You plan to configure Azure Disk Encryption for VM4.
Which key vault can you use to store the encryption key?
A. KeyVault1
B. KeyVault2
C. KeyVault3
Show Answer
Correct Answer: A
Explanation: Azure Disk Encryption requires the Azure Key Vault used for encryption keys/secrets to be in the same subscription and Azure region as the virtual machine. VM4 is in West US, and KeyVault1 is the matching key vault in that region, so it is the valid choice.
Question 217
You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect.
You create a new Azure subscription.
You discover that the synced on-premises user accounts cannot be assigned roles in the new subscription.
You need to ensure that you can assign Azure and Microsoft 365 roles to the synced Azure AD user accounts.
What should you do fist?
A. Configure the Azure AD tenant used by the new subscription to use pass-through authentication.
B. Configure the Azure AD tenant used by the new subscription to use federated authentication.
C. Change the Azure AD tenant used by the new subscription.
D. Configure a second instance of Azure AD Connect.
Show Answer
Correct Answer: C
Explanation: Azure RBAC and Microsoft Entra ID (Azure AD) role assignments can only be made to identities that exist in the Microsoft Entra tenant associated with the subscription. If a new Azure subscription is associated with a different tenant than the existing synchronized tenant, the synced on-premises users will not be available for role assignment. The first step is to change the subscription to use the existing Azure AD (Microsoft Entra) tenant. Changing the authentication method (pass-through or federation) does not affect tenant association, and deploying a second Azure AD Connect instance is unnecessary for this scenario.
Question 218
You have an Azure Active Directory (Azure AD) tenant that contains a user named Admin1. Admin1 is assigned the Application developer role.
You purchase a cloud app named App1 and register App1 in Azure AD.
Admin1 reports that the option to enable token encryption for App1 is unavailable.
You need to ensure that Admin1 can enable token encryption for App1 in the Azure portal.
What should you do?
A. Upload a certificate for App1.
B. Modify the API permissions of App1.
C. Add App1 as an enterprise application.
D. Assign Admin1 the Cloud application administrator role.
Show Answer
Correct Answer: D
Explanation: The Application developer role allows app registration but does not grant sufficient privileges to manage advanced enterprise application settings such as token encryption. To enable token encryption in the Azure portal, Admin1 needs a role such as Cloud Application Administrator (or Application Administrator/Global Administrator). Uploading a certificate is required to use token encryption, but it does not resolve the permission issue described in the question.
Question 219
You plan to deploy an app that will modify the properties of Azure Active Directory (Azure AD) users by using Microsoft Graph.
You need to ensure that the app can access Azure AD.
What should you configure first?
A. an app registration
B. an external identity
C. a custom role-based access control (RBAC) role
D. an Azure AD Application Proxy
Show Answer
Correct Answer: A
Explanation: To allow an application to access Microsoft Graph and Azure AD resources, you first create an Azure AD app registration. The app registration establishes the application's identity, after which you can configure API permissions (such as Microsoft Graph permissions), create a service principal, grant admin consent, and authenticate. The other options do not establish an application's identity for Graph access.
Question 220
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
You create a custom RBAC role in Subscription1 by using the following JSON file.
You assign Role1 to User1 on RG1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
No
No
Explanation: The role grants read access to all resources (*/Read) and Microsoft.Compute permissions only. It does not grant Microsoft.Network permissions needed to modify VNet attachments, nor Microsoft.Web or Microsoft.ContainerInstance permissions to manage App Service or Container Instances.
Question 221
HOTSPOT -
You have an Azure subscription that contains the storage accounts shown in the following table.
You need to configure authorization access.
Which authorization types can you use for each storage account? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: storage1: Shared Key, shared access signature (SAS), and Azure Active Directory (Azure AD)
storage2: Shared Key only
storage3: Shared Key, shared access signature (SAS), and Azure Active Directory (Azure AD)
Explanation: Blob and Table storage support Shared Key, SAS, and Azure AD authorization. Azure Files over SMB uses Shared Key authentication in this exam context; SAS is not supported for SMB access.
Question 222
HOTSPOT -
You have an Azure subscription that contains an Azure key vault named KeyVault1 and the virtual machines shown in the following table.
You set the Key Vault access policy to Enable access to Azure Disk Encryption for volume encryption.
KeyVault1 is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
No
Yes
Explanation: Key Vault network access is limited to VNET1, so VM1 can reach the vault while VM2 cannot. With 'Allow trusted Microsoft services to bypass this firewall' enabled and Azure Disk Encryption access enabled on the vault, ADE can still use the vault from VM2.
Question 223
You have an Azure subscription.
You plan to create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability.
What should you create first?
A. an automation account
B. a managed identity
C. an Azure logic app
D. an Azure function app
E. an alert rule
Show Answer
Correct Answer: C
Explanation: Workflow automation in Microsoft Defender for Cloud (formerly Azure Security Center) is built on Azure Logic Apps. To create a workflow automation, you first create or select a Logic App, which is then associated with triggers such as security alerts or recommendations. Automation Accounts, managed identities, Azure Functions, or alert rules may be used in some implementations, but they are not the prerequisite for creating the workflow automation itself.
Question 224
You have an Azure subscription name Sub1 that contains an Azure Policy definition named Policy1. Policy1 has the following settings:
✑ Definition location: Tenant Root Group
✑ Category: Monitoring
You need to ensure that resources that are noncompliant with Policy1 are listed in the Azure Security Center dashboard.
What should you do first?
A. Change the Category of Policy1 to Security Center.
B. Add Policy1 to a custom initiative.
C. Change the Definition location of Policy1 to Sub1.
D. Assign Policy1 to Sub1.
Show Answer
Correct Answer: B
Explanation: Azure Defender for Cloud (formerly Security Center) surfaces custom policy-based recommendations through custom initiatives (policy sets), not standalone policy definitions. The first step is to add the policy definition to a custom initiative. That initiative can then be assigned at the appropriate scope so noncompliance appears in the regulatory compliance/dashboard experience. Changing the category or definition location does not achieve this, and assigning the standalone policy alone does not integrate it as a custom recommendation.
Question 225
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.
You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:
✑ Assignments: Include Group1, exclude Group2
✑ Conditions: Sign-in risk level: Low and above
✑ Access: Allow access, Require multi-factor authentication
You need to identify what occurs when the users sign in to Azure AD.
What should you identify for each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: User1: Sign in by using a username and password only
User2: Be blocked
Explanation: User1 is excluded from the Identity Protection policy because exclusion takes precedence over inclusion, so the policy requiring MFA does not apply. User2 is included and a risky sign-in triggers the policy requiring MFA; because MFA is not registered/enabled for use, the user cannot satisfy the requirement and access is blocked.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
