Mixed Deck — All Microsoft Azure Security Engineer Certification Topics Flashcards

Which Azure AD capability revokes tokens in near real-time when critical events such as user disablement occur, without waiting for token expiry?

Answer: Continuous Access Evaluation (CAE)

Continuous Access Evaluation allows resource providers to reject tokens immediately when the issuing authority signals a critical change.

An attacker performs a password spray attack against Azure AD accounts. Which Microsoft Defender product generates an alert for this behavior?

Answer: Microsoft Defender for Identity

Microsoft Defender for Identity monitors Active Directory and Azure AD sign-in patterns to detect password spray and brute-force attacks.

Which Key Vault feature prevents even subscription administrators from permanently deleting a vault or its contents?

Answer: Purge Protection

Purge Protection enforces a mandatory retention period during which no one—including admins—can permanently purge a soft-deleted vault or object.

Which type of managed identity has a lifecycle independent of any single Azure resource and can be assigned to multiple services?

Answer: User-assigned managed identity

User-assigned managed identities are standalone Azure resources that persist independently and can be shared across multiple workloads.

What does UEBA stand for in the context of Microsoft Sentinel?

Answer: User and Entity Behavior Analytics

UEBA in Sentinel uses machine learning to baseline normal activity for users, hosts, and IPs, then flags anomalous deviations.

Which Azure service provides centralized management of secrets, encryption keys, and certificates with comprehensive access logging?

Answer: Azure Key Vault

Azure Key Vault securely stores and manages secrets, keys, and certificates with Azure AD-based access control and full audit logging.

Using stream analytics, you are creating a real-time processing system. The amount of weather reports that are received each time zone per minute should be counted. You must select the proper windowing function. Which windowing feature ought you to pick?

Answer: Tumbling

To count the amount of weather reports received each time zone per minute using Stream Analytics, the Tumbling window function is the appropriate choice. Tumbling windows are fixed-size, non-overlapping, and contiguous time intervals. They are perfect for segmenting a data stream into distinct, sequential blocks of time (e.g., one-minute intervals) and performing aggregations like counts within each block, ensuring each event is counted exactly once within its specific time window.

A web application on Azure App Service is receiving SQL injection attacks. Which service should you enable to detect and block these attacks?

Answer: Azure Application Gateway with WAF in Prevention mode

Azure Application Gateway WAF in Prevention mode actively blocks requests matching OWASP CRS rules including SQL injection signatures.

Which Microsoft Sentinel feature allows security analysts to proactively search for threats not yet covered by automated analytics rules?

Answer: Hunting queries

Hunting queries are KQL queries analysts run interactively to look for suspicious patterns and anomalies without a predefined detection.

Which Microsoft Defender for Cloud section surfaces hardening recommendations for open management ports, missing NSG coverage, and network security gaps?

Answer: Defender for Cloud Networking recommendations

Defender for Cloud's Networking recommendations section evaluates your network security configuration and provides prioritized remediation steps.

Which KQL operator is used in Microsoft Sentinel to combine rows from two log tables based on a matching field?

Answer: join

The KQL `join` operator merges two tables on specified key columns, supporting kinds like inner, leftouter, and rightouter.

Which Azure AD feature maintains a global and custom banned password list to block weak or compromised passwords?

Answer: Password Protection

Azure AD Password Protection blocks known weak passwords and allows organizations to add custom banned terms.

An Azure App Service needs to read a database connection string from Key Vault without storing any credentials. Which feature enables this?

Answer: App Service Key Vault references in application settings

App Service Key Vault references let you use the syntax @Microsoft.KeyVault(SecretUri=...) directly in app settings, and the platform resolves the secret value at runtime using a managed identity.

You need to detect when an Azure Key Vault secret is accessed by an unexpected application. Which service provides this capability?

Answer: Microsoft Defender for Key Vault

Microsoft Defender for Key Vault uses advanced threat protection to detect anomalous access patterns and trigger alerts.

You need to ensure that a service principal used by a CI/CD pipeline can only access Azure resources for 1 hour. Which approach achieves this?

Answer: Create a temporary role assignment using PIM for service principals

PIM supports time-bound eligible role assignments for service principals, enabling just-in-time access with automatic expiration.

When should an organization choose Azure Dedicated HSM over Azure Key Vault Premium?

Answer: When regulatory requirements demand exclusive, customer-controlled FIPS 140-2 Level 3 HSM hardware

Dedicated HSM provides single-tenant, customer-exclusive physical HSM devices meeting FIPS 140-2 Level 3, satisfying strict regulatory requirements that prohibit shared infrastructure.

What is an Application Security Group (ASG) in Azure primarily used for?

Answer: Grouping VMs logically so NSG rules can reference the group instead of IPs

ASGs let you tag VMs and write NSG rules referencing the tag, eliminating the need to maintain explicit IP address lists.

Which Azure service provides a managed, stateful, cloud-native firewall with built-in high availability and unrestricted cloud scalability?

Answer: Azure Firewall

Azure Firewall is a managed cloud-native firewall service that provides stateful packet inspection, FQDN filtering, and threat intelligence.

Which Key Vault networking feature restricts vault access to specific IP ranges or virtual networks without requiring a private endpoint?

Answer: Network ACLs and firewall rules

Key Vault firewall and virtual network rules (Network ACLs) allow you to allow-list specific public IP ranges and VNet subnets, blocking all other traffic.

Which Azure SQL Database feature encrypts entire columns so that even database administrators cannot see the plaintext data during query processing?

Answer: Always Encrypted

Always Encrypted stores column encryption keys client-side, so SQL Server only ever processes ciphertext — DBAs cannot access the plaintext.