Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 4 — Questions and Answers
Question 1: An Azure security engineer needs to scan container images for vulnerabilities before they are deployed to production. Which service provides this capability natively?
- Microsoft Defender for Containers with Azure Container Registry integration (Correct answer)
- Azure Security Center image scanning policy
- Azure DevOps pipeline with NSG validation
- Azure Monitor container insights with CVE alerts
Correct answer: Microsoft Defender for Containers with Azure Container Registry integration
Microsoft Defender for Containers integrates with Azure Container Registry to automatically scan pushed images for known vulnerabilities using Qualys or Microsoft vulnerability assessment engines.
Question 2: A company wants to ensure that only approved certificate authorities (CAs) can issue TLS certificates for their Azure-hosted applications. What should they implement?
- Azure Key Vault certificate policies with allowed issuer restrictions (Correct answer)
- Azure Front Door with custom TLS profiles
- Azure Application Gateway with SSL termination
- Azure Policy with certificate compliance auditing
Correct answer: Azure Key Vault certificate policies with allowed issuer restrictions
Azure Key Vault certificate policies allow administrators to specify which issuer organizations or self-signed CAs are permitted, enforcing CA pinning for certificates managed in the vault.
Question 3: Which log type in Azure AD should a security engineer analyze to investigate a suspicious sign-in from an unfamiliar location?
- Azure AD Audit Logs
- Azure AD Sign-in Logs (Correct answer)
- Azure Activity Log
- Microsoft Defender for Cloud Alerts
Correct answer: Azure AD Sign-in Logs
Azure AD Sign-in Logs contain detailed records of every authentication attempt including IP address, location, device, application, and risk level assessed at sign-in time.
Question 4: What is the function of Azure DDoS Protection Standard compared to the Basic tier?
- Standard provides Layer 7 WAF capabilities while Basic only covers Layers 3-4
- Standard provides adaptive tuning, attack analytics, and SLA guarantees while Basic offers only always-on monitoring (Correct answer)
- Standard allows custom mitigation policies while Basic uses fixed thresholds for all customers
- Standard includes integration with Azure Firewall while Basic only works with NSGs
Correct answer: Standard provides adaptive tuning, attack analytics, and SLA guarantees while Basic offers only always-on monitoring
DDoS Protection Standard adds adaptive real-time tuning based on your traffic patterns, detailed attack analytics, telemetry, and a cost protection SLA guarantee beyond Basic's always-on platform protection.
Question 5: A security engineer is configuring Azure Sentinel (Microsoft Sentinel) to automatically respond to a high-severity alert by isolating a compromised VM. Which feature enables this automation?
- Analytics Rules with scheduled queries
- Workbooks with embedded logic apps
- Playbooks built on Azure Logic Apps (Correct answer)
- Hunting queries with bookmark actions
Correct answer: Playbooks built on Azure Logic Apps
Microsoft Sentinel Playbooks are built on Azure Logic Apps and can be triggered automatically by analytics rules to execute response actions such as isolating VMs or blocking IPs.
Question 6: Which Azure feature allows an organization to enforce that all storage accounts in a subscription must have 'Secure transfer required' (HTTPS only) enabled?
- Azure Security Center hardening recommendations
- Azure Policy with a deny effect on insecure storage configurations (Correct answer)
- Azure Blueprints with a compliance dashboard
- Azure Advisor with automated remediation
Correct answer: Azure Policy with a deny effect on insecure storage configurations
Azure Policy with a 'deny' effect can be configured to block creation or modification of storage accounts that do not have the 'Secure transfer required' property set to enabled.
Question 7: When using Azure AD Conditional Access, what does the 'session control' option 'Sign-in frequency' enforce?
- The maximum number of sign-ins a user can perform per hour
- The interval after which users must re-authenticate, reducing persistent session risk (Correct answer)
- The time window during which MFA prompts are suppressed after initial authentication
- The frequency at which Azure AD refreshes user group memberships
Correct answer: The interval after which users must re-authenticate, reducing persistent session risk
Sign-in frequency session control forces users to reauthenticate after a defined period, limiting the risk posed by long-lived sessions on unmanaged or shared devices.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 4
An Azure security engineer needs to scan container images for vulnerabilities before they are deployed to production.
Which service provides this capability natively?