Microsoft Azure Security Engineer Certification Azure Data and Application Security 1 — Questions and Answers
Question 1: Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?
- Azure Storage with encryption
- Azure Key Vault (Correct answer)
- Azure App Configuration
- Azure Managed HSM
Correct answer: Azure Key Vault
Azure Key Vault securely stores and manages secrets, keys, and certificates with Azure AD-based access control and full audit logging.
Question 2: Which Key Vault access model uses Azure AD role assignments at the data plane level, providing granular control down to individual secrets?
- Key Vault access policies
- Azure RBAC for Key Vault (Correct answer)
- Managed identity passthrough
- Service principal certificate auth
Correct answer: Azure RBAC for Key Vault
Azure RBAC for Key Vault enables fine-grained role assignments at the vault, key, secret, or certificate level using Azure AD.
Question 3: Which Azure SQL Database feature encrypts entire columns so that even database administrators cannot see the plaintext data during query processing?
- Transparent Data Encryption
- Dynamic Data Masking
- Always Encrypted (Correct answer)
- Row-Level Security
Correct answer: Always Encrypted
Always Encrypted stores column encryption keys client-side, so SQL Server only ever processes ciphertext — DBAs cannot access the plaintext.
Question 4: Which Azure Storage encryption method encrypts data before it is sent to Azure so that Microsoft never handles the plaintext?
- Storage Service Encryption (SSE)
- Client-side encryption (Correct answer)
- Azure Disk Encryption
- Transparent Data Encryption
Correct answer: Client-side encryption
Client-side encryption encrypts data in the application before uploading, meaning the storage service and Microsoft only ever receive ciphertext.
Question 5: Which Azure Key Vault feature prevents even an administrator from permanently deleting a vault or its contents before a mandatory retention period expires?
- Expiration dates on secrets
- Soft delete
- Purge protection (Correct answer)
- Private endpoint
Correct answer: Purge protection
Purge protection enforces a configurable retention window (7-90 days) during which deleted Key Vault objects cannot be permanently purged.
Question 6: What is the recommended approach for granting an Azure VM access to Key Vault secrets without storing any credentials in code or configuration?
- Store the client secret in environment variables on the VM
- Assign the VM a managed identity and grant it a Key Vault RBAC role (Correct answer)
- Embed the access key directly in the application binary
- Use a service principal with a certificate stored on disk
Correct answer: Assign the VM a managed identity and grant it a Key Vault RBAC role
A managed identity gives the VM an Azure AD identity that can be assigned Key Vault roles, eliminating the need to manage or rotate credentials.
Microsoft Azure Security Engineer Certification Azure Data and Application Security 1
Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?