Secure Compute, Storage & Databases

You want to reduce the attack surface of Azure VMs by keeping management ports closed until an administrator requests temporary access through Microsoft Defender for Cloud. Which feature provides this?

• AJust-in-time VM access✓
• BFile integrity monitoring
• CA network security group default deny
• DAdaptive application controls

Answer: Just-in-time VM access in Microsoft Defender for Cloud keeps inbound management ports closed and opens them only for an approved time window, source, and user when requested. This reduces exposure to brute-force attacks.

You must encrypt the OS and data disks of an Azure VM using BitLocker or dm-crypt with keys protected in Azure Key Vault. Which capability should you enable?

• AStorage service encryption
• BTransparent Data Encryption
• CAzure Disk Encryption✓
• DAlways Encrypted

Answer: Azure Disk Encryption uses BitLocker for Windows and dm-crypt for Linux to encrypt VM OS and data disks, with the encryption keys safeguarded in Azure Key Vault. Transparent Data Encryption and Always Encrypted apply to databases.

A storage account currently allows access using account keys, but you want applications to authenticate using Microsoft Entra identities and RBAC instead. Which step enforces this?

• AEnable infrastructure encryption, which adds a second layer of encryption at rest and has no bearing on how clients authenticate
• BDisable shared key authorization and assign data-plane RBAC roles✓
• CRotate the storage account keys weekly
• DGenerate a user delegation SAS for each application, still leaving account key access enabled on the storage account

Answer: Disabling shared key authorization on the storage account blocks account-key and shared-key SAS access, forcing clients to authenticate with Microsoft Entra ID, where you grant data roles such as Storage Blob Data Reader. Rotating keys alone does not remove key-based access.

You need to grant a partner read access to a single blob container for seven days, scoped and revocable, without sharing the storage account key. What is the most appropriate mechanism?

• AA network security group rule
• BA shared access signature with a stored access policy✓
• CThe storage account access key
• DA system-assigned managed identity

Answer: A shared access signature grants scoped, time-limited delegated access; binding it to a stored access policy lets you revoke it before expiry. Sharing the account key would grant full access and cannot be selectively revoked.

Which Azure SQL Database feature encrypts data at rest at the database level and is enabled by default for new databases?

• AAlways Encrypted, protecting individual columns with keys held by the client rather than the whole database
• BDynamic data masking, hiding part of a result set from unprivileged users but storing the data unencrypted
• CRow-level security with a predicate
• DTransparent Data Encryption✓

Answer: Transparent Data Encryption encrypts the database, backups, and transaction log files at rest and is enabled by default for new Azure SQL databases. Always Encrypted protects specific columns and dynamic data masking only obfuscates query results.

You manage an Azure Kubernetes Service cluster and want pods to obtain Azure resource access using Microsoft Entra identities without storing secrets in the cluster. Which approach is recommended?

• AHardcoded service principal secrets in pod environment variables
• BA shared storage account key mounted as a volume
• CBasic Kubernetes service account tokens only
• DMicrosoft Entra Workload ID with federated credentials✓

Answer: Microsoft Entra Workload ID federates a Kubernetes service account with a Microsoft Entra application or managed identity, so pods get tokens without storing secrets. Embedding service principal secrets in pods is the practice this is designed to replace.

To require that all blobs in a storage account are only accessible over HTTPS, which storage account setting should you enable?

• ASecure transfer required✓
• BAllow Blob anonymous access
• CHierarchical namespace
• DInfrastructure encryption

Answer: Enabling the secure transfer required setting forces all requests to the storage account to use HTTPS, rejecting unencrypted HTTP. Infrastructure encryption adds a second layer of at-rest encryption but does not enforce transport security.

You want to harden an Azure VM by allowing only a defined set of known-safe applications to run and blocking everything else, using guidance from Microsoft Defender for Cloud. Which feature should you use?

• AAdaptive application controls✓
• BJust-in-time VM access
• CAzure Disk Encryption
• DTransparent Data Encryption

Answer: Adaptive application controls in Microsoft Defender for Cloud use machine learning to recommend allowlists of safe applications for a VM and alert on or block executables outside that list. Just-in-time access controls management ports, not application execution.

You want to ensure that Azure VMs receive operating system security updates centrally and report missing patches for compliance. Which capability should you use?

• AAzure Update Manager✓
• BA network security group
• CAzure Disk Encryption
• DJust-in-time VM access

Answer: Azure Update Manager assesses and deploys operating system updates to Azure and Arc-enabled machines and reports patch compliance, supporting centralized patch management. Disk encryption and JIT access address different security concerns.

You want to protect specific sensitive columns, such as national identifiers, in Azure SQL Database so that even database administrators cannot read the plaintext. Which feature should you use?

• AAlways Encrypted✓
• BAuditing
• CTransparent Data Encryption
• DDynamic data masking

Answer: Always Encrypted encrypts selected columns on the client side so the plaintext is never exposed inside the database engine, keeping it hidden even from high-privileged administrators. Transparent Data Encryption only protects data at rest and is transparent to administrators.

You need to detect anomalous database activities and SQL injection attempts against an Azure SQL Database and receive alerts. Which capability should you enable?

• AMicrosoft Defender for SQL✓
• BDynamic data masking
• CRow-level security
• DTransparent Data Encryption

Answer: Microsoft Defender for SQL provides advanced threat protection that detects anomalous activities and potential SQL injection and surfaces security alerts and vulnerability assessments. Masking and row-level security control data exposure but do not detect attacks.

You want to limit which Microsoft Entra accounts can administer an Azure SQL logical server centrally, replacing reliance on the SQL administrator login. What should you configure?

• AInfrastructure encryption
• BA Microsoft Entra admin for the SQL server✓
• CA shared access signature
• DA storage firewall rule

Answer: Setting a Microsoft Entra admin on the SQL logical server enables centralized, identity-based administration and lets you grant database access to Entra users and groups instead of SQL logins. The other options do not control SQL administrative identity.

To prevent containers in an Azure Container Registry from running with known vulnerabilities, which capability scans pushed images and reports findings?

• AAzure Bastion
• BA network security group
• CTransparent Data Encryption
• DMicrosoft Defender for Containers image scanning✓

Answer: Microsoft Defender for Containers scans images in supported registries for known vulnerabilities and provides recommendations, helping prevent vulnerable images from being deployed. The other options do not perform image vulnerability scanning.

You must guarantee that blobs in a container cannot be modified or deleted for a fixed retention period to meet regulatory requirements. Which storage feature provides this?

• AA shared access signature limited to read operations, controlling who may reach a blob but not whether it can be deleted
• BA lifecycle management rule that moves ageing blobs to the cool tier, changing storage cost rather than mutability
• CSoft delete for blobs, keeping a deleted blob recoverable
• DImmutable storage with a time-based retention policy✓

Answer: Immutable storage with a time-based retention policy enforces write-once, read-many protection so blobs cannot be altered or deleted until the retention period elapses, satisfying compliance mandates. Soft delete allows recovery but does not prevent modification.

You want to block public anonymous read access to all blobs across an entire storage account regardless of individual container settings. Which account-level setting should you configure?

• AEnable hierarchical namespace
• BDisable Allow Blob anonymous access on the storage account✓
• CEnable infrastructure encryption on the account
• DAdd a stored access policy

Answer: Setting the storage account property that disallows blob anonymous access overrides container-level public access settings and blocks anonymous reads account-wide. Infrastructure encryption and stored access policies do not govern anonymous access.

You need an Azure VM to mount an Azure Files share using identity-based authentication over SMB instead of the storage account key. Which configuration supports this?

• ADisabling secure transfer
• BA network security group rule
• CIdentity-based authentication for Azure Files using Microsoft Entra Domain Services or AD DS✓
• DA user delegation SAS issued to each user, which authorises REST calls to blob storage and is not honoured by the SMB protocol

Answer: Azure Files supports identity-based authentication over SMB using AD DS or Microsoft Entra Domain Services, letting users mount shares with their domain identities and NTFS permissions instead of the account key. SAS tokens and NSG rules do not provide SMB identity authentication.

You must ensure managed disks are encrypted at rest with a key you rotate, and the encryption should also cover the VM's temporary disk and caches. Which option provides the broadest customer-managed coverage?

• ATransparent Data Encryption, encrypting database files at rest without reaching a virtual machine's disks
• BPlatform-managed keys only, where Azure holds and rotates the key and you cannot revoke it yourself
• CEncryption at host with a customer-managed key via a disk encryption set✓
• DA shared access signature over the disk export URL, which delegates access rather than encrypting anything

Answer: Encryption at host encrypts the VM's OS, data, temp disks, and caches on the host itself, and using a disk encryption set with a customer-managed key gives you key control and rotation. Platform-managed keys do not provide customer key control, and TDE is for databases.

A compliance rule requires double encryption of data at rest in a storage account using two independent layers. Which feature provides the second layer beneath the default service-side encryption?

• AInfrastructure encryption✓
• BSecure transfer required
• CSoft delete
• DA stored access policy

Answer: Enabling infrastructure encryption adds a second, independent layer of encryption at the infrastructure level beneath the standard 256-bit service encryption, satisfying double-encryption requirements. Secure transfer protects data in transit, not a second at-rest layer.

You want application code to retrieve a database connection string from Key Vault at runtime without the secret ever appearing in app configuration. For an Azure App Service, which approach is cleanest?

• AStore the connection string in web.config and commit that file to the source control repository
• BUse a Key Vault reference in app settings with the app's managed identity✓
• CEmail the secret to developers
• DPaste the secret into application settings

Answer: A Key Vault reference in App Service settings, resolved using the app's managed identity, injects the secret at runtime so the value is never stored in configuration or source control. Pasting secrets into settings or config files exposes them.

To detect malware uploaded to a storage account and scan blobs on upload, which capability should you enable?

• AInfrastructure encryption, encrypting the data a second time at rest and never inspecting content
• BA stored access policy that lets you revoke the SAS tokens issued against a container
• CSoft delete on the blob container
• DMicrosoft Defender for Storage with malware scanning✓

Answer: Microsoft Defender for Storage includes malware scanning that inspects uploaded blobs and raises alerts on malicious content, in addition to anomalous-access detection. Soft delete and encryption do not scan content for malware.

An Azure SQL database must mask credit-card numbers so that non-privileged users see only the last four digits in query results, while the stored data remains intact. Which feature provides this?

• ATransparent Data Encryption
• BInfrastructure encryption
• CAlways Encrypted
• DDynamic data masking✓

Answer: Dynamic data masking obfuscates sensitive fields in query results for non-privileged users, for example revealing only the last four digits, without altering stored data. Always Encrypted would encrypt the data so it could not be used in normal queries by those users.

You need to restrict which rows of a table each user can see in Azure SQL Database based on their identity, enforced by the database engine. Which feature should you implement?

• ARow-level security with a security policy and predicate function✓
• BDynamic data masking
• CTransparent Data Encryption on the database
• DA storage firewall

Answer: Row-level security uses predicate functions and a security policy so the engine transparently filters rows a user may access based on their context, such as their login. Dynamic data masking hides column values but does not filter rows.

You manage a VM that must not have any inbound management ports open except during approved maintenance windows requested by named engineers. Which Defender for Cloud feature best fits?

• AAdaptive application controls
• BFile integrity monitoring
• CTransparent Data Encryption
• DJust-in-time VM access✓

Answer: Just-in-time VM access keeps management ports closed and opens them only for the requesting user, source IP, and time window upon approval, matching maintenance windows. Adaptive application controls govern which apps may run, not port exposure.

To protect against accidental or malicious deletion of blobs and allow recovery to a prior version, which two storage data-protection features should you enable together?

• ASecure transfer and DDoS protection
• BBlob versioning and soft delete for blobs✓
• CA stored access policy and a NAT gateway
• DInfrastructure encryption and a route table

Answer: Blob versioning preserves previous versions automatically on overwrite, and soft delete retains deleted blobs for a recovery window, together enabling recovery from accidental changes or deletions. Encryption and networking features do not provide point-in-time recovery.

Your organisation requires that Azure SQL auditing records all database events to an immutable store for compliance review. Where should auditing logs be written to support long retention and tamper resistance?

• AThe local disk of a virtual machine in the same resource group, where an operator can rotate the files
• BThe memory of the application tier, which is read by the compliance team when a review is due
• CA shared mailbox that receives an audit summary message after every database transaction
• DA storage account, Log Analytics, or Event Hub destination configured in SQL auditing✓

Answer: SQL auditing can write audit logs to a storage account, a Log Analytics workspace, or Event Hubs, supporting long retention and integration with monitoring; immutability policies can be applied to the storage destination. Local disk or email are not valid audit sinks.

A containerised workload in Azure Kubernetes Service must read a secret at runtime. To avoid storing the secret in a Kubernetes Secret object, which integration retrieves it directly from Key Vault?

• AA route table
• BA storage account container with anonymous read access holding the secret as a text file
• CAn NSG rule
• DThe Secrets Store CSI driver with the Azure Key Vault provider✓

Answer: The Secrets Store CSI driver with the Azure Key Vault provider mounts secrets, keys, and certificates from Key Vault into pods at runtime, optionally using workload identity, avoiding plaintext Kubernetes Secrets. Networking resources do not retrieve secrets.

To ensure that only signed and trusted container images can be deployed to your environment, which capability provides image signing and verification?

• ADynamic data masking applied to the registry metadata
• BA NAT gateway
• CA storage firewall
• DContainer image signing with notation/Notary and admission enforcement✓

Answer: Signing images and verifying signatures at admission ensures only trusted, untampered images run, supporting supply-chain security. Storage firewalls and NAT gateways are network controls and do not verify image provenance.

You want an Azure VM scale set to automatically apply OS security patches with minimal disruption and report compliance centrally. Which capability should you use?

• ADisabling Windows Update on each instance and patching during the annual maintenance window
• BAzure Update Manager with scheduled patching✓
• CA storage lifecycle policy that moves ageing blobs between access tiers on a schedule
• DManual patching by RDP

Answer: Azure Update Manager assesses and deploys OS updates on a schedule across Azure and Arc machines and reports patch compliance, supporting scale-set patching with maintenance configurations. Manual patching does not scale and disabling updates is insecure.

A storage account holds regulated records that must be retained unaltered for seven years, after which deletion is allowed. Which configuration enforces this without permitting early deletion?

• AA lifecycle management rule that moves the records to the archive tier after seven years
• BImmutable blob storage with a time-based retention policy of seven years✓
• CA shared access signature limited to read and list, controlling access but not deletion
• DSoft delete with a short retention window, which allows a deleted record to be restored afterwards

Answer: A time-based immutability policy enforces write-once, read-many protection for the specified retention period so records cannot be deleted or modified until it elapses, after which deletion is permitted. Soft delete allows recovery but not enforced immutability.

You need to give an analytics service temporary, least-privilege read access to a single blob container using Microsoft Entra credentials rather than a SAS, scoped tightly. Which approach is best?

• AShare the account key
• BDisable encryption
• CAssign the Storage Blob Data Reader role on that container's scope to the service's managed identity✓
• DMake the container publicly readable for the duration of the analysis

Answer: Assigning the Storage Blob Data Reader role at the container scope to the workload's managed identity grants least-privilege, identity-based read access without keys or SAS. Sharing the account key or making the container public grossly over-grants access.

Which feature lets you encrypt specific Azure SQL columns so that the keys are held by the client application and the database engine never sees plaintext, suitable for highly sensitive fields queried by equality?

• ADynamic data masking, obscuring the values returned to unprivileged users at query time
• BAlways Encrypted with deterministic encryption✓
• CInfrastructure encryption
• DTransparent Data Encryption

Answer: Always Encrypted keeps column encryption keys on the client so plaintext is never exposed to the engine; deterministic encryption additionally allows equality lookups on the encrypted column. TDE and masking do not hide data from the engine.

You want to prevent a managed disk from being downloaded or exported outside Azure and ensure exports require explicit authorisation. Which control helps restrict disk export access?

• AEnabling public blob access on the staging storage account so the exported disk can be fetched without a token
• BIssuing a broadly scoped shared access signature with a long expiry so that any holder can download the disk
• CDisabling public network access on the disk and using Microsoft Entra authentication for export, plus RBAC✓
• DDisabling encryption at rest on the managed disk entirely

Answer: Restricting the disk's network access and requiring Microsoft Entra-authenticated, RBAC-gated export operations limits who can generate a download and from where. A wide SAS or public access would undermine the restriction.

A finance application's VM must only run a fixed set of approved executables; any new or unknown binary should be flagged. Which Defender for Cloud feature provides this allowlisting?

• ANSG flow logs
• BJust-in-time VM access
• CAzure Disk Encryption
• DAdaptive application controls✓

Answer: Adaptive application controls learn the applications normally run on a VM and let you enforce an allowlist, alerting on or blocking unexpected executables. Just-in-time access controls port exposure, not which applications run.

To ensure Azure Files shares used by a VM are encrypted in transit and reject unencrypted SMB, what should you confirm on the storage account?

• AThat public network access is unrestricted, so the share can be mounted from any client network
• BThat infrastructure encryption is switched off, so the SMB session negotiates faster with the client
• CThat anonymous access to blobs is switched on, so the share does not prompt the client for credentials
• DSecure transfer required is enabled and SMB encryption is enforced✓

Answer: Enabling secure transfer required enforces encrypted SMB and HTTPS, so unencrypted SMB sessions to Azure Files are rejected. Anonymous access and unrestricted public access weaken security rather than enforce in-transit encryption.

You want vulnerability assessment findings for your Azure VMs surfaced and prioritised automatically. Which capability provides integrated vulnerability scanning for machines in Defender for Cloud?

• AA stored access policy on the storage container that holds the machines' virtual hard disks
• BA storage firewall
• CThe Microsoft Defender vulnerability management integration for servers✓
• DA route table

Answer: Defender for Cloud's Defender for Servers integrates Microsoft Defender vulnerability management to scan machines and surface prioritised findings as recommendations. Networking and storage features do not perform vulnerability assessment.

An Azure Cosmos DB account must restrict data-plane access so that only a specific managed identity can read documents, avoiding primary keys. Which capability supports this?

• AMicrosoft Entra ID role-based access control for Cosmos DB data plane✓
• BSharing the primary key
• CDisabling encryption
• DA public endpoint with no firewall rules applied

Answer: Cosmos DB supports Microsoft Entra ID authentication with data-plane RBAC roles, letting you grant a managed identity scoped read access without distributing account keys. Sharing the primary key grants full access and is the practice to avoid.

You need to ensure a VM's boot integrity by detecting rootkits and bootkits and attesting the boot state. Which VM security capability should you enable?

• ADynamic data masking, which hides sensitive column values from unprivileged database users
• BA stored access policy
• CA network security group filtering traffic to the machine's network interface by port
• DTrusted launch with secure boot and vTPM✓

Answer: Trusted launch provides secure boot, a virtual TPM, and boot integrity monitoring with attestation, protecting against rootkits and bootkits at the firmware and boot level. NSGs and masking do not address boot integrity.

A web app stores user uploads in blob storage. To let the app read and write blobs using least privilege, without granting subscription-wide access or storage account key management, which role is most appropriate?

• AStorage Account Key Operator Service Role, allowing the account access keys to be listed and regenerated
• BStorage Blob Data Contributor scoped to the container✓
• COwner at the subscription scope, granting full control of every resource in the subscription
• DReader on the storage account

Answer: Storage Blob Data Contributor scoped to the container grants read, write, and delete on blobs within that container following least privilege, without subscription-wide or key-management rights. Owner and key operator roles grant excessive privilege; Reader cannot write.

You must rotate the customer-managed key used to encrypt a storage account and ensure the account automatically uses the new key version. Which configuration achieves automatic key version updates?

• APin the key to one specific version, and then update that version manually for ever
• BUse the account key instead
• CDisable Key Vault
• DConfigure the storage account to use the key without a version so it tracks the latest, with rotation in Key Vault✓

Answer: Referencing the customer-managed key without specifying a version lets the storage account automatically pick up new versions as the key is rotated in Key Vault, supporting seamless rotation. Pinning to a version requires manual updates on each rotation.

To limit blast radius if a storage account access key is leaked, which design reduces reliance on the static keys altogether?

• AUse one storage account key for every application and never rotate it, so that no service breaks
• BPublish the key in documentation
• CPrefer Microsoft Entra authentication with RBAC and disable shared key authorisation✓
• DEmbed the key in client apps

Answer: Using Microsoft Entra identities with data-plane RBAC and disabling shared key authorisation removes the static keys as an attack vector, so a leaked key has no value. Embedding or publishing keys increases exposure.