AZ-900 practice questions 131–140

1. Question 131 · 462 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's developers intend to deploy a large number of custom virtual machines on a weekly basis. They will also be removing these virtual machines during the same week it was deployed. Sixty percent of the virtual machines have Windows Server 2016 installed, while the other forty percent has Ubuntu Linux installed. You are required to make sure that the administrative effort, needed for this process, is reduced by employing a suitable Azure service. Solution: You recommend the use of Microsoft Managed Desktop. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Answer correct. It is not Microsoft Managed Desktop. Welcome to Microsoft Managed Desktop Microsoft Managed Desktop brings together Microsoft 365 Enterprise, cloud-based device management by Microsoft, and security monitoring, enabling you to free your IT team to focus on core business needs. Currently, the Microsoft Managed Desktop service is offered only by invitation. Learn more on Microsoft docs or contact your Microsoft account manager. If you’re unfamiliar with Microsoft Managed Desktop, learn more about the service.

   Source: Adapted from community discussion — BinuRaj

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 132 · 462 in bank

   Which service provides network traffic filtering across multiple Azure subscriptions and virtual networks?

   • AAzure Firewall
   • Ban application security group
   • CAzure DDoS protection
   • Da network security group (NSG)

   Show answer

   Answer: A

   Explanation

   You can restrict traffic to multiple virtual networks in multiple subscriptions with a single Azure firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Azure Firewall uses a static public IP address for your virtual network resources allowing outside firewalls to identify traffic originating from your virtual network. References: https://docs.microsoft.com/en-us/azure/firewall/overview

   Source: Adapted from community discussion — Min_Thu

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 133 · 462 in bank

   Which Azure service should you use to store certificates?

   • AAzure Security Center
   • Ban Azure Storage account
   • CAzure Key Vault
   • DAzure Information Protection

   Show answer

   Answer: C

   Explanation

   Certificate Management - Azure Key Vault is also a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with Azure and your internal connected resources

   Source: Adapted from community discussion — MartinMystere

   Next question

4. Question 134 · 462 in bank

   Which Azure service can you use as a security information and event management (SIEM) solution?

   • AAzure Analysis Services
   • BAzure Sentinel
   • CAzure Information Protection
   • DAzure Cognitive Services

   Show answer

   Answer: B

   Explanation

   Reference: https://azure.microsoft.com/en-in/services/azure-sentinel/

   Source: Adapted from community discussion — Edittler

   Next question

5. Question 135 · 462 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/overview

   Source: Adapted from community discussion — wendyy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   

   Next question

6. Question 136 · 462 in bank

   DRAG DROP - Match the Azure Services service to the correct descriptions. Instructions: To answer, drag the appropriate service from the column on the left to its description on the right. Each service may be used once, more than once, or not at all. NOTE: Each correct match is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   Box 1: Azure Sentinel - Box 2: Azure Security Center - Box 3: Azure Key Vault - ✑ Azure Active Directory (Azure AD) Azure AD is an identity and access management service, which helps your employees sign in and access resources ✑ Azure Lighthouse Azure Lighthouse is used for cross- and multi-tenant management. Reference: https://docs.microsoft.com/en-us/azure/sentinel/overview https://docs.microsoft.com/en-us/azure/security-center/secure-score-security-controls https://practical365.com/securing-sensitive-information-in-azure-functions-with-the-azure-key-vault/ https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis https://docs.microsoft.com/en-us/azure/lighthouse/overview

   Source: Adapted from community discussion — xian05

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 137 · 462 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Azure firewall does not encrypt network traffic. It is used to block or allow traffic based on source/destination IP address, source/destination ports and protocol. Box 2: No - A network security group does not encrypt network traffic. It works in a similar way to a firewall in that it is used to block or allow traffic based on source/ destination IP address, source/destination ports and protocol. Box 3: No - The question is rather vague as it would depend on the configuration of the host on the Internet. Windows Server does come with a VPN client and it also supports other encryption methods such IPSec encryption or SSL/TLS so it could encrypt the traffic if the Internet host was configured to require or accept the encryption. However, the VM could not encrypt the traffic to an Internet host that is not configured to require the encryption. Reference: https://docs.microsoft.com/en-us/azure/security/azure-security-data-encryption-best-practices#protect-data-in-transit

   Source: Adapted from community discussion — hercu

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 138 · 462 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - Azure Security Center is a unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud - whether they're in Azure or not - as well as on premises. Box 2: No - Only two features: Continuous assessment and security recommendations, and Azure secure score, are free. Box 3: Yes - The advanced monitoring capabilities in Security Center also let you track and manage compliance and governance over time. The overall compliance provides you with a measure of how much your subscriptions are compliant with policies associated with your workload. References: https://docs.microsoft.com/en-us/azure/security-center/security-center-intro

   

   Next question

9. Question 139 · 462 in bank

   DRAG DROP - You need to complete the defense-in-depth strategy used in a datacenter. What should you do? To answer, drag the appropriate layers to the correct positions in the model. Each layer may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Defence in depth layers (from bottom to top): ✑ Data - In almost all cases attackers are after data. - Data can be in database, stored on disk inside VMs, on a SaaS application such as Office 365 or in cloud storage. - Those storing and controlling access to data to ensures that it's properly secured - Often regulatory requirements dictates controls & processes - to ensure confidentiality, integrity, and availability. ✑ Application - Ensure applications are secure and free of vulnerabilities. - Store sensitive application secrets in a secure storage medium. - Make security a design requirement for all application development. - Integrate security into the application development life cycle. ✑ Compute - Secure access to virtual machines. - Implement endpoint protection and keep systems patched and current. - Malware, unpatched systems, and improperly secured systems open your environment to attacks. ✑ Networking - Limit communication between resources. - Deny by default. - Allow only what is required - Restrict inbound internet access and limit outbound, where appropriate. - Implement secure connectivity to on-premises networks. ✑ Perimeter - Use distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for end users. - Use perimeter firewalls to identify and alert on malicious attacks against your network. ✑ Identity and access - Control access to infrastructure and change control. - Access granted is only what is needed - Use single sign-on and multi-factor authentication. - Audit events and changes. ✑ Physical security - Building security & controlling access to computing hardware. - First line of defense. Reference: https://github.com/undergroundwires/Azure-in-bullet-points/blob/master/AZ-900%20Microsoft%20Azure%20Fundamentals/4.2.%20Defence%20in%20Depth.md

   Source: Adapted from community discussion — AlexKK

   References

   • Microsoft Learn

   

   Next question

10. Question 140 · 462 in bank

    You have an Azure virtual machine named VM1. You plan to encrypt VM1 by using Azure Disk Encryption. Which Azure resource must you create first?

    • Aan Azure Storage account
    • Ban Azure Key Vault
    • Can Azure Information Protection policy
    • Dan Encryption key

    Show answer

    Answer: B

    Explanation

    Azure Disk Encryption uses Azure Key Vault to manage the disk encryption keys and secrets. You must create an Azure Key Vault before you can encrypt an Azure virtual machine using Azure Disk Encryption. The Key Vault is used to store the encryption keys and secrets, and it provides a central location for managing and securing these keys. Once you have created the Key Vault, you can then enable disk encryption on the virtual machine and specify the Key Vault as the location for the encryption keys.

    Source: Adapted from community discussion — Bereket

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-900 practice, question 131. 462 questions available.