Implement Management and Security Solutions

Your company has an Azure subscription.

You enable multi-factor authentication (MFA) for all users.

The company’s help desk reports an increase in calls from users who receive MFA requests while they work from the company’s main office.

You need to prevent the users from receiving MFA requests when they sign in from the main office.

What should you do?

You have an application named App1 that does not support Azure Active Directory (Azure AD) authentication.

You need to ensure that App1 can send messages to an Azure Service Bus queue. The solution must prevent App1 from listening to the queue.

What should you do?

An administrator plans to create a function app in Azure that will have the following settings:

• Runtime stack: .NET Core
• Operating System: Linux
• Plan type: Consumption
• Enable Application Insights: Yes

You need to ensure that you can back up the function app.

Which settings should you recommend changing before creating the function app?

You have 10 Azure virtual machines on a subnet named Subnet1. Subnet1 is on a virtual network named VNet1.

You plan to deploy a public Azure Standard Load Balancer named LB1 to the same Azure region as the 10 virtual machines.

You need to ensure that traffic from all the virtual machines to the internet flows through LB1. The solution must prevent the virtual machines from being accessible on the internet.

Which three actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You have SQL Server on an Azure virtual machine named SQL1.

You need to automate the backup of the databases on SQL1 by using Automated Backup v2 for the virtual machines. The backups must meet the following requirements:

• Meet a recovery point objective (RPO) of 15 minutes.
• Retain the backups for 30 days.
• Encrypt the backups at rest.

What should you provision as part of the backup solution?

You have an Azure subscription that contains an Azure key vault named KeyVault1 and the virtual machines shown in the following table.

KeyVault1 has an access policy that provides several users with Create Key permissions.

You need to ensure that the users can only register secrets in KeyVault1 from VM1.

What should you do?

You have resources in three Azure regions. Each region contains two virtual machines. Each virtual machine has a public IP address assigned to its network interface and a locally installed application named App1.

You plan to implement Azure Front Door-based load balancing across all the virtual machines.

You need to ensure that App1 on the virtual machines will only accept traffic routed from Azure Front Door.

What should you implement?

You have an Azure key vault named KV1.

You need to ensure that applications can use KV1 to provision certificates automatically from an external certification authority (CA).

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You create the following Azure role definition.

You need to create Role1 by using the role definition.

Which two values should you modify before you create Role1? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You are implementing authentication for applications in your company. You plan to implement self-service password reset (SSPR) and multifactor authentication (MFA) in Azure Active Directory (Azure AD).

You need to select authentication mechanisms that can be used for both MFA and SSPR.

Which two authentication methods should you use? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Your company has the groups shown in the following table.

The company has an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com.

An administrator named Admin1 attempts to enable Enterprise State Roaming for all the users in the Managers groups.

Admin1 reports that the options for Enterprise State Roaming are unavailable from Azure AD.

You verify that Admin1 is assigned the Global administrator role.

You need to ensure that Admin1 can enable Enterprise State Roaming.

What should you do?

You create the Azure resources shown in the following table.

You attempt to add a role assignment to a resource group as shown in the following exhibit

What should you do to ensure that you can assign VM2 the Reader role for the resource group?

You have Azure virtual machines deployed to three Azure regions. Each region contains a single virtual network that has four virtual machines on the same subnet. Each virtual machine runs an application named App1. App1 is accessible by using HTTPS. Currently, the virtual machines are inaccessible from the internet.

You need to use Azure Front Door to load balance requests for App1 across all the virtual machines.

Which additional Azure service should you provision?

You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table.

You need to ensure that all critical and security updates are applied to each virtual machine every month.

What is the minimum number of update deployments you should create?

You have an Azure subscription.

You create a custom role in Azure by using the following Azure Resource Manager template.

You assign the role to a user named User1.

Which action can User1 perform?

A company hosts virtual machines (VMs) in an on-premises datacenter and in Azure. The on-premises and Azure-based VMs communicate using ExpressRoute.

The company wants to be able to continue regular operations if the ExpressRoute connection fails. Failover connections must use the Internet and must not require Multiprotocol Label Switching (MPLS) support.

You need to recommend a solution that provides continued operations.

What should you recommend?

You have an Azure subscription that contains the resources shown in the following table.

Subnet1 is on VNET1. VM1 connects to Subnet1.

You plan to create a virtual network gateway on VNET1.

You need to prepare the environment for the planned virtual network gateway.

What are two ways to achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Your network contains an on-premises Active Directory and an Azure Active Directory (Azure AD) tenant.

You deploy Azure AD Connect and configure pass-through authentication.

Your Azure subscription contains several web apps that are accessed from the Internet.

You plan to use Azure Multi-Factor Authentication (MFA) with the Azure Active Directory tenant.

You need to recommend a solution to prevent users from being prompted for Azure MFA when they access the web apps from the on-premises network.

What should you include in the recommendation?

You create a new Azure subscription. You create a resource group named RG1. In RG1, you create the resources shown in the following table.

You need to configure an encrypted tunnel between your on-premises network and VNET1.

Which two additional resources should you create in Azure? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You plan to create an Azure Storage account named storage1 that will store blobs and be accessed by Azure Databricks.

You need to ensure that you can set permissions for individual blobs by using Azure Active Directory (Azure AD) authentication.

Which Advanced setting should you enable for storage1?

You have the following Azure Active Directory (Azure AD) tenants:

• Contoso.onmicrosoft.com: Linked to a Microsoft Office 365 tenant and syncs to an Active Directory forest named contoso.com by using password hash synchronization
• Contosoazure.onmicrosoft.com: Linked to an Azure subscription named Subscription1

You need to ensure that you can assign the users in contoso.com access to the resources in Subscription1.

What should you do?

You have several Azure web apps that use access keys to access databases.

You plan to migrate the access keys to Azure Key Vault. Each app must authenticate by using Azure Active Directory (Azure AD) to gain access to the access keys.

What should you create in Azure to ensure that the apps can access the access keys?

You have an Azure key vault named KV1.

You need to implement a process that will digitally sign the blobs stored in Azure Storage.

What is required in KV1 to sign the blobs?

You set the multi-factor authentication status for a user named [email protected] to Enabled.

Admin1 accesses the Azure portal by using a web browser.

Which additional security verifications can Admin1 use when accessing the Azure portal?