DRAG DROP -
You have an Azure subscription that contains a Microsoft SQL server named Server1 and an Azure key vault named vault1. Server1 hosts a database named
DB1. Vault1 contains an encryption key named key1.
You need to ensure that you can enable Transparent Data Encryption (TDE) on DB1 by using key1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Show Answer
Correct Answer: Create a managed identity for Server1.
Configure permissions for Server1.
Add key1 to Server1.
Configure the TDE protector on Server1.
Explanation: For TDE with customer-managed keys (BYOK), the Azure SQL server needs a system-assigned managed identity. That identity is granted Key Vault permissions (configured on the server identity) to access the key. The key is then added to the server, and finally set as the TDE protector.
Question 193
SIMULATION -
You need to ensure that when administrators deploy resources by using an Azure Resource Manager template, the deployment can access secrets in an Azure key vault named KV12345678.
To complete this task, sign in to the Azure portal.
Explanation: Enabling Azure Resource Manager access allows ARM template deployments to retrieve secrets from the key vault during deployment without granting explicit user or service principal permissions.
Question 194
SIMULATION -
You plan to use Azure Disk Encryption for several virtual machine disks.
You need to ensure that Azure Disk Encryption can retrieve secrets from the KeyVault12345678 Azure key vault.
To complete this task, sign in to the Azure portal and modify the Azure resources.
Explanation: Azure Disk Encryption requires explicit permission on the key vault to retrieve secrets. Enabling the *Azure Disk Encryption for volume encryption* option under the key vault access configuration grants this access.
Question 195
HOTSPOT -
You have an Azure subscription that contains an Azure key vault. The role assignments for the key vault are shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Can create keys:
Only User1, User2, and User4
Can create secrets:
Only User1, User3, and User4
Explanation: User1 is Subscription Owner and can perform data-plane operations on the vault. User2 (Key Vault Crypto Officer at vault scope) can create and manage keys. User3 (Key Vault Secrets Officer at vault scope) can create secrets only. User4 has Key Vault Administrator at the key scope, allowing key and secret operations within that scoped object.
Question 196
You have the Azure resources shown in the following table.
You need to meet the following requirements:
✑ Internet-facing virtual machines must be protected by using network security groups (NSGs).
✑ All the virtual machines must have disk encryption enabled.
What is the minimum number of security policies that you should create in Microsoft Defender for Cloud?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: The requirements map to two distinct Defender for Cloud security controls: (1) ensuring internet-facing virtual machines are protected by Network Security Groups, and (2) ensuring all virtual machines have disk encryption enabled. In Defender for Cloud, each requirement is enforced via a separate security policy. Even though policies can be grouped into an initiative, the question asks for the minimum number of security policies, not initiatives. Therefore, two security policies are required.
Question 197
You have an Azure subscription that contains an Azure SQL database named DB1 in the East US Azure region.
You create the storage accounts shown in the following table.
You plan to enable auditing for DB1.
Which storage accounts can you use as the auditing destination for DB1?
A. storage1 and storage4 only
B. storage1 only
C. storage1, storage2, storage3, and storage4
D. storage1, storage2, and storage3 only
E. storage2 and storage3 only
Show Answer
Correct Answer: A
Explanation: Azure SQL Database auditing writes logs to Azure Blob Storage. Supported destinations are Standard storage accounts and Premium BlockBlobStorage; Azure File Shares are not supported. When the deployment method isn’t specified, the storage account doesn’t have to be in the same region. Therefore, storage1 (Standard, GPv2) and storage4 (Standard, GPv2 in another region) are valid, while storage3 (File Shares) is not. Among the given options, this corresponds to storage1 and storage4 only.
Question 198
You have an Azure subscription that contains a storage account named storage1 and two web apps named app1 and app2.
Both apps will write data to storage1.
You need to ensure that each app can read only the data that it has written.
What should you do?
A. Provide each app with a system-assigned identity and configure storage1 to use Azure AD User account authentication.
B. Provide each app with a separate Storage account key and configure the app to send the key with each request.
C. Provide each app with a user-managed identity and configure storage1 to use Azure AD User account authentication.
D. Provide each app with a unique Base64-encoded AES-256 encryption key and configure the app to send the key with each request.
Show Answer
Correct Answer: A
Explanation: The requirement is authorization: each app must be able to read only its own data. Azure AD–based access control with managed identities addresses this directly. By assigning a system-assigned managed identity to each web app and enabling Azure AD authentication on the storage account, you can use Azure RBAC to grant each identity access only to its own container or path. This avoids shared secrets, minimizes administrative overhead, and enforces access control at the storage layer. Storage account keys grant full access, and encryption keys protect data confidentiality but do not enforce authorization boundaries.
Question 199
Your company makes use of Azure Active Directory (Azure AD) in a hybrid configuration. All users are making use of hybrid Azure AD joined Windows 10 computers.
You manage an Azure SQL database that allows for Azure AD authentication.
You need to make sure that database developers are able to connect to the SQL database via Microsoft SQL Server Management Studio (SSMS). You also need to make sure the developers use their on-premises Active Directory account for authentication. Your strategy should allow for authentication prompts to be kept to a minimum.
Which of the following is the authentication method the developers should use?
A. Azure AD token.
B. Azure Multi-Factor authentication.
C. Active Directory integrated authentication.
Show Answer
Correct Answer: C
Explanation: Active Directory integrated authentication allows developers to connect to Azure SQL Database using their on-premises Active Directory credentials from hybrid Azure AD joined Windows 10 devices. It provides seamless single sign-on through Windows Integrated Authentication, minimizing authentication prompts in SSMS. Azure AD tokens and MFA either require additional prompts or are not suited for seamless on-prem AD credential use in this scenario.
Question 201
SIMULATION -
You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod1234578 Azure Storage account.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Go to Storage account **rg1lod1234578**
Security + networking → **Networking** → **Firewalls and virtual networks**
Set **Public network access** to **Enabled from selected virtual networks and IP addresses**
Under **Firewall**, add IP address range **131.107.0.0/16**
Save
Explanation: To restrict access, the storage account firewall must deny public access by default and explicitly allow only the required network range. Since 131.107.0.0/16 is an IP range (not an Azure VNet), it is added under the Firewall IP rules in the Firewalls and virtual networks settings.
Question 202
You have an Azure Sentinel workspace.
You need to create a playbook.
Which two triggers will start the playbook? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. An Azure Sentinel scheduled query rule is executed.
B. An Azure Sentinel data connector is added.
C. An Azure Sentinel alert is generated.
D. An Azure Sentinel hunting query result is returned.
E. An Azure Sentinel incident is created.
Show Answer
Correct Answer: C, E
Explanation: Azure Sentinel (Microsoft Sentinel) playbooks are triggered by security events, not configuration or manual investigation actions. A playbook can start when an alert is generated or when an incident is created. Scheduled query rules only trigger playbooks indirectly by creating alerts, data connectors do not trigger playbooks, and hunting queries are manual and do not automatically invoke playbooks.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
