Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create an initiative and an assignment that is scoped to a management group.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: An Azure Policy initiative groups multiple policy definitions, and assigning that initiative at the management group scope applies it to all subscriptions under that management group. This meets the requirement to deploy the policies as a group to all three subscriptions using centralized management.
Question 172
SIMULATION -
You need to prevent HTTP connections to the rg1lod1234578n1 Azure Storage account.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Enable **Secure transfer required** on the storage account.
Azure portal → Storage accounts → rg1lod1234578n1 → Configuration → Secure transfer required = Enabled → Save.
Explanation: Enabling Secure transfer required forces all requests to use HTTPS and blocks HTTP connections to the Azure Storage account.
Question 173
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a policy definition and assignments that are scoped to resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The goal is to deploy multiple policy definitions as a group across all three subscriptions. This requires using a policy initiative (policy set) and assigning it at the subscription or management group scope. Creating individual policy definitions and assignments scoped only to resource groups does not deploy them as a group nor ensure coverage across entire subscriptions, so it does not meet the goal.
Question 174
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a policy initiative and assignments that are scoped to resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Scoping a policy initiative and its assignments to resource groups only enforces the policies within those specific resource groups. The requirement is to deploy the policy definitions as a group to all three subscriptions. To achieve subscription-wide coverage across multiple subscriptions, the initiative should be assigned at the subscription level or, more appropriately, at a management group that contains the three subscriptions. Therefore, the proposed solution does not meet the goal.
Question 175
SIMULATION -
You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com. The new directory must contain a new user named
.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create Azure AD tenant:
Sign in to Azure portal
Azure Active Directory → Manage tenants → +Create
Select Azure Active Directory
Organization name: 12345678
Initial domain name: 12345678.onmicrosoft.com
Complete tenant creation
Create user:
Azure Active Directory → Users → New user
User name: [email protected]
Name: User1
Create
Explanation: The task requires creating a new Azure AD directory with the domain 12345678.onmicrosoft.com, then adding a user to that directory. The tenant is created first by specifying the organization and initial domain name. After switching to the new directory, a user is added from the Users blade with the default auto-generated password.
Question 176
You have an Azure virtual machine named VM1.
From Microsoft Defender for Cloud, you get the following high-severity recommendation: `Install endpoint protection solutions on virtual machine`.
You need to resolve the issue causing the high-severity recommendation.
What should you do?
A. Add the Microsoft Antimalware extension to VM1.
B. Install Microsoft System Center Security Management Pack for Endpoint Protection on VM1.
C. Add the Network Watcher Agent for Windows extension to VM1.
D. Onboard VM1 to Microsoft Defender for Endpoint.
Show Answer
Correct Answer: D
Explanation: The Microsoft Defender for Cloud recommendation "Install endpoint protection solutions on virtual machine" is specifically satisfied when a supported endpoint protection/EDR solution is detected. For Azure VMs, the native and recommended solution is Microsoft Defender for Endpoint. Onboarding VM1 to Defender for Endpoint resolves the high‑severity recommendation by providing full endpoint detection and response coverage. The Microsoft Antimalware extension is a legacy/basic antivirus option and does not fully meet the modern Defender for Cloud endpoint protection recommendation. The other options are unrelated to endpoint protection.
Question 177
SIMULATION -
The developers at your company plan to create a web app named App12345678 and to publish the app to https://www.contoso.com.
You need to perform the following tasks:
✑ Ensure that App12345678 is registered to Azure Active Directory (Azure AD).
✑ Generate a password for App12345678.
To complete this task, sign in to the Azure portal.
Explanation: The app must be registered in Azure AD (Entra ID) via App registrations. A client secret (password) is generated under Certificates & secrets and is shown only once, so it must be copied at creation.
Question 178
You have an Azure environment.
You need to identify any Azure configurations and workloads that are non-compliant with ISO 27001:2013 standards.
What should you use?
A. Azure Sentinel
B. Azure Active Directory (Azure AD) Identity Protection
C. Microsoft Defender for Cloud
D. Microsoft Defender for Identity
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for Cloud includes a Regulatory Compliance dashboard that continuously assesses Azure resources and workloads against standards such as ISO/IEC 27001:2013, highlighting non-compliant configurations and providing remediation guidance. The other options focus on threat detection or identity risks, not broad regulatory compliance.
Question 179
You have an Azure subscription that contains an Azure Files share named share1 and a user named User1. Identity-based authentication is configured for share1.
User1 attempts to access share1 from a Windows 10 device by using SMB.
Which type of token will Azure Files use to authorize the request?
A. OAuth 2.0
B. JSON Web Token (JWT)
C. SAML
D. Kerberos
Show Answer
Correct Answer: D
Explanation: When accessing Azure Files over SMB with identity-based authentication from a Windows 10 device, Azure Files uses Kerberos for authentication and authorization. SMB on Windows relies on Kerberos tickets (via Azure AD DS or on-premises AD integration) rather than OAuth, JWT, or SAML, which are used for HTTP-based or federation scenarios, not SMB file access.
Question 180
SIMULATION -
You need to ensure that a user named user2-12345678 can manage the properties of the virtual machines in the RG1lod12345678 resource group. The solution must use the principle of least privilege.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Assign the **Virtual Machine Contributor** role to **user2-12345678** at the **RG1lod12345678** resource group scope.
Explanation: Virtual Machine Contributor grants permissions to manage VM properties without broader resource or access management rights, satisfying least-privilege. Assigning it at the resource group scope limits access to only VMs in RG1lod12345678.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.