You save $69.98
The approved security action is: Check plan and regional VNet integration support and select a supported hosting configuration. It addresses: A Function app needs outbound connectivity to a private Azure SQL endpoint but its current hosting plan lacks the required networking capability. Which observation BEST proves the outcome?
The Function resolves the private SQL hostname and establishes an authorized connection through integrated networking. This observation demonstrates that the control meets the case: A Function app needs outbound connectivity to a private Azure SQL endpoint but its current hosting plan lacks the required networking capability. It validates the intended result of: Check plan and regional VNet integration support and select a supported hosting configuration.
Packet flow follows the intended supported path without blackholing the service's private address. That would be evidence for the separate situation: An administrator tries to force all Private Link traffic through a centralized firewall without checking supported subnet network policies and effective routes.
A request succeeds only to expected trusted backend identities and fails for an invalid certificate chain. That would be evidence for the separate situation: A cloud API uses end-to-end HTTPS, but Application Gateway has no validation of the backend server certificate.
The hub's route intent and traffic flow show required branch egress traversing its inspection service. That would be evidence for the separate situation: A Virtual WAN branch sends internet traffic through its ordinary virtual hub while the design mandates centralized cloud security inspection.
An operational security assessment discovers: A third-party SaaS app requests tenant-wide consent for an unrelated set of privileged directory operations. Which hazard best describes the gap?
Blind tenant-wide administrator consent can grant an external application access beyond the intended business function. The current case is: A third-party SaaS app requests tenant-wide consent for an unrelated set of privileged directory operations. The risk follows because: Enterprise application consent policies are security gates for delegated and app-only access to protected APIs. The appropriate mitigative action is: Review application publisher, requested scopes, risk and authorized tenant consent settings before granting access.
Broad permanent external access increases attack surface after the scoped troubleshooting task has ended. This hazard concerns another scenario: A security analyst grants an external consultant permanent access to all resource groups to troubleshoot one VM.
Applying interactive MFA prompts to unattended service principals can interrupt automation without creating a working protection. This hazard concerns another scenario: A team wants to enforce MFA for cloud administration but excludes service principals by treating them as ordinary interactive users.
Relying on a deleted system-assigned principal can break external access grants when the resource is recreated. This hazard concerns another scenario: A virtual machine uses a system-assigned managed identity, and its rebuild removes the identity used by several dependent applications.
The approved security action is: Configure supported immutable blob storage with time-based retention or legal hold according to governance. It addresses: A regulated archive requires that retained records cannot be changed before their approved retention period ends. Which observation BEST proves the outcome?
Attempts to delete or overwrite protected records before retention expiry fail under an authorized test. This observation demonstrates that the control meets the case: A regulated archive requires that retained records cannot be changed before their approved retention period ends. It validates the intended result of: Configure supported immutable blob storage with time-based retention or legal hold according to governance.
An authorized upload succeeds within the window, and unrelated deletion or post-expiry access fails. That would be evidence for the separate situation: A temporary blob SAS grants read, write, list and delete access for one year when the use case requires one-hour upload only.
Authorized applications continue parameterized queries and decrypt intended columns with new key metadata. That would be evidence for the separate situation: A customer uses Azure SQL Always Encrypted but rotates column keys without coordinating the dependent application driver and metadata.
Only the authorized build job pushes the required repository and production deployments use approved digests. That would be evidence for the separate situation: A build pipeline pushes unapproved image tags into a production Container Registry because all jobs share a registry push token.
An Azure engineer proposes: Check onboarding, plan, subscriptions and inventory filters before concluding the virtual machines are unmanaged. In the case: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope. What underlying mechanism justifies the action?
Defender for Cloud posture coverage depends on enabled scopes, connectors and asset discovery paths. This principle explains why the control addresses: An infrastructure team finds new virtual machines in Azure Resource Graph but none appear in the expected Defender for Cloud security posture scope. The recommended action is: Check onboarding, plan, subscriptions and inventory filters before concluding the virtual machines are unmanaged. Observable evidence: Inventory and security findings consistently include the intended new VMs after configuration correction.
Azure Policy assignments associate policy definitions or initiatives with evaluation scope and enforcement settings. This mechanism is associated with a different case: An Azure administrator wants to prevent new publicly accessible storage accounts but only creates an Azure Policy definition without an assignment.
Regulatory compliance configuration governs which controls are evaluated and shown in Defender for Cloud. This mechanism is associated with a different case: An Azure administrator considers changing cloud security standards without evaluating how noncompliance results and secure score will change.
Sentinel data-source design should consider duplicate ingestion and correlation across multiple connectors. This mechanism is associated with a different case: A Defender for Cloud alert is forwarded into Sentinel but the SOC cannot distinguish it from a duplicate alert created by a parallel custom connector.
A security design review describes: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring. Which unresolved failure risk is MOST relevant?
Short-lived containers can disappear before investigators capture evidence when monitoring is not enabled. The current case is: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring. The risk follows because: Container security monitoring must preserve workload logs and relevant control-plane events across ephemeral lifecycles. The appropriate mitigative action is: Configure supported diagnostic settings, logging destinations and Defender coverage for the running container workload.
Assuming customer-managed keys and infrastructure double encryption are identical can miss a specific security requirement. This hazard concerns another scenario: A compliance requirement demands an additional independent infrastructure encryption layer for sensitive Azure Storage data.
Hard-coded SQL credentials increase secret exposure and complicate credential revocation or rotation. This hazard concerns another scenario: A development team stores SQL authentication passwords in deployment files despite having Microsoft Entra identities for application services.
Guess-resistant URLs are not an authorization boundary for published API operations. This hazard concerns another scenario: An API Management instance exposes backend administrative APIs to all callers, and one team proposes relying only on endpoint obscurity.
An Azure security engineer investigates: A database processes sensitive identifiers that must remain encrypted even from the SQL database engine. Which action most directly addresses this requirement?
Use Always Encrypted with supported client drivers and managed column keys where appropriate. This is the most direct response to: A database processes sensitive identifiers that must remain encrypted even from the SQL database engine. The security mechanism is: Always Encrypted separates sensitive column encryption keys from the database engine for supported applications. Expected verification: Authorized client code decrypts selected fields while the database service observes protected ciphertext.
Plan supported column encryption key rotation and client compatibility validation before deployment. This is a valid action in another context: A customer uses Azure SQL Always Encrypted but rotates column keys without coordinating the dependent application driver and metadata.
Implement approved API access, subscription or identity policies and network restrictions appropriate to the API tier. This is a valid action in another context: An API Management instance exposes backend administrative APIs to all callers, and one team proposes relying only on endpoint obscurity.
Apply appropriate resource locks, authorization separation and immutable or protected backup settings where supported. This is a valid action in another context: A backup operator can disable storage soft delete and permanently remove recovery data without independent approval.
After the team performs: Replace shared account keys with appropriately restricted user delegation SAS or identity-based authorization where supported. the original issue remains: A system distributes a storage account key to every contractor so they can upload one file each. What evidence should confirm success?
Uploads work only for the intended container, permissions and expiration, and the account key is no longer shared. This observation demonstrates that the control meets the case: A system distributes a storage account key to every contractor so they can upload one file each. It validates the intended result of: Replace shared account keys with appropriately restricted user delegation SAS or identity-based authorization where supported.
Production applications continue operating using approved credentials and the compromised key is no longer accepted. That would be evidence for the separate situation: A storage account's access key may have leaked into a support ticket while production apps still depend on both key slots.
The worker consumes the expected queue privately while internet-origin HTTP requests are not accepted. That would be evidence for the separate situation: An Azure Container App permits unauthenticated public ingress for an internal worker that only needs message-queue access.
Calls from unauthorized identities are denied while approved requests reach only intended operations. That would be evidence for the separate situation: An API Management instance exposes backend administrative APIs to all callers, and one team proposes relying only on endpoint obscurity.
The team identifies this Azure security condition: A development team stores SQL authentication passwords in deployment files despite having Microsoft Entra identities for application services. What is the clearest consequence if it persists?
Hard-coded SQL credentials increase secret exposure and complicate credential revocation or rotation. The current case is: A development team stores SQL authentication passwords in deployment files despite having Microsoft Entra identities for application services. The risk follows because: Azure SQL supports Microsoft Entra authentication and database authorization separately from SQL logins. The appropriate mitigative action is: Configure Microsoft Entra authentication for Azure SQL and grant appropriate contained database users or roles.
Sharing the ACR admin credential removes granular attribution and can permit unintended image mutation. This hazard concerns another scenario: A container registry allows image pulls using its broad administrator credential, shared across several unrelated clusters.
Transparent Data Encryption alone allows the SQL engine to process plaintext column values during queries. This hazard concerns another scenario: A database processes sensitive identifiers that must remain encrypted even from the SQL database engine.
A healthy deployment state does not imply container images or host packages are free of known vulnerabilities. This hazard concerns another scenario: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.
A cloud security team finds the following condition: A GitHub repository contains infrastructure secrets but no Defender for Cloud DevOps Security connection exists for the organization. What is the BEST next technical control?
Configure the supported Defender DevOps Security connector with authorized GitHub organization and repository permissions. This is the most direct response to: A GitHub repository contains infrastructure secrets but no Defender for Cloud DevOps Security connection exists for the organization. The security mechanism is: Defender for Cloud DevOps Security connectors integrate supported source-control environments for security posture insights. Expected verification: Approved repository findings appear with the correct repository identity and actionable ownership.
Use Defender for Cloud recommendations and inventory filters to resolve each finding to the actual resource. This is a valid action in another context: A subscription shows many security recommendations but engineers cannot find which virtual machines are affected.
Scope the intended protection plans and validate feature readiness and operational ownership for each subscription. This is a valid action in another context: A Defender for Cloud plan change is approved for one subscription but is rolled out to every subscription without reviewing cost and service dependencies.
Configure supported Key Vault network access or Private Endpoint settings and the required application identity permissions. This is a valid action in another context: An Azure Key Vault is placed behind a firewall but its application still accesses a public endpoint without an approved network rule.
An Azure security engineer investigates: A web application is vulnerable to HTTP request injection, but the team deploys only a Layer 3 and Layer 4 Azure Firewall network rule. Which action most directly addresses this requirement?
Place a Web Application Firewall policy on a supported HTTP entry point and evaluate request-inspection controls. This is the most direct response to: A web application is vulnerable to HTTP request injection, but the team deploys only a Layer 3 and Layer 4 Azure Firewall network rule. The security mechanism is: Azure Web Application Firewall applies HTTP-level security rules through supported services such as Application Gateway and Front Door. Expected verification: A controlled malicious HTTP request matches the intended WAF policy and is logged while valid traffic proceeds.
Reference the Application Security Group in an effective NSG rule with the required source, destination and port conditions. This is a valid action in another context: A security team expects an application security group to block all traffic after assigning VM NICs to the group but defines no NSG rules.
Configure supported gateway transit and remote gateway usage on the appropriate peering links. This is a valid action in another context: A hub-spoke virtual network peering is established, but spokes attempt to use a hub VPN gateway without gateway transit settings.
Configure a supported Azure Front Door endpoint and WAF policy with secured origin access. This is a valid action in another context: A globally distributed website suffers high latency and needs edge-based TLS, intelligent routing and an HTTP WAF.
A security design review describes: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record. Which unresolved failure risk is MOST relevant?
Uncontrolled policy exemptions can become permanent bypasses of baseline cloud security requirements. The current case is: A security team creates a policy exemption for one temporary production incompatibility with no expiration or approval record. The risk follows because: Azure Policy exemptions document exceptions to assigned policy compliance at selected scopes. The appropriate mitigative action is: Create a scoped, time-limited exemption with justification, owner and review evidence under approved governance.
A policy definition that is never assigned does not actively govern resource deployments. This hazard concerns another scenario: An Azure administrator wants to prevent new publicly accessible storage accounts but only creates an Azure Policy definition without an assignment.
Failed or unauthorized scans must not be interpreted as a passed vulnerability assessment. This hazard concerns another scenario: A vulnerability assessment on a VM fails repeatedly because the required identity or service permissions are missing.
Azure subscription onboarding alone does not grant visibility into an unrelated AWS account. This hazard concerns another scenario: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (523 Questions, Last Updated on Nov 9, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
