DRAG DROP
-
You have an Azure subscription that is linked to an Azure AD tenant named contoso.com. The subscription contains a group named Group1 and a virtual machine named VM1.
You need to meet the following requirements:
• Enable a system-assigned managed identity for VM1.
• Add VM1 to Group1.
How should you complete the PowerShell script? To answer, drag the appropriate cmdlets to the correct targets. Each cmdlet may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Get-AzVM
Get-AzADServicePrincipal
Explanation: Retrieve the VM object with Get-AzVM before enabling the system-assigned identity using Update-AzVM. After the identity exists, retrieve its service principal with Get-AzADServicePrincipal and add that service principal to the Azure AD group.
Question 210
HOTSPOT -
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table.
The users have the devices shown in the following table.
You create the following two Conditional Access policies:
• Name: CAPolicy1
• Assignments
o Users or workload identities: Group1
o Cloud apps or actions: Office 365 SharePoint Online
o Conditions
Filter for devices: Exclude filtered devices from the policy
Rule syntax: device.displayName -startsWith “Device”
o Access controls
Grant: Block access
Session: 0 controls selected
o Enable policy: On
• Name: CAPolicy2
• Assignments
o Users or workload identities: Group2
o Cloud apps or actions: Office 365 SharePoint Online
o Conditions: 0 conditions selected
• Access controls
o Grant: Grant access
Require multifactor authentication
o Session: 0 controls selected
• Enable policy: On
All users confirm that they can successfully authenticate using MFA.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
Yes
Explanation: CAPolicy1 blocks Group1 except devices excluded by the filter. Unregistered devices have null device attributes, so the positive 'startsWith' filter does not match and the exclusion is not applied; User1 is blocked. Device2 and Device3 are Entra devices with names starting with 'Device', so they are excluded from CAPolicy1. CAPolicy2 requires MFA for Group2, which succeeds.
Question 211
DRAG DROP -
You have an Azure AD tenant that contains a user named Admin1.
Admin1 uses the Require password change for high-risk users policy template to create a new Conditional Access policy.
Who is included and excluded by default in the policy assignment? To answer, drag the appropriate options to the correct target. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point
Show Answer
Correct Answer: Include: All users
Exclude: Admin1
Explanation: The 'Require password change for high-risk users' Conditional Access template includes all users by default and automatically excludes the current user creating the policy to prevent accidental lockout. Since Admin1 creates the policy, Admin1 is excluded.
Question 212
You have an Azure AD tenant.
You need to implement smart lockout with a lockout threshold of 10 failed sign-ins.
What should you configure in the Azure AD admin center?
A. Authentication strengths
B. Password protection
C. User risk policy
D. Sign-in risk policy
Show Answer
Correct Answer: B
Explanation: Smart lockout settings, including the lockout threshold (such as 10 failed sign-ins), are configured under Microsoft Entra ID (Azure AD) Password protection in the Azure AD admin center. Authentication strengths and risk policies do not manage smart lockout thresholds.
Question 213
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You need to configure access to Vault1. The solution must meet the following requirements:
• Ensure that User1 can manage and create keys in Vault1.
• Ensure that User2 can access a certificate stored in Vault1.
• Use the principle of least privilege.
Which role should you assign to each user? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Managing and creating keys requires the Key Vault Crypto Officer role. Accessing and managing certificates is covered by the Key Vault Certificates Officer role, which is the least-privileged built-in role for certificate operations.
Question 214
You have an Azure AD Premium P2 tenant.
You create a Log Analytics workspace.
You need to ensure that you can view Azure AD audit log information by using Azure Monitor.
What should you do first?
A. Modify the Diagnostics settings for Azure AD.
B. Run the Update-MgOrganization cmdlet.
C. Run the Update-MgDomain cmdlet.
D. Create an Azure AD workbook.
Show Answer
Correct Answer: A
Explanation: To view Azure AD (Microsoft Entra ID) audit logs in Azure Monitor via a Log Analytics workspace, you must first configure Microsoft Entra diagnostic settings to send the audit logs to the Log Analytics workspace. Creating workbooks is done after data is being collected, and the PowerShell cmdlets listed are unrelated to enabling log export.
Question 215
You have an Azure AD tenant that has multi-factor authentication (MFA) enforced and self-service password reset (SSPR) enabled.
You enable combined registration in interrupt mode.
You create a new user named User1.
Which two authentication methods can User1 use to complete the combined registration process? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. a FIDO2 security key
B. a hardware token
C. a one-time passcode email
D. Windows Hello for Business
E. the Microsoft Authenticator app
Show Answer
Correct Answer: C, E
Explanation: In combined registration interrupt mode, users are guided to register Microsoft Authenticator and phone by default, with the option to register email instead. FIDO2 security keys can be added only in Manage mode, not during interrupt-mode registration. Hardware tokens and Windows Hello for Business aren't supported as registration methods in this flow.
Question 216
You have an Azure AD tenant that contains the users shown in the following table.
You enable self-service password reset (SSPR) for all the users and configure SSPR to require security questions as the only authentication method.
Which users must use security questions when resetting their password?
A. User4 only
B. User3 and User4 only
C. User1 and User4 only
D. User1, User3, and User4 only
E. User1, User2, User3, and User4
Show Answer
Correct Answer: B
Explanation: In Microsoft Entra ID SSPR, certain privileged administrator roles (including User Administrator and Password Administrator) are subject to the administrator reset policy and cannot use security questions as the verification method. The Security Reader role is not one of the administrator roles subject to that special reset policy, so it follows the configured SSPR policy. With SSPR configured to require only security questions, the Security Reader and the standard user must use security questions when resetting their passwords.
Question 217
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.
You deploy an Azure subscription and enable Microsoft 365 Defender.
You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.
Solution: From the Microsoft 365 Defender portal, you add the Google Workspace app connector.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Adding the Google Workspace app connector enables Microsoft Defender for Cloud Apps OAuth app management for Google Workspace. OAuth app management becomes available after connecting a supported platform such as Google Workspace, allowing monitoring of OAuth authentication requests for that connected platform. The goal only requires enabling monitoring by using Defender for Cloud Apps, and this solution accomplishes that.
Sources:
https://www.coursehero.com/file/p68s38ce/Question-15-Note-This-question-is-part-of-a-series-of-questions-that-present-the
Question 218
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Amazon Web Services (AWS) account, a Google Workspace subscription, and a GitHub account.
You deploy an Azure subscription and enable Microsoft 365 Defender.
You need to ensure that you can monitor OAuth authentication requests by using Microsoft Defender for Cloud Apps.
Solution: From the Microsoft 365 Defender portal, you add the Amazon Web Services app connector.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: No. Monitoring OAuth app authorizations in Microsoft Defender for Cloud Apps is supported by connecting supported SaaS platforms such as Microsoft 365, Google Workspace, or Salesforce. Adding the AWS app connector enables AWS security and activity integration, but it does not enable OAuth app governance for AWS. To monitor OAuth authentication requests in this scenario, connecting Google Workspace would satisfy that capability.
$19
Get all 387 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
