You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to add a custom security recommendation to Defender for Cloud. The recommendation must be assigned the custom severity rating of the subscription.
What should you create?
A. an exemption
B. an initiative definition
C. a policy definition
D. an assignment
Show Answer
Correct Answer: B
Explanation: To have a custom recommendation appear in Microsoft Defender for Cloud, you create an Azure Policy initiative (policy set definition). Defender for Cloud surfaces initiatives as custom recommendations; a policy definition alone does not become a recommendation. Custom severity can be configured for the recommendation within the initiative metadata.
Question 44
DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
You need to configure network connectivity to meet the following requirements:
• Communication from VM1 to storage1 must traverse an optimized Microsoft backbone network.
• All the outbound traffic from VM1 to the internet must be denied.
• The solution must minimize costs and administrative effort.
What should you configure for VNet1 and NSG1? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VNet1: A service endpoint
NSG1: A service tag
Explanation: Use a Microsoft.Storage service endpoint to keep traffic to Azure Storage on the Microsoft backbone with minimal cost and administration. Use an NSG service tag (for example, Internet) in outbound rules to deny internet egress while allowing required Azure Storage traffic.
Question 45
You have an Azure AD tenant that contains the users shown in the following table.
You need to ensure that the users cannot create app passwords. The solution must ensure that User1 can continue to use the Mail and Calendar app.
What should you do?
A. Assign User1 the Authentication Policy Administrator role.
B. Enable Azure AD Password Protection.
C. Configure a multi-factor authentication (MFA) registration policy.
D. Create a new app registration.
E. From multi-factor authentication, configure the service settings.
Show Answer
Correct Answer: E
Explanation: To prevent users from creating app passwords, configure the Azure AD (Microsoft Entra) MFA Service Settings and select the option to not allow users to create app passwords. This setting does not prevent modern authentication clients such as the Mail and Calendar app from continuing to work, provided they use modern authentication rather than app passwords. The other options do not control app password creation.
Sources:
https://learn.microsoft.com/en-us/answers/questions/5384829/app-passwords-for-sign-in-does-microsoft-still-all
Question 46
You have an Azure subscription named Sub1 that has Security defaults disabled. The subscription contains the following users:
• Five users that have owner permissions for Sub1.
• Ten users that have owner permissions for Azure resources.
None of the users have multi-factor authentication (MFA) enabled.
Sub1 has the secure score as shown in the Secure Score exhibit. (Click the Secure Score tab.)
You plan to enable MFA for the following users:
• Five users that have owner permission for Sub1.
• Five users that have owner permissions for Azure resources.
By how many points will the secure score increase after you perform the planned changes?
A. 0
B. 5
C. 7.5
D. 10
E. 14
Show Answer
Correct Answer: C
Explanation: The recommendation to enable MFA for accounts with owner permissions contributes up to 10 secure score points and is calculated proportionally based on healthy resources (users). Enabling MFA for all 5 subscription owners satisfies that group (5/5 of a 5-point contribution = 5 points). Enabling MFA for 5 of the 10 Azure resource owners satisfies half of that group (5/10 of a 5-point contribution = 2.5 points). Total increase = 5 + 2.5 = 7.5 points.
Question 47
HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
NSG1 and NSG2 both have default rules only.
The subscription contains the virtual machines shown in the following table.
The subscription contains the web apps shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: Premium App Service VNet Integration provides outbound access to integrated and peered VNets, so WebApp1 can reach VM2. VNet Integration does not route inbound traffic to the web app through the subnet NSG, so NSG1 does not control inbound traffic to WebApp1. An Isolated App Service Environment is deployed inside the VNet, so WebApp2 can communicate with VM1 across the peered VNets, and default NSG rules allow it.
Question 48
HOTSPOT
-
You are implementing an Azure Application Gateway web application firewall (WAF) named WAF1.
You have the following Bicep code snippet.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: The WAF policy is in Detection mode, so matching custom and managed rules are logged rather than blocked. The custom rule would match IPs outside 10.10.10.0/24 due to negation, but the request is still allowed. OWASP managed rules detect but do not block path attacks in Detection mode. The 128 KB setting is the request body inspection size, not the file upload limit; a 50 MB upload is allowed within Application Gateway upload limits.
Question 49
DRAG DROP
-
You have an Azure subscription.
You create an Azure Firewall policy that has the rules shown in the following table.
In which order should the rules be processed? To answer, move all rules from the list of rules to the answer area and arrange them in the correct order.
Explanation: Azure Firewall processes rule collection types in the order: NAT, then Network, then Application. Within each type, lower priority numbers are processed first.
Question 50
You have an Azure AD tenant.
You need to ensure that users cannot create passwords containing a variation of the word contoso.
What should you configure?
A. Microsoft Entra Verified ID
B. Microsoft Entra Identity Governance
C. Azure AD Privileged Identity Management (PIM)
D. Azure AD Password Protection
E. Azure AD Identity Protection
Show Answer
Correct Answer: D
Explanation: Microsoft Entra (Azure AD) Password Protection supports custom banned password lists and automatically blocks variations of banned terms. Adding 'contoso' to the custom banned password list prevents users from creating passwords containing that word or common variants.
Question 53
DRAG DROP
-
You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table.
The storage3 storage account is encrypted by using customer-managed keys.
You need to enable Microsoft Defender for Storage to meet the following requirements:
• The storage1 and storage2 accounts must be included in the Defender for Storage protections.
• The storage3 account must be excluded from the Defender for Storage protections.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area.
Show Answer
Correct Answer: 1. Enable the Defender for Storage plan for Sub1.
2. For storage3, assign the AzDefenderPlanAutoEnable tag and set the value to Off.
3. Disable Defender for Storage for storage3.
Explanation: Enable the plan at the subscription scope so all storage accounts are protected by default. Exclude storage3 by applying the opt-out tag, then disable Defender on that storage account. Customer-managed keys do not need to be removed.
Question 54
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a single subnet. The subscription contains a virtual machine named VM1 that is connected to VNet1.
You plan to deploy an Azure SQL managed instance named SQL1.
You need to ensure that VM1 can access SQL1.
Which three components should you create? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. a subnet
B. a network security perimeter
C. a virtual network gateway
D. a network security group (NSG)
E. a route table
Show Answer
Correct Answer: A, D, E
Explanation: Azure SQL Managed Instance must be deployed into its own dedicated delegated subnet within a virtual network. That subnet requires an associated Network Security Group (NSG) and a route table to satisfy managed instance networking requirements. Because VM1 is already connected to the same virtual network, no virtual network gateway is required for connectivity, and a network security perimeter is not a deployment requirement for Azure SQL Managed Instance.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
