Governance & Key Management

Which Azure governance feature lets you audit or deny the creation of resources that do not meet organizational standards, such as requiring a specific tag or blocking public IP addresses?

• AA resource lock
• BAzure Policy✓
• CA network security group
• DMicrosoft Entra PIM

Answer: Azure Policy evaluates resources against rules and can audit non-compliant resources or use a deny effect to block creation that violates standards, such as missing tags or disallowed resource types. Resource locks only prevent deletion or modification of existing resources.

You want to deploy a related set of resources, role assignments and policy assignments as a single managed unit, so that deleting the unit also removes everything it created. What should you use?

• AA management lock
• BAzure Advisor
• CAzure deployment stacks✓
• DA single resource group

Answer: A deployment stack manages a collection of Azure resources — including role and policy assignments — as one unit with a defined lifecycle, so the whole set can be updated or torn down together. It is the supported successor to Azure Blueprints, which has retired. A management lock only blocks changes, Azure Advisor makes recommendations, and a resource group is a container that does not itself manage policy or role assignments as a unit.

You want to use your own key from Azure Key Vault to encrypt Azure Storage data at rest instead of a Microsoft-managed key. Which feature provides this?

• AClient-side encryption only
• BA user delegation SAS
• CAzure Disk Encryption
• DCustomer-managed keys for storage encryption✓

Answer: Customer-managed keys let you control the encryption key for storage service encryption by storing it in Azure Key Vault, including rotation and revocation. Azure Disk Encryption applies to VM disks, not storage account blob and file data.

You need to store cryptographic keys in hardware security modules validated to FIPS 140-3 Level 3 for a compliance requirement. Which Azure Key Vault option should you choose?

• AA storage account with infrastructure encryption
• BA Microsoft Entra application certificate
• CThe standard tier with software-protected keys
• DThe premium tier with HSM-protected keys✓

Answer: The Key Vault premium tier stores keys in hardware security modules validated to FIPS 140-3 Level 3, meeting stricter compliance needs. The standard tier protects keys in software, which does not satisfy the HSM requirement.

To prevent secrets in Azure Key Vault from being permanently lost if deleted, which two related protections should be enabled?

• AAzure RBAC and vault access policies
• BLogging and metrics
• CSoft delete and purge protection✓
• DFirewall and private endpoint

Answer: Soft delete retains deleted vaults and objects for a recovery period, and purge protection blocks permanent deletion until that period elapses, together guarding against accidental or malicious loss. Firewalls and RBAC control access, not recoverability.

Which assignment grants the least privilege for a user who only needs to read secret values from an Azure Key Vault that uses the Azure RBAC permission model?

• AContributor on the resource group
• BKey Vault Secrets User✓
• COwner on the key vault
• DKey Vault Administrator

Answer: The Key Vault Secrets User role grants read access to secret contents only, following least privilege. Owner, Contributor, and Key Vault Administrator grant far broader permissions than required.

You need to apply a baseline security policy to every current and future subscription in your organization in one place. At which scope should you assign the Azure Policy initiative?

• AThe root management group✓
• BEach individual resource
• CA single resource group
• DA storage account container

Answer: Assigning a policy initiative at a management group, such as the root or tenant management group, applies it to all subscriptions beneath it, including ones added later, providing organization-wide enforcement. Assigning at a resource group only covers that group.

You want Azure Key Vault to automatically rotate a stored certificate before it expires and notify you in advance. Which Key Vault capability supports this?

• AManual export of the certificate to a file share before its expiry date, then reimporting the renewed copy
• BA shared access signature, which is a delegated access token for storage and is not issued by Key Vault
• CA network access control list
• DCertificate auto-rotation policies with lifetime actions✓

Answer: Key Vault certificate policies support automatic renewal and lifetime action notifications, so certificates can be rotated before expiry without manual intervention. Network ACLs and SAS tokens do not manage certificate lifecycles.

You want to centrally create, manage, and reuse firewall rule collections across multiple Azure Firewall instances in different regions. Which resource should you use?

• AAn application security group
• BA network security group
• CAzure Firewall Policy✓
• DA route table

Answer: Azure Firewall Policy is a global resource that holds rule collections and settings and can be associated with multiple firewalls, supporting hierarchical and reusable configuration. Network security groups cannot be centrally shared across firewalls in this way.

You want to ensure that a storage account only accepts traffic from a specific virtual network subnet and denies all other public network access. Which storage account capability should you configure?

• AInfrastructure encryption
• BA management lock
• CStorage firewall rules with selected virtual networks and a default deny✓
• DA user delegation SAS signed with Microsoft Entra credentials, which limits what a holder may do but not where they connect from

Answer: The storage account firewall lets you set the default action to deny and allow access only from selected virtual network subnets or IP ranges, restricting the public endpoint. Encryption and locks do not control network access.

A virtual machine scale set must encrypt its temporary and OS disks while keeping the encryption keys under your control in Key Vault. Which combination provides customer-controlled disk encryption keys?

• AServer-side encryption with a platform-managed key, on by default and leaving key rotation with Microsoft
• BServer-side encryption with a customer-managed key via a disk encryption set✓
• CTransparent Data Encryption, which protects SQL database files at rest and does not apply to managed disks
• DA shared access signature granting time-limited access to storage data and performing no encryption

Answer: A disk encryption set lets you apply server-side encryption to managed disks using a customer-managed key stored in Key Vault, so you control key rotation and revocation. Microsoft-managed keys do not give you that control, and TDE applies to databases.

You want to ensure an Azure Kubernetes Service cluster only pulls images from your trusted Azure Container Registry and blocks images from other registries. Which control enforces this admission policy?

• AA storage account firewall restricting which networks may reach the blob and file endpoints
• BA network security group on the node subnet, which filters traffic by port and address rather than by image origin
• CAzure Policy for AKS with an allowed registries constraint✓
• DA route table with a default next hop

Answer: Azure Policy for AKS uses the built-in Gatekeeper admission controller to enforce constraints such as allowing container images only from approved registries, blocking others at deployment. Network security groups and routes cannot inspect image sources.

You want to deny the creation of any storage account that does not enforce HTTPS-only traffic across all subscriptions. Which Azure Policy effect should the assigned policy use?

• ADeny✓
• BAudit
• CAppend
• DDisabled

Answer: The Deny effect blocks the resource request when it violates the rule, so a storage account without secure transfer enforced cannot be created. The Audit effect would only flag non-compliance after the fact without preventing creation.

You want Azure Policy to automatically deploy a missing diagnostic setting on resources that lack one, remediating them rather than only reporting. Which policy effect supports this automated remediation?

• AAudit
• BDeny
• CDeployIfNotExists✓
• DDisabled

Answer: The DeployIfNotExists effect runs a remediation deployment, such as adding a diagnostic setting, when the condition is met, using a managed identity to apply the change. Audit and Deny do not deploy remediation resources.

You need to prevent anyone, including subscription owners, from accidentally deleting a critical resource group while still allowing changes to resources inside it. Which control should you apply?

• AA ReadOnly lock on the resource group, which would also block any change to the resources inside it
• BAn Azure Policy audit rule
• CA network security group
• DA CanNotDelete (Delete) resource lock on the resource group✓

Answer: A CanNotDelete lock prevents deletion of the resource group and its resources while still permitting read and modify operations. A ReadOnly lock would also block modifications, which is more restrictive than required.

You must ensure that secrets, keys, and certificates retrieved from Azure Key Vault are logged for audit and that access can be restricted to a single virtual network. Which two Key Vault capabilities together address this?

• AInfrastructure encryption and a CanNotDelete lock, double-encrypting the data at rest and stopping the vault being removed
• BDiagnostic logging to Log Analytics and Key Vault firewall with virtual network rules✓
• CSoft delete and purge protection on the vault
• DA shared access signature and a route table, neither of which is issued or evaluated by Key Vault at all

Answer: Enabling diagnostic logging sends Key Vault access events to Log Analytics for audit, while the Key Vault firewall with virtual network rules restricts access to an approved network. Soft delete and purge protection address recoverability, not auditing or network restriction.

You need to ensure that every resource group in production carries a costCentre tag, and resources without it should inherit the tag from their resource group automatically. Which Azure Policy effect adds the missing tag?

• AAudit
• BModify with a remediation task✓
• CDeny
• DDisabled

Answer: The Modify effect can add or update tags on resources and, with a remediation task and managed identity, can apply the inherited tag to existing resources. Deny would block creation rather than add the tag, and Audit only reports.

Your organisation requires that a specific set of policies, role assignments, and resource configurations be deployed consistently to every new landing zone subscription, with drift tracked. Which approach is recommended for repeatable governance at scale today?

• AManually configure each new subscription from a written runbook as it is handed over to the team
• BUse infrastructure as code with Azure Policy assignments at management group scope✓
• CEmail a checklist
• DApply a single resource lock

Answer: Deploying governance via infrastructure as code with policy assignments at the management group scope provides consistent, repeatable, and trackable configuration across subscriptions in a landing-zone model. Manual configuration and checklists do not ensure consistency or drift tracking.

You must prevent any resource in a subscription from being created outside an approved list of Azure regions for data residency. Which Azure Policy built-in addresses this?

• AAllowed locations✓
• BAllowed storage account SKUs
• CRequire a tag
• DAllowed virtual machine sizes

Answer: The Allowed locations built-in policy restricts the regions in which resources can be deployed, enforcing data residency requirements. The other built-ins constrain sizes, tags, or SKUs rather than region.

To group several related Azure Policy definitions and assign them together as a compliance baseline, which artefact should you create?

• AA route table of the next hops
• BA policy initiative (set definition)✓
• CA resource lock applied at management group scope to hold the settings in place
• DA network security group with one rule per policy definition to be enforced

Answer: A policy initiative, also called a set definition, bundles multiple policy definitions so they can be assigned and tracked together as a single compliance baseline. Locks and network resources do not group policies.

You want Key Vault access to be governed by Azure RBAC roles rather than vault access policies so permissions are managed consistently with the rest of Azure. Which configuration should you choose when creating the vault?

• APublic network access only
• BThe Azure role-based access control permission model✓
• CThe vault access policy permission model
• DA shared access signature

Answer: Selecting the Azure RBAC permission model for the key vault lets you assign granular built-in roles like Key Vault Secrets User through the same RBAC system used across Azure, improving consistency and least privilege. The legacy access policy model manages permissions separately.

A compliance requirement mandates that encryption keys are generated and stored in a single-tenant HSM that you fully control, with FIPS 140-3 Level 3 validation and exclusive administrative control. Which Azure offering meets this?

• AA service principal secret
• BA storage account key
• CKey Vault standard tier
• DAzure Key Vault Managed HSM✓

Answer: Azure Key Vault Managed HSM provides a fully managed, single-tenant, FIPS 140-3 Level 3 validated HSM pool with your own administrative control domain, suitable for the strictest key custody requirements. The standard vault tier uses software-protected keys.

You need to ensure that secrets in Key Vault can be recovered for 90 days after deletion and that no one can permanently purge them during that period. Which two settings provide this?

• AA shared access signature for the vault together with a route table on the client subnet
• BThe Key Vault firewall together with a private endpoint on the approved subnet
• CAzure RBAC data-plane roles together with diagnostic logging to a workspace
• DSoft delete with a 90-day retention and purge protection enabled✓

Answer: Soft delete retains deleted vaults and objects for the configured retention period, and purge protection prevents permanent deletion until that period expires, together guaranteeing recoverability for 90 days. Firewalls and RBAC control access, not recoverability.

To grant an application the ability to wrap and unwrap keys in Key Vault for envelope encryption, but not to read secrets, which built-in role follows least privilege under the RBAC model?

• AKey Vault Crypto User✓
• BOwner
• CKey Vault Secrets Officer
• DKey Vault Administrator

Answer: The Key Vault Crypto User role grants cryptographic operations such as wrap and unwrap on keys without secret read permissions, matching least privilege for envelope encryption. Administrator, Owner, and Secrets Officer grant broader rights than required.

You want to evaluate compliance of existing resources against a newly assigned policy and remediate non-compliant ones in bulk. Which Azure Policy feature performs the corrective deployment on existing resources?

• AA remediation task using the policy's managed identity✓
• BA resource lock
• CAn NSG rule
• DA budget alert set on the subscription

Answer: A remediation task applies DeployIfNotExists or Modify effects to existing non-compliant resources using the policy assignment's managed identity, bringing them into compliance in bulk. Locks and NSGs do not remediate policy non-compliance.

To restrict Key Vault network access so it is reachable only from a specific virtual network and a defined set of trusted Microsoft services, which configuration should you apply?

• AKey Vault firewall set to deny by default with a virtual network rule and the trusted Microsoft services bypass✓
• BA wide SAS
• CPublic access from all networks, with the trusted Microsoft services bypass left on so that Azure services keep working
• DDisable soft delete

Answer: Setting the Key Vault firewall to deny by default, adding a virtual network rule for the approved subnet, and allowing the trusted Microsoft services bypass restricts access appropriately while letting required Azure services function. Public access contradicts the requirement.

Your governance standard requires that storage accounts must not allow shared key access across the organisation. Which Azure Policy effect and target enforce this preventively?

• AAudit on storage accounts where allowSharedKeyAccess is true, recording each one as non-compliant
• BDeny on storage accounts where allowSharedKeyAccess is true✓
• CAppend a tag naming the owner to every storage account that still permits shared key access
• DDisabled, so the definition remains assigned but is not evaluated during deployment

Answer: A Deny policy targeting the allowSharedKeyAccess property prevents creation or update of storage accounts that permit shared key access, enforcing Microsoft Entra authentication organisation-wide. Audit would only flag, not prevent.

You must ensure that a critical production resource cannot be deleted or modified by anyone, including owners, even accidentally. Which lock type provides the strongest protection?

• AA tag
• BA CanNotDelete lock
• CRely on RBAC alone, without a lock
• DA ReadOnly lock✓

Answer: A ReadOnly lock prevents both deletion and modification of the resource, providing the strongest protection against accidental changes, whereas a CanNotDelete lock still allows modification. Tags and RBAC alone do not prevent authorised owners from deleting.

A subscription must inherit a baseline of deny and audit policies that also applies to any subscriptions added later under the same business unit. At which scope should the initiative be assigned?

• AA single resource group
• BThe individual resources
• CA storage container
• DThe business unit's management group✓

Answer: Assigning the initiative at the business unit management group applies it to all current and future subscriptions beneath that node, ensuring new subscriptions inherit the baseline automatically. Assigning at a resource group or resource would not cover other subscriptions.

To enable automatic, scheduled rotation of a secret stored in Key Vault, such as a generated password, which Key Vault capability should you configure?

• AA route table
• BA storage SAS
• CA rotation policy on the key, or an Event Grid notification driving an automated rotation function for secrets✓
• DManual rotation only, with an operator generating each new password and then updating the secret version by hand

Answer: Key Vault supports rotation policies for keys and can emit near-expiry events via Event Grid to trigger an automation function that rotates secrets, enabling scheduled rotation without manual steps. Routes and SAS tokens are unrelated to rotation.

You want to deny the deployment of any virtual machine that does not use a customer-managed key for disk encryption, enforcing your encryption standard. Which Azure Policy approach is appropriate?

• AA route table applied to each subnet that hosts the virtual machines being deployed by the team
• BAn audit-only policy that marks the virtual machine non-compliant after it has been created
• CA budget alert raised when spending on unencrypted virtual machine disks passes a threshold
• DA deny policy evaluating the disk encryption set or encryption settings of the VM disks✓

Answer: A deny policy that inspects whether VM disks use a disk encryption set with a customer-managed key blocks non-compliant deployments, enforcing the encryption standard preventively. Audit-only would not stop the deployment.

Your organisation needs visibility into which policies are non-compliant across all subscriptions in one place, with drill-down by resource. Which Azure Policy feature provides this?

• AA NAT gateway
• BA storage firewall
• CNSG flow logs
• DThe Azure Policy compliance dashboard✓

Answer: The Azure Policy compliance dashboard aggregates compliance state across assigned scopes, letting you drill down to non-compliant resources and policies. Flow logs and network resources do not report policy compliance.

To grant a security auditor read-only visibility across all resources in a subscription without any ability to change them, which built-in Azure role is appropriate?

• AReader✓
• BOwner
• CUser Access Administrator
• DContributor

Answer: The Reader role grants view access to all resources in the assigned scope without permission to modify them, suiting an auditor. Contributor and Owner allow changes, and User Access Administrator can manage access assignments.

You must ensure that role assignments granting privileged access are themselves governed and time-bound where possible, including Azure resource roles. Which capability extends just-in-time governance to Azure resource roles?

• ASmart lockout
• BA storage account firewall limiting which subnets may reach the account
• CSecurity defaults
• DPrivileged Identity Management for Azure resources✓

Answer: PIM for Azure resources brings eligible, time-bound, and approval-based activation to Azure RBAC roles on subscriptions and resource groups, extending just-in-time governance beyond directory roles. Security defaults and lockout do not govern resource role activation.

A policy must ensure that diagnostic logs for Key Vault are always sent to a central workspace, deploying the setting where missing. Which combination is correct?

• AA Deny effect with no remediation task, blocking any vault created without the setting
• BAppend effect on tags
• CDeployIfNotExists effect with a remediation task and managed identity✓
• DA ReadOnly lock

Answer: The DeployIfNotExists effect, paired with a remediation task and a managed identity, deploys the missing diagnostic setting on Key Vaults to send logs to the central workspace, including for existing resources. Deny would block, not deploy, and Append handles request content, not deployments.

You need to ensure that only approved virtual machine SKUs can be deployed to control cost and security baseline conformance. Which built-in policy should you assign?

• AAllowed locations
• BInherit a tag from the resource group
• CRequire a tag and its value
• DAllowed virtual machine size SKUs✓

Answer: The Allowed virtual machine size SKUs built-in policy restricts deployments to an approved list of VM sizes, supporting cost and baseline control. Location and tag policies address different governance dimensions.

To centrally manage which built-in and custom roles users may be assigned and to review privileged assignments regularly, which two capabilities work together?

• ANSG flow logs and route tables
• BPIM with access reviews for privileged roles✓
• CStorage firewall and SAS
• DDDoS protection and Bastion

Answer: PIM provides just-in-time, time-bound privileged access, and access reviews periodically recertify those privileged assignments, together governing the privileged access lifecycle. Network and storage features do not govern role assignments.

A regulatory audit requires demonstrating that customer-managed encryption keys can be revoked, immediately rendering encrypted storage data inaccessible. Which property of customer-managed keys supports this?

• ADisabling or revoking the key in Key Vault makes the encrypted data inaccessible until access is restored✓
• BKeys cannot be revoked
• CKeys are stored in the storage account
• DRevocation immediately and permanently deletes the encrypted data from the storage account, leaving nothing to recover

Answer: Because storage uses the customer-managed key to access the data encryption key, disabling or revoking the key in Key Vault renders the data inaccessible until access is restored, demonstrating control. Revocation does not itself delete data, and the key is held in Key Vault, not the storage account.