Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 3

Question 1

Your organization stores connection strings in Azure App Service application settings. What is the recommended security improvement?

Accepted Answer

Reference secrets from Azure Key Vault using managed identity

Answer

Encrypt the application settings manually

Answer

Store secrets in Azure Blob Storage with SAS tokens

Answer

Use Azure AD B2C for secret management

Question 2

Which Azure Defender plan specifically protects container images in Azure Container Registry by scanning for vulnerabilities?

Accepted Answer

Microsoft Defender for Containers

Answer

Microsoft Defender for App Service

Answer

Microsoft Defender for Servers

Answer

Microsoft Defender for Storage

Question 3

A user in Azure AD is assigned the Security Reader role. Which action are they permitted to perform?

Accepted Answer

View security alerts and recommendations in Microsoft Defender for Cloud

Answer

Remediate security findings in Defender for Cloud

Answer

Create Conditional Access policies

Answer

Manage Azure AD Identity Protection settings

Question 4

An Azure SQL Database must reject connections from all IP addresses except those from within an Azure Virtual Network. What is the most secure configuration?

Accepted Answer

Private endpoint with public endpoint disabled

Answer

Virtual network service endpoint with firewall rule

Answer

IP-based firewall rule for the VNet address space

Answer

Azure AD authentication only

Question 5

Which tool in Microsoft Sentinel is used to create automated response actions when a specific security alert is triggered?

Accepted Answer

Playbook using Azure Logic Apps

Answer

Analytics rule with KQL query

Answer

Workbook dashboard

Answer

Data connector

Question 6

You need to ensure that a service principal used by a CI/CD pipeline can only access Azure resources for 1 hour. Which approach achieves this?

Accepted Answer

Create a temporary role assignment using PIM for service principals

Answer

Use a managed identity with conditional access time restrictions

Answer

Issue a short-lived client secret and rotate it hourly

Answer

Use a SAS token scoped to the pipeline run

Question 7

An attacker has exfiltrated data from an Azure Storage account via an overly permissive SAS token. Which control would have best prevented this?

Accepted Answer

Azure AD authentication with RBAC instead of SAS tokens

Answer

User delegation SAS with short expiry and stored access policy

Answer

IP-based firewall rule on the storage account

Answer

Enabling soft delete on the storage account

Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 3

What Practice Test Geeks adds beyond an AI chat for Microsoft Azure Security Engineer Certification

Sources & references