Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a policy initiative and assignments that are scoped to resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: A policy initiative is the correct way to group policy definitions, but assigning it at the resource group scope would only apply it to those resource groups. The requirement is to deploy the grouped policies to all three subscriptions, so the initiative should be assigned at the subscription level (or at a management group containing the subscriptions), not to resource groups.
Question 173
SIMULATION -
You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com. The new directory must contain a new user named
.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Azure portal:
Microsoft Entra ID > Manage tenants > Create
Create a new Microsoft Entra ID tenant with initial domain: 12345678.onmicrosoft.com
After creation, switch to the new tenant
Create a new user with the specified username/details in the new directory.
Explanation: The task requires creating a new Azure AD (Microsoft Entra ID) directory with the specified initial domain, then switching to that tenant and creating the requested user.
Question 175
SIMULATION -
The developers at your company plan to create a web app named App12345678 and to publish the app to https://www.contoso.com.
You need to perform the following tasks:
✑ Ensure that App12345678 is registered to Azure Active Directory (Azure AD).
✑ Generate a password for App12345678.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Microsoft Entra ID → App registrations → New registration.
Name: App12345678
Redirect URI (Web): https://www.contoso.com
Register.
Open Certificates & secrets → New client secret → Add.
Copy the generated secret value.
Explanation: Register the web application in Microsoft Entra ID with the specified web redirect URI, then create a client secret (password) under Certificates & secrets.
Question 176
You have an Azure environment.
You need to identify any Azure configurations and workloads that are non-compliant with ISO 27001:2013 standards.
What should you use?
A. Azure Sentinel
B. Azure Active Directory (Azure AD) Identity Protection
C. Microsoft Defender for Cloud
D. Microsoft Defender for Identity
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for Cloud includes the Regulatory Compliance dashboard, which continuously assesses Azure resources against standards such as ISO 27001:2013 and identifies non-compliant configurations and workloads. Azure Sentinel is a SIEM/SOAR platform, Azure AD Identity Protection focuses on identity risk, and Microsoft Defender for Identity detects on-premises identity threats.
Question 177
You have an Azure subscription that contains an Azure Files share named share1 and a user named User1. Identity-based authentication is configured for share1.
User1 attempts to access share1 from a Windows 10 device by using SMB.
Which type of token will Azure Files use to authorize the request?
A. OAuth 2.0
B. JSON Web Token (JWT)
C. SAML
D. Kerberos
Show Answer
Correct Answer: D
Explanation: With Azure Files identity-based authentication over SMB from a Windows client, authorization is based on a Kerberos ticket obtained through the configured identity provider (such as AD DS, Microsoft Entra Kerberos, or Microsoft Entra Domain Services). OAuth 2.0, JWT, and SAML are not the SMB authentication token used for Azure Files access.
Question 178
SIMULATION -
You need to ensure that a user named user2-12345678 can manage the properties of the virtual machines in the RG1lod12345678 resource group. The solution must use the principle of least privilege.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Assign the Virtual Machine Contributor role to user2-12345678 at the RG1lod12345678 resource group scope.
Explanation: Virtual Machine Contributor allows managing virtual machine properties without granting broader permissions. Assigning it at the resource group scope follows least privilege for all VMs in that resource group.
Question 179
SIMULATION -
You need to ensure that User2-1234578 has all the key permissions for KeyVault1234578.
To complete this task, sign in to the Azure portal and modify the Azure resources.
Show Answer
Correct Answer: Assign the Key Vault Administrator role to User2-1234578 for KeyVault1234578.
If the vault uses Access policies instead of Azure RBAC, grant all Key permissions in the Key Vault access policy for User2-1234578.
Explanation: The required action depends on the key vault permission model. With Azure RBAC, Key Vault Administrator provides full data-plane permissions across keys, secrets, and certificates. With the legacy access policy model, the user must be granted all key permissions via an access policy.
Question 180
DRAG DROP -
You have an Azure subscription that contains an Azure SQL database named SQLDB1. SQLDB1 contains the columns shown in the following table.
For the Email and Birthday columns, you implement dynamic data masking by using the default masking function.
Which value will the users see in each column? To answer, drag the appropriate values to the correct columns. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Show Answer
Correct Answer: Email: XXXX
Birthday: 1900-01-01
Explanation: The default dynamic data masking function masks string types (such as varchar) as 'XXXX'. For the DATE data type, the default mask returns the default date value 1900-01-01.
Question 181
HOTSPOT -
You have an Azure subscription that is linked to an Azure Active Directory (Azure AD). The tenant contains the users shown in the following table.
You have an Azure key vault named Vault1 that has Purge protection set to Disable. Vault1 contains the access policies shown in the following table.
You create role assignments for Vault1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: 1. No
2. No
3. Yes
Explanation: Purge protection cannot be enabled after vault creation by these permissions, and Security Administrator does not manage Key Vault properties. Network Contributor plus Key Vault Reader cannot modify Key Vault networking settings because that requires write access to the vault. Key Vault Contributor can manage the vault resource, including access policies (though not RBAC role assignments).
Question 182
HOTSPOT -
You have an Azure subscription that contains a web app named App1 and an Azure key vault named Vault1.
You need to configure App1 to store and access the secrets in Vault1.
How should you configure App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation: Azure App Service should use a managed identity to authenticate to Azure Key Vault. Key Vault references are configured in the web app's Application settings using the @Microsoft.KeyVault(...) syntax.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
