Secure Storage, Databases & Networking

Which storage account setting ensures clients can only connect over encrypted connections?

• ARequire secure transfer (HTTPS) for the storage account✓
• BEnable blob soft delete and versioning for the whole storage account
• CRotate the storage account access keys regularly on a fixed schedule
• DEnable versioning on the storage account's blobs

Answer: The secure transfer required setting rejects requests made over unencrypted HTTP, forcing HTTPS (and SMB encryption for files). Soft delete, key rotation and versioning improve recoverability and hygiene but do not enforce encryption in transit.

You must stop a storage account from being reachable over the public internet and allow access only from a specific virtual network. Which combination achieves this?

• ASet the storage firewall to deny public access and add a private endpoint or service endpoint for the virtual network✓
• BEnable anonymous blob access on the account and rely on shared access signature tokens to control who reads the data
• CRotate both storage account access keys and distribute the new keys only to the hosts inside the target virtual network
• DEnable geo-redundant storage so that the replicated copies of the data remain within the same virtual network as the source

Answer: Denying public network access and permitting only a selected virtual network, ideally through a private endpoint, restricts the storage account to that network. Anonymous access, key distribution and geo-redundancy do not control network reachability.

What is the main security advantage of a private endpoint over a service endpoint for accessing a PaaS resource such as a storage account?

• AA private endpoint automatically encrypts the resource's data at rest using a platform key that Microsoft manages on your behalf
• BA private endpoint gives the resource a private IP in your virtual network, so traffic never traverses a public endpoint✓
• CA private endpoint removes the need to assign any RBAC roles because callers are authorized purely by their network location
• DA private endpoint grants the resource inbound access to every subnet in the virtual network without further configuration

Answer: A private endpoint maps the PaaS resource to a private IP inside your VNet so connectivity stays on the private network and the public endpoint can be disabled. Service endpoints still use the service's public IP with a VNet identity. Private endpoints do not change encryption at rest, RBAC or subnet access.

Which Defender for Cloud plan provides threat detection for blob storage, such as alerting on unusual access or potential malware uploads?

• AMicrosoft Defender for Servers
• BMicrosoft Defender for Containers
• CMicrosoft Defender for Storage✓
• DMicrosoft Defender for Key Vault

Answer: Defender for Storage monitors storage accounts and alerts on suspicious activities such as anomalous access patterns and malicious uploads, and can perform malware scanning. Defender for Servers, Containers and Key Vault protect other resource types.

Which mechanism grants a client time-limited, scoped access to a specific blob without sharing the storage account key?

• AA network security group rule allowing inbound traffic from the client's IP address
• BAn Azure Policy assignment granting the client read permission
• CA system-assigned managed identity attached directly to the storage account resource
• DA shared access signature (SAS), preferably a user delegation SAS✓

Answer: A SAS provides delegated, time-bound access to specific resources and operations; a user delegation SAS is signed with Microsoft Entra credentials rather than the account key, which is preferred. NSGs filter network traffic, Azure Policy governs configuration, and a storage account does not host a managed identity for inbound callers.

To reduce the risk from long-lived storage account keys, which is the best practice?

• APublish both account keys in a shared document for the team's convenience
• BRemove the key expiration policy so applications are not disrupted
• CPrefer Microsoft Entra authorization with RBAC and disable shared key access where possible✓
• DReuse the same shared access key across the storage accounts to simplify rotation

Answer: Disabling shared key authorization and using Microsoft Entra RBAC removes the powerful, static account keys as an attack target. Publishing keys, making them non-expiring and reusing them across accounts all increase exposure.

Which Azure SQL Database feature detects anomalous activities such as potential SQL injection and unusual access patterns?

• ATransparent data encryption for the database files
• BDynamic data masking for sensitive result columns
• CMicrosoft Defender for SQL (advanced threat protection)✓
• DLong-term backup retention for the database backups

Answer: Microsoft Defender for SQL provides advanced threat protection, alerting on suspicious activities like injection attempts and anomalous logins. Transparent data encryption protects data at rest, dynamic data masking obscures results, and long-term retention concerns backups.

What does enabling auditing on Azure SQL Database provide?

• AAutomatic encryption of the database's data at rest using service-managed keys
• BDynamic masking of sensitive columns so that unauthorized users see obfuscated placeholder values instead
• CA record of database events written to a destination such as a storage account, Log Analytics or Event Hubs✓
• DRow-level filtering that limits which rows each user is permitted to query

Answer: Azure SQL auditing tracks database events and writes audit logs to storage, Log Analytics or Event Hubs for investigation and compliance. Encryption at rest, dynamic data masking and row-level security are separate features.

Which control ensures data in an Azure SQL Database is encrypted at rest by default?

• AAlways Encrypted with secure enclaves
• BDynamic data masking on sensitive fields
• CA virtual network rule restricting access
• DTransparent data encryption (TDE)✓

Answer: Transparent data encryption encrypts the database, backups and transaction logs at rest and is enabled by default for Azure SQL. Always Encrypted protects specific columns in use, dynamic data masking obscures displayed values, and VNet rules govern network access.

Which Azure network resource filters inbound and outbound traffic to subnets and network interfaces based on source, destination, port and protocol?

• AA network security group (NSG)✓
• BA route table with user-defined routes
• CA network interface with accelerated networking
• DA public IP address with a standard SKU

Answer: An NSG contains allow and deny rules evaluated by priority to filter traffic at the subnet or NIC level. Route tables direct traffic paths, accelerated networking improves NIC performance, and a public IP provides internet addressing.

What advantage does an application security group (ASG) provide when writing NSG rules?

• ARules can reference workloads by group membership instead of by fixed IP addresses✓
• BRules are automatically encrypted end to end between the grouped resources on the same virtual network
• CRules are able to bypass the normal NSG priority evaluation order for members of the group
• DRules apply at the management group scope across the subscriptions

Answer: ASGs let you group VMs and write NSG rules against the group, so membership changes update the rules without editing IP addresses. ASGs do not encrypt traffic, skip rule evaluation, or apply at the management group scope.

Which service provides centralized, policy-driven management of network security rules and connectivity across many virtual networks?

• AAzure Virtual Network Manager✓
• BAzure Network Watcher
• CAzure Private Link
• DAzure Bastion

Answer: Azure Virtual Network Manager lets you group virtual networks and apply connectivity and security admin rules centrally at scale. Network Watcher is a diagnostics toolset, Private Link exposes services privately, and Bastion provides secure VM connectivity.

A security admin rule created in Azure Virtual Network Manager differs from an ordinary NSG rule in what important way?

• ASecurity admin rules apply to outbound traffic, while NSGs handle inbound
• BSecurity admin rules are evaluated after the NSG rules have been applied
• CSecurity admin rules take precedence over NSG rules and cannot be overridden by network teams by default✓
• DSecurity admin rules can allow network traffic but have no action for denying it

Answer: Security admin rules are enforced by network managers ahead of NSG rules, letting central security teams set guardrails that resource-level NSGs cannot override. They apply to inbound and outbound traffic and can allow, deny or always-allow.

Which service is a stateful, cloud-native firewall offering FQDN filtering, threat intelligence and centralized rule management?

• AAzure Application Gateway
• BAzure Load Balancer
• CAzure Front Door
• DAzure Firewall✓

Answer: Azure Firewall is a managed stateful firewall with application (FQDN) rules, network rules and threat intelligence-based filtering, managed centrally with Firewall Manager. Application Gateway and Front Door are web delivery and WAF services, and Load Balancer distributes traffic without firewalling.

You must protect a web application from common exploits such as SQL injection and cross-site scripting at the network edge. Which control is most appropriate?

• AA network security group applied to the web tier subnet
• BAzure DDoS Network Protection enabled across the entire virtual network
• CAzure Web Application Firewall on Application Gateway or Front Door✓
• DA user-defined route sending traffic through a network virtual appliance for inspection

Answer: Azure WAF inspects HTTP/S traffic and blocks OWASP-style attacks like injection and cross-site scripting. NSGs filter by IP and port, DDoS Protection mitigates volumetric attacks, and UDRs direct routing rather than inspecting application-layer content.

Which capability provides secure, private RDP and SSH connectivity to VMs without exposing a public IP or RDP/SSH port?

• AA just-in-time VM access rule
• BA point-to-site VPN connection
• CA public load balancer inbound rule
• DAzure Bastion✓

Answer: Azure Bastion provides browser-based RDP and SSH over TLS from the portal, so VMs need no public IP or exposed management ports. Just-in-time access still opens the port temporarily, and VPNs and load balancer rules do not replace Bastion's role.

What does Microsoft Entra Private Access provide?

• AA managed public DNS zone that resolves names for internet-facing web applications hosted in Azure
• BA global content delivery network that is used for caching all of the static website assets
• CA site-to-site tunnel that joins two on-premises data centers
• DSecure, identity-aware access to private applications without a traditional full VPN✓

Answer: Microsoft Entra Private Access, part of Global Secure Access, provides Zero Trust, identity-aware connectivity to private resources without exposing them or requiring a legacy full VPN. It is not a DNS service, a CDN, or a data-center-to-data-center tunnel.

Which Azure service lets you diagnose why traffic is or is not reaching a VM by evaluating the effective security rules and next hop?

• AAzure Network Watcher✓
• BAzure Monitor workbooks
• CAzure Resource Graph explorer
• DAzure Advisor recommendations

Answer: Network Watcher provides diagnostics such as IP flow verify, effective security rules and next hop to troubleshoot connectivity. Workbooks visualize data, Resource Graph queries resources, and Advisor gives best-practice recommendations, none of which trace network paths.

Which storage feature helps you recover from accidental or malicious deletion of blob data?

• ALocally redundant storage within a single data center
• BA shared access signature scoped to delete operations
• CBlob soft delete with an appropriate retention period✓
• DA storage firewall rule allowing a trusted IP range

Answer: Blob soft delete retains deleted blobs and versions for a set period so they can be restored, protecting against deletion. Locally redundant storage protects against hardware failure, a delete-scoped SAS actually grants deletion, and firewall rules control access.

To protect against a distributed denial-of-service attack on public endpoints, which service should be enabled?

• AAzure DDoS Protection (Network Protection)✓
• BAzure Private Link for the affected resources
• CAzure Firewall application rules with FQDN tags
• DTransparent data encryption on the back-end database

Answer: Azure DDoS Protection provides enhanced mitigation and telemetry for volumetric and protocol attacks against public IP resources. Private Link removes public exposure for specific PaaS services, Azure Firewall filters traffic, and TDE protects data at rest, none of which is a DDoS mitigation.

Which database protection prevents even a highly privileged database administrator from viewing sensitive column values in plaintext?

• ATransparent data encryption
• BDynamic data masking
• CDatabase-level auditing
• DAlways Encrypted✓

Answer: Always Encrypted encrypts sensitive columns so the keys stay client-side and the database engine, and thus a DBA, only ever sees ciphertext. Transparent data encryption protects at rest but is transparent to queries, dynamic data masking only obscures displayed values and can be bypassed with sufficient privilege, and auditing records events.

What is the recommended way to allow an Azure SQL Database to be reached only from within your virtual network?

• ATurn on the Allow Azure services and resources to access this server option instead
• BAdd every application server's public IP address to the server-level firewall rules
• CEnable geo-replication so the database stays inside the network
• DUse a private endpoint for the database and disable public network access✓

Answer: A private endpoint gives the database a private IP in your VNet and disabling public access ensures it is not reachable from the internet. The 'allow Azure services' option is broad, listing public IPs still exposes a public endpoint, and geo-replication concerns availability.

Which feature of a storage account limits SAS tokens so that ones created before a certain time are no longer valid?

• AEnabling infrastructure encryption for double encryption at rest
• BSetting a stored access policy or a SAS start-time and key rotation to invalidate old tokens✓
• CTurning on the hierarchical namespace for the storage account
• DConfiguring object replication between two storage accounts in different regions

Answer: Stored access policies let you revoke or constrain SAS tokens centrally, and rotating the signing key invalidates all SAS created with it, limiting exposure of leaked tokens. Infrastructure encryption, hierarchical namespace and object replication address encryption, analytics and copying rather than SAS validity.

Which statement about network security group rule evaluation is correct?

• AMatching rules are combined, and traffic is allowed if the majority of them allow it
• BDeny rules are processed after the allow rules have been evaluated, regardless of their priority order
• CRules are processed in priority order, and the first matching rule determines whether traffic is allowed or denied✓
• DRules are evaluated from the highest priority number down to the lowest

Answer: NSG rules are evaluated by ascending priority number, and the first match wins for that direction; default rules apply if nothing matches. Rules are not combined or counted against each other, lower numbers are processed first, priority governs order rather than allow-versus-deny type, and NSGs filter both inbound and outbound traffic.

Which service secures and centralizes connectivity for a global hub-and-spoke topology, and can include integrated security with Azure Firewall?

• AAzure ExpressRoute with a private peering circuit
• BAzure Virtual WAN with a secured virtual hub✓
• CAzure Traffic Manager with performance routing
• DAzure Content Delivery Network with dynamic caching

Answer: Azure Virtual WAN provides managed hub-and-spoke connectivity globally, and a secured virtual hub integrates Azure Firewall for traffic inspection. ExpressRoute is a private connectivity circuit, Traffic Manager is DNS-based routing, and a CDN caches content.

What does enabling malware scanning in Microsoft Defender for Storage do?

• AEncrypts each uploaded blob automatically with its own unique customer-managed key in Key Vault
• BScans uploaded blobs for known malware and can trigger a response when a threat is found✓
• CBlocks anonymous public read access to the blob containers in the storage account by default
• DRotates the storage account keys whenever a new blob is uploaded

Answer: Defender for Storage malware scanning inspects newly uploaded blobs and can surface alerts or move or delete infected files through automation. It does not manage encryption keys, container access settings or key rotation.

Which approach best secures traffic between two virtual networks so it stays on the Microsoft backbone rather than the public internet?

• AA public load balancer between the networks
• BVirtual network peering✓
• CA DNS forwarder in each virtual network
• DA shared public IP assigned to both networks

Answer: Virtual network peering connects VNets over the Microsoft backbone with private IPs and without public internet exposure. A public load balancer, DNS forwarding and a shared public IP do not provide private inter-VNet connectivity.

Which Azure SQL security feature limits the rows returned to a user based on their identity or context?

• ATransparent data encryption
• BRow-level security✓
• CAdvanced threat protection
• DGeo-replication

Answer: Row-level security uses predicates to filter which rows a given user can see or modify, enforcing data segregation within a table. Transparent data encryption protects data at rest, advanced threat protection detects attacks, and geo-replication provides availability.

You need to force all outbound traffic from a subnet through a network virtual appliance for inspection. Which construct accomplishes this?

• AA network security group rule denying all outbound internet traffic from the subnet's address range
• BA service endpoint added to the subnet for the appliance's service
• CA private endpoint for the network appliance that is placed into the very same subnet
• DA user-defined route directing 0.0.0.0/0 to the appliance's IP as the next hop✓

Answer: A user-defined route with a default route pointing to the appliance forces traffic through it for inspection. An NSG can deny but not redirect traffic, service endpoints extend VNet identity to PaaS services, and private endpoints expose services privately rather than routing traffic.

Which storage account option provides an extra, independent layer of encryption at rest beyond the default service encryption?

• AInfrastructure encryption✓
• BHierarchical namespace
• CObject replication
• DAccess tier management

Answer: Infrastructure encryption adds a second layer of encryption at the infrastructure level, so data is encrypted twice with different keys. Hierarchical namespace enables Data Lake features, object replication copies blobs, and access tiers manage cost by data temperature.

Which is the correct way to give a VM access to only the specific management ports it needs, only when required?

• AAssign the virtual machine a public IP address and rely on strong passwords
• BEnable just-in-time VM access so ports open temporarily and only for approved requests✓
• COpen the management ports permanently in the network security group
• DPlace the VM in a subnet with no network security group applied

Answer: Just-in-time VM access, provided by Defender for Servers, keeps management ports closed and opens them briefly for approved, scoped requests. A public IP with passwords, permanently open ports and removing the NSG all expand the attack surface.

What is the purpose of Azure Private Link service compared with a private endpoint?

• APrivate Link service encrypts the consumer's data before it reaches the provider
• BPrivate Link service lets a provider expose its own service privately, which consumers reach through private endpoints✓
• CPrivate Link service replaces the need for a virtual network on either side
• DA Private Link service is used to reach Microsoft's own first-party PaaS resources, such as Azure SQL Database and Storage

Answer: Private Link service is how a service provider publishes their service behind a standard load balancer for private consumption, and consumers connect via private endpoints. It does not itself perform encryption, remove the need for VNets, or apply only to first-party services.

Which measure most directly reduces the risk of data exfiltration to an untrusted storage account from within your network?

• AEnabling geo-redundant storage replication for the in-scope storage accounts in the subscription
• BVirtual network service endpoint policies that restrict which storage accounts are reachable✓
• CSimply increasing the overall retention period configured for the storage account's own access logs
• DAssigning the Reader role to users at the storage account scope so that they cannot write data

Answer: Service endpoint policies let you allow traffic only to approved Azure Storage accounts, limiting exfiltration to arbitrary accounts. Geo-redundancy, longer log retention and Reader assignments do not constrain which external storage accounts can be reached.

A partner must connect their on-premises network to Azure with an encrypted tunnel over the internet. Which option provides this?

• AAn Azure Bastion host deployed in the hub network
• BA private endpoint published to the partner's network
• CA site-to-site VPN using an Azure VPN gateway✓
• DA network security group allowing the partner's IP range

Answer: A site-to-site VPN over an Azure VPN gateway establishes an IPsec-encrypted tunnel between on-premises and Azure across the internet. Bastion provides VM access, private endpoints expose PaaS services, and NSG rules filter but do not create a tunnel.

Which control ensures that only a specific set of trusted client certificates can establish a point-to-site VPN connection?

• ACertificate-based authentication configured on the VPN gateway✓
• BA network security group that is applied directly to the VPN gateway subnet
• CA user-defined route pointing to the VPN gateway address as the next hop for client traffic
• DA storage firewall rule allowing the VPN client addresses

Answer: Point-to-site VPNs can use certificate-based authentication so only clients with a trusted certificate connect, and Microsoft Entra authentication is another option. NSGs, UDRs and storage firewall rules do not authenticate VPN clients.

Which Defender for Databases capability extends threat protection across Azure SQL, SQL Managed Instance and open-source database services?

• AMicrosoft Defender for Databases within Defender for Cloud✓
• BAzure SQL geo-replication with automatic failover groups
• CAzure Backup with long-term retention for the databases
• DAzure Policy audit definitions for database configuration

Answer: Defender for Databases is the Defender for Cloud plan providing advanced threat protection across Azure database services, including Azure SQL and open-source options. Geo-replication and backup address availability and recovery, and Azure Policy audits configuration rather than detecting threats.

What is the security purpose of disabling the 'allow Azure services and resources to access this server' option on an Azure SQL logical server?

• AIt completely disables Microsoft Entra ID authentication for every single connection made to the server
• BIt turns off transparent data encryption for every database hosted on the logical server, including new ones
• CIt prevents the server from sending audit logs to a Log Analytics workspace
• DIt stops any Azure service from any tenant reaching the server through the shared Azure IP range✓

Answer: That option, when enabled, allows connections from the broad Azure IP space, which is not scoped to your resources; disabling it and using private endpoints or specific rules tightens access. It does not affect authentication, encryption at rest or audit log delivery.

Which combination best protects a storage account holding sensitive data, following defense in depth?

• AAnonymous container access combined with a long, complex and randomly generated storage account name so the endpoint is hard to guess
• BA single shared access signature token that is generated once and then reused by the applications indefinitely
• CPublic network access left enabled from the internet, with the Reader role assigned to each of the users on the storage account
• DEntra RBAC with shared key disabled, the storage firewall denying public access, private endpoints, and Defender for Storage✓

Answer: Layering identity-based access, network restriction, private connectivity and threat detection is defense in depth for storage. Anonymous access, a reused indefinite SAS, and public access with broad Reader all weaken protection.

Which Network Watcher tool confirms whether a specific packet would be allowed or denied between a source and destination?

• AConnection monitor
• BPacket capture
• CIP flow verify✓
• DTopology view

Answer: IP flow verify checks whether traffic on a given 5-tuple is allowed or denied by effective NSG rules and names the blocking rule. Connection monitor tracks reachability over time, packet capture records traffic, and topology visualizes resources.

To meet a requirement that database backups are protected from tampering, which option is most appropriate?

• AKeep a single local copy of each backup to minimize the attack surface
• BStore backups with immutability and restrict who can change retention or delete recovery points✓
• CShare the backup storage account key with the database administrators so restores are not delayed
• DDisable auditing on the backup data so that access to it is not recorded in the storage account logs

Answer: Immutable, access-controlled backups resist tampering and deletion, which is central to recovery from ransomware. A single local copy, widely shared keys and disabled auditing all reduce protection and traceability.