Microsoft Azure Security Technologies Flashcards
7 cards from real Microsoft Azure Security Engineer Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft Azure Security Technologies flashcards as text
Microsoft Sentinel is configured to ingest Azure AD sign-in logs. Which built-in analytics rule type uses machine learning to detect anomalous sign-in patterns?
Answer: Anomaly detection rules (UEBA)
UEBA (User and Entity Behavior Analytics) anomaly rules use machine learning baselines to detect deviations from normal user behavior.
An Azure subscription contains resources that must comply with PCI-DSS. Which Defender for Cloud feature provides PCI-DSS compliance status visibility?
Answer: Regulatory compliance dashboard
The regulatory compliance dashboard in Defender for Cloud maps Azure resource configurations to PCI-DSS controls and shows pass/fail status.
A multi-tenant application registered in Azure AD must only be accessible by users from specific partner tenants. What configuration enforces this?
Answer: Cross-tenant access settings with specific tenant allowlist in External Identities
Cross-tenant access settings in Azure AD External Identities allow you to allowlist specific partner tenant IDs for inbound B2B collaboration.
Your team needs to investigate a suspected lateral movement attack across Azure VMs. Which Microsoft Sentinel feature visually maps relationships between entities in an incident?
Answer: Investigation graph
The Microsoft Sentinel investigation graph visually maps entities, alerts, and their relationships to help analysts understand attack chains.
An Azure Storage account must prevent all access using the legacy Shared Key authorization method. Which setting enforces this?
Answer: Disabling 'Allow storage account key access' in the storage account settings
The 'Allow storage account key access' setting, when disabled, forces all requests to use Azure AD authentication and rejects Shared Key authorization.
A security engineer needs to prevent Azure resources from being deployed to regions outside of US East and US West. What is the correct implementation?
Answer: Azure Policy with 'Allowed locations' built-in policy definition
The built-in 'Allowed locations' Azure Policy definition restricts resource deployment to the specified list of Azure regions.
Which Azure DDoS Protection tier provides adaptive tuning, attack metrics, and post-attack analysis reports for critical workloads?
Answer: Azure DDoS Protection Network Protection (formerly Standard)
Azure DDoS Network Protection provides adaptive real-time tuning, detailed attack telemetry, and post-attack mitigation reports for protected VNets.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- learn.microsoft.com — Test delivery, retake policy, time limit, score validity, eligibility, renewal, exam information · verified Nov 2026