Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 781Question →

Kestrel Aerospace has an on-premises Active Directory Domain Services (AD DS) forest named corp.kestrelaero.local. The company has a primary Microsoft Entra ID tenant (kestrelaero.com) and recently acquired a subsidiary that uses a separate Microsoft Entra ID tenant (sub.kestrelaero.com).

You are designing a hybrid and multi-tenant identity solution to meet the following requirements:
- Users in corp.kestrelaero.local must be able to access resources in both the kestrelaero.com and sub.kestrelaero.com tenants.
- Users must authenticate using their on-premises credentials, and password changes must be written back to the on-premises AD DS.
- Users must still be able to authenticate to cloud services even during an extended on-premises network outage.
- On-premises infrastructure overhead must be minimized.
- High-privilege administrative roles in the primary tenant must be protected using Privileged Identity Management (PIM) with zero permanent active assignments, and a Conditional Access policy must require multi-factor authentication (MFA) for all administrative logins.
- An emergency access account must be created to prevent administrative lockout.

Which of the following designs should you recommend?

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback to sync corp.kestrelaero.local to the kestrelaero.com tenant. Configure cross-tenant synchronization from kestrelaero.com to sub.kestrelaero.com. Define PIM roles as eligible, and exclude the emergency access account from the administrative MFA Conditional Access policy.

Answer

The design that synchronizes corp.kestrelaero.local to the kestrelaero.com tenant using Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback, uses cross-tenant synchronization from kestrelaero.com to sub.kestrelaero.com, defines PIM assignments as eligible, and excludes the emergency access account from the Conditional Access policy.
The correct design uses Password Hash Synchronization (PHS) with password writeback, which ensures on-premises passwords are sync'd to the cloud and allows self-service password reset (SSPR) writeback to AD DS. Because the hashes reside in the cloud, cloud authentication is preserved even if the on-premises datacenter loses connectivity. Additionally, cross-tenant synchronization resolves multi-tenant collaboration without violating the single-forest-to-single-tenant Entra Connect sync rule. Making administrative roles eligible in Privileged Identity Management (PIM) ensures zero permanent active assignments, and excluding the emergency access account from the administrative MFA policy adheres to recovery best practices.

Step-by-Step Solution

1
Determine the synchronization and authentication method.
Password Hash Synchronization (PHS) with password writeback enabled.
PHS satisfies the requirement for minimizing local infrastructure overhead (compared to AD FS) and ensures authentication remains operational during an on-premises network outage because the hashes are stored in Microsoft Entra ID. Password writeback ensures SSPR works.
2
Design the multi-tenant collaboration model.
Cross-tenant synchronization from the primary tenant to the subsidiary tenant.
Direct synchronization of a single on-premises forest to multiple tenants using multiple Microsoft Entra Connect engines is not supported. Cross-tenant synchronization securely provisions users from the primary tenant to the subsidiary tenant as B2B users, allowing them to authenticate back to their home tenant.
3
Configure administrative security controls.
Define Privileged Identity Management (PIM) assignments as eligible.
Eligible assignments require users to elevate their privileges on-demand (JIT), meeting the requirement of zero permanent active assignments.
4
Apply Conditional Access policy exclusions.
Exclude the emergency access (break-glass) account from the administrative MFA policy.
Excluding the emergency access account prevents total tenant lockout in the event of an MFA service failure or key loss.

Key Concept

Designing resilient, secure, and operationally efficient hybrid and multi-tenant identity solutions using Microsoft Entra Connect, PHS, Cross-Tenant Synchronization, PIM, and Conditional Access exclusions.
Question 782Question →

NovaSpace Solutions has an on-premises Active Directory Domain Services (AD DS) forest named corp.novaspacesolutions.com containing 18,500 user accounts. The company is designing a hybrid identity solution to integrate their on-premises directory with a new Microsoft Entra ID tenant.

The solution must satisfy the following constraints:
- Passwords must be validated directly against on-premises Domain Controllers in real-time to comply with local financial regulatory policies that require local audit logging of all authentication requests.
- The authentication solution must be highly available and tolerate the failure of an individual on-premises authentication server.
- The design must minimize administrative overhead and avoid the deployment of complex federation infrastructure like Active Directory Federation Services (AD FS).
- Users must be able to use Microsoft Entra Self-Service Password Reset (SSPR) to reset their passwords, and these changes must update the on-premises AD DS.

Which hybrid identity solution should you recommend?

Show answer & explanation

Answer: Microsoft Entra Connect Pass-through Authentication (PTA) combined with Password Writeback, using multiple PTA agents installed on separate on-premises servers

Answer

Microsoft Entra Connect Pass-through Authentication (PTA) combined with Password Writeback, using multiple PTA agents installed on separate on-premises servers
Pass-through Authentication (PTA) ensures that authentication requests are validated directly against on-premises Active Directory Domain Controllers in real-time, satisfying the regulatory auditing requirement. Installing multiple PTA agents on separate servers provides redundancy and high availability without the administrative overhead of deploying and maintaining Active Directory Federation Services (AD FS). Additionally, Microsoft Entra Connect supports Password Writeback to enable Self-Service Password Reset (SSPR) to update the on-premises directory.

Step-by-Step Solution

1
Analyze the authentication validation requirement.
Since the local regulatory policy requires password validation to happen directly against on-premises domain controllers in real-time, Password Hash Synchronization (PHS) is ruled out because it performs validation in the cloud.
Identifying that credential validation must happen locally narrows down the choices to Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS).
2
Evaluate the administrative overhead and infrastructure constraints.
The scenario requires minimizing administrative overhead and explicitly states to avoid complex federation infrastructure such as AD FS.
This rules out AD FS as the primary solution, leaving PTA as the best candidate.
3
Address the high availability and business continuity requirements.
Pass-through Authentication can be made highly available by installing multiple lightweight PTA agents on separate on-premises servers.
This ensures that if one server hosting a PTA agent goes offline, authentication requests are automatically handled by other active agents, meeting the business continuity constraint.
4
Verify self-service and password writeback capabilities.
Microsoft Entra Connect Sync supports both PTA and Password Writeback, allowing users to use Self-Service Password Reset (SSPR) in the cloud with writeback to the on-premises AD DS.
This fulfills the final requirement of allowing cloud-based SSPR to write back to the on-premises directory.

Key Concept

Hybrid Identity Authentication Methods
Question 783Question →

Aethera Genomics is designing an Azure governance model. The company's resource hierarchy consists of a root management group named Aethera-Root, under which exist two management groups named Aethera-Platform and Aethera-Workloads.

The Aethera-Platform management group hosts shared services, including a central Log Analytics workspace and private DNS resolvers at 10.100.1.410.100.1.4 and 10.100.1.510.100.1.5. The Aethera-Workloads management group contains three subscriptions: Aethera-Prod, Aethera-NonProd, and Aethera-Public-Ingress.

You need to design an Azure Policy strategy for the Aethera-Workloads management group that meets the following requirements:
1. All virtual networks (VNets) must automatically route DNS queries to the private DNS resolvers in Aethera-Platform upon creation, without blocking deployment.
2. All VNets must automatically stream resource logs to the central Log Analytics workspace in Aethera-Platform upon creation.
3. Creation of public IP addresses must be blocked across all subscriptions under Aethera-Workloads, except for the Aethera-Public-Ingress subscription, which requires public IPs for Application Gateways.

The solution must minimize administrative overhead.

Which two policy configurations should you include in the design?

Select all that apply

Show answer & explanation

Answer: To enforce VNet DNS and logging, assign a policy initiative to the Aethera-Workloads management group containing a Modify policy to set VNet DNS settings and a DeployIfNotExists policy to deploy VNet diagnostic settings.; To restrict public IP creation, assign a policy with the Deny effect to the Aethera-Workloads management group, and exclude the Aethera-Public-Ingress subscription using the notScopes property of the policy assignment.

Answer

To enforce virtual network DNS and diagnostic logging, assign a policy initiative to the workloads management group containing a Modify policy for VNet DNS settings and a DeployIfNotExists policy for VNet diagnostic settings. To restrict public IP creation, assign a policy with the Deny effect to the workloads management group, and exclude the ingress subscription using the notScopes property of the policy assignment.
To automatically configure custom DNS settings on virtual networks during deployment without blocking the creation, the Modify policy effect is required because it alters properties of the resource itself. To automatically stream resource logs, the DeployIfNotExists policy effect is required because diagnostic settings are deployed as a separate child resource. Grouping these policies into an initiative assigned at the workloads management group level reduces administrative overhead. Additionally, to block public IP creation while allowing it only within the ingress subscription, a policy with the Deny effect must be assigned at the workloads management group scope, with the ingress subscription specified in the notScopes parameter of the assignment to exclude it from enforcement.

Step-by-Step Solution

1
Determine the appropriate policy effect for virtual network DNS configuration.
Identify that custom DNS configuration modifies a property on the Virtual Network resource itself. To automatically apply this change without blocking creation, the Modify effect must be used.
Modify allows editing fields on the target resource during creation or update.
2
Determine the appropriate policy effect for enabling diagnostic logs on virtual networks.
Identify that diagnostic settings are distinct child resources (Microsoft.Insights/diagnosticSettings) rather than properties of the Virtual Network resource. To automatically deploy this child resource, the DeployIfNotExists effect is required.
DeployIfNotExists evaluates the existence of a child resource and deploys a template if the child resource is missing.
3
Identify the optimal policy assignment scope and grouping strategy.
Combine the Modify and DeployIfNotExists policies into a single policy initiative to simplify deployment, and assign it to the Aethera-Workloads management group level to leverage policy inheritance.
Grouping definitions into initiatives reduces assignment overhead and makes compliance monitoring easier.
4
Determine the correct block mechanism and exclusion strategy for public IP addresses.
Use the Deny effect to prevent creation of public IPs. Apply the policy at the workloads management group scope, and exclude the Aethera-Public-Ingress subscription by defining it under the notScopes parameter of the policy assignment.
Using notScopes at assignment time prevents the policy from evaluating resources in the ingress subscription, minimizing administrative overhead compared to managing lifecycle exemptions.

Key Concept

Azure Policy effects selection (Modify, DeployIfNotExists, Deny) and assignment exclusions (notScopes) to enforce resource compliance at scale.
Question 784Question →

You are designing a hybrid identity and multi-tenant solution for a company named ZenithLogix. The company has an on-premises Active Directory Domain Services (AD DS) forest and a Microsoft Entra ID tenant. You need to select the appropriate identity feature or sync method to meet each of the following business and security requirements:

- Ensure that users can authenticate to cloud services even during an on-premises network or power outage.
- Enforce on-premises account restrictions (such as logon hours) in real-time for cloud authentication without deploying Active Directory Federation Services (AD FS).
- Allow guest users from a trusted partner company to log in to corporate resources using their own corporate Microsoft Entra tenant credentials.
- Enable users who reset their passwords in Microsoft Entra ID to have the changes immediately reflected in the on-premises AD DS.

Match each requirement on the left to the correct identity solution on the right.

Click a left item, then click its matching right item

Items

Authentication must succeed during an on-premises network outage.
On-premises logon hours must be enforced in real-time without AD FS.
External guest users must authenticate using their own Entra ID home tenant.
Password changes made via Microsoft Entra self-service password reset (SSPR) must sync back to on-premises AD DS.

Matches

Show answer & explanation

Answer

Match the requirements as follows: 'Authentication must succeed during an on-premises network outage' matches with 'Password Hash Synchronization (PHS)'; 'On-premises logon hours must be enforced in real-time without AD FS' matches with 'Pass-through Authentication (PTA)'; 'External guest users must authenticate using their own Entra ID home tenant' matches with 'Microsoft Entra B2B Collaboration'; and 'Password changes made via Microsoft Entra self-service password reset (SSPR) must sync back to on-premises AD DS' matches with 'Self-Service Password Reset (SSPR) with Password Writeback'.
The correct matches align with the availability, policy, external collaboration, and synchronization requirements of Microsoft Entra ID. Password Hash Synchronization (PHS) provides cloud-side resilience during on-premises outages. Pass-through Authentication (PTA) enables real-time verification against on-premises policies without deploying AD FS. Microsoft Entra B2B Collaboration handles partner user authentication natively, and SSPR with Password Writeback ensures credentials modified in the cloud sync back to AD DS.

Step-by-Step Solution

1
Analyze high availability requirements under network failure.
Identify that Password Hash Synchronization (PHS) stores password hashes in the cloud, allowing authentication to proceed even if the on-premises directory is unreachable.
PHS removes dependency on on-premises domain controllers during cloud sign-in.
2
Analyze real-time security policy enforcement requirements without federation.
Identify that Pass-through Authentication (PTA) validates credentials directly against on-premises AD DS via lightweight agents, enforcing account states and login hours in real-time.
PTA keeps credential validation on-premises but does not require complex AD FS federation infrastructure.
3
Analyze guest access requirement using external credentials.
Identify that Microsoft Entra B2B Collaboration allows inviting external users to use their own home identity provider.
B2B collaboration avoids the need to manage external user life cycles manually.
4
Analyze bi-directional password synchronization requirements.
Identify that Self-Service Password Reset (SSPR) with Password Writeback updates the on-premises AD DS when a user changes their password in the cloud.
SSPR writeback ensures password consistency between cloud and on-premises environments.

Key Concept

Selecting hybrid sync options (PHS, PTA) and multi-tenant/governance features (B2B, SSPR Writeback) based on authentication availability, policy enforcement, and synchronization constraints.
Question 785Question →

An organization is designing a Microsoft Entra Conditional Access policy to require multi-factor authentication (MFA) for all administrative users. To prevent administrative lockout in the event of an authentication outage or misconfiguration, which policy configuration should you recommend?

Show answer & explanation

Answer: Exclude a dedicated emergency access account from the Conditional Access policy

Answer

Exclude a dedicated emergency access account from the Conditional Access policy
Excluding a dedicated emergency access account from the Conditional Access policy ensures that there is always at least one highly privileged account that can bypass standard authentication checks in the event of an outage or configuration error.

Step-by-Step Solution

1
Identify the primary threat vector and security goal
The goal is to enforce administrative MFA while mitigating the risk of total tenant lockout due to a policy misconfiguration or identity provider outage.
Administrators need a recovery path if MFA becomes unavailable or misconfigured.
2
Evaluate the role of Conditional Access exclusions
Excluding a cloud-only emergency account from the policy bypasses the MFA restriction for that account during emergencies.
Conditional Access policies apply broadly unless specific exclusions are defined.
3
Assess alternative identity configurations
Confirm that PIM assignments and hybrid auth models like AD FS do not override Conditional Access evaluations.
Conditional Access is evaluated at token issuance, regardless of role activation status or federated source.

Key Concept

Microsoft Entra ID emergency access accounts bypass standard Conditional Access policies to prevent tenant lockout.
Question 786Question →

Aetheris Dynamics is designing a hybrid identity and multi-tenant architecture to integrate four newly acquired business units (BU1, BU2, BU3, and BU4). You must match each business unit's technical requirements to the appropriate Microsoft Entra ID implementation.

- BU1 requires that users authenticate directly against the on-premises Active Directory Domain Services (AD DS) domain controllers. Authentication must happen on-premises to enforce local login hour restrictions without the complexity of Active Directory Federation Services (AD FS). The solution must remain available if a single on-premises server hosting the synchronization agent fails.
- BU2 requires the highest level of business continuity for authentication, allowing users to sign in to cloud services even during an on-premises network outage. Additionally, users must be able to change their passwords in the cloud, which must immediately update on-premises AD DS.
- BU3 has a security policy that strictly prohibits on-premises user password hashes or credentials from ever being stored in the cloud. User authentication must be federated, utilizing existing on-premises smart card infrastructure, and must support complex multi-factor authentication (MFA) policies managed entirely on-premises.
- BU4 needs to allow external contractors, who manage their own identity providers, to access specific Azure resources. Access must be restricted to a pre-defined duration, and the contractors must be automatically removed when their contract ends.

Match each business unit to the correct hybrid identity or multi-tenant solution component.

Click a left item, then click its matching right item

Items

BU1: Direct on-premises authentication enforcing login hours, without AD FS, supporting agent high availability.
BU2: Authentication business continuity during on-premises outages, with cloud-initiated password resets updating on-premises.
BU3: Zero password hashes in the cloud, federated authentication via smart cards, on-premises managed MFA.
BU4: Time-bound external contractor access with self-executing removal using external identity providers.

Matches

Show answer & explanation

Answer

BU1 matches with Pass-Through Authentication (PTA) with redundant agents; BU2 matches with Password Hash Synchronization (PHS) with Password Writeback; BU3 matches with AD FS federation; BU4 matches with B2B collaboration with access packages.
Each business unit's constraints map to a distinct hybrid or multi-tenant solution. Pass-Through Authentication (PTA) satisfies BU1 by keeping authentication local (enforcing login hours) and using redundant agents for high availability. Password Hash Synchronization (PHS) with Password Writeback satisfies BU2 by enabling cloud authentication during local network outages and allowing self-service changes to write back. AD FS federation satisfies BU3 by ensuring zero hashes enter the cloud while supporting local smart cards and MFA. Entitlement Management access packages satisfy BU4 by automating the lifecycle of external B2B guest identities.

Step-by-Step Solution

1
Analyze BU1's requirements: direct on-premises authentication, dynamic login hour enforcement, no AD FS, agent redundancy.
Determine that Pass-Through Authentication (PTA) is the correct choice because it evaluates login policies locally on domain controllers without copying password hashes, requires no complex AD FS infrastructure, and supports high availability via multiple authentication agents.
Validates local auth control and minimizes management overhead.
2
Analyze BU2's requirements: maximum authentication business continuity during on-premises connectivity outages and cloud-initiated self-service password reset (SSPR).
Determine that Password Hash Synchronization (PHS) with Password Writeback is correct. PHS allows Entra ID to authenticate users even if the on-premises network is completely offline, and Password Writeback permits cloud password changes to write back to the local AD DS.
Aligns with the cloud-fallback capability of PHS and the writeback requirement.
3
Analyze BU3's requirements: zero credentials/hashes in the cloud, smart card integration, and on-premises managed MFA.
Determine that Active Directory Federation Services (AD FS) is the correct choice. It delegates authentication entirely to the local environment via token exchange, which supports smart card logon and allows MFA policies to remain strictly on-premises.
Meets the zero-cloud-hash and advanced on-premises federation constraints.
4
Analyze BU4's requirements: dynamic access for external contractors managing their own identity providers, with automated time-bound lifecycle expiration.
Determine that Microsoft Entra B2B collaboration coupled with access packages in Entitlement Management is correct. B2B allows guest access using their external IdPs, and access packages automate access assignment and automatic revocation based on date/time policies.
Applies multi-tenant external collaboration and identity governance principles.

Key Concept

Hybrid and Multi-Tenant Identity Solutions
Estimated Time:3m 0s
Question 787Question →

An organization is designing a governance and compliance strategy for its Azure landing zones. The resource hierarchy consists of a parent Management Group named MG-LandingZones, which contains three subscriptions: Sub-App1, Sub-App2, and Sub-Shared.

You need to design an Azure Policy strategy that meets the following requirements:
1. All Azure Key Vaults deployed within MG-LandingZones must have diagnostic settings configured to send logs to a central Log Analytics workspace. If a Key Vault is deployed without these settings, they must be automatically created without blocking the deployment of the Key Vault itself.
2. Virtual machines deployed in the Sub-Shared subscription must be prevented from using public IP addresses. However, virtual machines deployed in a specific resource group named RG-Edge-Inbound within Sub-Shared must be allowed to have public IP addresses.

Which two Azure Policy configurations should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Assign an Azure Policy definition with the DeployIfNotExists effect at the MG-LandingZones management group to deploy diagnostic settings on Key Vaults.; Assign an Azure Policy definition with the Deny effect at the Sub-Shared subscription to block virtual machines with public IP addresses, and configure the RG-Edge-Inbound resource group in the notScopes property of the assignment.

Answer

Assign an Azure Policy definition with the DeployIfNotExists effect at the MG-LandingZones management group to deploy diagnostic settings on Key Vaults, and assign an Azure Policy definition with the Deny effect at the Sub-Shared subscription to block virtual machines with public IP addresses while excluding the RG-Edge-Inbound resource group using the notScopes property of the assignment.
To satisfy the first requirement, the DeployIfNotExists effect is the correct choice because it allows the Key Vault to be created and then automatically deploys the diagnostic settings if they do not exist. To satisfy the second requirement, the Deny effect is used to block deployments containing public IPs, and the notScopes (exclusion) property of the policy assignment is used to exempt the RG-Edge-Inbound resource group from the policy scope, thus allowing deployments with public IPs only within that group.

Step-by-Step Solution

1
Analyze the first requirement regarding Azure Key Vault diagnostics and automatic remediation without blocking deployment.
Identify that automatic remediation of missing child resources (like diagnostic settings) without blocking the parent deployment is best handled by the DeployIfNotExists (DINE) effect.
The DeployIfNotExists effect evaluates resources and deploys a template to create the missing settings if compliance is not met, aligning perfectly with the requirement.
2
Analyze the second requirement to prevent public IP usage on VMs in a subscription while exempting a specific resource group.
Identify that blocking resource creation requires the Deny effect, and excluding a specific scope from a policy assignment is best handled using the notScopes property.
Assigning a Deny policy at the subscription level with the notScopes exclusion ensures that any VM deployment with a public IP is blocked everywhere except in the specified resource group.

Key Concept

Azure Policy Governance and Effects
Estimated Time:2m 0s
Question 788Question →

CloudScale Industries is designing a hybrid identity solution to synchronize on-premises Active Directory Domain Services (AD DS) user accounts to a single Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to sign in to Azure resources using their on-premises passwords.
- Users must be able to authenticate successfully even if the on-premises network or domain controllers are temporarily offline.
- Users must have the ability to reset their passwords in the cloud, and the changes must immediately update their passwords on-premises.

Which two features or configurations should you recommend? (Select two.)

Select all that apply

Show answer & explanation

Answer: Password Hash Synchronization (PHS); Password writeback

Answer

To meet the requirements, you should configure Password Hash Synchronization (PHS) to allow offline cloud authentication and enable Password writeback to support updating on-premises passwords from the cloud.
Password Hash Synchronization (PHS) satisfies the requirement to authenticate users in the cloud using on-premises passwords while maintaining sign-in capability during on-premises network or domain controller outages. Password writeback enables self-service password reset (SSPR) updates in Microsoft Entra ID to sync back to the on-premises Active Directory.

Step-by-Step Solution

1
Identify the authentication method that allows users to sign in with on-premises passwords and provides high availability during on-premises network outages.
Password Hash Synchronization (PHS) is selected because it caches password hashes in the cloud, removing dependency on on-premises domain controllers during authentication.
Meeting the offline availability requirement rules out Active Directory Federation Services (AD FS).
2
Identify the feature required to enable self-service password reset changes in the cloud to sync back to the on-premises directory.
Password writeback is selected.
Enabling password writeback ensures that SSPR updates the on-premises Active Directory.

Key Concept

Hybrid identity synchronization and authentication methods with Microsoft Entra Connect
Question 789Question →

An enterprise is designing its Azure subscription governance and access control model. The organization has the following management group and subscription hierarchy:

* Tenant Root Group
* Corporate (Management Group)
* Production (Management Group)
* Subscription A
* Subscription B
* Non-Production (Management Group)
* Subscription C

You need to design a solution that meets the following security and governance requirements:
1. A team of external auditors must be able to view all Azure resources in the Corporate management group and its children, but they must never be allowed to view sensitive data such as Key Vault secrets or VM administrative credentials.
2. The internal DevOps team requires administrative control over Subscription A and Subscription B, but they must be prevented from deleting any resource groups or modifying resource locks.
3. Landing Zone administrators must only use Microsoft Entra ID groups for RBAC assignments and must be prevented from assigning permissions directly to individual user accounts.

Which two configurations should you recommend to meet the governance and security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement a custom RBAC role with Actions set to '*' and NotActions containing 'Microsoft.Authorization/locks/*' and 'Microsoft.Resources/subscriptions/resourceGroups/delete', and assign this role to a Microsoft Entra ID group for the DevOps team at the Production management group level.; Create and assign an Azure Policy definition at the Corporate management group level that uses the Deny effect to block the creation of role assignments where the principalType property of the Microsoft.Authorization/roleAssignments resource is set to 'User'.

Answer

Implement a custom RBAC role for the DevOps team with Actions set to '*' and NotActions containing 'Microsoft.Authorization/locks/*' and 'Microsoft.Resources/subscriptions/resourceGroups/delete' assigned at the Production management group level, and deploy an Azure Policy definition at the Corporate management group level that denies role assignments where the principalType is 'User'.
The correct configurations involve creating a custom RBAC role for the DevOps team that explicitly uses NotActions to subtract delete and lock capabilities from the wildcard Actions, and implementing an Azure Policy at the Corporate management group level that blocks the creation of role assignments where the principal type is an individual user. This effectively enforces group-based assignment and least privilege principles.

Step-by-Step Solution

1
Analyze the auditor requirement
Auditors require read-only access to all resources under the Corporate management group without viewing secrets. Since the built-in Reader role allows viewing resources but does not grant data-plane access to Key Vault secrets or VM administrative commands, assigning the Reader role at the Corporate management group level satisfies this requirement.
Ensures audit visibility across the entire hierarchy while preserving data confidentiality.
2
Analyze the DevOps delegation and restriction requirement
The DevOps team needs full control over Subscription A and Subscription B (which are children of the Production management group) but cannot delete resource groups or modify locks. A custom RBAC role with Actions set to '*' and NotActions containing 'Microsoft.Authorization/locks/*' and 'Microsoft.Resources/subscriptions/resourceGroups/delete' is created and assigned at the Production management group level.
Applies the custom role at the parent management group level of the target subscriptions, leveraging inheritance while restricting deletions and locks via NotActions.
3
Analyze the Landing Zone administrator constraint
Landing Zone administrators must be forced to use group-based assignments. An Azure Policy definition targeting the 'Microsoft.Authorization/roleAssignments' resource type with a rule that denies creation when 'principalType' equals 'User' is assigned at the Corporate management group level.
Enforces compliance at scale by preventing administrators from bypassing group-based access control.

Key Concept

Azure RBAC inheritance, custom roles, and Azure Policy integration for subscription governance.
Estimated Time:3m 0s
Question 790Question →

An organization is designing a security solution for their Microsoft Entra ID tenant to protect administrative accounts. The organization wants to enforce multi-factor authentication (MFA) for all administrators while ensuring that they do not lock themselves out of the tenant if there is an authentication services outage. Which two configurations should you include in the design? (Select two.)

Select all that apply

Show answer & explanation

Answer: A Conditional Access policy that requires multi-factor authentication (MFA) for all administrative directory roles; An exclusion for a dedicated emergency access account from the multi-factor authentication (MFA) Conditional Access policy

Answer

To protect administrative accounts while preventing tenant lockout, you should configure a Conditional Access policy that requires multi-factor authentication (MFA) for all administrative roles and exclude a dedicated emergency access account from that policy.
Securing administrative roles with Conditional Access MFA enforces strong security, while excluding a dedicated emergency access account prevents administrative lockout in the event of an MFA service disruption.

Step-by-Step Solution

1
Enforce MFA for all administrators.
Create a Conditional Access policy targeting administrative directory roles and require MFA.
This secures administrative access to the tenant.
2
Protect against lockouts.
Add an exclusion to the Conditional Access policy for a dedicated emergency access account.
Excluding a dedicated emergency account ensures tenant access remains possible during an outage.

Key Concept

Microsoft Entra ID Conditional Access policies and emergency access account design
Question 791Question →

An enterprise organizes its Azure subscriptions under a management group hierarchy. Under the root management group, there is a production management group named `MG-Prod`. You are designing a governance strategy to enforce security standards on Azure Storage accounts deployed under `MG-Prod` with the following requirements:
- If a storage account is deployed with secure transfer (HTTPS) disabled, it must be automatically configured to enable secure transfer during deployment.
- If a storage account is deployed with public blob access enabled, the deployment must be blocked.
- A resource group named `RG-Legacy-Shares` under a production subscription must be allowed to deploy storage accounts with public blob access enabled, but must still have secure transfer enforced.

Which policy design should you recommend?

Show answer & explanation

Answer: Assign a policy that uses the `Modify` effect to enable secure transfer on storage accounts to `MG-Prod`. Assign a second policy that uses the `Deny` effect to block public blob access to `MG-Prod`, and add `RG-Legacy-Shares` to the `notScopes` property of the second policy's assignment.

Answer

Assign a policy that uses the `Modify` effect to enable secure transfer on storage accounts to `MG-Prod`. Assign a second policy that uses the `Deny` effect to block public blob access to `MG-Prod`, and add `RG-Legacy-Shares` to the `notScopes` property of the second policy's assignment.
The correct design uses the `Modify` effect for the secure transfer policy to automatically remediate resource properties during deployment, and uses the `Deny` effect to block the deployment of any storage accounts with public blob access enabled. Because the legacy resource group must be exempt from the public access restriction but still subject to the secure transfer policy, the policies must be assigned as separate assignments. This allows the legacy resource group to be specified in the `notScopes` parameter of the public blob access policy assignment only, keeping the secure transfer rule fully active on that scope.

Step-by-Step Solution

1
Determine the appropriate policy effect for secure transfer auto-remediation.
Identify that the `Modify` effect is designed to add, update, or remove properties during resource creation or update, making it ideal for enforcing secure transfer (`supportsHttpsTrafficOnly = true`) on storage accounts without rejecting deployments.
This satisfies the requirement to automatically configure secure transfer during deployment with minimal overhead.
2
Determine the appropriate policy effect to prevent public blob access.
Identify that the `Deny` effect blocks the creation of resources that do not comply with the policy rules.
This satisfies the requirement to prevent and block the deployment of storage accounts that have public blob access enabled.
3
Determine how to handle scope exclusions for the legacy resource group.
Determine that since `RG-Legacy-Shares` only needs to be excluded from the public access block (but still have secure transfer enforced), the policies must be assigned separately rather than as a single initiative. The `notScopes` parameter of the public blob access policy assignment must target `RG-Legacy-Shares`.
This ensures the exclusion is applied granularly only to the public blob access rule, satisfying all constraints.

Key Concept

Azure Policy effects and assignment scope exclusions
Estimated Time:1m 30s
Question 792Question →

An enterprise, VeloTransit, manages its Azure resources using a Management Group hierarchy. The root is Velo-Corp, which has two child management groups: Velo-Prod (for production workloads) and Velo-Dev (for development environments).

The security team establishes the following compliance requirements for Velo-Prod:
- All virtual machines must have the Azure Monitor Agent installed and configured with a specific Data Collection Rule (DCR) to collect security logs.
- Any non-compliant virtual machines must have the agent automatically deployed without administrative intervention.
- For a specific legacy subscription under Velo-Prod named Sub-LegacyProd, the automatic deployment of the agent must be deferred to prevent compatibility issues. However, the compliance status of virtual machines in Sub-LegacyProd must still be evaluated and reported.

You need to design an Azure Policy strategy that meets these requirements with the least administrative overhead.

Which of the following policy designs should you recommend?

Show answer & explanation

Answer: Create an Azure Policy definition with a parameterized effect. Assign the policy to Velo-Prod with the effect parameter set to DeployIfNotExists, configuring Sub-LegacyProd as an excluded scope (notScopes) in the assignment. Create a second assignment of the same policy to Sub-LegacyProd with the effect parameter set to Audit.

Answer

Create an Azure Policy definition with a parameterized effect, assign it to the Velo-Prod management group with the DeployIfNotExists effect while excluding the Sub-LegacyProd subscription from that assignment, and create a second assignment of the same policy directly to Sub-LegacyProd with the Audit effect.
The correct design utilizes a single Azure Policy definition with a parameterized effect. By assigning the policy to the Velo-Prod management group with the DeployIfNotExists (DINE) effect, all child subscriptions automatically remediate non-compliant VMs. Excluding Sub-LegacyProd from this parent assignment using the 'notScopes' (Excluded Scopes) setting ensures that the remediation action is not triggered on that subscription. Finally, creating a separate assignment of the same policy directly to Sub-LegacyProd with the Audit effect satisfies the requirement to evaluate and report on compliance status without initiating automated deployment.

Step-by-Step Solution

1
Determine the appropriate policy effect for automatic deployment of agents.
DeployIfNotExists (DINE) is selected because it allows deploying helper resources or extensions (like the Azure Monitor Agent and DCR association) when they are missing.
DINE enables automated remediation during resource creation or update without blocking deployment.
2
Select the correct mechanism to exempt a child scope from parent remediation while maintaining auditing.
Use the 'notScopes' parameter to exclude Sub-LegacyProd from the parent assignment, and define a second assignment directly on Sub-LegacyProd.
Azure Policy assignments are cumulative. Without the exclusion, the parent scope's DINE assignment would still apply to Sub-LegacyProd despite any child assignment.
3
Determine how to support different compliance actions across scopes using the same policy definition.
Parameterize the 'effect' field in the policy rule definition.
Parameterizing the effect allows reusing a single policy definition for both automatic remediation (DINE) and auditing (Audit), reducing administrative overhead.

Key Concept

Azure Policy parameterized effects, cumulative inheritance, and scope exclusions (notScopes)
Question 793Question →

Tailspin Toys is designing a hybrid identity solution to integrate their on-premises Active Directory Domain Services (AD DS) with Microsoft Entra ID. The IT team wants to implement a single sign-on experience for users while minimizing on-premises infrastructure, maintenance overhead, and operational complexity. The company has no regulatory or compliance requirements that forbid storing password hashes in the cloud. Which hybrid authentication method should the company design to meet these requirements?

Show answer & explanation

Answer: Password Hash Synchronization (PHS) with Seamless Single Sign-On

Answer

Password Hash Synchronization (PHS) with Seamless Single Sign-On
The correct answer is the option indicating Password Hash Synchronization (PHS) with Seamless Single Sign-On. Microsoft recommends PHS as the default, simplest, and most resilient hybrid identity authentication method. Since the company has no compliance restrictions against cloud storage of password hashes and wants to minimize on-premises infrastructure and administrative effort, PHS is the optimal choice.

Step-by-Step Solution

1
Analyze the requirements.
The requirement is to choose a hybrid identity authentication method that provides single sign-on (SSO), minimizes on-premises infrastructure, and reduces operational complexity. There are no restrictions on storing password hashes in the cloud.
This establishes the constraints and design goals for the hybrid identity architecture.
2
Evaluate the available hybrid authentication options based on complexity.
Password Hash Synchronization (PHS) requires the least infrastructure (only Entra Connect/Cloud Sync). Pass-through Authentication (PTA) requires on-premises agents. Active Directory Federation Services (AD FS) requires dedicated server pools and certificates.
Choosing the method with the lowest operational overhead is Microsoft's best practice when no compliance policies prevent storing password hashes in the cloud.
3
Select the correct option.
Password Hash Synchronization (PHS) with Seamless SSO meets all requirements with the lowest operational and infrastructure footprint.
PHS provides user sign-in to cloud services using their on-premises password without requiring any on-premises authentication infrastructure during sign-in.

Key Concept

Selecting the appropriate hybrid identity authentication method (PHS vs. PTA vs. AD FS) based on operational overhead, infrastructure requirements, and security compliance.
Question 794Question →

Your organization, Tailwind Traders, is designing a hybrid and multi-tenant identity solution to integrate several business units and external partners with Microsoft Entra ID. You need to match the specific business requirement on the left to the correct Microsoft Entra identity technology or configuration on the right to achieve a secure, resilient, and highly automated architecture.

Click a left item, then click its matching right item

Items

Ensure that users from an external partner tenant can access resources in your tenant without local credential management, while accepting the MFA claims and device compliance status verified by their home tenant.
Allow on-premises AD DS users to authenticate to Entra ID using their on-premises credentials validated in real-time against domain controllers, while maintaining authentication capability if the on-premises connection is lost.
Automate the lifecycle of user accounts created for collaboration between two distinct Entra ID tenants within the same organization, including provisioning and deprovisioning based on changes in the source tenant.
Allow external contractors who do not possess a Microsoft account, Entra ID tenant, or federated identity provider to securely authenticate to shared applications using their business email addresses.

Matches

Show answer & explanation

Answer

Match the external partner trust requirement to cross-tenant access settings with inbound trust; match real-time authentication with offline failover to Pass-through Authentication (PTA) with Password Hash Sync (PHS) backup; match automated multi-tenant user lifecycle to Cross-tenant synchronization; and match contractors without tenants to Email One-Time Passcode (OTP).
The correct matches represent optimal architectural alignments for Azure identity scenarios: Cross-tenant access settings inbound trust configuration allows trusting external MFA/compliance; PTA with PHS backup offers on-premises real-time validation with cloud failover; Cross-tenant synchronization automates multi-tenant account lifecycles; and Email OTP supports users without structured identity providers.

Step-by-Step Solution

1
Analyze the requirement for trusting MFA and compliant devices from an external partner tenant.
Identify that Cross-tenant access settings allow you to trust MFA and device compliance from external Entra ID tenants, preventing double-prompting of external users.
This reduces friction for external users while maintaining security postures verified by their home tenants.
2
Analyze the real-time authentication requirement with an offline failover mechanism.
Determine that Pass-through Authentication (PTA) meets the real-time on-premises validation requirement, and enabling Password Hash Synchronization (PHS) provides a seamless fallback when PTA agents are unreachable.
Entra ID will automatically switch to PHS validation if the PTA agents are offline, ensuring business continuity.
3
Analyze the automated lifecycle management requirement for B2B collaboration across distinct Entra ID tenants.
Identify that Cross-tenant synchronization uses the Microsoft Entra provisioning service to automate provisioning, updating, and deprovisioning of B2B users across tenants.
This reduces administrative overhead and ensures external guest accounts are removed when users leave the source tenant.
4
Analyze the requirement to authenticate external contractors without an Entra ID or federated identity.
Recognize that Email One-Time Passcode (OTP) allows external users to authenticate using a temporary code sent to their email, serving as a fallback when no federated identity provider exists.
This ensures secure access for partners without requiring them to create a Microsoft Account.

Key Concept

Designing secure, resilient, and automated hybrid and multi-tenant identity topologies in Microsoft Entra ID.
Question 795Question →

ShopGlobe Logistics is designing an Azure governance strategy for its resource hierarchy, which consists of a Production management group and a Non-Production management group. The company must satisfy the following compliance requirements:

1. All virtual machines deployed in the Production management group must be audited if they do not use managed disks.
2. All storage accounts deployed in the Production management group must have HTTPS traffic enforcement enabled. If a storage account is created with HTTPS traffic disabled, it must be automatically remediated during deployment without blocking the creation.
3. Public IP addresses must not be created in the Non-Production management group, except for resources deployed in a specific resource group named 'shared-dmz-rg'.

To minimize administrative overhead, which of the following policy configurations should you implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Group the virtual machine auditing policy and the storage account HTTPS remediation policy using the Modify effect into a single policy initiative, and assign it to the Production management group.; Assign a policy that denies public IP address creation to the Non-Production management group, and add the 'shared-dmz-rg' resource group to the policy assignment's exclusion scope (notScopes).

Answer

Group the VM auditing policy and storage account HTTPS remediation policy (with Modify effect) into an initiative assigned to the Production management group, and assign a Deny policy for public IPs to the Non-Production management group with the 'shared-dmz-rg' added to the exclusion scope (notScopes).
Grouping the policies into a single initiative and assigning it to the Production management group ensures that all child subscriptions inherit the settings, minimizing management effort. The Modify effect automatically sets the HTTPS secure transfer property during resource deployment without failure. For the Non-Production requirement, assigning a Deny policy to the management group and using the exclusion scope (notScopes) to exempt the specific resource group is the standard, low-overhead way to manage exceptions.

Step-by-Step Solution

1
Select the correct policy effects based on compliance requirements.
Identify that the virtual machine managed disk compliance requires 'Audit' (to report non-compliance without blocking), the storage account HTTPS secure transfer requires 'Modify' (to change the property during resource creation), and public IP restriction requires 'Deny' (to block creation).
Matching business compliance rules to Azure Policy effects ensures correct enforcement behavior.
2
Determine the proper assignment scope and grouping to minimize overhead.
Combine the 'Audit' and 'Modify' policies into a single policy initiative and assign it to the Production management group scope, allowing inheritance to cover all child subscriptions.
Policy initiatives and management group assignments reduce the number of separate objects that must be managed.
3
Configure exclusions for specific resource scopes.
Assign the Deny policy for public IPs to the Non-Production management group, and specify the resource ID of the 'shared-dmz-rg' resource group in the 'notScopes' (exclusions) property of the assignment.
Exclusion scopes allow child resources/resource groups to be exempt from inherited policies without needing complex policy rules or breaking inheritance.

Key Concept

Azure Policy Governance using initiatives, inheritance, exclusion scopes (notScopes), and appropriate policy effects.
Question 796Question →

Meridian BioLabs is designing a hybrid identity solution to integrate its on-premises Active Directory Domain Services (AD DS) forest, meridianbiolabs.local, with Microsoft Entra ID. The solution must support administrative access governance, secure collaboration, and business continuity.

You must design the solution to meet the following requirements:
- Users must be able to authenticate to cloud resources even during an on-premises internet WAN outage.
- Users must be able to change their passwords in the Microsoft Entra portal and have those changes updated on-premises immediately.
- Management overhead for Azure RBAC role assignments must be kept to a minimum.
- Emergency administrator accounts must be protected against accidental lockout resulting from tenant-wide multi-factor authentication (MFA) policies.

Which two of the following components should you include in the design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable Password Writeback.; Create Microsoft Entra security groups for Azure RBAC assignments, and configure Conditional Access policies that exclude the designated emergency access accounts.

Answer

The correct design incorporates Microsoft Entra Connect configured with Password Hash Synchronization (PHS) and Password Writeback, alongside using Microsoft Entra security groups for role assignments and excluding emergency access accounts from Conditional Access policies requiring multi-factor authentication (MFA).
The design must use Password Hash Synchronization (PHS) to ensure users can authenticate during a WAN outage, since PHS validates credentials directly in the cloud. Enabling Password Writeback satisfies the requirement to write cloud-reset passwords back to the on-premises Active Directory immediately. To minimize management overhead and follow security guidelines, RBAC roles should be assigned to security groups rather than individual users. Finally, excluding emergency access accounts from MFA Conditional Access policies ensures that administrators can access the tenant even during MFA outages or administrative lockouts.

Step-by-Step Solution

1
Analyze authentication and business continuity needs.
Identify that Password Hash Synchronization (PHS) allows cloud authentication during on-premises WAN outages because hashes are stored in Microsoft Entra ID. Reject Pass-through Authentication (PTA) as it requires active connectivity.
Meets the requirement for users to authenticate to cloud resources when the on-premises network is down.
2
Evaluate self-service password management.
Select Password Writeback as an addition to Microsoft Entra Connect sync configurations.
Allows cloud-based self-service password changes to write back instantly to the on-premises Active Directory.
3
Determine the resource authorization delegation model.
Avoid direct user role assignments and implement group-based Azure RBAC assignments.
Minimizes governance overhead and simplifies tracking as administrator personnel change.
4
Assess administrative lock-out prevention.
Define Conditional Access policy exclusions specifically targeting emergency glass-breaker accounts.
Protects against tenant lockout if there is a regional MFA infrastructure failure or identity configuration issue.

Key Concept

Designing hybrid identity synchronization methods and secure multi-tenant access governance while maintaining administrative resilience.
Question 797Question →

You are designing the resource hierarchy for a new department in Azure to ensure proper subscription governance. You need to organize the resources from the top-level management structure down to the individual resources in the correct logical order according to Azure's resource hierarchy. Order the steps required to establish this hierarchy and deploy the resources.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to establish the resource hierarchy and deploy resources is: first, create a child management group under the Tenant Root Group; second, associate an Azure subscription with the management group; third, create a resource group within that subscription; and finally, deploy individual resources into the resource group.
The correct order follows Azure's resource hierarchy from top to bottom: Management Groups, Subscriptions, Resource Groups, and Resources. You start by creating a management group under the Tenant Root Group, then link the subscription to it, create a resource group in that subscription, and finally deploy the resources inside the resource group.

Step-by-Step Solution

1
Create a child management group.
A management group is established under the Tenant Root Group to define organizational governance.
Management groups are the highest level container in the hierarchy below the root and apply policies/RBAC to all child subscriptions.
2
Associate an Azure subscription.
The subscription is placed under the management group.
Subscriptions inherit the governance controls applied to the parent management group and act as billing boundaries.
3
Create a resource group.
A resource group is provisioned within the subscription.
Resources cannot be deployed directly to a subscription; they must reside within a resource group.
4
Deploy individual resources.
Resources are deployed into the resource group.
The resource group is the direct deployment container for Azure resources.

Key Concept

Azure Resource Hierarchy and Governance Scope
Question 798Question →

A multinational enterprise operates a hybrid Azure environment under a single Microsoft Entra tenant. The environment is organized under the following management group hierarchy to ensure regulatory compliance and operational isolation:

* Tenant Root Group
* Global-Ops-MG
* Regional-Lz-MG
* EU-Lz-MG
* EU-Prod-Sub (Subscription)
* EU-Dev-Sub (Subscription)
* US-Lz-MG
* US-Prod-Sub (Subscription)
* US-Dev-Sub (Subscription)

A group of regional site reliability engineers (SREs) based in the European Union (EU) needs permissions to manage virtual machine workloads. You must design an identity and governance solution that meets the following requirements:
1. The SREs must be able to start, stop, and resize virtual machines across all subscriptions under the `EU-Lz-MG` management group.
2. The SREs must be prevented from deleting virtual machines in any subscription under `EU-Lz-MG`.
3. The SREs must have no write or delete permissions on resources under the `US-Lz-MG` management group.
4. Access must be granted on-demand and require approval, with all actions audited, to comply with regional financial regulations.
5. The design must minimize administrative overhead and follow the principle of least privilege.

Which design strategy should you implement?

Show answer & explanation

Answer: Define a custom Azure RBAC role with AssignableScopes set to the EU-Lz-MG management group scope. Configure Actions as ["Microsoft.Compute/virtualMachines/*", "Microsoft.Resources/subscriptions/resourceGroups/read"] and NotActions as ["Microsoft.Compute/virtualMachines/delete"]. In Microsoft Entra Privileged Identity Management (PIM) for Azure resources, configure an eligible role assignment for a Microsoft Entra security group containing the SREs at the EU-Lz-MG scope.

Answer

The correct strategy is to define a custom Azure RBAC role at the management group scope that allows all virtual machine actions except deletion, and then configure this role as an eligible assignment to a Microsoft Entra security group using Privileged Identity Management (PIM).
Defining a custom role with Actions set to 'Microsoft.Compute/virtualMachines/*' and NotActions set to 'Microsoft.Compute/virtualMachines/delete' allows SREs to perform start, stop, and resize (which is a write operation) actions while blocking deletion. Setting the AssignableScopes and assigning the role at the management group level (EU-Lz-MG) ensures inheritance across all subscriptions within that management group, while preventing any access to US resources. Using Privileged Identity Management (PIM) with an eligible assignment for a Microsoft Entra security group satisfies the on-demand, approval-based compliance requirement while aligning with the best practice of avoiding direct user assignments.

Step-by-Step Solution

1
Specify Actions as Microsoft.Compute/virtualMachines/* and NotActions as Microsoft.Compute/virtualMachines/delete.
Allows SREs to perform actions like start, stop, and resize (which requires write operations) while subtracting delete permissions.
Ensures the role adheres strictly to the operational capabilities requested while blocking deletion.
2
Set the AssignableScopes property of the custom role to the EU-Lz-MG management group.
Restricts the applicability of this custom role to the EU management group hierarchy.
Adheres to regional isolation requirements by ensuring US resources cannot be modified under this role.
3
Map the custom role assignment to a Microsoft Entra security group rather than individual users.
Maintains scalable governance and prevents permission sprawl.
Direct user assignment violates Azure identity management best practices.
4
Configure the role assignment as eligible in Privileged Identity Management (PIM) for Azure resources at the EU-Lz-MG scope.
Requires SREs to request activation, receive approval, and generate audit logs.
Meets the regulatory requirement for audited, on-demand, and approved access.

Key Concept

Azure RBAC inheritance, custom role actions/notActions logic, and JIT group governance via Privileged Identity Management (PIM).
Question 799Question →

An organization, Zenith Retail, is designing an Azure governance strategy. The resource hierarchy consists of a root management group named Zenith-Root, with a child management group named Prod-MG containing all production subscriptions.

You must design an Azure Policy solution assigned at the Prod-MG level to meet the following requirements:
1. All virtual machines must have the Azure Monitor Agent installed and configured. Non-compliant virtual machines must be automatically configured upon deployment.
2. All new resource groups must automatically have a cost-center tag (CostCenter: 4002) applied if they are created without one, without blocking deployment.
3. No public IP addresses may be deployed within the subscriptions under Prod-MG, except for a specific shared services resource group named Shared-Gateway-RG where public IPs are permitted for firewalls.

Which two of the following design actions should the cloud architect implement to meet these requirements while minimizing administrative overhead?

Select all that apply

Show answer & explanation

Answer: Create and assign a policy initiative at the Prod-MG scope that contains a policy definition using the DeployIfNotExists effect to install the Azure Monitor Agent and a policy definition using the Modify effect to append the cost-center tag.; Assign a policy definition using the Deny effect for public IP resources at the Prod-MG scope, and configure the resource ID of Shared-Gateway-RG within the notScopes (exclusions) property of the policy assignment.

Answer

Assign a policy initiative at the Prod-MG scope containing a DeployIfNotExists policy for the agent and a Modify policy for the tags, and assign a Deny policy for public IPs at the Prod-MG scope with Shared-Gateway-RG specified in the notScopes property.
To satisfy the requirements with minimal administrative overhead, the architect should group the agent installation policy (which requires DeployIfNotExists to remediate missing agents) and the tagging policy (which requires Modify to apply missing tags without blocking deployments) into a single policy initiative assigned at the Prod-MG management group level. Additionally, preventing public IP creation globally while exempting a specific resource group is best handled by assigning a Deny policy at the management group level and using the notScopes property of the policy assignment to exclude the gateway resource group.

Step-by-Step Solution

1
Analyze compliance requirements for virtual machine monitoring configuration.
Identified the need to automatically configure virtual machines with the Azure Monitor Agent upon deployment. This corresponds to the DeployIfNotExists (DINE) policy effect, which remediates non-compliant resources natively.
DeployIfNotExists allows resources to be deployed and then automatically configures the missing extension, preventing deployment blockages while ensuring compliance.
2
Analyze compliance requirements for resource group cost-center tagging.
Identified the need to automatically append the CostCenter tag without blocking deployment if the tag is missing. This corresponds to the Modify policy effect.
The Modify effect can add, update, or remove properties/tags on a resource during the creation or update lifecycle phase without blocking the resource manager deployment.
3
Determine the optimal policy grouping and assignment scope to minimize overhead.
Combine the DeployIfNotExists policy and the Modify policy into a single policy initiative (set definition) and assign it at the Prod-MG management group level.
Initiatives simplify policy management by grouping multiple definitions together, reducing the number of individual assignments that need to be tracked at the management group scale.
4
Analyze restriction requirements for public IP addresses and exemptions.
Identified that public IPs must be blocked except in Shared-Gateway-RG. This corresponds to a Deny policy assigned at Prod-MG, with the Shared-Gateway-RG resource ID configured in the notScopes property.
The Deny effect prevents resource creation if it violates the policy. Using the notScopes property allows a clean exemption for the specific resource group without requiring separate assignments or policy rules.

Key Concept

Azure Policy Effects and Governance Architecture
Question 800Question →

Aetherius Logistics has an on-premises Active Directory Domain Services (AD DS) forest and is deploying a new Microsoft Entra ID tenant. You are designing a hybrid identity solution. The company has the following requirements:
- Users must be able to authenticate to cloud services using their on-premises passwords.
- Users must be able to perform self-service password resets in Microsoft Entra ID, and the changes must sync back to the on-premises AD DS.
- To ensure business continuity, users must be able to sign in to cloud services even if the on-premises network link is temporarily down.
- On-premises infrastructure requirements must be kept to a minimum.

Which hybrid identity synchronization configuration should you recommend?

Show answer & explanation

Answer: Password Hash Synchronization (PHS) with Password Writeback enabled

Answer

Password Hash Synchronization (PHS) with Password Writeback enabled
Password Hash Synchronization (PHS) copies a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID. This allows users to authenticate to cloud services even if the on-premises network link is down, satisfying the business continuity requirement. Enabling Password Writeback ensures that self-service password resets performed in the cloud are successfully written back to the on-premises directory. This combination also keeps the on-premises infrastructure to a minimum, requiring only the Microsoft Entra Connect sync tool.

Step-by-Step Solution

1
Evaluate the authentication and business continuity requirement.
Since cloud authentication must work even if the on-premises network link is down, the authentication processing must be independent of on-premises connectivity. This selects Password Hash Synchronization (PHS) and rules out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS).
Both PTA and AD FS validate credentials by forwarding requests to on-premises resources, making them dependent on the network link.
2
Evaluate the self-service capability requirement.
Self-service password resets (SSPR) initiated in Microsoft Entra ID must sync back to the on-premises Active Directory Domain Services (AD DS). This requires enabling Password Writeback.
Without Password Writeback, cloud-initiated password changes will not reflect in the on-premises directory.
3
Evaluate the infrastructure constraint.
Password Hash Synchronization (PHS) has the lowest infrastructure footprint compared to PTA and AD FS, as it only requires installing Microsoft Entra Connect or cloud sync agents without complex proxy or federation servers.
This satisfies the requirement to keep on-premises infrastructure to a minimum.

Key Concept

Selecting the appropriate hybrid identity synchronization method based on availability, self-service capability, and infrastructure constraints.
PreviousPage 40 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin