Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 2

Question 1

An organization wants to enforce MFA for all Azure AD users only when signing in from outside their corporate network. Which feature should they configure?

Accepted Answer

Conditional Access policy with named locations

Answer

Conditional Access policies with named locations allow you to require MFA only when users sign in from IP ranges outside the trusted corporate network.

Question 2

You need to detect when an Azure Key Vault secret is accessed by an unexpected application. Which service provides this capability?

Accepted Answer

Microsoft Defender for Key Vault

Answer

Microsoft Defender for Key Vault uses advanced threat protection to detect anomalous access patterns and trigger alerts.

Question 3

A company must ensure all Azure VMs in a subscription use managed disks with customer-managed keys. Which control enforces this at scale?

Accepted Answer

Azure Policy with a 'deny' effect

Answer

An Azure Policy with a deny effect prevents the creation of VMs with unencrypted or platform-managed-key disks.

Question 4

Which Azure service allows you to sign in to Azure VMs using your Azure AD credentials, eliminating the need for local administrator accounts?

Accepted Answer

Azure AD Login VM extension

Answer

The Azure AD Login VM extension enables sign-in to Windows and Linux VMs using Azure AD credentials and RBAC roles.

Question 5

An attacker performs a password spray attack against Azure AD accounts. Which Microsoft Defender product generates an alert for this behavior?

Accepted Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Identity monitors Active Directory and Azure AD sign-in patterns to detect password spray and brute-force attacks.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 2