Microsoft Azure Security Engineer Certification Azure Data and Application Security 2 — Questions and Answers
Question 1: Which Azure SQL Database feature obfuscates sensitive data in query results for non-privileged users without altering the actual stored values?
- Always Encrypted
- Row-Level Security
- Dynamic Data Masking (Correct answer)
- Column-level permissions
Correct answer: Dynamic Data Masking
Dynamic Data Masking replaces sensitive field values with masked output in query results for users without the UNMASK permission.
Question 2: What does Azure SQL Transparent Data Encryption (TDE) protect?
- Column values from DBA queries
- Database data files, log files, and backups at rest (Correct answer)
- Data in transit over TLS connections
- Row-level access for multi-tenant apps
Correct answer: Database data files, log files, and backups at rest
TDE performs real-time I/O encryption of the database file, log file, and backup files using a database encryption key.
Question 3: Which Azure Storage feature generates time-limited, permission-scoped URIs that grant access to specific resources without sharing the master account key?
- Storage access keys
- Azure AD authentication tokens
- Shared Access Signatures (SAS) (Correct answer)
- Storage firewall rules
Correct answer: Shared Access Signatures (SAS)
SAS tokens encode permissions, start time, expiry, and allowed operations into a signed URI for scoped temporary access.
Question 4: Which Microsoft Defender plan detects anomalous Azure Storage access patterns such as data exfiltration, access from Tor nodes, or malware uploads?
- Defender for Servers
- Defender for Key Vault
- Defender for Storage (Correct answer)
- Defender for SQL
Correct answer: Defender for Storage
Microsoft Defender for Storage monitors blob and file access patterns and generates alerts for suspicious activities against storage accounts.
Question 5: Which Azure App Service setting forces all HTTP requests to redirect to HTTPS with a 301 response code?
- TLS/SSL certificate binding only
- HTTPS Only setting (Correct answer)
- Access Restrictions policy
- Managed certificate auto-renewal
Correct answer: HTTPS Only setting
The HTTPS Only toggle in App Service Configuration automatically redirects all plaintext HTTP traffic to the HTTPS endpoint.
Question 6: Which Azure SQL security feature filters the rows returned by a query based on the identity of the user executing the query?
- Dynamic Data Masking
- Always Encrypted
- Row-Level Security (Correct answer)
- Column encryption policy
Correct answer: Row-Level Security
Row-Level Security uses security predicates to filter query results to only the rows the executing user is authorized to see.
Microsoft Azure Security Engineer Certification Azure Data and Application Security 2
Which Azure SQL Database feature obfuscates sensitive data in query results for non-privileged users without altering the actual stored values?