Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 2 — Questions and Answers
Question 1: An organization needs to ensure that Azure Virtual Machines can only be accessed during business hours. Which Azure feature best enforces this policy?
- Azure Policy with time-based conditions
- Just-in-Time VM access in Microsoft Defender for Cloud (Correct answer)
- Azure Bastion with schedule rules
- Network Security Group time-based rules
Correct answer: Just-in-Time VM access in Microsoft Defender for Cloud
Just-in-Time VM access in Microsoft Defender for Cloud allows administrators to lock down inbound traffic and open ports only when needed for a specified time window.
Question 2: Which Azure service provides a centralized view of security alerts and recommendations across multiple Azure subscriptions?
- Azure Monitor
- Microsoft Sentinel
- Microsoft Defender for Cloud (Correct answer)
- Azure Security Benchmark
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud aggregates security alerts, recommendations, and Secure Score across multiple Azure subscriptions in a unified dashboard.
Question 3: A developer stores a connection string directly in application code. What is the recommended Azure solution to remediate this security issue?
- Encrypt the connection string using AES-256 in the code
- Store the connection string in Azure Key Vault and reference it via a managed identity (Correct answer)
- Use Azure Active Directory authentication instead of connection strings
- Move the connection string to an environment variable in the VM
Correct answer: Store the connection string in Azure Key Vault and reference it via a managed identity
Azure Key Vault combined with managed identities allows applications to securely retrieve secrets at runtime without hardcoding credentials in source code.
Question 4: What does the 'Secure Score' in Microsoft Defender for Cloud represent?
- The percentage of compliant Azure policies across all subscriptions
- A numeric measure of an organization's current security posture based on implemented recommendations (Correct answer)
- The number of active security alerts divided by total resources
- A compliance rating against the Azure Security Benchmark
Correct answer: A numeric measure of an organization's current security posture based on implemented recommendations
Secure Score is a cumulative score that reflects how many of Defender for Cloud's security recommendations have been implemented, indicating overall security posture.
Question 5: An Azure administrator wants to detect when someone attempts to access Azure Key Vault secrets outside of business hours. Which service should they configure?
- Azure Policy
- Microsoft Sentinel with Key Vault analytics rules (Correct answer)
- Azure Advisor
- Azure Monitor Alerts on Key Vault metrics
Correct answer: Microsoft Sentinel with Key Vault analytics rules
Microsoft Sentinel's Key Vault analytics rules can detect anomalous access patterns, including off-hours access attempts, and generate security incidents.
Question 6: Which feature of Azure Active Directory helps prevent credential stuffing attacks by blocking sign-ins from known malicious IP addresses?
- Azure AD Identity Protection (Correct answer)
- Conditional Access named locations
- Azure AD Password Protection
- Azure AD Smart Lockout
Correct answer: Azure AD Identity Protection
Azure AD Identity Protection uses machine learning to detect risky sign-ins including those from anonymized IPs and known threat actors, then enforces remediation.
Question 7: A security team needs to audit all changes made to Azure RBAC role assignments over the last 30 days. Where should they look?
- Azure Monitor Metrics
- Azure Activity Log filtered by 'Write RoleAssignments' (Correct answer)
- Microsoft Defender for Cloud recommendations
- Azure AD Audit Logs under Sign-ins
Correct answer: Azure Activity Log filtered by 'Write RoleAssignments'
The Azure Activity Log records all management-plane operations including role assignment changes, and can be filtered by operation type such as Microsoft.Authorization/roleAssignments/write.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 2
An organization needs to ensure that Azure Virtual Machines can only be accessed during business hours.
Which Azure feature best enforces this policy?