You have an Azure subscription that contains an Azure Automation account named Automation1 and an Azure key vault named Vault1. Vault1 contains a secret named Secret1.
You enable a system-assigned managed identity for Automation1.
You need to ensure that Automation1 can read the contents of Secret1. The solution must meet the following requirements:
• Prevent Automation1 from accessing other secrets stored in Vault1.
• Follow the principle of least privilege.
What should you do?
A. From Vault1, configure the Access control (IAM) settings.
B. From Automation1, configure the Identity settings.
C. From Automation1, configure the Run as accounts settings.
D. From Secret1, configure the Access control (IAM) settings.
Show Answer
Correct Answer: D
Explanation: With Azure Key Vault using the Azure RBAC permission model, RBAC roles can be assigned at the individual secret scope. Grant the Automation account's system-assigned managed identity a secret reader role on Secret1 itself. This limits access to only that secret and satisfies least privilege. Configuring IAM at the vault scope would grant broader access than required, and the other options do not assign the necessary Key Vault data access.
Question 176
HOTSPOT
-
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named fabrikam.com. The domain contains an Active Directory Federation Services (AD FS) instance and a member server named Server1 that runs Windows Server. The domain contains the users shown in the following table.
You have a Microsoft Entra tenant named contoso.com that is linked to a Microsoft 365 subscription.
You establish federation between fabrikam.com and contoso.com by using a Microsoft Entra Connect instance that is configured as shown in the following exhibit.
You perform the following tasks in contoso.com:
• Create a group named Group1.
• Disable User2.
• Enable User3.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: User objects are synchronized from on-prem AD, but group writeback is not enabled. A cloud group can include synced users. Disabling or enabling synced users in Microsoft Entra ID does not change the authoritative on-prem AD account state, so User2 can still sign in to the on-prem server, while User3 remains disabled on-prem and cannot authenticate to Microsoft 365 in a federated setup.
Question 177
Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a certification authority (CA) named CA1.
You have an Azure AD tenant.
You need to implement certificate-based authentication in Azure AD. The solution must ensure that users can sign in by using certificates issued by CA1. What should you do first?
A. Deploy an Azure key vault.
B. Add CA1 as a Certificate Authority to the Microsoft Entra ID tenant.
C. Enable auto-enrollment for CA1.
D. Deploy Windows Hello for Business.
Show Answer
Correct Answer: B
Explanation: The first prerequisite for Microsoft Entra certificate-based authentication is to configure and upload the trusted certification authority (root and any intermediate CAs) to the Microsoft Entra ID tenant. This establishes trust for certificates issued by the on-premises CA. Auto-enrollment, Windows Hello for Business, and Azure Key Vault are not the initial requirement for enabling Entra certificate-based authentication.
Question 178
HOTSPOT -
You have a Microsoft Entra tenant that has a Microsoft Entra ID P2 service plan. The tenant contains the users shown in the following table.
You have the Device settings shown in the following exhibit.
User1 has the devices shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise. select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: The 5-device limit counts both Microsoft Entra joined and registered devices, and User1 already has 4 devices, so only one more can be added. A Cloud Device Administrator can manage device settings including the MFA requirement for join/registration. The local administrator role applies only to Microsoft Entra joined Windows devices, while Device3 is only Microsoft Entra registered.
Question 181
HOTSPOT
-
You have a Microsoft Entra tenant that contains multiple storage accounts.
You plan to deploy multiple Azure App Service apps that will require access to the storage accounts.
You need to recommend an identity solution to provide the apps with access to the storage accounts. The solution must minimize administrative effort.
Which type of identity should you recommend, and what should you recommend using to control access to the storage accounts? To answer, select the appropriate options in the answer area.
Show Answer
Correct Answer: Identity type: User-assigned managed identity
To control access: Role-based access control (RBAC)
Explanation: A user-assigned managed identity can be shared across multiple App Service apps, reducing the number of identities and role assignments to manage. Grant the identity Azure RBAC roles on the storage accounts for secure, centralized access control.
Question 182
You have an Azure subscription that contains a user named User1 and two resource groups named RG1 and RG2.
You need to ensure that User1 can perform the following tasks:
• View all resources.
• Restart virtual machines.
• Create virtual machines in RG1 only.
• Create storage accounts in RG1 only.
What is the minimum number of role-based access control (RBAC) role assignments required?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: The minimum number of RBAC role assignments is 2 if custom roles are allowed. Create one custom role scoped at the subscription that grants read access to all resources and the ability to restart virtual machines, and a second custom role scoped to RG1 that grants permission to create virtual machines and storage accounts. This satisfies all requirements with only two assignments. If restricted to built-in roles, more assignments would be needed, but the question asks for the minimum and does not restrict role definitions.
Question 183
You have an Azure subscription named Sub1 that contains a user named User1.
You need to ensure that User1 can purchase a Microsoft Entra Permissions Management license for Sub1. The solution must follow the principle of least privilege.
Which role should you assign to User1?
A. Global Administrator
B. Billing Administrator
C. Permissions Management Administrator
D. User Access Administrator
Show Answer
Correct Answer: B
Explanation: To purchase or activate a Microsoft Entra Permissions Management license, the least-privileged Microsoft Entra role is Billing Administrator. Global Administrator is required for subsequent onboarding/configuration tasks, but not for purchasing the license. Permissions Management Administrator manages the service after it exists, and User Access Administrator is an Azure RBAC role unrelated to license purchasing.
Question 184
HOTSPOT
-
You have a Microsoft Entra tenant that contains a group named Group3 and an administrative unit named Department1.
Department1 has the users shown in the Users exhibit. (Click the Users tab.)
Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)
The User Administrator role assignments are shown in the Assignments exhibit (Click the Assignments tab.)
The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Admin1 is a User Administrator scoped only to Department1 administrative unit. Administrative unit scope over groups does not extend user-management rights to the group's members, and Group3 is not in the administrative unit. Admin3 has directory-wide User Administrator rights and can reset User1's password.
Question 185
HOTSPOT -
You have an Azure AD tenant.
You perform the tasks shown in the following table.
On April 5, an administrator deletes App1, App2, App3, and App4.
You need to restore the apps and the settings.
Which apps can you restore on April 16, and which settings can you restore for App4 on April 16? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Apps: App1, App2, App3, and App4
App4 settings: App roles, Users and groups, Client secret, and Self-service
Explanation: Deleted enterprise applications can be restored within the 30-day recovery window along with their associated properties. April 16 is within 30 days of the April 5 deletion, so all four apps and the listed App4 settings can be restored.
Question 186
You have an Azure subscription that contains the users shown in the following table.
You need to implement Azure AD Privileged Identity Management (PIM).
Which users can use PIM to activate their role permissions?
A. Admin1 only
B. Admin2 only
C. Admin3 only
D. Admin1 and Admin2 only
E. Admin2 and Admin3 only
F. Admin1, Admin2, and Admin3
Show Answer
Correct Answer: C
Explanation: Azure AD Privileged Identity Management supports Microsoft Entra (Azure AD) roles and Azure RBAC roles, but it does not manage classic Azure subscription administrator roles such as Account Administrator, Service Administrator, or Co-Administrator. Therefore, only the user assigned a Microsoft Entra role (Admin3) can use PIM to activate role permissions.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
