Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 3

Question 1

A company needs to ensure that all Azure SQL Databases encrypt data at rest using customer-managed keys. Which feature should be configured?

Accepted Answer

Transparent Data Encryption with customer-managed keys in Key Vault

Answer

Transparent Data Encryption (TDE) with customer-managed keys (BYOK) stored in Azure Key Vault gives organizations full control over the encryption keys protecting their database files.

Question 2

What is the purpose of Azure Private Link when used with Azure Storage?

Accepted Answer

It allows access to Azure Storage over a private endpoint within the virtual network, avoiding public internet exposure

Answer

Azure Private Link maps a private IP address in your VNet to the Azure Storage service, so traffic never traverses the public internet.

Question 3

An organization must comply with a regulation requiring all privileged Azure AD roles to be activated through a formal approval process. Which feature meets this requirement?

Accepted Answer

Azure AD Privileged Identity Management (PIM) with approval workflows

Answer

Azure AD PIM supports approval workflows that require designated approvers to authorize privileged role activations before they take effect.

Question 4

Which Microsoft Defender for Cloud plan provides threat protection specifically for Azure Kubernetes Service (AKS) clusters?

Accepted Answer

Defender for Containers

Answer

Microsoft Defender for Containers protects AKS clusters by monitoring Kubernetes audit logs, detecting runtime threats, and assessing container image vulnerabilities.

Question 5

A security engineer needs to prevent Azure resources from being accidentally deleted by authorized users. What is the most appropriate Azure feature?

Accepted Answer

Azure Resource Locks with CanNotDelete lock type

Answer

Azure Resource Locks with the CanNotDelete lock type allow authorized users to read and modify a resource but prevent deletion, even by resource owners.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 3