AZ-301 Identity & Security Solutions 2

Question 1

An architect is designing a solution where encryption keys must be managed by the customer and stored on-premises, never uploaded to Azure.
Which Azure storage encryption option supports this requirement?

Accepted Answer

Customer-provided keys (SSE-C)

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Customer-managed keys in Azure Key Vault

Answer

Azure Disk Encryption

Question 2

A financial company needs to detect and prevent sensitive data (PII, credit card numbers) from leaving their Azure environment via emails or uploads. Which Azure service provides this Data Loss Prevention capability?

Accepted Answer

Microsoft Purview (Information Protection)

Answer

Microsoft Defender for Cloud

Answer

Azure Security Center

Answer

Azure Sentinel

Question 3

An architect needs to implement network micro-segmentation within an Azure virtual network to control traffic between individual VMs without using separate subnets. Which feature enables this?

Accepted Answer

Application Security Groups

Answer

Network Security Groups

Answer

Azure Firewall

Answer

Service Endpoints

Question 4

A company requires that all Azure virtual machine OS and data disks are encrypted using customer-managed keys stored in Azure Key Vault. Which service provides this OS-level disk encryption?

Accepted Answer

Azure Disk Encryption (ADE)

Answer

Storage Service Encryption

Answer

Azure Confidential Computing

Answer

BitLocker with platform-managed keys

Question 5

An architect is designing a security solution for Azure and needs centralized threat detection, security alerts, and automated response across all Azure subscriptions. Which service provides a SIEM/SOAR solution?

Accepted Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Answer

Azure Security Benchmark

Question 6

When designing a secure API solution, an architect needs to validate OAuth 2.0 tokens and enforce scope-based authorization at the API gateway level. Which Azure service provides this capability natively?

Accepted Answer

Azure API Management with OAuth 2.0 policy

Answer

Azure Active Directory B2C

Answer

Azure Application Gateway with rewrite rules

Answer

Azure Front Door with custom rules