Microsoft Certified: Azure Security Engineer Associate practice questions

Question 1

A security operations engineer is rolling out additional non-default compliance standards in Defender for Cloud for a fintech subscription and asks what Microsoft documents about adding non-default standards. Per the Microsoft documentation, which option matches?

Accepted Answer

By default, when you enable Defender for Cloud on an Azure subscription, AWS account, or GCP plan, the MCSB plan is enabled. You can add more non-default compliance standards when at least one paid plan is enabled in Defender for Cloud.

Answer

Non-default compliance standards in Defender for Cloud are limited exclusively to Azure subscriptions and cannot be assigned to AWS accounts or GCP projects even with paid plans enabled.

Answer

Non-default compliance standards in Defender for Cloud can be added free of charge on the foundational MCSB plan without enabling any paid Defender for Cloud workload-protection plan.

Answer

Non-default compliance standards in Defender for Cloud can only be added by Microsoft Support through a service request and the customer cannot self-service add any non-default standard.

Question 2

A security architect is rolling out Azure managed disk encryption across a defense-contractor subscription and asks how Microsoft documents the always-on encryption behavior of Azure-managed-disk Server-Side Encryption. Per the Microsoft documentation, which option matches?

Accepted Answer

Azure Disk Storage Server-Side Encryption (also referred to as encryption-at-rest or Azure Storage encryption) is always enabled and automatically encrypts data stored on Azure managed disks (OS and data disks) when persisting on the Storage Clusters.

Answer

Azure Disk Storage Server-Side Encryption is a billing-only abstraction that surfaces in Microsoft Cost Management consumption reports and does not actually encrypt any persisted disk content.

Answer

Azure Disk Storage Server-Side Encryption is disabled by default and must be enabled per disk through Defender for Cloud secure-score recommendations before any OS or data disk is encrypted.

Answer

Azure Disk Storage Server-Side Encryption only protects temp disks and disk caches by default and the OS and data disks remain unencrypted unless the customer enables Azure Disk Encryption.

Question 3

A SOC analyst is tasked with investigating an asymmetric routing alert and asks how Azure documents subnet-to-route-table association in Microsoft Learn for user-defined routes. Per the Microsoft documentation, which option matches?

Accepted Answer

In Azure, you create a route table and then associate the route table to zero or more virtual network subnets. Each subnet can have zero or one route table associated to it.

Answer

In Azure, each subnet is required to have at least three route tables associated to it for high availability and the platform automatically deletes any subnet with fewer than two route tables.

Answer

In Azure, route tables can only be associated to virtual networks at the VNet level and propagate identically to every subnet inside the VNet without per-subnet override.

Answer

In Azure, the relationship between route tables and subnets is many-to-many and a single subnet can be associated with up to 32 route tables that the platform evaluates round-robin.

Question 4

A security architect in a defense tenant is rolling out managed identities to remove static secrets from VM-hosted code and asks what the documentation says managed identities replace. Per the Microsoft documentation, which option matches?

Accepted Answer

Managed identity replaces secrets such as access keys or passwords. In addition, managed identities can replace certificates or other forms of authentication for service-to-service dependencies.

Answer

Managed identities replace the tenant's primary Microsoft Entra ID directory tenant for service-to-service authentication and disable user sign-ins for the entire subscription.

Answer

Managed identities replace the need for Azure RBAC role assignments entirely because every managed identity is granted Owner at the subscription scope by default.

Answer

Managed identities replace network security groups by routing all VM traffic through Microsoft Defender for Cloud's CWPP gateway before it leaves the virtual network.

Question 5

A SOC analyst is tasked with investigating an incident in Microsoft Sentinel for a healthcare HIPAA tenant and asks how Microsoft documents where severity and status are managed for a Sentinel incident. Per the Microsoft documentation, which option matches?

Accepted Answer

An incident is created based on analytics rules that you created in the Analytics page. The properties related to the alerts, such as severity and status, are set at the incident level.

Answer

Microsoft Sentinel incidents do not have severity or status properties and Microsoft documents that SOC analysts must track incident state manually in an external ticketing system.

Answer

Severity and status of a Microsoft Sentinel incident are set at the analytics-rule level and Microsoft documents that these properties cannot be overridden at the per-incident level.

Answer

Severity and status of a Microsoft Sentinel incident are inherited from Microsoft Defender for Cloud's secure-score control assigned to the relevant subscription and cannot be changed per incident.

Question 6

A database security lead is designing the separation of duties for sensitive SSN columns in a fintech Azure SQL Database and asks how Always Encrypted is documented to achieve duty separation between data owners and database admins. Per the Microsoft documentation, which option matches?

Accepted Answer

This approach provides a separation between those who own the data and can view it, and those who manage the data but should have no access: on-premises database administrators, cloud database operators, or other high-privileged unauthorized users.

Answer

Always Encrypted grants every database administrator full plain-text access to the sensitive columns and relies only on Microsoft Sentinel auditing for separation of duties between roles.

Answer

Always Encrypted requires every database administrator to also hold the role of column owner so that the same Microsoft Entra ID user can both manage and read the sensitive column.

Answer

Always Encrypted exposes plain-text values to high-privileged unauthorized users by design and Microsoft documents that separation of duties must be enforced at the application layer instead.

Question 7

A SOC analyst is tasked with investigating Azure Network Watcher capabilities during a Sentinel investigation for a fintech subscription and asks what Network Watcher is documented to provide. Per the Microsoft documentation, which option matches?

Accepted Answer

Azure Network Watcher provides a suite of tools to monitor, diagnose, view metrics, and enable or disable logs for Azure IaaS (Infrastructure-as-a-Service) resources.

Answer

Azure Network Watcher is a PaaS analytics product for Azure App Service and Azure Functions and does not surface metrics or logs for IaaS resources like virtual machines.

Answer

Azure Network Watcher only generates synthetic traffic for load testing and does not provide diagnostic tools, NSG analysis, or network log capture for IaaS workloads.

Answer

Azure Network Watcher is a billing-scoped tag service that surfaces consumption reports in Microsoft Cost Management and has no monitoring or diagnostic capability.

Question 8

An identity admin in a healthcare HIPAA-scoped tenant is tasked with hardening PIM and the CISO asks which specific safeguard PIM enforces when an eligible user attempts to activate a privileged role. Per the Microsoft documentation, which option matches?

Accepted Answer

Enforce multifactor authentication to activate any role; Use justification to understand why users activate; Get notifications when privileged roles are activated.

Answer

Block any role activation that has not been signed by a hardware security module enrolled in the tenant's Key Vault Managed HSM at the time of the request.

Answer

Forward the activation request to Microsoft Defender for Identity for offline review and prohibit any activation until a SOC analyst manually signs off in Sentinel.

Answer

Require the user to disable Conditional Access on their account for the duration of the activation so legacy applications continue to authenticate uninterrupted.

Question 9

A SOC engineer is designing a new scheduled analytics rule in Microsoft Sentinel and asks what the very first task should be before configuring scheduling, entity mapping, or alert thresholds. What should they do first?

Accepted Answer

Design and build a KQL query that the rule will run against Log Analytics workspace tables.

Answer

Assign the rule to an automation rule so that incidents are grouped before any query exists at all.

Answer

Connect a data connector from the Content hub and let it auto-author the rule's detection logic.

Answer

Enable UEBA so behavioral baselines populate the workspace before the analytics rule is built.

Question 10

A SOC analyst is tasked with investigating an expired-token error from az acr login in a healthcare CI pipeline and asks how long the token used by az acr login is documented to remain valid before re-authentication is required. Per the Microsoft documentation, which option matches?

Accepted Answer

For registry access, the token that az acr login uses is valid for 3 hours, so always sign in to the registry before running a docker command.

Answer

For registry access, the token used by az acr login is valid for 5 minutes and the CLI automatically re-runs az login on every docker pull to retrieve a fresh token from the registry.

Answer

For registry access, the token used by az acr login is valid for 24 hours and is automatically refreshed by the Docker daemon every time docker pull is invoked without a re-login.

Answer

For registry access, the token used by az acr login is permanent and stored in ~/.docker/config.json for the lifetime of the user account on the workstation or build agent.

Question 11

A customer needs to reach an Azure SQL Database and an Azure Storage account from a virtual network without exposing those services to the public internet, keeping the traffic on Microsoft's network. Which service is documented to do this over a private endpoint?

Accepted Answer

Azure Private Link, keeping traffic on the Microsoft backbone with no public internet exposure.

Answer

Azure Virtual Network Manager, deploying security admin rules across grouped virtual networks.

Answer

Azure DDoS Protection, auto-tuned to protect the resources inside a virtual network instance.

Answer

Azure Application Gateway, terminating TLS and routing web requests by URL path and host header.

Question 12

A security architect at a fintech is rolling out Microsoft Entra Privileged Identity Management for a tightly regulated tenant and must confirm what PIM is fundamentally designed to do for privileged role assignments. Per the Microsoft documentation, which option matches?

Accepted Answer

Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about.

Answer

Privileged Identity Management is a network-layer service that filters inbound role-elevation requests using NSG rules attached to the Microsoft Entra tenant subnet.

Answer

Privileged Identity Management automatically deletes any role assignment older than 24 hours from the tenant regardless of approval state or business justification.

Answer

Privileged Identity Management bypasses Conditional Access policies for activated privileged roles so administrators can respond to incidents without delay.

Question 13

A SOC architect is rolling out the Sentinel investigation graph for a retail PCI-DSS subscription and asks how Microsoft documents the role of the investigation graph for SOC analysts. Per the Microsoft documentation, which option matches?

Accepted Answer

The investigation graph helps you understand the scope, and identify the root cause, of a potential security threat by correlating relevant data with any involved entity.

Answer

The Sentinel investigation graph is a read-only visualization of NSG flow logs and does not correlate any entities or surface root-cause information for an active incident in the workspace.

Answer

The Sentinel investigation graph is a billing primitive that surfaces Microsoft Cost Management consumption for the Log Analytics workspace and does not perform any incident scoping.

Answer

The Sentinel investigation graph is a Microsoft 365 Defender feature only and Microsoft documents that it is not available for Sentinel-native analytics-rule incidents in the workspace.

Question 14

A GRC team is tasked with hardening storage account key management for a healthcare HIPAA subscription and asks what Microsoft recommends for storage account access key management. Per the Microsoft documentation, which option matches?

Accepted Answer

Microsoft recommends that you use Azure Key Vault to manage your access keys, and that you regularly rotate and regenerate your keys.

Answer

Microsoft recommends rotating storage account access keys only when a breach is suspected and never on a regular schedule, because regular rotation introduces unnecessary application risk.

Answer

Microsoft recommends storing storage account access keys inside the application source repository alongside the code so the keys travel with the application configuration during deployment.

Answer

Microsoft recommends embedding storage account access keys directly into the connection string field on the storage account resource itself and disabling Azure Key Vault integration.

Question 15

A security architect is tasked with hardening the backend connectivity model for Azure Application Gateway in a defense tenant and asks how Microsoft documents Application Gateway integration with Private Link and zero trust. Per the Microsoft documentation, which option matches?

Accepted Answer

Protect your applications against L7 layer DDoS protection by using WAF. Privately connect to your backend behind Application Gateway with Private Link and embrace a zero-trust access model.

Answer

Application Gateway requires every backend to be exposed over a public IP address and cannot integrate with Private Link, forcing zero-trust architectures to use Azure Front Door instead.

Answer

Application Gateway proxies all backend traffic through Azure Bastion when zero trust is enabled, and Private Link is documented as incompatible with the WAF policy on Application Gateway.

Answer

Application Gateway disables the WAF when Private Link is configured on the backend, because TLS inspection cannot be performed inside a Private Link connection per Microsoft documentation.

Microsoft Certified: Azure Security Engineer Associate

Sample questions

Sources

Similar exams