AZ-301 Risk Assessment & Management 5 — Questions and Answers
Question 1: An organization is using the FAIR (Factor Analysis of Information Risk) model in their Azure risk assessment. FAIR primarily focuses on quantifying risk in terms of:
- Compliance gaps against regulatory frameworks
- Probable frequency and probable magnitude of loss in financial terms (Correct answer)
- Control maturity scores across NIST domains
- Threat actor profiles and attack vectors
Correct answer: Probable frequency and probable magnitude of loss in financial terms
FAIR quantifies risk by estimating the probable frequency of loss events and the probable magnitude of financial loss, enabling data-driven risk prioritization.
Question 2: A risk assessment identifies that an Azure subscription has excessive Owner role assignments, violating least-privilege principles. Which Azure tool provides a report of over-provisioned permissions to guide remediation?
- Azure Cost Management
- Azure AD Access Reviews
- Microsoft Defender for Cloud – Identity Recommendations (Correct answer)
- Azure Policy compliance report
Correct answer: Microsoft Defender for Cloud – Identity Recommendations
Microsoft Defender for Cloud provides identity and access recommendations that flag over-provisioned permissions including excessive Owner assignments.
Question 3: A multi-tenant SaaS company on Azure needs to assess the risk of one tenant accessing another tenant's data. Which Azure architecture pattern BEST mitigates this data isolation risk?
- Shared database with row-level security only
- Separate Azure subscriptions per tenant with dedicated databases (Correct answer)
- Use Azure AD B2C for all tenants
- Implement shared App Service Plans
Correct answer: Separate Azure subscriptions per tenant with dedicated databases
Separate subscriptions and dedicated databases per tenant provide strong isolation boundaries, reducing cross-tenant data access risk to near-zero.
Question 4: During an Azure risk assessment, the team must distinguish between inherent risk and residual risk. Residual risk is BEST defined as:
- The risk that exists before any controls are applied
- The risk remaining after security controls have been implemented (Correct answer)
- The risk transferred to a third party via insurance
- The risk accepted by executive management formally
Correct answer: The risk remaining after security controls have been implemented
Residual risk is the level of risk that remains after all planned security controls have been applied to an inherent risk.
Question 5: A financial institution requires that all Azure resource changes be tracked with full audit trails to satisfy risk and compliance requirements. Which service provides an immutable log of all control-plane operations?
- Azure Monitor Metrics
- Azure Activity Log (Correct answer)
- Azure Resource Graph
- Azure Advisor
Correct answer: Azure Activity Log
Azure Activity Log records all control-plane operations (who did what, when) and can be retained and exported to provide immutable audit trails.
Question 6: An architect must recommend a risk treatment option for an Azure workload where the residual risk is too high to accept but the cost of additional controls exceeds the risk value. What is the MOST appropriate treatment?
- Risk avoidance — decommission the workload
- Risk transfer — purchase cyber liability insurance (Correct answer)
- Risk acceptance — document and monitor with compensating controls
- Risk reduction — implement all available controls regardless of cost
Correct answer: Risk transfer — purchase cyber liability insurance
When control costs exceed risk value, risk transfer (e.g., cyber insurance) shifts the financial impact of the risk to a third party, which is the appropriate treatment.
Question 7: A company's Azure risk assessment flags that secrets are being stored in Azure DevOps pipeline variables in plain text. Which combination BEST mitigates this secret exposure risk?
- Use secret pipeline variables with Azure DevOps variable groups only
- Reference secrets from Azure Key Vault in pipelines using Key Vault task or variable groups linked to Key Vault (Correct answer)
- Store secrets in Azure Blob Storage with SAS tokens
- Encode secrets in Base64 within pipeline YAML
Correct answer: Reference secrets from Azure Key Vault in pipelines using Key Vault task or variable groups linked to Key Vault
Linking Azure DevOps variable groups to Azure Key Vault ensures secrets are fetched at runtime from a secure vault rather than stored in plain text in pipelines.
AZ-301 Risk Assessment & Management 5
An organization is using the FAIR (Factor Analysis of Information Risk) model in their Azure risk assessment.
FAIR primarily focuses on quantifying risk in terms of: