HOTSPOT -
You have an Azure subscription that contains a resource group named RG1. RG1 contains a storage account named storage1.
You have two custom Azure roles named Role1 and Role2 that are scoped to RG1.
The permissions for Role1 are shown in the following JSON code.
The permissions for Role2 are shown in the following JSON code.
You assign the roles to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
No
No
Explanation: Both custom roles define only control-plane Actions and no DataActions, so they do not grant storage data access. Role1 can read storage account properties and list keys/SAS, but not data via RBAC. Role2 manages the storage account but also lacks DataActions. Restoring a storage account from Azure Backup requires Recovery Services/backup permissions not present in these roles.
Question 206
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy the virtual machines shown in the following table.
You need to assign managed identities to the virtual machines. The solution must meet the following requirements:
✑ Assign each virtual machine the required roles.
✑ Use the principle of least privilege.
What is the minimum number of managed identities required?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: Use user-assigned managed identities to share an identity across multiple virtual machines that require the same permissions. To satisfy least privilege, create one user-assigned managed identity for the VMs requiring the first role set and a second user-assigned managed identity for the VMs requiring the second role set. System-assigned identities cannot be shared across resources, but user-assigned identities can.
Question 207
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Monitor
B. SQL query editor in Azure
C. File Explorer in Windows
D. Azure Storage Explorer
Show Answer
Correct Answer: D
Explanation: Azure Storage Analytics logs are stored as blobs in the designated storage account. Azure Storage Explorer is the standard tool for browsing storage accounts and retrieving/viewing those log blobs. Azure Monitor is for monitoring and metrics, SQL Query Editor is unrelated, and Windows File Explorer cannot directly browse Azure Storage without additional mapping.
Question 208
DRAG DROP -
You have an Azure subscription that contains the following resources:
A virtual network named VNET1 that contains two subnets named Subnet1 and Subnet2.
✑ A virtual machine named VM1 that has only a private IP address and connects to Subnet1.
You need to ensure that Remote Desktop connections can be established to VM1 from the internet.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order.
Select and Place:
Show Answer
Correct Answer: Create a new subnet.
Deploy Azure Firewall.
Create a NAT rule collection.
Explanation: Azure Firewall requires a dedicated subnet named AzureFirewallSubnet. To allow RDP from the internet to a VM with only a private IP, deploy Azure Firewall and configure a DNAT (NAT rule collection) to forward TCP 3389 to the VM.
Question 209
SIMULATION -
You need to grant the required permissions to a user named User2-1234578 to manage the virtual networks in the RG1lod1234578 resource group. The solution must use the principle of least privilege.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Resource group RG1lod1234578 → Access control (IAM) → Add role assignment → Network Contributor → Select User2-1234578 → Save.
Explanation: The Network Contributor built-in role grants permission to manage virtual networks and related network resources without broader permissions, satisfying least privilege. Assign it at the RG1lod1234578 resource group scope as requested.
Question 210
HOTSPOT -
You have an Azure subscription that contains an Azure SQL database named SQL1.
You plan to deploy a web app named App1.
You need to provide App1 with read and write access to SQL1. The solution must meet the following requirements:
✑ Provide App1 with access to SQL1 without storing a password.
✑ Use the principle of least privilege.
✑ Minimize administrative effort.
Which type of account should App1 use to access SQL1, and which database roles should you assign to App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Account type: Managed identity
Roles: db_datareader and db_datawriter
Explanation: A managed identity lets an Azure App Service authenticate to Azure SQL without storing passwords or secrets, minimizing administration. Grant only the built-in database roles needed for read and write access (db_datareader and db_datawriter), rather than db_owner, to follow least privilege.
Question 211
You need to meet the technical requirements for the finance department users.
Which CAPolicy1 settings should you modify?
A. Cloud apps or actions
B. Conditions
C. Grant
D. Session
Show Answer
Correct Answer: D
Explanation: The technical requirement described is consistent with modifying Conditional Access session controls, specifically settings such as Sign-in frequency or other session behaviors. Those are configured under the Session section of a Conditional Access policy, not Cloud apps, Conditions, or Grant controls.
Question 212
DRAG DROP -
You need to perform the planned changes for OU2 and User1.
Which tools should you use? To answer, drag the appropriate tools to the correct resources. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Show Answer
Correct Answer: OU2: Azure AD Connect
User1: The Azure portal
Explanation: OU-related synchronization/filtering changes are performed with Azure AD Connect, while changes to a cloud-only Azure AD user/group membership are managed in the Azure portal.
Question 213
HOTSPOT -
You need to configure support for Microsoft Sentinel notebooks to meet the technical requirements.
What is the minimum number of Azure container registries and Azure Machine Learning workspaces required?
Hot Area:
Explanation: Microsoft Sentinel notebooks require an Azure Machine Learning workspace to run. An Azure Container Registry is only needed for custom container images and is not required for the basic Sentinel notebook configuration.
Question 214
You plan to deploy Azure container instances.
You have a containerized application that is comprised of two containers: an application container and a validation container. The application container is monitored by the validation container. The validation container performs security checks by making requests to the application container and waiting for responses after every transaction.
You need to ensure that the application container and the validation container are scheduled to be deployed together. The containers must communicate to each other only on ports that are not externally exposed.
What should you include in the deployment?
A. application security groups
B. network security groups (NSGs)
C. management groups
D. container groups
Show Answer
Correct Answer: D
Explanation: Azure Container Instances use container groups to deploy multiple containers together on the same host. Containers in the same container group share a network namespace and can communicate with each other via localhost on any port, including ports that are not exposed externally. Application Security Groups, Network Security Groups, and Management Groups do not provide co-scheduling of containers.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
