You save $69.98
An operational security assessment discovers: A hybrid environment includes several Google Cloud projects but only the Azure estate appears in Defender posture reporting. Which hazard best describes the gap?
An absent GCP connector leaves foreign-cloud resources outside the assumed central posture view. The current case is: A hybrid environment includes several Google Cloud projects but only the Azure estate appears in Defender posture reporting. The risk follows because: Defender for Cloud supports GCP onboarding through a connector with appropriate permissions and configuration. The appropriate mitigative action is: Onboard the necessary Google Cloud organization or project scope using supported multicloud connector permissions.
A correctly written policy with incomplete assignment scope leaves unmanaged subscriptions outside governance. This hazard concerns another scenario: An Azure Policy assignment covers only one subscription while the documented baseline is intended for every subscription in a management group.
Stale manual inventories can miss deployed assets and leave externally exposed resources outside review. This hazard concerns another scenario: A cloud governance team cannot identify unowned public IP addresses because resource inventories are stored in manually maintained spreadsheets.
Unreviewed compliance exemptions can hide permanent weaknesses from ordinary posture workflows. This hazard concerns another scenario: A Defender recommendation is marked exempt for a legacy system without a documented business owner or remediation plan.
An operational security assessment discovers: A team enables a GitLab integration but grants a long-lived unrestricted token without identifying required permissions. Which hazard best describes the gap?
Overprivileged integration tokens create a separate pathway for source code or pipeline compromise. The current case is: A team enables a GitLab integration but grants a long-lived unrestricted token without identifying required permissions. The risk follows because: Defender DevOps integrations require controlled connector identity and repository or group permissions. The appropriate mitigative action is: Use the supported GitLab connector workflow and scope its credentials and organization access to actual needs.
An unconnected source control estate can contain security risks outside the cloud resource inventory. This hazard concerns another scenario: A GitHub repository contains infrastructure secrets but no Defender for Cloud DevOps Security connection exists for the organization.
Unreviewed automatic identity containment can lock out critical responders or disrupt legitimate service. This hazard concerns another scenario: A team adds a response playbook that disables a compromised identity automatically but has no approval or allowlist for privileged emergency accounts.
Deploying only one definition can omit controls that stakeholders believed were part of the initiative. This hazard concerns another scenario: A policy initiative groups several encryption and network requirements but the team assigns only one underlying definition.
A cloud security team finds the following condition: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane. What is the BEST next technical control?
Plan a supported private AKS cluster and private DNS or authorized network paths for administrators. This is the most direct response to: An Azure Kubernetes Service cluster has a publicly reachable Kubernetes API despite policy requiring a private control plane. The security mechanism is: AKS private cluster mode provides private endpoint access to the Kubernetes API server under supported configurations. Expected verification: The API endpoint is reached only through approved private paths and the public endpoint is unavailable as designed.
Validate Managed Instance network architecture, private address reachability and allowed subnets and ports. This is a valid action in another context: An Azure SQL Managed Instance requires internal connectivity, but its application attempts to use an ordinary public SQL server firewall rule.
Disable or restrict external ingress and configure supported identity-based outbound access to required services. This is a valid action in another context: An Azure Container App permits unauthenticated public ingress for an internal worker that only needs message-queue access.
Configure a customer-managed TDE protector in Key Vault with the necessary managed identity permissions. This is a valid action in another context: An Azure SQL database uses TDE but security policy requires control of the TDE protector key.
An operational security assessment discovers: A regional web application is overwhelmed by volumetric traffic and an engineer assumes WAF request rules alone prevent all network-layer attacks. Which hazard best describes the gap?
WAF filtering is not a complete substitute for network-layer DDoS mitigation. The current case is: A regional web application is overwhelmed by volumetric traffic and an engineer assumes WAF request rules alone prevent all network-layer attacks. The risk follows because: Azure DDoS Protection and WAF address different layers of an internet-facing application's attack surface. The appropriate mitigative action is: Evaluate the applicable Azure DDoS Protection coverage and service configuration alongside HTTP-level WAF controls.
Confusing security admin rules and NSG semantics can unintentionally override or fail to enforce segmentation. This hazard concerns another scenario: A network administrator uses Azure Virtual Network Manager security admin rules but assumes all NSGs are no longer evaluated.
ASG membership alone does not implement packet filtering and may create false confidence in segmentation. This hazard concerns another scenario: A security team expects an application security group to block all traffic after assigning VM NICs to the group but defines no NSG rules.
Firewall deployment without traffic steering does not guarantee egress inspection. This hazard concerns another scenario: An Azure Firewall is deployed but a workload egress connection bypasses it through an existing default route.
The team identifies this Azure security condition: A VM subnet has an NSG that allows inbound SSH from any internet address despite a requirement for administrative access from one jump subnet. What is the clearest consequence if it persists?
An allow rule with unrestricted source scope can expose management ports even when another NSG rule appears restrictive. The current case is: A VM subnet has an NSG that allows inbound SSH from any internet address despite a requirement for administrative access from one jump subnet. The risk follows because: Azure Network Security Groups evaluate prioritized inbound and outbound security rules using five-tuple flow matching. The appropriate mitigative action is: Replace the broad rule with a higher-priority narrowly scoped source rule and verify all lower-priority defaults.
A functioning private endpoint does not guarantee private connectivity if DNS resolution follows the public path. This hazard concerns another scenario: An Azure Storage account allows only private access but its application still resolves the blob hostname to the public service endpoint.
A route entry outside the subnet's effective routing context cannot force desired network traffic inspection. This hazard concerns another scenario: A team creates a user-defined route sending egress traffic toward a firewall but sees the default system route still used for a workload subnet.
A private endpoint for inbound access to an app does not by itself configure that app's outbound VNet integration. This hazard concerns another scenario: An App Service web app must privately reach a database in a VNet but an engineer creates a Private Endpoint for the web app instead.
The recommended technical control is: Protect designated emergency access accounts with controlled exclusions, monitoring and secure credential custody following a documented design. The triggering issue is: An emergency administration account is mistakenly targeted by a Conditional Access block policy that denies every administrator access during an outage. Which security principle BEST explains this decision?
Emergency access design balances resilient administrative access with monitoring and segregation from routine privileged identities. This principle explains why the control addresses: An emergency administration account is mistakenly targeted by a Conditional Access block policy that denies every administrator access during an outage. The recommended action is: Protect designated emergency access accounts with controlled exclusions, monitoring and secure credential custody following a documented design. Observable evidence: A supervised recovery exercise confirms emergency access works while the account's use generates high-priority audit signals.
Microsoft Entra app registration platform settings constrain legitimate OAuth redirect locations. This mechanism is associated with a different case: A developer configures redirect URIs for a production application using a broad wildcard and an untrusted host.
Microsoft Graph permission grants and Azure RBAC are distinct authorization planes with different scopes and resources. This mechanism is associated with a different case: An application has broad Graph permissions and a developer assumes its Azure subscription Reader role limits which directory records it can retrieve.
Privileged access governance includes periodic entitlement review in addition to just-in-time role activation. This mechanism is associated with a different case: A security review finds several eligible PIM assignments with no documented owner, end date or periodic reassessment.
The approved security action is: Deploy Azure Bastion on a supported virtual network and use authorized private management sessions to the VM. It addresses: A production VM must be administered without exposing RDP or SSH over a public IP address. Which observation BEST proves the outcome?
Administrators connect through the Bastion workflow while the VM has no direct public management port exposure. This observation demonstrates that the control meets the case: A production VM must be administered without exposing RDP or SSH over a public IP address. It validates the intended result of: Deploy Azure Bastion on a supported virtual network and use authorized private management sessions to the VM.
Port access is limited to approved source addresses and expires after the granted duration. That would be evidence for the separate situation: A team requires temporary VM management ports opened only during verified change windows, but an NSG continuously permits SSH from the internet.
Authorized client code decrypts selected fields while the database service observes protected ciphertext. That would be evidence for the separate situation: A database processes sensitive identifiers that must remain encrypted even from the SQL database engine.
Uploads work only for the intended container, permissions and expiration, and the account key is no longer shared. That would be evidence for the separate situation: A system distributes a storage account key to every contractor so they can upload one file each.
The response is: Enforce supported encrypted SQL client connections and validate certificate or TLS trust settings. Given the original problem: An application is protected by Azure SQL TDE but sends customer records over an unencrypted client connection. Which design principle is most applicable?
SQL transport encryption and TDE protect different stages of the database data lifecycle. This principle explains why the control addresses: An application is protected by Azure SQL TDE but sends customer records over an unencrypted client connection. The recommended action is: Enforce supported encrypted SQL client connections and validate certificate or TLS trust settings. Observable evidence: Client network inspection confirms authenticated TLS while stored database encryption remains enabled.
Azure SQL auditing tracks selected database events and writes records to supported centralized destinations. This mechanism is associated with a different case: An Azure SQL administrator enables auditing only for successful authentication but investigators need failed login and sensitive activity evidence.
Azure Bastion provides managed browser-based or native-client connectivity to VMs through private networking. This mechanism is associated with a different case: A production VM must be administered without exposing RDP or SSH over a public IP address.
Container workload security includes image assessment, runtime signals and cluster configuration posture checks. This mechanism is associated with a different case: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.
A cloud security team finds the following condition: A Conditional Access policy is created for administrators but left in report-only mode while the team assumes its grant controls are enforced. What is the BEST next technical control?
Review the policy state and evaluate report-only sign-in results before deliberately enabling enforcement for the intended scope. This is the most direct response to: A Conditional Access policy is created for administrators but left in report-only mode while the team assumes its grant controls are enforced. The security mechanism is: Conditional Access report-only mode evaluates outcomes without enforcing the grant and session controls. Expected verification: Representative sign-ins show policy enforcement in the intended population, not merely hypothetical report-only results.
Identify the scope and assign the least-privileged built-in role that grants the required network operations rather than broad subscription Owner. This is a valid action in another context: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group.
Use the correct public-client authentication flow and keep any confidential credentials only in trusted server components. This is a valid action in another context: A team registers a confidential client application but puts the client secret in a public single-page application bundle.
Review the requested delegated or application permission type and complete the consent process through authorized policy. This is a valid action in another context: A security engineer grants an application registration directory read permissions without obtaining the required administrator consent.
A security design review describes: A security team discovers malware scan results for storage objects but sends no alert to resource owners or remediation workflow. Which unresolved failure risk is MOST relevant?
A detection signal with no operational response may allow malicious files to remain accessible. The current case is: A security team discovers malware scan results for storage objects but sends no alert to resource owners or remediation workflow. The risk follows because: Cloud workload protection requires an actionable alerting and remediation process in addition to detection. The appropriate mitigative action is: Route supported Defender for Storage findings to the approved monitoring destination and response team.
Filtering or coverage gaps can cause security responders to underestimate the actual cloud asset estate. This hazard concerns another scenario: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope.
Threat detection cannot restore prevention guarantees lost through broad access keys or missing retention policies. This hazard concerns another scenario: An application team asks whether enabling Defender for Storage can replace its container access control and immutability requirements.
Overbroad incident automation can destroy response workflow visibility or incorrectly suppress active threats. This hazard concerns another scenario: A SOC automation rule should tag high-severity incidents but instead closes every incident before investigation.
After the team performs: Re-enable or replace the intended identity and reconcile role assignments against the active principal object identifier. the original issue remains: A virtual machine's system-assigned identity is disabled after a migration, but its old role assignments remain documented in runbooks. What evidence should confirm success?
The active VM can obtain its own token with only intended permissions, and obsolete principal references are removed. This observation demonstrates that the control meets the case: A virtual machine's system-assigned identity is disabled after a migration, but its old role assignments remain documented in runbooks. It validates the intended result of: Re-enable or replace the intended identity and reconcile role assignments against the active principal object identifier.
Authorized staff can view permitted resources in child subscriptions but cannot change policy or network settings. That would be evidence for the separate situation: A central team needs read-only security posture visibility across a management group without modifying any descendant subscriptions.
A newly obtained token has the intended audience and delegated scope and the API authorizes the operation. That would be evidence for the separate situation: A web API publishes an OAuth scope but an authorized client repeatedly receives insufficient-scope errors.
A sample activation is blocked until approved verification is satisfied and produces auditable activation history. That would be evidence for the separate situation: A privileged directory role is eligible in PIM but the user can activate it without an MFA check or justification.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
