HOTSPOT
-
You have an Azure subscription that contains the following Azure firewall:
• Name: Fw1
• Azure region: UK West
• Private IP address: 10.1.3.4
• Public IP address: 23.236.62.147
The subscription contains the virtual networks shown in the following table.
The subscription contains the subnets shown in the following table.
The subscription contains the routes shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: 1) Subnet1-1 to Subnet1-2 is within the same VNet (10.1.0.0/16). The system route (local VNet) with a longer prefix is preferred over the 0.0.0.0/0 UDR, so traffic bypasses the firewall.
2) Subnet2-1 has a specific UDR (10.1.1.0/24) pointing to the firewall, which overrides system routes, so traffic is routed through Fw1.
3) Subnet3-1 has no default (0.0.0.0/0) UDR to the firewall, and VNet peering is not transitive, so internet traffic does not go through Fw1.
Question 141
HOTSPOT
-
You have an Azure subscription that contains a storage account named contoso2023.
You need to perform the following tasks:
• Verify that identity-based authentication over SMB is enabled.
• Only grant users access to contoso2023 in the year 2023.
Which two settings should you use? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Identity-based authentication over SMB is configured and verified at the Azure File shares level. Time-bound access limited to the year 2023 is enforced by using a Shared Access Signature (SAS) with start and expiry dates.
Question 142
DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
You plan to perform the following actions:
• Deploy a new app named App1 that will require access to Vault1.
• Configure a shared identity for VM1 and VM2 to access st1.
You need to configure identities for each requirement. The solution must minimize administrative effort.
Which type of identity should you configure for each requirement? To answer, drag the appropriate identity types to the correct requirements. Each identity type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VM1 and VM2 access to st1:
User-assigned managed identity
App1 access to Vault1:
System-assigned managed identity
Explanation: A user-assigned managed identity can be shared by multiple resources, meeting the requirement for VM1 and VM2 to use the same identity with minimal reconfiguration. A system-assigned managed identity is simplest for a single app and is automatically created and managed with App1, minimizing administrative effort.
Question 143
HOTSPOT
-
You have an Azure subscription that contains a resource group named RG1. RG1 contains a virtual machine named VM1 that uses Azure Active Directory (Azure AD) authentication.
You have two custom Azure roles named Role1 and Role2 that are scoped to RG1.
The permissions for Role1 are shown in the following JSON code.
The permissions for Role2 are shown in the following JSON code.
You assign the roles to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1 can delete VM1: No
User2 can delete VM1: No
User3 can sign in to VM1 using Azure AD credentials: Yes
Explanation: Role1 excludes delete via notActions, so User1 cannot delete. Having Role1 and Role2 together does not override the exclusion for delete in this scenario, so User2 also cannot delete. Azure AD sign-in requires the VM login permissions, which are included, allowing User3 to sign in.
Question 144
HOTSPOT
-
You have the role assignments shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Only Admin1 and Admin3
Admin3 only
Explanation: Admin1 is Owner at the RG1 scope and can delete resources within RG1, including VM1. Admin3 is Owner at the subscription scope and inherits permissions to all resource groups and resources, so can also delete VM1. Admin2 is Owner only at the VM scope and cannot delete the VM resource itself. Admin4 is a Security Reader and has no write permissions. Creating new resource groups requires Owner or Contributor at the subscription scope; only Admin3 meets this requirement.
Question 145
You have an Azure subscription linked to an Azure Active Directory Premium Plan 1 tenant.
You plan to implement Azure Active Directory (Azure AD) Identity Protection.
You need to ensure that you can configure a user risk policy and a sign-in risk policy.
What should you do first?
A. Purchase Azure Active Directory Premium Plan 2 licenses for all users.
B. Register all users for Azure Multi-Factor Authentication (MFA).
C. Enable security defaults for Azure Active Directory.
D. Enable enhanced security features in Microsoft Defender for Cloud.
Show Answer
Correct Answer: A
Explanation: Azure AD (Microsoft Entra ID) Identity Protection features, including configuring user risk policies and sign-in risk policies, require Microsoft Entra ID Premium Plan 2 (P2). With only Premium Plan 1, these policies are not available, so the first step is to purchase P2 licenses.
Question 146
HOTSPOT
-
You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure Active Directory Premium Plan 1 licenses.
You need to create a group named Group1 that will be assigned the Global reader role.
Which portal should you use to create Group1, and which type of group should you create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Portal:
The Azure Active Directory admin center only
Group type:
Security or Microsoft 365 only
Explanation: Groups assigned to Azure AD directory roles (such as Global Reader) must be created with the role-assignable option, which is supported in the Azure AD (Microsoft Entra) admin center. Only Security groups or Microsoft 365 groups can be made role-assignable; mail-enabled security groups are not supported for Azure AD role assignments.
Question 147
HOTSPOT
-
You have an Azure subscription that contains the key vaults shown in the following table.
The subscription contains the users shown in the following table.
On June 1, you perform the following actions:
• Delete a key named key1 from KeyVault1.
• Delete a secret named secret1 from KeyVault2.
For each of the following statements, select Yes If the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Admin1 is a Key Vault Contributor, which has management-plane permissions only and cannot recover keys (data plane).
Admin2 is a Key Vault Secrets Officer on KeyVault2; purge protection is disabled and June 12 is within the 15-day retention, so the secret can be purged.
KeyVault1 has a 10-day retention; by June 17 the deleted key is permanently removed and cannot be recovered, even by a Key Vault Administrator.
Question 148
You have an Azure subscription that contains an Azure SQL Database logic server named SQL1 and an Azure virtual machine named VM1. VM1 uses a private IP address only.
The Firewall and virtual networks settings for SQL1 are shown in the following exhibit.
You need to ensure that VM1 can connect to SQL1. The solution must use the principle of least privilege.
What should you do?
A. Set Connection Policy to Proxy.
B. Set Allow Azure services and resources to access this server to Yes.
C. Add an existing virtual network.
D. Create a new firewall rule.
Show Answer
Correct Answer: C
Explanation: VM1 has only a private IP and resides in an Azure virtual network. Azure SQL Database firewall rules only support public IP addresses, so creating a firewall rule is not applicable. Enabling 'Allow Azure services and resources' would grant overly broad access and violate least privilege. Adding an existing virtual network rule allows access only from the specific VNet/subnet containing VM1, satisfying connectivity requirements while adhering to the principle of least privilege.
Question 149
You have an Azure AD tenant that contains a user named User1.
You purchase an app named App1.
User1 needs to publish App1 by using Azure AD Application Proxy.
Which role should you assign to User1?
A. Cloud application administrator
B. Application administrator
C. Hybrid identity administrator
D. Cloud App Security Administrator
Show Answer
Correct Answer: B
Explanation: Publishing an application using Azure AD Application Proxy requires permissions to manage Application Proxy settings. The **Application administrator** role can create, manage, and publish enterprise applications, including configuring Azure AD Application Proxy. The **Cloud application administrator** role explicitly excludes Application Proxy permissions, and the other roles are unrelated.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
