Free Microsoft Azure Security Engineer Certification Questions and Answers — Questions and Answers
Question 1: To determine whether it is accurate, you must take into account the underlined portion. <br>
You are in charge of making a unique subscription for every section of your business. The subscriptions will, however, all be connected to a single Azure Active tenant for Azure Active Directory. <br>
Make sure that the roles assigned to each subscription are the same. <br>
You use Privileged Identity Management (PIM) for Azure AD. <br>
In the event that the underlined part is accurate, choose ""No adjustment required."" Choose the accurate answer if the underlined portion is accurate.
- Azure DevOps
- No adjustment required (Correct answer)
- Azure Blueprints
- Conditional access policies
Correct answer: No adjustment required
The statement is accurate. Azure AD Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources across Azure AD, Azure, and other Microsoft Online Services. While PIM primarily manages Azure AD roles, it can also extend to Azure resource roles at the subscription level, providing just-in-time access and enforcing review processes. This capability helps ensure consistent and secure role assignments across multiple subscriptions within a single tenant.
Question 2: The Azure subscription for your business includes a virtual network with a single subnet set up. <br>
For the subnet, which has an Azure virtual machine with Ubuntu Server 18.04 installed, you have defined a service endpoint. <br>
To install Docker containers on the virtual computer, you are getting ready. The containers must be able to use Azure Storage resources and Azure via the service endpoint, SQL databases. <br>
Before deploying containers, a task must be completed on the virtual machine. <br>
Installing the container network interface (CNI) plug-in is the solution. <br>
Is the aim being met by the solution?
- Yes (Correct answer)
- No
- Maybe
Correct answer: Yes
The Container Network Interface (CNI) plug-in is crucial for enabling network connectivity for Docker containers on a Linux virtual machine. By installing the CNI plug-in, containers can leverage the underlying virtual network's configuration, including the service endpoint. This allows the containers to securely access Azure Storage and Azure SQL databases directly over the Azure backbone network, fulfilling the requirement.
Question 3: To install Azure virtual machines, you use Azure Resource Manager templates. <br>
You are responsible for making sure that when instances of the virtual machines are provisioned, Windows features that are not in use are immediately deactivated. <br>
Which of the subsequent actions ought you to perform?
- You should make use of Azure Blueprints.
- You should make use of Azure DevOps.
- You should make use of Azure Automation State Configuration. (Correct answer)
- You should make use of network security groups (NSG).
Correct answer: You should make use of Azure Automation State Configuration.
Azure Automation State Configuration (DSC) is a cloud-based service that allows you to define and maintain the desired state of your Azure VMs. By using DSC configurations, you can specify which Windows features should be enabled or disabled, ensuring that VMs are provisioned with the correct and secure baseline configuration, including deactivating unused features, immediately upon deployment.
Question 4: Azure virtual machines running Windows Server 2016 are part of your company's Azure subscription.
You are advised that a specific antimalware virtual machine extension must be deployed on every virtual machine. To accomplish this, you are creating the essential code for a policy.
Which of the following effects is a need for your code?
- Modify
- Disabled
- DeployIfNotExists (Correct answer)
- AuditIfNotExists
Correct answer: DeployIfNotExists
To ensure that a specific VM extension, like an antimalware extension, is deployed on all virtual machines that meet certain criteria, the 'DeployIfNotExists' effect in Azure Policy is the correct choice. This effect automatically deploys a specified resource (the VM extension in this case) if it detects that the resource is missing on a non-compliant VM. 'AuditIfNotExists' would only report non-compliance without deploying.
Question 5: Azure Active Directory (Azure AD) is used by your organisation in a hybrid configuration. All users use hybrid Windows 10 devices that are connected to Azure AD. <br>
You are in charge of a SQL Azure database that supports Azure AD authentication. <br>
You must ensure that Microsoft SQL Server Management Studio (SSMS) can connect to the SQL database for database developers. Additionally, you must ensure that the developers authenticate using their on-premises Active Directory accounts. Your plan should provide for a minimal amount of authentication prompts. <br>
Which of the following authentication techniques ought to be employed by developers?
- Azure Multi-Factor authentication.
- Active Directory integrated authentication. (Correct answer)
- Azure AD token.
- None of the above
Correct answer: Active Directory integrated authentication.
For domain-joined devices and users authenticating with on-premises Active Directory accounts to an Azure SQL Database, 'Active Directory integrated authentication' provides the most seamless experience with minimal prompts. This method leverages the user's existing Windows login credentials from their domain-joined device, allowing for single sign-on without requiring them to re-enter credentials.
Question 6: A cluster for the Azure Kubernetes Service (AKS) is being created by you. An Azure resource must be reachable by the Azure Kubernetes Service (AKS) cluster. <br>
Registry for containers. <br>
The auto-generated service principal should be used to ensure that the Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry. <br>
Solution: You establish a role assignment in Azure Active Directory (Azure AD). <br>
Is the aim being met by the solution?
- Yes (Correct answer)
- No
- Maybe
Correct answer: Yes
When an Azure Kubernetes Service (AKS) cluster is created, an auto-generated service principal is typically created for it. To allow this service principal to authenticate and pull images from an Azure Container Registry (ACR), you must grant it the necessary permissions. This is achieved by creating a role assignment in Azure AD, assigning the service principal a role like 'AcrPull' on the ACR resource.
Question 7: To determine whether it is accurate, you must take into account the underlined portion. <br>
In your testing environment, you've set up an Azure Kubernetes Service (AKS) cluster. <br>
The cluster is now being deployed to the production environment as you speak. <br>
You should replace HTTP application routing after stopping it with an application routing solution that enables TLS termination and reverse proxy for AKS services via a single IP address. <br>
An AKS Ingress controller must be made. <br>
In the event that the underlined part is accurate, choose "No adjustment required." Choose the accurate answer if the underlined portion is accurate.
- a network security group
- an application security group
- an Azure Basic Load Balancer
- No adjustment required (Correct answer)
Correct answer: No adjustment required
The statement is accurate. To provide TLS termination, reverse proxy capabilities, and a single IP entry point for AKS services, an Ingress controller is the standard and recommended solution. An Ingress controller manages external access to services in a cluster, typically providing HTTP/S routing, load balancing, and TLS termination, which directly addresses the requirements outlined in the question.
