AZ-301 Risk Assessment & Management 4 — Questions and Answers
Question 1: A company performs a risk assessment and determines that their Azure workloads face significant DDoS risk. Which Azure service provides adaptive DDoS mitigation with attack analytics and telemetry?
- Azure Firewall Standard
- Azure DDoS Protection Standard (Correct answer)
- Azure Front Door WAF
- Network Security Groups (NSGs)
Correct answer: Azure DDoS Protection Standard
Azure DDoS Protection Standard provides adaptive tuning, attack mitigation reports, and telemetry specifically designed to counter volumetric DDoS attacks.
Question 2: An organization's risk policy requires that all privileged Azure AD role assignments be time-limited. Which Azure AD feature enforces just-in-time privileged access to reduce standing access risk?
- Conditional Access Policies
- Azure AD Privileged Identity Management (PIM) (Correct answer)
- Azure AD Identity Protection
- Multi-Factor Authentication (MFA)
Correct answer: Azure AD Privileged Identity Management (PIM)
Azure AD PIM provides just-in-time privileged access, requiring users to activate roles for a limited time, reducing the risk from persistent privileged accounts.
Question 3: A risk register entry states: 'Risk of using deprecated TLS versions on Azure App Service.' Which Azure Policy built-in initiative directly addresses this risk?
- CIS Microsoft Azure Foundations Benchmark
- Azure Security Benchmark – Restrict minimum TLS version (Correct answer)
- NIST SP 800-53 Rev 5
- PCI DSS v3.2.1
Correct answer: Azure Security Benchmark – Restrict minimum TLS version
The Azure Security Benchmark includes a built-in policy to enforce minimum TLS versions on App Service, directly mitigating deprecated protocol risk.
Question 4: During a risk assessment workshop, your team identifies that Azure Logic Apps could be exploited to exfiltrate data via connectors. What is the BEST control to mitigate this risk?
- Disable all Logic Apps connectors
- Use ISE (Integration Service Environment) with private endpoints and restrict connector use via Azure Policy (Correct answer)
- Encrypt Logic App workflows at rest
- Enable Azure Monitor diagnostics
Correct answer: Use ISE (Integration Service Environment) with private endpoints and restrict connector use via Azure Policy
Deploying Logic Apps in an ISE with private endpoints isolates them from the public internet, and Azure Policy can restrict which connectors are permitted.
Question 5: A risk assessment requires you to categorize residual risk after applying controls. If a risk has a likelihood of Medium and an impact of High after controls, how should it be treated?
- Accept it as residual risk
- Escalate it and apply additional controls to reduce it further (Correct answer)
- Transfer it to cyber insurance only
- Eliminate the workload
Correct answer: Escalate it and apply additional controls to reduce it further
A Medium × High residual risk typically falls into the 'High' zone on a risk matrix and requires escalation and additional control investment, not acceptance.
Question 6: An architect designing an Azure solution must assess the risk of certificate expiration causing service outages. Which Azure service automates certificate lifecycle management to mitigate this risk?
- Azure Key Vault Certificates with auto-renewal (Correct answer)
- Azure App Service Managed Certificates (manual only)
- Azure DNS with DNSSEC
- Azure Traffic Manager
Correct answer: Azure Key Vault Certificates with auto-renewal
Azure Key Vault Certificates support automatic renewal with configured issuers, eliminating the manual processes that lead to expiration risk.
Question 7: A company's cloud risk assessment identifies 'configuration drift' — where Azure resources deviate from their secure baseline — as an ongoing risk. Which tool continuously evaluates and can auto-remediate drift?
- Azure Resource Graph
- Azure Automation State Configuration (DSC) (Correct answer)
- Azure Cost Management
- Azure Service Map
Correct answer: Azure Automation State Configuration (DSC)
Azure Automation State Configuration uses PowerShell DSC to continuously assess and remediate configuration drift on Azure VMs and servers.
AZ-301 Risk Assessment & Management 4
A company performs a risk assessment and determines that their Azure workloads face significant DDoS risk.
Which Azure service provides adaptive DDoS mitigation with attack analytics and telemetry?