Azure Security – Protecting Microsoft Cloud Services – MCQ Questions

1. What is the primary purpose of Azure Security Center?

A) Managing Azure subscriptions
B) Providing compliance reports
C) Enhancing security posture and threat protection
D) Automating deployments

✅ Answer: C) Enhancing security posture and threat protection
Explanation: Azure Security Center provides a centralized view of security alerts, recommendations, and continuous security monitoring to protect workloads running in Azure.

---

2. Which feature in Azure helps in preventing Distributed Denial of Service (DDoS) attacks?

A) Azure Firewall
B) Azure DDoS Protection
C) Azure Security Groups
D) Azure Key Vault

✅ Answer: B) Azure DDoS Protection
Explanation: Azure DDoS Protection safeguards against volumetric, protocol, and application-layer DDoS attacks by automatically detecting and mitigating threats.

---

3. How does Azure Key Vault improve security?

A) By managing secrets, keys, and certificates securely
B) By providing network monitoring
C) By encrypting all Azure storage by default
D) By replacing firewalls in Azure Virtual Networks

✅ Answer: A) By managing secrets, keys, and certificates securely
Explanation: Azure Key Vault helps securely store and manage cryptographic keys, secrets, and certificates, reducing the risk of data leaks.

---

4. What is the main advantage of using Microsoft Defender for Cloud?

A) Automates Azure resource deployments
B) Enhances security posture and threat protection across Azure, hybrid, and multi-cloud environments
C) Reduces Azure billing costs
D) Improves networking capabilities

✅ Answer: B) Enhances security posture and threat protection across Azure, hybrid, and multi-cloud environments
Explanation: Microsoft Defender for Cloud provides security recommendations, detects threats, and ensures compliance across cloud resources.

---

5. Which of the following is used for Identity and Access Management (IAM) in Azure?

A) Azure Active Directory (Azure AD)
B) Azure Monitor
C) Azure Security Center
D) Azure Storage Account

✅ Answer: A) Azure Active Directory (Azure AD)
Explanation: Azure AD provides authentication and authorization for users and applications in Azure.

---

6. How does Azure Firewall help in securing cloud workloads?

A) By blocking all outbound traffic
B) By providing network filtering, threat intelligence, and logging capabilities
C) By managing storage accounts securely
D) By encrypting all data automatically

✅ Answer: B) By providing network filtering, threat intelligence, and logging capabilities
Explanation: Azure Firewall is a managed network security service that protects Azure Virtual Networks with advanced security features.

---

7. What is the role of Azure Policy in security?

A) It enforces security compliance and governance policies
B) It encrypts storage accounts
C) It provides role-based access control
D) It manages SQL databases

✅ Answer: A) It enforces security compliance and governance policies
Explanation: Azure Policy allows organizations to define, enforce, and audit compliance rules for resources in Azure.

---

8. Which of the following is used for Just-in-Time (JIT) access to Azure VMs?

A) Azure Monitor
B) Microsoft Defender for Cloud
C) Azure Functions
D) Azure AD

✅ Answer: B) Microsoft Defender for Cloud
Explanation: JIT VM access in Microsoft Defender for Cloud helps minimize attack surfaces by allowing access to VMs only when needed.

---

9. What is the primary function of Azure Sentinel?

A) Encrypting Azure storage
B) Acting as a cloud-native SIEM and SOAR solution
C) Enforcing MFA policies
D) Managing Kubernetes clusters

✅ Answer: B) Acting as a cloud-native SIEM and SOAR solution
Explanation: Azure Sentinel is Microsoft’s cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution.

---

10. Which Azure service is used for monitoring security logs and events?

A) Azure Monitor
B) Azure Blob Storage
C) Azure Kubernetes Service
D) Azure VPN Gateway

✅ Answer: A) Azure Monitor
Explanation: Azure Monitor collects, analyzes, and acts on telemetry data from Azure resources, helping with security and performance monitoring.

---

11. What is the function of Azure Privileged Identity Management (PIM)?

A) Managing privileged accounts with Just-in-Time access
B) Automating Azure deployments
C) Storing security logs
D) Encrypting all network traffic

✅ Answer: A) Managing privileged accounts with Just-in-Time access
Explanation: Azure PIM enhances security by providing time-based and approval-based access for privileged roles.

---

12. What does Azure AD Conditional Access do?

A) Blocks all unauthorized traffic
B) Enforces access policies based on conditions like user, device, and location
C) Encrypts database storage
D) Provides virtual network security

✅ Answer: B) Enforces access policies based on conditions like user, device, and location
Explanation: Azure AD Conditional Access controls access based on user identity, device security, and location.

---

13. Which service helps in detecting malicious activities in Azure workloads?

A) Azure Security Center
B) Azure Cost Management
C) Azure Backup
D) Azure DevOps

✅ Answer: A) Azure Security Center
Explanation: Azure Security Center continuously monitors workloads for security threats and provides recommendations.

---

14. What type of encryption does Azure Storage use by default?

A) AES-128
B) AES-256
C) MD5
D) SHA-1

✅ Answer: B) AES-256
Explanation: Azure Storage uses AES-256 encryption to protect data at rest.

---

15. What is Azure Bastion used for?

A) Securing remote desktop access to Azure VMs
B) Encrypting network traffic
C) Managing cloud costs
D) Automating deployments

✅ Answer: A) Securing remote desktop access to Azure VMs
Explanation: Azure Bastion provides secure, seamless RDP and SSH access to Azure VMs without exposing them to public internet.

---

16. Which feature in Azure AD helps prevent password-based attacks?

A) Azure Key Vault
B) Azure AD Identity Protection
C) Azure Virtual Network
D) Azure DNS

✅ Answer: B) Azure AD Identity Protection
Explanation: Azure AD Identity Protection detects and mitigates identity-based threats such as password spray attacks.

---

17. What does Azure Role-Based Access Control (RBAC) do?

A) Encrypts files automatically
B) Restricts access based on user roles
C) Manages DDoS protection
D) Secures SQL databases

✅ Answer: B) Restricts access based on user roles
Explanation: RBAC ensures users have only the necessary permissions based on their roles.

---

18. Which of the following helps in securing APIs in Azure?

A) Azure API Management
B) Azure AD B2C
C) Azure DevOps
D) Azure Backup

✅ Answer: A) Azure API Management
Explanation: Azure API Management helps protect and manage APIs by implementing security policies.

---

19. How does Azure Web Application Firewall (WAF) enhance security?

A) By blocking malicious web traffic and attacks
B) By encrypting all network traffic
C) By automating CI/CD pipelines
D) By improving virtual network performance

✅ Answer: A) By blocking malicious web traffic and attacks
Explanation: Azure WAF protects applications from common web threats such as SQL injection and XSS.

---

20. What is the main purpose of Azure AD Multi-Factor Authentication (MFA)?

A) Providing an additional layer of authentication security
B) Encrypting storage accounts
C) Managing Azure billing
D) Enforcing network segmentation

✅ Answer: A) Providing an additional layer of authentication security
Explanation: Azure MFA helps protect user accounts by requiring multiple verification methods.

---

21. Which Azure service provides a centralized place to manage security recommendations and compliance standards?

A) Azure Monitor
B) Microsoft Defender for Cloud
C) Azure AD Conditional Access
D) Azure DevOps

✅ Answer: B) Microsoft Defender for Cloud
Explanation: Microsoft Defender for Cloud offers security posture management and compliance recommendations for Azure workloads.

---

22. What is the function of Azure Security Groups (NSG)?

A) Encrypting storage accounts
B) Defining network traffic rules for Azure resources
C) Managing user authentication
D) Enforcing role-based access

✅ Answer: B) Defining network traffic rules for Azure resources
Explanation: Azure NSGs control inbound and outbound traffic for Azure virtual machines and subnets.

---

23. Which security feature ensures that a VM’s disk data is protected at rest?

A) Azure Disk Encryption
B) Azure Monitor
C) Azure DevOps
D) Azure AD Identity Protection

✅ Answer: A) Azure Disk Encryption
Explanation: Azure Disk Encryption secures disk data using BitLocker (Windows) and DM-Crypt (Linux).

---

24. Which service allows organizations to enforce security best practices across multiple Azure subscriptions?

A) Azure Policy
B) Azure Virtual Network
C) Azure Blob Storage
D) Azure DevOps

✅ Answer: A) Azure Policy
Explanation: Azure Policy enforces compliance and security policies across Azure resources and subscriptions.

---

25. What does Azure Information Protection (AIP) do?

A) Encrypts and classifies documents and emails
B) Detects unauthorized network activity
C) Provides firewall security
D) Automates Azure deployments

✅ Answer: A) Encrypts and classifies documents and emails
Explanation: AIP helps protect sensitive data by classifying, labeling, and encrypting files.

---

26. Which Azure feature prevents attackers from running malicious scripts on virtual machines?

A) Just-in-Time VM Access
B) Azure Sentinel
C) Application Control in Defender for Cloud
D) Azure AD B2B

✅ Answer: C) Application Control in Defender for Cloud
Explanation: Application Control blocks unauthorized or untrusted applications from running on Azure VMs.

---

27. What is the primary security function of Azure AD B2C?

A) Securing customer identities for applications
B) Managing Azure subscription costs
C) Encrypting data at rest
D) Monitoring Azure VM performance

✅ Answer: A) Securing customer identities for applications
Explanation: Azure AD B2C enables secure authentication and identity management for external users.

---

28. Which service provides real-time threat intelligence in Azure?

A) Azure Threat Intelligence
B) Azure DDoS Protection
C) Microsoft Defender for Cloud
D) Azure AD Identity Protection

✅ Answer: C) Microsoft Defender for Cloud
Explanation: Defender for Cloud offers real-time threat intelligence to detect and mitigate security threats.

---

29. How does Azure Private Link enhance security?

A) Prevents DDoS attacks
B) Encrypts all storage data
C) Enables secure access to Azure services via a private network
D) Manages user authentication

✅ Answer: C) Enables secure access to Azure services via a private network
Explanation: Azure Private Link provides private network access to Azure services, preventing data exposure to the internet.

---

30. What does Azure Log Analytics primarily help with?

A) Managing cloud billing
B) Aggregating security and operational logs for analysis
C) Encrypting API endpoints
D) Enforcing role-based access control

✅ Answer: B) Aggregating security and operational logs for analysis
Explanation: Azure Log Analytics collects and analyzes log data to identify security and performance issues.

---

31. Which security control helps in preventing lateral movement of threats in Azure?

A) Azure Bastion
B) Azure Virtual Network Peering
C) Azure Firewall
D) Network Segmentation with NSGs

✅ Answer: D) Network Segmentation with NSGs
Explanation: Proper NSG configuration limits unauthorized movement within an Azure network.

---

32. What does Managed Identity in Azure help with?

A) Assigning identities to applications for secure authentication
B) Encrypting Azure storage
C) Managing Azure networking
D) Automating server patching

✅ Answer: A) Assigning identities to applications for secure authentication
Explanation: Managed Identity eliminates the need for storing credentials by enabling applications to securely authenticate with Azure services.

---

33. Which feature helps protect Azure SQL databases against SQL Injection attacks?

A) Azure SQL Threat Detection
B) Azure Blob Encryption
C) Azure Virtual Network
D) Azure DevOps Security

✅ Answer: A) Azure SQL Threat Detection
Explanation: SQL Threat Detection alerts users about potential SQL Injection and other suspicious activities.

---

34. How does Azure AD Password Protection enhance security?

A) Prevents users from setting weak passwords
B) Encrypts stored credentials
C) Limits network traffic
D) Provides firewall protection

✅ Answer: A) Prevents users from setting weak passwords
Explanation: Azure AD Password Protection prevents the use of weak or commonly used passwords to enhance security.

---

35. What is the purpose of Microsoft Secure Score?

A) Provides a security assessment and recommendations for Azure resources
B) Encrypts user credentials
C) Manages Azure billing
D) Controls API access

✅ Answer: A) Provides a security assessment and recommendations for Azure resources
Explanation: Microsoft Secure Score helps organizations measure and improve their security posture.

---

36. Which of the following is NOT a security feature in Azure?

A) Azure AD Conditional Access
B) Azure Key Vault
C) Azure Virtual Machines
D) Azure Security Center

✅ Answer: C) Azure Virtual Machines
Explanation: Azure Virtual Machines provide compute resources but do not directly offer security features.

---

37. What does Azure Monitor Alerts do?

A) Provides notifications for security threats and system anomalies
B) Encrypts Azure Storage
C) Limits user permissions
D) Blocks all inbound traffic

✅ Answer: A) Provides notifications for security threats and system anomalies
Explanation: Azure Monitor Alerts detect anomalies and security threats and notify administrators.

---

38. What does Azure Sentinel use to analyze security threats?

A) Machine learning and AI-based analytics
B) Azure Storage encryption
C) Virtual Private Networks
D) Firewall rules

✅ Answer: A) Machine learning and AI-based analytics
Explanation: Azure Sentinel applies AI-driven security analytics to detect and respond to threats.

---

39. How does Azure RBAC improve security?

A) Restricts resource access based on assigned roles
B) Encrypts virtual machines
C) Provides advanced threat analytics
D) Automates software patching

✅ Answer: A) Restricts resource access based on assigned roles
Explanation: Azure RBAC enforces the principle of least privilege by granting users only necessary permissions.

---

40. What is the purpose of the Secure Score API in Azure?

A) Allows programmatic access to security recommendations
B) Encrypts all network traffic
C) Provides DDoS protection
D) Manages virtual machines

✅ Answer: A) Allows programmatic access to security recommendations
Explanation: The Secure Score API helps organizations integrate security insights into their applications.

---

41. What is the primary function of Azure Blueprints in security?

A) To manage cost optimization in Azure
B) To define and enforce security policies, role assignments, and resource configurations
C) To encrypt Azure data storage
D) To provide real-time DDoS protection

✅ Answer: B) To define and enforce security policies, role assignments, and resource configurations
Explanation: Azure Blueprints enable organizations to define security and governance standards, ensuring compliance across cloud environments.

---

42. Which Azure feature ensures secure and private connectivity to Azure services over the internet?

A) Azure Private Link
B) Azure VPN Gateway
C) Azure Monitor
D) Azure ExpressRoute

✅ Answer: D) Azure ExpressRoute
Explanation: ExpressRoute provides a dedicated, private connection to Azure services, bypassing the public internet for increased security.

---

43. Which Azure security solution helps organizations detect and mitigate brute force attacks on their accounts?

A) Azure AD Identity Protection
B) Azure SQL Firewall
C) Azure Cost Management
D) Azure Blob Storage

✅ Answer: A) Azure AD Identity Protection
Explanation: Azure AD Identity Protection uses machine learning to detect unusual sign-in patterns and potential identity threats.

---

44. What is the purpose of the Azure Security Benchmark?

A) It provides recommended security best practices for Azure workloads
B) It monitors Azure virtual machines
C) It improves Azure subscription billing
D) It enhances Azure networking performance

✅ Answer: A) It provides recommended security best practices for Azure workloads
Explanation: The Azure Security Benchmark offers security best practices and recommendations to protect cloud environments.

---

45. How does Azure AD Privileged Identity Management (PIM) help improve security?

A) By managing privileged accounts with Just-in-Time access and access reviews
B) By monitoring network traffic
C) By encrypting Azure SQL databases
D) By managing firewall rules

✅ Answer: A) By managing privileged accounts with Just-in-Time access and access reviews
Explanation: Azure AD PIM minimizes security risks by granting elevated access only when needed and requiring periodic access reviews.

---

46. What does Azure Secure Score measure?

A) The overall security posture of an organization’s Azure environment
B) The performance of Azure virtual machines
C) The cost efficiency of Azure services
D) The encryption strength of Azure Key Vault

✅ Answer: A) The overall security posture of an organization’s Azure environment
Explanation: Azure Secure Score assesses security configurations and provides recommendations for improving security posture.

---

47. How does Azure Policy help organizations improve compliance?

A) By enforcing security configurations and best practices
B) By optimizing Azure subscription costs
C) By providing firewall security
D) By encrypting API endpoints

✅ Answer: A) By enforcing security configurations and best practices
Explanation: Azure Policy allows organizations to apply and audit security policies to ensure compliance with industry standards.

---

48. Which of the following is a key benefit of Azure Security Center’s Secure Score recommendations?

A) It helps prioritize security improvements based on risk
B) It automates software updates
C) It provides cost-saving suggestions
D) It speeds up network traffic

✅ Answer: A) It helps prioritize security improvements based on risk
Explanation: Secure Score recommendations guide organizations in prioritizing security enhancements based on potential impact.

---

49. What is the role of Azure AD Conditional Access in securing cloud applications?

A) It grants or denies access based on user conditions such as location, device, and behavior
B) It encrypts all cloud storage automatically
C) It manages Azure billing
D) It optimizes virtual machine performance

✅ Answer: A) It grants or denies access based on user conditions such as location, device, and behavior
Explanation: Azure AD Conditional Access ensures secure access by applying conditional policies based on risk factors.

---

50. Which Azure service helps organizations maintain compliance with industry security regulations?

A) Azure Policy
B) Azure DevOps
C) Azure Virtual Network
D) Azure CDN

✅ Answer: A) Azure Policy
Explanation: Azure Policy enforces security compliance by defining and monitoring security configurations across Azure resources.

---

51. What does Azure DDoS Protection Standard provide that the Basic tier does not?

A) Adaptive AI-based mitigation and real-time attack telemetry
B) Free security recommendations
C) Cost analysis for Azure subscriptions
D) Encryption for Azure storage

✅ Answer: A) Adaptive AI-based mitigation and real-time attack telemetry
Explanation: DDoS Protection Standard offers AI-driven attack detection, automatic mitigation, and insights into threats.

---

52. How does Microsoft Defender for Endpoint integrate with Azure Security Center?

A) It provides threat detection and automated response for endpoints connected to Azure
B) It manages Azure billing
C) It optimizes virtual network traffic
D) It prevents Azure services from auto-scaling

✅ Answer: A) It provides threat detection and automated response for endpoints connected to Azure
Explanation: Defender for Endpoint enhances security by detecting and responding to threats in endpoint devices.

---

53. How does Azure Sentinel help improve security?

A) By providing a cloud-native SIEM solution for detecting and responding to security incidents
B) By encrypting Azure storage
C) By managing Azure subscriptions
D) By improving API performance

✅ Answer: A) By providing a cloud-native SIEM solution for detecting and responding to security incidents
Explanation: Azure Sentinel offers Security Information and Event Management (SIEM) and automated response capabilities.

---

54. What is the purpose of Microsoft Defender for Identity?

A) To detect and prevent identity-based threats such as credential theft and lateral movement attacks
B) To encrypt Azure storage
C) To automate Azure deployments
D) To optimize Azure billing

✅ Answer: A) To detect and prevent identity-based threats such as credential theft and lateral movement attacks
Explanation: Defender for Identity monitors user activities and detects suspicious behaviors in hybrid identity environments.

---

55. What is the main benefit of Azure Lighthouse in security?

A) It allows service providers to manage security across multiple tenants securely
B) It speeds up Azure deployments
C) It optimizes cost management in Azure
D) It provides virtual network monitoring

✅ Answer: A) It allows service providers to manage security across multiple tenants securely
Explanation: Azure Lighthouse enables centralized and secure management of multiple Azure tenants.

---

56. How does Azure AD Identity Protection detect risky sign-ins?

A) By using machine learning and risk-based analysis to flag suspicious activities
B) By scanning for unpatched software
C) By encrypting all network traffic
D) By preventing Azure resources from scaling

✅ Answer: A) By using machine learning and risk-based analysis to flag suspicious activities
Explanation: Azure AD Identity Protection uses AI-driven risk detection to identify and mitigate identity threats.

---

57. What is the primary role of Azure Monitor Logs in security?

A) To collect and analyze security-related logs for threat detection
B) To manage virtual machines
C) To optimize Azure cost management
D) To enforce compliance policies

✅ Answer: A) To collect and analyze security-related logs for threat detection
Explanation: Azure Monitor Logs provide valuable insights for detecting and responding to security threats.

---

58. What does Microsoft Defender for Cloud Apps do?

A) It provides security monitoring and threat detection for cloud applications
B) It encrypts Azure storage
C) It manages Azure virtual machines
D) It automates software patching

✅ Answer: A) It provides security monitoring and threat detection for cloud applications
Explanation: Defender for Cloud Apps offers visibility and control over cloud applications to prevent security risks.

---

59. What does Just-in-Time (JIT) VM Access prevent?

A) Unnecessary exposure of virtual machines to the internet
B) Automatic VM scaling
C) Network latency issues
D) Azure billing errors

✅ Answer: A) Unnecessary exposure of virtual machines to the internet
Explanation: JIT VM Access minimizes attack surfaces by allowing access to VMs only when required.

---

60. Which feature in Azure helps enforce encryption for data in transit?

A) Azure TLS Encryption
B) Azure Firewall
C) Azure Cost Management
D) Azure AD B2C

✅ Answer: A) Azure TLS Encryption
Explanation: Azure TLS Encryption ensures that data transmitted between services is securely encrypted.

---

61. What is the primary function of Azure Security Defaults?

A) To provide basic security configurations for all Azure AD tenants
B) To optimize virtual machine performance
C) To automate Azure deployments
D) To encrypt all Azure storage accounts

✅ Answer: A) To provide basic security configurations for all Azure AD tenants
Explanation: Azure Security Defaults enable security features like multi-factor authentication (MFA) and conditional access policies by default.

---

62. How does Azure Private Endpoint improve security?

A) By providing private network connectivity to Azure resources
B) By managing Azure billing
C) By encrypting Azure SQL databases
D) By providing public IP addresses

✅ Answer: A) By providing private network connectivity to Azure resources
Explanation: Azure Private Endpoint ensures that traffic to Azure services remains within a private network, reducing exposure to threats.

---

63. Which Azure security service helps prevent malware from running on virtual machines?

A) Microsoft Defender for Endpoint
B) Azure Virtual Network
C) Azure Cost Management
D) Azure AD B2B

✅ Answer: A) Microsoft Defender for Endpoint
Explanation: Microsoft Defender for Endpoint provides endpoint detection and response (EDR) to prevent malware and other cyber threats.

---

64. What is the main benefit of Azure Security Baselines?

A) They provide pre-configured security settings for Azure services
B) They improve Azure billing efficiency
C) They optimize Azure networking performance
D) They automate virtual machine scaling

✅ Answer: A) They provide pre-configured security settings for Azure services
Explanation: Azure Security Baselines help organizations configure security settings that align with industry standards.

---

65. Which Azure service enables tracking of security incidents and investigations?

A) Azure Sentinel
B) Azure VPN Gateway
C) Azure Cost Management
D) Azure Virtual Machines

✅ Answer: A) Azure Sentinel
Explanation: Azure Sentinel is a cloud-native SIEM solution that helps organizations detect, investigate, and respond to security incidents.

---

66. What is the primary security function of Azure AD Access Reviews?

A) To regularly review and validate user access to Azure resources
B) To encrypt Azure storage accounts
C) To optimize network performance
D) To monitor Azure billing

✅ Answer: A) To regularly review and validate user access to Azure resources
Explanation: Azure AD Access Reviews help ensure that only authorized users maintain access to sensitive resources.

---

67. Which security feature in Azure AD helps prevent token replay attacks?

A) Token Binding
B) Azure Virtual Network
C) Azure Monitor Logs
D) Azure Policy

✅ Answer: A) Token Binding
Explanation: Token Binding helps prevent the misuse of stolen authentication tokens by ensuring that tokens are only valid for a specific session.

---

68. How does Azure Application Gateway improve security?

A) By providing Web Application Firewall (WAF) capabilities
B) By managing Azure billing
C) By encrypting database connections
D) By automating server patching

✅ Answer: A) By providing Web Application Firewall (WAF) capabilities
Explanation: Azure Application Gateway includes a Web Application Firewall (WAF) to protect against web-based attacks.

---

69. What does Azure Security Center’s Regulatory Compliance feature do?

A) It provides compliance reports based on industry standards
B) It manages virtual machines
C) It encrypts all Azure storage accounts
D) It improves Azure networking

✅ Answer: A) It provides compliance reports based on industry standards
Explanation: This feature helps organizations assess their compliance with industry regulations such as ISO 27001, GDPR, and PCI-DSS.

---

70. How does Azure Bastion improve security?

A) By providing secure remote desktop and SSH access without exposing VMs to the internet
B) By encrypting all API calls
C) By monitoring Azure subscriptions
D) By managing firewall rules

✅ Answer: A) By providing secure remote desktop and SSH access without exposing VMs to the internet
Explanation: Azure Bastion eliminates the need for public IPs on virtual machines by enabling secure RDP and SSH access.

---

71. What is the main security benefit of using Azure Multi-Factor Authentication (MFA)?

A) It adds an extra layer of authentication beyond passwords
B) It encrypts all Azure network traffic
C) It optimizes virtual machine performance
D) It automatically patches Azure services

✅ Answer: A) It adds an extra layer of authentication beyond passwords
Explanation: Azure MFA enhances security by requiring additional verification methods, reducing the risk of unauthorized access.

---

72. How does Azure AD Identity Protection detect compromised user accounts?

A) By using risk-based policies and machine learning
B) By scanning virtual networks
C) By optimizing Azure billing
D) By encrypting all storage data

✅ Answer: A) By using risk-based policies and machine learning
Explanation: Azure AD Identity Protection analyzes user behavior and risk factors to detect compromised identities.

---

73. What is the role of Azure Key Vault Managed HSM (Hardware Security Module)?

A) To provide hardware-based encryption key management
B) To manage Azure billing
C) To optimize virtual machine performance
D) To automate software updates

✅ Answer: A) To provide hardware-based encryption key management
Explanation: Managed HSM in Azure Key Vault offers FIPS 140-2 Level 3-certified hardware security for key management.

---

74. How does Azure Conditional Access improve security?

A) By enforcing access policies based on user risk levels, location, and device compliance
B) By managing Azure virtual machines
C) By encrypting Azure storage accounts
D) By providing firewall protection

✅ Answer: A) By enforcing access policies based on user risk levels, location, and device compliance
Explanation: Conditional Access policies help enforce security requirements dynamically based on real-time risk assessments.

---

75. Which Azure service provides visibility into the security posture of Azure Kubernetes Service (AKS)?

A) Microsoft Defender for Cloud
B) Azure Monitor
C) Azure Virtual Network
D) Azure DevOps

✅ Answer: A) Microsoft Defender for Cloud
Explanation: Defender for Cloud provides insights into the security posture of Azure Kubernetes Service (AKS), helping detect vulnerabilities.

---

76. What does Azure Sentinel use for security threat detection?

A) AI and machine learning analytics
B) Azure DevOps pipelines
C) Azure Cost Management
D) Azure Storage encryption

✅ Answer: A) AI and machine learning analytics
Explanation: Azure Sentinel applies AI-driven security analytics to detect and mitigate threats across cloud environments.

---

77. How does Azure AD Password Protection improve security?

A) By preventing the use of weak and commonly breached passwords
B) By encrypting Azure storage
C) By managing network security groups
D) By monitoring Azure costs

✅ Answer: A) By preventing the use of weak and commonly breached passwords
Explanation: Azure AD Password Protection enforces strong password policies and blocks common passwords to enhance security.

---

78. What does Microsoft Defender for SQL help protect against?

A) SQL injection attacks and database vulnerabilities
B) Virtual machine performance issues
C) Azure subscription billing errors
D) Network latency issues

✅ Answer: A) SQL injection attacks and database vulnerabilities
Explanation: Microsoft Defender for SQL provides advanced threat protection for Azure SQL databases.

---

79. Which Azure security feature restricts API access based on authentication and authorization policies?

A) Azure API Management
B) Azure Key Vault
C) Azure DevOps
D) Azure Cost Management

✅ Answer: A) Azure API Management
Explanation: Azure API Management enforces security policies for API authentication and authorization.

---

80. What does Azure Security Center’s Secure Score API allow organizations to do?

A) Programmatically assess and improve their security posture
B) Encrypt all Azure data
C) Manage Azure subscriptions
D) Optimize Azure networking

✅ Answer: A) Programmatically assess and improve their security posture
Explanation: The Secure Score API helps organizations integrate security insights into their applications for continuous monitoring.

---

81. Which Azure service provides continuous threat intelligence and security recommendations?

A) Microsoft Defender for Cloud
B) Azure Virtual Network
C) Azure Cost Management
D) Azure DevOps

✅ Answer: A) Microsoft Defender for Cloud
Explanation: Microsoft Defender for Cloud continuously monitors and provides security recommendations to improve the security posture of Azure workloads.

---

82. What is the purpose of Azure AD Identity Governance?

A) To manage and secure identities, access, and policies efficiently
B) To encrypt Azure SQL databases
C) To optimize Azure network performance
D) To automate virtual machine scaling

✅ Answer: A) To manage and secure identities, access, and policies efficiently
Explanation: Azure AD Identity Governance helps manage user identities, access reviews, and policies for better security and compliance.

---

83. What is the function of Azure AD B2B (Business-to-Business)?

A) It allows external organizations to securely collaborate with Azure tenants
B) It encrypts data at rest
C) It manages Azure subscriptions
D) It automates security updates

✅ Answer: A) It allows external organizations to securely collaborate with Azure tenants
Explanation: Azure AD B2B enables external users to securely access Azure resources while maintaining control over permissions.

---

84. How does Azure AD Access Packages improve security?

A) By enabling controlled and time-limited access to resources
B) By encrypting all Azure data automatically
C) By monitoring Azure subscription costs
D) By managing firewall rules

✅ Answer: A) By enabling controlled and time-limited access to resources
Explanation: Azure AD Access Packages allow administrators to manage temporary and controlled access to Azure resources.

---

85. What security benefit does Azure Storage Service Encryption provide?

A) It encrypts data at rest using AES-256 encryption
B) It monitors Azure workloads for threats
C) It provides firewall protection
D) It optimizes Azure billing

✅ Answer: A) It encrypts data at rest using AES-256 encryption
Explanation: Azure Storage Service Encryption secures stored data by encrypting it with AES-256 encryption.

---

86. Which Azure service provides automatic security patches for virtual machines?

A) Azure Update Manager
B) Azure Key Vault
C) Azure API Management
D) Azure Firewall

✅ Answer: A) Azure Update Manager
Explanation: Azure Update Manager ensures that security patches and updates are applied to virtual machines automatically.

---

87. What does Azure Monitor Threat Intelligence do?

A) It provides insights into security threats based on global attack data
B) It manages Azure storage encryption
C) It improves network latency
D) It automates software deployments

✅ Answer: A) It provides insights into security threats based on global attack data
Explanation: Azure Monitor Threat Intelligence aggregates and analyzes global threat data to help detect potential security risks.

---

88. What does Azure Virtual WAN provide in terms of security?

A) Secure, scalable network connectivity for hybrid and multi-cloud environments
B) Encrypted storage for Azure VMs
C) Identity management for Azure users
D) Security monitoring for Kubernetes

✅ Answer: A) Secure, scalable network connectivity for hybrid and multi-cloud environments
Explanation: Azure Virtual WAN enhances security by providing secure and optimized network connectivity across cloud and on-premises resources.

---

89. What does Azure Traffic Analytics provide?

A) Insights into network traffic patterns and security threats
B) Automated cost optimization
C) Azure VM performance tuning
D) Automated role-based access control

✅ Answer: A) Insights into network traffic patterns and security threats
Explanation: Azure Traffic Analytics monitors network traffic to detect security threats and optimize performance.

---

90. What is the function of Azure AD Risk-Based Conditional Access?

A) It dynamically enforces security policies based on user risk assessment
B) It encrypts data at rest in Azure Storage
C) It manages virtual network security groups
D) It optimizes Azure billing

✅ Answer: A) It dynamically enforces security policies based on user risk assessment
Explanation: Risk-Based Conditional Access automatically adjusts security requirements based on real-time risk levels.

---

91. How does Azure WAF (Web Application Firewall) protect web applications?

A) By blocking malicious web traffic and attacks such as SQL injection and cross-site scripting
B) By encrypting all network traffic
C) By managing Azure billing
D) By automating VM deployments

✅ Answer: A) By blocking malicious web traffic and attacks such as SQL injection and cross-site scripting
Explanation: Azure WAF protects web applications from various cyber threats, including SQL injection and XSS attacks.

---

92. What security function does Azure Network Watcher perform?

A) It provides network monitoring and diagnostics to detect security issues
B) It encrypts virtual machines
C) It manages Azure subscriptions
D) It automates database backups

✅ Answer: A) It provides network monitoring and diagnostics to detect security issues
Explanation: Azure Network Watcher helps detect network security threats and troubleshoot connectivity issues.

---

93. Which feature in Microsoft Defender for Cloud provides security alerts based on real-world attack scenarios?

A) Threat Intelligence-Based Alerts
B) Azure Policy
C) Azure Traffic Manager
D) Azure DevOps Security

✅ Answer: A) Threat Intelligence-Based Alerts
Explanation: Microsoft Defender for Cloud uses real-world attack data to generate threat intelligence-based security alerts.

---

94. How does Azure Firewall Threat Intelligence-based filtering enhance security?

A) By blocking traffic from malicious IP addresses based on global threat data
B) By encrypting Azure storage
C) By optimizing VM performance
D) By managing Azure cost reports

✅ Answer: A) By blocking traffic from malicious IP addresses based on global threat data
Explanation: Azure Firewall uses Microsoft threat intelligence to identify and block traffic from known malicious IP addresses.

---

95. What does Azure AD Role-Based Access Control (RBAC) ensure?

A) That users only have the permissions necessary for their roles
B) That all Azure data is encrypted by default
C) That Azure VMs are automatically updated
D) That network latency is reduced

✅ Answer: A) That users only have the permissions necessary for their roles
Explanation: Azure RBAC enforces the principle of least privilege by restricting access based on assigned roles.

---

96. What security feature does Azure Virtual Network (VNet) Peering offer?

A) Secure, private connectivity between Azure virtual networks
B) Automated security patches for Azure VMs
C) Real-time monitoring of Azure storage activity
D) Built-in firewall management

✅ Answer: A) Secure, private connectivity between Azure virtual networks
Explanation: VNet Peering allows Azure virtual networks to communicate securely without passing traffic over the public internet.

---

97. What does Azure Secure Boot help prevent?

A) The execution of unauthorized firmware and bootloaders
B) Unauthorized access to storage accounts
C) SQL injection attacks
D) Azure billing errors

✅ Answer: A) The execution of unauthorized firmware and bootloaders
Explanation: Azure Secure Boot ensures that only trusted bootloaders and firmware run on Azure VMs.

---

98. How does Azure AD Sign-In Risk Detection improve security?

A) By identifying and mitigating suspicious login attempts
B) By optimizing Azure resource consumption
C) By automating firewall configurations
D) By encrypting virtual network traffic

✅ Answer: A) By identifying and mitigating suspicious login attempts
Explanation: Sign-In Risk Detection uses AI-driven analytics to detect and respond to unusual login activities.

---

99. What does Azure Confidential Computing protect against?

A) Unauthorized access to data while in use (processing)
B) Network-based attacks
C) Virtual machine crashes
D) Storage capacity limits

✅ Answer: A) Unauthorized access to data while in use (processing)
Explanation: Azure Confidential Computing ensures that data remains encrypted even while being processed in memory.

---

100. What does Azure DNS Private Zones help secure?

A) Name resolution for Azure resources within a private network
B) All Azure file storage by default
C) Azure cost management reports
D) Azure VM auto-scaling

✅ Answer: A) Name resolution for Azure resources within a private network
Explanation: Azure DNS Private Zones provide secure DNS resolution for private Azure environments without exposing DNS queries to the internet.

---

101. Which Azure service helps prevent unauthorized changes to critical resources?

A) Azure Resource Locks
B) Azure API Management
C) Azure VPN Gateway
D) Azure Traffic Manager

✅ Answer: A) Azure Resource Locks
Explanation: Azure Resource Locks prevent accidental or malicious modifications to critical resources by restricting deletion or changes.

---

102. What security advantage does Azure AD Dynamic Groups provide?

A) Automatically assigns users to groups based on predefined rules
B) Encrypts data at rest
C) Manages Azure subscription costs
D) Detects security threats in real-time

✅ Answer: A) Automatically assigns users to groups based on predefined rules
Explanation: Azure AD Dynamic Groups improve security by automating group membership based on user attributes.

---

103. Which Azure security feature provides just-in-time (JIT) access to VMs?

A) Microsoft Defender for Cloud
B) Azure AD Conditional Access
C) Azure VPN Gateway
D) Azure Cost Management

✅ Answer: A) Microsoft Defender for Cloud
Explanation: Just-in-Time VM access in Microsoft Defender for Cloud minimizes attack surfaces by allowing access only when necessary.

---

104. What does Azure Privileged Access Management (PAM) help prevent?

A) Unauthorized privilege escalation by restricting admin access
B) SQL injection attacks
C) Azure subscription billing errors
D) Slow network performance

✅ Answer: A) Unauthorized privilege escalation by restricting admin access
Explanation: Azure PAM limits high-privilege access, reducing the risk of credential theft or misuse.

---

105. What does Azure Blueprints help organizations achieve?

A) Enforce security, compliance, and governance best practices at scale
B) Encrypt all Azure storage accounts
C) Optimize Azure networking performance
D) Automate virtual machine scaling

✅ Answer: A) Enforce security, compliance, and governance best practices at scale
Explanation: Azure Blueprints define repeatable environments, ensuring security and compliance across multiple deployments.

---

106. Which Azure service provides hardware-based key protection for cryptographic operations?

A) Azure Dedicated HSM
B) Azure AD Privileged Identity Management
C) Azure Sentinel
D) Azure Policy

✅ Answer: A) Azure Dedicated HSM
Explanation: Azure Dedicated Hardware Security Module (HSM) provides highly secure key management and cryptographic operations.

---

107. How does Azure Storage Analytics improve security?

A) By providing logs and metrics to track unauthorized access attempts
B) By encrypting all storage accounts
C) By optimizing file storage performance
D) By enforcing firewall rules automatically

✅ Answer: A) By providing logs and metrics to track unauthorized access attempts
Explanation: Azure Storage Analytics helps detect security threats by monitoring and logging access patterns.

---

108. What does Azure Disk Encryption use to encrypt virtual machine disks?

A) BitLocker (Windows) and DM-Crypt (Linux)
B) AES-128 encryption
C) RSA-2048 encryption
D) MD5 hashing

✅ Answer: A) BitLocker (Windows) and DM-Crypt (Linux)
Explanation: Azure Disk Encryption secures VM disks using BitLocker for Windows and DM-Crypt for Linux.

---

109. What is the primary security function of Azure Managed Identities?

A) To allow applications to securely authenticate without storing credentials
B) To encrypt API calls
C) To monitor Azure subscription costs
D) To optimize network latency

✅ Answer: A) To allow applications to securely authenticate without storing credentials
Explanation: Managed Identities remove the need for storing credentials in code by enabling applications to use Azure AD authentication.

---

110. What does the Azure Security Benchmark provide?

A) A set of best practices for securing Azure services
B) A performance analysis of virtual machines
C) A cost-optimization report for Azure workloads
D) A network traffic performance report

✅ Answer: A) A set of best practices for securing Azure services
Explanation: The Azure Security Benchmark provides security recommendations based on industry standards.

---

111. How does Azure Defender for IoT improve security?

A) By detecting and mitigating threats in IoT devices and networks
B) By optimizing Azure subscription costs
C) By encrypting all API requests
D) By managing Azure virtual machines

✅ Answer: A) By detecting and mitigating threats in IoT devices and networks
Explanation: Azure Defender for IoT helps protect connected devices from cyber threats and vulnerabilities.

---

112. Which security measure does Azure SQL Database Advanced Threat Protection provide?

A) Alerts on suspicious activities, such as SQL injection attempts
B) Automatic encryption of all stored procedures
C) Full network isolation from the internet
D) Just-in-time access control

✅ Answer: A) Alerts on suspicious activities, such as SQL injection attempts
Explanation: Advanced Threat Protection detects and alerts on abnormal database activity, including SQL injection attacks.

---

113. What does Azure Monitor Activity Log track?

A) Changes, access, and security-related events across Azure resources
B) The cost of Azure resources
C) Network latency issues
D) Virtual machine performance metrics

✅ Answer: A) Changes, access, and security-related events across Azure resources
Explanation: The Azure Monitor Activity Log provides detailed logs of resource modifications, access attempts, and security incidents.

---

114. Which Azure feature provides security score recommendations to improve compliance?

A) Secure Score in Microsoft Defender for Cloud
B) Azure Virtual Network Peering
C) Azure Blob Encryption
D) Azure DevOps Pipelines

✅ Answer: A) Secure Score in Microsoft Defender for Cloud
Explanation: Secure Score provides insights and recommendations to strengthen the security posture of Azure workloads.

---

115. What does Azure Sentinel’s SOAR (Security Orchestration, Automation, and Response) capability provide?

A) Automated incident response actions based on security alerts
B) Encrypted API management
C) Role-based access control policies
D) Virtual network peering

✅ Answer: A) Automated incident response actions based on security alerts
Explanation: Azure Sentinel’s SOAR capabilities automate security responses, reducing the need for manual intervention.

---

116. How does Azure Key Vault Firewall and Virtual Networks enhance security?

A) By restricting access to Key Vault from specific trusted networks
B) By encrypting all stored keys
C) By enabling automatic key rotation
D) By blocking all external API access

✅ Answer: A) By restricting access to Key Vault from specific trusted networks
Explanation: This feature ensures that only authorized networks can access Azure Key Vault.

---

117. What does Azure Sentinel’s Fusion Alerts detect?

A) Multi-stage attacks by correlating multiple security signals
B) Azure billing issues
C) Virtual machine performance bottlenecks
D) Subscription renewal dates

✅ Answer: A) Multi-stage attacks by correlating multiple security signals
Explanation: Fusion Alerts use AI and machine learning to identify coordinated cyber attacks.

---

118. How does Azure Confidential Ledger enhance security?

A) By providing a tamper-proof, blockchain-based data storage solution
B) By encrypting all SQL database transactions
C) By restricting user access to specific virtual networks
D) By automatically patching virtual machines

✅ Answer: A) By providing a tamper-proof, blockchain-based data storage solution
Explanation: Azure Confidential Ledger ensures the integrity and immutability of stored data.

---

119. What does Azure Information Protection (AIP) Scanner do?

A) Scans and classifies sensitive data across on-premises and cloud storage
B) Monitors Azure subscription usage
C) Encrypts Azure file storage
D) Manages API performance

✅ Answer: A) Scans and classifies sensitive data across on-premises and cloud storage
Explanation: AIP Scanner helps discover and protect sensitive data across an organization.

---

120. What is the primary security feature of Azure Kubernetes Service (AKS)?

A) Azure Policy integration for compliance enforcement
B) Automatic billing optimization
C) Network latency reduction
D) API performance tuning

✅ Answer: A) Azure Policy integration for compliance enforcement
Explanation: AKS integrates with Azure Policy to enforce security best practices for Kubernetes clusters.

---

121. Which Azure service is designed to manage and enforce organizational security policies across multiple subscriptions?

A) Azure Policy
B) Azure Key Vault
C) Azure Virtual Network
D) Azure Cost Management

✅ Answer: A) Azure Policy
Explanation: Azure Policy helps organizations define and enforce security configurations across multiple Azure subscriptions and resources.

---

122. How does Azure Immutable Storage improve security?

A) Prevents deletion or modification of data once written
B) Encrypts API requests
C) Optimizes network traffic
D) Manages user authentication

✅ Answer: A) Prevents deletion or modification of data once written
Explanation: Immutable Storage ensures data integrity by preventing unauthorized changes, making it useful for regulatory compliance.

---

**123. What is the purpose of Azure Network Security Groups (NSGs)?

A) To filter and control network traffic within Azure Virtual Networks
B) To encrypt Azure Storage accounts
C) To manage Azure subscriptions
D) To optimize billing

✅ Answer: A) To filter and control network traffic within Azure Virtual Networks
Explanation: NSGs define rules that control inbound and outbound network traffic, improving security.

---

124. What does Microsoft Defender for Containers provide security for?

A) Azure Kubernetes Service (AKS) and containerized workloads
B) Azure SQL Databases
C) Virtual machines running Windows Server
D) Azure networking performance

✅ Answer: A) Azure Kubernetes Service (AKS) and containerized workloads
Explanation: Microsoft Defender for Containers secures AKS workloads against vulnerabilities and threats.

---

125. What does Azure Firewall Premium offer that the standard tier does not?

A) TLS inspection and intrusion detection/prevention
B) Role-based access control
C) Data encryption at rest
D) Multi-region scalability

✅ Answer: A) TLS inspection and intrusion detection/prevention
Explanation: Azure Firewall Premium includes advanced security features such as TLS inspection, intrusion detection, and malware filtering.

---

126. How does Azure Private DNS improve security?

A) Enables secure, private domain name resolution inside Azure
B) Encrypts all HTTP traffic
C) Blocks all incoming traffic
D) Manages API authentication

✅ Answer: A) Enables secure, private domain name resolution inside Azure
Explanation: Azure Private DNS prevents DNS exposure by enabling private name resolution within a VNet.

---

127. What does Microsoft Defender for Office 365 protect against?

A) Phishing, malware, and business email compromise
B) Azure cost overruns
C) Network performance issues
D) Unauthorized VM deployments

✅ Answer: A) Phishing, malware, and business email compromise
Explanation: Microsoft Defender for Office 365 helps protect emails and collaboration tools from cyber threats.

---

128. How does Azure App Service Managed Certificates enhance security?

A) Provides free SSL/TLS certificates for securing web apps
B) Encrypts Azure Storage accounts
C) Manages API performance
D) Enhances VM performance

✅ Answer: A) Provides free SSL/TLS certificates for securing web apps
Explanation: Managed Certificates offer free SSL/TLS encryption for securing Azure-hosted web applications.

---

129. What is the primary function of Azure Security Insights in Microsoft Sentinel?

A) Provides AI-powered threat detection and incident investigation
B) Manages Azure network traffic
C) Encrypts storage accounts
D) Optimizes cost efficiency

✅ Answer: A) Provides AI-powered threat detection and incident investigation
Explanation: Security Insights in Sentinel aggregates and analyzes security events for detecting threats.

---

130. What does Azure Active Directory External Identities allow organizations to do?

A) Securely authenticate external users and customers
B) Encrypt all storage accounts
C) Improve virtual machine performance
D) Manage API keys

✅ Answer: A) Securely authenticate external users and customers
Explanation: Azure AD External Identities enables secure authentication and management of external users accessing applications.

---

131. How does Azure Lighthouse improve security for managed service providers?

A) Allows secure, delegated access to manage multiple tenants
B) Encrypts data at rest
C) Prevents DDoS attacks
D) Manages Azure billing

✅ Answer: A) Allows secure, delegated access to manage multiple tenants
Explanation: Azure Lighthouse enables MSPs to manage multiple customer environments securely with granular permissions.

---

132. What security feature does Azure Service Endpoint Policies provide?

A) Restricts access to Azure PaaS services from specific virtual networks
B) Encrypts API requests
C) Blocks all internet-based traffic
D) Manages Azure subscriptions

✅ Answer: A) Restricts access to Azure PaaS services from specific virtual networks
Explanation: Service Endpoint Policies enhance security by ensuring that Azure services can only be accessed from specific VNets.

---

133. What does Microsoft Defender for Endpoint use to detect advanced threats?

A) Behavioral analytics and machine learning
B) IP-based filtering
C) Simple network heuristics
D) Manual security policies

✅ Answer: A) Behavioral analytics and machine learning
Explanation: Microsoft Defender for Endpoint leverages AI and behavioral analytics to detect sophisticated cyber threats.

---

134. What is the main purpose of Azure AD Domain Services?

A) Provides managed domain controllers for Azure-hosted applications
B) Encrypts all database transactions
C) Blocks unauthorized network access
D) Manages API authentication

✅ Answer: A) Provides managed domain controllers for Azure-hosted applications
Explanation: Azure AD Domain Services enables applications that require traditional domain controllers to run securely in Azure.

---

135. How does Azure Identity Protection improve security?

A) Detects and mitigates identity-based threats like compromised credentials
B) Encrypts Azure SQL Databases
C) Prevents DDoS attacks
D) Monitors network traffic

✅ Answer: A) Detects and mitigates identity-based threats like compromised credentials
Explanation: Azure Identity Protection uses AI to identify risky sign-ins and credential compromise attempts.

---

136. What does Azure Policy Guest Configuration help enforce?

A) Security and compliance settings within Azure virtual machines
B) Firewall rules in virtual networks
C) API rate limiting
D) Cost optimization strategies

✅ Answer: A) Security and compliance settings within Azure virtual machines
Explanation: Guest Configuration ensures that VMs adhere to security and compliance policies by enforcing OS-level settings.

---

137. What is the function of Microsoft Defender for Cloud Apps?

A) Protects SaaS applications from security threats
B) Encrypts Azure storage accounts
C) Monitors Azure billing
D) Manages virtual networks

✅ Answer: A) Protects SaaS applications from security threats
Explanation: Defender for Cloud Apps provides visibility and control over cloud-based applications to prevent security risks.

---

138. How does Azure Log Analytics Agent enhance security monitoring?

A) Collects security logs and metrics for advanced analysis
B) Encrypts all API calls
C) Manages Azure billing
D) Provides automatic firewall configuration

✅ Answer: A) Collects security logs and metrics for advanced analysis
Explanation: Log Analytics Agent gathers security data from Azure resources to detect and respond to threats.

---

139. What is the function of Azure Access Reviews?

A) Helps organizations periodically validate and review user access permissions
B) Encrypts storage accounts
C) Optimizes virtual machine performance
D) Blocks DDoS attacks

✅ Answer: A) Helps organizations periodically validate and review user access permissions
Explanation: Access Reviews ensure that only authorized users retain access to Azure resources.

---

140. How does Azure Traffic Manager contribute to security?

A) Provides failover and geo-routing to improve application availability and resilience
B) Encrypts network traffic
C) Manages Azure billing
D) Monitors SQL database performance

✅ Answer: A) Provides failover and geo-routing to improve application availability and resilience
Explanation: Azure Traffic Manager ensures that applications remain available even in case of regional failures.

---

141. What security feature does Azure Virtual Network (VNet) NAT Gateway provide?

A) Secures outbound internet traffic from Azure Virtual Networks
B) Encrypts Azure SQL Database connections
C) Blocks all incoming traffic from public IPs
D) Manages Azure user authentication

✅ Answer: A) Secures outbound internet traffic from Azure Virtual Networks
Explanation: Azure VNet NAT Gateway provides a secure and scalable outbound internet connection, preventing direct exposure of VMs.

---

142. How does Azure Web Application Firewall (WAF) DRS Mode improve security?

A) It automatically mitigates detected threats without requiring manual intervention
B) It encrypts API requests by default
C) It prevents DDoS attacks on Azure virtual machines
D) It manages Azure storage encryption

✅ Answer: A) It automatically mitigates detected threats without requiring manual intervention
Explanation: Azure WAF’s Default Rule Set (DRS) proactively blocks malicious web traffic and prevents attacks.

---

143. What does Azure Bastion’s IP-Based Connection feature provide?

A) Secure RDP/SSH access to Azure VMs via specific IP addresses
B) Encryption of all database transactions
C) A firewall for managing inbound and outbound traffic
D) Auto-scaling for Azure virtual machines

✅ Answer: A) Secure RDP/SSH access to Azure VMs via specific IP addresses
Explanation: Azure Bastion allows administrators to securely access VMs without exposing them to the public internet.

---

144. How does Azure AD Conditional Access Named Locations improve security?

A) Allows organizations to define trusted geographic locations for access policies
B) Encrypts all user authentication requests
C) Manages Azure network security groups
D) Blocks unauthorized API requests

✅ Answer: A) Allows organizations to define trusted geographic locations for access policies
Explanation: Named Locations enable organizations to restrict access based on geographical regions.

---

145. What does Azure Security Center’s Adaptive Application Controls feature do?

A) Prevents execution of unauthorized applications on Azure VMs
B) Encrypts all stored data
C) Blocks all external traffic to an Azure subscription
D) Automates software deployments

✅ Answer: A) Prevents execution of unauthorized applications on Azure VMs
Explanation: Adaptive Application Controls in Defender for Cloud prevent malware and unauthorized software from running on virtual machines.

---

146. What is the primary purpose of Azure Key Vault’s Soft Delete and Purge Protection?

A) Prevents accidental or malicious deletion of cryptographic keys and secrets
B) Blocks DDoS attacks on API endpoints
C) Encrypts all stored objects by default
D) Monitors Azure networking performance

✅ Answer: A) Prevents accidental or malicious deletion of cryptographic keys and secrets
Explanation: Soft Delete and Purge Protection ensure that deleted secrets and keys can be recovered if necessary.

---

147. What does Microsoft Defender for Identity (MDI) primarily protect?

A) On-premises Active Directory environments from identity-based threats
B) Azure Virtual Machines from malware
C) SQL databases from unauthorized queries
D) API traffic from external attacks

✅ Answer: A) On-premises Active Directory environments from identity-based threats
Explanation: MDI detects lateral movement, brute-force attacks, and other identity-based security threats.

---

148. What is the primary function of Azure Security Center Regulatory Compliance Dashboard?

A) Provides an overview of an organization’s compliance with industry security standards
B) Optimizes virtual machine cost management
C) Monitors Azure API traffic performance
D) Encrypts storage account contents

✅ Answer: A) Provides an overview of an organization’s compliance with industry security standards
Explanation: The Regulatory Compliance Dashboard helps organizations maintain compliance with security standards like ISO 27001, GDPR, and PCI-DSS.

---

149. How does Azure Policy Compliance Scanning enhance security?

A) Automatically scans Azure resources for security misconfigurations
B) Encrypts all data stored in Azure SQL databases
C) Improves network throughput for secure communications
D) Blocks unauthorized user logins

✅ Answer: A) Automatically scans Azure resources for security misconfigurations
Explanation: Azure Policy Compliance Scanning helps organizations enforce security best practices and identify non-compliant resources.

---

150. How does Azure Application Gateway v2 enhance security?

A) Provides SSL offloading and Web Application Firewall (WAF) integration
B) Encrypts Azure AD authentication requests
C) Prevents unauthorized network peering
D) Blocks Azure Storage access from external applications

✅ Answer: A) Provides SSL offloading and Web Application Firewall (WAF) integration
Explanation: Application Gateway v2 secures web applications by handling SSL termination and integrating with WAF.

---

151. What is the primary function of Azure AD Privileged Access Groups?

A) Restrict access to high-privilege roles using just-in-time (JIT) controls
B) Encrypt all stored secrets
C) Automate software patches for virtual machines
D) Improve API response times

✅ Answer: A) Restrict access to high-privilege roles using just-in-time (JIT) controls
Explanation: Privileged Access Groups help secure high-risk roles by requiring additional security measures.

---

152. How does Azure Firewall Forced Tunneling improve security?

A) Ensures that all outbound traffic flows through a designated security appliance
B) Encrypts all SQL database transactions
C) Blocks unauthorized API requests
D) Manages Azure cost optimization

✅ Answer: A) Ensures that all outbound traffic flows through a designated security appliance
Explanation: Forced Tunneling directs outbound traffic through a specified firewall or proxy to enhance security.

---

153. What does Azure Sentinel Hunting Queries enable security teams to do?

A) Proactively search for security threats using log data and analytics
B) Encrypt Azure Virtual Network traffic
C) Automatically patch virtual machines
D) Optimize API performance

✅ Answer: A) Proactively search for security threats using log data and analytics
Explanation: Hunting Queries in Sentinel allow security teams to proactively detect threats based on behavioral analytics.

---

154. What does Microsoft Defender for Storage provide?

A) Malware scanning and advanced threat protection for Azure Blob Storage
B) Automatic database indexing
C) SQL query optimization
D) Firewall security for network access

✅ Answer: A) Malware scanning and advanced threat protection for Azure Blob Storage
Explanation: Defender for Storage detects malicious activity, including data exfiltration and malware uploads.

---

155. How does Azure AD Password Protection Custom Banned List improve security?

A) Prevents users from using weak or compromised passwords
B) Encrypts authentication requests
C) Blocks network access for external users
D) Improves storage performance

✅ Answer: A) Prevents users from using weak or compromised passwords
Explanation: The Custom Banned List ensures that users do not use commonly breached or weak passwords.

---

156. What does Azure Monitor Private Link Access do?

A) Enables secure and private monitoring of Azure resources
B) Encrypts all Azure SQL connections
C) Blocks all external network traffic
D) Manages virtual machine scale sets

✅ Answer: A) Enables secure and private monitoring of Azure resources
Explanation: Private Link Access ensures that monitoring data remains within a private network, improving security.

---

157. How does Azure Managed HSM (Hardware Security Module) improve key security?

A) Provides FIPS 140-2 Level 3-certified key storage and management
B) Encrypts all virtual machine logs
C) Blocks API requests from external sources
D) Enhances firewall performance

✅ Answer: A) Provides FIPS 140-2 Level 3-certified key storage and management
Explanation: Azure Managed HSM provides high-security storage for cryptographic keys, ensuring compliance with strict regulations.

---

158. What does Microsoft Defender for IoT Threat Intelligence provide?

A) Identifies and mitigates security threats in IoT devices
B) Encrypts IoT device communication
C) Optimizes IoT network traffic
D) Manages IoT firmware updates

✅ Answer: A) Identifies and mitigates security threats in IoT devices
Explanation: Defender for IoT analyzes network behavior to detect suspicious activities.

---

159. What does Azure SQL Ledger enhance in security?

A) Provides tamper-proof, blockchain-like protection for database transactions
B) Encrypts all SQL queries
C) Blocks unauthorized API access
D) Optimizes database indexing

✅ Answer: A) Provides tamper-proof, blockchain-like protection for database transactions
Explanation: Azure SQL Ledger ensures data integrity by preventing unauthorized modifications.

---

160. How does Azure Virtual Machine Host-Based Encryption improve security?

A) Encrypts all data stored on a VM’s local disks
B) Monitors VM health
C) Blocks API access
D) Manages VM resource scaling

✅ Answer: A) Encrypts all data stored on a VM’s local disks
Explanation: Host-Based Encryption protects VM disk data against unauthorized access.

---

161. What does Microsoft Defender for Key Vault protect against?

A) Unauthorized access and unusual activities in Azure Key Vault
B) Network latency issues
C) Virtual machine performance degradation
D) Cost inefficiencies in Azure billing

✅ Answer: A) Unauthorized access and unusual activities in Azure Key Vault
Explanation: Microsoft Defender for Key Vault monitors and alerts against potential threats like excessive secret retrievals, brute-force attempts, and anomalous access patterns.

---

162. What security benefit does Azure Virtual Machine Just-in-Time (JIT) Access provide?

A) Minimizes attack surfaces by allowing VM access only when needed
B) Automatically encrypts all VM disks
C) Restricts network traffic using NSGs
D) Reduces VM resource consumption

✅ Answer: A) Minimizes attack surfaces by allowing VM access only when needed
Explanation: JIT access restricts VM access by default and grants access only when requested and approved, reducing exposure to attacks.

---

163. What is the primary function of Azure Entra Permissions Management?

A) Detects and manages excessive and unused permissions across cloud environments
B) Encrypts Azure API endpoints
C) Blocks unauthorized traffic from external sources
D) Monitors subscription cost anomalies

✅ Answer: A) Detects and manages excessive and unused permissions across cloud environments
Explanation: Azure Entra Permissions Management helps organizations enforce the principle of least privilege by identifying excessive permissions.

---

164. How does Microsoft Defender for SQL improve database security?

A) Provides real-time threat detection for SQL injection and suspicious activities
B) Encrypts database queries
C) Optimizes database performance
D) Manages database backup schedules

✅ Answer: A) Provides real-time threat detection for SQL injection and suspicious activities
Explanation: Defender for SQL monitors and detects threats such as anomalous login attempts, SQL injections, and data exfiltration attempts.

---

165. What does Azure Trusted Launch for Virtual Machines protect against?

A) Boot-level malware and rootkits
B) SQL injection attacks
C) API-based DDoS attacks
D) Unauthorized network peering

✅ Answer: A) Boot-level malware and rootkits
Explanation: Trusted Launch ensures that VMs boot securely by preventing unauthorized firmware or malware from running during startup.

---

166. How does Azure AD Cross-Tenant Access Policies improve security?

A) Controls how external Azure AD tenants interact with internal users and resources
B) Encrypts external network traffic
C) Restricts all guest user access
D) Automates cost optimization for Azure tenants

✅ Answer: A) Controls how external Azure AD tenants interact with internal users and resources
Explanation: Cross-Tenant Access Policies enable organizations to define granular security controls for external collaboration.

---

167. What does the Microsoft Defender External Attack Surface Management (EASM) tool do?

A) Continuously monitors and maps an organization’s external-facing assets for vulnerabilities
B) Encrypts all external data traffic
C) Blocks unauthorized API requests
D) Automates firewall configurations

✅ Answer: A) Continuously monitors and maps an organization’s external-facing assets for vulnerabilities
Explanation: EASM helps organizations discover and secure exposed internet-facing assets that attackers may target.

---

168. How does Azure Policy for Kubernetes (AKS) enhance security?

A) Enforces compliance policies on Kubernetes clusters in Azure
B) Encrypts Kubernetes API calls
C) Manages Azure subscription costs
D) Blocks all unauthorized pod deployments

✅ Answer: A) Enforces compliance policies on Kubernetes clusters in Azure
Explanation: Azure Policy for AKS ensures that Kubernetes clusters comply with organizational security standards and best practices.

---

169. What security feature does Microsoft Defender for DevOps provide?

A) Scans source code and CI/CD pipelines for vulnerabilities
B) Encrypts all Azure DevOps repositories
C) Blocks unauthorized code deployments
D) Optimizes DevOps resource usage

✅ Answer: A) Scans source code and CI/CD pipelines for vulnerabilities
Explanation: Defender for DevOps integrates security checks into CI/CD pipelines to detect and mitigate risks in development workflows.

---

170. What does Azure Private 5G Core provide in terms of security?

A) Secure and private 5G network connectivity for enterprise environments
B) Encrypts all network traffic by default
C) Optimizes virtual machine networking performance
D) Blocks unauthorized SIM card activations

✅ Answer: A) Secure and private 5G network connectivity for enterprise environments
Explanation: Azure Private 5G Core ensures secure, isolated 5G network access for organizations, reducing risks from public network exposure.

---

171. What is the main function of Microsoft Defender Threat Intelligence?

A) Provides real-time threat intelligence by mapping attacker infrastructure
B) Encrypts all DNS queries
C) Blocks Azure VM deployments from unauthorized sources
D) Manages cloud cost anomalies

✅ Answer: A) Provides real-time threat intelligence by mapping attacker infrastructure
Explanation: Microsoft Defender Threat Intelligence analyzes and tracks malicious infrastructure used by cybercriminals to enhance proactive security.

---

172. What does Azure Payment HSM (Hardware Security Module) provide security for?

A) Secure cryptographic key storage for payment processing
B) Automated database indexing
C) Virtual network access control
D) API traffic monitoring

✅ Answer: A) Secure cryptographic key storage for payment processing
Explanation: Azure Payment HSM provides a secure, PCI-compliant environment for storing and managing cryptographic keys used in financial transactions.

---

173. How does Azure Firewall Premium enhance protection against cyber threats?

A) Includes TLS inspection, intrusion prevention, and advanced threat intelligence
B) Encrypts all outbound traffic
C) Blocks all external access to Azure Storage accounts
D) Optimizes cloud subscription costs

✅ Answer: A) Includes TLS inspection, intrusion prevention, and advanced threat intelligence
Explanation: Azure Firewall Premium provides deep packet inspection and threat intelligence-based filtering to enhance security.

---

174. What does Microsoft Purview Insider Risk Management monitor?

A) Suspicious insider activities such as data leaks and policy violations
B) Network traffic optimization
C) Cost management for Azure subscriptions
D) Unauthorized firewall rule modifications

✅ Answer: A) Suspicious insider activities such as data leaks and policy violations
Explanation: Insider Risk Management helps detect and mitigate threats from employees or contractors who may be misusing access privileges.

---

175. What does Microsoft Defender for Storage protect against?

A) Malware and data exfiltration in Azure Blob Storage
B) SQL injection attacks on databases
C) Unauthorized user access to virtual machines
D) Network-based DDoS attacks

✅ Answer: A) Malware and data exfiltration in Azure Blob Storage
Explanation: Defender for Storage detects suspicious access patterns and malicious file uploads in Azure Blob Storage.

---

176. How does Azure Confidential Computing protect data?

A) Encrypts data while in use, ensuring sensitive computations remain secure
B) Blocks unauthorized network traffic
C) Restricts API access based on user roles
D) Prevents data loss due to accidental deletion

✅ Answer: A) Encrypts data while in use, ensuring sensitive computations remain secure
Explanation: Azure Confidential Computing keeps data encrypted during processing, protecting against unauthorized access.

---

177. What does Microsoft Defender for Endpoint’s Attack Surface Reduction (ASR) feature do?

A) Blocks malware and exploits by restricting high-risk system behaviors
B) Encrypts all endpoint traffic
C) Blocks Azure virtual machine deployments
D) Monitors user authentication logs

✅ Answer: A) Blocks malware and exploits by restricting high-risk system behaviors
Explanation: ASR policies limit risky behaviors such as script execution, preventing malware from exploiting vulnerabilities.

---

178. How does Azure AD Workload Identity Federation improve security?

A) Allows secure authentication for cloud workloads without storing credentials
B) Encrypts all workload API traffic
C) Blocks unauthorized VM deployments
D) Prevents DDoS attacks on API endpoints

✅ Answer: A) Allows secure authentication for cloud workloads without storing credentials
Explanation: Workload Identity Federation enables applications to authenticate with Azure AD securely, eliminating the need for secrets.

---

179. What is the primary function of Microsoft Defender for IoT Edge Security?

A) Protects edge devices from cyber threats and vulnerabilities
B) Encrypts all IoT device communications
C) Manages firmware updates for IoT devices
D) Blocks external access to IoT networks

✅ Answer: A) Protects edge devices from cyber threats and vulnerabilities
Explanation: Defender for IoT provides security monitoring and threat detection for edge computing devices.

---

180. What does Azure Identity Protection’s Risk-Based Conditional Access provide?

A) Dynamically adjusts authentication requirements based on user risk level
B) Encrypts Azure AD login credentials
C) Prevents API-based authentication attempts
D) Blocks all unauthorized data access

✅ Answer: A) Dynamically adjusts authentication requirements based on user risk level
Explanation: Risk-Based Conditional Access evaluates user behavior and adjusts security requirements accordingly.

---

181. What is the purpose of Azure AD Identity Protection Risk Policies?

A) Automatically detects and mitigates suspicious sign-ins based on user risk
B) Encrypts Azure AD authentication requests
C) Blocks all external network traffic
D) Manages Azure cost anomalies

✅ Answer: A) Automatically detects and mitigates suspicious sign-ins based on user risk
Explanation: Azure AD Identity Protection uses AI and analytics to detect and respond to anomalous login activities.

---

182. How does Azure Front Door enhance security for web applications?

A) Provides global load balancing and Web Application Firewall (WAF) protection
B) Encrypts all web traffic
C) Blocks SQL injection attacks
D) Monitors Azure billing and subscription usage

✅ Answer: A) Provides global load balancing and Web Application Firewall (WAF) protection
Explanation: Azure Front Door helps protect against DDoS attacks and malicious web traffic while improving application performance.

---

183. What is the primary function of Azure Firewall Threat Intelligence?

A) Blocks traffic from known malicious IPs based on Microsoft threat intelligence
B) Encrypts data at rest in Azure Storage
C) Improves Azure billing transparency
D) Manages Kubernetes security policies

✅ Answer: A) Blocks traffic from known malicious IPs based on Microsoft threat intelligence
Explanation: Azure Firewall uses real-time threat intelligence to identify and block malicious traffic.

---

184. What does Microsoft Defender for Cloud Apps do to enhance security?

A) Monitors cloud-based applications for threats and unauthorized access
B) Encrypts cloud application data
C) Prevents SQL injection attacks
D) Blocks all non-Microsoft cloud applications

✅ Answer: A) Monitors cloud-based applications for threats and unauthorized access
Explanation: Defender for Cloud Apps provides visibility, analytics, and security controls for SaaS applications.

---

185. How does Azure Private Link improve security?

A) Establishes a private connection to Azure services without exposing traffic to the public internet
B) Encrypts network traffic between Azure and on-premises environments
C) Blocks all external API calls
D) Prevents unauthorized guest user access

✅ Answer: A) Establishes a private connection to Azure services without exposing traffic to the public internet
Explanation: Azure Private Link ensures that data remains within a secure private network.

---

186. What is the function of Azure Sentinel’s Entity Behavior Analytics (EBA)?

A) Detects and correlates suspicious user and entity behaviors across Azure services
B) Encrypts Azure SQL database transactions
C) Improves Azure cost optimization
D) Monitors Kubernetes cluster health

✅ Answer: A) Detects and correlates suspicious user and entity behaviors across Azure services
Explanation: EBA in Azure Sentinel analyzes user and system behaviors to identify potential security threats.

---

187. How does Microsoft Defender for Endpoint’s Automated Investigation and Response (AIR) feature improve security?

A) Automatically analyzes and mitigates detected threats on endpoints
B) Encrypts all network traffic
C) Blocks unauthorized user logins
D) Manages virtual machine security policies

✅ Answer: A) Automatically analyzes and mitigates detected threats on endpoints
Explanation: AIR in Defender for Endpoint automates security threat investigations and response actions.

---

188. What does Azure Kubernetes Service (AKS) Role-Based Access Control (RBAC) enforce?

A) Limits access to AKS resources based on user roles and permissions
B) Encrypts all Kubernetes API requests
C) Monitors Azure API security logs
D) Blocks all external access to AKS pods

✅ Answer: A) Limits access to AKS resources based on user roles and permissions
Explanation: AKS RBAC helps enforce least privilege access by restricting actions based on user roles.

---

189. What is the primary benefit of using Microsoft Defender for DNS?

A) Detects and alerts on suspicious DNS queries
B) Encrypts all DNS requests
C) Blocks unauthorized access to Azure Storage
D) Manages cost optimizations for Azure networking

✅ Answer: A) Detects and alerts on suspicious DNS queries
Explanation: Defender for DNS monitors DNS traffic to identify potential threats such as command-and-control (C2) activity.

---

190. What does Azure Network Watcher’s Connection Monitor feature do?

A) Provides real-time network connectivity diagnostics and security insights
B) Encrypts network traffic between virtual networks
C) Blocks unauthorized virtual machine deployments
D) Manages firewall rules for Azure subscriptions

✅ Answer: A) Provides real-time network connectivity diagnostics and security insights
Explanation: Connection Monitor helps detect and troubleshoot network security and performance issues.

---

191. How does Microsoft Defender for IoT protect industrial control systems (ICS)?

A) Monitors and detects cyber threats targeting operational technology (OT) networks
B) Encrypts IoT device firmware updates
C) Blocks unauthorized Azure IoT deployments
D) Manages device authentication policies

✅ Answer: A) Monitors and detects cyber threats targeting operational technology (OT) networks
Explanation: Defender for IoT provides security monitoring for industrial and IoT environments.

---

192. What security measure does Azure Key Vault Managed HSM enforce?

A) Hardware-based key storage compliant with FIPS 140-2 Level 3
B) Encryption of all Azure SQL database queries
C) Automated rotation of all API keys
D) Blocking of unauthorized API calls

✅ Answer: A) Hardware-based key storage compliant with FIPS 140-2 Level 3
Explanation: Managed HSM provides a highly secure key management solution for cryptographic operations.

---

193. What does Azure Monitor’s Log Analytics Workspace provide in terms of security?

A) Collects and analyzes security logs for threat detection
B) Encrypts all stored log data
C) Blocks unauthorized log access
D) Monitors firewall rule changes

✅ Answer: A) Collects and analyzes security logs for threat detection
Explanation: Log Analytics Workspace aggregates security events and provides insights for detecting potential threats.

---

194. How does Azure Policy Guest Configuration improve VM security?

A) Enforces OS-level security settings and compliance policies
B) Blocks unauthorized API requests
C) Encrypts all virtual machine disk data
D) Manages virtual network access policies

✅ Answer: A) Enforces OS-level security settings and compliance policies
Explanation: Guest Configuration ensures that VM configurations comply with security and compliance standards.

---

195. What does Microsoft Defender for Identity do to protect hybrid environments?

A) Detects identity-based threats in on-premises Active Directory and Azure AD
B) Encrypts user credentials in Active Directory
C) Manages Azure user access policies
D) Blocks unauthorized SQL queries

✅ Answer: A) Detects identity-based threats in on-premises Active Directory and Azure AD
Explanation: Defender for Identity helps detect identity compromise and lateral movement attacks in hybrid environments.

---

196. What does Azure Lighthouse provide for security management?

A) Secure, delegated management of multiple Azure tenants
B) Blocks unauthorized access to Azure Security Center
C) Encrypts all API requests by default
D) Prevents external users from creating Azure policies

✅ Answer: A) Secure, delegated management of multiple Azure tenants
Explanation: Azure Lighthouse allows service providers to securely manage multiple customer environments.

---

197. What security feature does Azure SQL Ledger provide?

A) Tamper-proof, blockchain-based integrity for database transactions
B) Encryption of all SQL queries
C) Automated database indexing
D) Blocking of unauthorized database access

✅ Answer: A) Tamper-proof, blockchain-based integrity for database transactions
Explanation: SQL Ledger ensures data integrity by creating an immutable record of database transactions.

---

198. How does Azure AD Privileged Identity Management (PIM) improve security?

A) Provides just-in-time (JIT) access for privileged roles
B) Encrypts all Azure AD authentication requests
C) Blocks unauthorized access to virtual machines
D) Manages API security configurations

✅ Answer: A) Provides just-in-time (JIT) access for privileged roles
Explanation: PIM enhances security by limiting access to privileged roles only when necessary.

---

199. What is the purpose of Azure Confidential Ledger?

A) Provides an immutable, blockchain-based ledger for secure data storage
B) Encrypts all API traffic
C) Monitors Azure subscription costs
D) Blocks unauthorized Azure policy changes

✅ Answer: A) Provides an immutable, blockchain-based ledger for secure data storage
Explanation: Confidential Ledger ensures tamper-proof record-keeping for sensitive transactions.

---

200. How does Azure Managed Disks Encryption at Rest improve security?

A) Automatically encrypts all data stored on Azure Managed Disks
B) Blocks unauthorized disk snapshots
C) Prevents SQL injection attacks
D) Manages virtual machine access policies

✅ Answer: A) Automatically encrypts all data stored on Azure Managed Disks
Explanation: Encryption at Rest ensures that disk data remains secure, protecting it from unauthorized access.