You have an Azure AD tenant.
You plan to implement an authentication solution to meet the following requirements:
• Require number matching.
• Display the geographical location when signing in.
Which authentication method should you include in the solution?
A. Microsoft Authenticator
B. FIDO2 security key
C. SMS
D. Temporary Access Pass
Show Answer
Correct Answer: A
Explanation: Microsoft Authenticator supports Microsoft Entra ID MFA features including number matching and additional context in approval prompts, such as the geographic location of the sign-in attempt. FIDO2 security keys, SMS, and Temporary Access Pass do not provide both of these capabilities.
Question 68
You have an Azure subscription linked to an Azure AD tenant named contoso.com. Contoso.com contains a user named User1 and an Azure web app named App1.
You plan to enable User1 to perform the following tasks:
• Configure contoso.com to use Microsoft Entra Verified ID.
• Register App1 in contoso.com.
You need to identify which roles to assign to User1. The solution must use the principle of least privilege.
Which two roles should you identify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Authentication Policy Administrator
B. Authentication Administrator
C. Cloud App Security Administrator
D. Application Administrator
E. User Administrator
Show Answer
Correct Answer: A, D
Explanation: Configuring Microsoft Entra Verified ID requires either Global Administrator or Authentication Policy Administrator permissions. If the user is not a Global Administrator, Application Administrator is needed to complete the required app registration and grant admin consent. Registering an application is also covered by the Application Administrator role, making these the least-privileged roles for the required tasks.
Question 69
You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM).
A user named User1 is eligible for the Billing administrator role.
You need to ensure that the role can only be used for a maximum of two hours.
What should you do?
A. Create a new access review.
B. Edit the role assignment settings.
C. Update the end date of the user assignment.
D. Edit the role activation settings.
Show Answer
Correct Answer: D
Explanation: For eligible Microsoft Entra (Azure AD) PIM role assignments, the maximum time a user can use a role after activating it is controlled by the role activation settings (Activation maximum duration). Editing role assignment settings affects assignment properties such as eligibility or assignment duration, not the per-activation maximum usage time. Access reviews and assignment end dates do not limit each activation session.
Question 70
You have an Azure subscription that contains a storage account and an Azure web app named App1.
App1 connects to an Azure Cosmos DB database named Cosmos1 that uses a private endpoint named Endpoint1. Endpoint1 has the default settings.
You need to validate the name resolution to Cosmos1.
Which DNS zone should you use?
A. endpoint1.privatelink.documents.azure.com
B. endpoint1.privatelink.blob.core.windows.net
C. endpoint1.privatelink.azurewebsites.net
D. endpoint1.privatelink.database.azure.com
Show Answer
Correct Answer: A
Explanation: Azure Cosmos DB private endpoints use the Private Link DNS zone privatelink.documents.azure.com for the SQL (Core) API endpoint. To validate name resolution for Cosmos1 through its private endpoint, use the corresponding private DNS zone. The other options correspond to Azure Blob Storage, Azure App Service, or an incorrect domain.
Question 71
You have an Azure subscription that contains an Azure Blob storage account named blob1.
You need to configure attribute-based access control (ABAC) for blob1.
Which attributes can you use in access conditions?
A. blob index tags only
B. blob index tags and container names only
C. file extensions and container names only
D. blob index tags, file extensions, and container names
Show Answer
Correct Answer: B
Explanation: Azure Blob Storage ABAC access conditions support resource attributes such as blob index tags and container name. File extension is not a supported ABAC attribute (though blob path can be used in some conditions, it is distinct from file extension). Therefore the only correct option is blob index tags and container names.
Question 72
DRAG DROP
-
You have an Azure subscription.
You plan to implement Azure DDoS Protection. The solution must meet the following requirements:
• Provide access to DDoS rapid response support during active attacks.
• Protect Basic SKU public IP addresses.
You need to recommend which type of DDoS Protection to use for each requirement.
What should you recommend? To answer, drag the appropriate DDoS Protection types to the correct requirements. Each DDoS Protection type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Provide access to DDoS rapid response support during active attacks: DDoS Network Protection
Protect Basic SKU public IP addresses: DDoS Network Protection
Explanation: DDoS Network Protection includes DDoS Rapid Response (DRR) support and supports protection for Basic SKU public IPs. DDoS IP Protection is intended for Standard SKU public IP resources and doesn't support Basic SKU public IP addresses.
Question 73
DRAG DROP
-
You have an on-premises datacenter.
You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is connected to the on-premises datacenter by using a Site-to-Site (S2S) VPN.
You plan to create an Azure storage account named storage1 and deploy an Azure web app named App1.
You need to ensure that network communication to each resource meets the following requirements:
• Connections to App1 must be allowed only from corporate network NAT addresses.
• Connections from VNet1 to storage1 must use the Microsoft backbone network.
• The solution must minimize costs.
What should you configure for each resource? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: storage1: A service endpoint
App1: An access restriction rule
Explanation: Service Endpoints route Azure Storage traffic from the VNet over the Microsoft backbone at no additional cost, satisfying the connectivity and cost requirements. App Service Access Restrictions allow only the corporate NAT public IP addresses to reach the web app, which meets the inbound access requirement without requiring Private Link.
Question 74
You have an Azure subscription.
You need to deploy an Azure virtual WAN to meet the following requirements:
• Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.
• Ensure that security rules sync between the regions.
What should you use?
A. Azure Virtual Network Manager
B. Azure Front Door
C. Azure Network Function Manager
D. Azure Firewall Manager
Show Answer
Correct Answer: D
Explanation: Azure Firewall Manager is the service used to deploy and manage secured virtual hubs in Azure Virtual WAN. It provides centralized Azure Firewall Policy management, allowing the same firewall/security rules to be applied and synchronized across secured virtual hubs in multiple Azure regions. Azure Virtual Network Manager manages network topology and security admin rules for VNets, but it is not the service for secured Virtual WAN hubs.
Question 75
You have an Azure subscription that contains the subnets shown in the following table.
The subscription contains an Azure web app named WebApp1 that has the following configurations:
• Region: West US
• Virtual network: VNet1
• VNet integration: Enabled
• Outbound subnet: Subnet11
• Windows plan (West US): ASP1
You plan to deploy an Azure web app named WebApp2 that will have the following settings:
• Region: West US
• VNet integration: Enabled
• Windows plan (West US): ASP1
To which subnets can you integrate WebApp2?
A. Subnet11 only
B. Subnet12 only
C. Subnet11 or Subnet12 only
D. Subnet12 or Subnet21 only
E. Subnet11, Subnet12, or Subnet21
Show Answer
Correct Answer: E
Explanation: Current Azure App Service VNet Integration allows multiple apps in the same App Service plan to integrate with the same subnet, and an app can integrate with a subnet in another VNet in the same region. Therefore WebApp2 can use Subnet11, Subnet12, or Subnet21. Earlier documentation and exam content reflected older limitations, but current platform behavior permits this.
Question 76
You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1.
You review the Attack Surface Summary dashboard.
You need to identify the following insights:
• Deprecated technologies that are no longer supported
• Infrastructure that will soon expire
Which section of the dashboard should you review?
A. Securing the Cloud
B. Sensitive Services
C. Attack Surface Priorities
D. attack surface composition
Show Answer
Correct Answer: C
Explanation: The Attack Surface Priorities section highlights high-priority risks and exposures, including deprecated or unsupported technologies and infrastructure approaching expiration, helping organizations prioritize remediation based on risk.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
