You save $69.98
An Azure security engineer investigates: An Azure VM backup is successful, but no test verifies the recovered machine can boot in an isolated network. Which action most directly addresses this requirement?
Perform a supported test restore with protected backup permissions and validate the restored workload before approval. This is the most direct response to: An Azure VM backup is successful, but no test verifies the recovered machine can boot in an isolated network. The security mechanism is: Compute recovery security depends on protected backups, controlled restore privileges and recovery testing. Expected verification: A test VM boots and required application data is recovered without granting broad production restore privileges.
Configure just-in-time VM access through the supported Defender for Cloud workflow and secure its request approvals. This is a valid action in another context: A team requires temporary VM management ports opened only during verified change windows, but an NSG continuously permits SSH from the internet.
Configure supported immutable blob storage with time-based retention or legal hold according to governance. This is a valid action in another context: A regulated archive requires that retained records cannot be changed before their approved retention period ends.
Enable the supported double encryption option during account provisioning with approved storage characteristics. This is a valid action in another context: A compliance requirement demands an additional independent infrastructure encryption layer for sensitive Azure Storage data.
An Azure engineer implements: Identify the scope and assign the least-privileged built-in role that grants the required network operations rather than broad subscription Owner. for this situation: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group. Which verification is most relevant?
An authorization test permits the approved NSG change in the target resource group while unrelated subscription resources remain protected. This observation demonstrates that the control meets the case: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group. It validates the intended result of: Identify the scope and assign the least-privileged built-in role that grants the required network operations rather than broad subscription Owner.
Interactive authorization returns only to documented secure endpoints and rejects an unregistered redirect. That would be evidence for the separate situation: A developer configures redirect URIs for a production application using a broad wildcard and an untrusted host.
A sign-in from a targeted risky context receives the documented Conditional Access decision rather than relying on MFA status alone. That would be evidence for the separate situation: A user can complete MFA with a permitted authentication method but an administrator believes MFA alone establishes compliance for every sensitive cloud sign-in.
A newly obtained token has the intended audience and delegated scope and the API authorizes the operation. That would be evidence for the separate situation: A web API publishes an OAuth scope but an authorized client repeatedly receives insufficient-scope errors.
A cloud security team finds the following condition: An application needs private access to a PaaS service through a central hub, but the owner creates a Private Endpoint only in an isolated VNet. What is the BEST next technical control?
Deploy the endpoint in a reachable subnet and configure permitted peering and private DNS visibility for consumers. This is the most direct response to: An application needs private access to a PaaS service through a central hub, but the owner creates a Private Endpoint only in an isolated VNet. The security mechanism is: Private Endpoint reachability depends on network routing, DNS and service-specific access controls. Expected verification: Authorized spoke workloads resolve and connect to the private endpoint while unrelated networks are blocked.
Associate the correct route table with the intended subnet and validate the next hop and route selection. This is a valid action in another context: A team creates a user-defined route sending egress traffic toward a firewall but sees the default system route still used for a workload subnet.
Create a supported Private Link service on the provider side and control private endpoint connection approvals. This is a valid action in another context: An internal customer hosts a privately exposed application behind a standard load balancer and wants other tenants to access it over Private Link.
Review WAF mode and rule exclusions, validate detections, then enable prevention under approved change control. This is a valid action in another context: An Application Gateway WAF policy starts in detection mode, but administrators assume identified attack patterns are already blocked.
A security implementation review identifies: A company publishes an API through API Management but a developer uses an untrusted self-signed public-facing certificate. Which remediation is most defensible?
Configure a valid approved custom domain certificate and supported TLS security settings for the gateway. This is the most direct response to: A company publishes an API through API Management but a developer uses an untrusted self-signed public-facing certificate. The security mechanism is: TLS protects API endpoint confidentiality and server identity when certificates and trust chains are valid. Expected verification: Client verification succeeds for the trusted domain and rejects malformed or expired certificates.
Define global security admin rules with the correct behavior and test downstream NSG processing where appropriate. This is a valid action in another context: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated.
Configure a supported Azure Front Door endpoint and WAF policy with secured origin access. This is a valid action in another context: A globally distributed website suffers high latency and needs edge-based TLS, intelligent routing and an HTTP WAF.
Configure App Service VNet integration for the application's outbound access path to private resources. This is a valid action in another context: An App Service web app must privately reach a database in a VNet but an engineer creates a Private Endpoint for the web app instead.
An Azure security engineer investigates: A multi-subscription platform needs consistent firewall rules but each project team maintains independent copies. Which action most directly addresses this requirement?
Use Azure Firewall Manager and governed Firewall Policies with correctly scoped rule collection groups. This is the most direct response to: A multi-subscription platform needs consistent firewall rules but each project team maintains independent copies. The security mechanism is: Azure Firewall Manager supports central management of Azure Firewall policies and associated deployments. Expected verification: Policy deployment and effective rules show intended common controls across managed firewalls.
Evaluate the applicable Azure DDoS Protection coverage and service configuration alongside HTTP-level WAF controls. This is a valid action in another context: A regional web application is overwhelmed by volumetric traffic and an engineer assumes WAF request rules alone prevent all network-layer attacks.
Define global security admin rules with the correct behavior and test downstream NSG processing where appropriate. This is a valid action in another context: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated.
Inspect Network Watcher next-hop diagnostics and the effective routes on the originating network interface. This is a valid action in another context: A route through a network virtual appliance appears correct but a VM cannot reach a private workload in another subnet.
A cloud security team finds the following condition: A Sentinel detection query matches every failed login separately, generating hundreds of low-value incidents from one failed authentication burst. What is the BEST next technical control?
Tune rule aggregation, threshold and incident grouping in line with the intended attack pattern. This is the most direct response to: A Sentinel detection query matches every failed login separately, generating hundreds of low-value incidents from one failed authentication burst. The security mechanism is: Sentinel analytics rules and incident grouping allow correlation of related detection results into investigation units. Expected verification: Representative login bursts produce one useful incident with the relevant accounts and hosts rather than uncontrolled duplicates.
Assign the approved policy at the intended subscription or management group scope using a deny effect where supported. This is a valid action in another context: An Azure administrator wants to prevent new publicly accessible storage accounts but only creates an Azure Policy definition without an assignment.
Inspect related entities, recommendations, resource logs and event chronology before assigning alert disposition. This is a valid action in another context: Defender for Cloud reports a high-severity alert about suspicious outbound traffic, but responders close it without checking the affected resource or timeline.
Assign the intended policy initiative to the approved scope and evaluate each member control independently. This is a valid action in another context: A policy initiative groups several encryption and network requirements but the team assigns only one underlying definition.
A cloud security team finds the following condition: An application identity needs to read a Key Vault secret but the developer assigns a broad vault administrator role. What is the BEST next technical control?
Grant the narrow supported secret-reader role at the appropriate vault or secret scope. This is the most direct response to: An application identity needs to read a Key Vault secret but the developer assigns a broad vault administrator role. The security mechanism is: Key Vault RBAC roles differentiate secret use from key administration and vault management. Expected verification: The app reads the required secret while prohibited management or deletion operations are denied.
Use the selected vault permission model and configure appropriate Key Vault data-plane Azure RBAC roles. This is a valid action in another context: A Key Vault administrator enables RBAC authorization but continues editing legacy vault access policies as if they remain the effective data access model.
Combine Defender for Cloud resource inventory, exposure findings and supported attack-path or graph views. This is a valid action in another context: A security team wants to investigate whether sensitive database resources are exposed through network paths to the internet.
Use Defender for Cloud recommendations and inventory filters to resolve each finding to the actual resource. This is a valid action in another context: A subscription shows many security recommendations but engineers cannot find which virtual machines are affected.
A security design review describes: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle. Which unresolved failure risk is MOST relevant?
Removing key permissions or disabling the active encryption key can render protected data inaccessible. The current case is: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle. The risk follows because: Customer-managed keys for Azure Storage depend on the key service and managed identity authorized for encryption operations. The appropriate mitigative action is: Configure a customer-managed encryption key from Key Vault or managed HSM and grant the storage service its required key access.
Assuming customer-managed keys and infrastructure double encryption are identical can miss a specific security requirement. This hazard concerns another scenario: A compliance requirement demands an additional independent infrastructure encryption layer for sensitive Azure Storage data.
Embedding service principal passwords in reusable container images expands credential exposure and rotation failures. This hazard concerns another scenario: An AKS pod uses a container image with embedded Azure client secrets to access a storage service.
Restricting worker-node NSGs alone does not necessarily secure a publicly exposed Kubernetes control-plane endpoint. This hazard concerns another scenario: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane.
A cloud security team finds the following condition: A function app invokes an Azure resource endpoint using a managed identity but the service rejects its request with forbidden status. What is the BEST next technical control?
Verify the managed identity exists, requests the right resource audience token and has the required target service role assignment. This is the most direct response to: A function app invokes an Azure resource endpoint using a managed identity but the service rejects its request with forbidden status. The security mechanism is: Managed identity authentication and target-service authorization are separate steps in an Azure workload call. Expected verification: A token for the intended resource and correct scoped authorization allows the Function's approved operation.
Use an approved certificate credential or a managed identity where supported and enforce a documented rotation process. This is a valid action in another context: A workload application has both a client secret and a certificate, but operations repeatedly forgets to rotate the shared secret.
Assign the least-privileged appropriate Azure RBAC reader role at the required management-group scope. This is a valid action in another context: A central team needs read-only security posture visibility across a management group without modifying any descendant subscriptions.
Use a time-limited, least-privileged Azure RBAC assignment at the single required resource or resource-group scope. This is a valid action in another context: A security analyst grants an external consultant permanent access to all resource groups to troubleshoot one VM.
An Azure engineer proposes: Evaluate a regional Application Gateway with the required listeners, certificates and backend health probes. In the case: A public web workload requires regional HTTP routing and TLS termination, but a team proposes a global Front Door solely for one VNet-internal app. What underlying mechanism justifies the action?
Azure Application Gateway is a regional application delivery service with Layer 7 routing and optional integrated WAF. This principle explains why the control addresses: A public web workload requires regional HTTP routing and TLS termination, but a team proposes a global Front Door solely for one VNet-internal app. The recommended action is: Evaluate a regional Application Gateway with the required listeners, certificates and backend health probes. Observable evidence: Regional HTTPS requests terminate at the approved gateway and route only to healthy intended backend pools.
Point-to-site VPN security depends on controlled client authentication and credential or identity revocation. This mechanism is associated with a different case: Remote users connect to Azure via point-to-site VPN, but a legacy certificate remains accepted after an employee departure.
TLS protects API endpoint confidentiality and server identity when certificates and trust chains are valid. This mechanism is associated with a different case: A company publishes an API through API Management but a developer uses an untrusted self-signed public-facing certificate.
Azure route tables and effective routes determine which next hop handles matching destination address prefixes. This mechanism is associated with a different case: A team creates a user-defined route sending egress traffic toward a firewall but sees the default system route still used for a workload subnet.
The response is: Coordinate version use, secret references and application refresh behavior before revoking the old version. Given the original problem: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version. Which design principle is most applicable?
Key Vault secrets are versioned and consumers must follow appropriate version selection and refresh practices. This principle explains why the control addresses: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version. The recommended action is: Coordinate version use, secret references and application refresh behavior before revoking the old version. Observable evidence: Authorized applications retrieve the current version and operate without relying on a disabled obsolete value.
Key Vault soft delete and purge protection provide recovery and deletion-resilience controls for stored objects. This mechanism is associated with a different case: A Key Vault is configured without purge protection and the security team worries a privileged deletion could destroy critical recovery material.
Foundational CSPM assessment and Defender workload-protection plans provide different security capabilities. This mechanism is associated with a different case: A manager assumes all resources are protected because Microsoft Cloud Security Benchmark checks report high compliance.
Aggregate cloud posture metrics depend on assessment scope and counted control recommendations. This mechanism is associated with a different case: A cloud project migrates resources to a new subscription and the security team compares secure scores without matching coverage.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
