HOTSPOT
-
You have an Azure subscription named Sub1 that contains a storage account named storage1.
You need to deploy two apps named App1 and App2 that will have the following configurations:
• App1 will be deployed as a registered app in Sub1.
• App1 will access storage1 by using Microsoft Entra authentication.
• App2 will access storage1 by using a single Microsoft Entra identity.
• App2 be hosted on two new virtual machines named VM1 and VM2.
The solution must minimize administrative effort.
Which type of identity will each app use to access storage1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: App1: Service principal
App2: User-assigned managed identity
Explanation: A registered application authenticates to Azure resources through its service principal. App2 runs on two VMs but must use one shared Microsoft Entra identity, so a user-assigned managed identity can be attached to both VMs, unlike a system-assigned managed identity which is unique to each VM.
Question 163
You have a Microsoft 365 subscription.
You plan to deploy an app named App1 that will have the following configurations:
• Will be registered in Microsoft Entra
• Will access the signed-in user's Microsoft Outlook calendar by using the Microsoft Graph API
You need to ensure that App1 can access Microsoft Graph.
What should you use?
A. application permissions
B. delegated permissions
C. a custom role-based access control (RBAC) role
D. a built-in role-based access control (RBAC) role
Show Answer
Correct Answer: B
Explanation: Because the app will access the signed-in user's Outlook calendar through Microsoft Graph, it must act on behalf of that user. This requires delegated permissions. Application permissions are for app-only access without a signed-in user, while RBAC roles do not grant Microsoft Graph API permissions.
Question 164
You have a Microsoft 365 E5 subscription that contains a user named User1. User1 is eligible for the Application Administrator role.
User1 needs to configure a new connector group for an application proxy.
What should you use to activate the role for User1?
A. the Microsoft 365 Defender portal
B. the Microsoft 365 admin center
C. the Microsoft Intune admin center
D. the Azure Active Directory admin center
Show Answer
Correct Answer: D
Explanation: The correct choice is D. An eligible Microsoft Entra (formerly Azure AD) role such as Application Administrator is activated through Microsoft Entra Privileged Identity Management (PIM), which is accessed in the Azure Active Directory (now Microsoft Entra) admin center. The connector group task is unrelated to the activation mechanism.
Question 165
You have a Microsoft 365 tenant.
In Microsoft Entra ID, you configure the terms of use.
You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access.
What should you configure?
A. Terms and conditions in Microsoft Intune
B. an access policy in Microsoft Defender for Cloud Apps
C. a conditional access policy in Microsoft Entra ID
D. a compliance policy in Microsoft Intune
Show Answer
Correct Answer: C
Explanation: Microsoft Entra ID Terms of Use are enforced through Conditional Access. You create a Conditional Access policy that requires users to accept the configured Terms of Use before they can access selected cloud apps or resources. Users who do not accept are denied access. Intune terms and conditions and compliance policies do not enforce Entra Terms of Use for tenant resource access, and Defender for Cloud Apps access policies are not the mechanism for enforcing Terms of Use acceptance.
Question 166
You have an Azure subscription that contains a storage account named storage1 and a web app named WebApp1. WebApp1 uses a system-assigned managed identity.
You need to ensure that WebApp1 can read and write files to storage1 by using the system-assigned managed identity.
What should you configure for storage1 in the Azure portal?
A. data protection
B. a shared access signature (SAS)
C. the Access control (IAM) settings
D. the File share settings
E. access keys
Show Answer
Correct Answer: C
Explanation: A system-assigned managed identity accesses Azure Storage through Microsoft Entra ID and Azure RBAC. You grant the managed identity the appropriate storage data role (for example, Storage Blob Data Contributor or Storage File Data SMB Share Contributor, depending on the service) by configuring the storage account's Access control (IAM) settings. SAS tokens and access keys are shared-secret mechanisms and are not used with managed identities, while data protection and file share settings do not grant identity permissions.
Question 167
You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft 365 group named Group1.
You need to ensure that the members of Group1 can access Site1 for 90 days. The solution must minimize administrative effort.
What should you use?
A. an access package
B. an access review
C. a lifecycle workflow
D. a Conditional Access policy
Show Answer
Correct Answer: A
Explanation: An access package in Microsoft Entra ID Governance (Entitlement Management) can grant users access to resources such as Microsoft 365 groups and SharePoint Online sites for a defined duration, such as 90 days, with automatic expiration and removal of access. This minimizes administrative effort. Access reviews only validate existing access, lifecycle workflows manage user lifecycle events, and Conditional Access controls sign-in conditions rather than time-limited resource assignment.
Question 169
DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
The subscription uses Privileged Identity Management (PIM).
You need to configure the following access controls by using PIM:
• Ensure that User1 can read and update Secret1.
• Ensure that User2 can read the contents of the secrets stored in Vault2.
The solution must follow the principle of least privilege.
Which authorization method should you use for each user? To answer, drag the appropriate authorization methods to the correct users. Each authorization method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: The Key Vault Secrets Officer RBAC role
User2: The Key Vault Secrets User RBAC role
Explanation: Because the subscription uses Privileged Identity Management (PIM), Azure RBAC eligible role assignments are the appropriate authorization method rather than legacy Key Vault access policies. Secrets Officer allows reading and updating secrets, while Secrets User allows reading secret contents with least privilege among the available roles.
Question 172
You have three Azure subscriptions that are linked to a single Microsoft Entra tenant.
You need to evaluate and remediate the risks associated with highly privileged accounts. The solution must minimize administrative effort.
What should you use?
A. Global Secure Access
B. Privileged Identity Management (PIM)
C. Microsoft Entra Permissions Management
D. Microsoft Entra Verified ID
Show Answer
Correct Answer: B
Explanation: Microsoft Entra Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to evaluate, manage, and remediate risks associated with highly privileged accounts and role assignments. It provides just-in-time activation, approval workflows, access reviews, alerts, and monitoring for privileged roles across Azure subscriptions within the same Microsoft Entra tenant, minimizing ongoing administrative effort. Microsoft Entra Permissions Management focuses on cloud infrastructure entitlement management (CIEM), especially across multicloud environments, rather than lifecycle management of privileged directory and Azure roles. Global Secure Access and Verified ID do not address privileged account risk management.
Question 173
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains an Azure Cosmos DB database named DB1 and an Azure Kubernetes Service (AKS) cluster named AKS1. AKS1 uses a managed identity.
You need to ensure that AKS1 can access DB1. The solution must meet the following requirements:
• Ensure that AKS1 uses the managed identity to access DB1.
• Follow the principle of least privilege.
Which role should you assign to the managed identity of AKS1?
A. For Sub1, assign the Owner role.
B. For DB1, assign the Azure Cosmos DB Account Reader Role role.
C. For RG1, assign the Azure Cosmos DB Data Reader Role role.
D. For RG1, assign the Reader role.
Show Answer
Correct Answer: B
Explanation: The question is about assigning an Azure RBAC role to the managed identity with least privilege. Among the options, Owner and Reader at subscription/resource group scope are either excessive or insufficient. The Azure Cosmos DB Data Reader Role is a data-plane role and is not assigned at the resource group scope as stated in option C. Assigning the Azure Cosmos DB Account Reader Role at the Cosmos DB resource scope (DB1 in the question's wording) is the only valid least-privilege Azure RBAC option presented.
Question 174
You work for a company named Contoso, Ltd. that has a Microsoft Entra tenant named contoso.com.
Contoso is working on a project with the following two partner companies:
• A company named A. Datum Corporation that has a Microsoft Entra tenant named adatum.com.
• A company named Fabrikam, Inc. that has a Microsoft Entra tenant named fabrikam.com.
When you attempt to invite a new guest user from adatum.com to contoso.com, you receive an error message.
You can successfully invite a new guest user from fabnkam.com to contoso.com.
You need to be able to invite new guest users from adatum.com to contoso.com.
What should you configure?
A. Guest invite settings
B. Verifiable credentials
C. Named locations
D. Collaboration restrictions
Show Answer
Correct Answer: D
Explanation: The issue affects invitations from one specific external domain while invitations from another domain succeed. This behavior is controlled by Microsoft Entra External Identities collaboration restrictions, which use allowlists or blocklists for B2B invitation domains. To allow invitations from adatum.com, configure the collaboration restrictions to permit that domain (or remove it from the deny list).
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
