Q1.You operate a Microsoft Azure subscription that contains a custom application named Application1.
Application1 was developed by an external company named Fabrikam, Ltd.
Fabrikam’s developers are granted role-based access control (RBAC) permissions to the individual components of Application1.
All users are assigned a Microsoft 365 E5 plan license.
You need to propose a solution to verify whether Fabrikam’s developers still require access to Application1.
The solution must meet the following requirements.
Send an email listing access rights to Application1 to each developer’s manager every month.
If a manager does not verify the access rights, automatically revoke those rights.
Minimize development effort.
What should you propose?
Show answer
The requirement is to send a monthly review request to managers and automatically revoke rights if they are not verified.
With Microsoft Entra ID (formerly Azure AD) access reviews, you can set up recurring reviews targeting enterprise apps or role assignments, send a notification (email) at the start, and remove access for unapproved users through automatic application of results.
Because operation is completed mainly through configuration, it can minimize implementation work on the developer side.
What are access reviews
Create an access review of groups and applications in Microsoft Entra ID
Q2.You operate a Microsoft Entra ID tenant that is synchronized with an on-premises Active Directory domain.
An internal web app named WebApp1 is hosted on-premises, and WebApp1 uses Integrated Windows Authentication.
Some employees work from home and have no way to VPN into the internal network.
You need to provide single sign-on (SSO) access to WebApp1 for these remote workers.
Which two features should you include in the solution?
Show answer
To securely publish the on-premises internal web app without using a VPN while also achieving SSO, you use Microsoft Entra application proxy to relay communication with a cloud-side service and an on-premises-side connector.
Furthermore, you register WebApp1 as an enterprise application in Entra ID and configure SSO (for Integrated Windows Authentication, use Kerberos constrained delegation and the like as needed).
PIM, Arc, or Application Gateway alone cannot meet the requirement to “provide SSO without a VPN.”
Microsoft Entra application proxy
Add an on-premises application to Microsoft Entra ID
Q3.For an Azure subscription, you need to propose a solution that compiles a monthly report of the deployment status of all newly created Azure Resource Manager (ARM) resources.
What should the recommendation include?
Show answer
Within a subscription, “when, who, and what was deployed/created” can be tracked in the activity log (platform log), but because the retention period is limited, it is not sufficient for monthly reporting purposes.
Therefore, it is appropriate to use diagnostic settings to send the activity log to Azure Monitor Logs (backed by a Log Analytics workspace) to accumulate it, and aggregate deployment (Microsoft.Resources/deployments/write) and resource creation events with KQL.
Application Insights is for app observability, and Arc and Analysis Services serve different purposes.
Azure Monitor activity log
Diagnostic settings in Azure Monitor
Log Analytics workspace overview
Q4.A security group named Group1 exists in the Microsoft Entra ID (formerly Azure Active Directory: Azure AD) tenant of contoso.com.
Group1 is configured with assigned membership and has a total of 50 members registered (20 of whom are external guest users).
You need to propose a solution to periodically review the membership of Group1.
The review must recur automatically every 3 months, all members must be able to self-attest whether they need to remain, and users who respond that they are not needed as well as users who do not respond must be automatically removed from Group1.
What should the recommendation include?
Show answer
The requirements are “quarterly periodic evaluation,” “self-attestation by all members including guests,” and “automatic removal of those not needed or non-responders.”
Microsoft Entra ID (formerly Azure AD) access reviews can set up a recurring review every 3 months targeting group membership and designate the members themselves as reviewers.
Furthermore, through automatic application of results, you can automatically remove users who deny (not needed) or do not respond from the group, minimizing operational overhead.
What are access reviews
Create an access review of groups and applications in Microsoft Entra ID
Manage user access with Microsoft Entra access reviews
Q5.You plan to deploy an Azure App Service web app that places multiple instances across multiple Azure regions.
You need to propose a load balancing service for this deployment.
The solution must maintain reachability to the app even if a failure occurs in one region, and must support Azure Web Application Firewall (WAF), cookie-based affinity, and URL routing.
What should the recommendation include?
Show answer
The requirement is to meet “global (multi-region) failover,” “WAF,” “cookie-based session persistence,” and “URL (path)-based routing” through a single entry point.
Azure Front Door, as a global L7 (HTTP/HTTPS) load balancer, can provide WAF integration, cookie-based session affinity, and URL path-based routing.
Because Traffic Manager is DNS-based and does not have WAF or cookie/URL routing capabilities, it cannot meet the conditions of this question on its own.
Azure Front Door frequently asked questions (FAQ)
Traffic routing methods to the origin
Web Application Firewall (WAF) on Azure Front Door
Q6.A company with offices in New York, Sydney, Paris, and Johannesburg jointly uses a single Azure subscription.
The company plans to deploy a new Azure network solution that meets the following requirements.
Connect to an ExpressRoute circuit in the East US Azure region.
Provide connectivity in three regions—Southeast Asia, North Europe, and South Africa—while minimizing latency.
Support site-to-site VPN connections.
Minimize costs.
You need to determine the minimum number of Azure Virtual WAN hubs to deploy and the Virtual WAN SKU to adopt.
Show answer
To minimize latency, placing a virtual hub in each of the three regions where you want to provide connectivity (Southeast Asia, North Europe, and South Africa) is the minimal configuration, which comes to three hubs.
Also, a Basic Virtual WAN/hub is limited to the site-to-site VPN feature and does not support ExpressRoute.
Because this requirement includes both ExpressRoute and site-to-site VPN, the Standard SKU is required.
Upgrade a Virtual WAN from Basic to Standard
Tutorial: Create an ExpressRoute association to Virtual WAN – Azure portal
About virtual hub settings
Q7.You plan to deploy an infrastructure solution with the following configuration.
External users access the infrastructure through Azure Front Door.
External user access to a backend API hosted on Azure Kubernetes Service (AKS) is controlled by Azure API Management.
External users are authenticated in an Azure AD B2C tenant that uses OpenID Connect-based federation with a third-party identity provider.
Which function does each service perform?
Assign the appropriate function to the correct service.
Drag each option to the matching requirement’s drop zone, or tap to place it. Click a filled zone to send it back. (The same option may be used more than once.)
Applies IP filtering on a per-API basis.
Validates JSON Web Tokens (JWT) issued by Azure AD B2C.
Show answer
Azure Front Door integrates with WAF and can provide protection at the edge against common attacks and vulnerabilities based on rule sets such as the OWASP ruleset (CRS).
On the other hand, to reliably validate tokens issued by Azure AD B2C (now Microsoft Entra External ID) on the API gateway side, it is appropriate to validate the JWT with the validate-jwt policy in API Management.
Therefore, assign OWASP protection to Front Door and JWT validation to API Management.
Web Application Firewall (WAF) on Azure Front Door
Validate JWT
Overview of Microsoft Entra External ID
Q8.You have a resource group named RG1 that contains the objects shown in the following table.
You need to configure permissions so that App1 can copy all secrets in KV1 to KV2.
Currently, App1 is granted the Get permission on the secrets in KV1.
Which additional permissions should you assign to App1?
To answer, select the appropriate options in the answer area.
Show answer
Because App1 already has the Get permission on KV1, to replicate all secrets it additionally needs the List permission to enumerate which secrets exist.
On the KV2 side, because it must newly create (set) and store the retrieved secrets, you grant the Create permission, which corresponds to creation.
This allows App1 to copy from KV1 to KV2 through the flow of list → get → create.
Assign a Key Vault access policy (legacy)
About Azure Key Vault secrets
Grant access to Key Vault keys, certificates, and secrets using Azure role-based access control
Q9.You are designing an application that aggregates and delivers content to consumers.
You need to propose a database solution suitable for this application.
The solution must support SQL commands, support multi-master writes, and guarantee low-latency read operations.
What should the recommendation include?
Show answer
The requirements are “querying with SQL,” “simultaneous writes across multiple regions (multi-master),” and “guaranteed low-latency reads.”
Azure Cosmos DB for NoSQL provides a SQL-compatible query language and can be made active-active by enabling multi-region writes.
Furthermore, SLAs such as availability and P99 latency are explicitly stated, so you can aim for low latency globally.
Azure SQL active geo-replication is centered on read-only secondaries and does not meet the multi-master requirement.
Azure Cosmos DB for NoSQL documentation
Multi-region writes in Azure Cosmos DB
High availability (reliability) of Azure Cosmos DB for NoSQL
Q10.You have 100 Microsoft SQL Server Integration Services (SSIS) packages that are configured to target 10 on-premises SQL Server databases as their destination.
You plan to migrate these 10 on-premises databases to Azure SQL Database.
You need to propose a solution to host the SSIS packages on Azure.
The solution must ensure that each package can target a SQL Database instance as its destination.
What should the recommendation include?
Show answer
To run SSIS packages on Azure, it is appropriate to use the Azure-SSIS Integration Runtime of Azure Data Factory.
The Azure-SSIS Integration Runtime is a managed execution environment that can run SSIS packages as-is on Azure.
Therefore, existing SSIS workloads can be migrated easily without major rework, and it can also host packages whose destination is Azure SQL Database.
SSMA and Data Migration Assistant are mainly tools that assist with database migration and are not suited to hosting SSIS packages.
Migrate on-premises SSIS workloads with ADF or Synapse pipelines
Integration runtime in Azure Data Factory
Provision the Azure-SSIS integration runtime