Questions 31-60 Flashcards
Your company has an Azure subscription that uses Azure Storage.
The company plans to share specific blobs with vendors.
You need to recommend a solution to provide the vendors with secure access to specific blobs without exposing the blobs publicly. The access must be time-limited.
What should you include in the recommendation?
A. Configure private link connections. B. Configure encryption by using customer-managed keys (CMKs). C. Share the connection string of the access key. D. Create shared access signatures (SAS).
D. Create shared access signatures (SAS).
You are designing security for an Azure landing zone.
Your company identifies the following compliance and privacy requirements:
✑ Encrypt cardholder data by using encryption keys managed by the company.
✑ Encrypt insurance claim files by using encryption keys hosted on-premises.
Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Store the cardholder data in an Azure SQL database that is encrypted by using Microsoft-managed keys. B. Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys. C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM. D. Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.
C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.
D. Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.
You are a security architect for a company with Microsoft Azure and Microsoft 365 subscriptions and you recently had a ransomware attack.
After reviewing with the team, you found that while information was available to help remediate the attack, the information was not centrally contextualized for the security incident, slowing down the remediate action.
Which tools can provide a central console to detect, investigate, remediate, hunt, and utilize threat intelligence and contextualize a security incident?
A. Microsoft Sentinel B. Microsoft Defender for Cloud C. Microsoft 365 Defender D. Defender for Endpoint
A. Microsoft Sentinel
You are a security analyst in an organization. The chief compliance officer has tasked you to ensure that all new Azure core services are HIPAA compliant.
What operation compliance Azure solution can you use to automate the deployment compliance for Azure core services?
A. Azure Policy B. Azure Blueprints C. Desired State Configuration D. Azure Automation Update Management
B. Azure Blueprints
HOTSPOT -
You are designing security for a runbook in an Azure Automation account. The runbook will copy data to Azure Data Lake Storage Gen2.
You need to recommend a solution to secure the components of the copy process.
What should you include in the recommendation for each component? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer Area
Data security:
* Access keys stored in Azure Key Vault
* Automation Contributor built-in role
* Azure Private Link with network service tags
* Azure Web Application Firewall rules with network service tags
Network access control:
* Access keys stored in Azure Key Vault
* Automation Contributor built-in role
* Azure Private Link with network service tags
* Azure Web Application Firewall rules with network service tags
Data security: Access keys stored in Azure Key Vault
Network access control: Azure Private Link with network service tags
You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)
Security alert
MicroBurst exploitation toolkit used to extract keys to your storage accounts (Preview)
…
After remediating the threat, which policy definition should you assign to prevent the threat from reoccurring?
A. Storage account public access should be disallowed B. Azure Key Vault Managed HSM should have purge protection enabled C. Storage accounts should prevent shared key access D. Storage account keys should not be expired
A. Storage account public access should be disallowed
Your company plans to provision blob storage by using an Azure Storage account. The blob storage will be accessible from 20 application servers on the internet.
You need to recommend a solution to ensure that only the application servers can access the storage account.
What should you recommend using to secure the blob storage?
A. managed rule sets in Azure Web Application Firewall (WAF) policies B. inbound rules in network security groups (NSGs) C. firewall rules for the storage account D. inbound rules in Azure Firewall E. service tags in network security groups (NSGs)
C. firewall rules for the storage account
Your company is preparing for cloud adoption.
You are designing security for Azure landing zones.
Which two preventative controls can you implement to increase the secure score?
Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. Azure Web Application Firewall (WAF) B. Azure Active Directory (Azure AD) Privileged Identity Management (PIM) C. Microsoft Sentinel D. Azure Firewall E. Microsoft Defender for Cloud alerts
A. Azure Web Application Firewall (WAF)
D. Azure Firewall
HOTSPOT -
Your company uses Microsoft Defender for Cloud and Microsoft Sentinel.
The company is designing an application that will have the architecture shown in the following exhibit.
Clients–>Azure Application Gateway with Web Application Firewall–>Azure Firewall Premium–>Azure Virtual Machines
You are designing a logging and auditing solution for the proposed architecture. The solution must meet the following requirements:
✑ Integrate Azure Web Application Firewall (WAF) logs with Microsoft Sentinel.
✑ Use Defender for Cloud to review alerts from the virtual machines.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer Area
For WAF:
* The Azure Diagnostics extension
* Azure Network Watcher
* Data connectors
* Workflow automation
For the virtual machines:
* The Azure Diagnostics extension
* Azure Storage Analytics
* Data connectors
* The Log Analytics agent
* Workflow automation
For WAF: Data connectors
For the virtual machines: The Log Analytics agent
Your company plans to deploy several Azure App Service web apps. The web apps will be deployed to the West Europe Azure region. The web apps will be accessed only by customers in Europe and the United States.
You need to recommend a solution to prevent malicious bots from scanning the web apps for vulnerabilities. The solution must minimize the attack surface.
What should you include in the recommendation?
A. Azure Firewall Premium B. Azure Traffic Manager and application security groups C. Azure Application Gateway Web Application Firewall (WAF) D. network security groups (NSGs)
C. Azure Application Gateway Web Application Firewall (WAF)
Your company is designing an application architecture for Azure App Service Environment (ASE) web apps as shown in the exhibit. (Click the Exhibit tab.)
on-premise app server with public IP<–on-premise firewall
user—public internet–> Azure subscription[Resource group] [X]– subnet01 (–>appAPI01–>appAPI02)
Communication between the on-premises network and Azure uses an ExpressRoute connection.
You need to recommend a solution to ensure that the web apps can communicate with the on-premises application server. The solution must minimize the number of public IP addresses that are allowed to access the on-premises network.
What should you include in the recommendation?
A. Azure Traffic Manager with priority traffic-routing methods B. Azure Firewall with policy rule sets C. Azure Front Door with Azure Web Application Firewall (WAF) D. Azure Application Gateway v2 with user-defined routes (UDRs)
B. Azure Firewall with policy rule sets
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing the encryption standards for data at rest for an Azure resource.
You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.
Solution: For blob containers in Azure Storage, you recommend encryption that uses Microsoft-managed keys within an encryption scope.
Does this meet the goal?
A. Yes B. No
B. No
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing the encryption standards for data at rest for an Azure resource.
You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.
Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses Microsoft-managed keys.
Does this meet the goal?
A. Yes B. No
B. No
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing the encryption standards for data at rest for an Azure resource.
You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.
Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs).
Does this meet the goal?
A. Yes B. No
A. Yes
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing the encryption standards for data at rest for an Azure resource.
You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.
Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses customer-managed keys (CMKs).
Does this meet the goal?
A. Yes B. No
A. Yes
