Six exam-style questions I wrote this week (SAS, just-in-time access, private endpoints, Defender CSPM, RBAC scope, CEF through AMA), answers hidden, explanations in plain words.

How to use these: read the question, pick your answer before you open Answer , and write it down (or in the comments). Then check the "why not the others" part even if you got it right: that is where the exam traps live. Every scenario, name and number is made up by me; only the question formats follow the real exam.

Table of contents

Q005: A SAS when account keys are switched off

Q006: Just-in-time RDP: which Defender for Servers plan?

Q007: Private endpoint is up, but the VM still gets a public IP

Q008: Compliance standards and attack paths: which CSPM plan?

Q009: Right role, right scope, nothing more

Q010: CEF from a firewall to Sentinel through AMA, in order

Cheat sheet

Coming next

Q005: A SAS when account keys are switched off

Compute, storage and databases · Build list (put in order) · standalone page

The storage…