You have an Azure subscription that contains an Azure web app named App1 and a virtual machine named VM1. VM1 runs Microsoft SQL Server and is connected to a virtual network named VNet1. App1, VM1, and VNet1 are in the US Central Azure region.
You need to ensure that App1 can connect to VM1. The solution must minimize costs.
What should you include in the solution?
A. regional virtual network integration
B. gateway-required virtual network integration
C. Azure Front Door
D. Azure Application Gateway integration
E. NAT gateway integration
Show Answer
Correct Answer: A
Explanation: App1 needs outbound connectivity to VM1 within the same Azure region while minimizing cost. Regional virtual network integration enables an Azure App Service to access resources in a VNet in the same region without requiring a VNet gateway or App Service Environment, making it the most cost-effective option. Other options add unnecessary components or are intended for different use cases.
Question 66
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy an Azure Private Link service named APL1.
Which resource should you reference during the creation of APL1.
A. LB1
B. SQL1
C. VMSS1
D. VM1
Show Answer
Correct Answer: A
Explanation: An Azure Private Link service represents your own service that you want to expose privately to consumers. It must be fronted by an Azure Standard Load Balancer. During creation of a Private Link service, you reference the frontend IP configuration of that Standard Load Balancer, not individual VMs, VM scale sets, or PaaS resources like Azure SQL.
Question 67
You have an Azure AD tenant.
You plan to implement an authentication solution to meet the following requirements:
• Require number matching.
• Display the geographical location when signing in.
Which authentication method should you include in the solution?
A. Microsoft Authenticator
B. FIDO2 security key
C. SMS
D. Temporary Access Pass
Show Answer
Correct Answer: A
Explanation: Microsoft Authenticator supports number matching for MFA push notifications and can display additional sign-in context, including the geographical location of the sign-in attempt. The other options do not provide both number matching and location display.
Question 68
You have an Azure subscription linked to an Azure AD tenant named contoso.com. Contoso.com contains a user named User1 and an Azure web app named App1.
You plan to enable User1 to perform the following tasks:
• Configure contoso.com to use Microsoft Entra Verified ID.
• Register App1 in contoso.com.
You need to identify which roles to assign to User1. The solution must use the principle of least privilege.
Which two roles should you identify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Authentication Policy Administrator
B. Authentication Administrator
C. Cloud App Security Administrator
D. Application Administrator
E. User Administrator
Show Answer
Correct Answer: A, D
Explanation: To configure a tenant for Microsoft Entra Verified ID, the minimum required directory role is Authentication Policy Administrator (or Global Administrator). To register an application and grant admin consent without global admin rights, the least-privileged role is Application Administrator. Together, these roles allow both tasks while adhering to the principle of least privilege.
Question 69
You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM).
A user named User1 is eligible for the Billing administrator role.
You need to ensure that the role can only be used for a maximum of two hours.
What should you do?
A. Create a new access review.
B. Edit the role assignment settings.
C. Update the end date of the user assignment.
D. Edit the role activation settings.
Show Answer
Correct Answer: D
Explanation: User1 is eligible for the Billing administrator role, which means the role is activated on demand through Azure AD PIM. The maximum amount of time the role can be used is controlled by the role activation settings, specifically the Activation maximum duration. Editing role assignment settings or end dates affects assignment lifespan, not how long an activation session can last. Therefore, to limit usage to two hours, you must edit the role activation settings.
Question 70
You have an Azure subscription that contains a storage account and an Azure web app named App1.
App1 connects to an Azure Cosmos DB database named Cosmos1 that uses a private endpoint named Endpoint1. Endpoint1 has the default settings.
You need to validate the name resolution to Cosmos1.
Which DNS zone should you use?
A. endpoint1.privatelink.documents.azure.com
B. endpoint1.privatelink.blob.core.windows.net
C. endpoint1.privatelink.azurewebsites.net
D. endpoint1.privatelink.database.azure.com
Show Answer
Correct Answer: A
Explanation: Azure Cosmos DB private endpoints use the default private DNS zone privatelink.documents.azure.com for name resolution. To validate name resolution to Cosmos1 through its private endpoint, you must query this DNS zone. The other zones correspond to Blob Storage, App Service, or Azure SQL/other databases, not Cosmos DB.
Question 71
You have an Azure subscription that contains an Azure Blob storage account named blob1.
You need to configure attribute-based access control (ABAC) for blob1.
Which attributes can you use in access conditions?
A. blob index tags only
B. blob index tags and container names only
C. file extensions and container names only
D. blob index tags, file extensions, and container names
Show Answer
Correct Answer: B
Explanation: Azure ABAC for Blob Storage supports access conditions based on specific resource attributes. For blobs, the relevant supported attributes in this context are blob index tags and container names. File extensions are not a first-class ABAC attribute (they could only be inferred indirectly via blob path, which is not listed in the options). Therefore, the correct choice is blob index tags and container names only.
Question 72
DRAG DROP
-
You have an Azure subscription.
You plan to implement Azure DDoS Protection. The solution must meet the following requirements:
• Provide access to DDoS rapid response support during active attacks.
• Protect Basic SKU public IP addresses.
You need to recommend which type of DDoS Protection to use for each requirement.
What should you recommend? To answer, drag the appropriate DDoS Protection types to the correct requirements. Each DDoS Protection type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Provide access to DDoS rapid response support during active attacks:
DDoS Network Protection
Protect Basic SKU public IP addresses:
DDoS IP Protection
Explanation: DDoS Network Protection includes value‑added services such as DDoS rapid response support during active attacks. DDoS IP Protection is designed to protect individual public IP addresses, including Basic SKU public IPs, whereas DDoS Network Protection requires Standard SKU public IP resources.
Question 73
DRAG DROP
-
You have an on-premises datacenter.
You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is connected to the on-premises datacenter by using a Site-to-Site (S2S) VPN.
You plan to create an Azure storage account named storage1 and deploy an Azure web app named App1.
You need to ensure that network communication to each resource meets the following requirements:
• Connections to App1 must be allowed only from corporate network NAT addresses.
• Connections from VNet1 to storage1 must use the Microsoft backbone network.
• The solution must minimize costs.
What should you configure for each resource? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: storage1:
A service endpoint
App1:
An access restriction rule
Explanation: Storage1: A service endpoint ensures traffic from VNet1 to Azure Storage stays on the Microsoft backbone with no additional cost.
App1: Access restriction rules allow inbound access only from specified corporate NAT IP addresses and are cost-free, meeting the requirement while minimizing cost.
Question 74
You have an Azure subscription.
You need to deploy an Azure virtual WAN to meet the following requirements:
• Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.
• Ensure that security rules sync between the regions.
What should you use?
A. Azure Virtual Network Manager
B. Azure Front Door
C. Azure Network Function Manager
D. Azure Firewall Manager
Show Answer
Correct Answer: D
Explanation: Azure Firewall Manager is used to create and manage secured virtual hubs (Azure Virtual WAN hubs with Azure Firewall) and to centrally apply and synchronize firewall policies across multiple regions. This directly meets the requirement to deploy secured virtual hubs in East US, West US, and North Europe with synchronized security rules. Azure Virtual Network Manager focuses on topology and NSG governance, not secured Virtual WAN hubs.
$19
Get all 440 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
