QUESTION 24
Hotspot Question
You have a Microsoft Entra tenant that contains the users shown in the following table.

You have a location named HQ-Trusted that contains the IP address of the corporate network.
The tenant contains a Conditional Access policy named CA1 that has the following settings:
Assignments:

– Users or agents:
— Include: All users
— Exclude: Group1
Target resources:

– Resources (formerly cloud apps):
— Include: Office 365
Conditions:

– Client apps: Not configured
Access controls:

– Grant:
— Require multifactor authentication
– Grant:
— Require device to be marked as compliant
– For multiple controls:
— Require all the selected controls
The tenant contains a Conditional Access policy named CA2 that has the following settings:
Assignments:

– Users or agents:
— Include: All users
— Exclude: Group2
Target resources:

– Resources (formerly cloud apps):
— Include: All resources
Conditions:

– Locations:
— Configure: Yes
— Include: Any network or location
— Exclude: HQ-Trusted
Access controls:

– Grant:
— Block access
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

QUESTION 25
Your organization is deploying several generative AI applications that use Azure AI services.
Security administrators want to ensure that prompts and responses containing sensitive information are identified and monitored before they leave the organization’s environment. Which solution should be implemented first?

QUESTION 26
A company uses Microsoft Entra ID and has enabled Conditional Access. Administrators want to reduce the risk of token theft by requiring users to authenticate with phishing-resistant methods when accessing sensitive AI workloads. Which authentication method best satisfies this requirement?

QUESTION 27
You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1.
You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.
You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1.
The solution must minimize administrative effort.
What should you use?

QUESTION 28
You have a Microsoft Entra tenant.
You need to implement password less authentication. The solution must meet the following requirements:
*Users can sign in without a password by using a mobile device.
*New users that sign in for the first time must use a helpdesk issued sign in method that expires.
Which authentication method should you enable for each requirement? To answer, drag the appropriate methods to the correct requirements. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

QUESTION 29
You have a Microsoft Security Copilot workspace named Workspace1 that is used by Security Operations Center (SOC) analysts and security administrators.
The SOC analysts use only the Security Copilot standalone experience, and the security administrators access Security Copilot from the Microsoft Defender portal.
A new Security Copilot workspace named Workspace2 is created for the security administrators.
Workspace2 is assigned a capacity of five security compute units.
You need to ensure that Security Copilot usage for the SOC analysts is allocated to Workspace1 and Security Copilot usage for the security administrators is allocated to Workspace2.
What should you do?

QUESTION 30
Case Study 1 – Contoso, Ltd.
Overview
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1.
Existing Environment. Microsoft Entra tenant
Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.

Existing Environment. On-premises environment
The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server.
Existing Environment. Azure subscription
Sub1 contains the storage accounts shown in the following table.

Sub1 contains the virtual networks shown in the following table.

Sub1 contains the virtual machines shown in the following table.

The network interface of VM1 is associated with an application security group named ASG1.
Sub1 contains the resources shown in the following table.

Vault1 stores the objects shown in the following table.

Existing Environment. Privileged Identity Management (PIM) configuration You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.

Existing Environment. Microsoft Sentinel configuration
Contoso has a Microsoft Sentinel workspace that contains the following tables.

Requirements. Planned changes
Contoso plans to implement the following changes:
– Integrate AKS1 with Vault1.
– Enable Microsoft Entra Kerberos authentication for all supported
storage.
– Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location.
Requirements. Technical requirements
Contoso identifies the following technical requirements:
– Protect Server1 by using file integrity monitoring.
– Protect AKS1 by using Microsoft Defender for Cloud.
– Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier.
– Store objects used for authentication and encryption in Vault1 and
ensure that Vault1 regenerates the objects every 30 days, whenever
possible.
Hotspot Question
User1 has requested to use the AI Administrator role.
Which approvers can approve the request, and how long will User1 be an AI administrator after the role is approved? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 31
You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance. Sub1 has Microsoft Defender for Cloud enabled.
You need to configure Microsoft Defender for Databases to minimize costs.
Which Defender plan should you enable?

QUESTION 32
Case Study 2 – Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
– Bot Manager 1.1
– Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
– NIST SP 800-53 Rev. 4
– Microsoft cloud security benchmark (MCSB)
– System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
– Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region

AKV3 in the Central US Azure region

AKV4 in the East US Azure region

– Deploy the following key vaults to RG2:
AKV5 in the East US region

– Configure VM1 to read data from storage1.
– Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan

Fa2: Consumption hosting plan

Fa3: Dedicated hosting plan

– For WAF1, implement rate limiting rules based on the request
location.
– Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
– Create a new storage account named storage2 that supports Azure Table storage.
– Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
– Implement ExpressRoute circuits to the on-premises network as shown
in the following table.

– For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
– If VM1 is deleted, the permissions for VM1 must be removed
automatically.
– The AKS1 managed identity must only be able to pull images from
Registry1.
– The ID1 managed identity must be able to push images to and pull
images from Registry1.
– All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
– All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
– ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You implement the planned changes for the key vaults. To which key vaults can you restore AKV1 backups?

QUESTION 33
You have an Azure Storage account named storage1 that hosts a blob container named container1.
You have an Azure Functions app named app1 that uses a managed identity.
You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.
What should you do?

QUESTION 34
An organization is evaluating the security of AI-generated content before it is presented to end users. The goal is to detect harmful, unsafe, or policy-violating responses automatically. Which capability should be prioritized?

QUESTION 35
You are configuring a new Microsoft Sentinel workspace named Workspace1.
You have an external IT Service Management (ITSM) system that is NOT supported by any Microsoft Sentinel solutions in Azure Marketplace.
You need to ensure that Workspace1 creates service tickets in the ITSM system for all new security incidents.
What should you create?

QUESTION 36
Hotspot Question
You have an Azure subscription that contains the following servers:
– 200 virtual machines that run either Windows Server or Ubuntu Server
– 50 Azure Arc-enabled servers
You use Azure Policy to manage compliance across all the servers.
You need to enforce an organization-specific security baseline. The solution must meet the following requirements:
– Customize a built-in security baseline.
– Ensure that configuration changes to the servers are enforced
automatically after the security baseline is deployed.
– Minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 37
You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
*Elevated access must be evaluated by another administrator before it is granted
*Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

QUESTION 38
You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1.
You enable content trust for ContReg1.
You need to ensure that User1 can create trusted images in ContReg1 The solution must use the principle of least privilege.
Which two roles should you assign to User1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

QUESTION 39
You use Microsoft Security Copilot.
Security Copilot contributors currently create custom plugins for their own sessions and manage organization-wide custom plugins.
You need to prevent the contributors from managing the organization-wide custom plugins. The solution must NOT affect the contributors’ ability to create custom plugins for their own sessions.
What should you select in the Plugin settings?

QUESTION 40
You need to implement the function apps to meet the technical requirements.
Which apps should you include in the implementation?

QUESTION 41
You have a Microsoft 365 tenant that has Microsoft 365 Copilot enabled for a pilot group.
Users frequently generate responses based on Microsoft Teams chats and Microsoft SharePoint Online sites.
You use Microsoft Purview Data Security Posture Management (DSPM) to identify oversharing risks and create policies based on the recommendations.
You need to manage and edit the policies created by DSPM.
Which Microsoft Purview solution should you use?

QUESTION 42
You have an Azure SQL Database logical server named Server1 that contains multiple databases.
The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases.
You need to ensure that SQL authentication is denied for connections.
What should you do?

QUESTION 43
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create an analytics rule.
Does this meet the goal?

QUESTION 44
You have an Azure subscription named Sub1 that contains 50 virtual machines. Sub1 has Microsoft Defender for Cloud enabled.
Sub1 contains an Azure key vault named KV1 and an Azure policy that enforces storing all secrets in KV1.
Occasionally, the developers at your company store plaintext tokens and SSH private keys on the virtual machines.
You need to configure Defender for Cloud to detect plaintext secrets on the virtual machines. The solution must minimize administrative changes to the virtual machines.
How should you configure Defender for Cloud? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point.

QUESTION 45
You have an Azure subscription named Sub1 that contains multiple virtual machines. Sub1 has the Microsoft Defender Cloud Security Posture Management (CSPM) plan enabled.
You discover that Defender for Cloud falls to identify plaintext connection strings and SSH keys stored on the virtual machines.
You need to ensure that secrets can be identified on the virtual machines.
What should you do?

QUESTION 46
You have a Microsoft Entra tenant that contains the users shown in the following table.

You have a Microsoft Security Copilot workspace.
From Microsoft Security Store, you plan to deploy a partner-built agent named Agent1 that requires access to Microsoft Intune.
When User1 selects Agent1, the Get agent option is unavailable.
You need to enable User1 to complete the agent setup. The solution must follow the principle of least privilege.
What should you do first?

QUESTION 47
You have an Azure subscription named Sub1 that contains multiple virtual machines. Sub1 has the Microsoft Defender Cloud Security Posture Management (CSPM) plan enabled.
You discover that Defender for Cloud fails to identify plaintext connection strings and SSH keys stored on the virtual machines.
You need to ensure that secrets can be identified on the virtual machines.
What should you do?

QUESTION 48
You have an Azure subscription that contains the virtual machines shown in the following table.

All the virtual networks are peered.
You deploy Azure Bastion to VNET2.
Which virtual machines can be protected by the bastion host?