You save $69.98
The response is: Coordinate version use, secret references and application refresh behavior before revoking the old version. Given the original problem: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version. Which design principle is most applicable?
Key Vault secrets are versioned and consumers must follow appropriate version selection and refresh practices. This principle explains why the control addresses: A security engineer rotates a Key Vault secret and assumes dependent applications will automatically discover the new version. The recommended action is: Coordinate version use, secret references and application refresh behavior before revoking the old version. Observable evidence: Authorized applications retrieve the current version and operate without relying on a disabled obsolete value.
Key Vault soft delete and purge protection provide recovery and deletion-resilience controls for stored objects. This mechanism is associated with a different case: A Key Vault is configured without purge protection and the security team worries a privileged deletion could destroy critical recovery material.
Foundational CSPM assessment and Defender workload-protection plans provide different security capabilities. This mechanism is associated with a different case: A manager assumes all resources are protected because Microsoft Cloud Security Benchmark checks report high compliance.
Aggregate cloud posture metrics depend on assessment scope and counted control recommendations. This mechanism is associated with a different case: A cloud project migrates resources to a new subscription and the security team compares secure scores without matching coverage.
A cloud security team finds the following condition: A Virtual Network Manager configuration targets the wrong network group and unexpectedly includes a sensitive production subnet. What is the BEST next technical control?
Review dynamic and static network-group membership and apply an approved deployment scope before rollout. This is the most direct response to: A Virtual Network Manager configuration targets the wrong network group and unexpectedly includes a sensitive production subnet. The security mechanism is: Azure Virtual Network Manager applies connectivity and security configurations to selected network groups. Expected verification: Affected virtual networks match the approved inventory and no unplanned production network receives rules.
Configure App Service VNet integration for the application's outbound access path to private resources. This is a valid action in another context: An App Service web app must privately reach a database in a VNet but an engineer creates a Private Endpoint for the web app instead.
Define global security admin rules with the correct behavior and test downstream NSG processing where appropriate. This is a valid action in another context: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated.
Create a supported Private Link service on the provider side and control private endpoint connection approvals. This is a valid action in another context: An internal customer hosts a privately exposed application behind a standard load balancer and wants other tenants to access it over Private Link.
An Azure engineer proposes: Evaluate the confidentiality requirement and implement supported IPsec or other appropriate encryption over the connection. In the case: An organization buys an ExpressRoute circuit and assumes all private peering traffic is automatically encrypted end-to-end. What underlying mechanism justifies the action?
ExpressRoute supplies private connectivity to Microsoft networks, and encryption must be considered separately when required. This principle explains why the control addresses: An organization buys an ExpressRoute circuit and assumes all private peering traffic is automatically encrypted end-to-end. The recommended action is: Evaluate the confidentiality requirement and implement supported IPsec or other appropriate encryption over the connection. Observable evidence: Traffic on the required path is protected by the approved encryption mechanism independently of ExpressRoute private routing.
NSG egress filtering should be scoped by protocol, destinations and supported service dependencies. This mechanism is associated with a different case: A security engineer uses a single NSG to block all outbound traffic and then discovers that required identity and monitoring endpoints are unreachable.
Private endpoints and public network access controls must be configured together for private-only App Service ingress. This mechanism is associated with a different case: An App Service private endpoint is deployed for an internal site, but users from the public internet still reach its ordinary public hostname.
Service endpoints extend virtual network identity to selected Azure services but do not assign a private service IP. This mechanism is associated with a different case: A developer enables a virtual network service endpoint for Storage and assumes the storage account now has a private IP inside the subnet.
An Azure security engineer investigates: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval. Which action most directly addresses this requirement?
Apply appropriate resource locks, authorization separation and immutable or protected backup settings where supported. This is the most direct response to: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval. The security mechanism is: Storage and backup resilience require protecting the control plane and retained recovery content from destructive changes. Expected verification: Recovery data remains protected from unapproved deletion or configuration changes and alerts reach security owners.
Enable relevant vulnerability assessment and image security monitoring in supported Defender for Containers capabilities. This is a valid action in another context: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.
Assign an appropriate Azure Storage Blob Data Reader role at a justified scope if data access is authorized. This is a valid action in another context: A user has the Azure Reader management-plane role on a storage account and assumes it can download all blob contents.
Configure appropriate SQL auditing settings and an approved Log Analytics, Event Hubs or storage destination. This is a valid action in another context: An Azure SQL administrator enables auditing only for successful authentication but investigators need failed login and sensitive activity evidence.
The recommended technical control is: Reference the Application Security Group in an effective NSG rule with the required source, destination and port conditions. The triggering issue is: A security team expects an application security group to block all traffic after assigning VM NICs to the group but defines no NSG rules. Which security principle BEST explains this decision?
Application Security Groups provide reusable grouping of NICs for use in NSG source and destination rule definitions. This principle explains why the control addresses: A security team expects an application security group to block all traffic after assigning VM NICs to the group but defines no NSG rules. The recommended action is: Reference the Application Security Group in an effective NSG rule with the required source, destination and port conditions. Observable evidence: Member VM traffic is accepted or denied according to the associated NSG and its applied subnet or NIC scope.
Azure Firewall Manager supports central management of Azure Firewall policies and associated deployments. This mechanism is associated with a different case: A multi-subscription platform needs consistent firewall rules but each project team maintains independent copies.
Private endpoints and public network access controls must be configured together for private-only App Service ingress. This mechanism is associated with a different case: An App Service private endpoint is deployed for an internal site, but users from the public internet still reach its ordinary public hostname.
NSG egress filtering should be scoped by protocol, destinations and supported service dependencies. This mechanism is associated with a different case: A security engineer uses a single NSG to block all outbound traffic and then discovers that required identity and monitoring endpoints are unreachable.
An operational security assessment discovers: A tenant administrator assigns the Entra Security Reader directory role and assumes it grants access to edit an Azure subscription's virtual networks. Which hazard best describes the gap?
Conflating Microsoft Entra directory roles with Azure RBAC could create either a privilege gap or an overly broad workaround. The current case is: A tenant administrator assigns the Entra Security Reader directory role and assumes it grants access to edit an Azure subscription's virtual networks. The risk follows because: Microsoft Entra roles govern directory resources and Azure RBAC roles govern Azure Resource Manager resource access. The appropriate mitigative action is: Separate directory roles from Azure resource roles, then assign a resource-scoped Azure RBAC role if necessary.
Relying on an unversioned spreadsheet of administrators cannot establish actual time-bounded privilege use. This hazard concerns another scenario: An auditor requests evidence that a temporary privileged role was activated for a legitimate incident and then expired.
Listing a permission in app registration does not by itself mean consent was granted or usable by the app. This hazard concerns another scenario: A security engineer grants an application registration directory read permissions without obtaining the required administrator consent.
Assigning access to an outdated principal cannot authenticate a newly created or disabled managed identity. This hazard concerns another scenario: A virtual machine's system-assigned identity is disabled after a migration, but its old role assignments remain documented in runbooks.
After the team performs: Validate the KQL query columns, entity mapping and schedule against representative ingested events. the original issue remains: Security engineers create a Microsoft Sentinel scheduled analytics rule whose query returns an incorrect field for the entity mapping. What evidence should confirm success?
Generated alerts include the intended host and account entities with accurate timestamps and incident context. This observation demonstrates that the control meets the case: Security engineers create a Microsoft Sentinel scheduled analytics rule whose query returns an incorrect field for the entity mapping. It validates the intended result of: Validate the KQL query columns, entity mapping and schedule against representative ingested events.
The backed-up material remains inaccessible to unapproved users and a supported restore validates recoverability. That would be evidence for the separate situation: A Key Vault backup is exported to an unencrypted public file share for disaster recovery testing.
Compliance reports show results for all included policies and newly created resources obey the applicable effects. That would be evidence for the separate situation: A policy initiative groups several encryption and network requirements but the team assigns only one underlying definition.
An authorized test incident is updated by the playbook and unrelated incident workspaces remain inaccessible. That would be evidence for the separate situation: A Sentinel playbook successfully invokes a Logic App but cannot update an incident because its managed identity lacks rights.
The recommended technical control is: Require secure transfer and migrate the client to supported TLS-based access before removing plaintext paths. The triggering issue is: An administrator disables secure transfer enforcement on a storage account to support an obsolete client using HTTP. Which security principle BEST explains this decision?
Azure Storage secure transfer required enforces supported HTTPS access to storage service endpoints. This principle explains why the control addresses: An administrator disables secure transfer enforcement on a storage account to support an obsolete client using HTTP. The recommended action is: Require secure transfer and migrate the client to supported TLS-based access before removing plaintext paths. Observable evidence: HTTP-only requests fail while approved HTTPS storage calls succeed with valid authentication.
Container workload security includes image assessment, runtime signals and cluster configuration posture checks. This mechanism is associated with a different case: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.
Azure Container Registry supports identity-based authorization separately for pull, push and repository operations. This mechanism is associated with a different case: A container registry allows image pulls using its broad administrator credential, shared across several unrelated clusters.
Azure Blob Storage anonymous read controls must be configured explicitly at supported account and container scopes. This mechanism is associated with a different case: A storage account permits anonymous access to a blob container used for confidential internal data.
After the team performs: Distinguish application object and tenant-local service principal and assess the consequences of object lifecycle changes. the original issue remains: An administrator deletes an app registration but expects the existing enterprise application in another tenant to retain all delegated grants indefinitely. What evidence should confirm success?
The affected tenant's enterprise application state and effective grants are reconciled through authorized cleanup. This observation demonstrates that the control meets the case: An administrator deletes an app registration but expects the existing enterprise application in another tenant to retain all delegated grants indefinitely. It validates the intended result of: Distinguish application object and tenant-local service principal and assess the consequences of object lifecycle changes.
Authorized staff can view permitted resources in child subscriptions but cannot change policy or network settings. That would be evidence for the separate situation: A central team needs read-only security posture visibility across a management group without modifying any descendant subscriptions.
The Function retrieves the secret through its identity without storing a client credential in source code or settings. That would be evidence for the separate situation: An Azure Function needs to read a Key Vault secret but developers propose embedding a long-lived client secret in application settings.
The guest reads only the approved deployment data without inheriting internal employees' administrative permissions. That would be evidence for the separate situation: A guest collaborator needs to view a single resource group's deployment state while internal employees have broader subscription rights.
The response is: Create an ordered key rotation plan using alternate key migration or identity-based authentication before revoking the exposed key. Given the original problem: A storage account's access key may have leaked into a support ticket while production apps still depend on both key slots. Which design principle is most applicable?
Azure Storage provides multiple account keys to support controlled key rotation across dependent clients. This principle explains why the control addresses: A storage account's access key may have leaked into a support ticket while production apps still depend on both key slots. The recommended action is: Create an ordered key rotation plan using alternate key migration or identity-based authentication before revoking the exposed key. Observable evidence: Production applications continue operating using approved credentials and the compromised key is no longer accepted.
Azure Storage secure transfer required enforces supported HTTPS access to storage service endpoints. This mechanism is associated with a different case: An administrator disables secure transfer enforcement on a storage account to support an obsolete client using HTTP.
AKS private cluster mode provides private endpoint access to the Kubernetes API server under supported configurations. This mechanism is associated with a different case: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane.
Azure encryption at host extends encryption coverage to host-side disk processing paths for supported VMs. This mechanism is associated with a different case: A VM uses standard managed-disk encryption but the security design requires encryption of temporary disks and host-side caches.
A cloud security team finds the following condition: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record. What is the BEST next technical control?
Create a scoped, time-limited exemption with justification, owner and review evidence under approved governance. This is the most direct response to: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record. The security mechanism is: Azure Policy exemptions document exceptions to assigned policy compliance at selected scopes. Expected verification: The exemption applies only to the affected resource and expires or is reviewed at the recorded date.
Separate roles and enable available vault security features such as soft delete, resource locks or immutability as applicable. This is a valid action in another context: A Recovery Services vault permits the same operator who creates backups to disable protections and delete recovery points.
Review the rule's supported execution frequency, lookback and delay characteristics and choose an appropriate detection strategy. This is a valid action in another context: A security team assumes a newly created scheduled Sentinel analytics rule detects an event in real time even though it runs hourly.
Review connector overlap and incident-creation logic before enabling duplicate ingestion pipelines. This is a valid action in another context: A Defender for Cloud alert is forwarded into Sentinel but the SOC cannot distinguish it from a duplicate alert created by a parallel custom connector.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
