DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
You plan to perform the following actions:
• Deploy a new app named App1 that will require access to Vault1.
• Configure a shared identity for VM1 and VM2 to access st1.
You need to configure identities for each requirement. The solution must minimize administrative effort.
Which type of identity should you configure for each requirement? To answer, drag the appropriate identity types to the correct requirements. Each identity type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VM1 and VM2 access to st1: User-assigned managed identity
App1 access to Vault1: System-assigned managed identity
Explanation: A user-assigned managed identity can be shared across multiple resources, making it the correct choice for VM1 and VM2. A system-assigned managed identity is tied to a single Azure resource and minimizes administration for a single app accessing Key Vault.
Question 141
HOTSPOT
-
You have an Azure subscription that contains a resource group named RG1. RG1 contains a virtual machine named VM1 that uses Azure Active Directory (Azure AD) authentication.
You have two custom Azure roles named Role1 and Role2 that are scoped to RG1.
The permissions for Role1 are shown in the following JSON code.
The permissions for Role2 are shown in the following JSON code.
You assign the roles to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Role1 allows all VM actions except delete. Role2 allows all VM actions including delete, and NotActions is not a deny, so User2 can delete. Azure AD VM sign-in requires the VM login permissions (e.g. Microsoft.Compute/virtualMachines/login/action/loginAsAdmin), which are not granted by these custom roles as defined.
Question 142
HOTSPOT
-
You have the role assignments shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Can delete VM1: Only Admin1 and Admin3
Can create new resource groups: Admin3 only
Explanation: Owner at a resource group can manage resources in that group (including deleting VM1). Owner at the subscription inherits to all resource groups and can also create new resource groups. Owner scoped only to a VM cannot create resource groups, and Security Reader cannot modify resources.
Question 143
You have an Azure subscription linked to an Azure Active Directory Premium Plan 1 tenant.
You plan to implement Azure Active Directory (Azure AD) Identity Protection.
You need to ensure that you can configure a user risk policy and a sign-in risk policy.
What should you do first?
A. Purchase Azure Active Directory Premium Plan 2 licenses for all users.
B. Register all users for Azure Multi-Factor Authentication (MFA).
C. Enable security defaults for Azure Active Directory.
D. Enable enhanced security features in Microsoft Defender for Cloud.
Show Answer
Correct Answer: A
Explanation: User risk policies and sign-in risk policies are features of Microsoft Entra ID (Azure AD) Identity Protection, which requires Microsoft Entra ID (Azure AD) Premium Plan 2 licenses. A tenant with only Premium Plan 1 cannot configure these policies until P2 licensing is available for the applicable users.
Question 144
HOTSPOT
-
You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure Active Directory Premium Plan 1 licenses.
You need to create a group named Group1 that will be assigned the Global reader role.
Which portal should you use to create Group1, and which type of group should you create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Portal: The Azure Active Directory admin center or the Microsoft 365 admin center
Group type: Security or Microsoft 365 only
Explanation: Azure AD role-assignable groups can be created from either the Entra/Azure AD admin center or the Microsoft 365 admin center. Only Security and Microsoft 365 groups support role assignment; mail-enabled security groups do not.
Question 145
HOTSPOT
-
You have an Azure subscription that contains the key vaults shown in the following table.
The subscription contains the users shown in the following table.
On June 1, you perform the following actions:
• Delete a key named key1 from KeyVault1.
• Delete a secret named secret1 from KeyVault2.
For each of the following statements, select Yes If the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Key Vault Contributor is a management-plane role and cannot recover deleted keys. Key Vault Secrets Officer can purge soft-deleted secrets in an RBAC vault when purge protection is disabled and the retention period has not expired. After the 10-day retention period, the deleted key can no longer be recovered.
Question 146
You have an Azure subscription that contains an Azure SQL Database logic server named SQL1 and an Azure virtual machine named VM1. VM1 uses a private IP address only.
The Firewall and virtual networks settings for SQL1 are shown in the following exhibit.
You need to ensure that VM1 can connect to SQL1. The solution must use the principle of least privilege.
What should you do?
A. Set Connection Policy to Proxy.
B. Set Allow Azure services and resources to access this server to Yes.
C. Add an existing virtual network.
D. Create a new firewall rule.
Show Answer
Correct Answer: C
Explanation: Azure SQL Database server firewall rules accept public IP addresses, not a VM's private IP. Enabling 'Allow Azure services' grants overly broad access and violates least privilege. Adding a virtual network rule for the subnet containing the VM allows only resources from that authorized subnet to access the SQL server, which is the least-privilege option among the choices.
Question 147
You have an Azure AD tenant that contains a user named User1.
You purchase an app named App1.
User1 needs to publish App1 by using Azure AD Application Proxy.
Which role should you assign to User1?
A. Cloud application administrator
B. Application administrator
C. Hybrid identity administrator
D. Cloud App Security Administrator
Show Answer
Correct Answer: B
Explanation: Publishing an on-premises application with Microsoft Entra ID (formerly Azure AD) Application Proxy requires the Application Administrator role. The Cloud Application Administrator role can manage applications but does not have permissions to manage Application Proxy settings. Hybrid Identity Administrator and Cloud App Security Administrator do not grant the required Application Proxy publishing permissions.
Question 148
You have an Azure subscription that contains the resources shown in the following table.
Both VM1 and VM2 connect to VNET1 and are configured to use NSG1.
You need to ensure that only VM1 and VM2 can access DB1.
What should you do?
A. For NSG1, configure a rule that has a service tag.
B. Add the IP address range of VNET1 to the Firewall settings of DB1.
C. Create an application security group.
D. Configure DB1 to allow access from only VNET1.
Show Answer
Correct Answer: C
Explanation: Application Security Groups (ASGs) let you logically group VM1 and VM2 and then reference that group in NSG rules. Allowing the entire VNET (option D) would also allow any other current or future VM in that VNET to reach DB1, which does not satisfy the requirement that only VM1 and VM2 can access it. Service tags and VNET IP ranges are also broader than the two specific VMs.
Sources:
https://learn.microsoft.com/en-us/answers/questions/5884707/cosmos-db-for-mongodb-vcore-data-plane-unreachable
Question 149
You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 has the Key Vault VM extension installed.
For Vault1, you rotate the keys, secrets, and certificates.
What will be updated automatically on VM1?
A. the keys only
B. the secrets only
C. the certificates only
D. the keys and secrets only
E. the secrets and certificates only
F. the keys, secrets, and certificates
Show Answer
Correct Answer: C
Explanation: The Azure Key Vault VM extension is designed to automatically monitor and refresh certificates installed from Azure Key Vault when they are rotated. It does not automatically update keys or secrets on the VM in the same way. Therefore, only certificates are automatically updated.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
