Microsoft Azure Security Technologies Flashcards
7 cards from real Microsoft Azure Security Engineer Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft Azure Security Technologies flashcards as text
Your organization stores connection strings in Azure App Service application settings. What is the recommended security improvement?
Answer: Reference secrets from Azure Key Vault using managed identity
App Service supports Key Vault references, allowing managed identities to retrieve secrets without storing them directly in app settings.
Which Azure Defender plan specifically protects container images in Azure Container Registry by scanning for vulnerabilities?
Answer: Microsoft Defender for Containers
Microsoft Defender for Containers scans container images in ACR for known vulnerabilities using integrated vulnerability assessment.
A user in Azure AD is assigned the Security Reader role. Which action are they permitted to perform?
Answer: View security alerts and recommendations in Microsoft Defender for Cloud
The Security Reader role grants read-only access to security settings, alerts, and recommendations without the ability to make changes.
An Azure SQL Database must reject connections from all IP addresses except those from within an Azure Virtual Network. What is the most secure configuration?
Answer: Private endpoint with public endpoint disabled
A private endpoint assigns a private IP to the SQL server within the VNet, and disabling the public endpoint eliminates all public internet access.
Which tool in Microsoft Sentinel is used to create automated response actions when a specific security alert is triggered?
Answer: Playbook using Azure Logic Apps
Microsoft Sentinel playbooks are built on Azure Logic Apps and can be triggered by alerts to automate incident response actions.
You need to ensure that a service principal used by a CI/CD pipeline can only access Azure resources for 1 hour. Which approach achieves this?
Answer: Create a temporary role assignment using PIM for service principals
PIM supports time-bound eligible role assignments for service principals, enabling just-in-time access with automatic expiration.
An attacker has exfiltrated data from an Azure Storage account via an overly permissive SAS token. Which control would have best prevented this?
Answer: Azure AD authentication with RBAC instead of SAS tokens
Using Azure AD authentication with RBAC eliminates shared-key-based SAS tokens entirely, removing the attack vector.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- learn.microsoft.com — Test delivery, retake policy, time limit, score validity, eligibility, renewal, exam information · verified Nov 2026