Secure Compute & AI Workloads

Which Microsoft Purview capability identifies where Microsoft 365 Copilot could surface data that is overshared, such as files with broad access in SharePoint?

• AData Security Posture Management (DSPM) for AI✓
• BCommunication compliance for monitored messaging channels
• CInformation barriers between two conflicting user segments
• DRetention labels applied automatically to matching content

Answer: DSPM for AI in Microsoft Purview surfaces AI-related data risks, including oversharing that Copilot could expose, and recommends remediation. Communication compliance, information barriers and retention labels address messaging, segregation and lifecycle rather than AI data exposure.

A security engineer must reduce the risk that Microsoft 365 Copilot returns sensitive files a user should not see. Which is the most effective first step?

• ADisable Copilot for the users in the organization on a permanent basis
• BIncrease the maximum Copilot response length so that its answers include more context
• CRemediate oversharing by fixing broad SharePoint and OneDrive permissions and applying sensitivity labels✓
• DGrant users the same access so that Copilot results are consistent

Answer: Copilot honors existing permissions, so oversharing is the root risk; tightening access and labeling sensitive content reduces what Copilot can surface. Disabling Copilot outright removes value unnecessarily, longer responses do not reduce exposure, and equalizing access makes oversharing worse.

What does an agent identity in Microsoft Entra (Entra Agent ID) represent?

• AA shared service account whose password is rotated by the agent itself
• BA local Windows account created on each server the agent runs on
• CA first-class identity for an AI agent so its access can be governed, conditioned and audited✓
• DA standard external guest user object that has been invited in from the AI vendor's own home tenant

Answer: Entra Agent ID gives AI agents their own identities so you can apply access governance, Conditional Access and auditing to them like any other principal. It is not a shared password account, a local machine account, or a B2B guest.

How can you require additional controls, such as a compliant network or device, specifically when an AI agent accesses resources?

• AApply a Purview sensitivity label directly to the agent's own configuration file
• BApply a retention policy to the agent's conversation history in Microsoft Purview
• CApply Conditional Access policies that target the Entra Agent ID✓
• DApply a resource lock to the resources the agent reads from

Answer: Because Entra Agent ID is a real identity, Conditional Access can target agents to enforce conditions on their access. Sensitivity labels classify content, retention governs lifecycle, and resource locks prevent deletion, none of which conditions agent access.

After a Copilot agent is suspected of being misused, which tool helps you analyze the blast radius of what that agent identity could reach?

• AAzure Cost Management, using the agent's consumption data
• BAzure Resource Graph, using the agent's tag assignments
• CMicrosoft Defender XDR, using Entra Agent ID signals✓
• DAzure Advisor, using the agent's performance recommendations

Answer: Defender XDR can analyze the blast radius of an Entra Agent ID, showing what the agent could access to scope an incident. Cost Management, Resource Graph and Advisor address spend, inventory and optimization rather than security blast radius.

Which Defender for Cloud capability provides threat protection for AI services running your generative AI workloads?

• ADefender for Servers, which provides vulnerability assessment and endpoint detection for machines
• BDefender for Key Vault, which alerts on anomalous access to stored keys, secrets and certificates
• CDefender for Resource Manager, which alerts on suspicious control-plane management operations
• DDefender for AI Services (AI threat protection in Cloud Workload Protection)✓

Answer: Defender for AI Services (part of Cloud Workload Protection in Defender for Cloud) detects threats to AI workloads, such as prompt injection and data-exfiltration attempts against models. Defender for Servers, Key Vault and Resource Manager protect other resource types.

Which risk is unique to large language model applications and is specifically addressed by guardrails and input filtering?

• ASQL injection, where specially crafted input alters a back-end relational database query
• BCross-site scripting, where crafted input runs malicious script in a victim's browser session
• CPrompt injection, where crafted input manipulates the model into unintended actions✓
• DBuffer overflow, where crafted input overwrites adjacent memory regions

Answer: Prompt injection is an AI-specific attack where malicious input overrides the model's instructions, mitigated by guardrails, grounding and input/output filtering. SQL injection, cross-site scripting and buffer overflow are classic application vulnerabilities, not model-instruction manipulation.

In Microsoft Foundry, what is the purpose of configuring content filters and guardrails on a deployed model?

• ATo increase the model's maximum context window so that it accepts longer prompts
• BTo reduce the latency of the model's responses under heavy load
• CTo detect and block harmful or policy-violating prompts and responses✓
• DTo simply lower the overall token cost of each request that is sent to the model

Answer: Guardrails and content filters screen prompts and completions for harmful or disallowed content, enforcing safety and policy. They are not performance, capacity or cost controls.

How can Azure API Management act as an AI Gateway in front of Microsoft Foundry model endpoints?

• AIt fine-tunes a separate private copy of each model using the organization's own internal business data
• BIt centralizes authentication, rate limiting, logging and policy enforcement for calls to the models✓
• CIt stores the model weights locally on the gateway so the models can run without internet connectivity
• DIt removes the need to authenticate the clients calling the model endpoint

Answer: As an AI Gateway, API Management fronts model endpoints to apply authentication, throttling, logging and policies, giving central control and protection over AI traffic. It does not train models, host weights locally, or remove authentication.

Which dashboard gives a consolidated view of data and AI security posture and risks in Microsoft Defender for Cloud?

• AThe regulatory compliance dashboard
• BThe Data and AI security dashboard✓
• CThe identity and access dashboard
• DThe DevOps security dashboard

Answer: The Data and AI security dashboard in Defender for Cloud consolidates posture and risks for data and AI resources. The regulatory compliance, identity, and DevOps views focus on standards, identity posture and pipeline security respectively.

Where can an administrator review and manage the AI agents that have been created for the organization across Microsoft 365?

• AThe Azure network security group blade
• BThe Microsoft Entra named locations page
• CThe Azure Key Vault access policies page
• DThe Microsoft 365 admin center✓

Answer: Agents can be managed from the Microsoft 365 admin center, giving administrators oversight of the agents in their tenant. NSGs, named locations and Key Vault access policies govern networking, location conditions and key access, not agent management.

Which control provides real-time protection for Microsoft Copilot Studio agents against risky content and behavior?

• AApplying a Microsoft Purview sensitivity label so the agent's stored knowledge is classified and encrypted at rest
• BInspecting agent tool invocations at runtime in the Microsoft Defender portal and blocking risky actions such as cross-prompt injection✓
• CEnabling just-in-time access so the agent's compute management ports open for approved, time-boxed requests
• DTurning on soft delete for the agent so that its published knowledge base can then be recovered at a later point within a configured retention window period

Answer: Copilot Studio agents can be protected at runtime from the Microsoft Defender portal, where agent tool invocations are inspected and risky actions such as cross-prompt injection are blocked as they happen. A Purview sensitivity label, just-in-time access and soft delete address classification, port exposure and recoverability rather than agent-runtime protection.

Which VM protection encrypts the operating system and data disks using keys you can control in Key Vault?

• AJust-in-time VM access with approval workflows for the management ports
• BAzure Disk Encryption or encryption at host with customer-managed keys✓
• CNetwork security groups that are simply applied to the virtual machine's subnet
• DAzure Bastion for browser-based RDP and SSH connectivity to the VM over TLS

Answer: Azure Disk Encryption (and encryption at host) encrypts VM disks, and customer-managed keys in Key Vault give you control over the keys. Just-in-time access, NSGs and Bastion protect access paths, not the disks at rest.

What do secure boot and a virtual Trusted Platform Module (vTPM) provide when enabled on a trusted-launch Azure VM?

• AAutomatic patching of the guest operating system on a monthly maintenance schedule
• BEncryption of network traffic between the VM and other hosts
• CAutomatic load balancing of all of the inbound connections across the many VM instances
• DProtection against boot-level rootkits and a hardware root of trust for integrity✓

Answer: Trusted launch uses secure boot to block unsigned or malicious boot components and a vTPM as a hardware root of trust supporting integrity monitoring. It does not patch the OS, encrypt network traffic or balance load.

Which Defender for Cloud plan protects servers, including on-premises and multicloud machines, with EDR integration and vulnerability assessment?

• AMicrosoft Defender for Storage
• BMicrosoft Defender for Resource Manager
• CMicrosoft Defender for DNS
• DMicrosoft Defender for Servers✓

Answer: Defender for Servers protects Windows and Linux servers with integrated Defender for Endpoint (EDR), vulnerability assessment and just-in-time access, and covers hybrid and multicloud machines via Azure Arc. Defender for Storage, Resource Manager and DNS protect other surfaces.

How do you bring an on-premises or AWS server under Defender for Servers protection?

• AOnboard it to Azure Arc and enable the Defender for Servers plan✓
• BAssign it a public IP and add it to an Azure availability set
• CMigrate it to an Azure virtual machine before any protection can be applied
• DCreate a private endpoint for the server in an Azure virtual network

Answer: Azure Arc projects non-Azure servers into Azure so Defender for Servers can protect them where they run. A public IP and availability set, a full migration, or a private endpoint are not how hybrid or multicloud servers are onboarded.

Which Defender for Cloud capability scans VMs for vulnerabilities and missing configurations without installing an agent on each machine?

• AAdaptive application controls
• BFile integrity monitoring
• CAgentless scanning for machines✓
• DJust-in-time VM access

Answer: Agentless scanning takes a snapshot-based approach to assess VMs for vulnerabilities and secrets without deploying an agent to each one. Adaptive application controls, file integrity monitoring and just-in-time access are agent- or policy-based features serving other purposes.

Which service provides runtime threat detection and posture management for containers, including Azure Kubernetes Service?

• AMicrosoft Defender for Containers✓
• BAzure Container Registry content trust
• CAzure Kubernetes Service cluster autoscaler
• DAzure Container Instances restart policies

Answer: Defender for Containers provides vulnerability assessment of images, runtime threat detection and Kubernetes posture management. Content trust signs images, the autoscaler manages capacity, and restart policies handle container lifecycle rather than security.

Which practice reduces the risk of deploying container images with known vulnerabilities to AKS?

• ARun the containers as the root user simply to make file access and permission handling easier
• BScan images in Azure Container Registry and block or gate deployment of vulnerable images✓
• CExpose the Kubernetes API server publicly for easier remote management from home or partner networks
• DGrant pods cluster-admin so deployments do not fail on permissions

Answer: Scanning registry images and gating vulnerable ones out of deployment prevents known-bad images reaching the cluster. Running as root, exposing the API server publicly and granting cluster-admin broadly all weaken container security.

Which authentication approach best secures an Azure Function that must be called only by authorized clients?

• AEnable App Service authentication (Easy Auth) with Microsoft Entra ID and restrict network access✓
• BPublish the function app using anonymous authorization together with a long and hard-to-guess hidden URL
• CEmbed a static function key in the client and reuse it across apps
• DAllow inbound traffic from the internet and rely on the function code to check request headers for a shared token

Answer: Built-in authentication with Microsoft Entra ID validates callers before code runs, and network restrictions limit exposure. Anonymous access with a hidden URL, a shared static key and inspecting headers in code are weaker, leak-prone approaches.

What is a security benefit of using managed identities with Azure Logic Apps connectors?

• AConnections authenticate through Microsoft Entra ID without storing credentials in the workflow✓
• BWorkflows run without network egress to the connected services
• CWorkflow actions are automatically encrypted end to end by the identity
• DThe workflow bypasses Azure RBAC whenever it is accessing the target resources through a connector

Answer: A managed identity lets Logic Apps connectors authenticate via Microsoft Entra ID with no secret stored in the workflow definition. It does not remove network egress, blanket-encrypt actions, or bypass RBAC.

Which App Service configuration ensures the app is reachable only from your virtual network and not the public internet?

• AEnable the built-in App Service managed certificate for TLS on the custom domain
• BScale the app up to a much larger plan that has more compute instances
• CTurn on always-on so the app is never unloaded from memory
• DUse private endpoints and disable public network access for the app✓

Answer: A private endpoint plus disabling public access makes the App Service reachable only over the private network. Managed certificates provide TLS, scaling adds capacity, and always-on keeps the app warm, none of which restricts network reachability.

How does Azure API Management help protect back-end APIs from abuse?

• AIt applies policies such as authentication, rate limiting, IP filtering and request validation before requests reach the back end✓
• BIt automatically rewrites the back-end API's own source code to remove insecure functions before client requests reach the service
• CIt stores a full copy of the back-end API's data so that the back-end service itself does not receive traffic
• DIt disables TLS between the gateway and the clients so that requests are processed faster during heavy load periods

Answer: API Management sits in front of back-end APIs and enforces policies including authentication, throttling, IP restrictions and validation, shielding the back end. It does not modify back-end code, replace the back end as a data store, or disable TLS.

Which capability enforces a required security configuration inside Azure VMs, such as OS baseline settings, and reports drift?

• AAzure Update Manager scheduled patching
• BAzure Machine Configuration (guest configuration)✓
• CAzure Monitor agent data collection rules
• DAzure Backup application-consistent snapshots

Answer: Azure Machine Configuration audits and can enforce in-guest settings against a baseline and reports compliance and drift. Update Manager patches, the Monitor agent collects telemetry, and Backup handles recovery points, not baseline enforcement.

Which measure most directly limits the impact of a compromised container escaping to the AKS node?

• ASimply increase the overall AKS node pool size so that the workloads end up spread more thinly
• BAssign a public IP address to each pod so that engineers have direct troubleshooting access from outside the cluster
• CDisable Kubernetes RBAC so that deployments are not blocked by an authorization policy during a release
• DApply pod security standards and least-privilege settings so containers do not run privileged✓

Answer: Enforcing pod security standards and avoiding privileged, root or host-mounting containers limits what a compromised container can do to the node. More nodes, public pod IPs and disabling RBAC do not contain a container escape and often worsen exposure.

Which is a recommended way to protect secrets used by workloads running in AKS?

• ABake the secrets directly into the container image layers during the build so they deploy with the workload
• BUse workload identity with Microsoft Entra ID and reference Key Vault via the Secrets Store CSI driver✓
• CPass the secrets as plaintext environment variables in the deployment manifest so the pods can read them at start
• DStore the secrets in a public config map that is shared across namespaces so other workloads can reference them

Answer: Workload identity lets pods authenticate to Microsoft Entra ID without stored secrets, and the Secrets Store CSI driver mounts Key Vault secrets securely. Baking secrets into images, plaintext environment variables and public config maps all expose secrets.

A generative AI application must not leak proprietary data in its responses. Which combination of measures best addresses this?

• AGive the model unrestricted access to the corporate data sources at once, regardless of sensitivity
• BGround the model on approved data, apply DSPM for AI, and enforce content and data-loss controls✓
• CIncrease the temperature setting so responses are more varied and creative
• DCache the prompts and responses together inside a public storage container so they can be reviewed later

Answer: Grounding on approved sources, using Purview DSPM for AI to find and reduce exposure, and applying content and data-loss controls together limit leakage. Unrestricted data access, higher temperature and public caching increase the risk of leaking sensitive data.

What does enabling Defender for Containers image scanning in Azure Container Registry primarily detect?

• AExcessive CPU and memory requests declared in the pod specification for each container
• BKnown vulnerabilities in the operating system and application packages within images✓
• CMisrouted network traffic between pods in different namespaces
• DExpired or invalid TLS certificates that are presented by the cluster's ingress controller

Answer: Registry image scanning identifies known CVEs in OS and library packages so vulnerable images can be remediated before deployment. Resource requests, network routing and certificate expiry are unrelated to image vulnerability scanning.

Which statement best describes why AI agents should have their own identities rather than sharing a user's credentials?

• ADistinct identities allow least-privilege access, targeted policies and clear auditing of agent actions✓
• BDistinct identities let agents skip Conditional Access that applies to users
• CHaving distinct identities removes the need to assign the agents permissions of their own for resource access
• DDistinct identities cause the agents to inherit the permissions of their creator

Answer: Giving agents their own identities means you can scope their access, apply Conditional Access to them and audit their actions separately from any human. It does not exempt them from policy, remove the need for permissions, or grant them the creator's rights.

Which Azure service secures inbound web traffic to a containerized app with TLS termination and a web application firewall?

• AAzure Bastion placed directly in front of each of the container instances
• BAzure Private Link in front of the container registry
• CAzure Key Vault in front of the ingress controller
• DApplication Gateway with Web Application Firewall in front of the app✓

Answer: Application Gateway with WAF terminates TLS and inspects HTTP traffic for common web attacks before it reaches the app. Bastion provides VM access, Private Link exposes services privately, and Key Vault stores secrets, none of which is a web front door with WAF.

Which approach best limits standing exposure of an AI application's API keys to model endpoints?

• ADistribute one static API key to the client apps that call the endpoint and reuse the same key across environments
• BPublish the API key inside the client-side application code so that integrating new callers is quick and convenient
• CFront the endpoints with an AI Gateway and use managed identities or short-lived tokens instead of static keys✓
• DDisable authentication on the model endpoint so there are no keys or tokens to handle, store, rotate or protect

Answer: An AI Gateway centralizes access and lets you use managed identities or short-lived tokens, reducing reliance on static keys. Sharing one static key, publishing it client-side, or disabling authentication all increase exposure.

Which Defender for Cloud feature helps ensure only approved applications run on a protected server?

• AAdaptive application controls✓
• BAdaptive network hardening
• CRegulatory compliance mapping
• DWorkflow automation playbooks

Answer: Adaptive application controls learn expected applications on a machine and alert on or block unexpected ones. Adaptive network hardening recommends NSG rules, regulatory compliance maps standards, and workflow automation responds to alerts.

What is the security purpose of enabling integrity monitoring on a trusted-launch VM?

• AIt detects changes to the boot chain and validates the VM booted with a trusted configuration✓
• BIt compresses the VM's disks to reduce the storage footprint at rest
• CIt schedules automatic restarts to apply operating system updates
• DIt automatically replicates the entire VM to a second Azure region purely for disaster recovery purposes

Answer: Integrity monitoring, built on the vTPM and secure boot, attests that the VM booted in a trusted state and flags boot-chain tampering. It does not compress disks, schedule updates, or replicate the VM.

Which control reduces the risk that Azure Container Instances expose sensitive workloads to the public internet?

• ARun the container image as the root user inside the container
• BDeploy the container group into a virtual network and avoid assigning a public IP✓
• CStore the container's environment secrets in the image manifest
• DAllow inbound network traffic from literally any source on all of the container ports

Answer: Placing container instances in a virtual network without a public IP keeps them off the public internet. Running as root, embedding secrets and allowing any inbound traffic all worsen the security position.

Which measure best protects an AI workload from data-poisoning of its grounding data?

• AAllow authenticated users to add documents to the grounding store
• BDisable the logging on the grounding data store purely to reduce the ongoing storage and ingestion overhead
• CRestrict and monitor write access to the grounding data sources and validate ingested content✓
• DGrant the AI application the Owner role over its connected data sources

Answer: Controlling and monitoring who can write to grounding data, and validating what is ingested, reduces the chance of poisoned content skewing model outputs. Open write access, disabled logging and broad owner grants increase the poisoning risk.

Which capability lets you discover internet-exposed assets and unmanaged resources that could be attacked?

• AMicrosoft Defender for Cloud secure score
• BMicrosoft Purview data map scanning
• CMicrosoft Entra access reviews
• DMicrosoft Defender External Attack Surface Management (EASM)✓

Answer: Defender EASM discovers and inventories internet-facing assets, including unknown or unmanaged ones, so you can reduce the external attack surface. Secure score measures posture, the Purview data map catalogs data, and access reviews recertify access.

Which is the best way to grant a container app in Azure access to a database without embedding credentials?

• AAssign the container app a managed identity and grant it a scoped role on the database✓
• BStore the database password in the container app's revision settings
• CEmbed the full database connection string directly inside the published public container image
• DUse one shared database admin login for all container apps in the tenant

Answer: A managed identity with a least-privilege role lets the container app authenticate with Microsoft Entra ID and no stored credential. Storing the password in settings, baking a connection string into the image, and sharing an admin login all reintroduce credential risk.

When securing AI workloads, why is monitoring model inputs and outputs important?

• AIt corrects the model's factual errors before responses reach users
• BIt removes the need to apply access controls to the data sources
• CIt helps detect prompt injection, data leakage and misuse that static configuration alone would miss✓
• DIt prevents the underlying model from being retrained on new data, which keeps its behavior fixed over time

Answer: Monitoring prompts and responses surfaces runtime abuse like injection, leakage and misuse that configuration cannot catch on its own. It does not correct factual errors, replace access controls, or govern retraining.

Which combination best follows defense in depth for a public-facing web app running on Azure App Service?

• AA single strong administrator password that is reused across the development, test and production environments alike
• BPublic network access enabled everywhere, with reliance on obscure and hard-to-guess URLs to keep attackers out
• CAnonymous access to the back-end APIs, with the only authorization checks performed in the client-side code itself
• DWAF at the edge, private connectivity to back ends, managed identity for secrets, and Defender plans enabled✓

Answer: Layering a WAF, private back-end connectivity, identity-based secret access and Defender detection is defense in depth for a web app. A reused admin password, reliance on obscurity and client-side-only checks are weak single points of failure.