AZ-900 - Microsoft Azure Fundamentals Azure Identity and Security Questions and Answers 1 — Questions and Answers
Question 1: A company wants to enhance the security of its user sign-ins to Azure services. They require users to provide a second form of verification, such as a code from their mobile phone, in addition to their password. Which Azure service should they implement to meet this requirement?
- Azure Policy
- Microsoft Entra ID Multi-Factor Authentication (MFA) (Correct answer)
- Azure Key Vault
- Azure Role-Based Access Control (RBAC)
Correct answer: Microsoft Entra ID Multi-Factor Authentication (MFA)
Microsoft Entra ID Multi-Factor Authentication (MFA) provides an additional layer of security during user sign-in by requiring a second form of verification. This helps protect against unauthorized access, even if a user's password is compromised.
Question 2: Which security concept involves implementing a series of mechanisms that are layered to protect data and resources, so that if one layer is breached, subsequent layers are already in place to prevent further exposure?
- Role-Based Access Control (RBAC)
- Least Privilege Principle
- Defense in Depth (Correct answer)
- Shared Responsibility Model
Correct answer: Defense in Depth
Defense in Depth is a security strategy that uses multiple layers of security controls to protect resources. The idea is that if one security control fails, another layer of defense will be in place to stop an attack.
Question 3: Which of the following is the primary purpose of Azure Role-Based Access Control (RBAC)?
- To encrypt secrets, keys, and certificates used by applications.
- To enforce organizational standards and assess compliance for resources.
- To filter network traffic to and from Azure resources in a virtual network.
- To manage who has access to Azure resources, what they can do with them, and what areas they can access. (Correct answer)
Correct answer: To manage who has access to Azure resources, what they can do with them, and what areas they can access.
Azure RBAC is an authorization system used to manage access to Azure resources. It allows you to grant specific permissions to users, groups, and services at a defined scope, ensuring they have only the access needed to perform their jobs.
Question 4: An organization wants a unified security management system that provides security posture recommendations and threat protection for their workloads running in Azure, on-premises, and in other clouds. Which Azure service provides these capabilities?
- Azure Monitor
- Microsoft Sentinel
- Microsoft Defender for Cloud (Correct answer)
- Azure Firewall
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud is a solution for cloud security posture management (CSPM) and cloud workload protection (CWPP). It identifies weaknesses across cloud configurations, helps strengthen the security posture, and protects workloads in multi-cloud and hybrid environments from threats.
Question 5: What is the primary function of Azure Key Vault?
- To provide a second layer of authentication for user sign-ins.
- To securely store and manage access to secrets, keys, and certificates. (Correct answer)
- To distribute network traffic across multiple servers to improve availability.
- To provide a private, isolated section of the Azure cloud for networking.
Correct answer: To securely store and manage access to secrets, keys, and certificates.
Azure Key Vault is a cloud service for securely storing and accessing secrets, such as API keys, passwords, certificates, or cryptographic keys. It centralizes the management of this sensitive information, enhancing security and control.
Question 6: An administrator needs to ensure that all newly created virtual machines in a specific subscription are of an allowed size (SKU) to control costs. Which Azure service can be used to enforce this rule?
- Azure Role-Based Access Control (RBAC)
- Azure Monitor
- Microsoft Defender for Cloud
- Azure Policy (Correct answer)
Correct answer: Azure Policy
Azure Policy is a service that allows you to create, assign, and manage policies to enforce organizational rules and standards for Azure resources. It can be used to restrict which VM SKUs can be deployed, ensuring compliance with cost management goals.
AZ-900 - Microsoft Azure Fundamentals Azure Identity and Security Questions and Answers 1
A company wants to enhance the security of its user sign-ins to Azure services.
They require users to provide a second form of verification, such as a code from their mobile phone, in addition to their password.
Which Azure service should they implement to meet this requirement?