You have an Azure subscription that contains a web app named App1.
Users must be able to select between a Google identity or a Microsoft identity when authenticating to App1.
You need to add Google as an identity provider in Azure AD.
Which two pieces of information should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. a client ID
B. a tenant name
C. the endpoint URL of an application
D. a tenant ID
E. a client secret
Show Answer
Correct Answer: A, E
Explanation: To configure Google as an identity provider for Microsoft Entra ID (Azure AD) External Identities, you register an application with Google and then provide the Google OAuth 2.0 Client ID and Client Secret in the Microsoft Entra admin center. Tenant ID, tenant name, and an application endpoint URL are not the required configuration values for adding Google as the identity provider.
Question 109
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Cosmos DB explorer
B. Azure Monitor
C. AzCopy
D. Microsoft Defender for Cloud
Show Answer
Correct Answer: C
Explanation: Azure Storage Analytics logs are stored as blobs in the designated storage account. To retrieve the archived diagnostic log blobs, use AzCopy, which is designed to download and copy blobs from Azure Storage. Azure Monitor and Defender for Cloud are not used to retrieve these archived Storage Analytics log files, and Cosmos DB Explorer is unrelated.
Question 110
SIMULATION
-
The developers at your company plan to create a web app named App28681041 and to publish the app to https://www.contoso.com.
You need to perform the following tasks:
• Ensure that App28681041 is registered to Azure AD.
• Generate a password for App28681041.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Azure portal → Microsoft Entra ID → App registrations → New registration
Name: App28681041
Redirect URI (Web): https://www.contoso.com (or add later under Authentication)
Register
Certificates & secrets → New client secret → Add (generate password)
Explanation: Register the application in Microsoft Entra ID (Azure AD) and create a client secret, which serves as the app password.
Question 111
You have an Azure subscription named Sub1.
In Microsoft Defender for Cloud, you have a workflow automation named WF1. WF1 is configured to send an email message to a user named User1.
You need to modify WF1 to send email messages to a distribution group named Alerts.
What should you use to modify WF1?
A. Azure Logic Apps Designer
B. Azure Application Insights
C. Azure DevOps
D. Azure Monitor
Show Answer
Correct Answer: A
Explanation: Workflow automation in Microsoft Defender for Cloud is implemented using Azure Logic Apps. To change the email recipient from an individual user to a distribution group, you edit the underlying Logic App workflow in the Azure Logic Apps Designer and modify the email action's recipient. Azure Application Insights, Azure DevOps, and Azure Monitor are not used to edit Defender for Cloud workflow automation definitions.
Question 112
You have an Azure subscription that contains a web app named App1. App1 provides users with product images and videos. Users access App1 by using a URL of HTTPS://app1.contoso.com.
You deploy two server pools named Pool1 and Pool2. Pool1 hosts product images. Pool2 hosts product videos.
You need to optimize the performance of App1. The solution must meet the following requirements:
• Minimize the performance impact of TLS connections on Pool1 and Pool2.
• Route user requests to the server pools based on the requested URL path.
What should you include in the solution?
A. Azure Bastion
B. Azure Front Door
C. Azure Traffic Manager
D. Azure Application Gateway
Show Answer
Correct Answer: D
Explanation: Azure Application Gateway provides TLS/SSL termination (offloading the TLS processing from the backend servers) and supports URL path-based routing to direct requests such as /images/* and /videos/* to different backend pools. Azure Front Door can also perform these functions, but the scenario does not require global edge routing or CDN capabilities, making Application Gateway the best fit.
Question 113
You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1 that contains one subnet and uses Azure DNS.
You need to ensure that VM1 connects to storage1 by using a private IP address. The solution must minimize administrative effort.
What should you do?
A. For storage1, disable public network access.
B. On VNet1, create a new subnet.
C. For storage1, create a new private endpoint.
D. Create an Azure Private DNS zone.
Show Answer
Correct Answer: C
Explanation: Creating a private endpoint for the storage account assigns it a private IP address in the virtual network and enables VM1 to access the storage account over the private network. With Azure DNS, creating the private endpoint through the portal can automatically integrate with a Private DNS zone, minimizing administrative effort. Disabling public access alone does not provide private connectivity, creating a new subnet is unnecessary, and creating only a Private DNS zone does not create a private endpoint.
Question 114
You have an Azure subscription that contains a user named User1.
You need to ensure that User1 can perform the following tasks:
• Create groups.
• Create access reviews for role-assignable groups.
• Assign Azure AD roles to groups.
The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Groups administrator
B. Authentication administrator
C. Identity Governance Administrator
D. Privileged role administrator
Show Answer
Correct Answer: D
Explanation: The required combination of permissions is only provided by the Privileged Role Administrator role. It can create and manage role-assignable groups, assign Microsoft Entra (Azure AD) roles to groups, and create access reviews for role-assignable groups. Groups Administrator cannot assign Azure AD roles to groups, Identity Governance Administrator focuses on governance features but cannot assign roles to groups or manage role-assignable groups fully, and Authentication Administrator is unrelated.
Question 115
You have an Azure subscription.
You create a new virtual network named VNet1.
You plan to deploy an Azure web app named App1 that will use VNet1 and will be reachable by using private IP addresses. The solution must support inbound and outbound network traffic.
What should you do?
A. Create an Azure App Service Hybrid Connection.
B. Create an Azure application gateway.
C. Create an App Service Environment.
D. Configure regional virtual network integration.
Show Answer
Correct Answer: C
Explanation: An App Service Environment (ASE) is deployed into a virtual network and can provide private inbound access (for example, with an internal load balancer) while also supporting outbound traffic through the virtual network. Regional VNet Integration (D) only provides outbound connectivity from an App Service into a VNet and does not make the app privately reachable for inbound traffic. Hybrid Connections are for outbound access to specific resources, and Application Gateway alone does not place the App Service into the VNet or satisfy the private inbound requirement.
Question 116
You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1.
You need to allow access to Vault1 only from VM1.
What should you do in the Networking settings of Vault1?
A. From the Firewalls and virtual networks tab, add the IP address of VM1.
B. From the Private endpoint connections tab, create a private endpoint for VM1.
C. From the Firewalls and virtual networks tab, add VNet1.
D. From the Firewalls and virtual networks tab, set Allow trusted Microsoft services to bypass this firewall to Yes for Vault1.
Show Answer
Correct Answer: C
Explanation: Key Vault network rules support allowing specific virtual networks/subnets or public IP ranges. Azure VMs access Key Vault over their virtual network (via service endpoints/private connectivity), and the firewall does not filter on a VM's private IP. A private endpoint alone does not restrict access only to one VM, and allowing trusted Microsoft services is unrelated. Given the available options, adding the virtual network is the supported networking configuration.
Sources:
https://learn.microsoft.com/en-us/answers/questions/2154708/connectivity-on-key-vault
Question 117
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to review regulatory compliance with the Azure CIS 1.4.0 standard. The solution must minimize administrative effort.
What should you do first?
A. Assign an Azure policy.
B. Disable one of the Out of the box standards.
C. Manually add the Azure CIS 1.4.0 standard.
D. Add a custom initiative.
Show Answer
Correct Answer: C
Explanation: Azure CIS 1.4.0 is not included as an out-of-the-box regulatory compliance standard in Defender for Cloud. To review compliance against it, you must first add the Azure CIS 1.4.0 regulatory compliance standard (initiative). During that process, it is assigned to the selected scope. Therefore, the first action is to manually add the Azure CIS 1.4.0 standard.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.