AZ-900 practice questions 161–170

1. Question 161 · 462 in bank

   You need to configure an Azure solution that meets the following requirements: ✑ Secures websites from attacks ✑ Generates reports that contain details of attempted attacks What should you include in the solution?

   • AAzure Firewall
   • Ba network security group (NSG)
   • CAzure Information Protection
   • DDDoS protection

   Show answer

   Answer: D

   Explanation

   Firewall and NSG BOTH Allow/Deny. The difference between them is (mainly among other things) : FIREWALL = acts as a defence in depth PERIMETER (OUTSIDE the virtual network) filter = between a virtual network and the outside world NSG : acts as a defence in depth NETWORK/SUBNET (INSIDE/WITHIN the virtual network filter) = at the resources level Please correct me if I am wrong. https://docs.microsoft.com/en-us/learn/modules/secure-network-connectivity-azure/

   Source: Adapted from community discussion — Mozbius_

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 162 · 462 in bank

   HOTSPOT - You plan to implement several security services for an Azure environment. You need to identify which Azure services must be used to meet the following security requirements: ✑ Monitor threats by using sensors ✑ Enforce Azure Multi-Factor Authentication (MFA) based on a condition Which Azure service should you identify for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: To monitor threats by using sensors, you would use Azure Advanced Threat Protection (ATP). Azure Advanced Threat Protection (ATP) is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Sensors are software packages you install on your servers to upload information to Azure ATP. Box 2: To enforce MFA based on a condition, you would use Azure Active Directory Identity Protection. Azure AD Identity Protection helps you manage the roll-out of Azure Multi-Factor Authentication (MFA) registration by configuring a Conditional Access policy to require MFA registration no matter what modern authentication app you are signing in to. References: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/what-is-atp https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy

   Source: Adapted from community discussion — fgrion

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 163 · 462 in bank

   Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1. The company has users that work remotely. The remote workers require access to the VMs on VNet1. You need to provide access for the remote workers. What should you do?

   • AConfigure a Site-to-Site (S2S) VPN.
   • BConfigure a VNet-toVNet VPN.
   • CConfigure a Point-to-Site (P2S) VPN.
   • DConfigure DirectAccess on a Windows Server 2012 server VM.
   • EConfigure a Multi-Site VPN

   Show answer

   Answer: C

   Explanation

   Correct Answer. A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. ... P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet.

   Source: Adapted from community discussion — BinuRaj

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 164 · 462 in bank

   Your Azure environment contains multiple Azure virtual machines. You need to ensure that a virtual machine named VM1 is accessible from the Internet over HTTP. What are two possible solutions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AModify an Azure Traffic Manager profile
   • BModify a network security group (NSG)
   • CModify a DDoS protection plan
   • DModify an Azure firewall

   Show answer

   Answer: B

   Explanation

   So can somebody tell me why I spent moneyon examtopics.com when there are ERRORS ALL OVER THE PLACE?? How is that helping in testing / learning and not cause more confusion?!?

   Source: Adapted from community discussion — Mozbius_

   Next question

5. Question 165 · 462 in bank

   HOTSPOT - To complete the sentence, select the appropriate option in the answer area. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The just-in-time (JIT) virtual machine (VM) access feature in Azure Security Center allows you to lock down inbound traffic to your Azure Virtual Machines. This reduces exposure to attacks while providing easy access when you need to connect to a VM. Reference: https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time?tabs=jit-config-asc%2Cjit-request-asc

   Source: Adapted from community discussion — Meyti

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 166 · 462 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

   Source: Adapted from community discussion — hercu

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 167 · 462 in bank

   You have an Azure environment that contains 10 virtual networks and 100 virtual machines. You need to limit the amount of inbound traffic to all the Azure virtual networks. What should you create?

   • Aone application security group (ASG)
   • B10 virtual network gateways
   • C10 Azure ExpressRoute circuits
   • Done Azure firewall

   Show answer

   Answer: D

   Explanation

   NSG just block or open a port, Azure Firewall can "limit the amount of traffic", because it's a stateful firewall. So the answer is Azure Firewall (

   Source: Adapted from community discussion — Ragijo

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 168 · 462 in bank

   This question requires that you evaluate the underlined text to determine if it is correct. Azure Key Vault is used to store secrets for Azure Active Directory (Azure AD) user accounts. Instructions: Review the underlined text. If it makes the statement correct, select `No change is needed`. If the statement is incorrect, select the answer choice that makes the statement correct.

   • ANo change is needed
   • BAzure Active Directory (Azure AD) administrative accounts
   • CPersonally Identifiable Information (PII)
   • Dserver applications

   Show answer

   Answer: D

   Explanation

   I think that underlined text in the phrase is: "...Azure Active Directory (Azure AD) user accounts." so if you read the "Important" section in the link https://docs.microsoft.com/en-us/learn/modules/manage-secrets-with-azure-key-vault/2-what-is-key-vault You can read: "Key Vault is designed to store configuration secrets for server apps."

   Source: Adapted from community discussion — MCLC2021

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 169 · 462 in bank

   You plan to deploy several Azure virtual machines. You need to control the ports that devices on the Internet can use to access the virtual machines. What should you use?

   • Aa network security group (NSG)
   • Ban Azure Active Directory (Azure AD) role
   • Can Azure Active Directory group
   • Dan Azure key vault

   Show answer

   Answer: A

   Explanation

   A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager) A is the correct answer.

   Source: Adapted from community discussion — Sandy4912

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 170 · 462 in bank

    HOTSPOT - To complete the sentence, select the appropriate option in the answer area. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    When you create a virtual machine, the default setting is to create a Network Security Group attached to the network interface assigned to a virtual machine. A network security group works like a firewall. You can attach a network security group to a virtual network and/or individual subnets within the virtual network. You can also attach a network security group to a network interface assigned to a virtual machine. You can use multiple network security groups within a virtual network to restrict traffic between resources such as virtual machines and subnets. You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. In this question, we need to add a rule to the network security group to allow the connection to the virtual machine on port 8080. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-900 practice, question 161. 462 questions available.