AZ-301 Risk Assessment & Management 2 — Questions and Answers
Question 1: A financial services company needs to assess the risk of storing sensitive customer data in Azure Blob Storage. Which Azure service provides continuous compliance assessment and security score?
- Azure Policy
- Microsoft Defender for Cloud (Correct answer)
- Azure Monitor
- Azure Advisor
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a continuous security assessment with a Secure Score that tracks your compliance posture and identifies risks.
Question 2: An architect is designing a risk management strategy for an Azure deployment. Which framework does Microsoft recommend for evaluating cloud risks aligned with industry standards?
- ITIL v4
- Cloud Adoption Framework (CAF) (Correct answer)
- Azure DevOps Risk Matrix
- Azure Resource Manager Templates
Correct answer: Cloud Adoption Framework (CAF)
Microsoft's Cloud Adoption Framework (CAF) includes governance and risk management guidance aligned with industry standards for Azure deployments.
Question 3: A company wants to ensure that only compliant Azure resources are deployed. Which Azure feature allows you to define rules that evaluate resource properties against business requirements?
- Azure Blueprints
- Azure Policy (Correct answer)
- Azure RBAC
- Azure Resource Locks
Correct answer: Azure Policy
Azure Policy defines and enforces rules that evaluate resource properties to ensure they meet organizational compliance and risk standards.
Question 4: During a risk assessment, a team identifies that a critical VM could be unavailable due to Azure datacenter failure. What is the BEST architecture mitigation for this availability risk?
- Enable Azure Backup on the VM
- Deploy VMs across Availability Zones (Correct answer)
- Use Azure Monitor alerts
- Enable Accelerated Networking
Correct answer: Deploy VMs across Availability Zones
Deploying VMs across Availability Zones distributes them across physically separate datacenters, protecting against single-datacenter failures.
Question 5: An organization's risk register identifies unauthorized access to Azure Key Vault secrets as a high-risk item. Which control BEST mitigates this risk?
- Enable soft-delete on Key Vault
- Use Key Vault firewall and virtual network service endpoints (Correct answer)
- Enable diagnostic logging
- Configure Key Vault with geo-redundant storage
Correct answer: Use Key Vault firewall and virtual network service endpoints
Key Vault firewall and virtual network service endpoints restrict access to Key Vault to specific trusted networks, directly mitigating unauthorized access risk.
Question 6: A risk assessment identifies that accidental deletion of Azure SQL Database is a critical threat. Which TWO features should be implemented to mitigate this risk? (Choose the answer that represents both.)
- Enable geo-replication only
- Enable Azure Defender for SQL and configure long-term backup retention
- Apply a resource lock (CanNotDelete) and enable Point-in-Time Restore (Correct answer)
- Use Azure Policy and enable TDE
Correct answer: Apply a resource lock (CanNotDelete) and enable Point-in-Time Restore
A CanNotDelete resource lock prevents accidental deletion, while Point-in-Time Restore enables recovery if deletion does occur despite the lock.
Question 7: Which Azure tool generates a risk assessment report tailored to your specific cloud environment, helping organizations understand their security posture relative to the Azure Security Benchmark?
- Azure Advisor
- Microsoft Defender for Cloud (Regulatory Compliance dashboard) (Correct answer)
- Azure Service Health
- Azure Monitor Workbooks
Correct answer: Microsoft Defender for Cloud (Regulatory Compliance dashboard)
Microsoft Defender for Cloud's Regulatory Compliance dashboard maps your environment against benchmarks like Azure Security Benchmark, generating risk assessment insights.
AZ-301 Risk Assessment & Management 2
A financial services company needs to assess the risk of storing sensitive customer data in Azure Blob Storage.
Which Azure service provides continuous compliance assessment and security score?