AZ-301 Risk Assessment & Management 3 — Questions and Answers
Question 1: A healthcare organization must perform a risk assessment before migrating to Azure. Which Azure document describes the shared responsibility model that defines Microsoft's vs. the customer's risk obligations?
- Azure SLA Agreement
- Azure Shared Responsibility documentation
- Azure Trust Center / Service Trust Portal (Correct answer)
- Azure Compliance Manager
Correct answer: Azure Trust Center / Service Trust Portal
The Azure Service Trust Portal (trust.microsoft.com) hosts compliance documentation including the shared responsibility model and audit reports.
Question 2: An architect is performing threat modeling for an Azure-hosted web application. Which Microsoft methodology is specifically designed for structuring threat identification in application design?
- DREAD
- STRIDE (Correct answer)
- PASTA
- OCTAVE
Correct answer: STRIDE
STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is Microsoft's threat modeling methodology used in Azure design.
Question 3: A company's risk assessment indicates that insider threats are a significant concern for their Azure environment. Which Azure feature provides behavioral analytics to detect anomalous internal user activity?
- Azure Firewall Premium
- Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) (Correct answer)
- Azure AD Password Protection
- Azure DDoS Protection Standard
Correct answer: Microsoft Sentinel with User and Entity Behavior Analytics (UEBA)
Microsoft Sentinel's UEBA feature creates behavioral baselines and flags anomalous activities by insiders that deviate from normal patterns.
Question 4: During risk quantification, a team needs to calculate the Annual Loss Expectancy (ALE) for an Azure workload. ALE is calculated as:
- Asset Value × Exposure Factor
- Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO) (Correct answer)
- Risk Impact × Risk Probability × Control Effectiveness
- Threat Likelihood × Vulnerability Score
Correct answer: Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)
ALE = SLE × ARO, where SLE is the loss from a single incident and ARO is how often the incident is expected per year.
Question 5: An organization wants to reduce the risk of Azure subscription sprawl and uncontrolled resource creation. Which management hierarchy feature enforces governance across multiple subscriptions?
- Azure Resource Groups
- Azure Management Groups with Azure Policy (Correct answer)
- Azure Active Directory Tenants
- Azure DevOps Organizations
Correct answer: Azure Management Groups with Azure Policy
Azure Management Groups allow you to apply Azure Policy and RBAC across multiple subscriptions, enforcing consistent governance to control sprawl risk.
Question 6: A risk assessment identifies that data exfiltration via Azure Storage is a high risk. Which Azure network control BEST prevents data from leaving the trusted network boundary?
- Azure Storage soft-delete
- Azure Private Endpoints with network policies
- Storage Account firewall with selected virtual networks (Correct answer)
- Azure Content Delivery Network
Correct answer: Storage Account firewall with selected virtual networks
Azure Storage firewall configured with selected virtual networks restricts access so that storage traffic stays within the trusted network, mitigating exfiltration risk.
Question 7: An architect must assess the impact of a potential Azure region outage on a mission-critical application. What is the PRIMARY metric used to quantify the acceptable data loss risk?
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO) (Correct answer)
- Mean Time Between Failures (MTBF)
- Service Level Agreement (SLA) percentage
Correct answer: Recovery Point Objective (RPO)
RPO defines the maximum acceptable amount of data loss measured in time, directly quantifying the data loss risk from an outage.
AZ-301 Risk Assessment & Management 3
A healthcare organization must perform a risk assessment before migrating to Azure.
Which Azure document describes the shared responsibility model that defines Microsoft's vs. the customer's risk obligations?