Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 4 — Questions and Answers
Question 1: A company needs to monitor all administrative operations performed on Azure resources across all subscriptions for compliance auditing. Which log source should they query?
- Azure Activity Log (Correct answer)
- Azure Resource Diagnostic Logs
- Azure AD Audit Logs
- Microsoft Defender for Cloud alerts
Correct answer: Azure Activity Log
The Azure Activity Log records all control-plane operations (create, update, delete) across Azure resources at the subscription level.
Question 2: You are designing network security for an Azure Kubernetes Service cluster. Which feature enforces network policies between pods?
- Kubernetes Network Policy with Azure CNI or Calico (Correct answer)
- Azure NSG applied to the AKS node subnet
- Azure Firewall Premium with IDPS
- Azure Application Gateway Ingress Controller
Correct answer: Kubernetes Network Policy with Azure CNI or Calico
Kubernetes Network Policies enforce pod-to-pod traffic rules and require a compatible CNI plugin like Azure CNI with Calico.
Question 3: Which encryption option in Azure allows you to maintain control of your own encryption keys stored outside of Azure?
- Customer-managed keys with Azure Key Vault
- Platform-managed keys
- Double encryption with infrastructure encryption
- Customer-managed keys with Bring Your Own Key (BYOK) to an on-premises HSM (Correct answer)
Correct answer: Customer-managed keys with Bring Your Own Key (BYOK) to an on-premises HSM
BYOK allows customers to generate and manage their master keys in an on-premises HSM and import key material to Azure Key Vault Managed HSM.
Question 4: An organization's Azure AD tenant has guest users from partner companies. How should you regularly review whether these guests still need access?
- Azure AD Access Reviews (Correct answer)
- PIM recurring role review
- Conditional Access user exclusion audit
- Azure AD entitlement management catalog review
Correct answer: Azure AD Access Reviews
Azure AD Access Reviews allow periodic automated reviews where resource owners or the guests themselves confirm continued need for access.
Question 5: A web application on Azure App Service is receiving SQL injection attacks. Which service should you enable to detect and block these attacks?
- Azure Application Gateway with WAF in Prevention mode (Correct answer)
- Azure DDoS Protection Standard
- Microsoft Defender for App Service
- Azure Front Door with bot protection
Correct answer: Azure Application Gateway with WAF in Prevention mode
Azure Application Gateway WAF in Prevention mode actively blocks requests matching OWASP CRS rules including SQL injection signatures.
Question 6: Which Azure Security Center feature assigns a numeric score that helps you understand your overall security posture?
- Secure Score (Correct answer)
- Compliance dashboard percentage
- Resource health score
- Attack path analysis risk score
Correct answer: Secure Score
Secure Score in Microsoft Defender for Cloud aggregates security recommendations into a percentage-based score reflecting your security posture.
Question 7: You need to allow a developer's application to access Azure Key Vault secrets without storing any credentials in the code or configuration. What is the best approach?
- Assign a system-assigned managed identity to the app and grant it Key Vault access policy (Correct answer)
- Store a client secret in Azure App Configuration
- Use a certificate-based service principal with auto-rotation
- Configure Key Vault firewall to allow the app's IP only
Correct answer: Assign a system-assigned managed identity to the app and grant it Key Vault access policy
A system-assigned managed identity provides an automatically managed Azure AD identity that authenticates to Key Vault without any stored credentials.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 4
A company needs to monitor all administrative operations performed on Azure resources across all subscriptions for compliance auditing.
Which log source should they query?