You are designing an enterprise security architecture based on the Microsoft Zero Trust reference model. What are the three core foundational principles that govern Zero Trust implementation across all workloads?
- Verify explicitly, Use least privileged access, and Assume breach (Correct)
- Trust internal networks, Require complex passwords, and Encrypt disks
- Perimeter isolation, Block public cloud, and Centralize firewalls
- Enforce VPN access, Disable cloud apps, and Audit quarterly
Explanation: The three foundational guiding principles of the Microsoft Zero Trust architecture are: Verify explicitly, Use least privileged access, and Assume breach.
You are designing an enterprise security architecture based on the Microsoft Zero Trust reference model. What are the three core foundational principles that govern Zero Trust implementation across all workloads?
- Verify explicitly, Use least privileged access, and Assume breach (Correct)
- Trust internal networks, Require complex passwords, and Encrypt disks
- Perimeter isolation, Block public cloud, and Centralize firewalls
- Enforce VPN access, Disable cloud apps, and Audit quarterly
Explanation: The three foundational guiding principles of the Microsoft Zero Trust architecture are: Verify explicitly, Use least privileged access, and Assume breach.
An architect needs to align an organization multi-cloud security strategy with the Microsoft Cloud Adoption Framework (CAF) secure methodology. What are the four core elements defined under the CAF security discipline?
- Business alignment, People, Process, and Technology disciplines (Correct)
- Compute, Storage, Networking, and Database management
- Plan, Build, Run, and Decommission
- Detection, Investigation, Hunting, and Remediation
Explanation: The Cloud Adoption Framework (CAF) security methodology focuses on four core operational components: Business alignment, People, Process, and Technology/Security disciplines.
An architect needs to align an organization multi-cloud security strategy with the Microsoft Cloud Adoption Framework (CAF) secure methodology. What are the four core elements defined under the CAF security discipline?
- Business alignment, People, Process, and Technology disciplines (Correct)
- Compute, Storage, Networking, and Database management
- Plan, Build, Run, and Decommission
- Detection, Investigation, Hunting, and Remediation
Explanation: The Cloud Adoption Framework (CAF) security methodology focuses on four core operational components: Business alignment, People, Process, and Technology/Security disciplines.
You are evaluating an enterprise against the Microsoft Cybersecurity Reference Architectures (MCRA). Which security component in MCRA acts as the primary policy decision point (PDP) for modern identity, access, and context evaluation?
- Microsoft Entra Conditional Access (Correct)
- Azure Route Tables
- Windows Defender Firewall
- DNS Private Resolver
Explanation: In MCRA and Zero Trust architecture, Microsoft Entra Conditional Access serves as the primary Policy Decision Point (PDP), evaluating user identity, device compliance, risk signals, and session context before granting access.
You are evaluating an enterprise against the Microsoft Cybersecurity Reference Architectures (MCRA). Which security component in MCRA acts as the primary policy decision point (PDP) for modern identity, access, and context evaluation?
- Microsoft Entra Conditional Access (Correct)
- Azure Route Tables
- Windows Defender Firewall
- DNS Private Resolver
Explanation: In MCRA and Zero Trust architecture, Microsoft Entra Conditional Access serves as the primary Policy Decision Point (PDP), evaluating user identity, device compliance, risk signals, and session context before granting access.
Your organization must maintain business resilience and defend against human-operated ransomware attacks. Which architectural priority should you implement first to limit adversary lateral movement across corporate networks?
- Separating control planes using PAWs, tiering, and removing local admin rights (Correct)
- Purchasing larger storage arrays for rapid data copying
- Disabling all Multi-Factor Authentication on servers
- Reinstalling Windows Server 2008 R2 domain controllers
Explanation: Separating administrative control planes using dedicated Privileged Access Workstations (PAWs), enforcing tiered administrative boundaries, and eliminating local administrative rights are critical to halting credential theft and lateral movement.
Your organization must maintain business resilience and defend against human-operated ransomware attacks. Which architectural priority should you implement first to limit adversary lateral movement across corporate networks?
- Separating control planes using PAWs, tiering, and removing local admin rights (Correct)
- Purchasing larger storage arrays for rapid data copying
- Disabling all Multi-Factor Authentication on servers
- Reinstalling Windows Server 2008 R2 domain controllers
Explanation: Separating administrative control planes using dedicated Privileged Access Workstations (PAWs), enforcing tiered administrative boundaries, and eliminating local administrative rights are critical to halting credential theft and lateral movement.
You are designing compliance adherence across multiple Azure subscriptions. You need to enforce mandatory regulatory controls (such as NIST SP 800-53 or ISO 27001) and prevent unauthorized configurations from ever being deployed. What technology should you mandate?
- Azure Policy initiatives (Correct)
- Network Security Group rule tags
- Azure Cost Management budgeting alerts
- ExpressRoute circuit peering
Explanation: Azure Policy initiatives (regulatory compliance built-in policy initiatives) enforce governance rules, audit configurations, and block non-compliant resource deployments via Azure Resource Manager.
In the Microsoft Cloud Adoption Framework, what is the primary objective of establishing an "Enterprise-scale landing zone" architecture?
- Provides a scalable, well-architected foundation of governance, identity, and networking (Correct)
- Forces all company applications to run on a single physical server
- Disables internet connectivity across all subscriptions
- Automatically converts on-premises servers into virtual desktops
Explanation: An enterprise-scale landing zone provides a well-architected foundation with pre-configured management groups, subscription boundaries, identity delegation, network topology, and governance policies.
In the Microsoft Cloud Adoption Framework, what is the primary objective of establishing an "Enterprise-scale landing zone" architecture?
- Provides a scalable, well-architected foundation of governance, identity, and networking (Correct)
- Forces all company applications to run on a single physical server
- Disables internet connectivity across all subscriptions
- Automatically converts on-premises servers into virtual desktops
Explanation: An enterprise-scale landing zone provides a well-architected foundation with pre-configured management groups, subscription boundaries, identity delegation, network topology, and governance policies.
You are evaluating trade-offs between business velocity and security posture for a software development organization. Which approach best embeds security into cloud engineering without slowing deployment velocity?
- Adopting DevSecOps with automated SAST, SCA, and IaC security in CI/CD pipelines (Correct)
- Requiring manual paper signature approval for every code commit
- Disabling production deployments completely
- Permitting developers to deploy directly to production without testing
Explanation: Adopting a DevSecOps model that embeds automated static code analysis, software composition analysis (SCA), and Infrastructure-as-Code (IaC) security checks directly into CI/CD pipelines.
An architect needs to calculate the overall cloud security posture and benchmark improvements across multi-cloud environments (Azure, AWS, GCP). Which native Microsoft metric provides this prioritized insight?
- Microsoft Cloud Security Benchmark secure score in Defender for Cloud (Correct)
- Windows Disk Defragmenter health gauge
- Azure Traffic Manager latency charts
- Microsoft 365 subscription invoice metrics
Explanation: Microsoft Cloud Security Benchmark (MCSB) secure score in Microsoft Defender for Cloud aggregates security findings across cloud providers and calculates a measurable security posture score.
An architect needs to calculate the overall cloud security posture and benchmark improvements across multi-cloud environments (Azure, AWS, GCP). Which native Microsoft metric provides this prioritized insight?
- Microsoft Cloud Security Benchmark secure score in Defender for Cloud (Correct)
- Windows Disk Defragmenter health gauge
- Azure Traffic Manager latency charts
- Microsoft 365 subscription invoice metrics
Explanation: Microsoft Cloud Security Benchmark (MCSB) secure score in Microsoft Defender for Cloud aggregates security findings across cloud providers and calculates a measurable security posture score.
When designing business continuity and disaster recovery (BCDR) for critical workloads, how should immutable backups be architected in Azure to mitigate against malicious deletion by compromised administrators?
- Deploy Azure Backup with Multi-User Authorization (MUA) and Immutable Vaults (Correct)
- Store backup files on public FTP servers without authentication
- Save backup files in an unencrypted folder on the local domain controller
- Email database backups to external personal email accounts daily
Explanation: Deploy Azure Backup with Multi-User Authorization (MUA) via Resource Guard and Immutable Vaults configured in compliance mode, preventing unauthorized backup deletions or policy modifications.
When designing business continuity and disaster recovery (BCDR) for critical workloads, how should immutable backups be architected in Azure to mitigate against malicious deletion by compromised administrators?
- Deploy Azure Backup with Multi-User Authorization (MUA) and Immutable Vaults (Correct)
- Store backup files on public FTP servers without authentication
- Save backup files in an unencrypted folder on the local domain controller
- Email database backups to external personal email accounts daily
Explanation: Deploy Azure Backup with Multi-User Authorization (MUA) via Resource Guard and Immutable Vaults configured in compliance mode, preventing unauthorized backup deletions or policy modifications.
You are assessing compliance with payment card standards (PCI-DSS 4.0). Which portal allows security architects to view Microsoft third-party compliance audit reports, SOC audits, and penetration testing summaries?
- Microsoft Service Trust Portal (STP) (Correct)
- Public Wikipedia compliance page
- Local computer Event Viewer system log
- Exchange Message Trace delivery reports
Explanation: The Microsoft Service Trust Portal (STP) provides direct access to independent third-party audit reports, certifications, regulatory compliance assessments, and penetration testing results.
You are assessing compliance with payment card standards (PCI-DSS 4.0). Which portal allows security architects to view Microsoft third-party compliance audit reports, SOC audits, and penetration testing summaries?
- Microsoft Service Trust Portal (STP) (Correct)
- Public Wikipedia compliance page
- Local computer Event Viewer system log
- Exchange Message Trace delivery reports
Explanation: The Microsoft Service Trust Portal (STP) provides direct access to independent third-party audit reports, certifications, regulatory compliance assessments, and penetration testing results.
In Zero Trust architecture, what is the concept of "Micro-segmentation" when applied to cloud network infrastructure?
- Isolating workloads into granular segments using NSGs, ASGs, and firewalls (Correct)
- Connecting all enterprise devices into a single massive flat subnet
- Compressing network cables to reduce physical packet size
- Splitting router hardware into physically separate rooms
Explanation: Micro-segmentation isolates workloads into granular, software-defined network segments using Network Security Groups (NSGs), application security groups (ASGs), and zero-trust firewalls to prevent lateral spread.
You are designing an identity segmentation model to protect against credential dumping. According to Microsoft privileged access strategy, what are the three operational planes (tiers) in modern access control?
- Control Plane, Management Plane, and Data/User Plane (Correct)
- Tier 0, Tier 1, and Tier 2 on-premises domains only
- Development, Testing, and Production environments
- Public, Private, and Hybrid cloud models
Explanation: The modern enterprise access model defines three operational planes: Control Plane (identity/directory systems), Management Plane (workload configurations and infrastructure), and Data/User Plane (workload assets).
You are designing an identity segmentation model to protect against credential dumping. According to Microsoft privileged access strategy, what are the three operational planes (tiers) in modern access control?
- Control Plane, Management Plane, and Data/User Plane (Correct)
- Tier 0, Tier 1, and Tier 2 on-premises domains only
- Development, Testing, and Production environments
- Public, Private, and Hybrid cloud models
Explanation: The modern enterprise access model defines three operational planes: Control Plane (identity/directory systems), Management Plane (workload configurations and infrastructure), and Data/User Plane (workload assets).
Your executive team requires a threat modeling methodology to evaluate security risks in an upcoming AI-powered financial application. Which methodology is recommended by Microsoft?
- The STRIDE threat modeling methodology (Correct)
- The Waterfall project management methodology
- The Six Sigma manufacturing control methodology
- The Agile sprint estimation framework
Explanation: The STRIDE threat modeling methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Your executive team requires a threat modeling methodology to evaluate security risks in an upcoming AI-powered financial application. Which methodology is recommended by Microsoft?
- The STRIDE threat modeling methodology (Correct)
- The Waterfall project management methodology
- The Six Sigma manufacturing control methodology
- The Agile sprint estimation framework
Explanation: The STRIDE threat modeling methodology categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
You are designing security solutions for remote workers. Corporate laptops must be prohibited from accessing enterprise SaaS applications unless the endpoint operating system is patched and health-verified. Which Zero Trust principle is being enforced?
- Verify explicitly (Correct)
- Use least privileged access
- Assume breach
- Perimeter trust
Explanation: "Verify explicitly" mandates that every access attempt must evaluate all available data points—including user identity, location, device health, service or workload, data classification, and anomalies.
You are designing security solutions for remote workers. Corporate laptops must be prohibited from accessing enterprise SaaS applications unless the endpoint operating system is patched and health-verified. Which Zero Trust principle is being enforced?
- Verify explicitly (Correct)
- Use least privileged access
- Assume breach
- Perimeter trust
Explanation: "Verify explicitly" mandates that every access attempt must evaluate all available data points—including user identity, location, device health, service or workload, data classification, and anomalies.
An organization is migrating legacy monolithic systems to Azure. You need to establish governance guardrails that enforce tags and restrict region deployment across 50 subscriptions. Which structural hierarchy should you design?
- A structured Management Group hierarchy with Azure Policy initiatives assigned (Correct)
- A single flat subscription containing all 50 enterprise departments
- An array of unmanaged resource groups without tags
- A manual Excel spreadsheet reviewed once a year by IT
Explanation: Organize subscriptions into a structured Management Group hierarchy and assign Azure Policy initiatives at the root or intermediate management group level for inherited governance.
An organization is migrating legacy monolithic systems to Azure. You need to establish governance guardrails that enforce tags and restrict region deployment across 50 subscriptions. Which structural hierarchy should you design?
- A structured Management Group hierarchy with Azure Policy initiatives assigned (Correct)
- A single flat subscription containing all 50 enterprise departments
- An array of unmanaged resource groups without tags
- A manual Excel spreadsheet reviewed once a year by IT
Explanation: Organize subscriptions into a structured Management Group hierarchy and assign Azure Policy initiatives at the root or intermediate management group level for inherited governance.
When designing ransomware mitigation, why does Microsoft recommend configuring Customer Lockbox in Microsoft 365 and Azure?
- Ensures Microsoft engineers cannot access customer data without explicit approval (Correct)
- Locks the physical server chassis in the Azure data center
- Prevents employees from logging into work accounts on weekends
- Stores user passwords in a physical vault on company premises
Explanation: Customer Lockbox ensures that Microsoft cloud engineers cannot access customer data during support or service operations without explicit, time-limited approval from the customer administrator.
When designing ransomware mitigation, why does Microsoft recommend configuring Customer Lockbox in Microsoft 365 and Azure?
- Ensures Microsoft engineers cannot access customer data without explicit approval (Correct)
- Locks the physical server chassis in the Azure data center
- Prevents employees from logging into work accounts on weekends
- Stores user passwords in a physical vault on company premises
Explanation: Customer Lockbox ensures that Microsoft cloud engineers cannot access customer data during support or service operations without explicit, time-limited approval from the customer administrator.
You are designing an audit strategy to track changes to administrative role definitions and assignments across multiple Azure subscriptions. Which log repository captures these Azure Resource Manager events?
- Azure Activity Logs (Correct)
- Windows Application Event Logs
- Exchange Message Tracking logs
- Local router NetFlow records
Explanation: Azure Activity Logs record all subscription-level management events (PUT, POST, DELETE) executed against Azure Resource Manager resources, including RBAC role assignments.
You are designing a secure remote administrative access solution for Azure virtual machines without exposing public IP addresses on the internet. Which service should you architect?
- Azure Bastion (Correct)
- Direct public IP address mapping on VM network interfaces
- Open port forwarding on TCP port 3389
- Point-to-Site PPTP VPN
Explanation: Azure Bastion provides secure, fully managed RDP and SSH connectivity to virtual machines directly through the Azure portal via TLS, eliminating the need for public IP addresses on VMs.
You are designing a secure remote administrative access solution for Azure virtual machines without exposing public IP addresses on the internet. Which service should you architect?
- Azure Bastion (Correct)
- Direct public IP address mapping on VM network interfaces
- Open port forwarding on TCP port 3389
- Point-to-Site PPTP VPN
Explanation: Azure Bastion provides secure, fully managed RDP and SSH connectivity to virtual machines directly through the Azure portal via TLS, eliminating the need for public IP addresses on VMs.
In designing a Zero Trust network architecture, why does Microsoft advise against relying on network location (such as corporate office IP or VPN IP) as the primary authenticator for corporate access?
- Perimeter compromise grants lateral trust; access must be verified per request (Correct)
- Corporate network cables are slower than public home Wi-Fi networks
- VPN gateways cannot process TLS encryption protocols
- Office IP addresses change every 15 minutes automatically
Explanation: Attackers who compromise internal network perimeters or establish VPN implants gain unrestricted lateral trust; access must be authenticated and authorized dynamically per request regardless of network topology.
In designing a Zero Trust network architecture, why does Microsoft advise against relying on network location (such as corporate office IP or VPN IP) as the primary authenticator for corporate access?
- Perimeter compromise grants lateral trust; access must be verified per request (Correct)
- Corporate network cables are slower than public home Wi-Fi networks
- VPN gateways cannot process TLS encryption protocols
- Office IP addresses change every 15 minutes automatically
Explanation: Attackers who compromise internal network perimeters or establish VPN implants gain unrestricted lateral trust; access must be authenticated and authorized dynamically per request regardless of network topology.
An organization must comply with European Union GDPR mandates regarding data sovereignty. Which Azure architectural capability ensures customer data at rest remains strictly within designated national borders?
- Azure Regions and Sovereign Geographies (Correct)
- Global Anycast DNS load balancers
- Content Delivery Network edge caching servers
- Dynamic IP assignment via DHCP
Explanation: Azure Regions and Sovereign Geographies guarantee that customer data at rest, along with automated backups and replication, resides exclusively within designated geographic and geopolitical boundaries.
An organization must comply with European Union GDPR mandates regarding data sovereignty. Which Azure architectural capability ensures customer data at rest remains strictly within designated national borders?
- Azure Regions and Sovereign Geographies (Correct)
- Global Anycast DNS load balancers
- Content Delivery Network edge caching servers
- Dynamic IP assignment via DHCP
Explanation: Azure Regions and Sovereign Geographies guarantee that customer data at rest, along with automated backups and replication, resides exclusively within designated geographic and geopolitical boundaries.
You need to design a privileged access model for cloud administration. Which device configuration should be mandated for all personnel performing Tier-0 identity and cloud administrative operations?
- Dedicated Privileged Access Workstations (PAWs) with hardware isolation (Correct)
- Personal smartphones running web browsers
- Shared computer kiosks in company reception areas
- Unmanaged home desktop computers connecting via standard RDP
Explanation: Dedicated Privileged Access Workstations (PAWs) with hardware-enforced isolation, no internet email access, and restricted web browsing ensure that credential harvesting attacks cannot compromise admin tokens.
What is the function of the Microsoft Security Exposure Management platform in modern enterprise architecture?
- Aggregates asset inventories, evaluates exposure, and maps attack paths (Correct)
- Measures physical solar radiation levels on data center roofs
- Calculates monthly electricity bills for enterprise servers
- Manages employee vacation requests and shift schedules
Explanation: Microsoft Security Exposure Management aggregates multi-domain asset inventories, evaluates attack surface exposure, maps proactive attack paths, and provides contextual risk prioritization across the estate.
What is the function of the Microsoft Security Exposure Management platform in modern enterprise architecture?
- Aggregates asset inventories, evaluates exposure, and maps attack paths (Correct)
- Measures physical solar radiation levels on data center roofs
- Calculates monthly electricity bills for enterprise servers
- Manages employee vacation requests and shift schedules
Explanation: Microsoft Security Exposure Management aggregates multi-domain asset inventories, evaluates attack surface exposure, maps proactive attack paths, and provides contextual risk prioritization across the estate.
You are designing disaster recovery for critical identity services. What is the recommended hybrid identity architecture to ensure authentication survives a complete loss of on-premises data centers?
- Password Hash Synchronization (PHS) in Microsoft Entra Connect (Correct)
- Active Directory Federation Services without cloud synchronization
- Pass-through Authentication relying solely on on-premises agents
- Direct LDAP queries over unencrypted port 389
Explanation: Deploy Password Hash Synchronization (PHS) in Microsoft Entra Connect so that users can authenticate directly against cloud identity services even if on-premises domain controllers become unreachable.
You are designing disaster recovery for critical identity services. What is the recommended hybrid identity architecture to ensure authentication survives a complete loss of on-premises data centers?
- Password Hash Synchronization (PHS) in Microsoft Entra Connect (Correct)
- Active Directory Federation Services without cloud synchronization
- Pass-through Authentication relying solely on on-premises agents
- Direct LDAP queries over unencrypted port 389
Explanation: Deploy Password Hash Synchronization (PHS) in Microsoft Entra Connect so that users can authenticate directly against cloud identity services even if on-premises domain controllers become unreachable.
You are designing an integrated Security Operations Center (SOC) architecture. You need to combine Extended Detection and Response (XDR) telemetry with cloud Security Information and Event Management (SIEM). Which Microsoft platforms fulfill these complementary roles?
- Microsoft Defender XDR for workload XDR; Microsoft Sentinel for enterprise SIEM/SOAR (Correct)
- Windows Defender Firewall for SIEM; Microsoft Excel for SOAR
- Microsoft Intune for XDR; Azure DNS for SIEM
- Exchange Online Protection for SIEM; SharePoint Online for XDR
Explanation: Microsoft Defender XDR provides native, workload-specific XDR protection across endpoints, identities, and email; Microsoft Sentinel provides centralized SIEM and SOAR across multi-cloud enterprise logs.
You are designing an integrated Security Operations Center (SOC) architecture. You need to combine Extended Detection and Response (XDR) telemetry with cloud Security Information and Event Management (SIEM). Which Microsoft platforms fulfill these complementary roles?
- Microsoft Defender XDR for workload XDR; Microsoft Sentinel for enterprise SIEM/SOAR (Correct)
- Windows Defender Firewall for SIEM; Microsoft Excel for SOAR
- Microsoft Intune for XDR; Azure DNS for SIEM
- Exchange Online Protection for SIEM; SharePoint Online for XDR
Explanation: Microsoft Defender XDR provides native, workload-specific XDR protection across endpoints, identities, and email; Microsoft Sentinel provides centralized SIEM and SOAR across multi-cloud enterprise logs.
You are designing an authentication strategy for a multinational enterprise. You need to enforce phishing-resistant Multi-Factor Authentication for all high-privilege administrators. Which authentication methods satisfy this requirement?
- FIDO2 security keys, Windows Hello for Business, and Entra CBA (Correct)
- SMS text verification codes and voice phone calls
- Email verification links sent to personal webmail
- Security challenge questions and static 4-digit PINs
Explanation: FIDO2 security keys, Windows Hello for Business, and Microsoft Entra Certificate-Based Authentication (CBA) are cryptographic, origin-bound methods that qualify as phishing-resistant MFA.
You are designing an authentication strategy for a multinational enterprise. You need to enforce phishing-resistant Multi-Factor Authentication for all high-privilege administrators. Which authentication methods satisfy this requirement?
- FIDO2 security keys, Windows Hello for Business, and Entra CBA (Correct)
- SMS text verification codes and voice phone calls
- Email verification links sent to personal webmail
- Security challenge questions and static 4-digit PINs
Explanation: FIDO2 security keys, Windows Hello for Business, and Microsoft Entra Certificate-Based Authentication (CBA) are cryptographic, origin-bound methods that qualify as phishing-resistant MFA.
An architect needs to automate incident triage and remediation in Microsoft Sentinel. What two integrated technologies handle automated logic and orchestrated third-party response actions?
- Sentinel Automation Rules and Playbooks (Azure Logic Apps) (Correct)
- Command Prompt batch files and Windows Task Scheduler
- Exchange transport rules and Outlook inbox rules
- SharePoint workflows and Power BI metrics
Explanation: Microsoft Sentinel Automation Rules execute trigger-based triage, tagging, and assignment, while Sentinel Playbooks (built on Azure Logic Apps) handle complex multi-step automated remediation workflows.
An architect needs to automate incident triage and remediation in Microsoft Sentinel. What two integrated technologies handle automated logic and orchestrated third-party response actions?
- Sentinel Automation Rules and Playbooks (Azure Logic Apps) (Correct)
- Command Prompt batch files and Windows Task Scheduler
- Exchange transport rules and Outlook inbox rules
- SharePoint workflows and Power BI metrics
Explanation: Microsoft Sentinel Automation Rules execute trigger-based triage, tagging, and assignment, while Sentinel Playbooks (built on Azure Logic Apps) handle complex multi-step automated remediation workflows.
You are designing Microsoft Entra Privileged Identity Management (PIM) for Azure RBAC and Entra roles. What is the security advantage of configuring roles as "Eligible" rather than "Active"?
- Enforces Just-In-Time access requiring activation, approval, and MFA (Correct)
- Grants 24/7 permanent administrative privileges without expiration
- Blocks administrators from ever accessing the Azure portal
- Deletes the administrator account automatically after 7 days
Explanation: Eligible assignments enforce Just-In-Time (JIT) access, requiring administrators to explicitly request activation with justification, MFA verification, and approval for a time-limited period.
You are designing Microsoft Entra Privileged Identity Management (PIM) for Azure RBAC and Entra roles. What is the security advantage of configuring roles as "Eligible" rather than "Active"?
- Enforces Just-In-Time access requiring activation, approval, and MFA (Correct)
- Grants 24/7 permanent administrative privileges without expiration
- Blocks administrators from ever accessing the Azure portal
- Deletes the administrator account automatically after 7 days
Explanation: Eligible assignments enforce Just-In-Time (JIT) access, requiring administrators to explicitly request activation with justification, MFA verification, and approval for a time-limited period.
You need to design a solution that automatically revokes active session refresh tokens within minutes if an administrator resets a user password or flags an account as compromised. Which capability must you enable?
- Continuous Access Evaluation (CAE) (Correct)
- Kerberos Ticket Granting Service ticket lifetime GPO
- NTLMv2 session negotiation
- DNS dynamic time-to-live caching
Explanation: Continuous Access Evaluation (CAE) enables near real-time token revocation and security evaluation between Microsoft Entra ID and supporting resource providers (Exchange, Teams, SharePoint).