Microsoft Azure Security Technologies Flashcards

An organization wants to enforce MFA for all Azure AD users only when signing in from outside their corporate network. Which feature should they configure?

Answer: Conditional Access policy with named locations

Conditional Access policies with named locations allow you to require MFA only when users sign in from IP ranges outside the trusted corporate network.

You need to detect when an Azure Key Vault secret is accessed by an unexpected application. Which service provides this capability?

Answer: Microsoft Defender for Key Vault

Microsoft Defender for Key Vault uses advanced threat protection to detect anomalous access patterns and trigger alerts.

A company must ensure all Azure VMs in a subscription use managed disks with customer-managed keys. Which control enforces this at scale?

Answer: Azure Policy with a 'deny' effect

An Azure Policy with a deny effect prevents the creation of VMs with unencrypted or platform-managed-key disks.

Which Azure service allows you to sign in to Azure VMs using your Azure AD credentials, eliminating the need for local administrator accounts?

Answer: Azure AD Login VM extension

The Azure AD Login VM extension enables sign-in to Windows and Linux VMs using Azure AD credentials and RBAC roles.

An attacker performs a password spray attack against Azure AD accounts. Which Microsoft Defender product generates an alert for this behavior?

Answer: Microsoft Defender for Identity

Microsoft Defender for Identity monitors Active Directory and Azure AD sign-in patterns to detect password spray and brute-force attacks.

You need to restrict outbound internet traffic from Azure VMs to only approved FQDNs. Which Azure service provides FQDN-based filtering?

Answer: Azure Firewall

Azure Firewall supports FQDN-based application rules that allow or deny traffic based on fully qualified domain names.

A security team wants to review and approve role assignments for privileged Azure AD roles before they become active. Which feature enables this?

Answer: PIM approval workflow

Privileged Identity Management (PIM) approval workflows require designated approvers to authorize role activation requests.