You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EASM1 has discovery enabled and contains several inventory assets.
You need to identify which inventory assets are vulnerable to the most critical web app security risks.
Which Defender EASM dashboard should you use?
A. Security Posture
B. OWASP Top 10
C. Attack Surface Summary
D. GDPR Compliance
Show Answer
Correct Answer: B
Explanation: The OWASP Top 10 dashboard in Microsoft Defender External Attack Surface Management highlights inventory assets that are exposed to the most critical web application security risks based on the OWASP Top 10 categories. The other dashboards provide broader attack surface, security posture, or compliance views rather than focusing on critical web application vulnerabilities.
Question 119
Your on-premises network contains a Hyper-V virtual machine named VM1.
You need to use Azure Arc to onboard VM1 to Microsoft Defender for Cloud.
What should you install first?
A. the guest configuration agent
B. the Azure Monitor agent
C. the Log Analytics agent
D. the Azure Connected Machine agent
Show Answer
Correct Answer: D
Explanation: To onboard an on-premises Hyper-V VM to Azure Arc, the first prerequisite is installing the Azure Connected Machine agent. This agent registers the machine as an Azure Arc-enabled server. After the machine is connected through Azure Arc, you can enable Microsoft Defender for Cloud and deploy additional monitoring agents as needed. The Log Analytics agent was historically used by Defender for Cloud, but it is not the first step for Azure Arc onboarding.
Question 120
SIMULATION -
You need to ensure that the audit logs from the SQLdb1 Azure SQL database are stored in the WS12345678 Azure Log Analytics workspace.
To complete this task, sign in to the Azure portal and modify the Azure resources.
Show Answer
Correct Answer: Open SQLdb1 → Security > Auditing.
Enable Auditing.
Select Log Analytics as the destination.
Choose the WS12345678 Log Analytics workspace.
Save the changes.
Explanation: Configure Azure SQL Database Auditing at the database level and send audit logs to the specified Log Analytics workspace.
Question 121
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a resource graph and an assignment that is scoped to a management group.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The solution does not meet the goal. To deploy multiple Azure Policy definitions as a group, you use an initiative (policy set definition), then assign that initiative at the management group scope so it applies to all subscriptions beneath it. Azure Resource Graph is an inventory and query service for Azure resources and is not used to group or deploy policy definitions.
Question 122
HOTSPOT
-
You have an Azure subscription that contains a user named User1. User1 is assigned the Reader role for the subscription.
You plan to create a custom role named Role1 and assign Role1 to User1.
You need to ensure that User1 can create and manage application security groups by using Azure portal.
Which two permissions should you add to Role1? To answer, select the appropriate permissions in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Microsoft Network
Microsoft Portal
Explanation: Application Security Groups are Microsoft.Network resources, so network write permissions are required. Because the task specifies management by using the Azure portal, the expected second selection is Microsoft Portal.
Question 123
DRAG DROP
-
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains a user named User1.
You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains an Azure Storage account named storage1. Storage1 contains an Azure file share named share1.
Currently, the domain and the tenant are not integrated.
You need to ensure that User1 can access share1 by using his domain credentials.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Implement Azure AD Connect
Enable an Active Directory source for Azure File shares
Assign share-level permissions for share1
Explanation: To use on-premises Active Directory credentials with Azure Files, first synchronize identities with Azure AD using Azure AD Connect, then enable AD DS authentication for Azure Files, and finally grant the user appropriate share-level permissions. Private Link and service endpoints are networking features and are not required for identity-based access.
Question 124
You have an Azure subscription that contains an Azure Data Lake Storage Gen2 account named storage1.
You deploy an Azure Synapse Analytics workspace named synapsews1 to a managed virtual network.
You need to enable access from synapsews1 to storage1.
What should you configure?
A. peering
B. a private endpoint
C. a network security group (NSG)
D. a virtual network gateway
Show Answer
Correct Answer: B
Explanation: A Synapse workspace deployed with a managed virtual network accesses Azure Storage securely by creating a managed private endpoint (Azure Private Link) to the Azure Data Lake Storage Gen2 account. VNet peering, NSGs, and virtual network gateways do not establish the required private connectivity from the managed VNet to the storage account.
Question 125
HOTSPOT
-
You have an Azure AD tenant named contoso.com that contains the users shown in the following table.
You add enterprise applications to contoso.com as shown in the following table.
You need to identify which users can grant admin consent for App1 and App2.
Which users should you identify for each application? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: App1: User1 only
App2: User1 only
Explanation: Only the Application Administrator role can grant tenant-wide admin consent in this scenario. Application owners, Application Developer, Azure DevOps Administrator, Security Operator, assigned users/groups, and enterprise application owners do not have permission to grant admin consent.
Question 126
You have an Azure subscription that contains a resource group named RG1 and the identities shown in the following table.
You assign Group4 the Contributor role for RG1.
Which identities can you add to Group4 as members?
A. User1 only
B. User1 and Group3 only
C. User1, Group1, and Group3 only
D. User1, Group2, and Group3 only
E. User1, Group1, Group2, and Group3
Show Answer
Correct Answer: A
Explanation: Assigning the Contributor Azure RBAC role to Group4 makes Group4 a role-assignable group in the context of the exam. Role-assignable groups do not support group nesting, so you cannot add other groups as members. A user can be added, but Group1, Group2, and Group3 cannot. Therefore only User1 can be added.
Question 127
You have an Azure AD tenant. The tenant contains users that are assigned Azure AD Premium P2 licenses.
You have a partner company that has a domain named fabrikam.com. The fabrikam.com domain contains a user named User1. User1 has an email address of
You need to provide User1 with access to the resources in the tenant. The solution must meet the following requirements:
• User1 must be able to sign in by using the
credentials.
• You must be able to grant User1 access to the resources in the tenant.
• Administrative effort must be minimized.
What should you do?
A. Create a user account for User1.
B. To the tenant, add fabrikam.com as a custom domain.
C. Create an invite for User1.
D. Set Enable guest self-service sign up via user flows to Yes for the tenant.
Show Answer
Correct Answer: C
Explanation: Use Azure AD B2B collaboration by inviting User1 as a guest. This allows the external user to authenticate with their existing fabrikam.com credentials while giving you the ability to assign permissions to resources in your tenant with minimal administrative effort. Creating a local user would require separate credentials, adding fabrikam.com as a custom domain is for domains you own and verify (not a partner's domain), and enabling self-service sign-up via user flows is an Azure AD B2C feature, not the appropriate solution for partner collaboration.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
