Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 761Question →

A retail company's e-commerce platform consists of Azure App Service instances and Azure SQL databases. The compliance and operations teams establish the following requirements for diagnostic data:

- Database audit logs and Web Application Firewall (WAF) logs must be retained for seven years in a cost-optimized storage tier.
- The Security Operations Center (SOC) must receive real-time streams of all security events in an on-premises SIEM.
- Database administrators (DBAs) must be able to query database performance logs without viewing application transaction or security logs.

Which design should you recommend for log routing and access control?

Show answer & explanation

Answer: Configure diagnostic settings to send security events to Azure Event Hubs, route audit and WAF logs to Azure Storage with archive lifecycle rules, and send performance logs to a centralized Log Analytics workspace configured to use resource-context RBAC.

Answer

Configure diagnostic settings to stream security events to Azure Event Hubs, store audit and WAF logs in Azure Storage with archive lifecycle rules, and send performance logs to a centralized Log Analytics workspace using resource-context access control.
The correct design uses Azure Event Hubs to stream security events to the on-premises SIEM, Azure Storage with archive lifecycle rules for long-term audit/WAF log retention, and resource-context RBAC within a central Log Analytics workspace to isolate database performance logs for DBAs.

Step-by-Step Solution

1
Analyze log retention and cost requirements
Determine that database audit and WAF logs, which require seven-year retention, should be routed to Azure Storage with lifecycle policies to minimize costs.
Azure Storage is significantly more cost-effective for long-term retention than Log Analytics workspaces.
2
Address SIEM integration requirements
Determine that security events must be routed to Azure Event Hubs.
Azure Event Hubs provides low-latency streaming capabilities suitable for ingestion by external on-premises SIEM systems.
3
Determine the access model for DBAs querying performance logs
Select a centralized Log Analytics workspace configured with resource-context RBAC.
Resource-context RBAC automatically restricts users to only querying logs for resources they are authorized to access, avoiding the need for separate workspaces or complex workspace-level permissions.

Key Concept

Log routing architecture, cost optimization, and access isolation in Azure Monitor
Estimated Time:2m 30s
Question 762Question →

An organization needs to enforce a governance requirement where all newly created virtual machines must be automatically registered with Azure Backup using a specific Recovery Services vault. If a virtual machine is deployed without backup configuration, Azure must automatically deploy the required backup extension and protection settings. Which Azure Policy effect should you use to design this solution?

Show answer & explanation

Answer: DeployIfNotExists

Answer

DeployIfNotExists
DeployIfNotExists allows you to automatically deploy resources or configurations (like backup extensions) using an Azure Resource Manager (ARM) template when the primary resource (the virtual machine) is deployed without them. This meets the automated configuration requirement.

Step-by-Step Solution

1
Analyze the business requirement.
The requirement is to automatically deploy backup configurations (secondary resources) when a virtual machine is created without them.
This establishes that we need a policy effect capable of executing resource templates rather than just auditing or blocking deployment.
2
Evaluate the capabilities of the available policy effects.
DeployIfNotExists runs a deployment if the targeted sub-resource does not exist, whereas Modify only changes properties/tags, and Deny blocks the resource.
This step ensures that the policy effect matches the exact technical mechanism required for automated extension deployment.

Key Concept

Azure Policy Effects
Estimated Time:45s
Question 763Question →

A financial services company is designing the governance strategy for its Azure landing zone. The management group hierarchy has a root management group named Enterprise-MG, with two child management groups: Production-MG and Sandbox-MG. You need to implement a policy governance strategy that satisfies the following requirements:

1. All Azure Key Vaults deployed within Production-MG must automatically have diagnostic logging configured to send logs to a central Log Analytics workspace upon resource creation.
2. No virtual machines within Enterprise-MG are allowed to have public IP addresses, and any deployment attempt that includes a public IP must be blocked. However, this restriction must not apply to resources within a specific subscription under Sandbox-MG named Dev-Sandbox-Sub.

Which policy configuration should you design to meet these requirements with the minimum administrative overhead?

Show answer & explanation

Answer: Assign a DeployIfNotExists policy for Key Vault diagnostics to Production-MG, and assign a Deny policy for public IPs to Enterprise-MG with the subscription ID of Dev-Sandbox-Sub added to the notScopes property of the assignment.

Answer

Assign a DeployIfNotExists policy for Key Vault diagnostics to Production-MG, and assign a Deny policy for public IPs to Enterprise-MG with the subscription ID of Dev-Sandbox-Sub added to the notScopes property of the assignment.
The correct strategy uses the DeployIfNotExists effect to automatically configure diagnostic settings for new Key Vaults in the production management group, and the Deny effect at the parent management group to block public IP configurations. The notScopes property of the Deny policy assignment is used to exclude the specific sandbox subscription from this restriction, minimizing management overhead.

Step-by-Step Solution

1
Determine the appropriate policy effect for automatic log configuration.
DeployIfNotExists (DINE) is selected because the requirement is to automatically deploy diagnostic settings for newly created resources without blocking the deployment.
DeployIfNotExists allows automatic remediation of resources that do not comply with the desired state at the time of creation or update.
2
Determine the appropriate policy effect to block resources with public IPs.
Deny is selected because the requirement is to block any deployment attempts that include a public IP.
The Deny effect prevents resource creation or modification requests that violate the defined policy rules.
3
Identify the scoping and exclusion strategy to minimize administrative overhead.
Assign the Deny policy at the Enterprise-MG root scope and add the Dev-Sandbox-Sub subscription to the notScopes property of the assignment. Assign the DeployIfNotExists policy at the Production-MG child scope.
Using notScopes on a single policy assignment at a higher management group level avoids the overhead of managing multiple individual policy assignments or exemptions.

Key Concept

Azure Policy effects and assignment scope exclusions
Estimated Time:2m 0s
Question 764Question →

HealthFirst Solutions is implementing Microsoft Entra ID to secure their cloud resources. The security team wants to enforce multi-factor authentication (MFA) for all administrative logins. To prevent tenant-wide administrative lockout during a potential MFA service outage, the IT team must safeguard two newly created emergency access accounts.

Which policy configuration should you recommend?

Show answer & explanation

Answer: Configure the Conditional Access policy to exclude the emergency access accounts from the policy scope.

Answer

Configure the Conditional Access policy to exclude the emergency access accounts from the policy scope.
Excluding the emergency access accounts from the Conditional Access policy ensures that administrators can bypass MFA and log in to the tenant using basic authentication in the event of a system-wide MFA outage.

Step-by-Step Solution

1
Identify the primary risk being addressed, which is a tenant-wide lockout in the event of an MFA service disruption.
Emergency access accounts must be able to bypass the MFA requirement during an outage.
If emergency accounts require MFA and the MFA service is down, administrators cannot log in to resolve the issue.
2
Evaluate the configuration options for Microsoft Entra Conditional Access policies.
Exclusions are the standard mechanism to exempt specific accounts from policy requirements.
Adding the emergency accounts to the exclusion list of the MFA Conditional Access policy allows them to authenticate with password-only credentials.

Key Concept

Excluding emergency access (break-glass) accounts from MFA-enforcing Conditional Access policies is essential to prevent permanent administrative lockout during service outages.
Estimated Time:1m 0s
Question 765Question →

An organization is designing a hybrid identity and security governance strategy for its Microsoft Entra ID tenant. The organization has 10,000 users across multiple on-premises offices. The architecture must meet the following requirements:
1. On-premises Active Directory Domain Services (AD DS) user passwords must never be stored in the cloud in any form, including reversible or irreversible hashes, to comply with local financial regulations.
2. Users must be prompted for multi-factor authentication (MFA) when accessing cloud resources, except when they are working from physical corporate offices.
3. Access to privileged administrative roles in Entra ID must follow a zero-trust model requiring justification and manager approval, and administrators must be protected against tenant lockout in the event of an MFA service outage.

Which identity and access management design should the organization recommend?

Show answer & explanation

Answer: Configure Microsoft Entra Connect Pass-through Authentication (PTA) with seamless single sign-on. Design a Conditional Access policy that requires MFA for all users, excludes corporate network IP ranges defined as trusted locations, and excludes a dedicated emergency access account from the policy. Configure Privileged Identity Management (PIM) with eligible role assignments.

Answer

Configure Microsoft Entra Connect Pass-through Authentication (PTA) with seamless single sign-on. Design a Conditional Access policy that requires MFA for all users, excludes corporate network IP ranges defined as trusted locations, and excludes a dedicated emergency access account from the policy. Configure Privileged Identity Management (PIM) with eligible role assignments.
The correct strategy integrates Microsoft Entra Connect Pass-through Authentication (PTA) to keep credential validation on-premises without cloud hash storage, meeting the security and regulatory mandate. Excluding the corporate network IP ranges from the Conditional Access MFA rule ensures location-specific bypass. Applying Privileged Identity Management (PIM) with eligible assignments enforces zero-trust controls by requiring justification and approval for role activation. Finally, excluding a dedicated emergency access account from the Conditional Access policy ensures administrative access is maintained during an MFA outage.

Step-by-Step Solution

1
Select the appropriate hybrid authentication method to satisfy compliance.
Pass-through Authentication (PTA) is selected instead of Password Hash Synchronization (PHS) because PTA validates user credentials directly on-premises without copy-syncing password hashes to the cloud. AD FS is rejected because it adds unnecessary on-premises server footprint and infrastructure complexity.
Compliance dictates that no password hashes, reversible or irreversible, can exist in the cloud.
2
Configure location-based MFA exclusions using Conditional Access.
Define corporate network IP ranges as Trusted Locations and exclude them from the MFA grant control in the Conditional Access policy.
This configuration satisfies the requirement to prompt for MFA except when users are located in physical corporate offices.
3
Design emergency access mitigation within the Conditional Access policy.
Exclude a dedicated emergency access (glass-breaker) account from the Conditional Access policy that enforces MFA.
Without this exclusion, if the MFA service becomes unavailable, administrators could be locked out of the tenant with no method to authenticate.
4
Configure administrative role governance using Privileged Identity Management (PIM).
Define administrative role assignments as eligible rather than active.
Eligible assignments enforce a zero-trust model by requiring users to activate roles on-demand, providing justification and seeking manager approval, whereas active assignments grant privileges permanently.

Key Concept

Designing a secure hybrid identity infrastructure requires balancing strict compliance constraints (preventing cloud password storage via PTA), zero-trust administrator governance (using PIM eligible assignments), and tenant availability safeguards (excluding emergency glass-breaker accounts from Conditional Access MFA policies).
Estimated Time:3m 0s
Question 766Question →

An organization is designing a monitoring solution for its Azure environment. Match each Azure Monitor data type or source to its primary description.

Click a left item, then click its matching right item

Items

Azure Activity Logs
Azure Diagnostic Logs (Resource Logs)
Azure Monitor Metrics

Matches

Show answer & explanation

Answer

Azure Activity Logs match with the description of subscription-level management operations. Azure Diagnostic Logs match with the description of internal resource operational data. Azure Monitor Metrics match with the description of numerical performance values for near-real-time alerting.
Azure Activity Logs track control plane events at the subscription level. Azure Diagnostic Logs track data plane activities and internal operation events of individual resources. Azure Monitor Metrics capture numerical time-series performance data for rapid analysis and alerting.

Step-by-Step Solution

1
Analyze Azure Activity Logs function.
Activity logs record subscription-level events (write, delete, action operations).
This helps identify operations performed on Azure resources from the outside (control plane).
2
Analyze Azure Diagnostic Logs (Resource Logs) function.
Diagnostic logs record internal events and operations within specific resources (data plane).
This is crucial for understanding the internal behavior of a service, such as access requests or queries.
3
Analyze Azure Monitor Metrics function.
Metrics store numeric data points representing resource performance at regular intervals.
This allows for fast, near-real-time alerting and performance graphing.

Key Concept

Azure Monitor data sources classification and log routing
Question 767Question →

Your company has an Azure environment with a management group hierarchy. You are designing a governance strategy to enforce the following compliance requirements:

1. All newly created or updated Azure Storage accounts must have 'Minimum TLS version' set to 'TLS 1.2'. If a storage account is deployed without this configuration, Azure must automatically configure it to TLS 1.2 during deployment.
2. Any attempt to deploy a Virtual Machine without a cost center tag named 'CostCenter' must be blocked.

You need to design the Azure Policy definitions to meet these requirements.

Which two policy effects should you recommend?

Select all that apply

Show answer & explanation

Answer: Modify; Deny

Answer

The correct policy effects to recommend are Modify and Deny.
The Modify effect is the correct choice for the first requirement because it allows the policy engine to add or alter properties of the storage account (such as setting the minimum TLS version) during creation or update. The Deny effect is the correct choice for the second requirement because it actively blocks any resource deployment request that does not meet the specified condition (having the CostCenter tag), thereby preventing non-compliant virtual machines from being deployed.

Step-by-Step Solution

1
Analyze the first requirement: automatically configure 'Minimum TLS version' to 'TLS 1.2' during deployment for newly created or updated storage accounts.
Identify that this involves changing a configuration property on the primary resource itself during resource provisioning or updates.
The Modify effect is designed specifically to add or alter properties of a resource during creation or update. It also supports remediation of existing resources.
2
Analyze the second requirement: block any virtual machine deployment that does not have a cost center tag named 'CostCenter'.
Identify that this requires preventing the resource deployment from proceeding if compliance conditions are not met.
The Deny effect blocks the resource request before it reaches the resource provider, returning a failed deployment status to the user.
3
Evaluate the remaining options against the requirements to rule out inappropriate effects.
Determine that DeployIfNotExists is for deploying nested or auxiliary resources, and Audit does not block deployments.
Choosing the correct policy effects minimizes administrative overhead and ensures compliance rules are strictly enforced as required.

Key Concept

Azure Policy effects determine how resources are evaluated and governed. The Modify effect changes properties of resources during creation or update, while the Deny effect blocks non-compliant resource deployments. Correctly aligning policy effects to business requirements ensures compliance with minimum administrative overhead.
Question 768Question →

A global financial technology enterprise is designing a logging and auditing architecture for a new payment processing platform. The platform is deployed across two Azure regions: France Central (primary) and Qatar Central (secondary).

The compliance department mandates the following strict constraints:
1. Administrative and operational log data from France Central must remain within the European Union (EU) borders to satisfy regional sovereignty laws, while logs from Qatar Central must be stored within the Middle East region.
2. Data security policies require that developers can only query logs for resources they are explicitly authorized to manage, without having read access to the underlying Log Analytics workspace settings or other workloads' logs.
3. Diagnostic logging configuration must be automatically enforced and deployed for all current and future Azure SQL databases and App Service instances within the target subscriptions.
4. The architectural design must minimize overall Log Analytics workspace operational overhead while satisfying all regulatory boundaries.

Which log routing and workspace configuration strategy should you recommend to meet these requirements?

Show answer & explanation

Answer: Deploy two regional Log Analytics workspaces: one in France Central and one in Qatar Central. Configure resource-context access control on both workspaces. Authorize developers using Microsoft Entra groups assigned to the target resource groups. Enforce the diagnostic settings across subscriptions using an Azure Policy with the DeployIfNotExists effect.

Answer

Deploy two regional Log Analytics workspaces (one in France Central and one in Qatar Central) with resource-context access control, assign permissions using Microsoft Entra groups at the resource group level, and use an Azure Policy with the DeployIfNotExists effect to automate diagnostic settings.
The correct solution recommends regional workspaces to meet strict data sovereignty requirements, since Log Analytics workspace data remains in the region where the workspace is created. Using resource-context access control ensures that developers can only query logs for resources they are authorized to manage, without workspace-level permissions. Assigning RBAC roles to Microsoft Entra groups is the standard best practice for scalable management. Lastly, an Azure Policy with the DeployIfNotExists effect automatically creates diagnostic settings for new and existing resources, ensuring automated compliance without blocking deployments.

Step-by-Step Solution

1
Analyze data residency and sovereignty requirements
Two regional Log Analytics workspaces are required because workspace data is bound to the region of deployment. A single workspace in France Central would violate Middle East data residency for Qatar Central resources.
Log Analytics workspaces store data in the region they are provisioned, so separate workspaces are required to comply with regional sovereignty constraints.
2
Determine the workspace access model
Resource-context access control must be configured.
Resource-context access allows users to query logs only for resources they have RBAC access to, preventing them from viewing logs of other workloads or accessing workspace settings, without requiring separate workspaces per workload.
3
Design the identity and access management (IAM) structure
Permissions must be assigned to Microsoft Entra groups mapped to the target resource groups, rather than assigning permissions directly to user accounts or workspaces.
Assigning RBAC roles to groups at the resource group level ensures scalability, compliance with security best practices, and clean separation of duties.
4
Select the policy automation mechanism
An Azure Policy with the DeployIfNotExists effect is chosen.
DeployIfNotExists automatically deploys and configures the diagnostic settings on non-compliant resources, whereas a Deny policy would block developers from deploying resources altogether if they did not manually specify diagnostic settings.

Key Concept

Designing a compliant, secure, and low-overhead log routing architecture using regional Log Analytics workspaces, resource-context access control, group-based RBAC, and DeployIfNotExists Azure Policies.
Question 769Question →

You are designing a monitoring and log routing architecture for a large Azure enterprise environment. You need to route different types of Azure logs and metrics to the appropriate destinations to meet specific operational and compliance requirements.

Which destination should you match with each log source to meet the requirements?

Click a left item, then click its matching right item

Items

Database diagnostic logs that must be analyzed in real-time by a third-party SIEM.
Subscription activity logs that must be retained for audit compliance for five years at minimum cost.
Virtual machine guest operating system logs that require troubleshooting using Kusto Query Language (KQL).
Network Security Group (NSG) flow logs that must be analyzed using Traffic Analytics.

Matches

Show answer & explanation

Answer

Database diagnostic logs route to Azure Event Hubs; Subscription activity logs route to Azure Storage account; VM guest OS logs route to Azure Log Analytics workspace; NSG flow logs route to Log Analytics workspace with Traffic Analytics enabled.
Matching database diagnostic logs to Azure Event Hubs allows real-time integration with SIEMs. Matching activity logs to Azure Storage minimizes costs for long-term archival. Matching VM logs to Log Analytics supports KQL troubleshooting. Matching NSG flow logs to Log Analytics with Traffic Analytics enabled provides flow insights.

Step-by-Step Solution

1
Analyze the real-time ingestion requirement for the database diagnostic logs.
Identify that third-party SIEM integration requires low-latency ingestion, which is supported by streaming logs via Azure Event Hubs.
Azure Event Hubs functions as an event pipeline to stream diagnostic data out of Azure.
2
Evaluate the 5-year retention compliance requirement for activity logs.
Determine that archiving to an Azure Storage account is the most cost-effective solution for long-term compliance storage when active querying is not needed.
Log Analytics storage and retention costs are significantly higher than Azure Blob Storage cold or archive tiers.
3
Identify the querying and troubleshooting requirements for VM guest OS logs.
Match this with a standard Azure Log Analytics workspace.
Log Analytics natively integrates with Azure Monitor Agent to collect VM guest logs and provides KQL for querying and alerting.
4
Assess the requirement to run Traffic Analytics on NSG flow logs.
Determine that Traffic Analytics must be enabled on a Log Analytics workspace to process and visualize flow data.
Traffic Analytics relies on Network Watcher flow log data processed into a Log Analytics workspace.

Key Concept

Selecting the optimal destination for Azure diagnostic, activity, and flow logs based on cost, retention, and analytical requirements.

Alternative Method

Analyzing the log destination based on the primary consumer: SIEM consumers require Event Hubs, KQL queries require Log Analytics, and long-term compliance without active query needs requires a Storage Account.
Estimated Time:2m 0s
Question 770Question →

An organization is designing a governance strategy for Azure resources. You need to recommend Azure Policy configurations to meet the following requirements:

* Block the deployment of any virtual machine that does not use an approved SKU.
* Automatically deploy a diagnostics extension if a virtual machine is created without one.

Which two Azure Policy effects should you recommend?

Select all that apply

Show answer & explanation

Answer: Deny; DeployIfNotExists

Answer

The correct policy effects are Deny and DeployIfNotExists.
The correct policy effects are Deny and DeployIfNotExists. The Deny effect blocks the creation of resources that violate the policy rules, making it perfect for enforcing SKU restrictions. The DeployIfNotExists effect evaluates the resource configuration and, if a specified child resource (such as a diagnostics extension) is missing, deploys the resource via an ARM template deployment.

Step-by-Step Solution

1
Analyze the first requirement: Block the deployment of virtual machines with non-approved SKUs.
The Deny policy effect is identified as the correct mechanism because it proactively blocks the creation or update of resources that violate the defined policy rules.
Preventing the creation of non-compliant resources is the primary use case for the Deny effect.
2
Analyze the second requirement: Automatically deploy a diagnostics extension if a virtual machine is missing one.
The DeployIfNotExists policy effect is identified as the correct mechanism because it checks for the existence of a child resource or related resource, and if not present, triggers a template deployment to remediate it.
DeployIfNotExists is designed for deploying resources and configurations that must exist on target resources.
3
Evaluate the distractors (Audit and Modify effects) against the requirements.
Confirm that Audit only logs non-compliance without action, and Modify only updates resource properties/tags but cannot deploy sub-resources.
This confirms that the selected correct effects are the only ones meeting both business objectives.

Key Concept

Azure Policy effects determine how resources are evaluated and remediated to maintain governance standards.
Estimated Time:1m 0s
Question 771Question →

Your company, Litware Inc., plans to migrate workloads to Azure and must sync its on-premises Active Directory Domain Services (AD DS) to a Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must sign in to cloud services using their on-premises password.
- Authentication must remain operational even during a complete on-premises network outage.
- Users must be able to change their passwords in the cloud using self-service password reset (SSPR), and the changes must sync back to the on-premises AD DS environment.
- Administrative and infrastructure overhead must be minimized.

Which identity synchronization and authentication method should you recommend?

Show answer & explanation

Answer: Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled

Answer

Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled
The correct option is Password Hash Synchronization (PHS) with password writeback. PHS allows Microsoft Entra ID to perform authentication entirely in the cloud by using synchronized hashes of on-premises passwords. This satisfies the business continuity constraint, as cloud authentication remains fully functional even during an on-premises network outage. Password writeback ensures that password updates from Azure SSPR are synced back to the on-premises Active Directory Domain Services (AD DS). This approach also has the lowest administrative overhead since it requires no extra on-premises agent configurations or federated servers.

Step-by-Step Solution

1
Analyze the authentication requirement during on-premises network outages.
Identify that authentication must occur in the cloud without depending on on-premises domain controller availability. This eliminates Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) as standalone solutions.
Both PTA and AD FS validate credentials against the on-premises directory in real-time, meaning a network outage would prevent cloud logins.
2
Analyze the self-service and synchronization requirements.
Determine that Password Hash Synchronization (PHS) must be used alongside password writeback to enable self-service password reset (SSPR) writeback to the local Active Directory.
SSPR requires password writeback to be explicitly enabled in Microsoft Entra Connect to update on-premises AD DS.
3
Compare administrative overhead of the remaining options.
Confirm that PHS has the lowest administrative and infrastructure footprint compared to AD FS and PTA.
PHS does not require deploying on-premises agents or federated server farms to handle authentication traffic.

Key Concept

Selecting the appropriate hybrid identity authentication and synchronization method (PHS vs. PTA vs. AD FS) based on business continuity, compliance, and overhead constraints.
Estimated Time:45s
Question 772Question →

An enterprise is designing a governance strategy for its Azure environment. The resource hierarchy consists of a root management group with two child management groups: MG-Production and MG-Development. You must implement Azure Policies to enforce compliance according to the following requirements:

- All virtual machines deployed in MG-Production must have Azure Backup enabled automatically. If a VM is deployed without backup configured, Azure Backup must be configured automatically.
- To control costs, any attempt to deploy virtual machines outside of the Dv3-series in MG-Development must be blocked immediately.
- A specific resource group named rg-legacy within MG-Production hosts legacy workloads and must be exempted from the backup requirement.
- Existing and new SQL databases in MG-Production must be monitored for SQL auditing configuration, but deployments must not be blocked or auto-remediated.

You need to design the Azure Policy solution to meet these requirements with the least administrative overhead. Which two of the following policy assignments should you recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign a policy containing a DeployIfNotExists effect for virtual machine backup to the MG-Production management group, and add the rg-legacy resource group to the notScopes property of the assignment.; Assign a policy containing a Deny effect for allowed VM SKUs to MG-Development, and assign a policy containing an Audit effect for SQL database auditing to MG-Production.

Answer

Assign a policy containing a DeployIfNotExists effect for virtual machine backup to the MG-Production management group with the rg-legacy resource group in the notScopes property, and assign a Deny policy for VM SKUs to MG-Development alongside an Audit policy for SQL auditing to MG-Production.
The correct strategy uses DeployIfNotExists to automatically deploy dependent backup configurations for virtual machines within MG-Production, utilizing the notScopes property to cleanly exclude rg-legacy. It also applies a Deny policy to MG-Development to block non-Dv3 VM sizes immediately, and an Audit policy to MG-Production to monitor SQL database auditing configuration without altering or blocking resources.

Step-by-Step Solution

1
Determine the appropriate policy effect for automatic remediation of Azure Backup on virtual machines.
Identify DeployIfNotExists (DINE) as the correct effect because Azure Backup requires deploying helper resources (such as backup policies and association resources) that do not exist on the target VM resource itself.
DINE enables automated deployment of missing dependent resources, satisfying the requirement to enable backup automatically.
2
Identify the correct exclusion mechanism for the legacy workload scope.
Add the resource ID of the rg-legacy resource group to the notScopes property of the MG-Production policy assignment.
The notScopes property prevents the policy from evaluating any resources inside the specified scope, eliminating policy overhead and administrative complexity for exemptions.
3
Select the policy effects for VM SKU control and SQL auditing compliance.
Choose Deny for VM SKUs in MG-Development and Audit for SQL database auditing in MG-Production.
The Deny effect prevents deployments of non-compliant VM sizes immediately, while the Audit effect reports non-compliance of SQL database auditing without blocking or auto-remediating.

Key Concept

Azure Policy effects and assignment scope exclusions
Estimated Time:3m 0s
Question 773Question →

An organization has several virtual machines and web applications running in Azure. The security operations team requires all application transaction logs to be streamed to a third-party Security Information and Event Management (SIEM) system located on-premises in near real-time. Which destination should you configure in the Azure Monitor diagnostic settings to meet this requirement?

Show answer & explanation

Answer: An Azure event hub

Answer

An Azure event hub
An Azure event hub is the correct destination because Azure Monitor diagnostic settings natively support routing logs to Event Hubs. This configuration enables immediate ingestion and streaming of telemetry to third-party on-premises or cloud-based SIEM systems.

Step-by-Step Solution

1
Analyze the core requirement
The requirement demands streaming log data to a third-party, external system (on-premises SIEM) in near real-time.
This determines the export pipeline capability required (real-time streaming vs. batch ingestion or internal analysis).
2
Evaluate the supported destinations in Azure Monitor diagnostic settings
Diagnostic settings support exporting to Log Analytics workspaces, Azure Storage accounts, Azure Event Hubs, and partner integrations.
We must match the target destinations with the specific capability identified in the first step.
3
Select the optimal destination
Azure Event Hubs acts as a high-throughput event ingestion service that streams data out of Azure to external consumers instantly.
It is the only native destination designed specifically for streaming telemetry out of Azure in near real-time.

Key Concept

Azure Monitor diagnostic settings export destinations
Question 774Question →

AeroLine Dynamics is designing an administrative access security solution for its Microsoft Entra ID tenant. The solution must enforce Multi-Factor Authentication (MFA) and require a compliant device for all global administrators who access the Azure portal. The design must also ensure that administrators can still access the tenant if the MFA service or the device compliance validation service experiences a global outage. Which of the following strategies should you include in the design?

Show answer & explanation

Answer: Create the Conditional Access policy requiring multi-factor authentication (MFA) and compliant devices for all administrators, but exclude a dedicated, cloud-only emergency account that has the Global Administrator role.

Answer

Create the Conditional Access policy requiring multi-factor authentication (MFA) and compliant devices for all administrators, but exclude a dedicated, cloud-only emergency account that has the Global Administrator role.
Excluding a dedicated, cloud-only emergency access account (often called a glass-breaker account) from Conditional Access policies is a Microsoft best practice. This ensures that if there is a global outage of multi-factor authentication or device compliance validation, administrators can still access the Microsoft Entra tenant using this emergency account to disable or modify the policies. The account should be cloud-only and not federated or synced to prevent dependency on on-premises infrastructure.

Step-by-Step Solution

1
Identify the security requirements and the risk of tenant lockout.
Determined that strict Conditional Access rules without exclusions can block all administrative access during a service outage.
Ensures the architecture accounts for high availability and disaster recovery of administrative access.
2
Select the appropriate account configuration for emergency access.
Designate a dedicated, cloud-only account with the Global Administrator role that is excluded from MFA and compliance policies.
Minimizes dependencies on external or on-premises systems and avoids lockout.
3
Configure the main Conditional Access policy targeting administrators.
Create a policy that enforces Multi-Factor Authentication (MFA) and compliant devices for all Global Administrators, explicitly excluding the emergency access account.
Applies strong security controls to all active administrators while maintaining a break-glass rescue path.

Key Concept

Microsoft Entra ID Conditional Access emergency access accounts
Question 775Question →

An enterprise is designing a comprehensive monitoring and log routing architecture to support workloads across multiple Azure regions. Match each specific logging requirement to its correct Azure architectural design configuration.

Click a left item, then click its matching right item

Items

Route Security Event logs from virtual machines in multiple regions to an on-premises SIEM platform while minimizing cross-region data transfer latency.
Consolidate App Service logs across multiple subscriptions into one workspace, ensuring developers can query only their application's logs without workspace access.
Retain Azure Activity logs for 10 years to meet regulatory compliance requirements, ensuring logs cannot be modified or deleted, while minimizing storage costs.
Collect Syslog data from virtual machines while excluding all debug-level entries prior to ingestion to minimize workspace ingestion volume charges.

Matches

Show answer & explanation

Answer

Route SIEM logs to regional Event Hubs; route app logs to centralized Log Analytics with Resource-context RBAC; route long-term compliance logs to Storage with WORM policy; route VM logs via Azure Monitor Agent with DCR filter.
Matching the scenarios to their target log routing destinations ensures cost efficiency, data residency compliance, and proper access control boundaries. Real-time SIEM integration requires Event Hubs; multi-subscription developer access is secured using resource-context RBAC; low-cost immutable storage is achieved with Storage accounts; pre-ingestion filtering requires Azure Monitor Agent with a Data Collection Rule.

Step-by-Step Solution

1
Analyze SIEM logging requirements. Determine that Event Hubs is required for real-time streaming, and regional namespaces minimize cross-region egress costs.
Map VM SIEM logs to regional Event Hubs.
Reduces latency and cost for external SIEM integration.
2
Analyze developer access requirements. Evaluate workspace-context vs resource-context RBAC.
Map cross-subscription app logs to centralized Log Analytics with Resource-context RBAC.
Allows developers to access resource logs without granting access to the workspace.
3
Analyze compliance retention requirements. Compare Log Analytics retention costs with Azure Storage.
Map 10-year activity logs to an Azure Storage account with WORM policy.
Azure Storage provides the lowest-cost long-term retention and supports immutable (WORM) storage.
4
Analyze syslog filtering requirements. Evaluate how to filter logs before workspace ingestion.
Map syslog collection to Azure Monitor Agent (AMA) with a Data Collection Rule (DCR) and KQL transformation.
DCR transformations run before ingestion, filtering out debug logs to save on ingestion costs.

Key Concept

Azure Monitor architecture design including log routing, data retention, access control (RBAC), and filtering via Data Collection Rules.
Question 776Question →

VeloSpire Logistics has an on-premises Active Directory Domain Services (AD DS) domain that syncs to a single Microsoft Entra ID tenant. You are designing a hybrid identity solution. The solution must meet the following requirements:

- Users must be able to authenticate to cloud resources using their on-premises credentials.
- If the on-premises network or domain controllers experience an outage, users must still be able to sign in to cloud services.
- Cloud-initiated password changes via self-service password reset (SSPR) must be written back to the on-premises AD DS environment.
- The on-premises infrastructure footprint and management overhead must be minimized.

Which hybrid identity synchronization and authentication method should you recommend?

Show answer & explanation

Answer: Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled

Answer

Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled
The correct option is Password Hash Synchronization (PHS) with password writeback enabled. PHS replicates user password hashes to Microsoft Entra ID, allowing authentication to occur completely in the cloud. This fulfills the business continuity requirement by allowing users to sign in during on-premises outages. Enabling password writeback ensures that cloud-initiated password changes via SSPR sync back to the local AD DS. This combination requires the least infrastructure compared to other methods.

Step-by-Step Solution

1
Evaluate the business continuity requirement during an on-premises outage.
Identify that authentication must occur in the cloud without relying on live on-premises connectivity, ruling out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) since both require contact with on-premises servers to validate credentials.
To ensure authentication continues functioning during network or server downtime.
2
Evaluate the on-premises infrastructure and operational overhead constraint.
Determine that Password Hash Synchronization (PHS) has the lowest infrastructure footprint and management overhead as it requires no extra on-premises servers or certificates beyond the sync engine itself, unlike AD FS.
To minimize on-premises resource utilization and administrative cost.
3
Address the self-service capability requirements.
Verify that self-service password reset (SSPR) must have password writeback enabled so that updates to user passwords in Entra ID sync back to AD DS.
To satisfy the constraint that cloud-initiated password changes are reflected on-premises.

Key Concept

Hybrid identity synchronization and authentication methods selection based on availability, self-service, and infrastructure constraints
Question 777Question →

A pharmaceutical company is designing a log routing and governance strategy for its Azure resources deployed across the East US and West Europe regions. The design must meet the following requirements:

- Diagnostic logs from Azure Key Vault instances must be automatically collected and routed immediately upon resource deployment.
- Key Vault logs must remain within their region of origin to comply with regional data sovereignty regulations.
- A global security team must be able to view logs from both regions, whereas regional IT administrators must only be able to view logs from their respective region.
- Permitted access must be assigned to groups rather than individual users to simplify identity management.

Which design should you recommend?

Show answer & explanation

Answer: Create regional Log Analytics workspaces in East US and West Europe. Use an Azure Policy configured with the DeployIfNotExists effect to automatically configure diagnostic settings routing Key Vault logs to their respective regional workspace. Assign the Monitoring Reader role on each workspace to Microsoft Entra security groups containing the respective regional administrators, and assign the role on both workspaces to a group for the global security team.

Answer

The correct design uses regional Log Analytics workspaces to satisfy regional data residency and sovereignty requirements. Using an Azure Policy with the DeployIfNotExists effect ensures that any newly deployed Key Vault is automatically configured with diagnostic settings without blocking resources. Group-based RBAC assignments conform to governance best practices by avoiding direct user assignments.
The correct design uses regional workspaces to ensure that logs do not leave their geographical boundaries, complying with data residency requirements. It automates log routing using the DeployIfNotExists policy effect, which corrects non-compliance by adding diagnostic settings. It assigns permissions to Microsoft Entra security groups rather than individual users, which aligns with governance best practices.

Step-by-Step Solution

1
Address data residency constraints.
Establish separate regional Log Analytics workspaces in East US and West Europe so that logs do not cross regional boundaries, satisfying data sovereignty requirements.
Diagnostic logs must remain in their region of origin.
2
Select the policy effect for automated collection.
Configure Azure Policy using the DeployIfNotExists effect.
DeployIfNotExists automatically remediates and creates diagnostic settings upon resource deployment, whereas Deny would disrupt workflows by blocking deployments.
3
Implement identity and access governance.
Create Microsoft Entra security groups for regional administrators and the global security team. Assign the Monitoring Reader role to the regional groups on their corresponding workspaces, and assign it to the global group on both workspaces.
Assigning roles to groups instead of individual accounts ensures administrative scalability and conforms to governance best practices.

Key Concept

Designing compliant, automated, and secure log routing architectures across multiple regions using Azure Policy, Log Analytics workspaces, and Microsoft Entra ID groups.
Question 778Question →

Aether Dynamics has an on-premises Active Directory Domain Services (AD DS) forest named corp.aetherdynamics.com and a Microsoft Entra ID tenant. You are designing a hybrid identity and secure access solution. The solution must meet the following requirements:

- Users must be able to sign in to cloud applications using their on-premises credentials, even if the on-premises datacenter suffers a complete network outage.
- Users must be able to reset their own passwords from the cloud portal, and the changes must update on-premises AD DS.
- On-premises infrastructure and administrative overhead must be kept to a minimum.
- Multi-factor authentication (MFA) must be enforced for all administrative roles, but the design must prevent administrator lockout in the event of a Microsoft Entra MFA service outage.
- Administrative roles must be managed using Privileged Identity Management (PIM) to ensure just-in-time (JIT) access.

Which hybrid identity and access configuration should you recommend?

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback. Create a Conditional Access policy requiring MFA for administrators, and exclude a dedicated emergency access account. Use Privileged Identity Management (PIM) to configure eligible role assignments.

Answer

The configuration using Microsoft Entra Connect with Password Hash Synchronization, password writeback, a Conditional Access policy with an excluded emergency access account, and eligible PIM assignments.
The configuration using Microsoft Entra Connect with Password Hash Synchronization (PHS) ensures that user login requests can be authenticated directly by Microsoft Entra ID in the cloud, which satisfies the business continuity requirement during an on-premises network outage. Password writeback ensures cloud-initiated self-service password resets are successfully synced to on-premises AD DS. Excluding a break-glass account from the Conditional Access MFA policy prevents lockout during MFA outages, and eligible PIM assignments enforce just-in-time administrative access.

Step-by-Step Solution

1
Select the sync and authentication method that survives on-premises network outages and minimizes server overhead.
Password Hash Synchronization (PHS) is selected.
Unlike Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS), PHS allows users to sign in using their synchronized credentials directly in the cloud without needing any active connection or on-premises servers to validate the password.
2
Select the password management option to allow cloud SSPR to write back to the local domain.
Password writeback is enabled.
This allows self-service password changes initiated in Microsoft Entra ID to update the on-premises AD DS instantly, preserving synchronization.
3
Ensure administrative accounts are secure from lockout during cloud MFA service outages.
Excluding a dedicated emergency access (break-glass) account from the MFA policy.
This guarantees that at least one highly privileged account can access the tenant even if Microsoft Entra MFA services are completely unavailable.
4
Configure the administrative access governance to meet JIT requirements.
Configure Privileged Identity Management (PIM) with eligible assignments.
PIM eligible assignments require users to request activation, fulfilling the JIT policy, whereas active assignments grant permanent access.

Key Concept

Designing hybrid identity and secure administration with high availability and least privilege governance in Azure.
Question 779Question →

A financial services firm is designing a secure identity infrastructure. The lead architect must map specific security compliance requirements to the correct Microsoft Entra ID and Conditional Access features. Match each requirement to the appropriate Microsoft Entra ID or Conditional Access feature.

Click a left item, then click its matching right item

Items

Validate user login credentials directly against on-premises Active Directory in real-time without storing password hashes in the cloud.
Block users from downloading attachments when accessing Exchange Online from unmanaged personal devices.
Enforce Multi-Factor Authentication (MFA) only when a user's sign-in attempt is flagged as anomalous or high risk.

Matches

Show answer & explanation

Answer

Validate credentials directly on-premises matches Pass-through Authentication (PTA); block downloads from unmanaged devices matches Conditional Access session controls; enforce MFA for anomalous attempts matches Microsoft Entra ID Protection sign-in risk policies.
Pass-through Authentication validates credentials on-premises using a local agent; session controls restrict specific actions like downloads on unmanaged devices; Microsoft Entra ID Protection risk policies evaluate anomalous behavior to prompt for MFA dynamically.

Step-by-Step Solution

1
Analyze the first requirement: validating credentials against on-premises Active Directory in real-time without storing password hashes in the cloud.
This requirement is satisfied by Pass-through Authentication (PTA), which uses a local agent to pass credentials back to on-premises AD for validation.
Password Hash Synchronization stores password hashes in the cloud, which does not meet the design constraint of not storing hashes in the cloud.
2
Analyze the second requirement: blocking downloads when accessing Exchange Online from unmanaged personal devices.
This is satisfied by Conditional Access session controls, specifically using App Control or session restrictions.
Session controls are designed to apply restrictions within the context of an active web application session.
3
Analyze the third requirement: enforcing MFA only when a user's sign-in is flagged as anomalous or high risk.
This is satisfied by Microsoft Entra ID Protection sign-in risk policies.
ID Protection dynamically evaluates sign-in signals to assess risk level, allowing policies to trigger MFA conditionally on threat indicators.

Key Concept

Microsoft Entra ID Authentication and Conditional Access
Estimated Time:1m 30s
Question 780Question →

An enterprise has the following Azure management group and subscription hierarchy:

- Tenant Root Group
- Corp-Production (Management Group)
- Sub-App1 (Subscription for Production Application 1)
- Sub-App2 (Subscription for Production Application 2)
- Sub-HubNet (Subscription for Core Hybrid Networking Services)

You are designing a governance and identity strategy that must meet the following requirements:
1. A team of external security auditors must have read-only access to view configurations across Sub-App1, Sub-App2, and all future production application subscriptions.
2. The auditors must have absolutely no access to Sub-HubNet due to strict network security compliance.
3. Access management must minimize administrative overhead and ensure that new production application subscriptions automatically inherit the auditor permissions.
4. Any new production subscription must automatically deploy a standard diagnostic setting that streams activity logs to a central Log Analytics workspace.

Which governance and access control design should you recommend?

Show answer & explanation

Answer: Create a new management group named Corp-Prod-Apps under Corp-Production. Move Sub-App1 and Sub-App2 into Corp-Prod-Apps, leaving Sub-HubNet directly under Corp-Production. Assign the Reader role at the Corp-Prod-Apps scope to a Microsoft Entra ID security group containing the auditors. Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Production scope to deploy the diagnostic settings.

Answer

Create a new management group named Corp-Prod-Apps under Corp-Production, move the application subscriptions there, assign the Reader role at the new management group scope to a Microsoft Entra ID security group for the auditors, and deploy the diagnostic settings using an Azure Policy with the DeployIfNotExists effect at the Corp-Production scope.
The correct design restructures the management group hierarchy to segregate the subscriptions. By creating a new 'Corp-Prod-Apps' management group under 'Corp-Production' and placing the application subscriptions there, you isolate 'Sub-HubNet' from the inheritance path. Assigning the Reader role to a Microsoft Entra ID security group at the new management group scope ensures that permissions are inherited by all existing and future application subscriptions without manual intervention, satisfying the principle of least privilege and scalability. Additionally, assigning an Azure Policy with the DeployIfNotExists effect at the 'Corp-Production' scope guarantees that all production subscriptions automatically deploy and configure the required diagnostic settings upon resource creation.

Step-by-Step Solution

1
Analyze subscription requirements and identify resource scope boundaries.
Determine that Sub-HubNet must be excluded from auditor access, while Sub-App1, Sub-App2, and future application subscriptions must inherit access.
This establishes the scope boundaries and rules out assigning permissions at the root Corp-Production management group level directly, as that would grant access to Sub-HubNet via inheritance.
2
Design a management group structure to isolate the scopes.
Introduce a new child management group (Corp-Prod-Apps) under Corp-Production to hold only application subscriptions, leaving Sub-HubNet at a sibling level.
This allows for scalable RBAC inheritance on application subscriptions while keeping Sub-HubNet isolated.
3
Define the identity and RBAC assignment method.
Create a Microsoft Entra ID security group for the auditors and assign the Reader role at the Corp-Prod-Apps management group scope.
Assigning RBAC roles to groups rather than individual users follows identity governance best practices and minimizes administrative overhead.
4
Determine the policy effect for automatic remediation of diagnostic settings.
Select the DeployIfNotExists policy effect and assign it at the Corp-Production management group level.
A DeployIfNotExists policy automatically deploys the diagnostic settings if they are missing on new subscriptions, unlike a Deny policy which only blocks non-compliant deployments.

Key Concept

Azure RBAC inheritance, management group hierarchy design, and Azure Policy remediation effects.
Estimated Time:3m 0s
PreviousPage 39 / 60Next