Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Sample Questions:

1. Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create an analytics rule.
Does this meet the goal?

A) Yes
B) No

2. You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance. Sub1 has Microsoft Defender for Cloud enabled.
You need to configure Microsoft Defender for Databases to minimize costs.
Which Defender plan should you enable?

A) Microsoft Defender for Azure SQL Databases
B) Microsoft Defender for Servers
C) Microsoft Defender for SQL Servers on Machines
D) Microsoft Defender for Open-Source Relational Databases
E) Microsoft Defender for Storage

3. Your organization is deploying several generative AI applications that use Azure AI services.
Security administrators want to ensure that prompts and responses containing sensitive information are identified and monitored before they leave the organization's environment. Which solution should be implemented first?

A) Azure Load Balancer
B) Azure Firewall Premium
C) Azure Traffic Manager
D) Microsoft Purview Data Loss Prevention (DLP)

4. You have an Azure Storage account named storage1 that hosts a blob container named container1.
You have an Azure Functions app named app1 that uses a managed identity.
You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.
What should you do?

A) Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
B) Assign the Owner role to the managed identity of App1 at the scope of container1.
C) Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.
D) Assign the Storage Blob Delegator role to the managed identity of App1 at the scope of container1.

5. You have an Azure subscription that contains a resource group named RG1.
RG1 contains a Microsoft Security Copilot deployment that is integrated with a Microsoft Sentinel workspace named Workspace1.
Analysts use the Security Copilot standalone experience to retrieve incidents by using the Microsoft Sentinel plugin.
A user named User1 can sign in to Security Copilot but cannot retrieve incidents from Workspace1. You verify that User1 has only the Security Copilot Contributor role.
You need to ensure that User1 can retrieve the incidents. The solution must follow the principle of least privilege and NOT require any configuration changes to Security Copilot.
Which role should you assign to User1?

A) the Contributor role in Azure for RG1
B) the Security Copilot Owner role
C) the Microsoft Sentinel Reader role for Workspace1
D) the Security Administrator role in Microsoft Entra
E) the Security Reader role in Microsoft Entra

Solutions: