Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 3 — Questions and Answers
Question 1: Your organization stores connection strings in Azure App Service application settings. What is the recommended security improvement?
- Reference secrets from Azure Key Vault using managed identity (Correct answer)
- Encrypt the application settings manually
- Store secrets in Azure Blob Storage with SAS tokens
- Use Azure AD B2C for secret management
Correct answer: Reference secrets from Azure Key Vault using managed identity
App Service supports Key Vault references, allowing managed identities to retrieve secrets without storing them directly in app settings.
Question 2: Which Azure Defender plan specifically protects container images in Azure Container Registry by scanning for vulnerabilities?
- Microsoft Defender for Containers (Correct answer)
- Microsoft Defender for App Service
- Microsoft Defender for Servers
- Microsoft Defender for Storage
Correct answer: Microsoft Defender for Containers
Microsoft Defender for Containers scans container images in ACR for known vulnerabilities using integrated vulnerability assessment.
Question 3: A user in Azure AD is assigned the Security Reader role. Which action are they permitted to perform?
- View security alerts and recommendations in Microsoft Defender for Cloud (Correct answer)
- Remediate security findings in Defender for Cloud
- Create Conditional Access policies
- Manage Azure AD Identity Protection settings
Correct answer: View security alerts and recommendations in Microsoft Defender for Cloud
The Security Reader role grants read-only access to security settings, alerts, and recommendations without the ability to make changes.
Question 4: An Azure SQL Database must reject connections from all IP addresses except those from within an Azure Virtual Network. What is the most secure configuration?
- Private endpoint with public endpoint disabled (Correct answer)
- Virtual network service endpoint with firewall rule
- IP-based firewall rule for the VNet address space
- Azure AD authentication only
Correct answer: Private endpoint with public endpoint disabled
A private endpoint assigns a private IP to the SQL server within the VNet, and disabling the public endpoint eliminates all public internet access.
Question 5: Which tool in Microsoft Sentinel is used to create automated response actions when a specific security alert is triggered?
- Playbook using Azure Logic Apps (Correct answer)
- Analytics rule with KQL query
- Workbook dashboard
- Data connector
Correct answer: Playbook using Azure Logic Apps
Microsoft Sentinel playbooks are built on Azure Logic Apps and can be triggered by alerts to automate incident response actions.
Question 6: You need to ensure that a service principal used by a CI/CD pipeline can only access Azure resources for 1 hour. Which approach achieves this?
- Use a managed identity with conditional access time restrictions
- Create a temporary role assignment using PIM for service principals (Correct answer)
- Issue a short-lived client secret and rotate it hourly
- Use a SAS token scoped to the pipeline run
Correct answer: Create a temporary role assignment using PIM for service principals
PIM supports time-bound eligible role assignments for service principals, enabling just-in-time access with automatic expiration.
Question 7: An attacker has exfiltrated data from an Azure Storage account via an overly permissive SAS token. Which control would have best prevented this?
- User delegation SAS with short expiry and stored access policy
- IP-based firewall rule on the storage account
- Azure AD authentication with RBAC instead of SAS tokens (Correct answer)
- Enabling soft delete on the storage account
Correct answer: Azure AD authentication with RBAC instead of SAS tokens
Using Azure AD authentication with RBAC eliminates shared-key-based SAS tokens entirely, removing the attack vector.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 3
Your organization stores connection strings in Azure App Service application settings.
What is the recommended security improvement?