Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 2 — Questions and Answers
Question 1: An organization wants to enforce MFA for all Azure AD users only when signing in from outside their corporate network. Which feature should they configure?
- Conditional Access policy with named locations (Correct answer)
- Azure AD Identity Protection risk policies
- Azure AD Password Protection
- Privileged Identity Management just-in-time access
Correct answer: Conditional Access policy with named locations
Conditional Access policies with named locations allow you to require MFA only when users sign in from IP ranges outside the trusted corporate network.
Question 2: You need to detect when an Azure Key Vault secret is accessed by an unexpected application. Which service provides this capability?
- Microsoft Defender for Key Vault (Correct answer)
- Azure Monitor Alerts on metrics
- Azure Policy deny effect
- Azure AD App Proxy
Correct answer: Microsoft Defender for Key Vault
Microsoft Defender for Key Vault uses advanced threat protection to detect anomalous access patterns and trigger alerts.
Question 3: A company must ensure all Azure VMs in a subscription use managed disks with customer-managed keys. Which control enforces this at scale?
- Azure Policy with a 'deny' effect (Correct answer)
- Azure Blueprints assignment
- Azure Security Center recommendation
- ARM template deployment
Correct answer: Azure Policy with a 'deny' effect
An Azure Policy with a deny effect prevents the creation of VMs with unencrypted or platform-managed-key disks.
Question 4: Which Azure service allows you to sign in to Azure VMs using your Azure AD credentials, eliminating the need for local administrator accounts?
- Azure AD Login VM extension (Correct answer)
- Azure Bastion
- Just-in-time VM access
- Azure AD Domain Services
Correct answer: Azure AD Login VM extension
The Azure AD Login VM extension enables sign-in to Windows and Linux VMs using Azure AD credentials and RBAC roles.
Question 5: An attacker performs a password spray attack against Azure AD accounts. Which Microsoft Defender product generates an alert for this behavior?
- Microsoft Defender for Identity (Correct answer)
- Microsoft Defender for Endpoint
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Office 365
Correct answer: Microsoft Defender for Identity
Microsoft Defender for Identity monitors Active Directory and Azure AD sign-in patterns to detect password spray and brute-force attacks.
Question 6: You need to restrict outbound internet traffic from Azure VMs to only approved FQDNs. Which Azure service provides FQDN-based filtering?
- Azure Firewall (Correct answer)
- Network Security Groups
- Azure Application Gateway WAF
- Azure Front Door
Correct answer: Azure Firewall
Azure Firewall supports FQDN-based application rules that allow or deny traffic based on fully qualified domain names.
Question 7: A security team wants to review and approve role assignments for privileged Azure AD roles before they become active. Which feature enables this?
- PIM approval workflow (Correct answer)
- Azure AD access reviews
- Conditional Access authentication context
- Azure AD entitlement management
Correct answer: PIM approval workflow
Privileged Identity Management (PIM) approval workflows require designated approvers to authorize role activation requests.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 2
An organization wants to enforce MFA for all Azure AD users only when signing in from outside their corporate network.
Which feature should they configure?