DRAG DROP
-
You have an Azure AD tenant that contains the users shown in the following table.
You enable passwordless authentication for the tenant.
Which authentication method can each user use for passwordless authentication? To answer, drag the appropriate authentication methods to the correct users. Each authentication method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1:
Microsoft Authenticator app only
User2:
Microsoft Authenticator app, Windows Hello for Business, and FIDO2 security key
Explanation: Android devices support passwordless sign-in using the Microsoft Authenticator app. Windows devices with compatible hardware support Windows Hello for Business, and Azure AD also supports passwordless authentication using FIDO2 security keys or the Microsoft Authenticator app, regardless of the primary device.
Question 109
You have an Azure subscription that contains a web app named App1.
Users must be able to select between a Google identity or a Microsoft identity when authenticating to App1.
You need to add Google as an identity provider in Azure AD.
Which two pieces of information should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. a client ID
B. a tenant name
C. the endpoint URL of an application
D. a tenant ID
E. a client secret
Show Answer
Correct Answer: A, E
Explanation: When adding Google as an identity provider in Azure AD (Entra ID), you must configure the OAuth 2.0 credentials obtained from Google. These are the Client ID, which identifies the application to Google, and the Client secret, which Azure AD uses to authenticate securely to Google. Tenant name, tenant ID, or application endpoint URLs are not required for configuring Google as an external identity provider.
Question 110
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Cosmos DB explorer
B. Azure Monitor
C. AzCopy
D. Microsoft Defender for Cloud
Show Answer
Correct Answer: C
Explanation: Azure Storage Analytics logs are stored as blobs in a storage account. To retrieve (download) these diagnostic log files for review or troubleshooting, you use a storage access tool. AzCopy is the Microsoft-supported command-line utility designed specifically to copy data to and from Azure Storage, and Microsoft documentation explicitly recommends using AzCopy to download Storage Analytics log blobs. Azure Monitor, Cosmos DB Explorer, and Defender for Cloud do not retrieve raw Storage Analytics log blobs.
Question 111
SIMULATION
-
The developers at your company plan to create a web app named App28681041 and to publish the app to https://www.contoso.com.
You need to perform the following tasks:
• Ensure that App28681041 is registered to Azure AD.
• Generate a password for App28681041.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Azure portal → Azure Active Directory (Entra ID)
App registrations → New registration
Name: App28681041
Supported account type: Single tenant (default)
Register
App registrations → App28681041
Authentication → Add a platform → Web → Redirect URI: https://www.contoso.com
Certificates & secrets → New client secret → Add
Explanation: The task requires registering a web application in Azure AD (Entra ID) and generating a password. This is done by creating an App Registration with the specified name, optionally configuring the web redirect URI, and then creating a client secret under Certificates & secrets, which serves as the application password.
Question 112
You have an Azure subscription named Sub1.
In Microsoft Defender for Cloud, you have a workflow automation named WF1. WF1 is configured to send an email message to a user named User1.
You need to modify WF1 to send email messages to a distribution group named Alerts.
What should you use to modify WF1?
A. Azure Logic Apps Designer
B. Azure Application Insights
C. Azure DevOps
D. Azure Monitor
Show Answer
Correct Answer: A
Explanation: Microsoft Defender for Cloud workflow automations are implemented as Azure Logic Apps. To change the email recipient from an individual user to a distribution group, you must edit the existing workflow and update the email action. This is done using the Azure Logic Apps Designer, which provides the visual interface for modifying workflow steps and parameters.
Question 113
You have an Azure subscription that contains a web app named App1. App1 provides users with product images and videos. Users access App1 by using a URL of HTTPS://app1.contoso.com.
You deploy two server pools named Pool1 and Pool2. Pool1 hosts product images. Pool2 hosts product videos.
You need to optimize the performance of App1. The solution must meet the following requirements:
• Minimize the performance impact of TLS connections on Pool1 and Pool2.
• Route user requests to the server pools based on the requested URL path.
What should you include in the solution?
A. Azure Bastion
B. Azure Front Door
C. Azure Traffic Manager
D. Azure Application Gateway
Show Answer
Correct Answer: D
Explanation: Azure Application Gateway meets both requirements. It provides TLS/SSL termination (offloading) to minimize the performance impact of TLS connections on Pool1 and Pool2, and it supports URL path-based routing to direct requests (such as /images/* and /videos/*) to different backend server pools. The other options do not provide both TLS offloading and path-based routing together.
Question 114
You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1 that contains one subnet and uses Azure DNS.
You need to ensure that VM1 connects to storage1 by using a private IP address. The solution must minimize administrative effort.
What should you do?
A. For storage1, disable public network access.
B. On VNet1, create a new subnet.
C. For storage1, create a new private endpoint.
D. Create an Azure Private DNS zone.
Show Answer
Correct Answer: C
Explanation: Creating a private endpoint for storage1 assigns a private IP address from VNet1 to the storage service and enables VM1 to access it privately. This is the standard, minimal-effort way to ensure private connectivity to Azure Storage. Disabling public access alone does not provide private connectivity, creating a new subnet is unnecessary, and a Private DNS zone by itself does not give the storage account a private IP.
Question 115
You have an Azure subscription that contains a user named User1.
You need to ensure that User1 can perform the following tasks:
• Create groups.
• Create access reviews for role-assignable groups.
• Assign Azure AD roles to groups.
The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Groups administrator
B. Authentication administrator
C. Identity Governance Administrator
D. Privileged role administrator
Show Answer
Correct Answer: D
Explanation: User1 must be able to create groups, create access reviews specifically for role-assignable groups, and assign Azure AD roles to groups, while following least privilege. Only the Privileged Role Administrator role includes all required permissions: creating role-assignable groups, assigning Azure AD roles to groups, and creating access reviews for groups assignable to roles. Groups Administrator cannot assign Azure AD roles or create those access reviews, Identity Governance Administrator focuses on access reviews but lacks group and role assignment permissions, and Authentication Administrator is unrelated.
Question 116
You have an Azure subscription.
You create a new virtual network named VNet1.
You plan to deploy an Azure web app named App1 that will use VNet1 and will be reachable by using private IP addresses. The solution must support inbound and outbound network traffic.
What should you do?
A. Create an Azure App Service Hybrid Connection.
B. Create an Azure application gateway.
C. Create an App Service Environment.
D. Configure regional virtual network integration.
Show Answer
Correct Answer: C
Explanation: The requirement is for an Azure web app to use a virtual network and be reachable via private IP addresses while supporting both inbound and outbound traffic. An App Service Environment (ASE) runs entirely inside a customer’s VNet and can be deployed with an internal load balancer, providing private inbound access. Because it is fully VNet‑integrated by design, it also supports controlled outbound traffic. Regional VNet integration only supports outbound traffic, and the other options do not provide private inbound access for an App Service.
Question 117
You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1.
You need to allow access to Vault1 only from VM1.
What should you do in the Networking settings of Vault1?
A. From the Firewalls and virtual networks tab, add the IP address of VM1.
B. From the Private endpoint connections tab, create a private endpoint for VM1.
C. From the Firewalls and virtual networks tab, add VNet1.
D. From the Firewalls and virtual networks tab, set Allow trusted Microsoft services to bypass this firewall to Yes for Vault1.
Show Answer
Correct Answer: C
Explanation: Azure Key Vault firewall IP rules accept public IPs only. An Azure VM accesses Key Vault over the Azure backbone using its private IP, so adding the VM’s IP address is not valid. To restrict access from Azure resources, you must use a virtual network rule (service endpoint). Adding VNet1 allows access from resources in that VNet and blocks all others, which is the correct networking configuration among the options.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
