Unit 3: Secure Compute and Storage - Practice Quiz

1 What is the primary purpose of Azure Bastion?

2 Which feature is generally not required on a virtual machine when it is accessed through Azure Bastion?

3 Which specially named subnet is used to deploy Azure Bastion?

4 What is the main purpose of Just-in-Time virtual machine access?

5 Which management ports are commonly protected by Just-in-Time virtual machine access?

6 What happens after an approved Just-in-Time access period expires?

7 What is Azure Kubernetes Service (AKS) primarily used for?

8 In AKS, what is a pod?

9 Which component does Azure manage in a standard AKS cluster?

10 Which Azure service provides a logically isolated network for cloud resources?

11 What is the primary function of a Network Security Group (NSG)?

12 What does an Azure private endpoint provide?

13 Which Azure service collects and analyzes metrics and logs from Azure resources?

14 What is a metric in Azure Monitor?

15 What is the purpose of an Azure Monitor alert?

16 Which Azure service provides cloud-based identity and authentication?

17 What does multi-factor authentication require?

18 What is a key benefit of using a managed identity for an Azure resource?

19 What is Azure Container Registry primarily used to store?

20 Which Azure CLI command is used to sign in to an Azure Container Registry?

21 A company needs administrators to connect to Azure virtual machines without assigning public IP addresses to those machines. Which solution best meets this requirement?

22 An administrator wants to use Azure Bastion to connect to a virtual machine in a virtual network. Which subnet configuration is required for Bastion?

23 A security team wants to reduce exposure from administrative protocols while still allowing support staff to connect to virtual machines from a web browser. Which Bastion capability is most relevant?

24 A virtual machine normally receives no inbound management traffic, but administrators occasionally need SSH access. Which Just-in-Time configuration is most appropriate?

25 A Just-in-Time request opens TCP port 3389 for two hours from an administrator's public IP address. What happens when the approved period ends?

26 A security engineer wants to use Just-in-Time VM access, but inbound rules are managed by a network security group. What should the engineer verify first?

27 An organization wants Azure to manage the Kubernetes control plane while its team focuses on deploying applications and configuring worker nodes. Which service should it use?

28 A company needs pods in an AKS cluster to access a database hosted in a protected Azure virtual network. Which design best supports this requirement?

29 An AKS application must access Azure Storage without storing a long-lived storage key in a container image. Which approach is most appropriate?

30 A three-tier application contains web, application, and database virtual machines. Which network isolation design best limits lateral movement?

31 A database should be reachable from an application subnet but not from the public internet. Which Azure design is most suitable?

32 A workload must connect to an Azure service using an address that remains within the organization's virtual network. Which feature should be considered?

33 A platform team needs to determine whether increased response times are caused by an application dependency or by the application itself. Which Azure Monitor capability is most useful?

34 An operations team wants an alert whenever a virtual machine's average CPU usage exceeds 80 percent for five minutes. Which Azure Monitor feature should it configure?

35 Security analysts need to query sign-in events and administrative activity across multiple Azure resources. Which destination is best suited for this analysis?

36 A company wants employees to use one identity for Azure resources and several SaaS applications, with centralized sign-in controls. Which service should it use?

37 An administrator wants to require a second verification method when users sign in from an unfamiliar location. Which control addresses this requirement?

38 An application running on an Azure virtual machine must read secrets from Key Vault without storing credentials in its configuration files. Which approach is preferred?

39 A deployment pipeline must push container images to Azure Container Registry without using an administrator account. Which option provides the most appropriate access model?

40 A team wants an AKS cluster to pull private images from Azure Container Registry without placing registry credentials in Kubernetes manifests. What should the team configure?

41 A company deploys Azure Bastion in a hub virtual network. Virtual machines reside in peered spoke virtual networks and have no public IP addresses. Administrators can open Bastion sessions to hub VMs but not to spoke VMs. Which configuration should be verified first?

42 An NSG protects a target VM subnet. Administrators reach the VMs only through Azure Bastion, and direct RDP or SSH from all other sources must be blocked. Which inbound rule most precisely permits the required traffic?

43 Security policy requires administrators to use their local SSH clients while Azure Bastion transports the connection to private Linux VMs. The team also needs Bastion session recording. Which design satisfies both requirements?

44 A VM protected by an NSG has Just-in-Time access configured for TCP 3389. An approved request is made for one administrator's public IP address for two hours. What change should the administrator expect?

45 A VM's effective route sends Internet-bound traffic through Azure Firewall, and no NSG is associated with its NIC or subnet. The VM is configured for JIT access. Which control must JIT be able to modify to grant an approved SSH request?

46 A security engineer enables JIT on TCP 22 with a three-hour maximum duration. A developer requests access from 203.0.113.20/32 for four hours, but the request is rejected before any rule is created. Which change addresses the rejection without broadening source access?

47 Pods in AKS must access Azure Key Vault without Kubernetes secrets, without node-level identity permissions, and without the deprecated pod-managed identity mechanism. Which configuration best meets the requirement?

48 An AKS private cluster resolves its API server name correctly from the hub network, but administrators on-premises cannot connect over ExpressRoute. Network security rules allow TCP 443. Which missing element is the most likely cause?

49 An AKS cluster enforces a default-deny egress network policy. Application pods must retrieve images from ACR during startup, so the team adds an egress rule to the application pods. Image pulls still fail. Why?

50 A deployment has 10 replicas, maxUnavailable: 0, and maxSurge: 20%. During a rolling update, what is the maximum number of pods that may exist simultaneously for this deployment?

51 A storage account disables public network access and exposes a private endpoint in a spoke virtual network. Clients in a peered hub resolve the account name to its public IP and fail to connect. Routing between the networks works. What is the most direct fix?

52 Two private endpoints for the same Key Vault are created in separate virtual networks. A central private DNS zone is linked to both networks and contains records for both endpoint IPs. Clients must always use the endpoint local to their own network. Which design is most reliable?

53 A subnet uses a Storage service endpoint, and a storage firewall allows that subnet. Security now requires the storage account to have a private IP in the virtual network and to reject every public-endpoint path. What must change?

54 Azure Activity Log entries are visible for only the platform's standard retention period, but an auditor requires queryable records for three years. Which configuration is appropriate?

55 Azure Monitor Agent is installed on a VM, but a custom application log is not arriving in Log Analytics. Heartbeats from the VM are present. Which configuration should be inspected first?

56 An alert must fire when more than five distinct AKS nodes stop sending heartbeats during a ten-minute window. Which Azure Monitor design most directly expresses this requirement?

57 An Azure VM application must call Azure Resource Manager without storing credentials. The VM may be deleted and recreated, but the application's Azure identity and role assignments must remain unchanged. Which identity should be used?

58 A workload uses a managed identity to request a token for Azure Storage successfully, but Blob data access returns HTTP 403. The identity has the Contributor role on the storage account. What is the most likely correction?

59 An AKS cluster uses its kubelet managed identity to pull images from a private Azure Container Registry. The registry disables local admin credentials, and image pulls return 401 Unauthorized. Network connectivity is confirmed. Which action is required?

60 A security team enables a private endpoint for Azure Container Registry and disables public network access. Clients resolve myregistry.azurecr.io privately, but image layer downloads fail because the registry's data endpoint resolves publicly. What DNS configuration is missing?