You have the Azure resources shown in the following table.
You need to meet the following requirements:
✑ Internet-facing virtual machines must be protected by using network security groups (NSGs).
✑ All the virtual machines must have disk encryption enabled.
What is the minimum number of security policies that you should create in Microsoft Defender for Cloud?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: A
Explanation: In current Microsoft Defender for Cloud, a security policy is an Azure Policy initiative assignment. A single security policy (initiative) can include multiple policy definitions, such as requiring NSGs for internet-facing VMs and requiring disk encryption for VMs. Therefore, one security policy can satisfy both requirements when assigned at the appropriate scope.
Sources:
https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-machines-windows-virtual-machines-security-baseline
Question 195
You have an Azure subscription that contains an Azure SQL database named DB1 in the East US Azure region.
You create the storage accounts shown in the following table.
You plan to enable auditing for DB1.
Which storage accounts can you use as the auditing destination for DB1?
A. storage1 and storage4 only
B. storage1 only
C. storage1, storage2, storage3, and storage4
D. storage1, storage2, and storage3 only
E. storage2 and storage3 only
Show Answer
Correct Answer: B
Explanation: Based on the stated storage accounts, Azure SQL Database auditing requires blob storage. General-purpose v2 standard storage is supported, and Premium BlockBlobStorage is also supported in current Azure. Premium FileStorage (Azure Files) is not a valid audit destination. The exam question's answer set is inconsistent with current platform behavior because the valid combination would be storage1 and storage2. Since that combination is not offered, the only defensible choice among the provided options is storage1 only.
Question 196
You have an Azure subscription that contains a storage account named storage1 and two web apps named app1 and app2.
Both apps will write data to storage1.
You need to ensure that each app can read only the data that it has written.
What should you do?
A. Provide each app with a system-assigned identity and configure storage1 to use Azure AD User account authentication.
B. Provide each app with a separate Storage account key and configure the app to send the key with each request.
C. Provide each app with a user-managed identity and configure storage1 to use Azure AD User account authentication.
D. Provide each app with a unique Base64-encoded AES-256 encryption key and configure the app to send the key with each request.
Show Answer
Correct Answer: A
Explanation: System-assigned managed identities are the preferred choice for Azure App Service when each app needs its own identity with minimal administration. Configure the storage account to use Microsoft Entra ID (Azure AD) authentication and grant each app's managed identity RBAC access only to its own storage scope (such as a separate container). Storage account keys provide broad access, encryption keys control encryption rather than authorization, and user-managed identities add unnecessary management overhead for this scenario.
Question 197
Your company makes use of Azure Active Directory (Azure AD) in a hybrid configuration. All users are making use of hybrid Azure AD joined Windows 10 computers.
You manage an Azure SQL database that allows for Azure AD authentication.
You need to make sure that database developers are able to connect to the SQL database via Microsoft SQL Server Management Studio (SSMS). You also need to make sure the developers use their on-premises Active Directory account for authentication. Your strategy should allow for authentication prompts to be kept to a minimum.
Which of the following is the authentication method the developers should use?
A. Azure AD token.
B. Azure Multi-Factor authentication.
C. Active Directory integrated authentication.
Show Answer
Correct Answer: C
Explanation: Active Directory integrated authentication is the correct choice because the developers are using hybrid Azure AD joined Windows 10 devices and need to authenticate with their synchronized on-premises Active Directory accounts while minimizing sign-in prompts. Integrated authentication provides seamless single sign-on using the current Windows credentials. Azure AD token authentication requires obtaining and supplying a token, and Azure Multi-Factor Authentication introduces additional authentication prompts rather than minimizing them.
Question 199
SIMULATION -
You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod1234578 Azure Storage account.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Storage account > Networking > Public network access: Enabled from selected virtual networks and IP addresses.
Under Firewall, add IP range 131.107.0.0/16 and save.
Explanation: 131.107.0.0/16 is an IP address range, not an Azure virtual network. Restrict the storage account to selected networks and explicitly allow only that CIDR via the firewall IP rules.
Question 200
You have an Azure Sentinel workspace.
You need to create a playbook.
Which two triggers will start the playbook? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. An Azure Sentinel scheduled query rule is executed.
B. An Azure Sentinel data connector is added.
C. An Azure Sentinel alert is generated.
D. An Azure Sentinel hunting query result is returned.
E. An Azure Sentinel incident is created.
Show Answer
Correct Answer: C, E
Explanation: Microsoft Sentinel playbooks (Logic Apps) can be triggered directly by Microsoft Sentinel when an alert is created or when an incident is created. Scheduled analytics rules themselves are not playbook triggers; they may generate alerts that then trigger playbooks. Adding data connectors and returning hunting query results do not trigger playbooks.
Question 201
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains two users named User1 and User2 and a registered app named App1.
You create an app-specific role named Role1.
You need to assign Role1 to User1 and enable User2 to request access to App1.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: User1: Users and groups
User2: Self-service
Explanation: App roles defined on an app registration are assigned to users/groups through the Enterprise application's Users and groups blade. Enabling users to request access to the application is configured under Self-service.
Question 202
You have an Azure subscription that contains an Azure SQL database named SQL1 and an Azure key vault named KeyVault1. KeyVault1 stores the keys shown in the following table.
You need to configure Transparent Data Encryption (TDE). TDE will use a customer-managed key for SQL1.
Which keys can you use?
A. Key2 only
B. Key1 only
C. Key2 and Key3 only
D. Key1, Key2, Key3, and Key4
E. Key1 and Key2 only
Show Answer
Correct Answer: E
Explanation: For Azure SQL Database TDE with a customer-managed key, the TDE protector must be an asymmetric RSA or RSA-HSM key. In the exam scenario, the usable keys are the RSA keys with supported lengths (2048 or 3072 bits), which correspond to Key1 and Key2. Keys using unsupported algorithms or unsupported key characteristics cannot be used.
Question 203
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Cosmos DB explorer
B. SQL query editor in Azure
C. AzCopy
D. the Security admin center
Show Answer
Correct Answer: C
Explanation: Azure Storage Analytics logs are written into the configured Azure Storage account as blobs. To retrieve or download these archived log files, AzCopy is the appropriate tool. Azure Cosmos DB Explorer, the SQL query editor, and the Security admin center are not used to access Storage Analytics log blobs.
Question 204
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
Transparent Data Encryption (TDE) is disabled on SQL1.
You assign policies to the resource groups as shown in the following table.
You plan to deploy Azure SQL databases by using an Azure Resource Manager (ARM) template. The databases will be configured as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
Yes
No
Explanation: DeployIfNotExists doesn't automatically remediate existing resources without a remediation task. Deny blocks creation of SQL2 in RG2. SQL3 deployment is also denied in RG1 before Audit can apply, so it is not deployed and cannot be marked noncompliant.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
