Governance & Key Management

Which Azure Key Vault access model is recommended so that permissions can be managed consistently with the rest of your Azure resources?

• AVault access policies defined individually on each key vault
• BAzure role-based access control (RBAC) for the data plane✓
• CClassic co-administrator assignments at the subscription scope
• DShared access signatures generated per secret for each caller

Answer: Key Vault's RBAC permission model lets you assign data-plane roles the same way as other Azure resources, with central management, PIM eligibility and consistent auditing. Access policies are the older per-vault model, co-administrators are legacy, and SAS tokens do not apply to Key Vault secrets.

You must prevent a production key vault from being permanently deleted, and recover it if it is deleted. Which two features provide this?

• ASoft delete and purge protection✓
• BPrivate endpoints and service endpoints
• CManaged HSM and dedicated HSM pools
• DResource locks and diagnostic settings

Answer: Soft delete retains a deleted vault or object for a retention period so it can be recovered, and purge protection blocks permanent deletion during that period even by privileged users. Private endpoints control network access, HSM options concern key storage, and locks and diagnostics serve other purposes.

Which Key Vault configuration restricts data-plane access so that only traffic from a specific virtual network subnet or IP range is allowed?

• AKey rotation policies applied to each stored cryptographic key
• BKey Vault firewall rules with virtual network and IP restrictions✓
• CAccess policies that grant only the get and list permissions on the stored secrets
• DDiagnostic settings streaming audit logs to a Log Analytics workspace

Answer: The Key Vault firewall lets you deny public access and permit only selected virtual networks and IP ranges, which restricts the network paths to the vault. Rotation policies, access policies and diagnostic settings govern key lifecycle, authorization and logging, not network filtering.

A security engineer wants Defender for Cloud to detect unusual attempts to access secrets in a key vault, such as anomalous access patterns. What must be enabled?

• AAzure Policy audit effect on the key vault
• BKey Vault managed storage account keys
• CCustomer-managed keys for the key vault
• DMicrosoft Defender for Key Vault✓

Answer: Microsoft Defender for Key Vault is the Defender for Cloud plan that provides threat detection for key vaults, alerting on anomalous or suspicious access. Azure Policy audits configuration, managed storage account keys automate key rotation for storage, and customer-managed keys concern encryption, not detection.

Which Azure Policy effect stops non-compliant resources from being created in the first place?

• AAudit
• BModify
• CDeny✓
• DDeployIfNotExists

Answer: The Deny effect blocks a create or update request that does not meet the policy rule, preventing non-compliant resources. Audit only records non-compliance, Modify adds or changes properties such as tags, and DeployIfNotExists deploys a remediation after the resource exists.

You need Azure Policy to automatically deploy a diagnostic setting whenever a storage account is created without one. Which effect should the policy use?

• ADeployIfNotExists✓
• BAppend
• CDeny
• DDisabled

Answer: DeployIfNotExists evaluates related resources and deploys a remediation, such as a diagnostic setting, when it is missing, and can remediate existing resources through remediation tasks. Append adds fields to a request, Deny blocks it, and Disabled turns the policy off.

What is the primary purpose of assigning an Azure Policy initiative rather than individual policies?

• AIt grants users the permissions needed to remediate non-compliant resources automatically
• BIt converts audit policies into deny policies across the assigned scope at once
• CIt replaces the Azure RBAC role assignments for the resources that fall within the assigned scope
• DIt groups related policy definitions so they can be assigned and tracked together toward a goal such as a compliance standard✓

Answer: An initiative (policy set) bundles multiple policy definitions so you can assign and measure them together, which is how compliance standards are represented. It does not itself grant permissions, change policy effects, or replace RBAC.

Which Defender for Cloud feature maps your environment against standards such as ISO 27001, PCI DSS or the Microsoft cloud security benchmark?

• AThe workload protection dashboard
• BThe inventory asset management view
• CThe regulatory compliance dashboard✓
• DThe workflow automation configuration

Answer: The regulatory compliance dashboard in Defender for Cloud shows your posture against assigned standards and their controls, highlighting failing assessments. Workload protection shows plan coverage, inventory lists assets, and workflow automation triggers responses to alerts.

Which security standard is applied by default to subscriptions in Microsoft Defender for Cloud and forms the basis of the secure score?

• AThe Center for Internet Security Azure Foundations benchmark
• BThe National Institute of Standards and Technology 800-53 catalog
• CThe Microsoft cloud security benchmark✓
• DThe Payment Card Industry Data Security Standard version four

Answer: The Microsoft cloud security benchmark is applied by default and its recommendations drive the secure score. CIS, NIST 800-53 and PCI DSS are additional standards you can add to the regulatory compliance dashboard but are not the default baseline.

An engineer must prevent accidental deletion of a critical resource group while still allowing configuration changes. Which resource lock should be applied?

• AA CanNotDelete lock on the resource group✓
• BA ReadOnly lock on the resource group
• CA Deny assignment on the resource group
• DA management group policy exemption

Answer: A CanNotDelete lock allows reading and modifying resources but blocks deletion, which matches the requirement. A ReadOnly lock would also block configuration changes, a deny assignment is created by deployment stacks or Azure managed applications rather than as a general lock, and a policy exemption removes a resource from a policy's scope.

What is the effect of a ReadOnly resource lock on an Azure resource?

• AUsers can modify the resource but cannot delete it while the lock is in place
• BUsers can read the resource but cannot modify or delete it, even with a higher RBAC role✓
• CUsers are denied read access to the resource until the lock is first removed
• DUsers can delete the resource but cannot change its configuration settings

Answer: A ReadOnly lock permits read operations but blocks create, update and delete, overriding RBAC permissions, so even an Owner must remove the lock first to make changes. It does not deny reads or permit modification; allowing changes while blocking deletion is the CanNotDelete (Delete) lock.

To follow least privilege, which built-in Azure role lets a user manage access to a resource without granting them the ability to manage the resource itself?

• AContributor
• BOwner
• CUser Access Administrator✓
• DReader

Answer: User Access Administrator can manage role assignments (who has access) but cannot manage the resources themselves, separating access administration from resource management. Contributor manages resources but not access, Owner does both, and Reader can only view.

Which approach best detects and reduces overprivileged Azure role assignments over time?

• AGrant engineers the Owner role and rely on activity logs to catch misuse
• BReplace the existing role assignments with a single broad custom role applied once at the tenant root management group
• CStop using Azure RBAC for resource access and manage who can reach each resource through network security groups
• DReview Azure RBAC assignments and use PIM insights and access reviews to remove unused privileged access✓

Answer: Regularly reviewing RBAC assignments and using PIM's discovery and access reviews to strip unused or excessive privilege is how you drive least privilege. Blanket Owner grants, a single sweeping custom role, or using NSGs for access management all increase risk or misuse the wrong control.

What is the benefit of defining a custom Azure role instead of using a broad built-in role?

• AIt automatically expires the assignment after a fixed number of days
• BIt applies across every subscription in the tenant without assignment
• CIt grants only the specific actions required for a task, reducing standing privilege✓
• DIt automatically bypasses Conditional Access policies for the resources it covers

Answer: A custom role lets you specify exactly the actions and data actions needed, supporting least privilege where no built-in role fits. Expiration is handled by PIM, custom roles still require assignment at a scope, and they do not affect Conditional Access.

Where should a custom Azure role's assignable scope be set so it can be used across several subscriptions under one management group?

• AAt the management group, so subscriptions beneath it inherit the role definition✓
• BAt each individual resource group that requires the custom role definition
• CAt the tenant root group only, which is reserved for global administrators
• DAt a single subscription, then export and re-import it into the others

Answer: Defining the custom role with an assignable scope at a management group lets all child subscriptions use it without duplication. Per-resource-group scoping is narrow, the tenant root group has special constraints, and manual export-and-import creates drift.

Which practice keeps infrastructure-as-code deployments from leaking secrets into source control?

• AStore the secrets in template parameter default values for convenience
• BCommit an encrypted secrets file to source control and share the decryption key in the same repository
• CPlace all of the secrets inside code comments so that the deployment engine simply ignores them
• DReference secrets from Azure Key Vault in the template rather than hardcoding values✓

Answer: Bicep and ARM templates can reference Key Vault at deployment time so the secret value never appears in the template or repo. Default parameter values, committed encrypted files with the key alongside, and comments all risk exposing the secret in source control.

How can Azure Policy help enforce security configuration for resources deployed through infrastructure as code?

• APolicies apply to resources created in the portal, but not through templates
• BAzure Policy silently rewrites deployment templates before they are submitted to Azure Resource Manager
• CPolicies work by embedding the policy definition inline in each template
• DPolicies evaluate resources at creation regardless of the deployment tool and can deny non-compliant definitions✓

Answer: Azure Policy evaluates the resource create and update requests at the Resource Manager layer, so it applies whether the deployment came from a template, CLI or the portal, and Deny stops non-compliant definitions. It does not edit templates or need to be embedded in them.

Which Azure Backup capability helps protect backups from being deleted by an attacker who has compromised administrative credentials?

• AGeo-redundant storage replication of the Recovery Services vault contents, copied to a secondary paired region
• BSoft delete for Recovery Services vault backups, with multi-user authorization for critical operations✓
• CApplication-consistent snapshots that are taken automatically during each scheduled nightly backup window
• DInstant restore retention that keeps local snapshots for faster recovery

Answer: Soft delete retains deleted backup data for a period so it can be recovered, and multi-user authorization (using a Resource Guard) requires a second approval for critical operations like disabling soft delete, defending against a single compromised admin. Geo-redundancy, consistency and instant restore address availability and recovery speed, not malicious deletion.

What does enabling immutability or a resource guard on a Recovery Services vault primarily defend against?

• AData corruption caused by failures in the underlying storage hardware
• BExcessive backup storage costs from retaining too many recovery points
• CMalicious or accidental modification and deletion of backup data by privileged users✓
• DSlow restore and recovery performance when recovering very large virtual machines

Answer: Immutability and a Resource Guard for multi-user authorization protect backups against tampering and deletion, including by insiders with high privilege, which is central to ransomware resilience. They do not address hardware corruption, cost or restore speed.

Which statement about Azure RBAC and Microsoft Entra roles is correct?

• AAzure RBAC and Microsoft Entra roles are the same role set applied at different scopes
• BAzure RBAC governs access to Azure resources, while Microsoft Entra roles govern access to directory objects and services✓
• CAzure RBAC governs directory objects, while Microsoft Entra roles govern Azure resources
• DEvery Azure RBAC resource role automatically includes the equivalent Microsoft Entra directory roles for the same user

Answer: The two systems are distinct: Azure RBAC controls the Azure resource control and data planes, and Microsoft Entra roles control directory-level administration such as users, groups and Conditional Access. Holding one does not grant the other, and they are not the same role set.

You want to ensure that all new key vaults in a subscription have purge protection enabled. Which governance tool enforces this at scale?

• AA CanNotDelete resource lock placed on each key vault right after it is created
• BAn Azure Policy definition that audits or denies key vaults without purge protection✓
• CA Key Vault access policy applied to every new key vault created
• DA diagnostic setting forwarding key vault logs to a workspace

Answer: Azure Policy can audit or deny key vaults that lack purge protection, enforcing the standard automatically across the scope. Resource locks, access policies and diagnostic settings apply per-vault after creation and do not enforce a configuration standard at scale.

Which key management choice gives you control over the lifecycle of the encryption key used to protect an Azure service's data?

• ACustomer-managed keys stored in Azure Key Vault✓
• BMicrosoft-managed keys rotated automatically by the platform
• CShared access signatures scoped to the service's storage
• DManaged identities assigned to the service for authentication

Answer: Customer-managed keys let you control rotation, revocation and access of the key that encrypts a service's data, using Key Vault. Microsoft-managed keys remove that control by design, SAS tokens grant delegated data access, and managed identities handle authentication rather than key control.

What is the recommended way to rotate secrets stored in Azure Key Vault to reduce the impact of a leaked credential?

• AConfigure rotation policies or automation and have applications retrieve the current version at runtime✓
• BPin each application to a specific secret version in its configuration
• CDistribute the secret to each application team to rotate independently
• DPermanently disable secret versioning so that a single copy of the secret exists at a time

Answer: Rotation policies or event-driven automation update secrets on a schedule, and apps that fetch the current version at runtime pick up new values without redeployment, limiting the window a leaked secret is useful. Pinning versions, manual distribution and disabling versioning all undermine rotation.

Defender CSPM can scan for exposed secrets in code and resources. What risk does this specifically help reduce?

• AAttackers using secrets found in code or configuration to move laterally between resources✓
• BUsers bypassing multifactor authentication during interactive sign-in
• CApplications requesting excessive Microsoft Graph delegated permissions during the user consent prompt
• DStorage accounts that are mistakenly configured to allow public anonymous blob access to everyone

Answer: Defender CSPM secret scanning finds plaintext secrets such as keys and connection strings in code and resources, reducing the risk that an attacker reuses them to move laterally. MFA bypass, over-permissioned apps and public storage are addressed by other controls.

Which scope hierarchy correctly orders Azure management from broadest to narrowest?

• ASubscription, management group, resource, resource group
• BManagement group, subscription, resource group, resource✓
• CResource group, subscription, management group, resource
• DResource, resource group, management group, subscription

Answer: Azure scopes nest from management group to subscription to resource group to resource, and role assignments and policies applied higher up are inherited downward. The other orderings misplace at least one level.

An engineer needs to grant a monitoring tool read-only access to all resources in a subscription. Which assignment follows least privilege?

• AThe Reader role assigned at the subscription scope✓
• BThe Contributor role assigned at the subscription scope
• CThe Reader role assigned at the management group root
• DThe Owner role assigned at each resource group scope

Answer: Assigning Reader at the subscription gives the tool the read-only visibility it needs and nothing more. Contributor and Owner grant write access, and assigning at the management group root would extend access beyond the single subscription required.

Which feature lets you temporarily exclude a specific resource from an assigned Azure Policy without deleting the assignment?

• AA policy override changing the effect for that resource
• BA resource lock preventing evaluation of that resource
• CA management group move for that resource only
• DA policy exemption scoped to that resource✓

Answer: A policy exemption removes a specific scope or resource from evaluation of an assignment for a stated reason and period, without removing the assignment. Overrides change effects for definitions within an initiative rather than exempting a resource, locks do not stop policy evaluation, and resources cannot be moved individually into management groups.

What does the secure score in Microsoft Defender for Cloud represent?

• AA count of active security alerts currently open in your environment
• BThe total cost of the Defender for Cloud plans you have enabled
• CThe total number of resources currently protected by an enabled workload protection plan
• DA measure of your current security posture based on how many recommendations you have remediated✓

Answer: Secure score aggregates the security controls and recommendations you have addressed into a percentage that reflects posture and improves as you remediate. It is not an alert count, a cost figure or a coverage count.

To meet a regulatory requirement, you must demonstrate which controls are failing against PCI DSS across your Azure estate. What should you do in Defender for Cloud?

• AEnable every Defender workload protection plan across all subscriptions
• BExport the secure score recommendations to a workbook for the auditors
• CAssign the subscription Owner role to the audit team so they can inspect resources freely
• DAdd the PCI DSS standard to the regulatory compliance dashboard and review failing controls✓

Answer: Adding PCI DSS as a compliance standard maps your assessments to its controls and shows which are passing or failing, which is exactly what auditors need. Enabling all plans, exporting secure score, or granting Owner do not map posture to the specific standard.

Which key protection level should be chosen when regulatory requirements mandate keys never leave a FIPS 140-3 Level 3 validated boundary?

• AA software-protected key held in the standard Key Vault pricing tier
• BA customer-managed key stored in a general-purpose storage account
• CAzure Key Vault Managed HSM, or a Premium HSM-protected key on HSM Platform 2✓
• DA secret stored as plaintext in an application configuration store

Answer: Managed HSM and Key Vault Premium HSM keys on Platform 2 keep key material within a hardware security module validated to FIPS 140-3 Level 3. Software-protected keys, keys in storage accounts and plaintext secrets do not meet that hardware boundary requirement.

What is a security advantage of managing Azure resources through infrastructure as code rather than manual portal changes?

• AResources that are deployed by templates are then automatically exempted from the applicable Azure Policy rules
• BTemplates remove the need to assign RBAC roles to the deploying identity
• CInfrastructure as code disables interactive portal and CLI access to the deployed resources once they are provisioned
• DConfigurations are version-controlled and reviewable, making drift and unauthorized change easier to detect✓

Answer: Defining infrastructure as code gives you version history, peer review and repeatable deployments, so unauthorized changes and drift stand out against the declared state. Templates are still subject to Azure Policy and RBAC and do not disable access to what they create.

Which action best limits the blast radius if a single subscription is compromised?

• APlacing the workloads in a single large subscription so that management and billing stay centralized
• BAssigning the Owner role at the tenant root management group to the members of the platform team
• CSegmenting workloads across subscriptions and management groups with scoped RBAC and policy✓
• DDisabling Azure Policy so deployments are not blocked during incidents

Answer: Segmentation with scoped role assignments and policies contains an incident to a boundary rather than letting it spread tenant-wide. Consolidating everything in one subscription, broad root-scope Owner grants and disabling policy all widen the blast radius.

A key vault must allow a specific app to read secrets but never list or delete them. Under the RBAC model, what should you assign?

• AThe full Key Vault Administrator role scoped directly to that one particular vault
• BA role granting only secret get permission, scoped to that vault✓
• CThe Contributor role scoped to the resource group that contains the vault
• DAn access policy granting all secret permissions to the app

Answer: Granting only the get (read) data action on secrets at the vault scope follows least privilege, allowing reads without list or delete. Key Vault Administrator and Contributor are far broader, and an all-permissions access policy defeats the purpose.

What is the recommended way to detect configuration drift from your security baseline across many subscriptions?

• AAsk each resource owner to email a monthly attestation confirming that their settings still match the baseline
• BAssign Azure Policy initiatives and monitor the compliance state centrally in Defender for Cloud✓
• CEnable diagnostic logging and manually read the logs for each resource
• DRe-deploy every single resource from its original templates all over again on a fixed weekly schedule

Answer: Policy initiatives evaluate resources continuously and surface non-compliance centrally, which is how drift is detected at scale. Manual attestations, hand-reading logs and blanket redeployment are error-prone or disruptive.

Which Microsoft Entra role, when assigned through PIM as eligible, best supports least-privilege management of Azure resources for an on-call engineer?

• AThe tenant-wide Global Administrator directory role, activated and left on for the length of the on-call shift
• BThe Security Reader role, which grants write access to Azure resources when active
• CIt is not a Microsoft Entra role; Azure resource access uses Azure RBAC roles activated through PIM for Azure resources✓
• DThe Application Administrator role, which manages Azure resource role assignments

Answer: Managing Azure resources uses Azure RBAC roles, which PIM can also make eligible and time-bound (PIM for Azure resources), so the on-call engineer activates a scoped Azure role rather than a directory role. Global Administrator is directory-wide, Security Reader is read-only, and Application Administrator manages apps, not Azure resource access.

What does enabling diagnostic settings on a key vault and sending logs to Microsoft Sentinel achieve?

• AKey vault secrets are automatically rotated whenever anomalies are detected in the workspace
• BAccess to the key vault is automatically blocked for everyone whenever any log entry is generated
• CKey vault access and audit events can be analyzed and alerted on for suspicious activity✓
• DThe key vault firewall is reconfigured to match the workspace region

Answer: Diagnostic settings stream key vault audit events to a destination such as Sentinel, where you can hunt and build detections for suspicious access. Logging does not itself rotate secrets, block access or change firewall configuration.

Which is the best practice for the credentials a CI/CD pipeline uses to deploy Azure infrastructure?

• AStore a service principal client secret as a plaintext pipeline variable
• BUse a workload identity federation or managed identity so no long-lived secret is stored in the pipeline✓
• CReuse a single shared Global Administrator account so that no required permission is ever missing
• DEmbed a subscription management certificate directly in the repository

Answer: Workload identity federation lets the pipeline obtain short-lived tokens with no stored secret, and managed identities do the same for Azure-hosted agents. Plaintext secrets, using Global Administrator, and embedded certificates all create high-value, long-lived credentials at risk of theft.

An initiative assigned at a management group reports many resources as non-compliant with an audit policy. What is the safest first step to move toward compliance?

• AReview the failing resources and remediate or create scoped exemptions with documented justification✓
• BChange the audit policy effects to deny immediately across the whole assigned scope
• CDelete the policy assignment so the resources stop reporting failures
• DGrant Owner to the resource teams so they can change settings quickly

Answer: Auditing first, then remediating and using justified exemptions where needed, moves you toward compliance without breaking workloads. Flipping everything to deny at once can block operations, deleting the assignment hides the problem, and blanket Owner grants violate least privilege.

Why should break-glass (emergency access) accounts generally be excluded from most Conditional Access policies?

• ASo a misconfigured or failing policy cannot lock every administrator out of the tenant✓
• BSo that they are able to sign in without using any credential at all during a declared emergency
• CSo they inherit permissions automatically from the Global Administrator role
• DSo their sign-in activity is never written to the Microsoft Entra sign-in logs or audit logs

Answer: Break-glass accounts are excluded from most Conditional Access policies so that a broken policy or an outage in a dependency does not lock out all admins; they are still strongly protected and closely monitored. They still require credentials, need explicit role assignment, and their activity is logged and alerted on.

Which governance capability lets you require a specific tag, such as a data-classification tag, on all new resources?

• AA CanNotDelete resource lock that is configured to require the tag before any deletion
• BAn RBAC condition attached to the deploying user's role assignment
• CA diagnostic setting that records which resources are missing the tag in a Log Analytics workspace
• DAn Azure Policy with a deny or modify effect targeting the required tag✓

Answer: Azure Policy can deny resources missing a required tag, or use Modify to add it, enforcing tagging standards. Locks govern deletion, RBAC conditions constrain what a role can do rather than mandate tags, and diagnostics only observe.