You need to recommend which virtual machines to use to host App1. The solution must meet the technical requirements for KeyVault1.
Which virtual machines should you use?
A. VM1 only
B. VM1, VM2, VM3, and VM4
C. VM1 and VM2 only
D. VM1, VM2, and VM4 only
Show Answer
Correct Answer: C
Explanation: KeyVault1 uses a private endpoint in VNET1. Only VMs that have direct, non-transitive private network connectivity to that private endpoint can access KeyVault1 without using the public internet. VM1 (same VNET) and VM2 (directly peered VNET) meet this requirement. VM3 and VM4 rely on transitive peering or indirect routing, which is not supported by default, so they cannot reliably reach the private endpoint. Therefore, only VM1 and VM2 satisfy the KeyVault1 networking requirement.
Question 224
HOTSPOT -
You have an Azure subscription that contains the storage accounts shown in the following table.
You need to configure authorization access.
Which authorization types can you use for each storage account? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: storage1:
Shared Key, shared access signature (SAS), and Azure Active Directory (Azure AD)
storage2:
Shared Key only
storage3:
Shared Key, shared access signature (SAS), and Azure Active Directory (Azure AD)
Explanation: Azure Blob Storage supports Shared Key, SAS, and Azure AD authorization. Azure Files accessed over SMB does not support SAS, so Shared Key is the valid option. Azure Table Storage supports Shared Key and SAS, and also supports Azure AD (historically preview, but included for authorization options).
Question 225
HOTSPOT -
You have an Azure subscription that contains an Azure key vault named KeyVault1 and the virtual machines shown in the following table.
You set the Key Vault access policy to Enable access to Azure Disk Encryption for volume encryption.
KeyVault1 is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
Yes
Yes
Explanation: KeyVault1 allows selected networks and has trusted Microsoft services bypass enabled. VM1 is in the allowed VNET, so users can manage keys and secrets. Management access is not restricted by the VM’s VNET when using Azure control plane access, so users from VM2 can also manage keys and secrets. Azure Disk Encryption is a trusted Microsoft service, so VM2 can use KeyVault1 for ADE despite not being in an allowed VNET.
Question 226
You have an Azure subscription.
You plan to create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability.
What should you create first?
A. an automation account
B. a managed identity
C. an Azure logic app
D. an Azure function app
E. an alert rule
Show Answer
Correct Answer: C
Explanation: In Microsoft Defender for Cloud (formerly Azure Security Center), workflow automation is built on Azure Logic Apps. To automatically remediate vulnerabilities, Defender for Cloud triggers a Logic App based on alerts, recommendations, or compliance changes. Therefore, the Logic App must exist first so it can be selected or created when configuring the workflow automation. Other components (automation accounts, managed identities, functions, or alert rules) are optional or secondary depending on the remediation actions.
Question 227
You have an Azure subscription name Sub1 that contains an Azure Policy definition named Policy1. Policy1 has the following settings:
✑ Definition location: Tenant Root Group
✑ Category: Monitoring
You need to ensure that resources that are noncompliant with Policy1 are listed in the Azure Security Center dashboard.
What should you do first?
A. Change the Category of Policy1 to Security Center.
B. Add Policy1 to a custom initiative.
C. Change the Definition location of Policy1 to Sub1.
D. Assign Policy1 to Sub1.
Show Answer
Correct Answer: B
Explanation: Azure Defender for Cloud (Security Center) surfaces custom recommendations only from policy initiatives, not standalone policy definitions. To have noncompliant resources from a custom policy appear on the Security Center dashboard, the policy must first be added to a custom initiative. Assignment comes afterward, but the first required step is creating the custom initiative that includes Policy1.
Question 228
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.
You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:
✑ Assignments: Include Group1, exclude Group2
✑ Conditions: Sign-in risk level: Low and above
✑ Access: Allow access, Require multi-factor authentication
You need to identify what occurs when the users sign in to Azure AD.
What should you identify for each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: User1: Sign in by using a username and password only
User2: Be blocked
Explanation: The Identity Protection policy includes Group1 but excludes Group2, and exclusion takes precedence.
• User1 is in both Group1 and Group2, so the policy does not apply. With MFA only Enabled (not enforced), the user can sign in using username and password only.
• User2 is included in the policy and meets the sign-in risk condition. The policy requires MFA, but because User2 has not registered MFA, access is blocked.
Question 229
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.
You create the groups shown in the following table.
The membership rules for Group1 and Group2 are configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
No
No
Explanation: Dynamic user rule is `(accountEnabled == true) OR (usageLocation == "US")`.
• User1 (US) matches and is added to both dynamic user groups.
• User2 (Germany) does not qualify for Group2 only; with the OR rule, membership would not be exclusive to Group2.
• Managed identities are not supported as members of Microsoft 365 groups, so Managed1 cannot be in both groups.
Question 230
You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments.
You need to resolve the issue by ensuring that the PIM service principal has the correct permissions for the subscription. The solution must use the principle of least privilege.
Which role should you assign to the PIM service principle?
A. Contributor
B. User Access Administrator
C. Managed Application Operator
D. Resource Policy Contributor
Show Answer
Correct Answer: B
Explanation: Azure AD PIM performs role assignments through its service principal. To create, update, or read role assignments at the subscription scope, the least-privileged built-in role that grants the required Microsoft.Authorization/roleAssignments permissions is User Access Administrator. Assigning this role to the PIM service principal resolves authorization errors without granting broader permissions like Contributor.
Question 231
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains the resources shown in the following table.
User2 is the owner of Group2.
The user and group settings for App1 are configured as shown in the following exhibit.
You enable self-service application access for App1 as shown in the following exhibit.
User3 is configured to approve access to App1.
After you enable self-service application access for App1, who will be configured as the Group2 owner and who will be configured as the App1 users? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Group2 owners:
User3 only
App1 users:
Group1 and Group2 members only
Explanation: When self-service access is enabled and a target group is selected, the configured approver becomes the owner of that group, replacing the previous owner. Therefore, User3 becomes the sole owner of Group2. App1 already has Group1 assigned, and approved self-service requests add users to Group2, which is also assigned to App1. Thus, App1 users are members of Group1 and Group2 only.
Question 232
You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table.
You need to ensure that App1 can read all user calendars and create appointments. The solution must use the principle of least privilege.
What should you do?
A. Add a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.
B. Add a new Application API permission for Microsoft.Graph Calendars.ReadWrite.
C. Select Grant admin consent.
D. Add new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.
Show Answer
Correct Answer: B
Explanation: The requirement is that App1 can read all user calendars and create appointments across the entire tenant. Delegated permissions only allow access in the context of the signed-in user and cannot guarantee access to all users’ calendars. Microsoft Graph Calendars.ReadWrite application permission explicitly allows read and write access to calendars in all mailboxes without a signed-in user. This is the minimum permission that satisfies the requirement, making it compliant with least privilege for the stated need.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
