Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 5 — Questions and Answers
Question 1: Microsoft Sentinel is configured to ingest Azure AD sign-in logs. Which built-in analytics rule type uses machine learning to detect anomalous sign-in patterns?
- Anomaly detection rules (UEBA) (Correct answer)
- Scheduled KQL query rules
- Microsoft Security incident creation rules
- Fusion rules for multi-stage attacks
Correct answer: Anomaly detection rules (UEBA)
UEBA (User and Entity Behavior Analytics) anomaly rules use machine learning baselines to detect deviations from normal user behavior.
Question 2: An Azure subscription contains resources that must comply with PCI-DSS. Which Defender for Cloud feature provides PCI-DSS compliance status visibility?
- Regulatory compliance dashboard (Correct answer)
- Secure Score recommendations
- Attack path analysis
- Cloud Security Posture Management (CSPM) inventory
Correct answer: Regulatory compliance dashboard
The regulatory compliance dashboard in Defender for Cloud maps Azure resource configurations to PCI-DSS controls and shows pass/fail status.
Question 3: A multi-tenant application registered in Azure AD must only be accessible by users from specific partner tenants. What configuration enforces this?
- Cross-tenant access settings with specific tenant allowlist in External Identities (Correct answer)
- Conditional Access policy scoped to guest users
- Application manifest accessTokenAcceptedVersion restriction
- Azure AD B2B direct federation with allowed domains
Correct answer: Cross-tenant access settings with specific tenant allowlist in External Identities
Cross-tenant access settings in Azure AD External Identities allow you to allowlist specific partner tenant IDs for inbound B2B collaboration.
Question 4: Your team needs to investigate a suspected lateral movement attack across Azure VMs. Which Microsoft Sentinel feature visually maps relationships between entities in an incident?
- Investigation graph (Correct answer)
- Hunting queries
- Workbook visualization
- Threat intelligence TAXII feed
Correct answer: Investigation graph
The Microsoft Sentinel investigation graph visually maps entities, alerts, and their relationships to help analysts understand attack chains.
Question 5: An Azure Storage account must prevent all access using the legacy Shared Key authorization method. Which setting enforces this?
- Disabling 'Allow storage account key access' in the storage account settings (Correct answer)
- Removing all stored access policies
- Enabling Azure AD-only authentication in Defender for Storage
- Setting the minimum TLS version to 1.2
Correct answer: Disabling 'Allow storage account key access' in the storage account settings
The 'Allow storage account key access' setting, when disabled, forces all requests to use Azure AD authentication and rejects Shared Key authorization.
Question 6: A security engineer needs to prevent Azure resources from being deployed to regions outside of US East and US West. What is the correct implementation?
- Azure Policy with 'Allowed locations' built-in policy definition (Correct answer)
- Azure Blueprint with resource group lock
- Azure Management Group deny assignment
- Subscription-level RBAC restriction by location
Correct answer: Azure Policy with 'Allowed locations' built-in policy definition
The built-in 'Allowed locations' Azure Policy definition restricts resource deployment to the specified list of Azure regions.
Question 7: Which Azure DDoS Protection tier provides adaptive tuning, attack metrics, and post-attack analysis reports for critical workloads?
- Azure DDoS Protection Network Protection (formerly Standard) (Correct answer)
- Azure DDoS Protection IP Protection
- Azure DDoS Protection Basic
- Azure Firewall Premium with IDPS
Correct answer: Azure DDoS Protection Network Protection (formerly Standard)
Azure DDoS Network Protection provides adaptive real-time tuning, detailed attack telemetry, and post-attack mitigation reports for protected VNets.
Microsoft Azure Security Engineer Certification Microsoft Azure Security Technologies 5
Microsoft Sentinel is configured to ingest Azure AD sign-in logs.
Which built-in analytics rule type uses machine learning to detect anomalous sign-in patterns?