Azure Data and Application Security Flashcards
6 cards from real Microsoft Azure Security Engineer Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Azure Data and Application Security flashcards as text
Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?
Answer: Azure Key Vault
Azure Key Vault securely stores and manages secrets, keys, and certificates with Azure AD-based access control and full audit logging.
Which Key Vault access model uses Azure AD role assignments at the data plane level, providing granular control down to individual secrets?
Answer: Azure RBAC for Key Vault
Azure RBAC for Key Vault enables fine-grained role assignments at the vault, key, secret, or certificate level using Azure AD.
Which Azure SQL Database feature encrypts entire columns so that even database administrators cannot see the plaintext data during query processing?
Answer: Always Encrypted
Always Encrypted stores column encryption keys client-side, so SQL Server only ever processes ciphertext — DBAs cannot access the plaintext.
Which Azure Storage encryption method encrypts data before it is sent to Azure so that Microsoft never handles the plaintext?
Answer: Client-side encryption
Client-side encryption encrypts data in the application before uploading, meaning the storage service and Microsoft only ever receive ciphertext.
Which Azure Key Vault feature prevents even an administrator from permanently deleting a vault or its contents before a mandatory retention period expires?
Answer: Purge protection
Purge protection enforces a configurable retention window (7-90 days) during which deleted Key Vault objects cannot be permanently purged.
What is the recommended approach for granting an Azure VM access to Key Vault secrets without storing any credentials in code or configuration?
Answer: Assign the VM a managed identity and grant it a Key Vault RBAC role
A managed identity gives the VM an Azure AD identity that can be assigned Key Vault roles, eliminating the need to manage or rotate credentials.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- learn.microsoft.com — Test delivery, retake policy, time limit, score validity, eligibility, renewal, exam information · verified Nov 2026