You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a single subnet. The subscription contains a virtual machine named VM1 that is connected to VNet1.
You plan to deploy an Azure SQL managed instance named SQL1.
You need to ensure that VM1 can access SQL1.
Which three components should you create? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. a subnet
B. a network security perimeter
C. a virtual network gateway
D. a network security group (NSG)
E. a route table
Show Answer
Correct Answer: A, D, E
Explanation: Azure SQL Managed Instance must be deployed into its own dedicated subnet that is delegated to Microsoft.Sql/managedInstances. That subnet requires an associated network security group to allow the necessary inbound and outbound traffic. It also requires an associated route table to handle required routing behavior for the managed instance. With these components in place, VM1 in the same virtual network can access SQL1.
Question 55
DRAG DROP
-
You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a resource group named RG1 and an Azure policy named Policy1.
You need to remediate the non-compliant resources in Sub1 based on Policy1.
How should you complete the PowerShell script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: Set-AzContext sets the active subscription to Sub1 so the policy assignment is targeted correctly. Start-AzPolicyRemediation triggers remediation for all non-compliant resources associated with the specified policy assignment, with compliance re-evaluated.
Question 56
You have an Azure subscription that contains an Azure Key Vault Standard key vault named Vault1. Vault1 hosts a 2048-bit RSA key named key1.
You need to ensure that key1 is rotated every 90 days.
What should you do first?
A. Create a key rotation policy.
B. Modify the Access policies settings of Vault1.
C. Upgrade Vault1 to Key Vault Premium.
D. Recreate key1 as an EC key.
Show Answer
Correct Answer: A
Explanation: Azure Key Vault **Standard** supports automated key rotation through **key rotation policies** for RSA keys. To ensure key1 rotates every 90 days, the first required action is to create and configure a rotation policy for that key. No upgrade to Premium is required, access policies are unrelated to rotation scheduling, and changing the key type is unnecessary.
Question 57
You have an Azure subscription.
You plan to deploy Microsoft Defender External Attack Surface Management (Defender EASM) to identify and monitor externally facing assets.
You create a new Defender EASM instance named EASM1.
What should you do next?
A. Create a custom attack surface.
B. Add a Log Analytics workspace.
C. Add a discovery group.
D. Import seeds from an organization.
Show Answer
Correct Answer: C
Explanation: After creating a Defender EASM instance, the next required step is to create a discovery group. Discovery groups define the scope and rules for discovery and act as the container into which seeds (domains, IPs, ASNs, etc.) are added. You cannot import seeds or run discovery until a discovery group exists.
Question 59
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
VNet1 connects to a remote site by using a Site-to-Site (S2S) VPN that uses forced tunneling.
VNet1 contains the subnets shown in the following table.
The SQL subnet contains SQL1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: 1) SQL Managed Instance inbound access isn’t restricted by modifying NSG rules in the same way as VMs, so it’s not a must.
2) With S2S VPN and forced tunneling, enabling a service endpoint on the Default subnet isn’t required to use the Microsoft backbone, and alternatives exist.
3) An App Service Environment can be deployed to the Default subnet, provided the subnet is dedicated and meets ASE requirements.
Question 60
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have an Amazon Web Services (AWS) account.
You need to ensure that when you deploy a new AWS Elastic Compute Cloud (EC2) instance, the Microsoft Defender for Servers agent installs automatically.
What should you configure first?
A. the classic cloud connector
B. the Azure Monitor agent
C. the Log Analytics agent
D. the native cloud connector
Show Answer
Correct Answer: D
Explanation: To automatically deploy the Microsoft Defender for Servers agent on new AWS EC2 instances, you must first onboard the AWS account to Microsoft Defender for Cloud. This is done using the native cloud connector, which is the recommended and current method. The native connector enables Defender for Cloud to integrate with AWS and manage agent deployment and security plans across AWS resources. The other options are agents themselves or legacy approaches and are not the prerequisite configuration step.
Question 61
HOTSPOT
-
You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.
User1 is assigned the following roles for storage1:
• Storage Blob Data Reader
• Storage Table Data Contributor
• Storage File Data SMB Share Reader
In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Show Answer
Correct Answer: Yes
No
No
Explanation: 1) SAS1 allows File service with object permissions including Delete, so files in the file share can be deleted via SAS.
2) When mapping via Azure AD (SMB), RBAC applies; the user only has Storage File Data SMB Share Reader, which does not allow delete.
3) SAS1 does not include the Table service, so it cannot delete rows in table1.
Question 62
You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?
A. the Microsoft 365 Defender portal
B. SQL query editor in Azure
C. Azure Monitor
D. Azure Storage Explorer
Show Answer
Correct Answer: D
Explanation: Azure Storage Analytics logs archived to a storage account are written as files (typically in the $logs container). To retrieve (view or download) those log files, you use Azure Storage Explorer, which provides direct access to blob containers. Azure Monitor is used for collecting, routing, and analyzing telemetry, but the question specifically asks how to retrieve the archived diagnostics logs.
Question 63
You have an Azure subscription that contains a user named User1 and a storage account that hosts a blob container named blob1.
You need to grant User1 access to blob1. The solution must ensure that the access expires after six days.
What should you use?
A. a shared access signature (SAS)
B. role-based access control (RBAC)
C. a shared access policy
D. a managed identity
Show Answer
Correct Answer: A
Explanation: A shared access signature (SAS) allows you to grant time-limited access to a specific Azure Storage resource such as a blob container. SAS tokens support explicit start and expiry times, making it possible to ensure access automatically expires after six days. RBAC assignments do not support automatic expiration in this context, a shared access policy is used to manage SAS tokens but does not itself grant access, and managed identities are for service-to-service authentication, not granting temporary user access.
Question 64
HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
The subscription contains the subnets shown in the following table.
You plan to create an Azure web app named WebApp2 that will have the following configurations:
• Region: East US
• VNet integration: Enabled
• Scale out: Autoscale to up to 10 instances
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Subnet11: No
Subnet12: Yes
Subnet21: No
Explanation: Azure App Service VNet integration requires a dedicated, unused subnet (/28 or larger) in the same region as the web app.
Subnet11 contains a VM, so it cannot be used.
Subnet12 is empty, large enough (/27), and in East US, matching WebApp2.
Subnet21 is in West US, while WebApp2 is in East US, so cross-region integration is not supported.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
