You are designing a data protection strategy for Azure virtual machines. All the virtual machines use managed disks. You need to recommend a solution that meets the following requirements:
* The use of encryption keys is audited.
* All the data is encrypted at rest always.
* You manage the encryption keys, not Microsoft
What should you include in the recommendation?

• A.Azure Disk Encryption
• B.Azure Storage Service Encryption
• C.BitLocker Drive Encryption (BitLocker)
• D.client-side encryption

Comment: *

Name: *

Email: *

Verification: *

You need to design a resource governance solution for an Azure subscription. The solution must meet the following requirements:
* Ensure that all ExpressRoute resources are created in a resource group named RG1.
* Delegate the creation of the ExpressRoute resources to an Azure Active Directory (Azure AD) group named Networking.
* Use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

Box 1: An Azure policy assignment at the subscription level that has an exclusion Box 2: A custom RBAC role assignment at the level of RG1 Azure role-based access control (Azure RBAC) is the authorization system you use to manage access to Azure resources. To grant access, you assign roles to users, groups, service principals, or managed identities at a particular scope.
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage

Comment: *

Name: *

Email: *

Verification: *

You need to recommend a solution for data of the historical transaction query system.
What should you include in the recommendation? To answer, Select the appropriate or options in the answer area.
NOTE: Each correct selection is worth one point

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

You need to recommend a solution for configuring the Azure Multi-Factor Authentication (MFA) settings.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-mfa-policy

Comment: *

Name: *

Email: *

Verification: *

You have an Azure Active Directory (Azure AD) tenant.
You plan to deploy Azure Cosmos DB databases that will use the SQL API.
You need to recommend a solution to provide specific Azure AD user accounts with read access to the Cosmos DB databases.
What should you include in the recommendation?

• A.a resource token and an Access control (IAM) role assignment
• B.shared access signatures (SAS) and conditional access policies
• C.master keys and Azure Information Protection policies
• D.certificates and Azure Key Vault

Correct Answer: A

Explanation
The Access control (IAM) pane in the Azure portal is used to configure role-based access control on Azure Cosmos resources. The roles are applied to users, groups, service principals, and managed identities in Active Directory. You can use built-in roles or custom roles for individuals and groups. The following screenshot shows Active Directory integration (RBAC) using access control (IAM) in the Azure portal:

Reference:
https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control

Comment: *

Name: *

Email: *

Verification: *