Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 801Question →

Your company is designing the subscription governance and access control model for a new Azure subscription. You need to grant a team of ten developers the ability to manage virtual machines in the subscription. The solution must adhere to the principles of least privilege, minimize administrative overhead, and ensure that administrative access is granted only when required. Which two configurations should you implement? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Virtual Machine Contributor role to a Microsoft Entra ID security group that contains the developer accounts.; Configure the group's role assignment in Microsoft Entra Privileged Identity Management (PIM) as eligible.

Answer

Assign the Virtual Machine Contributor role to a Microsoft Entra ID security group that contains the developer accounts, and configure the group's role assignment in Microsoft Entra Privileged Identity Management (PIM) as eligible.
To satisfy subscription governance and least privilege, permissions should be assigned to a Microsoft Entra ID security group to minimize overhead, and the group should be configured as eligible in Microsoft Entra PIM to ensure that administrative permissions are activated only when needed.

Step-by-Step Solution

1
Evaluate the administrative overhead requirement.
Identify that permissions should be assigned to groups rather than individual user accounts to ensure scalability and ease of management.
Direct user assignments require manual updates for every new or departing team member, causing significant administrative overhead.
2
Evaluate the temporary access requirement.
Determine that role assignments must be configured using Privileged Identity Management (PIM) with an eligible state.
Setting assignments to permanently active provides constant access, failing to meet the requirement for temporary, on-demand administrative access.

Key Concept

Azure RBAC best practices advocate assigning roles to security groups rather than individual users, and using Microsoft Entra PIM with eligible assignments to enforce just-in-time, least-privilege access.
Estimated Time:45s
Question 802Question →

An organization is designing a Microsoft Entra Conditional Access policy to require multi-factor authentication (MFA) for all administrative roles. The organization wants to ensure that administrators do not get locked out of the tenant in the event of a tenant-wide disruption or MFA service outage. Which of the following recommendations should you include in the identity security design?

Show answer & explanation

Answer: Exclude a dedicated emergency access account from the Conditional Access policy.

Answer

Exclude a dedicated emergency access account from the Conditional Access policy.
Excluding a dedicated emergency access account from the Conditional Access policy ensures that there is at least one administrative path into the tenant that does not depend on the availability of the MFA service or external authentication endpoints.

Step-by-Step Solution

1
Analyze the requirement to prevent administrator lockout during tenant-wide or MFA-specific service disruptions.
Identify that policies requiring MFA must have a mechanism to bypass MFA in absolute emergencies.
If MFA is globally down or misconfigured, administrators need a path to access the tenant and correct the configuration.
2
Review Microsoft best practices for managing emergency access in Microsoft Entra ID.
Confirm that creating one or two dedicated, highly secure emergency access (break-glass) accounts that are excluded from all Conditional Access policies is the standard mechanism to prevent lockout.
These accounts are kept excluded from CA policies and monitored closely for any sign-in activity.

Key Concept

Emergency access accounts (break-glass accounts) should be excluded from Conditional Access policies that enforce MFA to prevent tenant lockout.
Estimated Time:50s
Question 803Question →

Your organization has an Azure management group hierarchy consisting of a root management group and several child management groups. You are designing a governance strategy and need to implement a custom Azure RBAC role named 'Billing Reader Custom' for a specific child management group named 'Finance-MG'. The role must be assignable only within 'Finance-MG' and its descendants. You need to create this custom role and assign it to a Microsoft Entra security group named 'Finance Auditors' for a specific subscription under 'Finance-MG'. Which sequence of steps should you perform to create and assign the custom role?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Verify permissions at the management group scope, retrieve the management group resource ID, define the AssignableScopes in the JSON file using the management group ID, register the role using the CLI, and assign it to the security group at the subscription scope.
To create a custom Azure RBAC role scoped to a management group, you must first verify that you have administrative access (such as Owner or User Access Administrator) at that management group scope. You then retrieve the management group's resource ID and place it in the AssignableScopes array of the role definition JSON. Once the JSON file is created, you register the role using the CLI command. Finally, because the subscription inherits the custom role availability from the parent management group, you assign the role to the target group at the subscription scope.

Step-by-Step Solution

1
Ensure that the deploying user account has write permissions for role definitions at the 'Finance-MG' scope.
Confirms the deployment process will not fail due to authorization constraints when registering the custom role.
Creating a custom role with a management group assignable scope requires write permissions (Microsoft.Authorization/roleDefinitions/write) at that specific management group scope.
2
Retrieve the resource ID for the 'Finance-MG' management group.
Acquires the exact resource ID path required for the role definition.
The AssignableScopes list in the custom role definition requires the full resource path format: /providers/Microsoft.Management/managementGroups/Finance-MG.
3
Create a JSON role definition template and set the AssignableScopes property to include the management group resource ID.
Prepares the schema structure for the custom role, limiting its scope strictly to Finance-MG and its child subscriptions.
Setting the AssignableScopes directly restricts where the custom role can be displayed and assigned, preventing leakage to other management group branches.
4
Execute the 'az role definition create' command using the JSON file.
Creates and registers the custom role at the tenant level, making it active for the specified assignable scopes.
The custom role must be registered within the Azure active directory/tenant database before any assignments can be made.
5
Assign the newly created custom role to the 'Finance Auditors' security group at the scope of the target subscription.
Grants the security group billing reader permissions specifically for the target subscription.
Because the subscription resides within the management group hierarchy under 'Finance-MG', it inherits the availability of the custom role, allowing the role assignment to succeed.

Key Concept

Azure Custom RBAC Roles can be scoped to Management Groups, allowing them to be inherited by all child subscriptions and resources, while the creation itself requires appropriate write permissions at that management group level.
Estimated Time:3m 0s
Question 804Question →

An international shipping company, Pacific Cargo Enterprises, is designing an identity and access management solution for its Microsoft Entra ID tenant. The tenant contains several custom administrative roles and standard built-in roles. The security architecture must meet the following requirements:
1. All users assigned to administrative roles must be prompted for multi-factor authentication (MFA) and must connect from a compliant device when accessing Azure management portals.
2. The risk of administrative lockout due to an emergency or a misconfigured Conditional Access policy must be mitigated.
3. Access to high-privilege roles, such as Global Administrator, must be limited to just-in-time (JIT) activation and subject to approval.

Which two configurations should you include in the design to satisfy these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: A Conditional Access policy that targets all administrative directory roles, requires multi-factor authentication and device compliance, and excludes a group containing two dedicated emergency access accounts.; Microsoft Entra Privileged Identity Management (PIM) role settings for the Global Administrator role configured with eligible assignments that require justification, multi-factor authentication, and approval upon activation.

Answer

A Conditional Access policy that targets administrative directory roles, requires multi-factor authentication and device compliance, and excludes emergency access accounts; along with Microsoft Entra Privileged Identity Management (PIM) configured with eligible assignments requiring approval.
To secure administrative access while preventing accidental lockout, a best-practice design uses Microsoft Entra Conditional Access policies combined with emergency access (break-glass) accounts. These emergency accounts must be excluded from policies that enforce multi-factor authentication (MFA) and device compliance, ensuring they can still log in if MFA or device registration services fail. Additionally, using Microsoft Entra Privileged Identity Management (PIM) with eligible assignments ensures that high-privilege roles like Global Administrator are only active when needed (just-in-time) and require approval, rather than being permanently assigned.

Step-by-Step Solution

1
Analyze the access and resiliency requirements for administrative accounts in Microsoft Entra ID.
Identify that emergency access (break-glass) accounts are required to mitigate tenant lockout.
Excluding emergency accounts from strict Conditional Access policies is critical to maintain tenant access during a failure.
2
Determine the optimal configuration for Microsoft Entra Privileged Identity Management (PIM).
Select eligible assignments for the Global Administrator role instead of active assignments.
Eligible assignments enforce just-in-time access, reducing the exposure of highly privileged accounts.
3
Synthesize the results to select the correct architectural recommendations.
Combine the exclusion of emergency accounts in Conditional Access with eligible assignments in PIM.
This dual approach fulfills the security requirement for MFA and device compliance while maintaining tenant recoverability and least privilege.

Key Concept

Designing secure administrative access using Microsoft Entra ID Conditional Access exclusions and Privileged Identity Management (PIM).
Estimated Time:3m 0s
Question 805Question →

Your company is designing a Microsoft Entra Conditional Access policy to secure administrative access. The policy must require multi-factor authentication (MFA) for all users with privileged roles. You also need to ensure that administrators are not locked out of the tenant if a cloud-based MFA service outage occurs.

Which two configurations should you include in the design?

Select all that apply

Show answer & explanation

Answer: Exclude a dedicated emergency access account from the Conditional Access policy; Configure the Grant control in the Conditional Access policy to require multi-factor authentication

Answer

Exclude a dedicated emergency access account from the Conditional Access policy and configure the Grant control in the Conditional Access policy to require multi-factor authentication.
Excluding a dedicated emergency access account and requiring multi-factor authentication under Grant controls satisfies both security and business continuity requirements. The exclusion ensures resilience against MFA outages, while the Grant control enforces the required MFA verification for general administrative sessions.

Step-by-Step Solution

1
Identify the primary requirement: Require MFA for administrative access.
This requires configuring the Grant control in the Conditional Access policy to 'Require multi-factor authentication'.
Grant controls are used to enforce security requirements like MFA when policy conditions are met.
2
Identify the secondary requirement: Prevent tenant lockout in case of MFA service outages.
This requires excluding a dedicated emergency access (break-glass) account from the policy.
Excluding emergency access accounts prevents administrative lockout when external factors disrupt authentication mechanisms.

Key Concept

Microsoft Entra ID Conditional Access controls and lockout prevention using emergency access accounts.
Question 806Question →

An enterprise manages its Azure resources using a management group structure. Under the root management group, there is a parent management group named Corp-MG, which has two child management groups named Corp-Prod-MG and Corp-Dev-MG.

You are designing an Azure Policy governance solution to meet the following requirements:
1. All virtual machines deployed to Corp-Prod-MG must have the Azure Monitor Agent extension automatically installed.
2. All Azure Storage accounts deployed to Corp-Dev-MG must have public network access disabled. Any attempts to deploy a storage account with public network access enabled must be blocked, except for resources deployed within a specific resource group named Dev-Sandbox-RG.

You need to configure the policies to enforce these compliance requirements while minimizing administrative overhead.

Which two configuration actions should you include in the design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Prod-MG scope to install the Azure Monitor Agent extension on virtual machines.; Assign an Azure Policy with the Deny effect at the Corp-Dev-MG scope, and configure the Dev-Sandbox-RG resource group ID in the notScopes property of the policy assignment.

Answer

Assign an Azure Policy with the DeployIfNotExists effect at the Corp-Prod-MG scope to install the Azure Monitor Agent extension on virtual machines, and assign an Azure Policy with the Deny effect at the Corp-Dev-MG scope, configuring the Dev-Sandbox-RG resource group ID in the notScopes property of the policy assignment.
To automatically install the Azure Monitor Agent extension on virtual machines, a policy with the DeployIfNotExists effect should be assigned at the Corp-Prod-MG scope. To block non-compliant storage accounts while excluding the sandbox environment, a policy with the Deny effect should be assigned to the Corp-Dev-MG scope, with the Dev-Sandbox-RG resource group ID added to the notScopes property of the policy assignment. This ensures compliance without manual intervention or excessive policy assignments.

Step-by-Step Solution

1
Determine the appropriate policy effect for deploying the Azure Monitor Agent extension on virtual machines.
Select DeployIfNotExists.
Virtual machine extensions are child resources, and DeployIfNotExists is the standard effect for deploying nested resources or templates when a resource is created or updated.
2
Determine the policy effect to prevent storage accounts from enabling public network access.
Select the Deny effect.
The Deny effect prevents the creation or modification of resources that do not match the compliance rule, ensuring that public network access cannot be enabled.
3
Identify how to exclude the specific sandbox resource group from the policy enforcement scope.
Configure the notScopes property on the policy assignment to include the resource ID of the sandbox resource group.
The notScopes property excludes specific resource groups or individual resources from the scope of a policy assignment, preventing enforcement there without requiring separate policy assignments.

Key Concept

Enforcing compliance at scale using Azure Policy effects (DeployIfNotExists, Deny) and targeting scopes using the notScopes exclusion property.
Question 807Question →

An enterprise wants to secure administrative access to their production Azure subscriptions. You are designing an identity governance solution for system administrators who require the Owner role. To comply with security best practices, the administrators must not have permanent Owner privileges, but must be able to request and activate the role for a maximum of 4 hours when performing changes. Which configuration should you design to meet this requirement?

Show answer & explanation

Answer: Configure Microsoft Entra Privileged Identity Management (PIM) and define the Owner role assignments for the administrators as eligible.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) and define the Owner role assignments for the administrators as eligible.
Configuring the Owner role assignments as eligible in Microsoft Entra Privileged Identity Management (PIM) ensures that administrators do not have standing, permanent privileges. Instead, they must request activation when needed, which can be restricted to a maximum duration of 4 hours, satisfying the security requirements.

Step-by-Step Solution

1
Analyze the business and security requirements.
Identified the need for non-permanent, time-bound (maximum 4 hours), and just-in-time (JIT) administrative access for the highly privileged Owner role.
This establishes the core functional requirements for the identity governance design.
2
Select the appropriate Azure governance tool.
Determined that Microsoft Entra Privileged Identity Management (PIM) is the standard tool designed for managing, controlling, and monitoring access to important resources in Azure.
PIM provides the capabilities required for JIT access and time-bound activations.
3
Select the proper assignment type within the chosen tool.
Configured the role assignments as 'eligible' rather than 'active'.
Eligible assignments require the user to explicitly perform an activation process (which can be restricted to 4 hours), whereas active assignments grant persistent privileges without requiring activation.

Key Concept

Just-In-Time (JIT) privileged access management using Microsoft Entra Privileged Identity Management (PIM) role eligibility.
Question 808Question →

A medical group is planning to migrate a local relational database to the cloud. The database contains several legacy features, including SQL Server Agent jobs and cross-database queries across two databases. You need to recommend a fully managed database solution that minimizes management overhead while supporting these features. Which Azure SQL deployment option should you select?

Show answer & explanation

Answer: Azure SQL Managed Instance

Answer

Azure SQL Managed Instance
Azure SQL Managed Instance provides near-100% compatibility with the SQL Server database engine, including support for SQL Server Agent and cross-database queries. Because it is a fully managed platform-as-a-service (PaaS), it also minimizes administrative overhead by automating patching, backups, and high availability.

Step-by-Step Solution

1
Identify the legacy database feature requirements.
The requirements are support for SQL Server Agent and cross-database queries.
These are instance-level features of SQL Server.
2
Filter Azure SQL options based on support for these legacy features.
Azure SQL Managed Instance and SQL Server on Azure Virtual Machines support both SQL Server Agent and cross-database queries.
Azure SQL Database (Single Database or Elastic Pools) does not support these instance-level features natively.
3
Filter remaining options based on management overhead and platform type.
Azure SQL Managed Instance is chosen because it is a fully managed PaaS solution.
SQL Server on Azure Virtual Machines is an IaaS solution that requires significant administrative effort for OS patching, SQL updates, and backup management.

Key Concept

Selecting the correct Azure SQL service based on compatibility with instance-level features and administrative management overhead.
Estimated Time:45s
Question 809Question →

A financial services company is designing a monitoring and log routing architecture for its Azure environment, which spans the East US and North Europe regions. The architecture must meet the following requirements:
- Diagnostic logs from resources in both regions must be collected.
- To comply with local data residency regulations, logs generated in East US must remain within the United States, and logs generated in North Europe must remain within the European Union.
- A centralized security operations team requires real-time access to security-related logs from both regions using a third-party SIEM tool.
- Internal audit teams must have read-only access to log data originating from their respective regions only, without the ability to view logs from other regions.
- Management overhead and the number of Log Analytics workspaces must be minimized.

Which log routing and workspace configuration should you recommend?

Show answer & explanation

Answer: Deploy one Log Analytics workspace in East US and one in North Europe. Configure diagnostic settings to route resource logs to their respective regional workspaces. Assign regional audit teams to Microsoft Entra ID groups, and assign the Reader role to these groups at the workspace level. Configure resource diagnostic settings to stream security logs to regional Azure Event Hubs for SIEM ingestion.

Answer

Deploy one Log Analytics workspace in East US and one in North Europe, routing regional logs to their respective workspaces, managing audit permissions via Microsoft Entra groups assigned at the workspace level, and streaming security logs to regional Azure Event Hubs for real-time SIEM ingestion.
Deploying regional Log Analytics workspaces ensures compliance with data residency regulations by keeping logs within their respective geographic boundaries. Group-based RBAC assignments follow standard identity governance principles to control audit access. Streaming logs to Azure Event Hubs enables real-time ingestion by third-party SIEM tools without introducing unnecessary workspace or routing overhead.

Step-by-Step Solution

1
Analyze regional residency and isolation constraints for resource logs.
Logs from East US must remain in the United States, and logs from North Europe must remain within the European Union.
Log Analytics workspaces store data within the region where they are provisioned. Therefore, separate workspaces in East US and North Europe are required to satisfy the data residency compliance rules.
2
Evaluate access requirements and design the authorization model for the audit teams.
Create regional Microsoft Entra ID groups and assign them workspace-level Reader permissions.
Assigning RBAC roles directly to individual user accounts introduces governance risks and high management overhead, making group-based assignment the correct approach.
3
Determine the routing mechanism for the real-time SIEM integration.
Configure resource diagnostic settings to stream security logs to regional Azure Event Hubs.
Event Hubs provide a low-latency, real-time message streaming pipeline suitable for ingestion by third-party SIEM tools without requiring log centralization in a single Log Analytics workspace.

Key Concept

Log routing and workspace design must balance data sovereignty requirements (requiring regional workspaces) with administrative overhead, while utilizing group-based access control and Event Hubs for real-time SIEM ingestion.
Question 810Question →

Kestrel Dynamics has an on-premises Active Directory Domain Services (AD DS) forest. You are designing a hybrid identity solution that integrates the AD DS forest with a new Microsoft Entra ID tenant. The solution must meet the following requirements:

* Users must be able to sign in to cloud services using their on-premises credentials.
* Users must be able to authenticate to Microsoft Entra ID even if the on-premises network or AD DS domain controllers are completely offline.
* Users must be able to reset their passwords in the cloud, and the changes must immediately write back to the on-premises AD DS.
* Administrative overhead and infrastructure costs must be minimized.

Which two components should you include in the hybrid identity design? (Select two).

Select all that apply

Show answer & explanation

Answer: Password Hash Synchronization (PHS); Password writeback enabled in Microsoft Entra Connect

Answer

The correct design components are Password Hash Synchronization (PHS) and Password writeback enabled in Microsoft Entra Connect.
Password Hash Synchronization (PHS) allows users to log in with their on-premises credentials by validating hashes locally in Microsoft Entra ID. Because the hashes reside in the cloud, sign-in works even if the on-premises network or AD DS domain controllers go offline. Additionally, PHS requires no extra on-premises servers, aligning with the low overhead constraint. Enabling password writeback in Microsoft Entra Connect is the specific configuration needed to write SSPR changes immediately back to the on-premises AD DS.

Step-by-Step Solution

1
Identify the cloud-based authentication method that handles on-premises outages.
Password Hash Synchronization (PHS) is selected because it enables independent cloud-based sign-in from synchronized password hashes, unlike Pass-through Authentication or Active Directory Federation Services which depend on active on-premises availability.
The system must support user sign-ins during on-premises offline events.
2
Evaluate the design against complexity and cost constraints.
Confirming PHS meets the low overhead constraint, whereas AD FS would require dedicated federation servers and complex setup.
The scenario mandates that administrative overhead and infrastructure costs be minimized.
3
Determine the requirement for SSPR changes to reflect on-premises.
Enable password writeback in the Microsoft Entra Connect configuration.
Cloud-initiated self-service password resets must update the on-premises AD DS immediately.

Key Concept

Selecting the appropriate hybrid identity authentication protocol and directory synchronization settings under cost, complexity, and availability constraints.
Question 811Question →

A company plans to migrate a legacy on-premises database to Azure. The database relies on SQL Server Agent for scheduled maintenance tasks and uses SQL Server Common Language Runtime (CLR) integration. Which of the following Azure relational database solutions natively support both SQL Server Agent and CLR? (Select TWO).

Select all that apply

Show answer & explanation

Answer: SQL Server on Azure Virtual Machines; Azure SQL Managed Instance

Answer

SQL Server on Azure Virtual Machines and Azure SQL Managed Instance
SQL Server on Azure Virtual Machines and Azure SQL Managed Instance are the relational database deployment options in Azure that provide instance-level features, including native support for SQL Server Agent and SQL CLR.

Step-by-Step Solution

1
Identify the key relational database feature requirements.
The requirements are SQL Server Agent and SQL Common Language Runtime (CLR) support.
These are instance-level features commonly used in legacy database workloads.
2
Evaluate Azure SQL options against the requirements.
Azure SQL Database single database and elastic pools do not support SQL Server Agent or CLR natively. Azure SQL Managed Instance and SQL Server on Azure VMs support both features.
To determine which Azure services provide the required feature parity.
3
Select the correct solutions based on the feature comparison.
SQL Server on Azure Virtual Machines and Azure SQL Managed Instance satisfy all criteria.
To choose the relational database options that support the requested features.

Key Concept

Azure SQL Feature Compatibility
Question 812Question →

Your organization is designing an identity governance and privileged access strategy for a newly acquired Azure tenant that hosts critical financial workloads. You must implement administrative access for a cloud engineering team according to the following requirements:

- Members of the cloud engineering team must be able to request Subscription Owner permissions on demand for a maximum duration of 4 hours, subject to manager approval.
- Administrative permissions must be managed at a group level rather than assigned to individual user accounts to minimize management overhead and ensure scalable governance.
- Multi-Factor Authentication (MFA) must be enforced for all administrative sessions.
- An emergency access account (break-glass account) must be protected from accidental lockouts that could be caused by MFA service disruptions or configuration issues.

Which two configurations should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a Microsoft Entra security group, assign the group to the Owner role of the production subscription, and configure the cloud engineers as eligible members of the group using PIM for Groups.; Create a Conditional Access policy enforcing Multi-Factor Authentication (MFA) for administrative applications, and exclude the emergency access glass-breaker account from this policy.

Answer

Create a Microsoft Entra security group, assign the group to the Owner role of the production subscription, and configure the cloud engineers as eligible members of the group using PIM for Groups; and create a Conditional Access policy enforcing Multi-Factor Authentication (MFA) for administrative applications, and exclude the emergency access glass-breaker account from this policy.
The correct configurations involve using PIM for Groups to assign the Subscription Owner role to a security group and making the engineers eligible members. This complies with group-based governance and allows just-in-time 4-hour access. Additionally, enforcing MFA for administrative sessions while excluding the emergency access account ensures security compliance without risking a tenant lockout scenario.

Step-by-Step Solution

1
Evaluate the requirement for group-based administrative access management.
Identify that assigning roles directly to individual users is not scalable. Decide to use a security group and leverage PIM for Groups to manage eligibility.
This meets the governance requirement of group-level permission management instead of direct user assignment.
2
Address the just-in-time (JIT) on-demand access requirement for the Subscription Owner role.
Assign the security group to the Subscription Owner role, and configure group membership in PIM as eligible with a maximum activation duration of 4 hours and approval requirements.
This ensures engineers only obtain owner permissions when requested and approved, conforming to the principle of least privilege.
3
Determine how to enforce MFA for administrative sessions while securing the emergency account.
Create a Conditional Access policy requiring MFA for administrative roles/apps, but explicitly add the emergency glass-breaker account as an exclusion.
This guarantees that all normal admin sessions require MFA, while safeguarding the tenant against lockout if MFA services fail.

Key Concept

Microsoft Entra Privileged Identity Management (PIM) and security group governance, combined with Conditional Access policy design for emergency accounts.
Estimated Time:3m 0s
Question 813Question →

A logistics company is designing the migration of an on-premises tracking application to Azure. The application database requires Common Language Runtime (CLR) integration, SQL Server Agent for scheduling internal tasks, and cross-database queries using three-part naming conventions. Additionally, the solution must survive the outage of a primary datacenter and minimize the administrative overhead of managing operating system updates and database backups. Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure SQL Managed Instance

Answer

Azure SQL Managed Instance
Azure SQL Managed Instance is the correct choice because it is a fully managed service that minimizes administrative overhead (such as patching and backups) while providing near-100% compatibility with on-premises SQL Server instance features. It supports instance-level features like CLR integration, SQL Server Agent, and native cross-database queries using three-part names, and it can be configured with geo-redundant storage to survive a primary datacenter outage.

Step-by-Step Solution

1
Analyze the application capability requirements.
The application requires Common Language Runtime (CLR), SQL Server Agent, and cross-database queries using three-part naming.
These are instance-scoped features typical of on-premises SQL Server instances and require either Azure SQL Managed Instance or SQL Server on Azure VMs.
2
Evaluate the administrative overhead constraint.
The requirement to minimize the management of operating system updates and database backups rules out SQL Server on Azure Virtual Machines, as VMs require manual OS/DBMS patching and backup configuration.
Azure SQL Managed Instance is a fully managed Platform-as-a-Service (PaaS) that handles OS patching and automated backups.
3
Evaluate the resiliency and storage requirements.
The solution must survive a primary datacenter outage, requiring geo-redundant storage (GRS) or zone-redundant storage (ZRS) depending on regional availability, ruling out Locally Redundant Storage (LRS). Also, transaction logs require high-performance disks (Premium SSD or Ultra Disk), ruling out Standard HDD configurations.
Locally Redundant Storage only replicates data within a single physical facility, making it vulnerable to a datacenter outage.

Key Concept

Selecting the appropriate Azure SQL deployment option based on compatibility, administrative overhead, and resiliency requirements.
Question 814Question →

Your company has a Microsoft Entra tenant. You are designing a privileged access solution for a group of helpdesk operators. The operators must be able to reset user passwords, but they should only have these administrative privileges when actively responding to support tickets, up to a maximum of 4 hours per session. Additionally, their identity must be verified using multi-factor authentication (MFA) each time they request these privileges.

Which two configurations should you recommend to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Set the assignment type for the helpdesk operators to Eligible in Microsoft Entra Privileged Identity Management (PIM).; Configure the role activation settings in Microsoft Entra Privileged Identity Management (PIM) to require multi-factor authentication.

Answer

To meet the requirements, you must set the assignment type for the operators to Eligible in Microsoft Entra Privileged Identity Management (PIM) and configure the role settings to require multi-factor authentication on activation.
Configuring the assignment as eligible in Privileged Identity Management (PIM) ensures that users do not have permanent standing administrative access and must explicitly activate the role when needed (just-in-time access). Requiring multi-factor authentication (MFA) within the PIM role activation settings ensures that the user's identity is verified at the moment of activation, fulfilling both security requirements.

Step-by-Step Solution

1
Analyze the access requirement
The helpdesk operators require temporary, just-in-time access (up to 4 hours) rather than permanent standing access.
This determines that they should be configured as Eligible in PIM instead of Active, as active assignments provide persistent access.
2
Analyze the authentication requirement
The operators must verify their identity via MFA when requesting the role.
This requires enabling the multi-factor authentication requirement within the specific PIM role's activation settings.

Key Concept

Microsoft Entra Privileged Identity Management (PIM) enables just-in-time access governance and step-up authentication configuration for administrative roles.
Question 815Question →

An organization is planning to host a legacy vendor application in Azure. The application requires a relational database backend using SQL Server. The vendor documentation states that the application installer must run directly on the database server operating system to configure local registry keys and file path structures.

Which Azure SQL deployment option should you recommend to meet these requirements?

Show answer & explanation

Answer: SQL Server on Azure Virtual Machines

Answer

SQL Server on Azure Virtual Machines
SQL Server on Azure Virtual Machines is an Infrastructure as a Service (IaaS) offering that gives you full administrative control over the SQL Server instance and the underlying operating system. This is required when third-party applications or installers need to make OS-level changes, write to the Windows Registry, or configure local file paths.

Step-by-Step Solution

1
Analyze the application requirements.
The application requires a relational SQL Server database and must write directly to the host operating system's registry and file paths.
Identifying the constraint of operating system access is critical for choosing the right deployment option.
2
Evaluate the management tiers of Azure SQL offerings.
PaaS options (Azure SQL Database and Azure SQL Managed Instance) abstract the operating system and do not allow administrative host access.
This determines whether a fully managed service can meet the requirements.
3
Select the option that provides host access.
SQL Server on Azure Virtual Machines (IaaS) provides full control over the OS.
This is the only deployment model that satisfies the requirement for OS-level installation and configuration.

Key Concept

SQL Server on Azure Virtual Machines vs. PaaS Database Services
Question 816Question →

An organization is designing a security and access control strategy for its Microsoft Entra ID tenant to protect sensitive cloud resources and workloads. The security team has defined several key access requirements for their environment. Match each security requirement to the corresponding Microsoft Entra ID or Conditional Access feature that best satisfies it.

Click a left item, then click its matching right item

Items

Secure access to a critical financial application by requiring users to authenticate using phishing-resistant methods like FIDO2 security keys, ignoring weaker multi-factor authentication methods.
Revoke active OAuth 2.0 access tokens in near real-time when a user's password is reset or their account is disabled, bypassing standard token lifetimes.
Trigger a step-up authentication challenge dynamically within a custom line-of-business application when a user attempts to view highly confidential files.
Configure Microsoft 365 services to automatically block file downloads and enforce read-only web access when connected from unmanaged devices.

Matches

Show answer & explanation

Answer

The requirement for phishing-resistant methods matches Conditional Access Authentication Strength; near real-time token revocation matches Continuous Access Evaluation (CAE); dynamically triggering step-up authentication matches Conditional Access Authentication Context; and blocking file downloads from unmanaged devices matches Conditional Access App Enforced Restrictions.
The correct mapping pairs the security requirements with their respective Entra ID features: FIDO2 requirement pairs with Conditional Access Authentication Strength, near real-time token revocation pairs with Continuous Access Evaluation (CAE), dynamic step-up authentication pairs with Conditional Access Authentication Context, and restricting unmanaged devices to read-only access pairs with Conditional Access App Enforced Restrictions.

Step-by-Step Solution

1
Analyze the requirement for enforcing specific phishing-resistant MFA methods.
Identify that Conditional Access Authentication Strength allows administrators to specify exactly which MFA methods (e.g., FIDO2 keys) are acceptable for a policy.
Standard MFA policies only require multi-factor authentication generally, whereas authentication strength defines the specific combination of allowed methods.
2
Analyze the requirement for near real-time revocation of active sessions upon account events.
Identify Continuous Access Evaluation (CAE) as the mechanism that enables active token revocation within minutes when events like password resets occur.
Without CAE, tokens remain valid until their standard expiration lifetime (typically 1 hour) even if the user account is disabled.
3
Analyze the requirement for triggering MFA step-up dynamically within an application session.
Identify Conditional Access Authentication Context as the bridge between application-level actions and Conditional Access policies.
Authentication context allows custom apps or SharePoint to prompt for additional verification only when accessing specific high-sensitivity data.
4
Analyze the requirement for restricting downloads and enforcing read-only web access on unmanaged devices.
Identify Conditional Access App Enforced Restrictions as the session control that communicates device state to Microsoft 365 workloads.
This session control allows workloads like SharePoint to control the browser behavior based on compliance signals passed by Entra ID.

Key Concept

Designing granular and secure Microsoft Entra ID Authentication and Conditional Access policies using authentication strengths, session controls, real-time evaluation, and application-level integration.
Estimated Time:3m 0s
Question 817Question →

Vortex Media is designing a governance and compliance strategy for its Azure environment. The resources are organized under a management group hierarchy. The company has the following key compliance requirements:

1. All virtual machines deployed in the production subscriptions must have the Azure Monitor agent installed and configured automatically during deployment.
2. In the development subscriptions, if a virtual machine is deployed without the Azure Monitor agent, it should be allowed to deploy but must be flagged as non-compliant for auditing purposes.
3. No resource groups in any subscription should be created without a 'CostCenter' tag. If the tag is missing, the deployment must be blocked. However, an exception must be made for the 'Sandbox-Subscriptions' management group, where tags are not enforced.

You need to recommend the Azure Policy design to meet these requirements with minimal administrative overhead. Which of the following recommendations should you include in the design? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Assign an Azure Policy with the DeployIfNotExists effect at the production management group scope to automatically deploy the Azure Monitor agent on virtual machines.; Assign an Azure Policy with the Deny effect to enforce the 'CostCenter' tag on resource groups at the root management group scope, and configure the 'Sandbox-Subscriptions' management group as an excluded scope (notScopes) in the policy assignment.

Answer

Assign an Azure Policy with the DeployIfNotExists effect at the production management group scope to automatically deploy the Azure Monitor agent, and assign a Deny policy for tag enforcement at the root management group scope while adding the Sandbox-Subscriptions management group to the assignment's excluded scopes (notScopes).
The correct recommendations involve using the DeployIfNotExists effect to automatically install the Azure Monitor agent on production virtual machines, and using the Deny effect at the root management group scope to block resource group creation without a 'CostCenter' tag, while excluding the Sandbox-Subscriptions management group using the notScopes property to minimize administrative overhead.

Step-by-Step Solution

1
Analyze the automatic agent installation requirement for production VMs.
Determine that DeployIfNotExists is the correct effect because it evaluates the resource and automatically runs a template deployment to install the agent if it is missing.
The requirement asks for automatic installation/remediation, which is the primary use case for DeployIfNotExists.
2
Analyze the tagging requirement with exceptions.
Determine that the Deny effect is appropriate to block resource group creation if the 'CostCenter' tag is missing, and notScopes is the most efficient way to exclude the entire Sandbox-Subscriptions management group.
Using notScopes at the policy assignment level avoids evaluation overhead and eliminates the need to manage individual exemptions.

Key Concept

Azure Policy effects and assignment scope exclusions
Question 818Question →

A multinational healthcare organization requires external vendor consultants to manage specific Azure resource groups containing protected health information (PHI) across multiple subscriptions. You are designing a privileged access solution that meets the following security requirements:
- Vendor consultants must only receive administrative permissions on-demand.
- Permission activation must require multi-factor authentication (MFA) and manager approval.
- The solution must minimize administrative overhead and scale as vendor personnel change.
- A strict tenant-wide Conditional Access policy must enforce MFA for all administrative roles, while ensuring that the organization's emergency access accounts are never locked out under any circumstance.

Which design strategy should you recommend to meet these requirements?

Show answer & explanation

Answer: Create a Microsoft Entra security group, assign the group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and exclude the emergency access accounts from the administrative MFA Conditional Access policy.

Answer

Create a Microsoft Entra security group, assign the group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and exclude the emergency access accounts from the administrative MFA Conditional Access policy.
The correct design uses a Microsoft Entra security group to manage the vendor accounts collectively, minimizing administrative overhead. By assigning the group as eligible in PIM for Azure resources, vendor consultants only obtain administrative access on-demand (just-in-time) after meeting the activation requirements such as MFA and approval. Excluding break-glass/emergency access accounts from the tenant-wide Conditional Access MFA policy ensures the tenant remains accessible in emergency situations while enforcing MFA for all other administrative access.

Step-by-Step Solution

1
Select the appropriate identity container for vendor administration.
A Microsoft Entra security group is defined to contain all external vendor consultant accounts.
Using a security group instead of individual accounts reduces administrative overhead and aligns with scalable governance practices.
2
Configure the access assignment type in Privileged Identity Management (PIM).
The security group is assigned to the required Azure RBAC roles in PIM as eligible rather than active.
An eligible assignment enforces just-in-time (JIT) administrative access, ensuring that permissions are only granted on-demand and are not permanently active.
3
Apply Conditional Access policy settings for administrative MFA.
A Conditional Access policy is designed to require MFA for administrative roles during role activation and session initiation.
This enforces strong authentication for privileged actions in compliance with security guidelines.
4
Secure emergency glass-breaker accounts from policy enforcement.
The organization's emergency access accounts are explicitly excluded from the MFA Conditional Access policy.
Excluding break-glass accounts ensures that administrators can access the tenant to resolve issues in the event of an MFA service disruption.

Key Concept

Designing scalable, just-in-time privileged access using Entra ID PIM group assignments and securing administrative sessions with Conditional Access while preventing tenant lockout.
Question 819Question →

A financial services firm plans to migrate its core transactional and reporting database system to Microsoft Azure. The system consists of three databases that regularly perform cross-database transactions and query each other using standard three-part naming conventions. The application requires SQL Server Agent for automated scheduling, database mail services, and must be deployed with private IP addresses within a dedicated Azure Virtual Network. The firm has a primary operational driver to minimize the administrative overhead of managing the underlying operating system and database clustering for high availability. Which database solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Azure SQL Managed Instance

Answer

Azure SQL Managed Instance
Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with the on-premises SQL Server database engine. It natively supports instance-level features such as SQL Server Agent, Database Mail, and cross-database queries using three-part names. It also integrates natively into an Azure Virtual Network to provide private IP addresses. As a fully managed Platform as a Service (PaaS), it offloads the administrative overhead of managing the operating system, backups, updates, and high-availability configuration.

Step-by-Step Solution

1
Analyze the migration compatibility and feature requirements.
The application requires SQL Server Agent, Database Mail, and cross-database queries using standard three-part names. This requires either SQL Server on Azure Virtual Machines or Azure SQL Managed Instance, as Azure SQL Database (single database or elastic pools) does not natively support these instance-scoped features.
Eliminate options that fail to support critical application capabilities.
2
Evaluate network isolation requirements.
The databases must be deployed with private IP addresses within a dedicated Azure Virtual Network. Both Azure SQL Managed Instance and SQL Server on Azure Virtual Machines natively support this configuration.
Ensure network security and routing policies are satisfied.
3
Apply the operational driver constraint to minimize administrative overhead.
SQL Server on Azure Virtual Machines is an IaaS service requiring the administrative management of OS patching, backups, and high availability clustering. Azure SQL Managed Instance is a fully managed PaaS service that automates these tasks, aligning with the primary goal.
Identify the solution that minimizes management overhead while meeting all technical requirements.

Key Concept

Selecting the appropriate Azure SQL relational database deployment option based on feature compatibility, networking requirements, and management overhead.
Question 820Question →

Apex Pharma has a multi-subscription Azure environment. The security team has the following compliance requirements for all resources in a production subscription:
1. Automatically apply a tag named 'SecurityReview' with the value 'Approved' to all newly created resource groups, without blocking the deployment if the tag is missing in the request.
2. Block the deployment of virtual machines that do not use Premium SSD storage, except for those deployed within a specific development resource group.

You need to design an Azure Policy solution to meet the requirements with the least administrative effort.

Which two of the following actions should you perform? (Select two)

Select all that apply

Show answer & explanation

Answer: Create a policy definition with the Modify effect and assign it to the production subscription to add the 'SecurityReview' tag.; Create a policy definition with the Deny effect, assign it to the production subscription, and add the development resource group to the assignment exclusions.

Answer

To meet the requirements, you should create a policy definition with the Modify effect to add the 'SecurityReview' tag, and create a policy definition with the Deny effect while adding the development resource group to the assignment exclusions.
The correct design uses the Modify effect to add the tag during resource creation without blocking the deployment request, and the Deny effect to block non-compliant VM deployments while exempting the development resource group by adding it to the policy assignment's excluded scopes.

Step-by-Step Solution

1
Analyze the tag requirement.
The requirement is to automatically apply a tag without blocking the deployment. The Modify effect is used to add, update, or remove properties/tags on resources during creation or update.
To select the correct policy effect for tagging.
2
Analyze the virtual machine storage requirement.
The requirement is to block the creation of non-compliant virtual machines. The Deny effect blocks the resource creation request if it does not match the policy rule.
To select the correct policy effect for enforcement.
3
Analyze the exclusion requirement.
The exclusion of a specific development resource group from the Deny policy can be achieved by adding the resource group's resource ID to the excluded scopes (notScopes) of the policy assignment.
To exempt specific resources from policy enforcement.

Key Concept

Azure Policy effects and assignment exclusions
PreviousPage 41 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin