Question bank
Microsoft Certified: Cybersecurity Architect Expert
40 Microsoft Certified: Cybersecurity Architect Expert questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Design security operations, identity, and compliance capabilities
11 questions in this domain
- Question 1Single Choice
Which Azure security capability is specifically designed to provide Layer 7 application traffic inspection?
- ANetwork Security Group (NSG)
- BWAF/Azure Firewall application rulesCorrect answer
- CAzure DNS
- DAzure Traffic Manager
Why this is the answer
WAF and Azure Firewall application rules inspect Layer 7 data such as HTTP headers. NSGs filter at Layer 4 using IPs and ports, which is the common confusion described in the playbook.
- Question 2Multiple Select
According to the common traps, which scenarios are recognized architecture mistakes?
- AConfusing Layer 4 NSG rules with Layer 7 WAF capabilitiesCorrect answer
- BSelecting a hub-and-spoke topology for simplicity while ignoring central inspectionCorrect answer
- CPrioritizing connectivity over inspecting trafficCorrect answer
- DImplementing policy-driven security deployment
Why this is the answer
The playbook lists layer confusion, topology simplification over inspection, and connectivity before security as common traps. Policy-driven security is recommended, not a trap.
- Question 3Interactive
You are reviewing a network rule that only inspects IP addresses and TCP port 80. Which security capability does this rule represent?
- ALayer 4 Network Security GroupCorrect answer
- BLayer 7 Web Application Firewall
- CAzure Policy assignment
- DAzure Active Directory conditional access
Why this is the answer
The rule filters by TCP port and IP prefixes, which is Layer 4 behavior. Application-layer inspection would require a WAF or Azure Firewall application rule.
- Question 4Single Choice
What is the main risk of making connectivity a higher priority than security inspection in a cloud architecture?
- ATraffic flows quickly but may bypass required security inspectionCorrect answer
- BInspection improves automatically as traffic flow increases
- CNetwork latency always increases
- DCompliance is easier to prove
Why this is the answer
When connectivity is prioritized, traffic may be allowed to flow without being directed through required inspection points, creating security gaps.
- Question 5Multiple Select
Which statements about IaaS and PaaS security responsibilities are correct?
- AIaaS gives customers more control over operating systems and middlewareCorrect answer
- BPaaS shifts more infrastructure security responsibility to the providerCorrect answer
- CTreating PaaS like IaaS can cause over-provisioning of security controlsCorrect answer
- DPaaS customers must patch the host operating system
Why this is the answer
PaaS transfers more underlying infrastructure responsibility to the provider. Applying IaaS-level controls to PaaS can lead to unnecessary security provisioning.
- Question 6Interactive
An Azure Policy definition is used to continuously audit deployed resources for compliance. Which security strategy does this demonstrate?
- AReactive manual remediation
- BProactive policy-driven architectural designCorrect answer
- CLayer 4 network inspection
- DHub-and-spoke connectivity planning
Why this is the answer
Automated policy audit is a proactive architectural design. It continuously checks resources instead of relying on manual remediation after an issue appears.
- Question 7Single Choice
What happens when an organization selects a visibility tool that deeply monitors only one cloud while using multiple cloud providers?
- AIt will likely fail to meet centralized security monitoring requirementsCorrect answer
- BIt will automatically unify all cloud security data
- CIt reduces the need for identity management
- DIt is always the best choice for compliance
Why this is the answer
A single-cloud tool cannot deliver the required centralized visibility across a multi-cloud environment, causing gaps in security operations.
- Question 8Multiple Select
Which considerations are important when using a hub-and-spoke topology for security?
- ACentralized inspection may require traffic to pass through a hubCorrect answer
- BA simplistic hub-and-spoke design can ignore inspection needsCorrect answer
- CEnabling connectivity alone does not secure the trafficCorrect answer
- DA hub-and-spoke network automatically applies WAF policies
Why this is the answer
Hub-and-spoke networks support centralized inspection only if traffic is intentionally routed through the hub. Simplicity and connectivity do not guarantee security.
- Question 9Interactive
A security team writes a rule that inspects the URI of incoming HTTP requests and blocks malicious values. Which capability is this?
- AAzure Web Application Firewall (WAF)Correct answer
- BNetwork Security Group (NSG)
- CAzure Policy
- DAzure Private Link
Why this is the answer
Inspecting HTTP request URIs and blocking patterns is application-layer filtering, provided by WAF/Azure Firewall rather than by an NSG.
- Question 10Single Choice
Which statement best describes a security responsibility difference between IaaS and PaaS?
- APaaS places more infrastructure security responsibility on the providerCorrect answer
- BIaaS places all security responsibility on the provider
- CPaaS and IaaS have the exact same responsibility model
- DIaaS customers do not need to secure their applications
Why this is the answer
IaaS requires customers to secure more layers, while PaaS moves more infrastructure responsibility to the cloud provider.
- Question 11Multiple Select
Which practices are examples of proactive architectural design over reactive manual remediation?
- AImplementing Azure Policy to enforce compliance before deploymentCorrect answer
- BManually fixing a misconfigured firewall after an incident
- CDesigning centralized inspection points during architecture designCorrect answer
- DReactively adding WAF rules after an attack is discovered
Why this is the answer
Proactive design uses policy and architecture to enforce security. Manual fixes after incidents or attacks are reactive practices.
Design security solutions for applications and data
9 questions in this domain
- Question 12Single Choice
At which OSI layer do Network Security Groups (NSGs) filter traffic in an Azure environment?
- ALayer 4 (Transport)Correct answer
- BLayer 7 (Application)
- CLayer 2 (Data Link)
- DLayer 5 (Session)
Why this is the answer
NSGs filter traffic by source/destination IP, port, and protocol, so they operate at Layer 4 of the OSI model rather than at Layer 7.
- Question 13Multiple Select
Which two Azure services are commonly used for Layer 7 application-level inspection and protection?
- AAzure Web Application Firewall (WAF)Correct answer
- BAzure FirewallCorrect answer
- CNetwork Security Group (NSG)
- DAzure Traffic Manager
Why this is the answer
Azure WAF protects web apps from application-layer attacks, and Azure Firewall supports Layer 7 FQDN-based rules. NSGs operate at Layer 4.
- Question 14Interactive
Review the JSON rule in the code block. At which OSI layer does this rule operate?
- ALayer 4 (Transport)Correct answer
- BLayer 7 (Application)
- CLayer 2 (Data Link)
- DLayer 5 (Session)
Why this is the answer
The rule filters TCP port 80, which is a transport-layer characteristic, so this NSG rule operates at Layer 4.
- Question 15Single Choice
Which network topology is typically used to route traffic through a central security inspection point?
- AHub-and-spokeCorrect answer
- BFull mesh
- CPoint-to-point
- DFlat network
Why this is the answer
Hub-and-spoke centralizes connectivity in a hub, allowing traffic to be inspected before reaching spokes. Other topologies complicate centralized enforcement.
- Question 16Multiple Select
Which two security outcomes should be prioritized instead of only ensuring traffic flows?
- AEnsure traffic is inspectedCorrect answer
- BCentralize security inspectionCorrect answer
- CMinimize latency above all
- DLet traffic flow freely
Why this is the answer
Security architecture must inspect traffic and centralize enforcement; only ensuring traffic flows without inspection can create security gaps.
- Question 17Interactive
The code block contains a resource definition. Which cloud service model does this resource represent?
- APlatform as a Service (PaaS)Correct answer
- BInfrastructure as a Service (IaaS)
- CSoftware as a Service (SaaS)
- DOn-premises
Why this is the answer
Microsoft.Web/sites represents Azure App Service, a PaaS offering in which the platform manages infrastructure and the customer manages applications and data.
- Question 18Single Choice
What common trap occurs when a security tool provides excellent visibility in one cloud but does not meet multi-cloud requirements?
- ASingle-cloud visibility trapCorrect answer
- BIaaS/PaaS responsibility confusion
- CConnectivity over security
- DReactive security
Why this is the answer
Using a tool that only meets single-cloud visibility fails to protect distributed environments when multi-cloud visibility is required by the architecture.
- Question 19Multiple Select
Which two approaches are common traps in security architecture design?
- AManual reactive remediationCorrect answer
- BSingle-cloud visibility toolCorrect answer
- CPolicy-driven security guardrails
- DCentralized security inspection
Why this is the answer
Reactive manual remediation and relying on single-cloud tools create gaps and inconsistent security. Proactive, policy-driven design and centralized inspection are preferred.
- Question 20Interactive
The code block shows a policy assignment. Which security design approach does it represent?
- AProactive policy-driven securityCorrect answer
- BManual reactive remediation
- CConnectivity-first design
- DSingle-cloud visibility tool
Why this is the answer
Policy assignments enforce required security configurations automatically, representing proactive design rather than manual or reactive control.
Design security solutions for infrastructure
11 questions in this domain
- Question 21Single Choice
Which common trap refers to confusing the security capabilities of NSG with those of WAF or Azure Firewall when dealing with application-level threats?
- ASelecting hub-and-spoke for simplicity and no inspection
- BConfusing NSG (Layer 4) with WAF (Layer 7)Correct answer
- CPrioritizing connectivity over security inspection
- DMixing IaaS and PaaS security responsibilities
Why this is the answer
The document lists this exact trap as confusing Layer 4 (NSG) with Layer 7 (WAF/Azure Firewall) capabilities, especially for application-level threats.
- Question 22Multiple Select
Which of the following are common traps when designing security solutions for infrastructure? Select all that apply.
- AConfusing NSG (Layer 4) with WAF (Layer 7)Correct answer
- BSelecting hub-and-spoke while ignoring inspectionCorrect answer
- CPrioritizing reactive over proactive designCorrect answer
- DCentralizing inspection before enabling traffic
Why this is the answer
The first three options match common traps listed in the playbook. The fourth is a recommended practice, not a trap.
- Question 23Interactive
Which common trap is illustrated by the scenario in the code block?
- AConfusing NSG with WAF/Azure Firewall layers
- BUsing hub-and-spoke without centralized inspectionCorrect answer
- CPrioritizing reactive manual response
- DMixing IaaS and PaaS responsibilities
Why this is the answer
The code block describes a simple hub-and-spoke deployment without centralized inspection, which matches the hub-and-spoke trap.
- Question 24Single Choice
What is the main risk of prioritizing connectivity over security when designing infrastructure?
- AConnectivity guarantees traffic inspection
- BTraffic flows without mandatory inspectionCorrect answer
- CFirewall required for connectivity
- DNSGs block all Layer 7 threats
Why this is the answer
The playbook warns against prioritizing connectivity for the sake of traffic flow while ignoring security inspection, which can leave traffic uninspected.
- Question 25Multiple Select
Which of the following are consequences of confusing IaaS and PaaS security responsibilities? Select all that apply.
- AOver-provisioning security controlsCorrect answer
- BSecurity gaps from missed responsibilitiesCorrect answer
- CClearer platform security boundaries
- DSame security posture in all models
Why this is the answer
The playbook states this confusion can lead to over-provisioning or security gaps, not to clearer boundaries or identical posture.
- Question 26Interactive
Which common trap is represented by the selection logic in the code block?
- ASingle-cloud tool that misses hybrid coverageCorrect answer
- BConfusing NSG with WAF
- CReactive instead of proactive design
- DHub-and-spoke without inspection
Why this is the answer
The code selects a single-cloud tool even though the environment includes multiple clouds and on-premises, matching the tool-selection trap.
- Question 27Single Choice
Which approach best represents proactive architectural design for infrastructure security?
- AManual remediation after incidents
- BPolicy-driven security in the architectureCorrect answer
- CWaiting for alerts before acting
- DConnecting before planning inspection
Why this is the answer
The playbook contrasts reactive manual remediation with proactive architectural design, specifically policy-driven security.
- Question 28Multiple Select
Which of the following accurately describe the hub-and-spoke common trap? Select all that apply.
- AHub-and-spoke chosen for simplicityCorrect answer
- BCentralized inspection requirements ignoredCorrect answer
- COnly a trap when spokes are disconnected
- DEliminates need for WAF/Azure Firewall
Why this is the answer
The trap is choosing hub-and-spoke for simplicity and ignoring centralized inspection; connectivity alone does not avoid the trap.
- Question 29Interactive
Which trap is demonstrated by the strategy described in the code block?
- AReactive security over proactive designCorrect answer
- BIaaS and PaaS responsibility confusion
- CHub-and-spoke without inspection
- DSingle-cloud tool selection
Why this is the answer
The code block describes a strategy centered on manual remediation and waiting for incidents, which matches the reactive-versus-proactive trap.
- Question 30Single Choice
What is a common consequence of confusing Layer 4 NSGs with Layer 7 WAFs when trying to protect an application?
- AApplication-layer attacks may not be blockedCorrect answer
- BNSGs automatically provide WAF capabilities
- CLayer 7 controls are already in Layer 4
- DAzure Firewall is unnecessary for app threats
Why this is the answer
NSGs operate at Layer 4 and are not designed to replace Layer 7 capabilities such as WAF or Azure Firewall for application-level threats.
- Question 31Multiple Select
Which of the following are common traps to avoid when designing security solutions for infrastructure? Select all that apply.
- AConfusing NSG (Layer 4) with WAF (Layer 7)Correct answer
- BHub-and-spoke without centralized inspectionCorrect answer
- CSingle-cloud visibility misses multi-cloud needsCorrect answer
- DProactive policy-driven architecture
Why this is the answer
The first three are stated traps. Proactive policy-driven architecture is the recommended approach, not a trap.
Design solutions that align with security best practices and priorities
9 questions in this domain
- Question 32Single Choice
At which network layer does a Network Security Group (NSG) primarily inspect and filter traffic?
- ALayer 4Correct answer
- BLayer 7
- CLayer 2
- DLayer 5
Why this is the answer
NSGs filter traffic based on source/destination IP, port, and protocol, which aligns with Layer 4 transport-layer information.
- Question 33Multiple Select
According to the playbook, which of the following are common traps when designing security solutions? (Select all that apply.)
- AConfusing NSG with WAF capabilitiesCorrect answer
- BIgnoring centralized inspection when choosing hub-and-spokeCorrect answer
- CUsing a single-cloud tool for multi-cloud visibilityCorrect answer
- DPrioritizing security over connectivity in all designs
Why this is the answer
The playbook warns about confusing Layer 4 with Layer 7, ignoring centralized inspection, and choosing single-cloud tools when multi-cloud visibility is needed.
- Question 34Interactive
Review the filtering rule in the exhibit. At which OSI layer is this network security rule operating?
- ALayer 4Correct answer
- BLayer 7
- CSession layer
- DApplication layer
Why this is the answer
The rule filters by protocol TCP and destination port 443, which is transport-layer information, so it operates at Layer 4.
- Question 35Single Choice
When a designer prioritizes connectivity over security, what should be reviewed to avoid this trap?
- AEnsuring traffic is inspectedCorrect answer
- BMaking traffic flow quickly
- CReducing network latency
- DMinimizing route complexity
Why this is the answer
The playbook warns against prioritizing connectivity before security; the correct emphasis is that traffic must be inspected, not just allowed to flow.
- Question 36Multiple Select
Which of the following reflect the IaaS/PaaS responsibility confusion mentioned in the playbook? (Select all that apply.)
- AApplying host-level controls to a PaaS serviceCorrect answer
- BOver-provisioning controls due to responsibility confusionCorrect answer
- CReviewing the shared responsibility model
- DUsing built-in PaaS security features
Why this is the answer
IaaS/PaaS confusion appears when host-level controls are applied to PaaS or when security controls are over-provisioned because responsibility boundaries are unclear.
- Question 37Interactive
The exhibit shows an action taken by a security team. Does this action represent proactive architecture or reactive remediation?
- AProactive policy-driven designCorrect answer
- BReactive manual remediation
- CLayer 4 filtering
- DHub-and-spoke simplification
Why this is the answer
Assigning a policy is a proactive architectural control; it prevents misconfiguration instead of manually fixing issues after detection.
- Question 38Single Choice
Why is selecting a single-cloud visibility tool dangerous when multi-cloud visibility is required?
- AIt lacks required multi-cloud coverageCorrect answer
- BIt increases latency in every cloud
- CIt filters at the wrong OSI layer
- DIt eliminates the need for a WAF
Why this is the answer
A tool focused on one cloud cannot monitor workloads and threats across all providers, violating the overarching visibility requirement.
- Question 39Multiple Select
Which statements correctly describe the playbook's warning about hub-and-spoke topologies? (Select all that apply.)
- AChoosing hub-and-spoke only for simplicityCorrect answer
- BCentralized inspection must still be consideredCorrect answer
- CHub-and-spoke removes inspection needs
- DAny topology works without inspection
Why this is the answer
The playbook warns against selecting hub-and-spoke for simplicity; centralized inspection requirements must still be considered.
- Question 40Interactive
The security configuration in the exhibit is associated with which traffic inspection layer?
- ALayer 7Correct answer
- BLayer 4
- CLayer 2
- DPhysical layer
Why this is the answer
A WAF policy inspects and filters application-layer traffic, such as HTTP and HTTPS payloads, which corresponds to Layer 7.
Frequently asked questions
Everything about the Microsoft Certified: Cybersecurity Architect Expert question bank and how to use it.