Unit 4: Manage Security Operation - Practice Quiz

1 What is the main purpose of a security policy?

2 Which Azure service can evaluate resources against organizational security rules?

3 What is Azure Blueprints primarily used to create?

4 Which item can be included as an artifact in an Azure blueprint?

5 Which Azure resource filters inbound and outbound traffic for network interfaces and subnets?

6 Which Azure service provides managed network firewall protection?

7 What type of information is commonly stored in Azure Key Vault?

8 What is a secret in Azure Key Vault?

9 Which practice reduces the need to place passwords directly in application code?

10 What is the main purpose of a Hardware Security Module?

11 What does the abbreviation HSM stand for?

12 What does Azure RBAC control?

13 Which Azure built-in role can manage resources but cannot assign roles to other users?

14 Which Azure built-in role provides view-only access to resources?

15 What is a digital certificate commonly used to verify?

16 Which Azure service can securely store and manage certificates?

17 What is the primary purpose of Azure Backup?

18 What is a recovery point?

19 Which Azure resource stores backup data and recovery points for protected virtual machines?

20 What must be selected when configuring an Azure virtual machine backup?

21 An organization requires every newly created Azure Storage account to disable public blob access. Which control should an administrator use to enforce this requirement across a management group?

22 A policy assignment reports that several existing virtual machines are non-compliant because a required monitoring extension is missing. Which policy effect can automatically deploy the extension?

23 A cloud governance team wants to package policy assignments, RBAC assignments, resource groups, and ARM templates as one repeatable environment definition. Which Azure Blueprint concept supports this?

24 A blueprint definition has been assigned to a subscription. The team later publishes a new version with an additional security policy. What must be done to apply that version to the subscription?

25 A web application is deployed in a virtual network with separate web and database subnets. The database must accept SQL traffic only from the web subnet. Which configuration best meets the requirement?

26 Administrators need to connect to Azure virtual machines through RDP and SSH without assigning public IP addresses to those machines. Which service should they deploy?

27 An Azure application must retrieve a database password from Key Vault without storing credentials in its source code or configuration files. Which approach is most appropriate?

28 A Key Vault secret was deleted accidentally, and the security team must be able to restore it during the configured retention period. Which Key Vault feature provides this capability?

29 A security team must ensure that a deleted Key Vault object cannot be permanently removed before its retention period ends. Which protection should be enabled?

30 A financial application requires cryptographic keys to remain protected by dedicated, validated hardware and needs control over an isolated HSM pool. Which Azure service is the best fit?

31 An application uses an HSM-backed key to sign data in Azure. Which statement correctly describes the private key?

32 A support engineer must restart virtual machines but must not create, delete, or resize them. What is the best way to grant this access?

33 A user receives the Reader role at the subscription scope and the Contributor role on one resource group. What access does the user have in that resource group?

34 A team needs permission to manage resources in one resource group, but members must not grant access to other users. Which built-in role is most suitable?

35 A TLS certificate stored in Azure Key Vault is approaching expiration. The operations team wants to receive advance notifications. Which configuration should it use?

36 A new version of a certificate is created in Azure Key Vault after renewal. An application references the certificate using a versionless identifier. What is the main benefit?

37 A company wants to define how often Azure virtual machines are backed up and how long daily recovery points are retained. Where should these settings be configured?

38 An organization must restore Azure virtual machines after a regional outage. Which design most directly improves the geographic resilience of backup data?

39 An administrator is configuring backup for an Azure virtual machine. Which sequence is appropriate?

40 An administrator enabled backup for a virtual machine but needs a recovery point immediately instead of waiting for the scheduled job. What should the administrator do?

41 An Azure Policy definition uses the DeployIfNotExists effect to install diagnostic settings. After assignment, hundreds of existing resources remain noncompliant and no settings are deployed. What action is required?

42 A production subscription must remain within a policy assignment's scope, but one legacy resource needs a temporary exception that is visible in compliance reports. Which mechanism should be used?

43 A custom policy with the Deny effect is assigned to an existing subscription containing noncompliant storage accounts. What is the immediate result?

44 A blueprint assignment uses the Read Only locking mode for its deployed artifacts. A subscription Owner attempts to modify one of those resources and receives an authorization failure. Why?

45 Version 1 of a published blueprint is assigned to 20 subscriptions. Version 2 is later published with a stricter policy artifact. How are the existing assignments affected?

46 Two spoke virtual networks must communicate only through an Azure Firewall in a hub. Peering exists, but traffic bypasses or fails to reach the firewall. Which configuration is essential?

47 A Standard Load Balancer's backend VMs fail health probes after an administrator adds an inbound NSG rule at priority 200 denying all traffic. What is the least-permissive correction?

48 A user has the Contributor role on a Key Vault configured to use Azure RBAC. The user can change vault networking but cannot read secrets. Which additional role provides the least required access?

49 Purge protection is enabled with a 90-day retention period. An administrator deletes a key and immediately attempts to purge it using an account with purge permissions. What occurs?

50 A Key Vault has public network access disabled and a private endpoint in a virtual network. Applications in that network still resolve the vault name to its public IP. What should be configured?

51 An organization requires a dedicated, single-tenant HSM pool with administrative isolation from Microsoft and support for HSM-protected cryptographic operations. Which service best meets the requirement?

52 During Managed HSM initialization, security-domain recovery keys are distributed among several officers using a quorum model. What is the main consequence if fewer than the required quorum shares remain available?

53 A management-group deny assignment blocks deletion of network resources. A user with the Owner role at the subscription level attempts to delete a virtual network. What is the expected authorization result?

54 A custom role must let operators start virtual machines but must not let them read Key Vault secrets. Where should the VM start operation be declared?

55 A certificate is created in Azure Key Vault. An application must download the certificate together with its private key in PFX form. Which associated Key Vault object should it retrieve?

56 Azure Key Vault automatically renews a TLS certificate used by Application Gateway, but the gateway continues presenting the old certificate. The listener references a version-specific secret identifier. What is the best correction?

57 An organization must restore Azure VM backups in the Azure paired region after a regional outage. Which vault configuration is required?

58 A recent VM recovery point restores much faster than an older recovery point from the same Recovery Services vault. Which design most directly explains the difference?

59 A team creates a Recovery Services vault in West Europe and attempts to protect an Azure VM in North Europe. Both resources are in the same subscription. What must be changed?

60 A VM is protected by vault A. Administrators stop backup but retain all recovery points, then attempt to protect the same VM with vault B. Why does registration with vault B fail?