Microsoft Azure Security Engineer Certification Azure Data and Application Security

Question 1

Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?

Accepted Answer

Azure Key Vault

Answer

Azure Storage with encryption

Answer

Azure App Configuration

Answer

Azure Managed HSM

Question 2

Which Key Vault access model uses Azure AD role assignments at the data plane level, providing granular control down to individual secrets?

Accepted Answer

Azure RBAC for Key Vault

Answer

Key Vault access policies

Answer

Managed identity passthrough

Answer

Service principal certificate auth

Question 3

Which Azure SQL Database feature encrypts entire columns so that even database administrators cannot see the plaintext data during query processing?

Accepted Answer

Always Encrypted

Answer

Transparent Data Encryption

Answer

Dynamic Data Masking

Answer

Row-Level Security

Question 4

Which Azure Storage encryption method encrypts data before it is sent to Azure so that Microsoft never handles the plaintext?

Accepted Answer

Client-side encryption

Answer

Storage Service Encryption (SSE)

Answer

Azure Disk Encryption

Answer

Transparent Data Encryption

Question 5

Which Azure Key Vault feature prevents even an administrator from permanently deleting a vault or its contents before a mandatory retention period expires?

Accepted Answer

Purge protection

Answer

Expiration dates on secrets

Answer

Soft delete

Answer

Private endpoint

Question 6

What is the recommended approach for granting an Azure VM access to Key Vault secrets without storing any credentials in code or configuration?

Accepted Answer

Assign the VM a managed identity and grant it a Key Vault RBAC role

Answer

Store the client secret in environment variables on the VM

Answer

Embed the access key directly in the application binary

Answer

Use a service principal with a certificate stored on disk