Question 630 A team protects a database subnet with an NSG but stores sensitive backups without access controls. What defense-in-depth layer is missing? Only another VM fault domain Appropriate data protection and authorization for the backups Treat public endpoint firewall rules as a substitute for encryption of stored sensitive data More CPU for the application server Explanation Correct Answer B:Network filtering on the database VM does not secure all copies of the data. Incorrect Answers A:Availability placement doesn't control backup readers. C:Network controls limit traffic; encryption protects data confidentiality at rest when properly configured. D:Performance is not data confidentiality.
Question 631 A company wants cloud security recommendations and configuration posture visibility across Azure resources. Which Microsoft service is relevant? Assume an Entra group name by itself produces full cloud security posture assessment Azure Storage Explorer Azure Pricing Calculator Microsoft Defender for Cloud Explanation Correct Answer D:Defender for Cloud provides security posture and workload protection capabilities. Incorrect Answers A:Group naming is not Microsoft Defender for Cloud's resource security recommendations and posture evaluation. B:A storage desktop client isn't a cloud security posture dashboard. C:Cost estimates aren't a security assessment.
Question 632 A security team sees recommendations for overly exposed VMs and wants to prioritize remediation. Which Defender for Cloud capability is most relevant? Security posture recommendations and findings for assessed resources Use a VM tag labeled Secure instead of remediating documented posture findings An Azure subscription invoice Automatic rewrite of every custom application bug without review Explanation Correct Answer A:Posture analysis can identify risky configurations to investigate and fix. Incorrect Answers B:A tag is not evidence that the underlying cloud configuration meets the recommended controls. C:Billing isn't a security finding register. D:The platform doesn't universally repair arbitrary app code.
Question 633 An organization wants security visibility for both Azure and supported non-Azure workloads. What must it evaluate in Defender for Cloud? Supported multicloud/hybrid coverage and appropriate connectors or plans Assume every on-premises device is scanned automatically without onboarding Use an Azure region pair as a security scanner Remove all IAM policies before onboarding Explanation Correct Answer A:Coverage depends on enabled capabilities and integration scope. Incorrect Answers B:Connection and supported configuration are needed. C:Regional topology isn't a workload security agent. D:Broad removal increases exposure and doesn't enable inventory.
Question 634 A finance officer assumes every advanced Defender for Cloud workload-protection plan is free once an Azure subscription exists. What should be checked? Only the VM's resource group name Assume the Defender for Cloud plan has identical charges and feature coverage for all protected resource types Assume Microsoft Defender for Cloud charges are completely covered by the VM operating-system license Enabled plans, licensing and billing scope for the relevant workloads Explanation Correct Answer D:Advanced protection options may add charges beyond baseline posture capabilities. Incorrect Answers A:Names don't define paid plan scope. B:Pricing and available protection capabilities can vary by plan, scope and workload. C:Workload security plan pricing and feature entitlement are not determined solely by the guest OS license.
Question 635 A company owns three Azure subscriptions but uses one workforce directory for sign-ins across all three. Which statement is accurate? One tenant is exactly the same resource as one resource group A VNet peering connection creates the identity tenant Multiple subscriptions can be associated with the same Microsoft Entra tenant Every subscription must contain a different Entra tenant Explanation Correct Answer C:Billing/resource boundaries can share a central identity directory. Incorrect Answers A:Identity and resource organization have different scopes. B:Networking doesn't provision directories. D:Subscription count does not require one directory per subscription.
Question 636 A partner receives an Entra B2B guest invitation but cannot access a protected application until onboarding and assignment are complete. What should be checked? Only whether storage redundancy is GRS Whether the partner's email contains the tenant name Invitation redemption, app entitlement and applicable access policies Only whether the resource group is in a region pair Explanation Correct Answer C:An invited identity still needs the supported onboarding and authorization path. Incorrect Answers A:Data replicas don't grant app permissions. B:Name resemblance isn't authorization. D:Regional topology doesn't assign application roles.
Question 637 A field engineer signs into a corporate app from an unmanaged mobile device and faces a security challenge. Which Entra capability could be enforcing that policy? Azure Blob lifecycle policy Conditional Access evaluating device context and authentication requirements A VM availability set reacting to the sign-in Use only a private IP allowlist and ignore user/device sign-in conditions Explanation Correct Answer B:CA can treat unmanaged device sign-ins differently from compliant device access. Incorrect Answers A:Object retention can't challenge mobile sign-ins. C:Compute placement doesn't evaluate user devices. D:Network location alone does not replace appropriate Conditional Access identity and device evaluation.
Question 638 A security team wants to understand the impact of proposed Conditional Access changes before enforcing them broadly. What supported policy approach can help? Evaluate policies in report-only mode where supported Assign all users permanent Global Administrator Disable every sign-in log to avoid noise Enforce a new policy immediately without testing its effect on intended users Explanation Correct Answer A:A report-only evaluation can show potential effects without fully enforcing controls. Incorrect Answers B:Broad privilege doesn't test conditional rules. C:Lack of evidence prevents impact assessment. D:Report-only evaluation can reveal impact before enforcement; skipping that stage can lock out valid workflows.
Question 639 An analyst authenticates to an enterprise SaaS app but gets an access-denied message inside the app. What is a plausible missing step? Give every user subscription Owner rather than assign app-specific permissions Increase the app VM's disk size Give the user subscription Owner immediately Assign the user or group the appropriate application access or role Explanation Correct Answer D:Authentication may succeed while application-specific permissions are missing. Incorrect Answers A:Broad Azure management roles do not express appropriate application-level authorization for a user's task. B:Storage capacity doesn't grant application authorization. C:Azure resource management roles may be unrelated to the SaaS entitlement.
Question 640 A security team sees many unexpected authenticator push requests to an employee. What action is appropriate? Approve all prompts to stop notifications Treat unsolicited approvals as suspicious and investigate or block sign-in attempts Disable every sign-in log to avoid noise Publish the user's password for testing Explanation Correct Answer B:Unexpected prompts can indicate an attacker is trying to use a known password. Incorrect Answers A:Approving an attacker's request can compromise the account. C:Removing evidence harms investigation. D:Exposure would create additional credential risk.
