Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 3 — Questions and Answers
Question 1: A company needs to ensure that all Azure SQL Databases encrypt data at rest using customer-managed keys. Which feature should be configured?
- Always Encrypted with randomized encryption
- Transparent Data Encryption with customer-managed keys in Key Vault (Correct answer)
- Dynamic Data Masking with Key Vault integration
- Azure SQL Ledger with HSM-backed keys
Correct answer: Transparent Data Encryption with customer-managed keys in Key Vault
Transparent Data Encryption (TDE) with customer-managed keys (BYOK) stored in Azure Key Vault gives organizations full control over the encryption keys protecting their database files.
Question 2: What is the purpose of Azure Private Link when used with Azure Storage?
- It encrypts all data transferred to Azure Storage using private keys
- It allows access to Azure Storage over a private endpoint within the virtual network, avoiding public internet exposure (Correct answer)
- It creates a dedicated storage account accessible only to a single subscription
- It enforces IP firewall rules on the Azure Storage service
Correct answer: It allows access to Azure Storage over a private endpoint within the virtual network, avoiding public internet exposure
Azure Private Link maps a private IP address in your VNet to the Azure Storage service, so traffic never traverses the public internet.
Question 3: An organization must comply with a regulation requiring all privileged Azure AD roles to be activated through a formal approval process. Which feature meets this requirement?
- Azure AD Conditional Access with MFA enforcement
- Azure AD Privileged Identity Management (PIM) with approval workflows (Correct answer)
- Azure RBAC with custom role definitions
- Azure AD Access Reviews with manager approval
Correct answer: Azure AD Privileged Identity Management (PIM) with approval workflows
Azure AD PIM supports approval workflows that require designated approvers to authorize privileged role activations before they take effect.
Question 4: Which Microsoft Defender for Cloud plan provides threat protection specifically for Azure Kubernetes Service (AKS) clusters?
- Defender for Servers
- Defender for Containers (Correct answer)
- Defender for App Service
- Defender for Resource Manager
Correct answer: Defender for Containers
Microsoft Defender for Containers protects AKS clusters by monitoring Kubernetes audit logs, detecting runtime threats, and assessing container image vulnerabilities.
Question 5: A security engineer needs to prevent Azure resources from being accidentally deleted by authorized users. What is the most appropriate Azure feature?
- Azure Policy with deny effect
- Azure Resource Locks with CanNotDelete lock type (Correct answer)
- Azure Blueprints with immutable assignments
- Azure RBAC with read-only custom roles
Correct answer: Azure Resource Locks with CanNotDelete lock type
Azure Resource Locks with the CanNotDelete lock type allow authorized users to read and modify a resource but prevent deletion, even by resource owners.
Question 6: Which Azure networking feature inspects and filters traffic between Azure virtual networks using OSI Layer 7 (application-layer) rules?
- Network Security Groups (NSG)
- Azure DDoS Protection Standard
- Azure Firewall Premium with IDPS (Correct answer)
- Azure Front Door with WAF policies
Correct answer: Azure Firewall Premium with IDPS
Azure Firewall Premium includes an Intrusion Detection and Prevention System (IDPS) that performs signature-based detection at Layer 7, enabling advanced threat filtering between VNets.
Question 7: What is the primary security benefit of enabling Azure AD Multi-Factor Authentication (MFA) for all users?
- It eliminates the need for password complexity requirements
- It ensures that compromised passwords alone cannot grant unauthorized access (Correct answer)
- It encrypts user credentials stored in Azure AD
- It prevents phishing emails from reaching user mailboxes
Correct answer: It ensures that compromised passwords alone cannot grant unauthorized access
MFA requires an additional verification factor beyond the password, so even if credentials are stolen or guessed, an attacker cannot authenticate without the second factor.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 3
A company needs to ensure that all Azure SQL Databases encrypt data at rest using customer-managed keys.
Which feature should be configured?