Microsoft Certified: Cloud and AI Security Engineer Associate (beta) — Practice Set 1

Question 1

You are a security engineer at a financial services company. You need to ensure that users can only access Azure resources during business hours and only from compliant devices. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID allow you to define conditions under which access is granted, including time-based restrictions and device compliance requirements. PIM manages privileged role assignments. External Identities handles guest users. Identity Protection risk policies respond to detected risks, not scheduling.

Question 2

Your organization uses Azure resources and you need to ensure that a virtual machine can authenticate to Azure Key Vault without storing credentials in code or configuration files. Which solution should you implement?

Accepted Answer

A system-assigned managed identity automatically creates an identity in Microsoft Entra ID tied to the VM's lifecycle. The VM can authenticate to Azure services like Key Vault without any stored credentials. Service principals require credential management. App registrations are typically for applications, not VMs. SAS tokens are for Azure Storage, not Key Vault authentication.

Question 3

You are reviewing access assignments in your Azure subscription. You discover a service account has Owner permissions on a resource group but only needs to read storage blob data. You need to apply the principle of least privilege. What should you do?

Accepted Answer

Removing the Owner role and granting only the Storage Blob Data Reader role on the specific storage account applies least privilege by scoping both the permission and the resource. Assigning Reader at subscription level still grants broader access than needed. Deny assignments block actions but do not remove existing elevated permissions. PIM for the Owner role still provides elevated access on demand.

Question 4

You are configuring Azure Key Vault to store application secrets. You need to implement security controls that restrict network access and protect against unauthorized access. Which two actions should you take? Choose 2.

Accepted Answer

Configuring the firewall to allow only specific virtual network subnets and deploying a private endpoint while disabling public network access are the two primary network security controls for Key Vault. Soft-delete and purge protection are important for data recovery but not for network access restriction. Storing access policies in a repository is a security risk. Assigning Key Vault Contributor to developers violates least privilege.

Question 5

Your organization needs to enforce that all Azure resources are deployed only in approved regions and that all storage accounts must have HTTPS traffic only enabled. You need to implement these controls at scale using infrastructure as code. Which approach should you use?

Accepted Answer

A custom Azure Policy initiative containing the allowed locations policy and the storage HTTPS policy, deployed via ARM template or Bicep, implements governance as code and enforces controls at scale across subscriptions. Management groups provide organizational hierarchy but not automatic enforcement. Azure Blueprints uses policies but is being deprecated. Defender for Cloud recommendations are reactive, not preventative.

Question 6

You need to grant an application team temporary elevated access to manage Azure SQL databases for a planned maintenance window, with automatic expiration after 4 hours. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra PIM allows just-in-time (JIT) role activation with configurable time limits, providing temporary elevated access that expires automatically. Conditional Access controls how users access resources but does not provide time-limited role elevation. Access reviews periodically review existing access. Entitlement management handles access packages for ongoing access, not temporary elevation.

Question 7

Your organization stores sensitive documents in Azure Blob Storage. You need to ensure that data is encrypted with keys managed by your organization rather than Microsoft-managed keys. Which storage encryption option should you configure?

Accepted Answer

Customer-managed keys (CMK) stored in Azure Key Vault allow your organization to control the encryption keys used to protect Azure Storage data. Microsoft-managed keys are handled by Microsoft without customer control. Client-side encryption is complex and requires key management outside Azure. SAS tokens control access but do not determine encryption key ownership.

Question 8

You are a security engineer for a healthcare company. Your Azure storage account must be accessible only from a specific Azure virtual network subnet. External internet access must be blocked. Which configuration achieves this requirement?

Accepted Answer

Azure Storage firewall rules allow you to restrict access to specific virtual network subnets by enabling virtual network service endpoints or private endpoints, blocking public internet access. Access policies control what operations can be performed, not where connections originate. Defender for Storage detects threats but does not block network access. LRS is a replication strategy unrelated to network access.

Question 9

Your organization has deployed Azure SQL Database and you need to detect suspicious database activities, such as unusual access patterns and potential SQL injection attacks. Which feature should you enable?

Accepted Answer

Microsoft Defender for Azure SQL provides advanced threat protection that detects anomalous activities, potential vulnerabilities, and SQL injection attacks, generating security alerts. TDE encrypts data at rest but does not detect threats. Geo-replication provides high availability. Long-term retention is for backup management, not threat detection.

Question 10

You need to allow internal Azure virtual machines to communicate with an Azure PaaS service without traversing the public internet. The connection must use a private IP address within your virtual network. Which solution should you implement?

Accepted Answer

Azure Private Endpoint, powered by Azure Private Link, assigns a private IP address from your virtual network to a PaaS service, allowing traffic to flow over the Microsoft backbone without traversing the public internet. VNet peering connects virtual networks but does not create private endpoints for PaaS services. Application Gateway is for HTTP/S load balancing. VPN gateway is for connecting on-premises networks to Azure.

Question 11

You are designing network security for a hub-and-spoke Azure architecture. You need to inspect all east-west traffic between spokes and all outbound internet traffic from spoke virtual networks. The solution must support FQDN-based filtering rules. Which Azure service should you deploy in the hub virtual network?

Accepted Answer

Azure Firewall Premium deployed in the hub virtual network provides centralized inspection of east-west and outbound traffic, with support for FQDN-based application rules and TLS inspection. NSGs filter traffic at the subnet/NIC level but do not support FQDN filtering or cross-VNet east-west inspection at scale. DDoS Protection defends against volumetric attacks. Azure Front Door is a global load balancer for internet-facing applications.

Question 12

You are configuring security for an Azure SQL Database that stores personally identifiable information (PII). You need to protect data at rest and enable auditing of all database access. Which two actions should you take? Choose 2.

Accepted Answer

TDE with customer-managed keys encrypts the database at rest using keys you control, satisfying data protection requirements. Configuring auditing to log to Azure Storage captures all database access events for compliance and forensic purposes. Geo-replication provides disaster recovery but does not protect PII. Read-only replicas support performance, not security. SQL Server Authentication is less secure than Microsoft Entra ID authentication.

Question 13

You need to verify whether effective NSG rules are blocking legitimate traffic between two virtual machines in your Azure environment. You want to diagnose the issue without making any configuration changes. Which tool should you use?

Accepted Answer

Azure Network Watcher IP flow verify evaluates effective NSG rules for a specific traffic flow (source IP, destination IP, port, protocol) and tells you exactly which NSG rule is allowing or blocking the traffic. Azure Monitor Metrics show aggregate statistics but not specific rule evaluation. Defender for Cloud recommendations identify security misconfigurations but do not diagnose specific blocked flows. Azure Advisor provides general guidance, not real-time diagnostics.

Question 14

Your organization has deployed Azure Kubernetes Service (AKS) to run containerized applications. A security audit reveals that pods can communicate with the Azure Instance Metadata Service (IMDS) endpoint and potentially access node-level tokens. You need to restrict pod access to sensitive cluster resources while maintaining application functionality. Which control should you implement?

Accepted Answer

Kubernetes network policies can be used to block pod egress traffic to the Azure Instance Metadata Service endpoint (169.254.169.254), preventing pods from accessing node-level managed identity tokens or sensitive instance metadata. HTTP application routing is for ingress, not security. Upgrading to Azure CNI changes the network model but does not inherently block IMDS. Auto-scaler manages compute capacity, not security.

Question 15

You need to provide secure administrative access to Azure virtual machines that do not have public IP addresses, without opening inbound RDP or SSH ports through firewalls. Which Azure service should you use?

Accepted Answer

Azure Bastion provides secure and seamless RDP/SSH connectivity to VMs directly through the Azure portal over TLS, without requiring public IP addresses or open inbound RDP/SSH ports on the VM. VPN Gateway provides site-to-site connectivity but still requires RDP/SSH ports. Load Balancer NAT rules expose ports to the internet. Application Gateway is an HTTP/S load balancer, not a VM access solution.

Question 16

Your organization runs workloads on Azure virtual machines. You need to ensure that VMs are only accessible via RDP during maintenance windows, reducing the persistent attack surface. Which Defender for Cloud feature should you enable?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud locks down inbound traffic to VMs by default and opens RDP/SSH ports only when access is explicitly requested and approved, for a limited time window. Adaptive application controls manage which applications are allowed to run. File integrity monitoring detects changes to critical files. Adaptive network hardening recommends NSG rule improvements but does not provide time-limited access.

Question 17

You are implementing security for AI workloads in your organization. Your developers are using Microsoft Copilot Studio to build agents that access sensitive internal data. You need to ensure that runtime inputs and outputs of these agents are monitored for harmful content and data exfiltration. Which control should you configure?

Accepted Answer

Enabling real-time protection for Microsoft Copilot Studio agents in Microsoft Defender XDR monitors agent runtime behaviors including inputs and outputs, detects harmful content generation, and alerts on potential data exfiltration. Conditional Access controls user authentication but not agent runtime behavior. AI Builder Contributor is a role assignment, not a monitoring control. Purview labels protect data classification but do not provide runtime monitoring of agent behavior.

Question 18

You are securing Azure App Service web applications for your organization. You need to enforce HTTPS-only access and restrict the application to receive traffic only from Azure Front Door. Which two configurations should you implement? Choose 2.

Accepted Answer

Enabling HTTPS Only ensures all HTTP traffic is redirected to HTTPS, enforcing encrypted connections. Configuring access restrictions to allow only the AzureFrontDoor.Backend service tag ensures that only Azure Front Door can send traffic to the App Service, blocking direct internet access. Auto-scaling manages capacity. Self-signed certificates are not trusted. Deployment slots are for staging deployments.

Question 19

You need to scan Azure container images for vulnerabilities before they are deployed to production. The scanning results should be integrated into Microsoft Defender for Cloud recommendations. Which Defender for Cloud capability provides this functionality?

Accepted Answer

Microsoft Defender for Containers includes vulnerability assessment that scans images in Azure Container Registry and running containers in AKS, surfacing findings directly in Defender for Cloud recommendations. Defender for Servers scans VMs, not containers. Defender for App Service protects web applications. Defender EASM discovers external-facing assets, not container images.

Question 20

Your organization has Azure resources deployed in multiple Azure subscriptions and also uses Amazon Web Services (AWS). The security team needs a unified view of security posture and compliance across all environments. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud natively supports multi-cloud environments by connecting AWS and GCP accounts alongside Azure subscriptions, providing unified security posture management, compliance assessment against the Microsoft Cloud Security Benchmark, and workload protection across all clouds. Microsoft Sentinel is a SIEM/SOAR tool, not a posture management solution. Azure Monitor focuses on observability, not security posture. Microsoft Purview handles data governance.

Question 21

You need to configure Microsoft Sentinel to collect Windows Security Event logs from Azure virtual machines using an agent-based approach that supports centralized rule management. Which data collection mechanism should you use?

Accepted Answer

Azure Monitor Agent with Data Collection Rules (DCRs) is the current recommended approach for collecting Windows Security Events in Microsoft Sentinel. DCRs allow centralized, scalable configuration of what events to collect from multiple machines. The legacy Log Analytics agent (MMA) is being deprecated. Syslog is for Linux-based log forwarding. Sentinel does not collect events without a configured data connector or collection rule.

Question 22

Your security team has deployed Microsoft Sentinel and needs to automatically respond to a specific incident type by isolating a compromised virtual machine in Microsoft Defender for Endpoint. Which Sentinel feature enables this automated response?

Accepted Answer

Microsoft Sentinel automation rules can trigger Playbooks (Azure Logic Apps) in response to incidents. A Playbook can call the Microsoft Defender for Endpoint API to isolate the compromised VM automatically. Analytics rules detect threats and create incidents but do not perform response actions themselves. Workbooks are for visualization. Watchlists enrich queries with additional data, not automate responses.

Question 23

Your organization needs to implement Microsoft Security Copilot for the security operations team. You are configuring the workspace for first use. Which two resources must you provision during initial Security Copilot setup?

Accepted Answer

Microsoft Security Copilot requires provisioning Security Compute Units (SCUs) as capacity in an Azure subscription, along with a Microsoft Entra tenant for identity management. SCUs determine the processing capacity available to the service. Log Analytics and Sentinel are integrated plugins but not required for initial provisioning. Security Copilot uses its own AI infrastructure, not Azure OpenAI resources directly provisioned by customers. Defender XDR is a data source plugin, not a provisioning requirement.

Question 24

You are onboarding an on-premises Windows Server to Microsoft Defender for Cloud using Azure Arc. You need to enable threat detection and vulnerability assessment on the server. Which two steps are required? Choose 2.

Accepted Answer

Installing the Azure Connected Machine agent onboards the on-premises server to Azure Arc, making it an Arc-enabled server. Enabling the Defender for Servers plan on the Arc-enabled server then provides threat detection, vulnerability assessment, and EDR capabilities. Migrating to a VM is not required; Arc extends protection to non-Azure machines. ExpressRoute provides network connectivity but is not required for Defender for Cloud Arc onboarding. Intune is for device management, not Defender for Cloud onboarding.

Question 25

Your organization's Defender for Cloud secure score has decreased significantly. The Defender CSPM plan is enabled. You investigate and find multiple attack path findings that indicate a storage account with public access is reachable from an internet-exposed VM that has a managed identity with Storage Blob Data Contributor permissions. Which Defender CSPM feature surfaces this chained risk finding?

Accepted Answer

Defender CSPM attack path analysis identifies multi-step attack paths that chain together misconfigurations and excessive permissions, such as an internet-exposed VM with a privileged managed identity that can access a storage account with public access. Standard Defender for Cloud recommendations flag individual issues but do not chain them into attack paths. EASM discovers external attack surface but does not model internal lateral movement paths. Microsoft Sentinel is a SIEM used for threat detection and investigation, not posture attack paths.

SC-500 — Cloud and AI Security Engineer Associate