AZ-301 Identity & Security Solutions 2 — Questions and Answers
Question 1: An architect is designing a solution where encryption keys must be managed by the customer and stored on-premises, never uploaded to Azure. Which Azure storage encryption option supports this requirement?
- Azure Storage Service Encryption with Microsoft-managed keys
- Customer-managed keys in Azure Key Vault
- Customer-provided keys (SSE-C) (Correct answer)
- Azure Disk Encryption
Correct answer: Customer-provided keys (SSE-C)
Customer-provided keys (SSE-C) allows clients to supply their own encryption keys with each storage request, keeping keys entirely under their control outside Azure.
Question 2: A financial company needs to detect and prevent sensitive data (PII, credit card numbers) from leaving their Azure environment via emails or uploads. Which Azure service provides this Data Loss Prevention capability?
- Microsoft Defender for Cloud
- Microsoft Purview (Information Protection) (Correct answer)
- Azure Security Center
- Azure Sentinel
Correct answer: Microsoft Purview (Information Protection)
Microsoft Purview Information Protection provides DLP policies to detect and prevent sensitive data exfiltration across Microsoft 365 and Azure services.
Question 3: An architect needs to implement network micro-segmentation within an Azure virtual network to control traffic between individual VMs without using separate subnets. Which feature enables this?
- Network Security Groups
- Application Security Groups (Correct answer)
- Azure Firewall
- Service Endpoints
Correct answer: Application Security Groups
Application Security Groups (ASGs) allow logical grouping of VMs and define NSG rules based on application workloads rather than explicit IP addresses.
Question 4: A company requires that all Azure virtual machine OS and data disks are encrypted using customer-managed keys stored in Azure Key Vault. Which service provides this OS-level disk encryption?
- Storage Service Encryption
- Azure Disk Encryption (ADE) (Correct answer)
- Azure Confidential Computing
- BitLocker with platform-managed keys
Correct answer: Azure Disk Encryption (ADE)
Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt VM OS and data disks with keys stored in Azure Key Vault.
Question 5: An architect is designing a security solution for Azure and needs centralized threat detection, security alerts, and automated response across all Azure subscriptions. Which service provides a SIEM/SOAR solution?
- Microsoft Defender for Cloud
- Microsoft Sentinel (Correct answer)
- Azure Monitor
- Azure Security Benchmark
Correct answer: Microsoft Sentinel
Microsoft Sentinel is Azure's cloud-native SIEM and SOAR solution that provides intelligent security analytics, threat detection, and automated incident response.
Question 6: When designing a secure API solution, an architect needs to validate OAuth 2.0 tokens and enforce scope-based authorization at the API gateway level. Which Azure service provides this capability natively?
- Azure Active Directory B2C
- Azure API Management with OAuth 2.0 policy (Correct answer)
- Azure Application Gateway with rewrite rules
- Azure Front Door with custom rules
Correct answer: Azure API Management with OAuth 2.0 policy
Azure API Management includes OAuth 2.0 token validation policies that can validate JWT tokens and enforce scope-based access control at the gateway.
AZ-301 Identity & Security Solutions 2
An architect is designing a solution where encryption keys must be managed by the customer and stored on-premises, never uploaded to Azure.
Which Azure storage encryption option supports this requirement?