VCEdump

AZ-500 Microsoft Azure Security Technologies

PDF question preview Back to product

Reading controls

Reader tools

Free demo

95 of 632 questions

Purchase the full version to unlock every question and answer.

View the full question set

Preview tools

Try Web TestEngine

Question formats

Single choice52

Multiple choice3

Hotspot22

Drag & drop7

Lab simulation11

Microsoft · AZ-500

Free AZ-500 Exam Dumps Preview

Preview real exam questions, verified answers and available explanations before choosing a study plan.

Question 1

Single choice

You have a Microsoft Entra tenant named contoso.com.

You plan to collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com.

Fabrikam.com uses the following identity providers:

1. Google Cloud Platform (GCP)
2. Microsoft accounts
3. Microsoft Entra ID

You need to configure the Cross-tenant access settings for B2B collaboration.

Which identity providers support cross-tenant access?

A
Microsoft Entra ID only
B
GCP and Microsoft Entra ID only
C
Microsoft accounts and Microsoft Entra ID only
D
GCP, Microsoft accounts, and Microsoft Entra ID

Reveal answer details Close answer details

Correct answerD

Question 2

Multiple choice

You have an Azure subscription that contains a web app named App1.

Users must be able to select between a Google identity or a Microsoft identity when authenticating to App1.

You need to add Google as an identity provider in Azure AD.

Which two pieces of information should you configure? Each correct answer presents part of the solution.

Each correct selection is worth one point

A
a tenant name
B
a tenant ID
C
the endpoint URL Of an application
D
a client ID
E
a client secret

Reveal answer details Close answer details

Correct answersD, E

Explanation

Configure Google federation in Azure AD.
You'll now set the Google client ID and client secret. You can use the Azure portal or PowerShell to do so.
Be sure to test your Google federation configuration by inviting yourself. Use a Gmail address and try to redeem the invitation with your invited Google account.

To configure Google federation in the Azure portal:

1. Sign in to the Azure portal as an External Identity Provider Administrator or a Global Administrator.

2. In the left pane, select Azure Active Directory.

3. Select External Identities.

4. Select All identity providers, and then select the Google button.

5. Enter the client ID and client secret you obtained earlier.

https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-google

Question 3

Single choice

You have an Azure subscription that contains an Azure key vault named Vault1.

In Vault1, you create a secret named Secret1.

An application developer registers an application in Azure Active Directory (Azure AD).

You need to ensure that the application can use Secret1.

What should you do?

A
In Azure AD, create a role.
B
In Azure Key Vault, create a key.
C
In Azure Key Vault, create an access policy.
D
In Azure AD, enable Azure AD Application Proxy.

Reveal answer details Close answer details

Correct answerC

Explanation

Azure Key Vault provides a way to securely store credentials and other keys and secrets, but your code needs to authenticate to Key Vault to retrieve them. Managed identities for Azure resources overview makes solving this problem simpler, by giving Azure services an automatically managed identity in Azure Active Directory (Azure AD). You can use this identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without having any credentials in your code.

Example: How a system-assigned managed identity works with an Azure VM
After the VM has an identity, use the service principal information to grant the VM access to Azure resources. To call Azure Resource Manager, use role-based access control (RBAC) in Azure AD to assign the appropriate role to the VM service principal. To call Key Vault, grant your code access to the specific secret or key in Key Vault.

References:
https://docs.microsoft.com/en-us/azure/key-vault/quick-create-net
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Question 4

Multiple choice

You have an Azure subscription that contains an Azure key vault.

You create a storage account named storage1.

You plan to store data in the following storage1 services:

1. Azure Files
2. Azure Blob storage
3. Azure Table storage
4. Azure Queue storage

For which two services can you configure data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution,

NOTE: Each correct selection is worth one point.

A
Blob storage
B
Table storage
C
Queue storage
D
Azure Files

Reveal answer details Close answer details

Correct answersA, D

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 5

Testlet 5 Lab simulation

Simulation

You need to ensure that the rg1lod10598168n1 Azure Storage account is encrypted by using a key stored in the KeyVault10598168 Azure key vault.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

Configure customer-managed keys in the same tenant for an existing storage account Azure Storage encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can manage your own keys. Customer-managed keys must be stored in Azure Key Vault or Key Vault Managed Hardware Security Model (HSM).

Configure encryption for manual updating of key versions

Step 1: In the Azure portal, navigate to the Storage accounts page, and select rg1lod28681041n1

Step 2: On the Encryption tab, indicate for which services you want to enable support for customer-managed keys in the Enable support for customer-managed keys field.

Step 3: In the Encryption type field, select Customer-managed keys (CMK).

Step 4: To locate the key URI in the Azure portal, navigate to your key vault, and select the Keys setting.

Select the desired key, then select the key to view its versions. Select a key version to view the settings for that version.

Step 5: Copy the value of the Key Identifier field, which provides the URI.

Step 6: In the Encryption key settings for your storage account, choose the Enter key URI option.

Step 7: Paste the URI that you copied into the Key URI field. Include the key version on the URI to configure manual updating of the key version.

Step 8: Specify a user-assigned managed identity by choosing the Select an identity link.

Step 9: Select the Review button to validate

References:
https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account

Question 6

Single choice

You are securing access to the resources in an Azure subscription.

A new company policy states that all the Azure virtual machines in the subscription must use managed disks.

You need to prevent users from creating virtual machines that use unmanaged disks.

What should you use?

A
Azure Monitor
B
Azure Policy
C
Azure Security Center
D
Azure Service Health

Reveal answer details Close answer details

Correct answerB

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 7

Testlet 5 Lab simulation

Simulation

You need to ensure that the events in the NetworkSecurityGroupRuleCounter log of the VNETOI-Subnet0- NSG network security group (NSG) are stored in the Iogs31330471 Azure Storage account for 30 days.

Reveal model answer Close model answer

Enable diagnostic resource logging for the NSG. You can use the Azure portal, Azure PowerShell, or the Azure CLI to do this. You need to select the Rule counter category under Logs and choose the Iogs31330471 storage account as the destination.
Configure the retention policy for the storage account to keep the logs for 30 days. You can use the Azure portal, Azure PowerShell, or the Azure CLI to do this. You need to specify the days parameter as 30 for the Set-AzStorageServiceProperty cmdlet or the az storage logging update command.
View and analyze the logs in the storage account. You can use any tool that can read JSON files, such as Azure Storage Explorer or Visual Studio Code. You can also export the logs to any visualization tool, SIEM solution, or IDS of your choice

Question 8

Single choice

You have an Azure subscription that contains the virtual machines shown in the following table.

You are configuring Microsoft Defender for Servers.

You plan to enable adaptive application controls to create an allowlist of known-safe apps on the virtual machines.

Which virtual machines support the use of adaptive application controls?

A
VM1 and VM2 only
B
VM2 and VM4 only
C
VM2 and VM3 only
D
VM1, VM2, VM3, and VM4

Reveal answer details Close answer details

Correct answerD

Question 9

Single choice

You have a Microsoft 365 E5 subscription.

You have an Azure subscription that uses Microsoft Defender for Cloud.

You have an on-premises datacenter that contains the servers shown in the following table.

You enable direct onboarding to Microsoft Defender for Cloud.

Which servers will be onboarded to Defender for Cloud?

A
Server1 only
B
Server2 only
C
Server3 only
D
Server1 and Server3
E
Servei2 and Servet3
F
Server1, Server2, and Server3

Reveal answer details Close answer details

Correct answerC

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 10

Testlet 5 Lab simulation

Simulation

You need to ensure that the rg1lod28681041n1 Azure Storage account is encrypted by using a key stored in the KeyVault28681041 Azure key vault.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

Configure customer-managed keys in the same tenant for an existing storage account

Azure Storage encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can manage your own keys. Customer-managed keys must be stored in Azure Key Vault or Key Vault Managed Hardware Security Model (HSM).

Configure encryption for manual updating of key versions

Step 1: In the Azure portal, navigate to the Storage accounts page, and select rgllod28681041nl.

Step 2: On the Encryption tab, indicate for which services you want to enable support for customer-managed keys in the Enable support for customer-managed keys field.

Step 3: In the Encryption type field, select Customer-managed keys (CMK).

Step 4: To locate the key URI in the Azure portal, navigate to your key vault, and select the Keys setting.
Select the desired key, then select the key to view its versions. Select a key version to view the settings for that version.

Step 5: Copy the value of the Key Identifier field which provides the URI.

Step 6: In the Encryption key settings for your storage account, choose the Enter key URI option.

Step 7: Paste the URI that you copied into the Key URI field. Include the key version on the URI to configure manual updating of the key version.

Step 8: Specify a user-assigned managed identity by choosing the Select an identity link.

Question 11

Hotspot

HOTSPOT

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains three security groups named Group1, Group2, and Group3 and the users shown in the following table.

Group3 is a member of Group2.

In contoso.com, you register an enterprise application named App1 that has the following settings:

1. Owners: User1
2. Users and groups: Group2

You configure the properties of App1 as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select no.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal

Question 12

Single choice

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a hybrid configuration of Azure Active Directory (Azure AD).

You have an Azure HDInsight cluster on a virtual network.

You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.

You need to configure the environment to support the planned authentication.

Solution: You create a site-to-site VPN between the virtual network and the on-premises network.

Does this meet the goal?

A
Yes
B
No

Reveal answer details Close answer details

Correct answerA

Explanation

You can connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.
Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions: Create Azure Virtual Network.
Create a custom DNS server in the Azure Virtual Network.
Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.
Configure forwarding between the custom DNS server and your on-premises DNS server.

References:
https://docs.microsoft.com/en-us/azure/hdinsight/connect-on-premises-network

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 13

Testlet 5 Lab simulation

Simulation

You need to prevent HTTP connections to the rg1lod1234578n1 Azure Storage account.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

The "Secure transfer required" feature is now supported in Azure Storage account. This feature enhances the security of your storage account by enforcing all requests to your account through a secure connection.
This feature is disabled by default.
1. In Azure Portal select you Azure Storage account rg1lod12345678n1.
2. Select Configuration, and Secure Transfer required.

References:
https://techcommunity.microsoft.com/t5/Azure/quot-Secure-transfer-required-quot-is-available-in-Azure-Storage/m-p/82475

Question 14

Hotspot

HOTSPOT

You have a Microsoft Entra tenant that contains the users shown in the following table.

From Microsoft Entra Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit.

From PIM, you assign the Security Administrator role to the following groups:

1. Group1: Active assignment type, permanently assigned
2. Group2: Eligible assignment type, permanently eligible

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

No - User1 is a member of Group1: that has Active assignment type, permanently assigned. Active assignments don't require the member to perform any activations to use the role. Members or owners assigned as active have the privileges assigned to the role at all times.

Yes - No approval is required. There is no waiting.

No - User3 is a member of Group1 and Group 2. Active assignments don't require the member to perform any activations to use the role.

References:
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-assign-member-owner

Question 15

Single choice

You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.

You create the Azure policy shown in the following exhibit.

You assign the policy to RG1.

What will occur if you assign the policy to NSG1 and NSG2?

A
Flow logs will be enabled for NSG1 and NSG2.
B
Flow logs will be enabled for NSG2 only.
C
Flow logs will be disabled for NSG1 and NSG2.
D
Flow logs will be enabled for NSG1 only.

Reveal answer details Close answer details

Correct answerB

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 16

Testlet 5 Lab simulation

Simulation

You need to ensure that connections through an Azure Application Gateway named Homepage-AGW are inspected for malicious requests.

To complete this task, sign in to the Azure portal.

You do not need to wait for the task to complete.

Reveal model answer Close model answer

You need to enable the Web Application Firewall on the Application Gateway.

1. In the Azure portal, type Application gateways in the search box, select Application gateways from the search results then select the gateway named Homepage-AGW. Alternatively, browse to Application Gateways in the left navigation pane.
2. In the properties of the application gateway, click on Web application firewall.
3. For the Tier setting, select WAF V2.
4. In the Firewall status section, click the slider to switch to Enabled.
5. In the Firewall mode section, click the slider to switch to Prevention.
6. Click Save to save the changes.

Question 17

Single choice

You have an Azure subscription.

You need to deploy an Azure virtual WAN to meet the following requirements:

1. Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.
2. Ensure that security rules sync between the regions.

What should you use?

A
Azure Firewall Manager
B
Azure Virtual Network Manager
C
Azure Network Function Manager
D
Azure Front Door

Reveal answer details Close answer details

Correct answerA

Question 18

Single choice

You have an Azure subscription that contains an Azure Data Lake Storage Gen2 account named storage1.

You deploy an Azure Synapse Analytics workspace named synapsews1 to a managed virtual network.

You need to enable access from synapsews1 to storage1.

What should you configure?

A
peering
B
a private endpoint
C
a network security group (NSG)
D
a virtual network gateway

Reveal answer details Close answer details

Correct answerB

Explanation

Connect to workspace resources from a restricted network Suppose you are an IT administrator who is managing your organization's restricted network. You want to enable the network connection between Azure Synapse Analytics Studio and a workstation within this restricted network. This article shows you how.

Step 1: Add network outbound security rules to the restricted network Step 2: Create private link hubs Step 3: Create a private endpoint for your Synapse Studio Step 4: Create private endpoints for your workspace resource

References:
https://learn.microsoft.com/en-us/azure/synapse-analytics/security/how-to-connect-to-workspace-from-restricted-network

Question 19

Single choice

You have an Azure subscription.

You plan to deploy Microsoft Defender External Attack Surface Management (Defender EASM) to identify and monitor externally facing assets.

You create a new Defender EASM instance named EASM1.

What should you do next?

A
Create a custom attack surface.
B
Add a Log Analytics workspace.
C
Add a discovery group.
D
Import seeds from an organization.

Reveal answer details Close answer details

Correct answerD

Question 20

Hotspot

HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

Box 1: Yes
Azure Monitor maximizes the availability and performance of your applications and services by delivering a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments.

Box 2: Yes
Alerts in Azure Monitor proactively notify you of critical conditions and potentially attempt to take corrective action.

Box 3: Yes
Azure Monitor uses Target Resource, which is the scope and signals available for alerting. A target can be any Azure resource. Example targets:
a virtual machine, a storage account, a virtual machine scale set, a Log Analytics workspace, or an Application Insights resource.

References:
https://docs.microsoft.com/en-us/azure/azure-monitor/overview
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview

Question 21

Single choice

You have an Azure subscription that contains an Azure SQL server named sqlsrv1 and an Azure SQL database named DB1. Sqlsrv1 is configured for Microsoft Entra authentication only.

You have the Microsoft Entra identities shown in the following table.

Which users can create scoped credentials for DB1?

A
User1 only
B
User1 and User2 only
C
User1, User2, and User3

Reveal answer details Close answer details

Correct answerC

Case study

Case Study 4

Case Study Questions

Overview

Sub1 Resources
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
The on-premises network contains a datacenter in each office.
Fabtikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that
includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.

Sub2 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
1. Bot Manager 1.1
2. Azure-managed Default Rule Set (DRS)

Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
1. MIST SP 800-53 Rev. 4

2. Microsoft cloud security benchmark (MCSB)
3. System and Organization Controls (SOC) 2 Type 2

Planned Changes and Requirements
Planned Changes
Sub2 contains a resource group named RG2.
Fabtikam plans to implement the following changes: Deploy the following key vaults to RG1: AKV2 in the West Europe Azure region AKV3 in the Central US Azure region AKV4 in the East US Azure region

Deploy the following key vaults to RG2: AKV5 in the East US region

Configure VM1 to read data from storage1.

Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan

For WAF1, implement rate limiting rules based on the request location.
Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
Create a new storage account named storage2 that supports Azure Table storage.
Enforce multifactor authentication (MFA) when database administrators access SQLdbl.
Implement ExpressRoute circuits to the on-premises network as shown in the following table.

For RG1. create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.

Technical Requirements
Fabrikam has the following technical requirements: If VM1 is deleted, the permissions for VM1 must be removed automatically.
The AKS1 managed identity must only be able to pull images from Registry1.
The ID1 managed identity must be able to push images to and pull images from Registry1.
All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

Question 22

Testlet 4 Single choice

You need to delegate a user to implement the planned change for Defender for Cloud.

The solution must follow the principle of least privilege.

Which user should you choose?

A
Admin1
B
Admin2
C
Admin3
D
Admin4

Reveal answer details Close answer details

Correct answerB

Question 23

Single choice

You have an Azure subscription that contains the resources shown in the following table.

You plan to deploy an Azure Private Link service named APL1.

Which resource must you reference during the creation of APL1?

A
VMSS1
B
VM1
C
SQL
D
LB1

Reveal answer details Close answer details

Correct answerD

Question 24

Single choice

You have an Azure subscription that contains a user named User1.

You need to ensure that User1 can create managed identities. The solution must use the principle of least privilege.

What should you do?

A
Create a management group and assign User1 the Hybrid Identity Administrator Azure Active Directory (Azure AD) role.
B
Create a management group and assign User1 the Managed Identity Operator role.
C
Create a resource group and assign User1 to the Managed Identity Contributor role.
D
Create an organizational unit (OU) and assign User1 the User administrator Azure Active Directory (Azure AD) role.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/
how-manage-user-assigned-managed-identities

Question 25

Single choice

Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory Azure (Azure AD) tenant named contoso.com.

The company develops a mobile application named App1. App1 uses the OAuth 2 implicit grant type to
acquire Azure AD access tokens.

You need to register App1 in Azure AD.

What information should you obtain from the developer to register the application?

A
a redirect URI
B
a reply URL
C
a key
D
an application ID

Reveal answer details Close answer details

Correct answerA

Explanation

For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.

References:
https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

Question 26

Single choice

You have an Azure environment.

You need to identify any Azure configurations and workloads that are non-compliant with ISO 27001 standards.

What should you use?

A
Azure Sentinel
B
Azure Active Directory (Azure AD) Identity Protection
C
Azure Security Center
D
Azure Advanced Threat Protection (ATP)

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.microsoft.com/en-us/azure/security-center/security-center-compliance-dashboard

Question 27

Single choice

You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry.

You need to use automatically generated service principal for the AKS cluster to authenticate to the Azure Container Registry.

What should you create?

A
a secret in Azure Key Vault
B
a role assignment
C
an Azure Active Directory (Azure AD) user
D
an Azure Active Directory (Azure AD) group

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal

Question 28

Drag & drop

DRAG DROP

You have three Azure subscriptions and a user named User1.

You need to provide User1 with the ability to manage and view costs for the resources across all three subscriptions. The solution must use the principle of least privilege.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Reveal answer details Close answer details

Question 29

Single choice

You have an Azure subscription that contains the resources shown in the following table.

You create an Azure DDoS Protection plan named DDoS1 in the West US Azure region.

Which resources can you add to DDoS1?

A
VNetl1only
B
WebApp1 only
C
VNet1 and VNet2 only
D
VNet1 and WebApp1 only
E
VNet1, VNet2, and WebApp1

Reveal answer details Close answer details

Correct answerC

Question 30

Single choice

You have an Azure subscription that contains an Azure web app named 1 and a virtual machine named VM1. VM1 runs Microsoft SQL Server and is connected to a virtual network named VNet1. App1, VM1, and Vent are in the US Central Azure region.

You need to ensure that App1 can connect to VM1. The solution must minimize costs.

A
NAT gateway integration
B
Azure Front Door
C
regional virtual network integration
D
gateway-required virtual network integration
E
Azure Application Gateway integration

Reveal answer details Close answer details

Correct answerC

Explanation

Virtual network integration is used only to make outbound calls from your app into your virtual network.
Virtual network integration gives your app access to resources in your virtual network, but it doesn't grant inbound private access to your app from the virtual network.

The VNet integration feature behaves differently when it's used with virtual networks in the same region and with virtual networks in other regions. The VNet integration feature has two variations:
1. Regional virtual network integration: When you connect to virtual networks in the same region, you must have a dedicated subnet in the virtual network you're integrating with.
2. Gateway-required virtual network integration: When you connect directly to virtual networks in other regions or to a classic virtual network in the same region, you need an Azure Virtual Network gateway created in the target virtual network.

https://learnwithankit.medium.com/azure-app-service-networking-vnet-integration-and-access-restriction-de5fdbdddd14

Question 31

Single choice

You have an Azure SQL Database server named SQL1.

You plan to turn on Advanced Threat Protection for SQL1 to detect all threat detection types.

Which action will Advanced Threat Protection detect as a threat?

A
A user updates more than 50 percent of the records in a table.
B
A user attempts to sign as select * from table1.
C
A user is added to the db_owner database role.
D
A user deletes more than 100 records from the same table.

Reveal answer details Close answer details

Correct answerB

Explanation

Advanced Threat Protection can detect potential SQL injections: This alert is triggered when an active exploit happens against an identified application vulnerability to SQL injection. This means the attacker is trying to inject malicious SQL statements using the vulnerable application code or stored procedures.

References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threat-detection-overview

Question 32

Hotspot

HOTSPOT

Your company uses cloud-based resources from the following platforms:

1. Azure
2. Amazon Web Services (AWS)
3. Google Cloud Platform (GCP)

You plan to implement Microsoft Defender for Cloud.

On which platforms can you use Defender for Cloud to protect containers and storage? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Case study

Case Study 1

Overview

Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.

The company hosts its entire server infrastructure in Azure.

Contoso has two Azure subscriptions named Sub1 and Sub2. Both subscriptions are associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

Technical requirements

Contoso identifies the following technical requirements:

Deploy Azure Firewall to VNetWork1 in Sub2.
Register an application named App2 in contoso.com.
Whenever possible, use the principle of least privilege.
Enable Azure AD Privileged Identity Management (PIM) for contoso.com

Existing Environment

Azure AD

Contoso.com contains the users shown in the following table.

Contoso.com contains the security groups shown in the following table.

Sub1

Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6.

User2 creates the virtual networks shown in the following table.

Sub1 contains the locks shown in the following table.

Sub1 contains the Azure policies shown in the following table.

Sub2

Sub2 contains the virtual machines shown in the following table.

All virtual machines have the public IP addresses and the Web Server (IIS) role installed. The firewalls for each virtual machine allow ping requests and web requests.

Sub2 contains the network security groups (NSGs) shown in the following table.

NSG1 has the inbound security rules shown in the following table.

NSG2 has the inbound security rules shown in the following table.

NSG3 has the inbound security rules shown in the following table.

NSG4 has the inbound security rules shown in the following table.

NSG1, NSG2, NSG3, and NSG4 have the outbound security rules shown in the following table.

Contoso identifies the following technical requirements:

1. Deploy Azure Firewall to VNetwork1 in Sub2.
2. Register an application named App2 in contoso.com.
3. Whenever possible, use the principle of least privilege.
4. Enable Azure AD Privileged Identity Management (PIM) for contoso.com.

Question 33

Testlet 1 Hotspot

HOTSPOT

You are evaluating the security of the network communication between the virtual machines in Sub2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

1 - No, as traffic would be sourced from internet since it is destined to the public IP address of VM2. 2 - Yes, as VM3 has no NSGs interfering and traffic is contained within the same vnet. 3 - No, as VM5 is in a separate vnet and there is no mention of any peering going on.

Question 34

Hotspot

HOTSPOT

You have an Azure subscription that uses Microsoft Defender for Cloud.

You plan to use the Secure Score Over Time workbook.

You need to configure the Continuous export settings for the Defender for Cloud data.

Which two settings should you configure? To answer, select the appropriate settings in the answer area.

NOTE: Each correct selection is worth one point.

stem image

Reveal answer details Close answer details

Question 35

Single choice

You have 15 Azure virtual machines in a resource group named RG1.

All virtual machines run identical applications.

You need to prevent unauthorized applications and malware from running on the virtual machines.

What should you do?

A
Apply an Azure policy to RG1.
B
From Azure Security Center, configure adaptive application controls.
C
Configure Azure Active Directory (Azure AD) Identity Protection.
D
Apply a resource lock to RG1.

Reveal answer details Close answer details

Correct answerB

Explanation

Microsoft Defender for Cloud helps you prevent, detect, and respond to threats. Defender for Cloud gives you increased visibility into, and control over, the security of your Azure resources. It provides integrated security monitoring and policy management across your Azure subscriptions. It helps detect threats that might otherwise go unnoticed, and works with a broad ecosystem of security solutions.
Defender for Cloud helps you optimize and monitor the security of your virtual machines by: Providing security recommendations for the virtual machines. Example recommendations include: apply system updates, configure ACLs endpoints, enable antimalware, enable network security groups, and apply disk encryption.
Monitoring the state of your virtual machines.

References:
https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-application

Question 36

Single choice

You have 10 on-premises servers that run Windows Server 2019.

You plan to implement Azure Security Center vulnerability scanning for the servers.

What should you install on the servers first?

A
the Azure Arc enabled servers Connected Machine agent
B
the Microsoft Defender for Endpoint agent
C
the Security Events data connector in Azure Sentinel
D
the Microsoft Endpoint Configuration Manager client

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.microsoft.com/en-us/azure/azure-arc/servers/agent-overview
https://docs.microsoft.com/en-us/azure/security-center/deploy-vulnerability-assessment-vm

Question 37

Single choice

You have an Azure AD tenant. The tenant contains users that are assigned Azure AD Premium P2 licenses.

You have a partner company that has a domain named fabrikam.com. The fabrikam.com domain contains a user named User1. User1 has an email address of [email protected]

You need to provide User1 with access to the resources in the tenant. The solution must meet the following requirements:

1. User1 must be able to sign in by using the [email protected] credentials.
2. You must be able to grant User1 access to the resources in the tenant.
3. Administrative effort must be minimized.

What should you do?

A
Create a user account for User1.
B
To the tenant, add fabrikam.com as a custom domain.
C
Create an invite for User1.
D
Set Enable guest self-service sign up via user flows to Yes for the tenant.

Reveal answer details Close answer details

Correct answerC

Explanation

With Azure AD B2B collaboration, you can invite anyone to collaborate with your organization using their own work, school, or social account.

References:
https://learn.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 38

Testlet 5 Lab simulation

Simulation

You need to configure a virtual network named VNET2 to meet the following requirements:

1. Administrators must be prevented from deleting VNET2 accidentally.
2. Administrators must be able to add subnets to VNET2 regularly.

To complete this task, sign in to the Azure portal and modify the Azure resources.

Reveal model answer Close model answer

Locking prevents other users in your organization from accidentally deleting or modifying critical resources, such as Azure subscription, resource group, or resource.

Note: In Azure, the term resource refers to an entity managed by Azure. For example, virtual machines, virtual networks, and storage accounts are all referred to as Azure resources.

1. In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET2. Alternatively, browse to Virtual Networks in the left navigation pane.

2. In the Settings blade for virtual network VNET2, select Locks.

3. To add a lock, select Add.

4. For Lock type select Delete lock, and click OK

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

Question 39

Hotspot

HOTSPOT

You have a management group named MG1 that contains an Azure subscription named Sub1.

Sub1 contains the resources shown in the following table.

You create an Azure Virtual Network Manager instance named AVNM1 that has the following configurations:

Management scope: MG1
Network groups:
Name: Group1
Group members: VNet1

Security admin configuration:
Name: SAT
Rule collections:

Name: SACollection1
Target network groups: Group1
Security admin rules:
Name: SARule1
Priority: 500
Action: Deny
Direction: Inbound
Source type: Any
Source port *

SA1 is deployed to all Azure regions.

You create a Virtual Network Manager instance named AVNM2 that has the following configurations:

Management scope: Sub1
Network groups:
Name: Group2

Group members: VNet1
Security admin configuration:
Name: SA2
Rule collections:

Name: SACollection2

Target network groups: Group2

Security admin rules:

Name: SARule2

Priority: 500

Action: Always allow

Direction: Inbound

Source type: Any

Source port: *

SA2 is deployed to all Azure regions.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE Each correct selection is worth one point.

Reveal answer details Close answer details

Question 40

Drag & drop

DRAG DROP

You create an Azure subscription with Azure AD Premium P2.

You need to ensure that you can use Azure Active Directory (Azure AD) Privileged Identity Management (PIM) to secure Azure AD roles.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal answer details Close answer details

Question 41

Single choice

You have an Azure subscription that contains an Azure App Services web app named WebApp1 and an Azure key vault named Vault1. Vault1 has the certificates shown in the following table.

You plan to implement TLS for WebApp1.

You need to add a certificate to WebApp1.

Which certificates from Vault1 can you add to WebApp1?

A
Cert1 and Cert2 only
B
Cert1 and Cert3 only
C
Cert3 and Cert4 only
D
Cert1, Cert2, Cert3, and Cert4

Reveal answer details Close answer details

Correct answerA

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 42

Testlet 5 Lab simulation

Simulation

You need to prevent HTTP connections to the rg1lod10598168n1 Azure Storage account.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

Require secure transfer to ensure secure connections
You can configure your storage account to accept requests from secure connections only by setting the Secure transfer required property for the storage account. When you require secure transfer, any requests originating from an insecure connection are rejected. Microsoft recommends that you always require secure transfer for all of your storage accounts.

When secure transfer is required, a call to an Azure Storage REST API operation must be made over HTTPS. Any request made over HTTP is rejected.

Require secure transfer in the Azure portal
You can turn on the Secure transfer required property when you create a storage account in the Azure portal. You can also enable it for existing storage accounts.

Require secure transfer for an existing storage account

Step 1: Select an existing storage account (here: rg1lod28681041n1) in the Azure portal.

Step 2: In the storage account menu pane, under Settings, select Configuration.

Step 3: Under Secure transfer required, select Enabled.

References:
https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer

Case study

Case Study 3

Existing Environment

Network Environment

Fabrikam has a Microsoft 365 subscription and an Azure subscription named subscription1.

The network contains an on-premises Active Directory domain named Fabrikam.com. The domain contains two organizational units (OUs) named OU1 and OU2. Azure AD Connect cloud sync syncs only
OU1.

The Azure resources hierarchy is shown in the following exhibit.

The Azure Active Directory (Azure AD) tenant contains the users shown in the following table.

Azure AD contains the resources shown in the following table.

Subscription1 Resources

Subscription1 contains the virtual networks shown in the following table.

Subscription1 contains the network security groups (NSGs) shown in the following table.

Subscription1 contains the virtual machines shown in the following table.

Subscription1 contains the Azure key vaults shown in the following table.

Subscription1 contains a storage account named storage1 in the West US Azure region.

Planned Changes and Requirements

Planned Changes

Fabrikam plans to implement the following changes:

Create two application security groups as shown in the following table.

1. Associate the network interface of VM1 to ASG1.
2. Deploy SecPol1 by using Azure Security Center.
3. Deploy a third-party app named App1. A version of App1 exi sts for all available operating systems.
4. Create a resource group named RG2.
5. Sync OU2 to Azure AD.
6. Add User1 to Group1.

Technical Requirements

Fabrikam identifies the following technical requirements:

The finance department users must reauthenticate after three hours when they access SharePoint Online.
Storage1 must be encrypted by using customer-managed keys and automatic key rotation.
From Sentinel1, you must ensure that the following notebooks can be launched:
- Entity Explorer - Account
- Entity Explorer - Windows Host
- Guided Investigation Process Alerts
VM1, VM2, and VM3 must be encrypted by using Azure Disk Encryption.
Just in time (JIT) VM access for VM1, VM2, and VM3 must be enabled.
App1 must use a secure connection string stored in KeyVault1.
KeyVault1 traffic must NOT travel over the internet.

Question 43

Testlet 3 Hotspot

HOTSPOT

You need to configure support for Azure Sentinel notebooks to meet the technical requirements.

What is the minimum number of Azure container registries and Azure Machine Learning workspaces required?

Reveal answer details Close answer details

Explanation

References:
https://docs.microsoft.com/en-us/azure/sentinel/notebooks

Question 44

Single choice

Your company recently created an Azure subscription. You have, subsequently, been tasked with making sure that you are able to secure Azure AD roles by making use of Azure Active Directory (Azure AD)
Privileged Identity Management (PIM).

Which of the following actions should you take FIRST?

A
You should sign up Azure Active Directory (Azure AD) Privileged Identity Management (PIM) for Azure
AD roles.
B
You should consent to Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
C
You should discover privileged roles.
D
You should discover resources.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started

Question 45

Single choice

You need to consider the underlined segment to establish whether it is accurate.

Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it.

Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type.

The mobile application must be registered in Azure AD.

You require a redirect URI from the developer for registration purposes.

Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

A
No adjustment required
B
a secret
C
a login hint
D
a client ID

Reveal answer details Close answer details

Correct answerA

Explanation

For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.

References:
https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

Question 46

Hotspot

HOTSPOT

You have an Azure subscription named Subscription1 that contains a resource group named RG1 and a user named User1. User1 is assigned the Owner role for RG1.

You create an Azure Blueprints definition named Blueprint1 that includes a resource group named RG2 as shown in the following exhibit.

You assign Blueprint1 to Subscription1 by using the following settings:

1. Lock assignment: Read Only
2. Managed Identity: System assigned

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

References:
https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

Question 47

Single choice

You have an Azure subscription that contains the resources shown in the following table.

You need to configure AFW1 to only allow traffic from VM1 to storage accounts in the West US Azure region. The solution must minimize administrative effort.

What should you configure?

A
a DNAT rule
B
a network rule
C
an SNAT private IP address range
D
an application rule

Reveal answer details Close answer details

Correct answerB

Question 48

Single choice

Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory
(Azure AD) tenant named contoso.com.

The company develops an application named App1. App1 is registered in Azure AD.

You need to ensure that App1 can access secrets in Azure Key Vault on behalf of the application users.

What should you configure?

A
an application permission without admin consent
B
a delegated permission without admin consent
C
a delegated permission that requires admin consent
D
an application permission that requires admin consent

Reveal answer details Close answer details

Correct answerB

Explanation

Delegated permissions - Your client application needs to access the web API as the signed-in user, but with access limited by the selected permission. This type of permission can be granted by a user unless the permission requires administrator consent.

Incorrect Answers:
A, D: Application permissions - Your client application needs to access the web API directly as itself (no user context). This type of permission requires administrator consent and is also not available for public (desktop and mobile) client applications.

References:
https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

Case study

Case Study 4

Case Study Questions

Overview

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.

Sub2 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
1. MIST SP 800-53 Rev. 4

2. Microsoft cloud security benchmark (MCSB)
3. System and Organization Controls (SOC) 2 Type 2

Deploy the following key vaults to RG2: AKV5 in the East US region

Configure VM1 to read data from storage1.

Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan

For RG1. create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.

Question 49

Testlet 4 Single choice

You need to implement the planned change for WAF1.

The solution must minimize administrative effort

What should you do?

A
Create an Azure policy.
B
Modify the Azure-managed DRS.
C
Add a custom rule.
D
Modify the Bot Manager 1.1 rule set.

Reveal answer details Close answer details

Correct answerC

Question 50

Drag & drop

DRAG DROP

You have an Azure subscription named Sub1. Sub1 contains an Azure virtual machine named VM1 that runs Windows Server 2016.

You need to encrypt VM1 disks by using Azure Disk Encryption.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal answer details Close answer details

Explanation

References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disks

Question 51

Single choice

You have an Azure subscription linked to an Azure Active Directory Premium Plan 1 tenant.

You plan to implement Azure Active Directory (Azure AD) Identity Protection.

You need to ensure that you can configure a user risk policy and a sign-in risk policy.

What should you do first?

A
Purchase Azure Active Directory Premium Plan 2 licenses for all users.
B
Register all users for Azure Multi-Factor Authentication (MFA).
C
Enable security defaults for Azure AD.
D
Upgrade Azure Security Center to the standard tier.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa

Question 52

Single choice

You have an Azure AD tenant that contains three users named User1, User2, and User3.

You configure Azure AD Password Protection as shown in the following exhibit.

The users perform the following tasks:

1. User1 attempts to reset her password to C0nt0s0.
2. User2 attempts to reset her password to F@brikamHQ.
3. User3 attempts to reset her password to Pr0duct123.

Which password reset attempts fail?

A
User1 only
B
User2 only
C
User3 only
D
User1 and User 3 only
E
User1, User2, and User3

Reveal answer details Close answer details

Correct answerE

Question 53

Single choice

You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them.

You decide to create an Azure Log Analytics query to confirm your suspicions. The query will detect unsuccessful user sign-in attempts from the last few days. You want to make sure that the results only show users who had failed to sign-in more than five times.

Which of the following should be included in your query?

A
The EventID and CountIf() parameters.
B
The ActivityID and CountIf() parameters.
C
The EventID and Count() parameters.
D
The ActivityID and Count() parameters.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples

Question 54

Drag & drop

DRAG DROP

You have an Azure subscription that contains 100 virtual machines. Azure Diagnostics is enabled on all the virtual machines.

You are planning the monitoring of Azure services in the subscription.

You need to retrieve the following details:

1. Identify the user who deleted a virtual machine three weeks ago.
2. Query the security events of a virtual machine that runs Windows Server 2016.

What should you use in Azure Monitor? To answer, drag the appropriate configuration settings to the correct details. Each configuration setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

Box1: Activity log
Azure activity logs provide insight into the operations that were performed on resources in your subscription. Activity logs were previously known as "audit logs" or "operational logs," because they report control-plane events for your subscriptions.

Activity logs help you determine the "what, who, and when" for write operations (that is, PUT, POST, or DELETE).

Box 2: Logs
Log Integration collects Azure diagnostics from your Windows virtual machines, Azure activity logs, Azure Security Center alerts, and Azure resource provider logs. This integration provides a unified dashboard for all your assets, whether they're on-premises or in the cloud, so that you can aggregate, correlate, analyze, and alert for security events.

References:
https://docs.microsoft.com/en-us/azure/security/azure-log-audit

Question 55

Hotspot

HOTSPOT

You have an Azure subscription that contains an Azure firewall named AzFW1. AzFW1 has a firewall policy named FWPolicy1.

You need to add rule collections to FWPolicy1 to meet the following requirements:

1. Allow traffic based on the FQDN of the destination.
2. Allow TCP traffic.

Which types of rule collections should you add for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 56

Single choice

You have an Azure subscription named Sub1 that contains the Azure key vaults shown in the following table:

In Sub1, you create a virtual machine that has the following configurations:

1. Name: VM1
2. Size: DS2v2
3. Resource group: RG1
4. Region: West Europe
5. Operating system: Windows Server 2016

You plan to enable Azure Disk Encryption on VM1.

In which key vaults can you store the encryption key for VM1?

A
Vault1 or Vault3 only
B
Vault1, Vault2, Vault3, or Vault4
C
Vault1 only
D
Vault1 or Vault2 only

Reveal answer details Close answer details

Correct answerA

Explanation

In order to make sure the encryption secrets don't cross regional boundaries, Azure Disk Encryption needs the Key Vault and the VMs to be co-located in the same region. Create and use a Key Vault that is in the same region as the VM to be encrypted.

References:
https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites

Question 57

Single choice

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant.

You plan to implement single sign-on (SSO) for Azure AD resources.

You need to configure an Intranet Zone setting for all users by using a Group Policy Object (GPO).

Which setting should you configure?

A
Logon options
B
Allow updates to status bar via script
C
Allow active scripting
D
Access data sources across domains

Reveal answer details Close answer details

Correct answerB

Question 58

Single choice

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.

You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.

What should you use?

A
device configuration policies in Microsoft Intune
B
an Azure Desired State Configuration (DSC) virtual machine extension
C
application security groups
D
Azure Logic Apps
E
security policies in Azure Security Center
F
device compliance policies in Microsoft Intune

Reveal answer details Close answer details

Correct answerB

Explanation

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.

Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

References:
https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started

Question 59

Hotspot

HOTSPOT

Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD).

The Azure AD tenant contains the users shown in the following table.

You configure the Authentication methods - Password Protection settings for adatum.com as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 60

Single choice

You have a hybrid configuration of Azure Active Directory (Azure AD).

All users have computers that run Windows 10 and are hybrid Azure AD joined.

You have an Azure SQL database that is configured to support Azure AD authentication.

Database developers must connect to the SQL database by using Microsoft SQL Server Management Studio (SSMS) and authenticate by using their on-premises Active Directory account.

You need to tell the developers which authentication method to use to connect to the SQL database from SSMS. The solution must minimize authentication prompts.

Which authentication method should you instruct the developers to use?

A
SQL Login
B
Active Directory - Universal with MFA support
C
Active Directory - Integrated
D
Active Directory - Password

Reveal answer details Close answer details

Correct answerC

Explanation

Azure AD can be the initial Azure AD managed domain. Azure AD can also be an on-premises Active Directory Domain Services that is federated with the Azure AD.

Using an Azure AD identity to connect using SSMS or SSDT
The following procedures show you how to connect to a SQL database with an Azure AD identity using SQL Server Management Studio or SQL Server Database Tools.

Active Directory integrated authentication
Use this method if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.

1. Start Management Studio or Data Tools and in the Connect to Server (or Connect to Database Engine) dialog box, in the Authentication box, select Active Directory - Integrated. No password is needed or can be entered because your existing credentials will be presented for the connection.

2. Select the Options button, and on the Connection Properties page, in the Connect to database box, type the name of the user database you want to connect to. (The AD domain name or tenant ID" option is only supported for Universal with MFA connection options, otherwise it is greyed out.)

References:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/sql-database/sql-database-aad-authentication-configure.md

Question 61

Single choice

You onboard Azure Sentinel. You connect Azure Sentinel to Azure Security Center.

You need to automate the mitigation of incidents in Azure Sentinel. The solution must minimize administrative effort.

What should you create?

A
an alert rule
B
a playbook
C
a function app
D
a runbook

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Question 62

Single choice

You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure SQL Database instance that is configured to support Azure AD authentication.

Database developers must connect to the database instance and authenticate by using their on-premises Active Directory account.

You need to ensure that developers can connect to the instance by using Microsoft SQL Server Management Studio. The solution must minimize authentication prompts.

Which authentication method should you recommend?

A
Active Directory - Password
B
Active Directory - Universal with MFA support
C
SQL Server Authentication
D
Active Directory - Integrated

Reveal answer details Close answer details

Correct answerD

Explanation

Use Active Directory password authentication when connecting with an Azure AD principal name using the Azure AD managed domain.

Use this method to authenticate to SQL DB/DW with Azure AD for native or federated Azure AD users. A native user is one explicitly created in Azure AD and being authenticated using user name and password, while a federated user is a Windows user whose domain is federated with Azure AD. The latter method (using user & password) can be used when a user wants to use their windows credential, but their local machine is not joined with the domain (for example, using a remote access). In this case, a Windows user can indicate their domain account and password and can authenticate to SQL DB/DW using federated credentials.

Incorrect Answers:
D: Use Active Directory integrated authentication if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.

References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure

Question 63

Single choice

You have an Azure subscription that contains a web app named App1. App1 provides users with product images and videos. Users access App1 by using a URL of HTTPS://app1.contoso.com.

You deploy two server pools named Pool1 and Pool2. Pool1 hosts product images. Pool2 hosts product videos.

You need to optimize the performance of App1. The solution must meet the following requirements:

1. Minimize the performance impact of TLS connections on Pool1 and Pool2.
2. Route user requests to the server pools based on the requested URL path.

What should you include in the solution?

A
Azure Bastion
B
Azure Front Door
C
Azure Traffic Manager
D
Azure Application Gateway

Reveal answer details Close answer details

Correct answerD

Explanation

With an Application Gateway behind Front Door, one can achieve 100% TLS/SSL offload and route only HTTP requests within their virtual network (VNET).

Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. Traditional load balancers operate at the transport layer (OSI layer 4 - TCP and UDP) and route traffic based on source IP address and port, to a destination IP address and port.

Application Gateway can make routing decisions based on additional attributes of an HTTP request, for example URI path or host headers.

Note: When should we deploy an Application Gateway behind Front Door?
The key scenarios why one should use Application Gateway behind Front Door are:

Front Door can perform path-based load balancing only at the global level but if one wants to load balance traffic even further within their virtual network (VNET) then they should use Application Gateway.
Since Front Door doesn't work at a VM/container level, so it can't do Connection Draining. However, Application Gateway allows you to do Connection Draining.
With an Application Gateway behind Front Door, one can achieve 100% TLS/SSL offload and route only HTTP requests within their virtual network (VNET).
Front Door and Application Gateway both support session affinity. While Front Door can direct subsequent traffic from a user session to the same cluster or backend in a given region, Application Gateway can direct affinitize the traffic to the same server within the cluster.

Incorrect:
* Azure Application Gateway
What is the difference between Azure Front Door and Azure Application Gateway?
While both Front Door and Application Gateway are layer 7 (HTTP/HTTPS) load balancers, the primary difference is that Front Door is a nonregional service whereas Application Gateway is a regional service.
While Front Door can load balance between your different scale units/clusters/stamp units across regions, Application Gateway allows you to load balance between your VMs/containers etc. that is within the scale unit.

* Azure Front Door
Azure Front Door supports dynamic site acceleration (DSA), TLS/SSL offloading and end to end TLS, Web Application Firewall, cookie-based session affinity, url path-based routing, free certificates and multiple domain managements, and many other features.

References:
https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq

Question 64

Drag & drop

DRAG DROP

You create an Azure subscription.

You need to ensure that you can use Azure Active Directory (Azure AD) Privileged Identity Management (PIM) to secure Azure AD roles.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal answer details Close answer details

Explanation

Step 1: Consent to PIM

Step: 2 Verify your identity by using multi-factor authentication (MFA)
Click Verify my identity to verify your identity with Azure MFA. You'll be asked to pick an account.

Step 3: Sign up PIM for Azure AD roles Once you have enabled PIM for your directory, you'll need to sign up PIM to manage Azure AD roles.

References:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started

Question 65

Hotspot

HOTSPOT

You have an Azure subscription that contains a user named User1. User1 is assigned the Reader role for the subscription.

You plan to create a custom role named Role1 and assign Role1 to User1.

You need to ensure that User1 can create and manage application security groups by using Azure portal.

Which two permissions should you add to Role1? To answer, select the appropriate permissions in the answer area.

NOTE: Each correct selection is worth one point.

stem image

Reveal answer details Close answer details

Explanation

1. Microsoft Portal
2. Microsoft Network

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-services-resource-providers

Question 66

Single choice

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.

You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.

What should you use?

A
device compliance policies in Microsoft Intune
B
Azure Automation State Configuration
C
application security groups
D
Azure Advisor

Reveal answer details Close answer details

Correct answerB

Explanation

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.

References:
https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started

Question 67

Hotspot

HOTSPOT

You have an Azure Subscription that is connected to an on-premises datacenter and contains the resources shown in the following table.

You need to configure virtual network service endpoints for VNet1 and VNet2. The solution must meet the following requirements:

1. The virtual machines that connect to the subnet of VNet1 must access storage1, storage2, and Azure
AD by using the Microsoft backbone network.
2. The virtual machines that connect to the subnet of VNet2 must access storage1 and KeyVault1 by using the Microsoft backbone network.
3. The virtual machines must use the Microsoft backbone network to communicate between VNet1 and VNet2.

How many service endpoints should you configure for each virtual network? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

stem image

Reveal answer details Close answer details

Explanation

Box 1: 1
VNet1

The virtual machines that connect to the subnet of VNet1 must access storage1, storage2, and Azure AD by using the Microsoft backbone network.
The virtual machines must use the Microsoft backbone network to communicate between VNet1 and VNet2.

First service endpoint: One service endpoint for Microsoft.Storage added to VNET1.
The question asks how many to add to VNET1. When adding service endpoints on the VNET1 side you only get to choose the service (Microsoft.Storage) not the actual storage accounts. Once you add this service endpoint it can be then linked to on the storage side for both accounts.

Second Service Endpoint: No second service endpoint needed.

Incorrect:
* Service Endpoint between Virtual Machines in the two Virtual Network VM is not a service endpoint type.

* Service Endpoint for Microsoft.AzureActiveDirectory
Microsoft.AzureActiveDirectory tag listed under services supporting service endpoints is used only for supporting service endpoints to ADLS Gen 1. Azure AD doesn't support service endpoints natively.

Box 2: 2
VNet2

The virtual machines that connect to the subnet of VNet2 must access storage1 and KeyVault1 by using the Microsoft backbone network.

First service endpoint: One service endpoint for Microsoft.Storage added to VNET2.
Second Service Endpoint: Azure Key Vault.

Note:
Service endpoints are available for the following Azure services and regions. The Microsoft.* resource is in parenthesis. Enable this resource from the subnet side while configuring service endpoints for your service:

Generally available

Azure Storage (Microsoft.Storage): Generally available in all Azure regions.
Azure Storage cross-region service endpoints (Microsoft.Storage.Global): Generally available in all Azure regions.
Azure SQL Database (Microsoft.Sql): Generally available in all Azure regions.
Azure Synapse Analytics (Microsoft.Sql): Generally available in all Azure regions for dedicated SQL pools (formerly SQL DW).
Azure Database for PostgreSQL server (Microsoft.Sql): Generally available in Azure regions where database service is available.
Azure Database for MySQL server (Microsoft.Sql): Generally available in Azure regions where database service is available.
Azure Database for MariaDB (Microsoft.Sql): Generally available in Azure regions where database service is available.
Azure Cosmos DB (Microsoft.AzureCosmosDB): Generally available in all Azure regions.
Azure Key Vault (Microsoft.KeyVault): Generally available in all Azure regions.
Azure Service Bus (Microsoft.ServiceBus): Generally available in all Azure regions.
Azure Event Hubs (Microsoft.EventHub): Generally available in all Azure regions.
Azure Data Lake Store Gen 1 (Microsoft.AzureActiveDirectory): Generally available in all Azure regions where ADLS Gen1 is available.
Azure App Service (Microsoft.Web): Generally available in all Azure regions where App service is available.
Azure Cognitive Services (Microsoft.CognitiveServices): Generally available in all Azure regions where Cognitive services are available.

References:
https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Question 68

Single choice

You have an Azure web app named WebApp1.

You upload a certificate to WebApp1.

You need to make the certificate accessible to the app code of WebApp1.

What should you do?

A
Add a user-assigned managed identity to WebApp1.
B
Add an app setting to the WebApp1 configuration.
C
Enable system-assigned managed identity for the WebApp1.
D
Configure the TLS/SSL binding for WebApp1.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code

Question 69

Multiple choice

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.

You plan to publish several apps in the tenant.

You need to ensure that User1 can grant admin consent for the published apps.

Which two possible user roles can you assign to User1 to achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A
Application developer
B
Security administrator
C
Application administrator
D
User administrator
E
Cloud application administrator

Reveal answer details Close answer details

Correct answersC, E

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent

Question 70

Single choice

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016.

You need to deploy Microsoft Antimalware to the virtual machines.

Solution: You connect to each virtual machine and add a Windows feature.

Does this meet the goal?

A
Yes
B
No

Reveal answer details Close answer details

Correct answerB

Explanation

Microsoft Antimalware is deployed as an extension and not a feature.

References:
https://docs.microsoft.com/en-us/azure/security/fundamentals/antimalware

Case study

Case Study 2

Overview

Litware, Inc. is a digital media company that has 500 employees in the Chicago area and 20 employees in the San Francisco area.

Existing Environment

Litware has an Azure subscription named Sub1 that has a subscription ID of 43894a43-17c2-4a39-8cfc-
3540c2653ef4.

Sub1 is associated to an Azure Active Directory (Azure AD) tenant named litwareinc.com. The tenant contains the user objects and the device objects of all the Litware employees and their devices. Each user is assigned an Azure AD Premium P2 license. Azure AD Privileged Identity Management (PIM) is activated.

The tenant contains the groups shown in the following table.

The Azure subscription contains the objects shown in the following table.

Azure Security Center is set to the Free tier.

Planned changes

Litware plans to deploy the Azure resources shown in the following table.

Litware identifies the following identity and access requirements:

All San Francisco users and their devices must be members of Group1.
The members of Group2 must be assigned the Contributor role to Resource Group2 by using a permanent eligible assignment.
Users must be prevented from registering applications in Azure AD and from consenting to applications that access company information on the users' behalf.

Platform Protection Requirements

Litware identifies the following platform protection requirements:

Microsoft Antimalware must be installed on the virtual machines in Resource Group1.
The members of Group2 must be assigned the Azure Kubernetes Service Cluster Admin Role.
Azure AD users must be to authenticate to AKS1 by using their Azure AD credentials.
Following the implementation of the planned changes, the IT team must be able to connect to VM0 by
using JIT VM access.
A new custom RBAC role named Role1 must be used to delegate the administration of the managed disks in Resource Group1. Role1 must be available only for Resource Group1.

Security Operations Requirements

Litware must be able to customize the operating system security configurations in Azure Security Center.

Data and Application Requirements Litware identifies the following data and applications requirements:
1. The users in Group2 must be able to authenticate to SQLDB1 by using their Azure AD credentials.
2. WebApp1 must enforce mutual authentication.

General Requirements
Litware identifies the following general requirements:
1. Whenever possible, administrative effort must be minimized.
2. Whenever possible, use of automation must be maximized.

Question 71

Testlet 2 Hotspot

HOTSPOT

You need to ensure that the Azure AD application registration and consent configurations meet the identity and access requirements.

What should you use in the Azure portal? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent

Question 72

Single choice

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant.

As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings.

You are currently preparing to create a custom sensitivity label.

Solution: You start by creating a custom sensitive information type.

Does the solution meet the goal?

A
Yes
B
No

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.microsoft.com/en-us/office365/securitycompliance/customize-a-built-in-sensitive-information-type

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 73

Testlet 5 Lab simulation

Simulation

You need to prevent administrative users from accidentally deleting a virtual network named VNET1. The administrative users must be allowed to modify the settings of VNET1.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

Locking prevents other users in your organization from accidentally deleting or modifying critical resources, such as Azure subscription, resource group, or resource.

Note: In Azure, the term resource refers to an entity managed by Azure. For example, virtual machines, virtual networks, and storage accounts are all referred to as Azure resources.

1. In the Settings blade for virtual network VNET, select Locks.

2. To add a lock, select Add.

3. For Lock type select Delete lock, and click OK

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

Case study

Case Study 4

Case Study Questions

Overview

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.

Sub2 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
1. MIST SP 800-53 Rev. 4

2. Microsoft cloud security benchmark (MCSB)
3. System and Organization Controls (SOC) 2 Type 2

Deploy the following key vaults to RG2: AKV5 in the East US region

Configure VM1 to read data from storage1.

Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan

For RG1. create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.

Question 74

Testlet 4 Hotspot

HOTSPOT

You need to configure the AKS1 and ID1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.

Which role should you assign to each identity? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 75

Single choice

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry.

You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal.

Solution: You create a secret in Azure Key Vault.

Does the solution meet the goal?

A
Yes
B
No

Reveal answer details Close answer details

Correct answerB

Question 76

Single choice

You are in the process of configuring an Azure policy via the Azure portal.

Your policy will include an effect that will need a managed identity for it to be assigned.

Which of the following is the effect in question?

A
AuditIfNotExist
B
Disabled
C
DeployIfNotExist
D
EnforceOPAConstraint

Reveal answer details Close answer details

Correct answerC

Explanation

When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity.

References:
https://docs.microsoft.com/bs-latn-ba/azure/governance/policy/how-to/remediate-resources

Question 77

Hotspot

HOTSPOT

You have a Microsoft Entra tenant that contains the users shown in the following table.

You configure the Temporary Access Pass settings as shown in the following exhibit.

You add the Temporary Access Pass authentication method to Admin2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 78

Hotspot

HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

The tenant contains the named locations shown in the following table.

You create the conditional access policies for a cloud app named App1 as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 79

Testlet 5 Lab simulation

Simulation

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: User1 [email protected]

Azure Password: GpOAe4@lDg

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:

Lab Instance: 28681041

You need to email an alert to a user named [email protected] if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

In the Azure portal, search for and select the virtual machine named VM1.
In the left pane, select Alerts.
Select New alert rule.
In the New alert rule pane, enter the following information: In the Actions pane, select Add action group.
In the Add action group pane, enter the following information: Select OK.

Question 80

Single choice

You have an Azure subscription that contains an Azure Data Lake Storage account named sa1.

You plan to deploy an app named App1 that will access sa1 and perform operations, including Read, List, Create Directory, and Delete Directory.

You need to ensure that App1 can connect securely to sa1 by using a private endpoint.

What is the minimum number of private endpoints required for sa1?

Reveal answer details Close answer details

Correct answerB

Explanation

If you create a private endpoint for the Data Lake Storage Gen2 storage resource, then you should also create one for the Blob Storage resource. That's because operations that target the Data Lake Storage Gen2 endpoint might be redirected to the Blob endpoint. Similarly, if you add a private endpoint for Blob Storage only, and not for Data Lake Storage Gen2, some operations (such as Manage ACL, Create Directory, Delete Directory, etc.) will fail since the Gen2 APIs require a DFS private endpoint. By creating a private endpoint for both resources, you ensure that all operations can complete successfully.
https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

Question 81

Single choice

You have an Azure key vault named Vault1 that stores the resources shown in following table.

Which resources support the creation of a rotation policy?

A
Key1 Only
B
Cert1 only
C
Key1 and Secret1 only
D
Key1 and Cert1 only
E
Secret1 and Cert1 only
F
Key1, Secret1, and Cert1

Reveal answer details Close answer details

Correct answerC

Question 82

Hotspot

HOTSPOT

You have an Azure subscription named Sub1 that contains two resource groups named RGnet and NET.

You have the Azure Policy definition shown in the following exhibit.

You assign the policy definition to Sub1 and NET.

You plan to deploy the resources shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 83

Hotspot

HOTSPOT

You create resources in an Azure subscription as shown in the following table.

VNET1 contains two subnets named Subnet1 and Subnet2. Subnet1 has a network ID of 10.0.0.0/24.
Subnet2 has a network ID of 10.1.1.0/24.

Contoso1901 is configured as shown in the exhibit. (Click the Exhibit tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

Box 1: Yes
Access from Subnet1 is allowed.

Box 2: No
No access from Subnet2 is allowed.

Box 3: Yes
Access from IP address 193.77.10.2 is allowed.

Question 84

Drag & drop

DRAG DROP

You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table

The storage3 storage account is encrypted by using customer-managed keys.

YOU need to enable Microsoft Defender for storage to meet the following requirements:

1. The storage1 and storage2 account must be include in the defender for storage requirement.
2. The storage3 account must be exclude from the Defender for Storage protections.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and them in the correct order.

Reveal answer details Close answer details

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 85

Testlet 5 Lab simulation

Simulation

You need to ensure that web11597200 is protected from malware by using Microsoft Antimalware for Virtual Machines and is scanned every Friday at 01:00.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

You need to install and configure the Microsoft Antimalware extension on the virtual machine named web11597200.

1. In the Azure portal, type Virtual Machines in the search box, select Virtual Machines from the search results then select web11597200. Alternatively, browse to Virtual Machines in the left navigation pane.
2. In the properties of web11597200, click on Extensions.
3. Click the Add button to add an Extension.
4. Scroll down the list of extensions and select Microsoft Antimalware.
5. Click the Create button. This will open the settings pane for the Microsoft Antimalware Extension.
6. In the Scan day field, select Friday.
7. In the Scan time field, enter 60. The scan time is measured in minutes after midnight so 60 would be
01:00, 120 would be 02:00 etc.
8. Click the OK button to save the configuration and install the extension.

Question 86

Hotspot

HOTSPOT

Your on-premises network contains an Active Directory Domain Services (AD DS) domain and the devices shown in the following table.

You have a hybrid Microsoft Entra tenant that contains a synced user named User1.

You have an Azure subscription that contains the Azure Files shares shown in the following table.

Used is assigned the Storage File Data SMB Share Contributor role tor storage1 and storage2.

The Security settings for Share! are configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise. Select No.
NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 87

Single choice

You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect.

You create a new Azure subscription.

You discover that the synced on-premises user accounts cannot be assigned roles in the new subscription.

You need to ensure that you can assign Azure and Microsoft 365 roles to the synced Azure AD user accounts.

What should you do fist?

A
Configure the Azure AD tenant used by the new subscription to use pass-through authentication.
B
Configure the Azure AD tenant used by the new subscription to use federated authentication.
C
Change the Azure AD tenant used by the new subscription.
D
Configure a second instance of Azure AD Connect.

Reveal answer details Close answer details

Correct answerC

Explanation

You create a new Azure subscription. Hence you need to assign. These questions something are tricky.
Go over every answer and try to backtrack if it triggers an earlier statement.

Question 88

Hotspot

HOTSPOT

You have an Azure subscription that contains the resources shown in the following table.

You create the Azure Storage accounts shown in the following table.

You need to configure auditing for SQL1.

Which storage accounts and Log Analytics workspaces can you use as the audit log destination? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Question 89

Drag & drop

DRAG DROP

You are implementing conditional access policies.

You must evaluate the existing Azure Active Directory (Azure AD) risk events and risk levels to configure and implement the policies.

You need to identify the risk level of the following risk events:

1. Users with leaked credentials
2. Impossible travel to atypical locations
3. Sign-ins from IP addresses with suspicious activity

Which level should you identify for each risk event? To answer, drag the appropriate levels to the correct risk events. Each level may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

Azure AD Identity protection can detect six types of suspicious sign-in activities:

1. Users with leaked credentials
2. Sign-ins from anonymous IP addresses 3. Impossible travel to atypical locations
4. Sign-ins from infected devices 5. Sign-ins from IP addresses with suspicious activity
6. Sign-ins from unfamiliar locations

These six types of events are categorized in to 3 levels of risks - High, Medium & Low:

References:
http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

Question 90

Hotspot

HOTSPOT

You have a Microsoft Sentinel deployment.

You need to connect a third-party security solution to the deployment. The third-party solution will send Common Event Format (CER-formatted messages.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Reveal answer details Close answer details

Explanation

1. Linux server and a Syslog forwarder daemon
2. Azure Monitor agent

https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format
There are two main steps to making this connection, that will be explained below in detail:
- Designating a Linux machine or VM as a dedicated log forwarder, installing the Log Analytics agent on it, and configuring the agent to forward the logs to your Microsoft Sentinel workspace. The installation and configuration of the agent are handled by a deployment script.
- Configuring your device to send its logs in CEF format to a Syslog server.

Case study

Case Study 5

SIMULATION Questions

SIMULATION

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]
Azure Password: Ag1Bh9!#Bd

The following information is for technical support purposes only:
Lab Instance: 10598168

Question 91

Testlet 5 Lab simulation

Simulation

A user named Debbie has the Azure app installed on her mobile device.

You need to ensure that [email protected] is alerted when a resource lock is deleted.

To complete this task, sign in to the Azure portal.

Reveal model answer Close model answer

You need to configure an alert rule in Azure Monitor.

1. Type Monitor into the search box and select Monitor from the search results.
2. Click on Alerts.
3. Click on +New Alert Rule.
4. In the Scope section, click on the Select resource link.
5. In the Filter by resource type box, type locks and select Management locks (locks) from the filtered results.
6. Select the subscription then click the Done button.
7. In the Condition section, click on the Select condition link.
8. Select the Delete management locks condition the click the Done button.
9. In the Action group section, click on the Select action group link.
10. Click the Create action group button to create a new action group.
11. Give the group a name such as Debbie Mobile App (it doesn't matter what name you enter for the exam) then click the Next: Notifications > button.
12. In the Notification type box, select the Email/SMS message/Push/Voice option.
13. In the Email/SMS message/Push/Voice window, tick the Azure app Push Notifications checkbox and enter and enter [email protected] in the Azure account email field.
14. Click the OK button to close the window.
15. Enter a name such as Debbie Mobile App in the notification name box.
16. Click the Review & Create button then click the Create button to create the action group.
17. Back in the Create alert rule window, in the Alert rule details section, enter a name such as Management lock deletion in the Alert rule name field.
18. Click the Create alert rule button to create the alert rule.

Question 92

Single choice

You have an Azure Active Directory (Azure AD) tenant that contains a group named Group1.

You need to ensure that the members of Group1 sign in by using passwordless authentication.

What should you do?

A
Configure the sign-in risk policy.
B
Create a Conditional Access policy.
C
Configure the Microsoft Authenticator authentication method policy.
D
Configure the certificate-based authentication (CBA) policy.

Reveal answer details Close answer details

Correct answerC

Question 93

Single choice

You have been tasked with altering a current security playbook via Azure Security Center.

You want make sure that the playbook sends email messages to a distribution group, instead of a user.

Which of the following options should you use to achieve your goal?

A
Azure Blueprints
B
Activity Log
C
Azure Log Analytics
D
Azure Logic Apps Designer

Reveal answer details Close answer details

Correct answerD

Explanation

You can change an existing playbook in Security Center to add an action, or conditions. To do that you just need to click on the name of the playbook that you want to change, in the Playbooks tab, and Logic App Designer opens up.

References:
https://docs.microsoft.com/en-us/azure/security-center/security-center-playbooks

Question 94

Single choice

You have the Azure virtual machines shown in the following table.

For which virtual machine can you enable Update Management?

A
VM2 and VM3 only
B
VM2, VM3, and VM4 only
C
VM1, VM2, and VM4 only
D
VM1, VM2, VM3, and VM4
E
VM1, VM2, and VM3 only

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.microsoft.com/en-us/azure/automation/automation-update-management?toc=%2Fazure%
2Fautomation

Question 95

Single choice

You have an Azure resource group that contains 100 virtual machines.

You have an initiative named Initiative1 that contains multiple policy definitions. Initiative1 is assigned to the resource group.

You need to identify which resources do NOT match the policy definitions.

What should you do?

A
From Azure Security Center, view the Regulatory compliance assessment.
B
From the Policy blade of the Azure Active Directory admin center, select Compliance.
C
From Azure Security Center, view the Secure Score.
D
From the Policy blade of the Azure Active Directory admin center, select Assignments.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data#portal

VOL	TYPE	QUESTIONS
1	Single choice	52
2	Multiple choice	3
3	Hotspot	22
4	Drag & drop	7
5	Lab simulation	11