HOTSPOT -
You assign User8 the Owner role for RG4, RG5, and RG6.
In which resource groups can User8 create virtual networks and NSGs by using the Azure portal? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You need to ensure that you can meet the security operations requirements. What should you do first?

A. Turn on Auto Provisioning in Security Center.

B. Integrate Security Center and Microsoft Cloud App Security.

C. Upgrade the pricing tier of Security Center to Standard.

D. Modify the Security Center workspace configuration.

From Microsoft Defender for Cloud, you need to deploy SecPol1.
What should you do first?

A. Enable Microsoft Defender for Cloud.

B. Create an Azure Management group.

C. Create an initiative.

D. Configure continuous export.

HOTSPOT -
You need to configure support for Microsoft Sentinel notebooks to meet the technical requirements.
What is the minimum number of Azure container registries and Azure Machine Learning workspaces required?
Hot Area:
 

HOTSPOT -
Which virtual networks in Sub1 can User9 modify and delete in their current state? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

DRAG DROP -
You need to perform the planned changes for OU2 and User1.
Which tools should you use? To answer, drag the appropriate tools to the correct resources. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
 

You plan to implement JIT VM access.
Which virtual machines will be supported?

A. VM2, VM3, and VM4 only

B. VM1, VM2, VM3, and VM4

C. VM1 and VM3 only

D. VM1 only

HOTSPOT -
You implement the planned changes for ASG1 and ASG2.
In which NSGs can you use ASG1, and the network interfaces of which virtual machines can you assign to ASG2?
Hot Area:
 

You need to encrypt storage1 to meet the technical requirements.
Which key vaults can you use?

A. KeyVault2 and KeyVault3 only

B. KeyVault1 only

C. KeyVault1 and KeyVault3 only

D. KeyVault1, KeyVault2, and KeyVault3

You plan to configure Azure Disk Encryption for VM4.
Which key vault can you use to store the encryption key?

A. KeyVault1

B. KeyVault2

C. KeyVault3

HOTSPOT -
You need to deploy Microsoft Antimalware to meet the platform protection requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You need to ensure that users can access VM0. The solution must meet the platform protection requirements.
What should you do?

A. Move VM0 to Subnet1.

B. On Firewall, configure a network traffic filtering rule.

C. Assign RT1 to AzureFirewallSubnet.

D. On Firewall, configure a DNAT rule.

DRAG DROP -
You need to deploy AKS1 to meet the platform protection requirements.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
Select and Place:
 

HOTSPOT -
You are evaluating the security of VM1, VM2, and VM3 in Sub2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
 
You create a shared access token as shown in the following exhibit.
 
Which resources can you access by using the shared access token and Key1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
 

You need to meet the technical requirements for VNetwork1.
What should you do first?

A. Create a new subnet on VNetwork1.

B. Remove the NSGs from Subnet11 and Subnet13.

C. Associate an NSG to Subnet12.

D. Configure DDoS protection for VNetwork1.

DRAG DROP -
You need to configure SQLDB1 to meet the data and application requirements.
Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
 

HOTSPOT -
You are evaluating the effect of the application security groups on the network communication between the virtual machines in Sub2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You need to create Role1 to meet the platform protection requirements.
How should you complete the role definition of Role1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You are evaluating the security of the network communication between the virtual machines in Sub2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You need to configure WebApp1 to meet the data and application requirements.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Upload a public certificate.

B. Turn on the HTTPS Only protocol setting.

C. Set the Minimum TLS Version protocol setting to 1.2.

D. Change the pricing tier of the App Service plan.

E. Turn on the Incoming client certificates protocol setting.

HOTSPOT -
What is the membership of Group1 and Group2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You need to ensure that User2 can implement PIM.
What should you do first?

A. Assign User2 the Global administrator role.

B. Configure authentication methods for contoso.com.

C. Configure the identity secure score for contoso.com.

D. Enable multi-factor authentication (MFA) for User2.

HOTSPOT -
You need to delegate the creation of RG2 and the management of permissions for RG1.
Which users can perform each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You need to meet the technical requirements for the finance department users.
Which CAPolicy1 settings should you modify?

A. Cloud apps or actions

B. Conditions

C. Grant

D. Session

You have an Azure subscription that contains a storage account and an Azure web app named App1.
App1 connects to an Azure Cosmos DB database named Cosmos1 that uses a private endpoint named Endpoint1. Endpoint1 has the default settings.
You need to validate the name resolution to Cosmos1.
Which DNS zone should you use?

A. endpoint1.privatelink.documents.azure.com

B. endpoint1.privatelink.blob.core.windows.net

C. endpoint1.privatelink.azurewebsites.net

D. endpoint1.privatelink.database.azure.com

You have an Azure subscription that contains an Azure Blob storage account named blob1.
You need to configure attribute-based access control (ABAC) for blob1.
Which attributes can you use in access conditions?

A. blob index tags only

B. blob index tags and container names only

C. file extensions and container names only

D. blob index tags, file extensions, and container names

You are troubleshooting a security issue for an Azure Storage account.
You enable Azure Storage Analytics logs and archive it to a storage account.
What should you use to retrieve the diagnostics logs?

A. Azure Cosmos DB explorer

B. Azure Monitor

C. AzCopy

D. Microsoft Defender for Cloud

HOTSPOT
-
You have an Azure subscription that contains the virtual machines shown in the following table.
 
You have an Azure Cosmos DB account named cosmos1 configured as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

SIMULATION
-
You need to ensure that the rg1lod28681041n1 Azure Storage account is encrypted by using a key stored in the KeyVault28681041 Azure key vault.
To complete this task, sign in to the Azure portal.

HOTSPOT
-
You have an Azure subscription that is linked to an Azure AD tenant and contains the virtual machines shown in the following table.
 
The subnets of the virtual networks have the service endpoints shown in the following table.
 
You create the resources shown in the following table.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

SIMULATION
-
You need to prevent HTTP connections to the rg1lod28681041n1 Azure Storage account.
To complete this task, sign in to the Azure portal.

You have an Azure subscription that contains a web app named App1. App1 provides users with product images and videos. Users access App1 by using a URL of HTTPS://app1.contoso.com.
You deploy two server pools named Pool1 and Pool2. Pool1 hosts product images. Pool2 hosts product videos.
You need to optimize the performance of App1. The solution must meet the following requirements:
•	Minimize the performance impact of TLS connections on Pool1 and Pool2.
•	Route user requests to the server pools based on the requested URL path.
What should you include in the solution?

A. Azure Bastion

B. Azure Front Door

C. Azure Traffic Manager

D. Azure Application Gateway

HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
 
SQL1 has the following configurations:
•	Auditing: Enabled
•	Audit log destination: storage1, Workspace1
DB1 has the following configurations:
•	Auditing: Enabled
•	Audit log destination: storage2
DB2 has auditing disabled.
Where are the audit logs for DB1 and DB2 stored? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1.
VM1 is connected to a virtual network named VNet1 that contains one subnet and uses Azure DNS.
You need to ensure that VM1 connects to storage1 by using a private IP address. The solution must minimize administrative effort.
What should you do?

A. For storage1, disable public network access.

B. On VNet1, create a new subnet.

C. For storage1, create a new private endpoint.

D. Create an Azure Private DNS zone.

You have an Azure subscription that contains an Azure SQL server named SQL1. SQL1 contains an Azure SQL database named DB1.
You need to use Microsoft Defender for Cloud to complete a vulnerability assessment for DB1.
What should you do first?

A. From Advanced Threat Protection types, select SQL injection vulnerability.

B. Configure the Send scan report to setting.

C. Set Periodic recurring scans to ON.

D. Enable the Microsoft Defender for SQL plan.

HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
 
VNet1 contains the subnets shown in the following table.
 
You plan to use the Azure portal to deploy an Azure firewall named AzFW1 to VNet1.
Which resource group and subnet can you use to deploy AzFW1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You need to recommend which virtual machines to use to host App1. The solution must meet the technical requirements for KeyVault1.
Which virtual machines should you use?

A. VM1 only

B. VM1, VM2, VM3, and VM4

C. VM1 and VM2 only

D. VM1, VM2, and VM4 only

HOTSPOT
-
You have an Azure subscription that contains the virtual machines shown in the following table.
 
Subnet1 and Subnet2 have a network security group (NSG). The NSG has an outbound rule that has the following configurations:
•	Port: Any
•	Source: Any
•	Priority: 100
•	Action: Deny
•	Protocol: Any
•	Destination: Storage
The subscription contains a storage account named storage1.
You create a private endpoint named Private1 that has the following settings:
•	Resource type: Microsoft.Storage/storageAccounts
•	Resource: storage1
•	Target sub-resource: blob
•	Virtual network: VNet1
•	Subnet: Subnet1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

HOTSPOT -
You need to ensure that the Azure AD application registration and consent configurations meet the identity and access requirements.
What should you use in the Azure portal? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.
 
You create and assign the Azure policy shown in the following exhibit.
 
What is the flow log status of NSG1 and NSG2 after the Azure policy is assigned?

A. Flow logs will be enabled for NSG1 only.

B. Flow logs will be enabled for NSG2 only.

C. Flow logs will be enabled for NSG1 and NSG2.

D. Flow logs will be disabled for NSG1 and NSG2.

You need to meet the identity and access requirements for Group1.
What should you do?

A. Add a membership rule to Group1.

B. Delete Group1. Create a new group named Group1 that has a group type of Microsoft 365. Add users and devices to the group.

C. Modify the membership rule of Group1.

D. Change the membership type of Group1 to Assigned. Create two groups that have dynamic memberships. Add the new groups to Group1.

You have an Azure subscription that contains an Azure Data Lake Storage account named sa1.
You plan to deploy an app named App1 that will access sa1 and perform operations, including Read, List, Create Directory, and Delete Directory.
You need to ensure that App1 can connect securely to sa1 by using a private endpoint.
What is the minimum number of private endpoints required for sa1?

A. 1

B. 2

C. 3

D. 4

E. 5

You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1.
You have an Azure container registry that stores container images that were deployed by using Azure DevOps Microsoft-hosted agents.
You need to ensure that administrators can access AKS1 only from specific networks. The solution must minimize administrative effort.
What should you configure for AKS1?

A. authorized IP address ranges

B. an Application Gateway Ingress Controller (AGIC)

C. a private endpoint

D. a private cluster

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subscription contains the virtual machines shown in the following table.
 
You have a storage account named contoso2024 that contains the following resources:
•	A container named Container1 that contains a file named File1
•	A file share named Share1 that contains a file named File2
You create a private endpoint for contoso2024 as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

You have an Azure subscription that contains the resources shown in the following table.
 
You plan to deploy an Azure Private Link service named APL1.
Which resource should you reference during the creation of APL1.

A. LB1

B. SQL1

C. VMSS1

D. VM1

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subscription contains the virtual machines shown in the following table.
 
All the virtual machines have only private IP addresses.
You deploy Azure Bastion to VNet1 as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

HOTSPOT
-
You have an Azure Subscription that is connected to an on-premises datacenter and contains the resources shown in the following table.
 
You need to configure virtual network service endpoints for VNet1 and VNet2. The solution must meet the following requirements:
•	The virtual machines that connect to the subnet of VNet1 must access storage1, storage2, and Azure AD by using the Microsoft backbone network.
•	The virtual machines that connect to the subnet of VNet2 must access storage1 and KeyVault1 by using the Microsoft backbone network.
•	The virtual machines must use the Microsoft backbone network to communicate between VNet1 and VNet2.
How many service endpoints should you configure for each virtual network? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

HOTSPOT
-
You have an Azure subscription that contains an Azure firewall named AzFW1. AzFW1 has a firewall policy named FWPolicy1.
You need to add rule collections to FWPolicy1 to meet the following requirements:
•	Allow traffic based on the FQDN of the destination.
•	Allow TCP traffic.
Which types of rule collections should you add for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

SIMULATION
-
You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account.
To complete this task, sign in to the Azure portal.