Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 5 — Questions and Answers
Question 1: A company's compliance team requires that all Azure management operations be logged and retained for 1 year. Which combination of services should be configured?
- Azure Monitor Metrics + Azure Storage with a 1-year retention policy
- Azure Activity Log + Diagnostic Settings exporting to a Log Analytics workspace with 1-year retention (Correct answer)
- Microsoft Sentinel + Azure Event Hub with long-term archive
- Azure AD Audit Logs + Azure Blob Storage with lifecycle management
Correct answer: Azure Activity Log + Diagnostic Settings exporting to a Log Analytics workspace with 1-year retention
Configuring Diagnostic Settings on the Azure Activity Log to export to a Log Analytics workspace, then setting workspace retention to 365 days, captures all ARM management operations for one year.
Question 2: An attacker has compromised an Azure VM's managed identity. What is the primary risk this poses?
- The attacker can modify the VM's disk encryption keys directly
- The attacker can use the managed identity's token to access any Azure resource the identity is authorized for (Correct answer)
- The attacker can escalate to Global Administrator in Azure AD automatically
- The attacker can disable Azure Security Center monitoring for the subscription
Correct answer: The attacker can use the managed identity's token to access any Azure resource the identity is authorized for
A managed identity issues Azure AD tokens scoped to its assigned RBAC roles; a compromised VM can request and use these tokens to access any Azure resource the identity has been granted permissions on.
Question 3: Which Microsoft Defender for Cloud recommendation would most directly address a publicly accessible Azure SQL Server with no firewall rules configured?
- Enable Advanced Threat Protection on SQL servers
- Restrict public network access to Azure SQL servers by enabling the Azure SQL firewall (Correct answer)
- Enable Transparent Data Encryption on SQL databases
- Rotate SQL Server admin passwords using Key Vault
Correct answer: Restrict public network access to Azure SQL servers by enabling the Azure SQL firewall
A SQL Server with no firewall rules and public access allows connections from any IP on the internet; the correct remediation is to restrict access using Azure SQL firewall rules or disable public access.
Question 4: What is the role of Azure AD Application Proxy in a zero-trust security model?
- It replaces VPN connections by providing secure, identity-aware remote access to on-premises web applications (Correct answer)
- It creates private endpoints for Azure PaaS services within a virtual network
- It enforces MFA for all Azure portal sign-ins regardless of location
- It proxies all outbound internet traffic through a Microsoft-managed secure gateway
Correct answer: It replaces VPN connections by providing secure, identity-aware remote access to on-premises web applications
Azure AD Application Proxy allows remote users to access on-premises web applications securely through Azure AD authentication without needing a VPN, aligning with zero-trust principles.
Question 5: A security engineer discovers that a storage account's shared access signature (SAS) token with full permissions was accidentally published to a public GitHub repository. What is the correct immediate remediation?
- Rotate the storage account access keys to invalidate the SAS token (Correct answer)
- Delete the storage account and recreate it with new keys
- Apply an IP-based access restriction to the storage account
- Enable Azure Defender for Storage to monitor for abuse
Correct answer: Rotate the storage account access keys to invalidate the SAS token
Account SAS tokens are derived from storage account access keys; rotating the access key immediately invalidates all SAS tokens signed with that key, stopping unauthorized access.
Question 6: Which Azure AD feature generates a report identifying users who have not completed a periodic review of their group memberships or application assignments?
- Azure AD Identity Protection risky users report
- Azure AD Access Reviews with reviewer outcomes tracking (Correct answer)
- Azure AD Privileged Identity Management access history
- Azure AD Sign-in Logs with inactive user filter
Correct answer: Azure AD Access Reviews with reviewer outcomes tracking
Azure AD Access Reviews allow administrators to create periodic reviews where resource owners or designated reviewers confirm or revoke access, with outcomes tracked in the review report.
Question 7: An organization wants to use a hardware security module (HSM) to protect encryption keys used by Azure services. Which Azure Key Vault tier supports this requirement?
- Azure Key Vault Standard tier with HSM-protected keys option enabled
- Azure Key Vault Premium tier, which stores keys in FIPS 140-2 Level 3 validated HSMs (Correct answer)
- Azure Managed HSM (mHSM) only — Key Vault itself never uses HSMs
- Azure Key Vault Standard with customer-managed keys and Bring Your Own Key (BYOK)
Correct answer: Azure Key Vault Premium tier, which stores keys in FIPS 140-2 Level 3 validated HSMs
Azure Key Vault Premium tier stores keys in FIPS 140-2 Level 3 validated HSMs, while Standard tier uses software protection; Azure Managed HSM provides a dedicated single-tenant HSM.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 5
A company's compliance team requires that all Azure management operations be logged and retained for 1 year.
Which combination of services should be configured?