Question 140 A cloud customer is concerned about unauthorized entry to Azure facilities. Which layer of security is principally owned by Azure? Customer-managed administrative passwords Source code authorization checks Datacenter physical access controls Application-specific payroll permissions Explanation Correct Answer C:The provider protects its buildings and physical infrastructure. Incorrect Answers A:Credential control remains a tenant responsibility. B:The application owner implements its own authorization rules. D:The organization must grant users access based on business roles.
Question 141 An enterprise migrates to Azure and keeps thousands of employees. Which ongoing customer control remains essential despite provider infrastructure security? Servicing the region's power generators Replacing physical disks in Microsoft datacenters Managing identities, privileges and access policies Give every employee full Azure subscription Owner access to avoid authentication issues Explanation Correct Answer C:Secure facilities do not decide whether each employee should read confidential workloads. Incorrect Answers A:Power infrastructure is not operated by the tenant. B:The provider maintains its hardware. D:Broad administration rights defeat the required customer management of least-privilege identity and access controls.
Question 142 A business selects a managed cloud storage service and assumes it no longer needs to review sensitive data access. Which distinction matters? Datacenter guards decide employee file-level authorization Encryption makes access permissions unnecessary Provider encryption and customer access governance are separate controls A larger storage tier grants correct user roles Explanation Correct Answer C:Encryption at rest does not automatically authorize the right users or detect misuse. Incorrect Answers A:Business data access remains tenant-controlled. B:An authorized but inappropriate identity can still misuse data. D:Capacity or tier choice is not identity policy.
Question 143 An application owner opens inbound access from every IP address to simplify testing. What security responsibility does it retain? Maintaining the cloud datacenter perimeter fences Selecting appropriate network exposure and access rules Upgrading provider hypervisor firmware Setting the facility fire suppression system Explanation Correct Answer B:The tenant controls its virtual resources and should restrict unneeded ingress. Incorrect Answers A:That is physical provider security. C:Host maintenance is not the tenant's virtual network configuration. D:Fire safety equipment is not an application firewall policy.
Question 144 A company operates in a regulated sector and moves a database to Azure. Which governance practice remains necessary? Assume every region supports every required certification identically Map applicable obligations to configured controls and evidence Treat cloud adoption as exemption from all regulation Disable logs because the provider hosts hardware Explanation Correct Answer B:Provider compliance attestations do not replace tenant-specific risk assessment and implementation. Incorrect Answers A:Coverage can vary by service and geography. C:Legal duties still apply. D:Audit evidence can be a tenant obligation.
Question 145 A user is already connected to the corporate network and requests sensitive data. Which principle best supports secure cloud access? Automatically trust all internal network requests Explicitly verify identity, context and least privilege for the request Disable multifactor authentication for all employees Share privileged accounts to reduce login friction Explanation Correct Answer B:Network location alone should not confer broad trust. Incorrect Answers A:Internal origin does not establish authorization. C:Removing an identity layer expands risk. D:Shared credentials weaken accountability.
Question 146 A company wants departments to identify their cloud resources by owner and cost center. What governance benefit does consistent tagging provide? Guaranteed application high availability An unlimited monthly credit for every tagged resource Automatic encryption of every attached disk Organized metadata for reporting and resource management Explanation Correct Answer D:Tags help categorize resources for cost and operational views, although they do not enforce all policy by themselves. Incorrect Answers A:Labels cannot create redundant runtime instances. B:Tags do not waive consumed service charges. C:Tag metadata is not an encryption control.
Question 147 A platform team wants to prevent unapproved regions or resource configurations from being deployed. Which class of control is needed? Enforced governance policy evaluated against deployments Only a style guide in a shared email A second availability zone without access policy A fixed resource-group display name Explanation Correct Answer A:Policy controls can audit or restrict resources according to organizational rules. Incorrect Answers B:Guidance is not an enforced deployment restriction. C:Fault isolation does not establish configuration governance. D:Naming by itself does not block noncompliant locations.
Question 148 Multiple teams need the same security baseline when provisioning new workloads. What cloud-management advantage is useful? Require each developer to invent unrelated security controls Disable resource inventory to reduce clutter Centralized governance and repeatable deployment standards Use the largest available VM as the universal security control Explanation Correct Answer C:Policies and automation reduce variation compared with each team applying manual rules. Incorrect Answers A:Ad hoc baselines create inconsistency. B:Without inventory, standardization is harder. D:Capacity is not a security baseline.
Question 149 An organization must demonstrate which Azure resources exist and how they are configured. What operational benefit helps? Store the only evidence on a developer's laptop Delete all configuration history after every deployment Assume every resource is compliant merely because it is hosted Centralized inventory, policy evaluation and audit reporting Explanation Correct Answer D:Managed tooling makes compliance evidence easier to collect across resources. Incorrect Answers A:Local-only records are fragile and incomplete. B:Removing history harms accountability. C:Cloud hosting alone does not prove tenant policy compliance.
Question 150 A company deploys the same development environment repeatedly. What cloud manageability practice reduces manual inconsistency? Infrastructure as code with reusable declarative definitions Manually click through arbitrary settings for every rebuild Copy screenshots of configuration into a slide deck Rely on VM display names instead of deployment settings Explanation Correct Answer A:Versioned templates reproduce intended resource configurations. Incorrect Answers B:Repeated manual setup creates drift. C:Screenshots do not provision infrastructure. D:Labels cannot recreate dependencies and configurations.
