AZ-900 Azure Identity and Security 3 — Questions and Answers
Question 1: What is the core principle of the Zero Trust security model?
- Never trust, always verify (Correct answer)
- Trust everything inside the network
- Encrypt only external traffic
- Allow all internal connections
Correct answer: Never trust, always verify
Zero Trust assumes breach and verifies every request as though it originates from an untrusted network.
Question 2: Which Azure feature provides centralized, secure storage for secrets, keys, and certificates?
- Azure Key Vault (Correct answer)
- Azure Monitor
- Azure Advisor
- Azure Blueprints
Correct answer: Azure Key Vault
Azure Key Vault securely stores and manages secrets, encryption keys, and certificates.
Question 3: What allows an Azure resource like a VM to authenticate to other services without storing credentials in code?
- Managed identities (Correct answer)
- Access keys
- Connection strings
- SAS tokens
Correct answer: Managed identities
Managed identities let Azure resources authenticate to services automatically without managing credentials.
Question 4: Which concept describes one of the three pillars of Zero Trust regarding limiting user access?
- Use least privilege access (Correct answer)
- Grant broad permissions
- Disable authentication
- Trust by default
Correct answer: Use least privilege access
Least privilege access grants users only the permissions they need to perform their tasks.
Question 5: What defense strategy uses multiple layers of security controls throughout an environment?
- Defense in depth (Correct answer)
- Single point defense
- Perimeter-only security
- Open access model
Correct answer: Defense in depth
Defense in depth applies layered security controls so that if one layer fails, others still protect resources.
Question 6: In the defense in depth model, which layer focuses on controlling access to applications and data through identity?
- Identity and access layer (Correct answer)
- Physical security layer
- Perimeter layer
- Network layer
Correct answer: Identity and access layer
The identity and access layer ensures only authenticated and authorized users reach resources.
Question 7: Which principle assumes that a breach has already occurred and limits its impact through segmentation?
- Assume breach (Correct answer)
- Trust internal traffic
- Single firewall reliance
- No monitoring needed
Correct answer: Assume breach
'Assume breach' is a Zero Trust principle that minimizes blast radius through segmentation and verification.
AZ-900 Azure Identity and Security 3
What is the core principle of the Zero Trust security model?