HOTSPOT
-
You plan to deploy a dynamically scaling, Linux-based Azure Virtual Machine Scale Set that will host jump servers. The jump servers will be used by support staff who connect from personal and kiosk devices via the internet. The subnet of the jump servers will be associated to a network security group (NSG).
You need to design an access solution for the Azure Virtual Machine Scale Set. The solution must meet the following requirements:
• Ensure that each time the support staff connects to a jump server, they must request access to the server.
• Ensure that only authorized support staff can initiate SSH connections to the jump servers.
• Maximize protection against brute-force attacks from internal networks and the internet.
• Ensure that users can only connect to the jump servers from the internet.
• Minimize administrative effort.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Manage NSG rules by using: Just-in-time (JIT) VM access
Only allow SSH connections to the jump servers from: AzureBastionSubnet
Explanation: JIT VM access requires users to request temporary access and dynamically updates NSG rules, reducing brute-force exposure. Azure Bastion lets users connect over HTTPS from the internet while the VM only accepts SSH from the AzureBastionSubnet, preventing direct SSH exposure.
Question 96
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You need to recommend a network security solution for App1. The solution must meet the following requirements:
• Only the virtual machines that are connected to Subnet1 must be able to connect to DB1.
• DB1 must be inaccessible from the internet.
• Costs must be minimized.
What should you include in the recommendation? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: To ensure that only VM1 can access DB1: A private endpoint
To enforce network security restrictions for DB1: Network security groups (NSGs)
Explanation: A private endpoint gives Azure SQL a private IP in the VNet, removing public internet exposure. Applying an NSG to the subnet hosting the private endpoint can restrict access so only the required subnet/VM can reach the database while minimizing cost.
Question 97
HOTSPOT
-
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.
You need to configure WS1 to meet the following requirements:
• Create custom dashboards to visualize the workload of security analysts that use Microsoft Sentinel.
• Enable automated responses for the security alerts generated by Microsoft Sentinel analytics rules.
What should you use for each requirement? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Explanation: Microsoft Sentinel Workbooks provide customizable dashboards and visualizations. Playbooks, built on Azure Logic Apps, automate responses to alerts and incidents triggered by analytics rules.
Question 98
Your company has an Azure subscription that uses Microsoft Defender for Cloud.
The company signs a contract with the United States government.
You need to review the current subscription for NIST 800-53 compliance.
What should you do first?
A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.
B. From Azure Policy, assign a built-in policy definition that has a scope of the subscription.
C. From Defender for Cloud, review the Azure security baseline for audit report.
D. From Defender for Cloud, enable Defender for Cloud plans.
Show Answer
Correct Answer: A
Explanation: To assess NIST 800-53 compliance, the first step is to assign the built-in Azure Policy regulatory compliance initiative for NIST at the subscription scope. Defender for Cloud's Regulatory compliance dashboard uses assigned policy initiatives to evaluate compliance. Assigning a single policy definition is insufficient, reviewing reports alone does not establish NIST assessment, and enabling Defender plans is not the first step for regulatory compliance evaluation.
Question 99
You have a Microsoft 365 tenant named contoso.com.
You need to ensure that users can authenticate only to contoso.com. The solution must meet the following requirements:
• Prevent the users from authenticating to other Microsoft 365 tenants.
• Minimize administrative effort.
What should you use?
A. Microsoft Entra Private Access
B. Microsoft Defender for Endpoint
C. Microsoft Entra Internet Access
D. Microsoft Defender for Cloud Apps
Show Answer
Correct Answer: C
Explanation: Microsoft Entra Internet Access (part of Global Secure Access) supports Universal Tenant Restrictions, which can restrict authentication so users can sign in only to the organization's Microsoft 365 tenant and prevent authentication to other Microsoft 365 tenants. This directly satisfies the requirement while minimizing administrative effort. Microsoft Entra Private Access is for private application access, Defender for Endpoint is endpoint protection, and Defender for Cloud Apps does not provide this tenant authentication restriction capability in the current architecture.
Question 100
HOTSPOT
-
You have on-premises servers and virtual machines that run Windows Server, Red Hat Enterprise Linux (RHEL) 7, or RHEL 8.
You have an Azure subscription. The subscription contains virtual machines that run Windows Server Datacenter: Azure Edition.
You need to recommend a solution to manage operating system updates for the on-premises servers and the virtual machines. The solution must meet the following requirements:
• Enable hotpatching for the Azure virtual machines.
• Enable the on-demand inventory and deployment of updates.
• Enable the deployment of Extended Security Update (ESU) patches to the on-premises servers.
What should you include in the recommendation? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: For update management: Azure Update Manager
On the on-premises operating systems, install: The Azure Connected Machine agent
Explanation: Azure Update Manager supports hotpatching for Windows Server Datacenter: Azure Edition, provides on-demand update assessment and deployment, and works with Azure Arc-enabled servers. Azure Arc (via the Azure Connected Machine agent) is required to manage on-premises servers and deliver ESU patches.
Question 101
HOTSPOT
-
You have an Azure subscription. The subscription contains an Azure Bastion host and 100 virtual machines that run Windows Server 2022. The virtual machines have Microsoft Defender for Servers Plan 2 enabled.
You need to recommend a security solution for the virtual machines that meets the following requirements:
• Administrators must request RDP access to the virtual machines by using the Azure portal.
• Remote Desktop sessions must be limited to a maximum of three hours.
• Agentless scanning must be scheduled to run on each virtual machine.
What should you recommend using? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: To manage RDP access:
Just-in-time (JIT) VM access
To perform agentless scanning:
The Microsoft Defender for Cloud integrated Qualys vulnerability scanner
Explanation: JIT VM access requires administrators to request RDP access through the Azure portal and supports time-limited access windows (such as up to three hours). The integrated Qualys vulnerability scanner in Microsoft Defender for Cloud provides scheduled vulnerability assessment without requiring a permanently installed scanner agent.
Question 102
HOTSPOT
-
You have the Azure subscriptions shown in the following table.
The tenants contain the groups shown in the following table.
You perform the flowing actions:
• Configure multi-user authorization (MUA) for Vault1 by using a resource guard deployed to Sub2.
• Enable all available MUA controls for Vault1.
• In contoso.com, create a Privileged Identity Management (PIM) assignment named Assignment1.
• Configure Assignment1 to enable Group1 to activate the Contributor role for Vault1.
For each of the following statements, select Yes if the statements is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: A Resource Guard can be in a different subscription/tenant than the vault. With MUA enabled for all protected operations, sensitive backup changes require authorization through the Resource Guard, so security administrators approve protected actions such as backup policy changes and disabling soft delete.
Question 103
HOTSPOT
-
You have an Azure subscription that contains 100 virtual machines. The virtual machines are accessed by using Azure Bastion.
You need to recommend a solution to ensure that only specific users in specific locations can access the virtual machines. The solution must meet the following requirements:
• Restrict access to the virtual machines based on an originating IP address or a connection request by using just-in-time (JIT) VM access network-based controls.
• Restrict access to the virtual machines based on role-based access control (RBAC) role assignments by using JIT VM access authorization controls.
Which Microsoft cloud services should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Network controls: Microsoft Defender for Cloud
Authorization controls: Microsoft Entra Privileged Identity Management (PIM)
Explanation: JIT VM access network-based controls are provided by Microsoft Defender for Cloud. JIT authorization controls can integrate with Microsoft Entra Privileged Identity Management (PIM) to enforce RBAC-based just-in-time role activation.
Question 104
HOTSPOT -
You have an Azure subscription.
You plan to deploy a storage account named storage1 that will store confidential data. You will assign tags to the confidential data.
You need to ensure that access to storage1 can be defined by using the assigned tags.
Which authorization mechanism should you enable, and which type of resource should you use to store the data? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Attribute-based access control (ABAC)
Blob
Explanation: Azure ABAC can authorize access based on attributes such as blob index tags. This capability applies to Azure Blob Storage, allowing access decisions using the assigned tags.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
