Microsoft Azure Security Engineer Certification Azure Data and Application Security 1

Question 1

Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?

Accepted Answer

Azure Key Vault

Answer

Azure Key Vault securely stores and manages secrets, keys, and certificates with Azure AD-based access control and full audit logging.

Question 2

Which Key Vault access model uses Azure AD role assignments at the data plane level, providing granular control down to individual secrets?

Accepted Answer

Azure RBAC for Key Vault

Answer

Azure RBAC for Key Vault enables fine-grained role assignments at the vault, key, secret, or certificate level using Azure AD.

Question 3

Which Azure SQL Database feature encrypts entire columns so that even database administrators cannot see the plaintext data during query processing?

Accepted Answer

Always Encrypted

Answer

Always Encrypted stores column encryption keys client-side, so SQL Server only ever processes ciphertext — DBAs cannot access the plaintext.

Question 4

Which Azure Storage encryption method encrypts data before it is sent to Azure so that Microsoft never handles the plaintext?

Accepted Answer

Client-side encryption

Answer

Client-side encryption encrypts data in the application before uploading, meaning the storage service and Microsoft only ever receive ciphertext.

Question 5

Which Azure Key Vault feature prevents even an administrator from permanently deleting a vault or its contents before a mandatory retention period expires?

Accepted Answer

Purge protection

Answer

Purge protection enforces a configurable retention window (7-90 days) during which deleted Key Vault objects cannot be permanently purged.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Azure Data and Application Security 1