HOTSPOT
-
You have a Microsoft Sentinel deployment.
You need to connect a third-party security solution to the deployment. The third-party solution will send Common Event Format (CEF)-formatted messages.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Deploy:
A Linux server and a Syslog forwarder daemon
Forward events to Microsoft Sentinel by using:
An Azure Monitor agent
Explanation: CEF integration with Microsoft Sentinel requires a Linux-based syslog forwarder to receive CEF messages from third-party solutions. The events are then sent to the Log Analytics workspace using the Azure Monitor (Log Analytics) agent.
Question 161
You have an Azure subscription that contains a managed identity named Identity1 and the Azure key vaults shown in the following table.
KeyVault1 contains an access policy that grants Identity1 the following key permissions:
• Get
• List
• Wrap
• Unwrap
You need to provide Identity1 with the same permissions for KeyVault2. The solution must use the principle of least privilege.
Which role should you assign to Identity1?
A. Key Vault Crypto Service Encryption User
B. Key Vault Crypto User
C. Key Vault Reader
D. Key Vault Crypto Officer
Show Answer
Correct Answer: A
Explanation: Identity1 needs Get, List, Wrap, and Unwrap permissions on keys, and the solution must follow least privilege. The **Key Vault Crypto Service Encryption User** role grants exactly these data-plane permissions (keys/read which covers get & list, plus wrap and unwrap) without additional capabilities like sign, verify, update, backup, or key management actions. Other roles either lack required permissions or grant more than necessary, violating least privilege.
Question 162
HOTSPOT
-
You have a management group named MG1 that contains an Azure subscription and a resource group named RG1. RG1 contains a virtual machine named VM1.
You have the custom Azure roles shown in the following table.
The permissions for Role1 are shown in the following role definition file.
The permissions for Role2 are shown in the following role definition file.
You assign the roles to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: No
User2: Yes
User3: Yes
Explanation: Role1 excludes VM delete via NotActions and grants no other VM permissions, so User1 cannot delete. NotActions are not deny rules; permissions from other roles still apply. User2 and User3 have Role2 at RG1, which allows Microsoft.Compute/virtualMachines/*, including delete, so they can delete VM1.
Question 163
You have an Azure Active Directory (Azure AD) tenant.
You need to prevent nonprivileged Azure AD users from creating service principles in Azure AD.
What should you do in the Azure Active Directory admin center of the tenant?
A. From the User settings blade, set Users can register applications to No.
B. From the Properties blade, set Access management for Azure resources to No.
C. From the User settings blade, set Restrict access to Azure AD administration portal to Yes.
D. From the Properties blade, set Enable Security defaults to Yes.
Show Answer
Correct Answer: A
Explanation: Nonprivileged users create service principals by registering applications. In the Azure AD (Entra ID) admin center, setting **Users can register applications** to **No** under **User settings** prevents nonprivileged users from registering apps and thereby creating service principals, while still allowing privileged roles to do so. Other options do not control app/service principal creation.
Question 164
You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.
You create the Azure policy shown in the following exhibit.
You assign the policy to RG1.
What will occur if you assign the policy to NSG1 and NSG2?
A. Flow logs will be enabled for NSG2 only.
B. Flow logs will be disabled for NSG1 and NSG2.
C. Flow logs will be enabled for NSG1 and NSG2.
D. Flow logs will be enabled for NSG1 only.
Show Answer
Correct Answer: B
Explanation: The assigned Azure Policy uses the **Audit** effect, which only evaluates and reports non-compliance but does not change resource configuration. Since flow logs are already disabled on both NSG1 and NSG2, assigning this audit policy will not enable or disable anything. Enabling flow logs would require a **DeployIfNotExists** policy with remediation. Therefore, flow logs will remain disabled for both NSGs.
Question 165
SIMULATION -
You need to ensure that web1234578 is protected from malware by using Microsoft Antimalware for Virtual Machines and is scanned every Friday at 01:00.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Install and configure the Microsoft Antimalware extension on the VM web1234578.
• Azure portal → Virtual Machines → web1234578
• Settings → Extensions + applications → Add
• Select Microsoft Antimalware → Create
• Scan day: Friday
• Scan time: 60 (minutes after midnight = 01:00)
• Save/OK
Explanation: Microsoft Antimalware for Virtual Machines is deployed as a VM extension. Scheduling is configured during setup, where scan time is defined as minutes after midnight, so 60 corresponds to 01:00 on the selected day (Friday).
Question 166
SIMULATION -
You need to ensure that a user named Danny1234578 can sign in to any SQL database on a Microsoft SQL server named web1234578 by using SQL Server
Management Studio (SSMS) and Azure Active Directory (Azure AD) credentials.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Provision an Azure AD (Microsoft Entra ID) admin on the SQL Server web1234578.
Azure portal → SQL Servers → web1234578 → Microsoft Entra ID (Active Directory) admin → Set admin → select Danny1234578 → Save.
Explanation: Configuring an Azure AD admin on the SQL Server enables Azure AD authentication via SSMS. Once set, the selected user can sign in to any database on that server using Azure AD credentials and then be granted database-level permissions as needed.
Question 167
HOTSPOT -
You have a hybrid Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1 and the servers shown in the following table.
The tenant is linked to an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1.
User1 is assigned the Storage File Data SMB Share Contributor role for storage1.
The Security protocol settings for the file shares of storage1 are configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
Yes
No
Explanation: The SMB security settings allow only Kerberos authentication and disable NTLMv2. Using a storage account access key requires NTLMv2, so access keys cannot be used from either server. Kerberos with user credentials is supported for domain-joined servers, so User1 can map the share using their credentials on Server1.
Question 169
HOTSPOT -
You have an Azure subscription that contains a blob container named cont1. Cont1 has the access policies shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: 4
1
Explanation: A blob container supports a maximum of five stored access policies. Since one policy already exists, up to four additional stored access policies can be added.
A container supports only one immutability policy and one legal hold. Because a time-based retention (immutability) policy already exists on cont1, only one additional immutable policy (a legal hold) can be added.
Question 170
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.
You plan to enable passwordless authentication for the tenant.
You need to ensure that User1 can enable the combined registration experience. The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Security administrator
B. Privileged role administrator
C. Authentication administrator
D. Global administrator
Show Answer
Correct Answer: D
Explanation: To enable the combined registration experience for passwordless authentication at the tenant level, Azure AD requires a User Administrator or Global Administrator role. Since User Administrator is not an option, Global Administrator is the least available role that can perform this task. Authentication Administrator can manage authentication methods but cannot enable the combined registration experience itself in this context.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
