You have an Azure subscription that contains the resources shown in the following table.
Both VM1 and VM2 connect to VNET1 and are configured to use NSG1.
You need to ensure that only VM1 and VM2 can access DB1.
What should you do?
A. For NSG1, configure a rule that has a service tag.
B. Add the IP address range of VNET1 to the Firewall settings of DB1.
C. Create an application security group.
D. Configure DB1 to allow access from only VNET1.
Show Answer
Correct Answer: C
Explanation: The requirement is that only VM1 and VM2 can access DB1. Allowing access at the VNET level (option D or B) would permit any current or future resources in VNET1 to access DB1, which violates the 'only VM1 and VM2' requirement. An Application Security Group (ASG) lets you explicitly group VM1 and VM2 and then create an NSG rule that allows traffic only from that ASG to DB1, while denying all other sources. This is the only option that enforces access at the individual VM level rather than the entire network.
Question 151
You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 has the Key Vault VM extension installed.
For Vault1, you rotate the keys, secrets, and certificates.
What will be updated automatically on VM1?
A. the keys only
B. the secrets only
C. the certificates only
D. the keys and secrets only
E. the secrets and certificates only
F. the keys, secrets, and certificates
Show Answer
Correct Answer: C
Explanation: The Azure Key Vault VM extension is designed to automatically monitor and refresh certificates from Azure Key Vault when they are rotated. It does not automatically update keys or secrets on the VM. Therefore, when keys, secrets, and certificates are rotated in Vault1, only the certificates are updated automatically on VM1.
Question 152
HOTSPOT
-
You have an Azure Active Directory (Azure AD) tenant that contains two administrative units named AU1 and AU2.
Users are assigned to the administrative units as shown in the following table.
Users are assigned the roles shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point
Show Answer
Correct Answer: Yes
No
No
Explanation: Admin1 is a Helpdesk Administrator scoped to AU1 and can reset passwords for non-administrators like User1 in the same AU.
Admin2 is a Groups Administrator, which has no password reset permissions, and User3 is also in a different administrative unit.
Admin3 is a Password Administrator, which can reset passwords only for non-administrators and other Password Administrators; Admin4 is a User Administrator, so the reset is not allowed.
Question 153
HOTSPOT
-
You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.
In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit.
To which resources can User1 write on July 1, 2022 by using SAS1 and key1? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: SAS1: container and folder1 only
Key1: container1, folder1 and table1
Explanation: SAS1 allows only the File service with service/container/object resource types, so write access applies to the file share (container) and its folder (folder1) only. The storage account key (key1) grants full access to all services in the account, enabling writes to the blob container (container1), file share/folder (folder1), and table (table1).
Question 154
You have an Azure AD tenant that contains the identities shown in the following table.
You plan to implement Azure AD Identity Protection.
What is the maximum number of user risk policies you can configure?
A. 1
B. 90
C. 200
D. 265
E. 1000
Show Answer
Correct Answer: A
Explanation: In Azure AD (Microsoft Entra ID) Identity Protection, **user risk policies are a legacy, built‑in policy type**. You can configure **only one user risk policy per tenant**. This is separate from Conditional Access policies, which have much higher limits. Therefore, regardless of the number of users or licenses, the maximum number of user risk policies is one.
Question 155
You have an Azure subscription that contains a user named User1.
You need to ensure that User1 can create managed identities. The solution must use the principle of least privilege.
What should you do?
A. Create a management group and assign User1 the Hybrid Identity Administrator Azure Active Directory (Azure AD) role.
B. Create a management group and assign User1 the Managed Identity Operator role.
C. Create a resource group and assign User1 to the Managed Identity Contributor role.
D. Create an organizational unit (OU) and assign User1 the User administrator Azure Active Directory (Azure AD) role.
Show Answer
Correct Answer: C
Explanation: To create managed identities, a user needs permissions to create and manage user-assigned managed identities. The Managed Identity Contributor role provides exactly these permissions (create, read, update, delete user-assigned identities) without broader access. Assigning this role at the resource group scope satisfies the principle of least privilege. Other roles listed either cannot create managed identities or grant excessive, unrelated privileges.
Question 156
You have an Azure Active Directory (Azure AD) tenant that contains 500 users and an administrative unit named AU1.
From the Azure Active Directory admin center, you plan to add the users to AU1 by using Bulk add members.
You need to create and upload a file for the bulk add.
What should you include in the file?
A. only the display name of each user
B. only the user principal name (UPN) of each user
C. only the user principal name (UPN) and display name of each user
D. only the user principal name (UPN) and object identifier of each user
E. only the object identifier of each user
Show Answer
Correct Answer: B
Explanation: When using **Bulk add members** for an administrative unit in the Azure AD admin center, the CSV template requires only one identifier per user: the **User Principal Name (UPN)**. Each row contains a single UPN, which Azure AD uses to resolve and add existing users to the administrative unit. Display names or object IDs are not required for this operation.
Question 157
DRAG DROP
-
You have an Azure subscription.
You plan to create two custom roles named Role1 and Role2.
The custom roles will be used to perform the following tasks:
• Members of Role1 will manage application security groups.
• Members of Role2 will manage Azure Bastion.
You need to add permissions to the custom roles.
Which resource provider should you use for each role? To answer, drag the appropriate resource providers to the correct roles. Each resource provider may be used, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Application Security Groups are part of Azure Virtual Network resources, which belong to the Microsoft.Network resource provider. Azure Bastion is also a networking service (bastionHosts, VNets, subnets, public IPs), all managed under Microsoft.Network.
Question 158
You have an Azure subscription that contains the resources shown in the following table.
You need to configure storage1 to regenerate keys automatically every 90 days.
Which cmdlet should you run?
A. Add-AzKeyVaultflanagedStorageAccount
B. Set-AzStorageAccountManagementPolicy
C. Set-AzStorageAccount
D. Add-AzStorageAccountManagementPolicyAction
Show Answer
Correct Answer: A
Explanation: Automatic regeneration of Azure Storage account access keys every fixed interval (such as 90 days) is achieved by integrating the storage account with Azure Key Vault using a managed storage account. The Add-AzKeyVaultManagedStorageAccount cmdlet links the existing storage account to a Key Vault and configures Key Vault to automatically regenerate and switch keys based on the specified RegenerationPeriod. The other cmdlets manage storage policies or properties but do not configure automatic key rotation.
Question 159
You have an Azure Active Directory (Azure AD) tenant that contains a group named Group1.
You need to ensure that the members of Group1 sign in by using passwordless authentication.
What should you do?
A. Configure the sign-in risk policy.
B. Create a Conditional Access policy.
C. Configure the Microsoft Authenticator authentication method policy.
D. Configure the certificate-based authentication (CBA) policy.
Show Answer
Correct Answer: B
Explanation: Configuring the Microsoft Authenticator authentication method policy only enables passwordless methods but does not enforce their use. To ensure that members of Group1 must sign in using passwordless authentication, you must enforce this requirement with a Conditional Access policy (for example, by requiring a passwordless authentication strength for that group).
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
