HOTSPOT
-
You have a Microsoft Entra tenant that contains the user shown in the following table.
You configure a Conditional Access policy that has the following settings:
• Name:CAPolicy1
• Assignments
o Users or workload identities: Group1
o Target resources: All cloud apps
• Access controls
o Grant access: Require multifactor authentication
From Microsoft Authenticator settings for the tenant, the Enable and Target settings are configured as shown in the Enable and Target exhibit. (Click the Enable and Target tab.)
From Microsoft Authenticator settings for the tenant, the Configure settings are configured as shown in the Configure exhibit. (Click the Configure tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: No
User2: Yes
User3: Yes
Explanation: Conditional Access enforces MFA only for Group1. Number matching is configured in Microsoft Authenticator and targeted to Group2. User1 is not in Group2, so number matching is not required. User2 is in Group2 and must use number matching when satisfying MFA. User3 is not in the CA policy, but if prompted for Authenticator MFA, Group2 targeting enforces number matching.
Question 13
HOTSPOT
-
You have a Microsoft Entra tenant that contains the groups shown in the following table.
From the Azure portal, you configure a group expiration policy that has a lifetime of 180 days.
Which groups will be deleted after 180 days of inactivity, and what is the maximum amount of time you have to restore a deleted group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Groups that will be deleted:
Group3 only
Maximum amount of time to restore a deleted group:
30 days
Explanation: Group expiration policies in Microsoft Entra ID apply only to Microsoft 365 groups, not security or mail-enabled security groups. Deleted Microsoft 365 groups can be restored from the soft-delete state for up to 30 days.
Question 14
You have a Microsoft Entra tenant named contoso.com.
You collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com.
You need to create an allow list of cloud apps from fabrikam.com that can be used by the users in contoso.com.
What should you do for contoso.com in the Microsoft Entra admin center?
A. From Inbound access settings in Cross-tenant access settings, configure the B2B direct connect settings.
B. From External collaboration settings, configure the Collaboration restrictions settings.
C. From External collaboration settings, configure the Guest invite settings.
D. From Outbound access settings in Cross-tenant access settings, configure the B2B collaboration settings.
Show Answer
Correct Answer: D
Explanation: Users in contoso.com need access to cloud apps that are hosted in an external tenant (fabrikam.com). In Microsoft Entra, outbound cross-tenant access settings control what internal users can access in an external organization. By configuring Outbound access settings in Cross-tenant access settings for B2B collaboration, you can define an allow list of specific external applications that contoso users are permitted to use. Inbound settings would instead control fabrikam users accessing contoso resources, which is not the requirement.
Question 15
You have a Microsoft Entra tenant that contains three users named User1, User2, and User3.
You configure Microsoft Entra Password Protection as shown in the following exhibit.
The users perform the following tasks:
• User1 attempts to reset her password to C0nt0s0.
• User2 attempts to reset her password to F@brikamHQ.
• User3 attempts to reset her password to Pr0duct123.
Which password reset attempts fail?
A. User1 only
B. User2 only
C. User3 only
D. User1 and User 3 only
E. User1, User2, and User3
Show Answer
Correct Answer: E
Explanation: Microsoft Entra Password Protection normalizes passwords (case-insensitive, common substitutions like 0→o, @→a) and evaluates them against the global and custom banned password lists. If banned terms are found, they reduce the score, and the password must reach at least 5 points to be accepted.
- C0nt0s0 normalizes to "contoso" (a standard/banned term).
- F@brikamHQ normalizes to "fabrikamhq" (contains the banned term "fabrikam").
- Pr0duct123 normalizes to "product123" (contains the banned term "product").
All three passwords contain banned words or their variations and therefore fail the reset.
Question 16
You have a Microsoft Entra tenant that uses Microsoft Entra Permissions Management and contains the accounts shown in the following table:
Which accounts will be listed as assigned to highly privileged roles on the Azure AD insights tab in the Entra Permissions Management portal?
A. Admin1 only
B. Admin2 and Admin3 only
C. Admin2 and Admin4 only
D. Admin1, Admin2, and Admin3 only
E. Admin2, Admin3, and Admin4 only
F. Admin1, Admin2, Admin3, and Admin4
Show Answer
Correct Answer: D
Explanation: In the Microsoft Entra Permissions Management **Azure AD insights** tab, accounts are listed if they are assigned to **highly privileged roles**. These include tenant‑wide security and role‑control roles such as **Global Administrator**, **Privileged Role Administrator**, and **Privileged Authentication Administrator**.
Exchange Administrator is a service‑specific role and is **not treated as a highly privileged role** in this Insights view. Therefore, the accounts holding the three privileged roles (Admin1, Admin2, and Admin3) are listed, while Admin4 is not.
Question 17
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have an Amazon Web Services (AWS) account.
You need to add the AWS account to Defender for Cloud.
What should you do first?
A. From Defender for Cloud, configure the Environment settings.
B. From the AWS account, enable a security hub.
C. From Defender for Cloud, configure the Security solutions settings.
D. From the Azure portal, add the AWS enterprise application.
Show Answer
Correct Answer: A
Explanation: To onboard an AWS account to Microsoft Defender for Cloud, the first step is performed in Defender for Cloud itself. You go to Defender for Cloud > Environment settings and add a new environment for Amazon Web Services. This initiates the native connector setup and guides the required AWS-side configuration. The other options are not the starting point for onboarding.
Question 18
You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.)
You plan to deploy the cluster to production. You disable HTTP application routing.
You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address.
What should you do?
A. Create an AKS Ingress controller.
B. Create an Azure Standard Load Balancer.
C. Install the container network interface (CNI) plug-in.
D. Create an Azure Basic Load Balancer.
Show Answer
Correct Answer: A
Explanation: An AKS Ingress controller provides application-layer routing for HTTP/HTTPS traffic, acting as a reverse proxy and supporting TLS termination. It allows multiple services to be exposed through a single public IP address using host- or path-based routing, which matches the requirement after disabling HTTP application routing.
Question 19
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains the subnets shown in the following table.
You create the virtual machines shown in the following table.
You plan to configure just-in-time (JIT) VM access for the virtual machines. The solution must minimize administrative effort.
For which virtual machines can you configure JIT VM access?
A. VM1 only
B. VM1 and VM2 only
C. VM1 and VM3 only
D. VM1, VM2, and VM3 only
E. VM1, VM2, VM3, and VM4
Show Answer
Correct Answer: D
Explanation: Just-in-time (JIT) VM access requires that inbound traffic to the VM be controlled by a Network Security Group (NSG), either at the subnet level or on the VM’s NIC. VM1 and VM2 are in subnets that have NSGs associated, and VM3 has an NSG associated directly with its NIC, so JIT can be configured for all three. VM4 does not meet this prerequisite. Therefore, JIT can be configured for VM1, VM2, and VM3 only.
Question 20
You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains an instance of Azure Database for PostgreSQL.
You need to ensure that an email alert is triggered when a suspected brute force attack on the database is detected. The solution must minimize administrative effort.
What should you configure?
A. the Azure Monitor activity log
B. an Azure Monitor alert rule
C. Microsoft Defender for open-source relational databases
D. the PostgreSQL Audit extension (pgAudit)
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for open-source relational databases (part of Microsoft Defender for Cloud) provides built-in threat detection for Azure Database for PostgreSQL, including suspected brute force attacks, and can automatically trigger email alerts. This requires minimal administrative effort compared to creating custom alerts or configuring auditing extensions.
Question 21
You have an on-premises network.
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy a Site-to-Site (S2S) VPN between the on-premises network and VNet1.
You need to recommend an Azure VPN Gateway SKU that meets the following requirements:
• Supports 1-Gbps throughput
• Minimizes costs
What should you recommend?
A. VpnGw1
B. VpnGw2
C. VpnGw1AZ
D. VpnGw2AZ
Show Answer
Correct Answer: B
Explanation: The requirement is to support 1‑Gbps S2S VPN throughput while minimizing cost. VpnGw1 supports up to ~650 Mbps, which is insufficient. VpnGw2 supports up to 1 Gbps and is the lowest‑cost SKU that meets this requirement. The AZ variants (VpnGw1AZ, VpnGw2AZ) add zone redundancy at a higher cost, which is not required by the question.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
