Security Issues in a Hybrid Cloud Environment CERTIFIED-HYBRID-CLOUD-IMPLEMENTATION-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company uses Azure AD with conditional access policies. Users on the corporate network can access a sensitive application, but remote users are blocked. The company also uses Azure AD Application Proxy for remote access. Remote users report they are blocked even when using the corporate VPN. What is the most likely cause?

   • AThe user's account is not licensed for Azure AD Premium.
   • BThe conditional access policy requires a compliant device, and remote users' devices are not compliant.
   • CThe Application Proxy is not configured for the application.
   • DThe VPN is not routing traffic through the corporate network.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An administrator is troubleshooting why data at rest in a cloud storage service is not encrypted. What is the most likely cause?

   • AThe storage service does not support encryption by default
   • BThe data is stored in a different region
   • CThe encryption key used by the storage service is not accessible
   • DThe storage account is configured for public access
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A client application is failing to connect to a cloud service over TLS, and the error indicates a certificate problem. What is the most likely cause of this encryption issue?

   • AThe certificate presented by the cloud service is expired or untrusted
   • BThe cloud service is using a symmetric encryption algorithm
   • CThe network firewall is blocking port 80
   • DThe client application does not support encryption
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a hub-spoke network topology in Azure. The hub contains a firewall appliance. Spoke VNets are peered to the hub. Users in a spoke VNet cannot reach the internet, but they can reach on-premises via the hub. The firewall logs show no blocked traffic. What is the most likely cause?

   • AThe firewall is blocking internet traffic but not logging it.
   • BThe firewall is not configured for NAT.
   • CThe spoke VNet does not have a route to the internet via the firewall.
   • DThe spoke VNet is not peered to the hub.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company must comply with PCI DSS and uses Azure Policy to enforce encryption for storage accounts. An audit finds that some storage accounts are not encrypted. The policy is assigned to the subscription and has a remediation task. Why are some storage accounts still not encrypted?

   • AThe remediation task failed because the storage accounts are in a different resource group.
   • BThe storage accounts are in a different Azure region.
   • CThe remediation task only applies to new resources, not existing ones.
   • DThe storage accounts are using a different encryption method.
   Reveal Solution Discussion Select an answer first