposes relying only on endpoint obscurity. Which security principle BEST explains this decision?
Azure API Management policies and networking support authentication, authorization and request-level controls. This principle explains why the control addresses: An API Management instance exposes backend administrative APIs to all callers, and one team proposes relying only on endpoint obscurity. The recommended action is: Implement approved API access, subscription or identity policies and network restrictions appropriate to the API tier. Observable evidence: Calls from unauthorized identities are denied while approved requests reach only intended operations.
Azure SQL TDE protects stored database pages and backups, not network ingress or user authorization. This mechanism is associated with a different case: An Azure SQL server is public and a DBA tries to secure it solely by enabling Transparent Data Encryption.
Azure immutable blob storage can enforce write-once-read-many retention policies beyond standard user permissions. This mechanism is associated with a different case: A regulated archive requires that retained records cannot be changed before their approved retention period ends.
Azure Bastion provides managed browser-based or native-client connectivity to VMs through private networking. This mechanism is associated with a different case: A production VM must be administered without exposing RDP or SSH over a public IP address.
A cloud security team finds the following condition: A Blob container has soft delete enabled, but accidental overwrites still destroy access to earlier versions needed for audit. What is the BEST next technical control?
Enable appropriate blob versioning and retention capabilities, then test restore of previous content. This is the most direct response to: A Blob container has soft delete enabled, but accidental overwrites still destroy access to earlier versions needed for audit. The security mechanism is: Azure Blob versioning preserves prior object versions, while soft delete protects eligible deleted data. Expected verification: The team can retrieve the earlier object version after an overwrite without restoring an entire account.
Review platform compatibility and select the supported encryption-at-host, ADE or confidential disk option for the deployment. This is a valid action in another context: A team attempts to enable Azure Disk Encryption on a confidential VM using unsupported combinations of encryption features.
Enable the supported double encryption option during account provisioning with approved storage characteristics. This is a valid action in another context: A compliance requirement demands an additional independent infrastructure encryption layer for sensitive Azure Storage data.
Configure a customer-managed TDE protector in Key Vault with the necessary managed identity permissions. This is a valid action in another context: An Azure SQL database uses TDE but security policy requires control of the TDE protector key.
The response is: Restrict the identity's storage data-plane role assignment or assign a dedicated managed identity to the required workload. Given the original problem: A storage automation client uses a user-assigned managed identity attached to several virtual machines but only one needs blob write access. Which design principle is most applicable?
A user-assigned managed identity can attach to multiple resources, so its permission scope and attachment governance matter. This principle explains why the control addresses: A storage automation client uses a user-assigned managed identity attached to several virtual machines but only one needs blob write access. The recommended action is: Restrict the identity's storage data-plane role assignment or assign a dedicated managed identity to the required workload. Observable evidence: Only the approved workload identity can write target blobs, and other workloads remain unauthorized.
PIM activation histories and resource activity logs support audit of privileged identity use when properly retained. This mechanism is associated with a different case: An auditor requests evidence that a temporary privileged role was activated for a legitimate incident and then expired.
OAuth access tokens carry audience and scope or role claims determined by app registration and consent. This mechanism is associated with a different case: A web API publishes an OAuth scope but an authorized client repeatedly receives insufficient-scope errors.
PIM supports eligible role assignments and just-in-time activation for supported Azure resource roles and directory roles. This mechanism is associated with a different case: An incident response team needs elevated Azure resource access only during approved investigations, but administrators have standing Owner access all week.
An operational security assessment discovers: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval. Which hazard best describes the gap?
Unrestricted backup deletion rights can allow accidental or malicious destruction of recovery points. The current case is: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval. The risk follows because: Storage and backup resilience require protecting the control plane and retained recovery content from destructive changes. The appropriate mitigative action is: Apply appropriate resource locks, authorization separation and immutable or protected backup settings where supported.
Publishing unrestricted RDP or SSH on an internet-facing IP increases credential-attack and exploit exposure. This hazard concerns another scenario: A production VM must be administered without exposing RDP or SSH over a public IP address.
Hard-coded SQL credentials increase secret exposure and complicate credential revocation or rotation. This hazard concerns another scenario: A development team stores SQL authentication passwords in deployment files despite having Microsoft Entra identities for application services.
Overbroad or long-lived SAS tokens can be replayed outside the intended task and expose stored data. This hazard concerns another scenario: A temporary blob SAS grants read, write, list and delete access for one year when the use case requires one-hour upload only.
A security design review describes: An AKS pod uses a container image with embedded Azure client secrets to access a storage service. Which unresolved failure risk is MOST relevant?
Embedding service principal passwords in reusable container images expands credential exposure and rotation failures. The current case is: An AKS pod uses a container image with embedded Azure client secrets to access a storage service. The risk follows because: AKS workload identity federation can exchange trusted Kubernetes service account tokens for Entra workload tokens. The appropriate mitigative action is: Configure Microsoft Entra Workload ID or supported managed identity integration and least-privileged target permissions.
At-rest encryption does not protect plaintext records on unencrypted network sessions. This hazard concerns another scenario: An application is protected by Azure SQL TDE but sends customer records over an unencrypted client connection.
Assuming customer-managed keys and infrastructure double encryption are identical can miss a specific security requirement. This hazard concerns another scenario: A compliance requirement demands an additional independent infrastructure encryption layer for sensitive Azure Storage data.
Publishing unrestricted RDP or SSH on an internet-facing IP increases credential-attack and exploit exposure. This hazard concerns another scenario: A production VM must be administered without exposing RDP or SSH over a public IP address.
A security design review describes: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane. Which unresolved failure risk is MOST relevant?
Restricting worker-node NSGs alone does not necessarily secure a publicly exposed Kubernetes control-plane endpoint. The current case is: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane. The risk follows because: AKS private cluster mode provides private endpoint access to the Kubernetes API server under supported configurations. The appropriate mitigative action is: Plan a supported private AKS cluster and private DNS or authorized network paths for administrators.
Uncoordinated column key rotation can cause application decryption failures even if the SQL server stays healthy. This hazard concerns another scenario: A customer uses Azure SQL Always Encrypted but rotates column keys without coordinating the dependent application driver and metadata.
Accidental public container access can expose blob content independently of subscription RBAC settings. This hazard concerns another scenario: A storage account permits anonymous access to a blob container used for confidential internal data.
Kubernetes namespaces alone do not enforce complete network isolation between pods. This hazard concerns another scenario: AKS workloads from different teams share one cluster and require restricted pod-to-pod network communication.
An Azure security engineer investigates: An Azure VM backup is successful, but no test verifies the recovered machine can boot in an isolated network. Which action most directly addresses this requirement?
Perform a supported test restore with protected backup permissions and validate the restored workload before approval. This is the most direct response to: An Azure VM backup is successful, but no test verifies the recovered machine can boot in an isolated network. The security mechanism is: Compute recovery security depends on protected backups, controlled restore privileges and recovery testing. Expected verification: A test VM boots and required application data is recovered without granting broad production restore privileges.
Configure just-in-time VM access through the supported Defender for Cloud workflow and secure its request approvals. This is a valid action in another context: A team requires temporary VM management ports opened only during verified change windows, but an NSG continuously permits SSH from the internet.
Configure supported immutable blob storage with time-based retention or legal hold according to governance. This is a valid action in another context: A regulated archive requires that retained records cannot be changed before their approved retention period ends.
Enable the supported double encryption option during account provisioning with approved storage characteristics. This is a valid action in another context: A compliance requirement demands an additional independent infrastructure encryption layer for sensitive Azure Storage data.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
