Azure security

Correct — Global Administrator is a directory role; Owner is an Azure RBAC role.

Correct — Who, what permissions, and where (MG/subscription/RG/resource).

Correct — Scope flows down: management group → subscription → RG → resource.

Correct — Both can create role assignments — a privilege-escalation surface to watch.

Correct — It lacks Microsoft.Authorization/roleAssignments/write.

Correct — You elevate on demand with an audit trail, shrinking the standing-access window.

Correct — No secret in code or config for the app to leak.

Correct — System-assigned is tied to a single resource lifecycle.

Correct — A principal who can add credentials to an SP can authenticate as it.

Correct — Access decisions adapt to context rather than being static.

Correct — Membership changes flow through without editing assignments.

Correct — No standing admin; elevate on demand and log it.

Correct — Return traffic is automatic; lower priority number wins.

Correct — Rules follow the workload identity, so scaling never breaks the ruleset.

Correct — It enables domain allowlists and IDPS at the network edge.

Correct — A compromised workload with open egress phones home freely.

Correct — The data plane stays on the Azure backbone, off the internet.

Correct — Service Endpoints still use the service’s public IP, just over the Azure backbone.

Correct — Even a leaked key cannot connect from the internet.

Correct — No open management ports on the internet.

Correct — One place to enforce and log traffic policy across the estate.

Correct — A key forensic and detection input, sent to storage/Log Analytics.

Correct — Remove standing internet exposure of management ports entirely.

Correct — DDoS absorbs floods; the WAF filters injection and known exploits.

Correct — One governed store for the three credential types.

Correct — RBAC gives granular, consistent, auditable access aligned with the rest of Azure.

Correct — An attacker or mistake cannot irrecoverably wipe your keys.

Correct — Customer-managed keys (CMK) let you take control for compliance and revocation.

Correct — Disabling the key renders the encrypted data unreadable: a kill switch.

Correct — For regulated workloads requiring attestable hardware custody.

Correct — The app setting holds a reference, not the value.

Correct — A leaked token cannot reach the vault from the internet.

Correct — Least privilege: distinct roles for distinct actions.

Correct — Rotation is non-disruptive and can be enforced by policy.

Correct — Anomalous bulk secret reads become visible.

Correct — Consumers must refresh within the window before the old version is disabled.

Correct — It is the central posture + threat surface for Azure (and hybrid/multicloud).

Correct — It turns posture into a trackable, actionable number.

Correct — You enable the plans relevant to what you run.

Correct — It correlates across sources and runs playbooks for response.

Correct — Scheduled/near-real-time detections generate the incident queue.

Correct — SOAR turns a detection into containment without waiting for a human.

Correct — Defender is posture+workload; Sentinel is the SIEM that unifies and automates.

Correct — A quiet attacker hides where protection is not enabled.

Correct — Isolate, disable, or ticket in seconds via playbooks.

Correct — Tune analytics rules, dedupe, and prioritize by severity.

Correct — Behavioral baselining surfaces subtle account compromise.

Correct — A permitted action at abnormal volume/pattern is the tell.

Correct — e.g. deny public IPs, require encryption, auto-deploy diagnostic settings.

Correct — Two planes: allowed configuration vs allowed principals.

Correct — The misconfiguration never happens rather than being reported.

Correct — Apply org-wide guardrails once at the top.

Correct — New subscriptions arrive secure-by-default, not after a hardening sprint.

Correct — Deny assignments take precedence over role assignments.

Correct — Revoke-SignInSessions invalidates tokens already issued.

Correct — Contain and preserve evidence rather than destroying it.

Correct — Persistence hides in the identity control plane; find it before restoring.

Correct — It is the subscription-level audit trail for management actions.

Correct — Immutable storage stops an attacker deleting the evidence trail.

Correct — Speed and correctness come from practice, not invention mid-incident.