Secure Compute, Storage & Databases

You want to reduce the attack surface of Azure VMs by keeping management ports closed until an administrator requests temporary access through Microsoft Defender for Cloud. Which feature provides this?

• AJust-in-time VM access✓
• BFile integrity monitoring
• CA network security group default deny
• DAdaptive application controls

Answer: Just-in-time VM access in Microsoft Defender for Cloud keeps inbound management ports closed and opens them only for an approved time window, source, and user when requested. This reduces exposure to brute-force attacks.

You must encrypt the OS and data disks of an Azure VM using BitLocker or dm-crypt with keys protected in Azure Key Vault. Which capability should you enable?

• AStorage service encryption
• BTransparent Data Encryption
• CAzure Disk Encryption✓
• DAlways Encrypted

Answer: Azure Disk Encryption uses BitLocker for Windows and dm-crypt for Linux to encrypt VM OS and data disks, with the encryption keys safeguarded in Azure Key Vault. Transparent Data Encryption and Always Encrypted apply to databases.

A storage account currently allows access using account keys, but you want applications to authenticate using Microsoft Entra identities and RBAC instead. Which step enforces this?

• AEnable infrastructure encryption, which adds a second layer of encryption at rest and has no bearing on how clients authenticate
• BDisable shared key authorization and assign data-plane RBAC roles✓
• CRotate the account keys weekly
• DGenerate a user delegation SAS for each application, still leaving account key access enabled on the storage account

Answer: Disabling shared key authorization on the storage account blocks account-key and shared-key SAS access, forcing clients to authenticate with Microsoft Entra ID, where you grant data roles such as Storage Blob Data Reader. Rotating keys alone does not remove key-based access.