HOTSPOT
-
You have a management group named MG1 that contains an Azure subscription and a resource group named RG1. RG1 contains a virtual machine named VM1.
You have the custom Azure roles shown in the following table.
The permissions for Role1 are shown in the following role definition file.
The permissions for Role2 are shown in the following role definition file.
You assign the roles to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: No
User2: Yes
User3: Yes
Explanation: Role1 excludes VM delete via NotActions, so by itself it cannot delete VMs. Role2 grants all Microsoft.Compute/virtualMachines/* actions at RG1, including delete. NotActions is not an explicit deny; permissions from another assigned role still grant the action. MG1 scope includes RG1 resources.
Question 161
You have an Azure Active Directory (Azure AD) tenant.
You need to prevent nonprivileged Azure AD users from creating service principles in Azure AD.
What should you do in the Azure Active Directory admin center of the tenant?
A. From the User settings blade, set Users can register applications to No.
B. From the Properties blade, set Access management for Azure resources to No.
C. From the User settings blade, set Restrict access to Azure AD administration portal to Yes.
D. From the Properties blade, set Enable Security defaults to Yes.
Show Answer
Correct Answer: A
Explanation: Setting 'Users can register applications' to 'No' in Azure AD User settings prevents nonprivileged users from registering applications, which also prevents them from creating the associated service principals. The other options control Azure resource access management, portal access, or security defaults and do not specifically restrict service principal creation.
Question 162
You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.
You create the Azure policy shown in the following exhibit.
You assign the policy to RG1.
What will occur if you assign the policy to NSG1 and NSG2?
A. Flow logs will be enabled for NSG2 only.
B. Flow logs will be disabled for NSG1 and NSG2.
C. Flow logs will be enabled for NSG1 and NSG2.
D. Flow logs will be enabled for NSG1 only.
Show Answer
Correct Answer: B
Explanation: An Azure Policy with the Audit effect only evaluates and reports non-compliance; it does not change resource configuration. Enabling NSG flow logs requires a DeployIfNotExists policy (or manual configuration). Therefore assigning the audit policy will not enable flow logs, and the NSGs remain with flow logs disabled.
Question 164
SIMULATION -
You need to ensure that a user named Danny1234578 can sign in to any SQL database on a Microsoft SQL server named web1234578 by using SQL Server
Management Studio (SSMS) and Azure Active Directory (Azure AD) credentials.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Azure portal → SQL servers → web1234578 → Microsoft Entra ID → Set admin → select Danny1234578 → Save.
Do not enable 'Microsoft Entra authentication only' unless explicitly required.
Explanation: Setting the Microsoft Entra ID (Azure AD) administrator on the SQL server allows the specified Entra user to authenticate to SQL databases with SSMS using Azure AD credentials. The authentication-only option is not required for this task.
Question 165
HOTSPOT -
You have a hybrid Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1 and the servers shown in the following table.
The tenant is linked to an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1.
User1 is assigned the Storage File Data SMB Share Contributor role for storage1.
The Security protocol settings for the file shares of storage1 are configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
Yes
No
Explanation: Only Kerberos authentication is allowed; NTLMv2 is disabled. Using the storage account access key for SMB relies on NTLMv2, so access-key mapping is blocked. User credentials via Kerberos are allowed, and Windows Server 2016 supports SMB 3.1.1. Therefore: Server1 with access key = No, Server1 with user credentials = Yes, Server2 with access key = No.
Question 167
HOTSPOT -
You have an Azure subscription that contains a blob container named cont1. Cont1 has the access policies shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: 4
1
Explanation: A blob container supports up to 5 stored access policies. One already exists, so 4 more can be added. A container supports one time-based immutability policy and one legal hold. Since a time-based retention policy already exists, only one additional immutable storage policy (a legal hold) can be added.
Question 168
You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.
You plan to enable passwordless authentication for the tenant.
You need to ensure that User1 can enable the combined registration experience. The solution must use the principle of least privilege.
Which role should you assign to User1?
A. Security administrator
B. Privileged role administrator
C. Authentication administrator
D. Global administrator
Show Answer
Correct Answer: D
Explanation: For the classic Azure AD configuration of enabling the combined security information registration (combined MFA/SSPR registration) as part of tenant passwordless setup, the required administrative role was Global Administrator (or User Administrator in some documentation). Since User Administrator is not an option, Global Administrator is the correct choice among the available answers. Authentication Administrator manages authentication methods but historically was not sufficient for enabling the combined registration experience tenant setting.
Question 169
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create an initiative and an assignment that is scoped to a management group.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. An Azure Policy initiative groups multiple policy definitions into a single unit, and assigning that initiative at the management group scope applies it to all subscriptions within that management group. This is the recommended way to centrally deploy and manage a set of policies across multiple subscriptions, including those used by Microsoft Defender for Cloud.
Question 170
SIMULATION -
You need to prevent HTTP connections to the rg1lod1234578n1 Azure Storage account.
To complete this task, sign in to the Azure portal.
Explanation: Enabling Secure transfer required blocks unsecured HTTP access and requires HTTPS connections to the storage account.
Question 171
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a policy definition and assignments that are scoped to resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: To deploy several policy definitions as a group across multiple Azure subscriptions, you should use an Azure Policy initiative (policy set definition) and assign it at the management group or subscription scope. Creating a single policy definition and assigning it at the resource group scope neither groups multiple policy definitions nor targets all three subscriptions appropriately.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
