HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.
You create the groups shown in the following table.
The membership rules for Group1 and Group2 are configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
No
No
Explanation: The rule is (accountEnabled = true) OR (usageLocation = "US"). User1 is included. The statement that User2 is in Group2 only is false because the rule would not make them exclusive to Group2. Managed identities are not user objects for Dynamic User membership, and Microsoft 365 groups do not support managed identities as members.
Question 227
You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments.
You need to resolve the issue by ensuring that the PIM service principal has the correct permissions for the subscription. The solution must use the principle of least privilege.
Which role should you assign to the PIM service principle?
A. Contributor
B. User Access Administrator
C. Managed Application Operator
D. Resource Policy Contributor
Show Answer
Correct Answer: B
Explanation: The authorization error occurs because the Azure AD Privileged Identity Management (PIM) service principal must itself have permission to manage Azure RBAC role assignments at the subscription scope. The least-privileged built-in role that grants permission to create and manage role assignments is User Access Administrator. Contributor cannot manage role assignments, Managed Application Operator is unrelated, and Resource Policy Contributor manages Azure Policy rather than RBAC role assignments.
Question 229
You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table.
You need to ensure that App1 can read all user calendars and create appointments. The solution must use the principle of least privilege.
What should you do?
A. Add a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.
B. Add a new Application API permission for Microsoft.Graph Calendars.ReadWrite.
C. Select Grant admin consent.
D. Add new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.
Show Answer
Correct Answer: B
Explanation: The requirement is for the application to read all users' calendars and create appointments across the organization. Delegated permissions are limited to the signed-in user's access and cannot by themselves grant organization-wide access to every user's calendar. The Microsoft Graph application permission Calendars.ReadWrite allows the app to read and write calendars in all mailboxes without a signed-in user. Although application permissions are broader, they are the least privilege that satisfies the stated requirement. Grant admin consent is necessary for application permissions to become effective, but the primary action asked for is to add the required permission; admin consent alone does not add the permission.
Question 230
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.
Azure AD Privileged Identity Management (PIM) is used in contoso.com.
In PIM, the Password Administrator role has the following settings:
✑ Maximum activation duration (hours): 2
✑ Send email notifying admins of activation: Disable
✑ Require incident/request ticket number during activation: Disable
✑ Require Azure Multi-Factor Authentication for activation: Enable
✑ Require approval to activate this role: Enable
✑ Selected approver: Group1
You assign users the Password Administrator role as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
Yes
No
Explanation: Active assignments are effective immediately. Eligible users can request activation, but MFA is required before activation completes. Approvers cannot approve their own activation requests, even if they belong to the approver group.
Question 231
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.
You configure an access review named Review1 as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: User3 only
User2 will retain the Password administrator role
Explanation: The review targets the Password Administrator role with reviewers set to Members (self), so each eligible member reviews only their own assignment. User3 can therefore perform the review only for themself. Auto-apply results is disabled, so even if User2 does not respond and the recommendation is used, the role is not automatically revoked; User2 retains the role unless an administrator applies changes manually.
Question 232
HOTSPOT -
You implement the planned changes for ASG1 and ASG2.
In which NSGs can you use ASG1, and the network interfaces of which virtual machines can you assign to ASG2?
Hot Area:
Show Answer
Correct Answer: NSG2 and NSG4 only
VM3 only
Explanation: ASGs can be referenced only by NSGs in the same region, and ASG membership is constrained by region and then virtual network. ASG2 is in Central US, so only VM3's NIC can be assigned. ASG1 can be used in the NSGs that are in its region: NSG2 and NSG4.
Question 233
HOTSPOT -
You need to delegate the creation of RG2 and the management of permissions for RG1.
Which users can perform each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Create RG2: Admin3 only
Manage RG1 permissions: Admin1 and Admin4 only
Explanation: A Contributor at the subscription scope can create resource groups but cannot manage RBAC permissions. User Access Administrator can manage access assignments, and an Owner on RG1 can also manage permissions for that resource group.
Question 234
SIMULATION -
You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com and a user named User1 in the new directory.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Azure portal → Microsoft Entra ID (Azure AD) → Manage tenants → Create → New Microsoft Entra ID tenant.
Directory name: 12345678
Initial domain: 12345678.onmicrosoft.com
Create the tenant.
Switch to the new tenant.
Users → New user → Create user: User1 → Create.
Explanation: Create a new Azure AD (Microsoft Entra ID) directory with the specified initial domain, then switch to that tenant and add a new user named User1.
Question 235
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.
The tenant contains the named locations shown in the following table.
You create the conditional access policies for a cloud app named App1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
Yes
No
Explanation: User1 is excluded from the blocking policy and matches the grant policy. User2 from Seattle is only subject to the grant-with-MFA policy, while from Boston the block policy applies and block takes precedence.
Question 236
You plan to implement JIT VM access.
Which virtual machines will be supported?
A. VM2, VM3, and VM4 only
B. VM1, VM2, VM3, and VM4
C. VM1 and VM3 only
D. VM1 only
Show Answer
Correct Answer: A
Explanation: Azure Defender for Cloud Just-in-Time VM access requires supported inbound access control such as a Network Security Group (or supported firewall configuration). Based on the scenario, only VM2, VM3, and VM4 meet the prerequisite because they have NSGs, while VM1 does not.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
