You have an Azure SQL Database logical server named Server1 that contains a database named DB1.
You need to configure authentication for Server1 to meet the following requirements:
SQL authentication cannot be used for any databases on Server1.
The solution must be enforced centrally at the server level.
What should you do?
A.Configure a Microsoft Entra administrator for Server1.
B.Enable a managed identity for Server1.
C.Enable Microsoft Entra-only authentication for Server1.Correct
D.Remove SQL logins from DB1.
Explanation
Enabling Microsoft Entra-only authentication disables SQL authentication at the server level, so no SQL authentication account can connect to the logical server or any of its databases. Configuring a Microsoft Entra administrator is a prerequisite for this feature, but on its own it leaves SQL authentication working. A managed identity gives the server an identity for outbound access and does not affect how clients sign in. Removing logins from DB1 is not central enforcement, because it affects only that database and new SQL logins could still be created and used.
You have a Microsoft Entra tenant that has the following configurations:
User consent for applications is disabled.
Only administrators can grant permissions to applications.
You register an application named App1 that uses delegated Microsoft Graph permissions.
You need to configure App1 to meet the following requirements:
Enable user sign-ins without interactive consent prompts.
Enable App1 to access Microsoft Graph on behalf of the signed-in user.
What should you do?
A.Configure enterprise applications to require user assignment and assign users to App1.
B.Modify the app registration to use application permissions instead of delegated permissions.
C.Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
D.Grant admin consent to App1 for the required delegated permissions.Correct
Explanation
Tenant-wide admin consent grants the delegated permissions on behalf of all users, so users sign in without a consent prompt and App1 calls Microsoft Graph as the signed-in user. Requiring user assignment only controls who can sign in and grants no permissions. Application permissions let an app run without a signed-in user, which fails the on-behalf-of requirement. Relying on user consent cannot work because user consent is disabled in this tenant.
You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
Elevated access must be evaluated by another administrator before it is granted.
Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A.Expire active assignments after
B.Require approval to activateCorrect
C.Require justification on activation
D.Expire eligible assignments after
E.Activation maximum durationCorrect
Explanation
Require approval to activate makes an approver evaluate each elevation request before the role becomes active. Activation maximum duration sets how long an activation stays active before it expires, so the elevated access ends automatically after that period. Expire active assignments after limits direct active assignments, which are not elevated through activation, and Expire eligible assignments after only ends the right to request the role. Require justification on activation records a reason but does not involve another administrator.
You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.
You have a user named User1 and a global administrator named Admin1.
You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.
You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.
What should you do first?
A.Move Sub1 to MG1.
B.Assign Admin1 the User Access Administrator role for Sub1.
C.Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
D.Instruct Admin1 to enable Access management for Azure resources.Correct
Explanation
Microsoft Entra roles do not grant access to Azure resources, so a Global Administrator has no rights on Sub1 by default. Setting Access management for Azure resources to Yes gives Admin1 the User Access Administrator role at root scope, which allows managing role assignments in every subscription and management group in the tenant. Assigning that role directly on Sub1 would need someone with rights on Sub1, and User1 is its only owner. Moving the subscription does not give Admin1 any access, and Security Administrator is a Microsoft Entra role that cannot change Azure role assignments.
You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2.
Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.
You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.
How should you configure the policy?
A.Assign the policy to MG1 and exclude RG-Exception.Correct
B.Assign the policy to Sub1 and RG-Exception.
C.Assign the policy to MG1 and RG-Exception.
D.Assign the policy to Sub1 and exclude RG-Exception.
Explanation
An assignment at MG1 applies to all child subscriptions and resource groups, so it covers both Sub1 and Sub2, and an excluded scope removes RG-Exception from evaluation. Assigning at Sub1 would leave Sub2 uncovered even with the exclusion. The options that assign the policy to RG-Exception apply the restriction to the very resource group that must stay unrestricted.
You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.
You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.
You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.
What should you create?
A.an access policy for KV1
B.an app registration for App1
C.a private endpoint for KV1
D.a managed identity for App1Correct
Explanation
A managed identity lets App1 authenticate to Key Vault with no stored credentials, and with RBAC authorization you then assign it the Key Vault Secrets User role. An access policy belongs to the vault access policy permission model, so it does not apply to a vault that uses RBAC. An app registration would need a client secret or certificate that App1 has to hold. The firewall already allows the virtual network that contains App1, so a private endpoint adds nothing and does not solve authentication.
You have a Microsoft Entra tenant.
You need to implement passwordless authentication. The solution must meet the following requirements:
- Users can sign in without a password by using a mobile device.
- New users that sign in for the first time must use a helpdesk-issued sign-in method that expires.
Which authentication method should you enable for each requirement? To answer, drag the appropriate methods to the correct requirements. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Microsoft Authenticator provides passwordless phone sign-in from a mobile device, so it meets the passwordless requirement. A Temporary Access Pass is a time-limited passcode that an administrator or helpdesk creates for a user, and its most common use is registering authentication methods during the first sign-in. Hardware OATH tokens are not a mobile device method and do not expire as an onboarding credential. SMS and voice call deliver codes to a phone the user has already registered, so they are neither helpdesk-issued nor expiring credentials.
You have a Microsoft Entra tenant that has user consent for applications disabled.
You register an application named App1 that requests the following Microsoft Graph delegated permissions:
- User.Read
- Mail.Read
You need to configure tenant permissions to meet the following requirements:
- Enable users to grant consent for low-risk permissions without administrator interaction.
- Ensure that applications requesting higher-privilege permissions require administrator approval.
What should you do?
A.Grant tenant-wide admin consent to App1.
B.Configure application assignments for App1.
C.Configure Privileged Identity Management (PIM) role assignments.
D.Create an app consent policy.Correct
Explanation
An app consent policy governs which permissions users may consent to, so users can consent to permissions classified as low impact while anything else still needs an administrator. Tenant-wide admin consent only approves App1 on behalf of the organization and does not let users consent to anything themselves. Application assignments control who can use an app, and apps that require assignment actually need administrator consent. PIM manages privileged role activation and has no effect on application consent.
You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.
You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.
Which role should you assign to Group1?
A.Contributor at the MG1 scope
B.Contributor at the Sub1 and Sub2 scopes
C.User Access Administrator at the MG1 scopeCorrect
D.Owner at the MG1 scope
Explanation
User Access Administrator includes the Microsoft.Authorization permissions needed to manage role assignments, and assigning it at MG1 is inherited by both subscriptions. Contributor is wrong at any scope because it explicitly cannot assign roles in Azure RBAC. Owner can assign roles but also grants full management of all resources, which is more than the task needs and breaks least privilege.
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have a user named User1 and an Azure App Service web app named App1 that has a system-assigned managed identity.
You need to configure authorization to meet the following requirements:
- App1 must be able to retrieve secrets from KV1.
- User1 must manage the KV1 settings without accessing secret values.
The solution must follow the principle of least privilege.
Which role should you assign to each identity for KV1? To answer, drag the appropriate roles to the correct identities. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Key Vault Contributor is a control plane role for managing key vaults and does not allow access to keys, secrets or certificates, so it fits User1. Key Vault Secrets User can read secret contents and nothing more, which is the least privilege App1 needs. Key Vault Administrator performs all data plane operations and cannot manage the vault resource, so it fails User1's requirement and is excessive for App1. Key Vault Secrets Officer can perform any action on secrets, which exposes secret values to User1 and gives App1 more than it needs.
You have an Azure subscription named Sub1 that contains 50 virtual machines. Sub1 has Microsoft Defender for Cloud enabled.
Sub1 contains an Azure key vault named KV1 and an Azure policy that enforces storing all secrets in KV1.
Occasionally, the developers at your company store plaintext tokens and SSH private keys on the virtual machines.
You need to configure Defender for Cloud to detect plaintext secrets on the virtual machines. The solution must minimize administrative changes to the virtual machines.
How should you configure Defender for Cloud? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Plan to enable: Defender Cloud Security Posture Management (CSPM) is one of the plans that makes machine secrets scanning available, the other being Defender for Servers Plan 2, which is not offered here. Defender for Cloud Apps focuses on SaaS applications, and Defender for Key Vault protects the vault itself rather than looking at what is stored on VM disks.
Feature to enable: Agentless machine scanning analyzes disk snapshots through cloud APIs, so it finds plaintext tokens and SSH private keys without installing anything on the virtual machines. Regulatory compliance reports posture against standards, and vulnerability assessment looks for software weaknesses rather than exposed secrets.
You have an Azure subscription.
You need to create and deploy an Azure policy that meets the following requirements:
- When a new virtual machine is deployed, automatically install a custom security extension.
- Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension.
What should you include in the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Definition effect: DeployIfNotExists runs a template deployment when the related resource is missing, which is how a VM extension gets installed, and remediation tasks can apply that template to existing resources. Modify and Append change properties on the resource being evaluated and cannot deploy an extension, while EnforceOPAConstraint and EnforceRegoPolicy relate to Kubernetes admission control.
For remediation, define: Azure Policy runs remediation with a managed identity associated with the policy assignment, not a service principal, so the service principal options are wrong. The identity needs Contributor because deploying the extension means writing resources, whereas User Access Administrator only manages authorization and cannot deploy anything.
You have an Azure SQL Database logical server named Server1 that contains multiple databases.
The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases.
You need to ensure that SQL authentication is denied for connections.
What should you do?
A.Run create USER ... FROM EXTERNAL PROVIDER on each database.
B.Create a Conditional Access policy.
C.Enable Microsoft Entra-only authentication for Server1.Correct
D.Assign the SQL Server Contributor role to Server1.
Explanation
Enabling Microsoft Entra-only authentication disables SQL authentication at the server level, so no SQL authentication login or user can connect to Server1 or any of its databases. It does not remove the existing SQL logins and users; it only stops them from connecting, which is exactly what is required. Creating users from the external provider adds Entra users but leaves SQL authentication working. Conditional Access applies to Microsoft Entra sign-ins, not SQL authentication, and SQL Server Contributor is a role for managing servers that cannot even change this setting.
You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance. Sub1 has Microsoft Defender for Cloud enabled.
You need to configure Microsoft Defender for Databases to minimize costs.
Which Defender plan should you enable?
A.Microsoft Defender for Servers
B.Microsoft Defender for Open-Source Relational DatabasesCorrect
C.Microsoft Defender for SQL Servers on Machines
D.Microsoft Defender for Azure SQL Databases
E.Microsoft Defender for Storage
Explanation
Azure Database for PostgreSQL is protected by the Defender for Open-Source Relational Databases plan, so enabling only that plan covers the instance without paying for anything unused. The Defender for Azure SQL Databases and Defender for SQL Servers on Machines plans protect SQL Server workloads, not PostgreSQL. Defender for Servers protects machines and Defender for Storage protects storage accounts, so neither provides threat protection for the database service.
You have an Azure Storage account named storage1 that contains Azure Files shares.
You have an application named App1 that uses a system-assigned managed identity to access the shares.
Administrators access the shares by using storage account keys.
You need to ensure that App1 access the shares without using the storage account keys.
What should you do on storage1?
A.Store the storage account access keys in Azure Key Vault and regenerate them periodically.
B.Set Allow storage account key access to Disabled.
C.Select Default to Microsoft Entra authorization in the Azure portal.
D.Assign the Storage File Data Privileged Reader role to the managed identity of App1.Correct
Explanation
A managed identity authenticates with Microsoft Entra ID and is authorized through Azure RBAC, so App1 needs a data role on storage1; Storage File Data Privileged Reader grants read access to share data through OAuth over REST, replacing the account keys. Disabling storage account key access would reject every key-authorized request, which would break the administrators who still use keys. Default to Microsoft Entra authorization only changes how the Azure portal authorizes access for people using the portal, and does not give App1 any permissions. Storing the keys in Key Vault still means using the keys.
You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled.
You need to configure a solution that automates the remediation of malware detected in storage1.
What should you include in the solution?
A.Application Insights
B.Azure Event Hubs
C.Azure Event GridCorrect
D.Azure Policy
Explanation
Defender for Storage can send malware scan results to Azure Event Grid in near real time, and an event subscription can trigger a Function App that deletes or quarantines the malicious blob. Event Hubs can only receive forwarded events for downstream consumers, so it does not by itself drive remediation. Application Insights monitors applications, and Azure Policy governs resource configuration rather than reacting to individual scan results.
You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2, and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:
- VM1 on Subnet1
- VM2 on Subnet2
- VM3 on Subnet3
You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.
You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.
How should you configure the inbound rule on NSG1? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
The traffic starts at VM2, which is the only member of ASG1, so ASG1 is the source; it ends at VM3, the member of ASG2, so ASG2 is the destination. An NSG rule that references application security groups follows the network interfaces in the group rather than their addresses, so it keeps working if the private IP address of VM2 changes, which rules out the IP address settings. VirtualNetwork would match every VM in VNet1, including VM1. Because the default AllowVNetInBound rule permits traffic inside the virtual network, a lower-priority deny rule is also needed to stop other sources from reaching VM3.
You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1.
All the traffic from the virtual machines is routed through FW1.
You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic.
What should you use?
A.an inbound NAT rule
B.an application ruleCorrect
C.an outbound NAT rule
D.a network rule
Explanation
Application rules filter outbound HTTP and HTTPS traffic by name, matching on the Host header or SNI, so a rule that targets updates.contoso.com allows that site. Azure Firewall denies traffic that matches no rule, so everything else is blocked without another rule. Network rules are the layer that works with IP protocols, addresses and ports rather than web names. Inbound NAT rules translate traffic coming in to the firewall, and an outbound NAT rule is not an Azure Firewall rule type.
You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1.
You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.
You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1. The solution must minimize administrative effort.
What should you use?
A.a connectivity configuration
B.a security admin configurationCorrect
C.a user-defined route (UDR)
D.a network security group (NSG)
Explanation
A security admin configuration holds rule collections that are associated with a network group, and when deployed its rules apply to every virtual network in that group. A Deny rule for inbound TCP 3389 is evaluated before NSG rules and stops the traffic, and 3389 is one of the high-risk ports the documentation recommends restricting this way. NSGs attach to individual subnets or network interfaces, so they would need configuring many times. A connectivity configuration defines the network topology, and a UDR controls routing rather than filtering a port.
You have an Azure subscription.
You need to deploy an Azure virtual WAN to meet the following requirements:
Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.
Ensure that security rules sync between the regions.
What should you use?
A.Azure Network Function Manager
B.Azure Firewall ManagerCorrect
C.Azure Virtual Network Manager
D.Azure Front Door
Explanation
Azure Firewall Manager centrally deploys and configures Azure Firewall instances across regions and manages firewall policies across multiple secured virtual hubs, which are Virtual WAN hubs with security and routing policies attached. A global firewall policy applied to all three hubs keeps the security rules the same in every region. Azure Virtual Network Manager manages virtual networks through network groups, not firewall policy on secured hubs. Azure Network Function Manager and Azure Front Door do not manage secured virtual hubs either.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.