AZ-900 practice questions 181–190

1. Question 181 · 462 in bank

   Select 2

   Which two types of customers are eligible to use Azure Government to develop a cloud solution? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Aa Canadian government contractor
   • Ba European government contractor
   • Ca United States government entity
   • Da United States government contractor
   • Ea European government entity

   Show answer

   Answer: CD

   Explanation

   Azure Government is a cloud environment specifically built to meet compliance and security requirements for US government. This mission-critical cloud delivers breakthrough innovation to U.S. government customers and their partners. Azure Government applies to government at any level ג€" from state and local governments to federal agencies including Department of Defense agencies. The key difference between Microsoft Azure and Microsoft Azure Government is that Azure Government is a sovereign cloud. It's a physically separated instance of Azure, dedicated to U.S. government workloads only. It's built exclusively for government agencies and their solution providers. References: https://docs.microsoft.com/en-us/learn/modules/intro-to-azure-government/2-what-is-azure-government

   Source: Adapted from community discussion — techy

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 182 · 462 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. You have been informed by your superiors of the company's intentions to automate server deployment to Azure. There is, however, some concern that administrative credentials could be uncovered during this process. You are required to make sure that during the deployment, the administrative credentials are encrypted using a suitable Azure solution. Solution: You recommend the use of Azure Multi-Factor Authentication (MFA). Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   No, the recommended solution of Azure Multi-Factor Authentication (MFA) does not encrypt administrative credentials during server deployment to Azure. MFA is a solution that adds an additional layer of authentication to the login process, and it can help prevent unauthorized access to resources. To encrypt administrative credentials during server deployment to Azure, a better solution would be to use Azure Key Vault. Azure Key Vault is a cloud-based service that provides secure storage of keys, secrets, and certificates. By storing the administrative credentials in Azure Key Vault, they can be encrypted and protected from unauthorized access.

   Source: Adapted from community discussion — BeauChateau

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 183 · 462 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - It is not true that you must deploy a federation solution or sync on-premises identities to the cloud. You can have a cloud-only environment and use MFA. Box 2: No - Picture identification and passport numbers are not valid MFA authentication methods. Valid methods include: Password, Microsoft Authenticator App, SMS and Voice call. Box 3: You can configure MFA to be required for administrator accounts only or you can configure MFA for any user account. Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods

   Source: Adapted from community discussion — NareshNK

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 184 · 462 in bank

   You need to ensure that when Azure Active Directory (Azure AD) users connect to Azure AD from the Internet by using an anonymous IP address, the users are prompted automatically to change their password. Which Azure service should you use?

   • AAzure AD Connect Health
   • BAzure AD Privileged Identity Management
   • CAzure Advanced Threat Protection (ATP)
   • DAzure AD Identity Protection

   Show answer

   Answer: D

   Explanation

   D > Azure AD Identity Protection "Identity Protection is a tool that allows organizations to accomplish three key tasks: Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal. Export risk detection data to third-party utilities for further analysis."

   Source: Adapted from community discussion — SoniaA

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 185 · 462 in bank

   DRAG DROP - Match the term to the correct definition. Instructions: To answer, drag the appropriate term from the column on the left to its description on the right. Each term may be used once, more than once, or not at all. NOTE: Each correct match is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: ISO - ISO is the International Organization for Standardization. Companies can be certified to ISO standards, for example ISO 9001 or 27001 are commonly used in IT companies. Box 2: NIST - The National Institute of Standards and Technology (NIST) is a physical sciences laboratory, and a non-regulatory agency of the United States Department of Commerce. Box 3: GDPR - GDPR is the General Data Protection Regulations. This standard was adopted across Europe in May 2018 and replaces the now deprecated Data Protection Directive. The General Data Protection Regulation (EU) (GDPR) is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA areas. The GDPR aims primarily to give control to individuals over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. Box 4: Azure Government - US government agencies or their partners interested in cloud services that meet government security and compliance requirements, can be confident that Microsoft Azure Government provides world-class security, protection, and compliance services. Azure Government delivers a dedicated cloud enabling government agencies and their partners to transform mission-critical workloads to the cloud. Azure Government services handle data that is subject to certain government regulations and requirements, such as FedRAMP, NIST 800.171 (DIB), ITAR, IRS 1075, DoD L4, and CJIS. In order to provide you with the highest level of security and compliance, Azure Government uses physically isolated datacenters and networks (located in U.S. only). References: https://en.wikipedia.org/wiki/National_Institute_of_Standards_and_Technology https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://docs.microsoft.com/en-us/azure/azure-government/documentation-government-welcome

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 186 · 462 in bank

   To what should an application connect to retrieve security tokens?

   • Aan Azure Storage account
   • BAzure Active Directory (Azure AD)
   • Ca certificate store
   • Dan Azure key vault

   Show answer

   Answer: B

   Explanation

   The answer B is correct, because it asks what "an application should connect to". An Application cannot connect to a Key Vault.

   Source: Adapted from community discussion — RTT1976

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 187 · 462 in bank

   Your network contains an Active Directory forest. The forest contains 5,000 user accounts. Your company plans to migrate all network resources to Azure and to decommission the on-premises data center. You need to recommend a solution to minimize the impact on users after the planned migration. What should you recommend?

   • AImplement Azure Multi-Factor Authentication (MFA)
   • BSync all the Active Directory user accounts to Azure Active Directory (Azure AD)
   • CInstruct all users to change their password
   • DCreate a guest user account in Azure Active Directory (Azure AD) for each user

   Show answer

   Answer: B

   Explanation

   To migrate to Azure and decommission the on-premises data center, you would need to create the 5,000 user accounts in Azure Active Directory. The easy way to do this is to sync all the Active Directory user accounts to Azure Active Directory (Azure AD). You can even sync their passwords to further minimize the impact on users. The tool you would use to sync the accounts is Azure AD Connect. The Azure Active Directory Connect synchronization services (Azure AD Connect sync) is a main component of Azure AD Connect. It takes care of all the operations that are related to synchronize identity data between your on-premises environment and Azure AD. References: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-whatis

   Source: Adapted from community discussion — Ragijo

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 188 · 462 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - You can send Azure AD activity logs to Azure Monitor logs to enable rich visualizations, monitoring and alerting on the connected data. All data collected by Azure Monitor fits into one of two fundamental types, metrics and logs (including Azure AD activity logs). Activity logs record when resources are created or modified. Metrics tell you how the resource is performing and the resources that it's consuming. Box 2: Yes - Azure Monitor can consolidate log entries from multiple Azure resources, subscriptions, and tenants into one location for analysis together. Box 3: Yes - You can create alerts in Azure Monitor. Alerts in Azure Monitor proactively notify you of critical conditions and potentially attempt to take corrective action. Alert rules based on metrics provide near real time alerting based on numeric values, while rules based on logs allow for complex logic across data from multiple sources. References: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor https://docs.microsoft.com/en-us/azure/azure-monitor/overview

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 189 · 462 in bank

   HOTSPOT - You create a resource group named RG1 in Azure Resource Manager. You need to prevent the accidental deletion of the resources in RG1. Which setting should you use? To answer, select the appropriate setting in the answer area. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You can configure a lock on a resource group to prevent the accidental deletion. As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively. ✑ CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource. ✑ ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 190 · 462 in bank

    You have a resource group named RG1. You need to prevent the creation of virtual machines in RG1. The solution must ensure that other objects can be created in RG1. What should you use?

    • Aa lock
    • Ban Azure role
    • Ca tag
    • Dan Azure policy

    Show answer

    Answer: D

    Explanation

    D is the answer. https://learn.microsoft.com/en-us/azure/governance/policy/overview#policy-definition The journey of creating and implementing a policy in Azure Policy begins with creating a policy definition. Every policy definition has conditions under which it's enforced. And, it has a defined effect that takes place if the conditions are met. In Azure Policy, we offer several built-in policies that are available by default. For example: - Not allowed resource types (Deny): Prevents a list of resource types from being deployed.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-900 practice, question 181. 462 questions available.