You have an Azure subscription that is linked to an Azure AD tenant and contains the resources shown in the following table.
Which resources can be assigned the Contributor role for VM1?
A. Managed1 and App1 only
B. Group1 and Managed1 only
C. Group1, Managed1, and VM2 only
D. Group1, Managed1, VM1, and App1 only
Show Answer
Correct Answer: D
Explanation: Azure RBAC role assignments can target security principals: users, groups, service principals (enterprise applications), and managed identities. A VM with a system-assigned managed identity also has a service principal that can receive RBAC assignments. The restriction that dynamic groups cannot be role-assignable applies to Microsoft Entra directory roles, not Azure RBAC roles. VM2 cannot be assigned unless it has a managed identity; the scenario implies only VM1 is relevant as a principal. Therefore Group1, Managed1, VM1, and App1 can all be assigned the Contributor role for VM1.
Sources:
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps
Question 88
SIMULATION
-
You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Azure Storage account → Networking (Firewalls and virtual networks)
Set Public network access to Selected networks
If a VNet with subnet 131.107.0.0/16 exists: add the subnet under Virtual networks.
Otherwise, add IP rule: 131.107.0.0/16.
Save.
Explanation: Restrict storage account access by allowing only the specified network. In typical Azure Storage networking, this is done via Selected networks and either an allowed VNet subnet or an IP network rule, depending on the lab environment.
Question 89
HOTSPOT
-
You have an Azure subscription that contains the virtual machines shown in the following table.
You have an Azure Cosmos DB account named cosmos1 configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
Yes
Explanation: VM1 is on a subnet with an enabled Cosmos DB service endpoint, so traffic uses the Azure backbone rather than the public internet. VM2's subnet does not have the endpoint enabled, but its public IP is allowed by the Cosmos DB firewall. VM3 is outside the allowed VNet list, but its public IP falls within an allowed firewall range, so it can access over the internet.
Question 90
HOTSPOT
-
You have an Azure subscription named Sub1 that contains the resource groups shown in the following table.
You create the Azure Policy definition shown in the following exhibit.
You assign the policy to Sub1.
You plan to create the resources shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
Yes
Explanation: The policy denies when either the resource location differs from its resource group's location or the resource name does not contain 'obj' (case-insensitive). IPobject1 and OBJ3 match their resource group locations and their names contain 'obj'. For a resource group resource, resourceGroup().location isn't applicable, so that condition isn't evaluated, allowing creation.
Question 91
HOTSPOT
-
You have an Azure subscription that contains a user named Admin1 and an Azure key vault named Vault1.
You plan to implement Microsoft Entra Verified ID.
You need to create an access policy to ensure that Admin1 has permissions to Vault1 that support the implementation of the Verified ID service. The solution must use the principle of least privilege.
Which three key permissions should you select? To answer, select the appropriate permissions in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Create
Delete
Sign
Explanation: For Microsoft Entra Verified ID initial configuration, the configuring account needs key permissions to create and delete keys and perform signing operations. This satisfies the required permissions with least privilege.
Question 92
You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains the Azure Policy definitions shown in the following table.
Which definitions can be assigned as a security policy in Defender for Cloud?
A. Policy1 and Policy2 only
B. Initiative1 and Initiative2 only
C. Policy1 and Initiative1 only
D. Policy2 and Initiative2 only
E. Policy1, Policy2, Initiative1, and Initiative2
Show Answer
Correct Answer: B
Explanation: Microsoft Defender for Cloud security policies are assigned as Azure Policy initiatives (initiative definitions), not individual policy definitions. Custom security policies exposed in Defender for Cloud are custom initiatives that can contain one or more policy definitions.
Question 93
You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud.
You have the management group hierarchy shown in the following exhibit.
You create the definitions shown in the following table.
You need to use Defender for Cloud to add a security policy.
Which definitions can you use as a security policy?
A. Policy1 only
B. Policy1 and Initiative1 only
C. Initiative1 and Initiative2 only
D. Initiative1, Initiative2, and Initiative3 only
E. Policy1, Initiative1, Initiative2, and Initiative3
Show Answer
Correct Answer: C
Explanation: Microsoft Defender for Cloud security policies are assigned as Azure Policy initiatives rather than individual policy definitions. Therefore, Policy1 cannot be used directly. Initiative1 and Initiative2 are valid initiatives that can be used for the subscription. Initiative3 is defined under a different management group branch and is not applicable to Sub1 if MG1 is a sibling rather than an ancestor of Sub1.
Sources:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/policy-reference
Question 95
You have an Azure subscription that contains an Azure SQL server named SQL1. SQL1 contains an Azure SQL database named DB1.
You need to use Microsoft Defender for Cloud to complete a vulnerability assessment for DB1.
What should you do first?
A. From Advanced Threat Protection types, select SQL injection vulnerability.
B. Configure the Send scan report to setting.
C. Set Periodic recurring scans to ON.
D. Enable the Microsoft Defender for SQL plan.
Show Answer
Correct Answer: D
Explanation: To use Microsoft Defender for Cloud to perform a vulnerability assessment on an Azure SQL Database, the prerequisite is that the Microsoft Defender for SQL plan is enabled on the subscription/server. Only after enabling the plan can you configure vulnerability assessment settings such as recurring scans and email reports. The other options are configuration steps performed after Defender for SQL is enabled.
Question 96
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
SQL1 has the following configurations:
• Auditing: Enabled
• Audit log destination: storage1, Workspace1
DB1 has the following configurations:
• Auditing: Enabled
• Audit log destination: storage2
DB2 has auditing disabled.
Where are the audit logs for DB1 and DB2 stored? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: DB1: storage1, storage2, and Workspace1
DB2: storage1 and Workspace1
Explanation: Server-level auditing applies to all databases on the server. Database-level auditing runs in parallel and does not override server-level auditing. Therefore DB1 writes to both its own destination and the server destinations, while DB2 inherits only the server-level destinations.
Question 97
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You create a shared access token as shown in the following exhibit.
Which resources can you access by using the shared access token and Key1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Shared access token: container1 only
Key1: container1 and share1 only
Explanation: A container-level SAS grants access only to the specific container it was created for. The storage account access key (Key1) grants access to all services within that storage account (contoso2023), including both the blob container and the file share, but not resources in a different storage account.
$19
Get all 437 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
