HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains two users named User1 and User2 and a registered app named App1.
You create an app-specific role named Role1.
You need to assign Role1 to User1 and enable User2 to request access to App1.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Users and groups
Self-service
Explanation: Role1 is an app-specific role created in the app registration, so it is assigned to User1 from the Enterprise Application’s **Users and groups** blade. To allow User2 to request access to App1, you must enable access requests in the **Self-service** settings.
Question 204
You have an Azure subscription that contains an Azure SQL database named SQL1 and an Azure key vault named KeyVault1. KeyVault1 stores the keys shown in the following table.
You need to configure Transparent Data Encryption (TDE). TDE will use a customer-managed key for SQL1.
Which keys can you use?
A. Key2 only
B. Key1 only
C. Key2 and Key3 only
D. Key1, Key2, Key3, and Key4
E. Key1 and Key2 only
Show Answer
Correct Answer: E
Explanation: For Azure SQL Database TDE with a customer-managed key (BYOK), the TDE protector must be an asymmetric key of type RSA or RSA-HSM stored in Azure Key Vault. Only supported key sizes are 2048-bit and 3072-bit. From the listed keys, only Key1 and Key2 meet both the key type and supported key length requirements; keys with unsupported algorithms or unsupported lengths (such as 4096-bit) cannot be used.
Question 205
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Cosmos DB explorer
B. SQL query editor in Azure
C. AzCopy
D. the Security admin center
Show Answer
Correct Answer: C
Explanation: Azure Storage Analytics logs are written to the storage account (Blob/Table storage). To retrieve or download those log files, you use a storage data access tool such as AzCopy, which is designed to copy data to and from Azure Storage.
Question 206
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
Transparent Data Encryption (TDE) is disabled on SQL1.
You assign policies to the resource groups as shown in the following table.
You plan to deploy Azure SQL databases by using an Azure Resource Manager (ARM) template. The databases will be configured as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: SQL1 will have TDE enabled automatically: No
The deployment of SQL2 will fail: Yes
SQL3 will be deployed and marked as noncompliant: Yes
Explanation: DeployIfNotExists doesn’t automatically remediate existing resources, so SQL1 stays without TDE unless a remediation task is run. SQL2 is deployed to RG2 where a Deny policy for disabled TDE blocks creation. SQL3 is deployed to RG1 where there is no Deny policy, so deployment succeeds but the Audit policy marks it noncompliant.
Question 207
HOTSPOT -
You have an Azure subscription that contains a resource group named RG1. RG1 contains a storage account named storage1.
You have two custom Azure roles named Role1 and Role2 that are scoped to RG1.
The permissions for Role1 are shown in the following JSON code.
The permissions for Role2 are shown in the following JSON code.
You assign the roles to the users shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: User1 can read data in storage1: Yes
User2 can read data in storage1: Yes
User3 can restore storage1 from a backup in Azure Backup: No
Explanation: Role1 allows listing storage account keys and generating SAS tokens. With keys or SAS, a user can access storage data even without dataActions. Role2 includes Microsoft.Storage/storageAccounts/*, which also allows key access, enabling data access. Restoring from Azure Backup requires Recovery Services (Microsoft.RecoveryServices/*) permissions, which neither role provides.
Question 208
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy the virtual machines shown in the following table.
You need to assign managed identities to the virtual machines. The solution must meet the following requirements:
✑ Assign each virtual machine the required roles.
✑ Use the principle of least privilege.
What is the minimum number of managed identities required?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: To follow the principle of least privilege, virtual machines that require the same set of permissions can share a single **user-assigned managed identity**, while VMs with different permission requirements must use different identities. In this scenario, the VMs fall into two distinct permission groups, so two user-assigned managed identities are sufficient. System-assigned identities cannot be shared across resources, but user-assigned identities can be associated with multiple VMs, which minimizes the total number required.
Question 209
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. Azure Monitor
B. SQL query editor in Azure
C. File Explorer in Windows
D. Azure Storage Explorer
Show Answer
Correct Answer: D
Explanation: Azure Storage Analytics logs are stored as blobs in a storage account. Azure Storage Explorer is the appropriate tool to browse the storage account, navigate to the logs container, and retrieve or download the diagnostic log files. Azure Monitor is used for metrics and log analytics, not direct access to archived Storage Analytics logs.
Question 210
DRAG DROP -
You have an Azure subscription that contains the following resources:
A virtual network named VNET1 that contains two subnets named Subnet1 and Subnet2.
✑ A virtual machine named VM1 that has only a private IP address and connects to Subnet1.
You need to ensure that Remote Desktop connections can be established to VM1 from the internet.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order.
Select and Place:
Show Answer
Correct Answer: Create a new subnet.
Deploy Azure Firewall.
Create a NAT rule collection.
Explanation: VM1 has no public IP, so inbound RDP must be published via Azure Firewall DNAT. Azure Firewall requires a dedicated subnet (AzureFirewallSubnet). After deploying the firewall, a DNAT (NAT rule collection) maps the firewall’s public IP and TCP 3389 to VM1’s private IP.
Question 211
SIMULATION -
You need to grant the required permissions to a user named User2-1234578 to manage the virtual networks in the RG1lod1234578 resource group. The solution must use the principle of least privilege.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Assign the **Network Contributor** role to User2-1234578 at the **RG1lod1234578** resource group scope.
Explanation: The requirement is to manage **virtual networks** with least privilege. The Network Contributor role allows full management of virtual network resources without granting broader permissions such as VM or resource group ownership. Assigning it at the resource group scope covers all VNets in RG1lod1234578.
Question 212
HOTSPOT -
You have an Azure subscription that contains an Azure SQL database named SQL1.
You plan to deploy a web app named App1.
You need to provide App1 with read and write access to SQL1. The solution must meet the following requirements:
✑ Provide App1 with access to SQL1 without storing a password.
✑ Use the principle of least privilege.
✑ Minimize administrative effort.
Which type of account should App1 use to access SQL1, and which database roles should you assign to App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Account type:
Managed identity
Roles:
db_datareader and db_datawriter
Explanation: A managed identity allows the web app to authenticate to Azure SQL Database using Azure AD without storing credentials, minimizing administrative effort. Assigning db_datareader and db_datawriter provides only the required read and write permissions, satisfying the principle of least privilege.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
