Microsoft Certified: Cloud and AI Security Engineer Associate
Independent: not affiliated with Microsoft. Free to try; the study bundle adds a study guide and two practice exams.
5 original questions, none of them in the practice exams.
Pick an answer. Show answer explains every option and links its Microsoft source.
5 questions / Explanations link Microsoft sources / Last updated Oct 26, 2026
Question 1
Multiple choice
Domain 1 / Task 1.2 Secure secrets and keys with Azure Key Vault
Your app calls a partner's REST API with an API key that is stored as a secret in Azure Key Vault, and every secret version is created with an expiration date 90 days out. The partner offers an endpoint that issues a new API key and revokes the previous one. Security wants the API key replaced automatically before it expires, without any scheduled job that polls the vault. What should you implement?
Show answerHide answer
Answer: A
Why
Key Vault autorotation for secrets is event-driven: 30 days before a secret expires, Key Vault publishes a near-expiry event to Event Grid, and a function app subscribed to that event runs your own rotation logic, here a call to the partner's endpoint, then adds the new value as a new secret version. No job has to poll the vault. Microsoft describes this pattern for API keys and other service credentials.
Why not the others
BCertificate auto-renewal works with integrated certificate authorities such as DigiCert and GlobalSign or by regenerating self-signed certificates; it cannot obtain an API key that the partner issues.
CA function on a timer trigger polls the vault on a schedule, which Security ruled out; the Event Grid near-expiry event arrives 30 days before expiration, so no polling is needed.
DRotation policies are defined for individual Key Vault keys, and Key Vault generates the new key version itself; a secret that holds a partner's API key needs custom code that gets the new value from the partner.
A site-to-site connection links your Azure VPN gateway, which uses the VpnGw2AZ SKU, to a branch firewall, and it currently negotiates with the Azure default IPsec/IKE proposals. A new compliance rule requires IKEv2 main mode with AES256, SHA384 and Diffie-Hellman group 24, and IPsec quick mode with AES256, SHA256 and PFS group 24. Which two actions are required? Choose two.
Show answerHide answer
Answers: C and E
Why
For specific algorithms and key strengths, Azure VPN Gateway takes one custom IPsec/IKE policy per site-to-site or VNet-to-VNet connection, and that policy must set every main mode and quick mode parameter. The on-premises device must match or contain the algorithms, DH group and PFS group in the Azure policy, or the connection cannot be established.
Why not the others
AA custom policy must specify every main mode and quick mode parameter; partial policies are not allowed.
BThe default IKEv2 main mode proposals use only Diffie-Hellman group 2, so group 24 cannot be negotiated without a custom policy.
DCustom IPsec/IKE policies are supported on every VPN Gateway SKU except Basic, so VpnGw2AZ already supports them.
A logic app workflow uses the Azure Key Vault connector's Get secret action to read a vendor API key and passes the value in a header of an HTTP action. Support engineers review run history to troubleshoot failures. They must keep seeing run status and the data of actions that do not handle the key, but they must never see the key itself. What should you do?
Show answerHide answer
Answer: C
Why
Secure Outputs on the Get secret action hides that action's outputs in run history, and because the HTTP action explicitly uses those secured outputs as inputs, Logic Apps also hides the HTTP action's inputs. Actions that do not use the key keep their inputs and outputs visible.
Why not the others
ASecure Inputs on the HTTP action hides only that action's inputs; the Get secret action's outputs would still show the key.
BAn IP range of 0.0.0.0-0.0.0.0 blocks everyone from all inputs and outputs in run history, not only the key.
DA securestring parameter is not returned with the workflow definition, but a parameter used in a request header can still appear in run history and in the outgoing request.
A support web app signs users in with Microsoft Entra ID and calls an Azure OpenAI chat completions deployment through the Azure OpenAI Service by using the app's managed identity. Threat protection for AI services is on for the subscription. When Defender for Cloud raises an AI alert for a suspicious prompt, analysts cannot tell who sent the prompt or from where, so they cannot block that user. What should you do?
Show answerHide answer
Answer: D
Why
Because the requests come from the application, AI alerts carry no end-user context unless the app adds it to each call. The UserSecurityContext object in the chat completions request body carries that context into AI alerts: Microsoft says to pass at least EndUserId, the user's Microsoft Entra object ID, and SourceIP, and applicationName adds the application.
Why not the others
AUser prompt evidence adds suspicious segments of prompts and model responses to alerts; it does not say who sent the prompt or from where.
BAI model security scans models registered in Azure Machine Learning for embedded malware, unsafe operators and exposed secrets; it adds nothing to alerts about prompts.
CThe applicationName field supplies application context, which tells analysts which app made the call; end-user context needs EndUserId and SourceIP, so the user and address behind a prompt would stay unknown.
Domain 4 / Task 4.2 Activity and event collection in Microsoft Sentinel
Your SOC installed a content hub solution in Microsoft Sentinel, created 25 scheduled analytics rules from the solution's rule templates, and then tuned the queries of several of those rules. The solution has since been updated, and the new version of one template fixes a detection gap. What is the state of the 25 rules, and what should you do?
Show answerHide answer
Answer: A
Why
Creating a rule from a template makes a copy that is no longer connected to the template, so later template changes do not reach existing rules. A rule whose template has a newer version shows an Update badge; Review and update compares the rule with the latest template, and the custom changes step lets you reapply tuning that the update would otherwise overwrite. Microsoft labels template version management as preview.
Why not the others
BRules created from a template are copies; changes to the template are not applied to them.
CInstalling or updating the solution refreshes its templates, not the rules already created from them.
DA template update does not change rules created from it earlier; they keep their current queries and settings.
The study bundle has two practice exams with 120 original questions, an answer key and an explanation for every answer, plus the 59-page study guide. Practice exam explanations are shorter than the ones on this page: a short paragraph per question, with no source links.
Study bundle
$19
120 practice questions / Study guide / Answer keys
Every bundle includes 6 months of access: download the PDFs, and any new editions, until 6 months after your purchase date. Your receipt has a license key. Enter it at overqual.com/download for the three PDFs, stamped with your email and order number. They are yours to keep.