Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 4

Question 1

An Azure security engineer needs to scan container images for vulnerabilities before they are deployed to production. Which service provides this capability natively?

Accepted Answer

Microsoft Defender for Containers with Azure Container Registry integration

Answer

Microsoft Defender for Containers integrates with Azure Container Registry to automatically scan pushed images for known vulnerabilities using Qualys or Microsoft vulnerability assessment engines.

Question 2

A company wants to ensure that only approved certificate authorities (CAs) can issue TLS certificates for their Azure-hosted applications. What should they implement?

Accepted Answer

Azure Key Vault certificate policies with allowed issuer restrictions

Answer

Azure Key Vault certificate policies allow administrators to specify which issuer organizations or self-signed CAs are permitted, enforcing CA pinning for certificates managed in the vault.

Question 3

Which log type in Azure AD should a security engineer analyze to investigate a suspicious sign-in from an unfamiliar location?

Accepted Answer

Azure AD Sign-in Logs

Answer

Azure AD Sign-in Logs contain detailed records of every authentication attempt including IP address, location, device, application, and risk level assessed at sign-in time.

Question 4

What is the function of Azure DDoS Protection Standard compared to the Basic tier?

Accepted Answer

Standard provides adaptive tuning, attack analytics, and SLA guarantees while Basic offers only always-on monitoring

Answer

DDoS Protection Standard adds adaptive real-time tuning based on your traffic patterns, detailed attack analytics, telemetry, and a cost protection SLA guarantee beyond Basic's always-on platform protection.

Question 5

A security engineer is configuring Azure Sentinel (Microsoft Sentinel) to automatically respond to a high-severity alert by isolating a compromised VM. Which feature enables this automation?

Accepted Answer

Playbooks built on Azure Logic Apps

Answer

Microsoft Sentinel Playbooks are built on Azure Logic Apps and can be triggered automatically by analytics rules to execute response actions such as isolating VMs or blocking IPs.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 4