Practice Test #4

A stored access policy is used with Azure Storage to control shared access signatures for blobs, files, queues, or tables. It has no role in Azure SQL Database Always Encrypted. Always Encrypted relies on SQL key metadata and external key stores such as Azure Key Vault, not Storage access policies. Therefore, this option is unrelated to decrypting SQL data.

A shared access signature grants delegated access to Azure Storage resources and is not used by Azure SQL Database Always Encrypted. Decryption of Always Encrypted data depends on the CEK and CMK hierarchy, not on Storage tokens. Even if Azure Key Vault is involved, access is managed through identity and key permissions rather than SAS. This makes SAS irrelevant in this scenario.

User credentials allow a developer or application to authenticate to Azure SQL Database, but they are not one of the two specific pieces of Always Encrypted information needed for decryption. The question is focused on the encryption architecture, which depends on the CEK and CMK. Authentication alone does not enable decryption unless the client also has the necessary key metadata and access to the CMK. Therefore, credentials are necessary operationally but not the intended answer here.

Creating a new subnet is only appropriate when requirements explicitly call for additional segmentation, address space separation, or dedicated subnets for services (e.g., AzureFirewallSubnet, GatewaySubnet). It does not inherently improve security posture unless paired with routing/NSGs/firewalls. If the issue is that an existing subnet lacks an NSG, adding a new subnet is unnecessary and doesn’t meet the immediate control requirement.

Removing NSGs from Subnet11 and Subnet13 reduces network segmentation and violates least-privilege principles. NSGs are commonly required to restrict inbound/outbound flows and to control east-west traffic. This option might seem appealing if someone assumes NSGs are causing connectivity issues, but the prompt is about meeting technical requirements for VNetwork1, which typically implies adding/enforcing controls, not removing them.

Configuring DDoS protection for VNetwork1 (typically DDoS Network Protection Standard) helps mitigate large-scale volumetric and protocol attacks and provides enhanced telemetry and cost protection. However, it does not control which ports/protocols are allowed between subnets or from the internet. If the requirement is about subnet security rules or restricting traffic, DDoS protection is not the first or primary control to implement.

Azure AD Privileged Identity Management (PIM) provides just-in-time elevation for privileged roles in Azure AD and Azure RBAC, such as Global Administrator or Owner. It helps control who can activate administrative permissions and for how long, but it does not manage inbound network access to a VM. Even if a user activates a privileged role through PIM, TCP 3389 would still need to be controlled separately through networking rules. Therefore, PIM addresses identity governance rather than temporary opening and closing of the RDP port.

An application security group (ASG) is used to logically group virtual machine NICs so that NSG rules can target those groups more easily. This simplifies rule administration, especially when multiple VMs need the same network policy, but it does not provide request-based or time-limited access. If RDP were allowed through an NSG rule referencing an ASG, that access would remain in place until an administrator changed the rule. As a result, ASGs help organize security rules but do not meet the requirement to keep RDP closed until an authorized user requests access.

Azure AD Conditional Access evaluates sign-in conditions for Azure AD-authenticated applications and services, such as requiring MFA, compliant devices, or trusted locations. It is focused on authentication and authorization decisions at the identity layer, not on controlling inbound traffic to a VM's network port. Remote Desktop exposure on TCP 3389 is governed by NSGs, Azure Firewall, or similar network controls, not Conditional Access policies. Therefore, Conditional Access cannot ensure that the RDP port remains closed until a user requests temporary access.

An Azure Storage account is commonly used as a diagnostic destination for archiving logs cheaply or meeting long-term retention requirements. However, Azure Monitor alert rules (especially log query alerts) do not require a storage account to exist. Storage is optional for retention/archival and is not the primary prerequisite to create security alerts in Azure Monitor.

An Azure Event Hub is used to stream logs/events to external systems (for example, a third-party SIEM) or for near-real-time event processing. While it can be a diagnostic destination, Azure Monitor alerting does not require Event Hubs. It’s an integration/streaming choice, not the first step to prepare an Azure subscription for Azure Monitor security alerts.

An Azure Automation account is used for runbooks, update management (legacy), and automation tasks. It can be invoked by an alert action (via webhook/logic app) to remediate issues, but it is not required to create Azure Monitor alerts. You typically create automation only after alerts exist and you’ve defined response workflows.

Security administrator primarily manages security-related features (security policies, alerts, identity protection configurations, and some Conditional Access-related tasks depending on scope). This role is not intended for application lifecycle management and typically does not include the ability to grant tenant-wide admin consent for application permissions. It’s a common distractor because it sounds broadly privileged, but it’s not the correct capability for app consent.

User administrator can create and manage users and groups and handle some access-related tasks (like password resets and user properties). However, it does not provide the necessary permissions to manage application consent at the tenant level. It may appear plausible because it’s an administrative role, but it’s focused on identity objects rather than application permission governance.

Application developer (or similar developer-focused permissions) typically allows creating and managing app registrations depending on tenant settings (for example, whether users can register applications). However, it does not grant the authority to provide tenant-wide admin consent for permissions. Developers can request permissions, but an admin role is required to approve/grant admin consent for the organization.

Security administrator is designed for managing security settings, alerts, and security-related policies across the tenant. It does not provide the permissions needed to reconfigure Azure AD Connect synchronization options or directory synchronization behavior. Although synchronization has security implications, this role's scope is not intended for hybrid identity synchronization administration. Therefore, it is not an appropriate role for this task.

Global administrator certainly has enough permissions to modify Azure AD Connect synchronization options, but it violates the principle of least privilege in this question. Because a lower-privileged role from the options can perform the required task, assigning Global administrator would grant unnecessary tenant-wide authority. On Microsoft exams, if a less-privileged valid role is available, it is usually the correct choice. Therefore, Global administrator is not the best answer here.

A security group with Assigned membership is static and requires manual administration whenever new virtual machines are added. That directly conflicts with the requirement to automatically add any new Windows Server 2019 virtual machines. In addition, Azure Automation Update Management does not use Azure AD security groups as the deployment targeting mechanism. Therefore this option fails both functionally and architecturally.

A security group with Dynamic Device membership can automatically update membership in Azure AD, but Azure Automation Update Management does not target update deployments through Azure AD device groups. Even if the group correctly contains the VMs, the deployment scope would not be driven from that group. This is a common confusion between identity grouping and operational targeting. As a result, it would not be the correct configuration for Update1.

'Dynamic group query' is not the actual construct used when defining Azure Automation Update Management deployment scope in this scenario. The dynamic behavior is achieved through a Log Analytics saved search backed by a Kusto query, not by selecting a separate 'dynamic group query' object. While the wording sounds plausible, it is imprecise for the service feature being tested. On Microsoft exams, the expected answer for this type of dynamic inclusion in Update Management is the KQL query option.