Question 650 An application has public frontend servers and private database servers in Azure. Which Zero Trust-style control reduces unnecessary lateral access? Share a single privileged password across all tiers Segment network access so only approved application paths reach the database Allow every workload to contact every database port Use only a data-copying redundancy tier Explanation Correct Answer B:Restricting east-west traffic limits the attack surface after a compromise. Incorrect Answers A:Shared credentials increase compromise impact. C:Unrestricted lateral access increases blast radius. D:Replica choice doesn't restrict network paths.
Question 651 An administrator's identity is compromised but has Reader on one group rather than Owner everywhere. Which design principle reduced potential impact? Storage geo replication An unrestricted shared admin account Least privilege and restricted scope Set a visible tag named Reader but retain an Owner role assignment Explanation Correct Answer C:Limited permissions constrain operations available to a compromised principal. Incorrect Answers A:Replica placement doesn't change what an identity can do. B:That would amplify impact rather than reduce it. D:A tag does not limit effective permissions or reduce an account's possible management operations.
Question 652 An organization has preventive controls but no security alerts or audit records. Which defense-in-depth capability is lacking? Monitoring, detection and response evidence A second public IP with unrestricted access An additional VM name prefix Only a larger backup disk Explanation Correct Answer A:Layered security includes the ability to notice and investigate suspicious activity. Incorrect Answers B:Extra exposure doesn't provide detection. C:Naming isn't security monitoring. D:Storage capacity isn't incident visibility.
Question 653 A team puts an application behind a firewall but leaves its API publicly accessible with hardcoded admin credentials. What is the most important correction? Protect application identity and secrets alongside network controls Move to a larger VM Assume the firewall inspects and fixes every source-code vulnerability Add a billing tag named Secure Explanation Correct Answer A:A perimeter alone cannot compensate for exposed credentials or missing authorization. Incorrect Answers B:Compute capacity doesn't remove a credential leak. C:Network controls don't rewrite applications. D:Metadata can't revoke an exposed password.
Question 654 A cloud governance team needs a high-level view of recommended security posture improvements over time. Which Defender for Cloud concept is relevant? Storage account access-tier history Secure score and associated security recommendations A VM availability set update domain number Treat a single VM's current CPU utilization as the tenant's secure score Explanation Correct Answer B:Posture indicators prioritize and track assessed security controls. Incorrect Answers A:Blob tier changes aren't an aggregate security posture measure. C:Compute placement doesn't measure overall policy posture. D:Performance utilization is different from supported security-control assessments and posture scoring.
Question 655 Security analysts expect Defender for Cloud to catch every malicious act across all SaaS vendors without enabling any integrations. What should they recognize? Security coverage depends on supported plans, workloads, configuration and integrated data sources Every custom application is automatically free of vulnerabilities An Azure subscription automatically monitors every third-party service globally Using a region pair guarantees complete threat detection Explanation Correct Answer A:A security platform doesn't provide universal detection without coverage and signals. Incorrect Answers B:Cloud hosting doesn't certify custom code. C:Subscriptions don't give unbounded telemetry from other providers. D:Resilience placement isn't incident detection.
Question 656 A security engineer wants to investigate suspicious access and threats to supported Azure workloads. Which Defender for Cloud feature can provide relevant evidence? Cost budget forecasts Security alerts from enabled workload protection capabilities Resource group name history Review only Azure Cost Management budget alerts for suspected threats Explanation Correct Answer B:Alerts can highlight detected suspicious behavior on covered resources. Incorrect Answers A:Forecasts do not identify attack activity. C:Administrative names cannot reveal suspicious runtime behavior. D:Spending alerts do not replace the security alerts and threat-detection findings from Defender for Cloud.
Question 657 A compliance lead wants a view of how assessed cloud resources align with configured standards. Which Defender for Cloud capability is relevant? Azure Pricing Calculator Azure File Sync cloud tiering Regulatory compliance dashboard where supported A VM load balancer health probe Explanation Correct Answer C:The dashboard maps evaluated recommendations to selected compliance controls. Incorrect Answers A:Pricing estimates aren't control assessments. B:Tiering caches files and does not report security control compliance. D:Health probes test endpoints, not entire compliance frameworks.
Question 658 A dashboard reports insecure resource settings, and management assumes detection automatically fixes every finding. Which statement is accurate? Every Defender recommendation is applied to all workloads without authorization A subscription can only contain resources with perfect secure score Teams must review and implement supported remediations according to policy Security findings mean data is already irretrievably lost Explanation Correct Answer C:Recommendations do not guarantee automatic correction of all configuration risks. Incorrect Answers A:Changes need configured automation and permissions. B:Secure score is an assessment metric, not a universal deployment lock. D:Misconfiguration findings don't always imply compromise.
Question 659 An administrator asks whether Defender for Cloud replaces the need to configure Azure Policy. What distinction is important? Defender evaluates and recommends security controls, while Azure Policy can audit/enforce resource rules Defender for Cloud is merely a VM backup tool Azure Policy only stores firewall packet captures Treat a posture recommendation as though it were automatically an enforced Azure Policy deny Explanation Correct Answer A:Posture and governance controls complement each other. Incorrect Answers B:It offers posture and workload protection features. C:Policy isn't packet capture software. D:Defender recommendations and Azure Policy effects can integrate, but advice and enforcement are not identical operations.
Question 660 Security staff see a recommendation that a VM should restrict public ports, but no active attack alert. What can they conclude? Every risky setting proves an attacker has logged in A policy compliance flag changes the VM's public IP to private immediately Posture findings identify configuration exposure, not necessarily a detected active intrusion No alert means the open port is automatically safe Explanation Correct Answer C:Misconfiguration risk and observed malicious behavior are different signals. Incorrect Answers A:Exposure alone is not incident evidence. B:Assessment findings don't automatically rewrite network endpoints. D:Threat visibility isn't proof of risk absence.
