You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam,
Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the
Microsoft 365 E5 plan.
You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements:
✑ To the manager of the developers, send a monthly email message that lists the access permissions to Application1.
✑ If the manager does not verify an access permission, automatically revoke that permission.
✑ Minimize development effort.
What should you recommend?
A.In Azure Active Directory (Azure AD), create an access review of Application1.Correct
B.Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
C.In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
D.Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.
Explanation
Access reviews in Azure Active Directory enable administrators to verify user access permissions on a regular basis. By setting up an access review for Application1, the manager can receive monthly email notifications listing all access permissions and automatically revoke unverified permissions, meeting the requirements with minimal development effort.
You have an Azure subscription. The subscription has a blob container that contains multiple blobs.
Ten users in the finance department of your company plan to access the blobs during the month of April.
You need to recommend a solution to enable access to the blobs during the month of April only.
Which security solution should you include in the recommendation?
A.shared access signatures (SAS)Correct
B.Conditional Access policies
C.certificates
D.access keys
Explanation
Shared Access Signatures (SAS) provide a secure way to grant limited access to specific resources for a set period, making them ideal for enabling the finance department users to access blobs only during April. SAS tokens can be configured with an expiration date, ensuring that after April, these tokens will no longer grant access.
You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.
You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication.
Some users work remotely and do NOT have VPN access to the on-premises network.
You need to provide the remote users with single sign-on (SSO) access to WebApp1.
Which two features should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A.Azure AD Application ProxyCorrect
B.Azure AD Privileged Identity Management (PIM)
C.Conditional Access policies
D.Azure Arc
E.Azure AD enterprise applicationsCorrect
F.Azure Application Gateway
Explanation
Azure AD Application Proxy (Option A) allows remote users to access on-premises web apps without a VPN by proxying the requests through Azure. Azure AD enterprise applications (Option E) enable configuring single sign-on for WebApp1, allowing seamless authentication via Azure AD credentials.
You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20 guest users.
You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements:
✑ The evaluation must be repeated automatically every three months.
✑ Every member must be able to report whether they need to be in Group1.
✑ Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
✑ Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.
What should you include in the recommendation?
A.Implement Azure AD Identity Protection.
B.Change the Membership type of Group1 to Dynamic User.
C.Create an access review.Correct
D.Implement Azure AD Privileged Identity Management (PIM).
Explanation
An access review on Group1 can recur quarterly, can use self-review so every member (including guests) attests whether they still need membership, and with auto-apply enabled removes members who answer that they do not need access. Setting 'If reviewers don't respond' to 'Remove access' also removes members who do not respond. Identity Protection, dynamic membership and PIM do not provide member self-attestation with automatic removal.
You plan to deploy Azure Databricks to support a machine learning application. Data engineers will mount an Azure Data Lake Storage account to the Databricks file system. Permissions to folders are granted directly to the data engineers.
You need to recommend a design for the planned Databrick deployment. The solution must meet the following requirements:
✑ Ensure that the data engineers can only access folders to which they have permissions.
✑ Minimize development effort.
✑ Minimize costs.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Databricks SKU: Premium. Azure Data Lake Storage credential passthrough is available only on the Premium plan, so Premium is the lowest-cost SKU that meets the access requirement. Cluster configuration: Credential passthrough. With credential passthrough, each data engineer reaches the Data Lake Storage account with their own Microsoft Entra ID identity, so the folder permissions granted to them are enforced and no code or extra configuration is needed. A secret scope or a managed identity would give everyone the same identity and could not enforce per-user folder permissions. MLflow and Photon have nothing to do with access control. Credential passthrough is now a legacy feature that Databricks recommends replacing with Unity Catalog, but it is the right answer for the options given.
You plan to deploy an Azure web app named App1 that will use Azure Active Directory (Azure AD) authentication.
App1 will be accessed from the internet by the users at your company. All the users have computers that run Windows 10 and are joined to Azure AD.
You need to recommend a solution to ensure that the users can connect to App1 without being prompted for authentication and can access App1 only from company-owned computers.
What should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
An Azure AD app registration integrates App1 with Azure AD. Because the users sign in to Azure AD-joined Windows 10 computers, they hold a Primary Refresh Token and get single sign-on to App1 without being prompted. A Conditional Access policy can require a compliant or Microsoft Entra hybrid joined device for App1, which limits access to company-owned computers. A managed identity is for the app's own access to resources, Application Proxy publishes on-premises apps, and Azure Policy, Blueprints, administrative units and Application Gateway do not check the user's device.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic.
Does this meet the goal?
A.Yes
B.NoCorrect
Explanation
Traffic Analytics in Network Watcher processes NSG or virtual network flow logs in aggregated intervals (every 10 or 60 minutes) to visualize traffic patterns, top talkers and blocked or malicious flows across the network. It is a reporting and analytics tool, not a diagnostic that tests whether a specific packet to or from a virtual machine is allowed or denied and which security rule decided it. To identify whether packets are being allowed or denied to the virtual machines, use IP flow verify in Azure Network Watcher. The solution does not meet the goal.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Use Azure Advisor to analyze the network traffic.
Does this meet the goal?
A.Yes
B.NoCorrect
Explanation
Azure Advisor provides recommendations for improving cost, security, reliability, operational excellence and performance in Azure, but it does not analyze network traffic. To identify whether packets are being allowed or denied to the virtual machines, use IP flow verify in Azure Network Watcher. The solution does not meet the goal.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic.
Does this meet the goal?
A.YesCorrect
B.No
Explanation
The solution meets the goal. IP flow verify in Azure Network Watcher takes a 5-tuple (direction, protocol, local IP and port, remote IP and port) for a virtual machine's network interface and reports whether the packet is allowed or denied, together with the network security group rule that allowed or denied it. This is exactly what is needed to diagnose the connectivity issues.
You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux.
You need to use Azure Monitor to design an alerting strategy for security-related events.
Which Azure Monitor Logs tables should you query? To answer, drag the appropriate tables to the correct log types. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Events from the Windows event logs (System, Application, Security via the agent) are collected into the Event table in Azure Monitor Logs, so Windows security-related alerts query Event. Linux system logging events are collected through the syslog daemon into the Syslog table. AzureActivity holds subscription-level control-plane operations and AzureDiagnostics holds Azure resource logs, so neither stores guest OS events.
You are designing a large Azure environment that will contain many subscriptions.
You plan to use Azure Policy as part of a governance solution.
To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A.Azure Active Directory (Azure AD) administrative units
B.Azure Active Directory (Azure AD) tenants
C.subscriptionsCorrect
D.compute resources
E.resource groupsCorrect
F.management groupsCorrect
Explanation
Azure Policy can be assigned at the scope levels of subscriptions (C), resource groups (E), and management groups (F). These scopes allow for varying degrees of control over resources within your Azure environment, from individual resource groups up to multiple subscriptions managed under a single group.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using the Regulatory compliance dashboard in Microsoft Defender for Cloud.
Does this meet the goal?
Explanation
1. Azure AD Application Proxy: enable Application Proxy and install a connector on the on-premises network so App1 can be published securely to the internet. 2. An Azure AD enterprise application: add App1 as an on-premises application for Application Proxy, which creates the enterprise application with its external URL and Azure AD pre-authentication. 3. A Conditional Access policy: target the enterprise application and require MFA so users sign in with their Azure AD account and MFA when they connect to App1.
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
A.Azure Activity LogCorrect
B.Azure Advisor
C.Azure Analysis Services
D.Azure Monitor action groups
Explanation
The Azure Activity Log provides insights into subscription-level events, including when new resources are deployed. By using the Azure Activity Log, you can track all ARM resource deployments and generate a monthly report based on these logs.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic.
Does this meet the goal?
A.Yes
B.NoCorrect
Explanation
The solution does not meet the goal. The Azure Monitor agent and the Dependency agent enable VM insights, which shows performance data and a map of processes and their network connections, but it does not evaluate network security rules to determine whether packets are allowed or denied. To identify whether packets are being allowed or denied to the virtual machines, use IP flow verify in Azure Network Watcher.
You need to design an architecture to capture the creation of users and the assignment of roles. The captured data must be stored in Azure Cosmos DB.
Which services should you include in the design? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all.
**Data Flow:**
Azure Active Directory audit log
↓
[Drop Zone 1]
↓
[Drop Zone 2]
↓
Cosmos DB
Explanation
Microsoft Entra ID (Azure Active Directory) audit logs, which record user creation and role assignments, can be streamed to Azure Event Hubs through the tenant's diagnostic settings. An Azure Functions app with an Event Hubs trigger then reads those events and writes them to Azure Cosmos DB (for example, through the Cosmos DB output binding). Event Grid, Monitor Logs and Notification Hubs do not provide this ingest-then-store path to Cosmos DB.
Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service.
Contoso establishes a partnership with another company named Fabrikam, Inc.
Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users.
Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso.
You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements:
✑ Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso.
✑ The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.
✑ The solution must NOT require changes to the logic apps.
✑ The solution must NOT use Azure AD guest accounts.
What should you include in the solution?
A.Azure Front Door
B.Azure AD Application Proxy
C.Azure AD business-to-business (B2B)
D.Azure API ManagementCorrect
Explanation
Azure API Management (APIM) can be placed in front of the logic apps' HTTP triggers without changing the logic apps. APIM can validate OAuth 2.0 tokens issued by Fabrikam's third-party identity provider (validate-jwt policy), so no Azure AD tenant or guest accounts are needed, and products/subscriptions with rate-limit or quota policies let the Fabrikam developers be throttled to lower rates than Contoso users. Front Door, Azure AD Application Proxy and Azure AD B2B do not provide per-consumer rate limiting with a third-party OAuth provider.
You have an Azure subscription that contains 300 virtual machines that run Windows Server 2019.
You need to centrally monitor all warning events in the System logs of the virtual machines.
What should you include in the solution? To answer, select the appropriate options in the answer area.
Explanation
To centrally monitor warning events in the System logs of the virtual machines, create a Log Analytics workspace where the log data can be stored and queried. Then install the Azure Monitor agent on each VM and use a data collection rule that collects Windows event logs (System log, Warning level) and sends them to the Log Analytics workspace.
You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys.
Several departments have the following requests to support the web app:
| Department | Request |
| --- | --- |
| Security | - Review the membership of administrative roles and require users to provide a justification for continued membership.<br>- Get alerts about changes in administrator assignments.<br>- See a history of administrator activation, including which changes administrators made to Azure resources. |
| Development | - Enable the applications to access Key Vault and retrieve keys for use in code. |
| Quality Assurance | - Receive temporary administrator access to create and configure additional web apps in the test environment. |
Which service should you recommend for each department's request? To answer, configure the appropriate options in the answer area.
Explanation
Security: Azure AD Privileged Identity Management (PIM) provides access reviews that ask members to justify continued role membership, alerts on administrator role assignments, and an audit history of role activations. Development: a managed identity lets the App Service apps authenticate to Key Vault and retrieve keys without storing any credentials in code. Quality Assurance: PIM provides just-in-time, time-bound administrator access, so QA staff can be made eligible and activate the role only while they configure the test web apps.
Your company has the divisions shown in the following table.
| Division | Azure subscription | Azure Active Directory (Azure AD) tenant |
| --- | --- | --- |
| East | Sub1, Sub2 | East.contoso.com |
| West | Sub3, Sub4 | West.contoso.com |
You plan to deploy a custom application to each subscription. The application will contain the following:
✑ A resource group
✑ An Azure web app
✑ Custom role assignments
✑ An Azure Cosmos DB account
You need to use Azure Blueprints to deploy the application to each subscription.
What is the minimum number of objects required to deploy the application? To answer, select the appropriate options in the answer area.
Explanation
Management groups: 2 — A management group hierarchy exists within a single Azure AD tenant and cannot span tenants. The company has two tenants (East.contoso.com and West.contoso.com), so one management group per tenant is the minimum.
Blueprint definitions: 2 — A blueprint definition is saved to a management group or subscription and can only be assigned within that tenant, so the definition cannot be shared across the two tenants. One definition per tenant is required; a single definition would not be visible to the subscriptions in the other tenant.
Blueprint assignments: 4 — A blueprint is assigned to one subscription at a time, and the application must be deployed to each subscription. With four subscriptions (Sub1, Sub2, Sub3 and Sub4), four separate assignments are needed — two from the East definition and two from the West.
You need to design an Azure policy that will implement the following functionality:
✑ For new resources, assign tags and values that match the tags and values of the resource group to which the resources are deployed.
✑ For existing resources, identify whether the tags and values match the tags and values of the resource group that contains the resources.
✑ For any non-compliant resources, trigger auto-generated remediation tasks to create missing tags and values.
The solution must use the principle of least privilege.
What should you include in the design? To answer, select the appropriate options in the answer area.
Explanation
The Modify effect adds or replaces tags on resources when they are created or updated, reports existing resources whose tags do not match as non-compliant, and supports remediation tasks that fix existing resources. Append does not support remediation tasks, and EnforceOPAConstraint and EnforceRegoPolicy are for Kubernetes. Remediation tasks for Modify run under the policy assignment's managed identity, not a service principal you create. Contributor is the least-privileged option offered that can change resource tags; User Access Administrator manages role assignments only and cannot modify resources.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.