Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure Azure AD join.
B. Use Azure AD entitlement management to govern external users.
C. Enable Azure AD pass-through authentication and update the sign-in endpoint.
D. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
Show Answer
Correct Answer: B
Explanation: App1 is configured as a single-tenant Azure AD application, so users from another tenant (fabrikam.com) cannot authenticate unless they are added as external (B2B) users in the contoso tenant. Azure AD entitlement management is designed to govern external users by automating invitations, access packages, and lifecycle management, enabling fabrikam.com users to authenticate to App1. The other options do not enable cross-tenant user access to a single-tenant app.
Question 126
You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1.
You plan to migrate DB1 to an Azure SQL managed instance.
You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength.
Which type of encryption algorithm and key length should you use for the TDE protector?
A. RSA 3072
B. AES 256
C. RSA 4096
D. RSA 2048
Show Answer
Correct Answer: A
Explanation: For Azure SQL Managed Instance with customer-managed TDE (BYOK), the TDE protector must be an asymmetric RSA key stored in Azure Key Vault or HSM. The only supported key lengths are RSA 2048 and RSA 3072; RSA 4096 is not supported, and AES-256 applies to the data encryption key, not the TDE protector. To maximize encryption strength within supported options, choose RSA 3072.
Question 127
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using the Regulatory compliance dashboard in Microsoft Defender for Cloud.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Regulatory Compliance dashboard in Microsoft Defender for Cloud is a monitoring and reporting tool; it does not enforce or restrict where resources are deployed. To meet a requirement that App Service and Azure SQL resources are deployed only in specific regions, you would need enforcement mechanisms such as Azure Policy with allowed locations. Therefore, the proposed solution does not meet the goal.
Question 128
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You plan to deploy multiple instances of an Azure web app across several Azure regions.
You need to design an access solution for the app. The solution must meet the following replication requirements:
✑ Support rate limiting.
✑ Balance requests between all instances.
✑ Ensure that users can access the app in the event of a regional outage.
Solution: You use Azure Application Gateway to provide access to the app.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Azure Application Gateway is a regional Layer 7 load balancer and cannot distribute traffic across multiple Azure regions. Therefore, it does not provide global load balancing or regional failover. To balance requests across regions, support rate limiting, and ensure availability during a regional outage, a global service such as Azure Front Door (with WAF for rate limiting) is required.
Question 129
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using an Azure Policy initiative to enforce the location.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Azure Policy (or an Azure Policy initiative) can enforce allowed locations for resource deployment. By defining allowed regions, the company can ensure that App Service instances and their associated Azure SQL databases are created only in compliant Azure regions, meeting the regulatory requirement that resources reside in specific locations.
Question 130
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend creating resource groups based on locations and implementing resource locks on the resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Resource groups and resource locks do not enforce deployment location. Resource groups can contain resources from different regions, and locks only prevent deletion or modification. To restrict deployments to specific Azure regions, Azure Policy with allowed locations must be used. Therefore, the solution does not meet the regulatory requirement.
Question 131
You need to recommend a solution that meets the data requirements for App1.
What should you recommend deploying to each availability zone that contains an instance of App1?
A. an Azure Cosmos DB that uses multi-region writes
B. an Azure Data Lake store that uses geo-zone-redundant storage (GZRS)
C. an Azure Storage account that uses geo-zone-redundant storage (GZRS)
Show Answer
Correct Answer: A
Explanation: App1 requires that each instance writes data locally (in the same availability zone) while ensuring that data written by any instance is visible to all other instances. Azure Cosmos DB with multi-region writes supports active-active (multi-master) writes and automatic replication, ensuring low-latency local writes and global data visibility. Azure Data Lake Store and Azure Storage with GZRS provide redundancy and replication, but they do not support active multi-write scenarios across zones or regions in a way that guarantees immediate visibility of writes from all instances. Therefore, Cosmos DB with multi-region writes best satisfies the requirements.
Question 132
DRAG DROP -
You need to recommend a solution that meets the file storage requirements for App2.
What should you deploy to the Azure subscription and the on-premises network? To answer, drag the appropriate services to the correct locations. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Explanation: Azure Files provides SMB-based file storage in an Azure Storage account. Azure File Sync synchronizes Azure file shares to on-premises Windows servers, enabling local LAN access over SMB while keeping data replicated with Azure.
Question 133
You need to recommend a notification solution for the IT Support distribution group.
What should you include in the recommendation?
A. a SendGrid account with advanced reporting
B. an action group
C. Azure Network Watcher
D. Azure AD Connect Health
Show Answer
Correct Answer: D
Explanation: The requirement is to recommend a notification solution specifically for IT Support. Azure AD Connect Health (now Microsoft Entra Connect Health) includes built-in monitoring of the identity synchronization infrastructure and can natively send email notifications to distribution groups when health alerts are generated or resolved. An action group is a generic alerting mechanism but does not itself provide the health monitoring required. Therefore, Azure AD Connect Health is the correct recommendation.
Question 134
You plan to migrate App1 to Azure.
You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements.
What should you include in the recommendation?
A. Microsoft peering for an ExpressRoute circuit
B. Azure public peering for an ExpressRoute circuit
C. a service endpoint that has a service endpoint policy
D. a private endpoint
Show Answer
Correct Answer: D
Explanation: A private endpoint provides private IP-based access to the Azure Storage account from within a virtual network, keeping traffic off the public internet and meeting strict security and compliance requirements. When combined with VPN or ExpressRoute from on-premises, it allows secure on-premises access as well. ExpressRoute peering options (A and B) control connectivity to Microsoft services but do not by themselves secure the storage account, and service endpoints (C) still expose the service to the public endpoint and are less restrictive than private endpoints.
$19
Get all 273 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
