Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 5

Question 1

A company's compliance team requires that all Azure management operations be logged and retained for 1 year. Which combination of services should be configured?

Accepted Answer

Azure Activity Log + Diagnostic Settings exporting to a Log Analytics workspace with 1-year retention

Answer

Configuring Diagnostic Settings on the Azure Activity Log to export to a Log Analytics workspace, then setting workspace retention to 365 days, captures all ARM management operations for one year.

Question 2

An attacker has compromised an Azure VM's managed identity. What is the primary risk this poses?

Accepted Answer

The attacker can use the managed identity's token to access any Azure resource the identity is authorized for

Answer

A managed identity issues Azure AD tokens scoped to its assigned RBAC roles; a compromised VM can request and use these tokens to access any Azure resource the identity has been granted permissions on.

Question 3

Which Microsoft Defender for Cloud recommendation would most directly address a publicly accessible Azure SQL Server with no firewall rules configured?

Accepted Answer

Restrict public network access to Azure SQL servers by enabling the Azure SQL firewall

Answer

A SQL Server with no firewall rules and public access allows connections from any IP on the internet; the correct remediation is to restrict access using Azure SQL firewall rules or disable public access.

Question 4

What is the role of Azure AD Application Proxy in a zero-trust security model?

Accepted Answer

It replaces VPN connections by providing secure, identity-aware remote access to on-premises web applications

Answer

Azure AD Application Proxy allows remote users to access on-premises web applications securely through Azure AD authentication without needing a VPN, aligning with zero-trust principles.

Question 5

A security engineer discovers that a storage account's shared access signature (SAS) token with full permissions was accidentally published to a public GitHub repository. What is the correct immediate remediation?

Accepted Answer

Rotate the storage account access keys to invalidate the SAS token

Answer

Account SAS tokens are derived from storage account access keys; rotating the access key immediately invalidates all SAS tokens signed with that key, stopping unauthorized access.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft Azure Security Engineer Certification 5