Microsoft Cybersecurity Architect Free Sample Questions

The core requirement is to isolate administrative tasks from daily user activities to prevent credential theft. Privileged Access Workstations (PAWs) are specifically designed for this purpose. A PAW provides a dedicated, hardened operating system for sensitive tasks, completely separate from the user's standard workstation used for email and browsing. This directly prevents credential theft vectors like phishing and browser exploits from compromising high-privilege accounts. While Defender for Identity is crucial for detection and PIM for just-in-time access, neither provides the required task isolation at the workstation level.

Microsoft Entra Permissions Management is the Cloud Infrastructure Entitlement Management (CIEM) solution from Microsoft. It is designed to provide comprehensive visibility and control over permissions for any identity and any resource across multi-cloud infrastructures, including Azure, AWS, and GCP. It helps enforce the principle of least privilege by discovering unused or excessive permissions. Azure Arc extends the Azure control plane, and Defender for Cloud provides posture management, but neither is primarily a CIEM solution for managing granular permissions across clouds.

Microsoft Defender for Containers provides vulnerability scanning for images in Azure Container Registry and real-time threat detection for containerized environments. Azure Policy for Kubernetes can then enforce policies at deployment time, such as blocking the deployment of images that have known vulnerabilities identified by Defender for Containers. This combination directly addresses the requirement to scan images and block non-compliant deployments.

The requirements specifically call for securing data in Azure SQL Database and Azure Blob Storage. Microsoft Defender for SQL is designed to discover and classify sensitive data, manage vulnerabilities, and detect anomalous activities in SQL databases. Microsoft Defender for Storage provides advanced threat protection for Azure Storage, detecting unusual and potentially harmful attempts to access or exploit storage accounts. Together, these two plans directly address the specified data security needs.

Microsoft Sentinel Playbooks are collections of procedures that can be run from Microsoft Sentinel in response to an alert or incident. Playbooks are built on Azure Logic Apps, which provide a powerful, customizable, and scalable engine for creating automated workflows. This allows for integration with various services like Microsoft Teams, Azure AD, and ServiceNow to perform the required actions (post message, disable user, create ticket), fulfilling the SOAR (Security Orchestration, Automation, and Response) requirement.

Azure Firewall Premium is the ideal choice for this scenario. It is a managed, cloud-native firewall service that can be deployed in a central hub VNet to inspect both east-west (spoke-to-spoke) and north-south (outbound to internet) traffic. The Premium SKU specifically provides advanced capabilities like TLS inspection to decrypt and inspect outbound traffic, a signature-based IDPS to detect and prevent malicious activity, and URL filtering for web policies. NSGs operate at Layer 4 and lack these advanced features, while Application Gateway is primarily for protecting inbound web traffic.

This statement is false. While detection tools are critical for prevention, a comprehensive ransomware resiliency strategy must prioritize business continuity and disaster recovery (BCDR). The assumption should always be that a preventative control might fail. Therefore, a robust, tested, and secure backup and recovery solution is the ultimate safety net to ensure the business can recover its data and operations without paying a ransom. Microsoft security best practices emphasize a balanced approach but highlight BCDR as a cornerstone of ransomware resilience.

Microsoft Entra Private Access (which includes the capabilities of the former Azure AD Application Proxy) is the correct solution. It acts as a Zero Trust Network Access (ZTNA) service. It allows publishing on-premises web applications to external users through the Microsoft Entra service. Lightweight connectors are installed on-premises and make outbound connections to the service, meaning no inbound firewall ports need to be opened. It fully integrates with Azure AD, allowing pre-authentication and the application of Conditional Access policies before granting access to the on-premises application, perfectly matching all the requirements.

Microsoft Defender for Cloud Apps is Microsoft's Cloud Access Security Broker (CASB) solution. It directly addresses the requirements by providing capabilities for shadow IT discovery (discovering and assessing cloud apps used by the organization) and by acting as a reverse proxy to apply session controls. These session controls can enforce policies like blocking downloads, uploads, or copy/paste actions for specific users or devices, which is exactly what is needed to prevent data leakage to unmanaged devices.

The Cloud Adoption Framework emphasizes establishing governance from the start. The most effective and scalable way to enforce security standards across an entire Azure estate is by using Azure Policy assignments or Azure Blueprints at a high level in the management group hierarchy. This ensures that any new subscription created under that management group automatically inherits the policies, guaranteeing compliance without manual intervention. This approach is a core principle of designing and governing Azure landing zones.