Eligible approvers: Admin1 and Admin2 only

Based on the Privileged Identity Management (PIM) configuration table in the case study, the row for the AI Administrator role explicitly lists Admin1, Admin2 in the ‘Approvers’ column. This means that both Admin1 and Admin2 are designated as approvers for activation requests for this role.

Maximum active duration of the role: 1 day

The same PIM configuration table shows that for the AI Administrator role, the ‘Activation maximum duration (hours)’ is set to 24. Since 24 hours is equivalent to 1 day, this is the maximum period User1 can have the role activated after approval.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

Statement 1: Admin1 must approve requests for the Agent ID Developer role. ➡️️ Yes

Reasoning: The ‘Privileged Identity Management (PIM) configuration’ table explicitly shows that for the ‘Agent ID Developer’ role, the ‘Require approval to activate’ setting is ‘Yes’, and the designated ‘Approvers’ is ‘Admin1’.

Statement 2: Admin2 can approve requests for the AI Administrator role. ➡️️ No

Reasoning: The PIM configuration table for the ‘AI Administrator’ role shows that the ‘Require approval to activate’ setting is ‘No’. Since activation requests for this role do not require approval, there is no approval task for anyone, including Admin2, to perform.

Statement 3: Admin3 can assign User1 a two-day active assignment for the Agent ID Developer role. ➡️️ No

Reasoning: Admin3 holds the ‘User Administrator’ role. This role does not grant permissions to manage Privileged Identity Management (PIM) assignments. This action requires either the ‘Privileged Role Administrator’ role (held by Admin2) or the ‘Global Administrator’ role (held by Admin1).

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

✅ Option C (Correct)
Reasoning: Enabling Microsoft Entra-only authentication for Server1 centrally enforces that SQL authentication is disabled for all databases on that logical server. This directly meets both requirements: SQL authentication cannot be used, and the solution is enforced at the server level.

❌ Why the other choices are incorrect:

• Option A is incorrect: Configuring a Microsoft Entra administrator allows Entra users to connect but does not disable SQL authentication centrally for the server.
• Option B is incorrect: Enabling a managed identity is for Azure resources to authenticate to other Azure services, not for disabling client SQL authentication to the server.
• Option D is incorrect: Removing SQL logins from DB1 is a database-specific action, not a server-level configuration that affects all databases or prevents the use of SQL authentication entirely.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication

✅ Option D (Correct)When user consent is disabled and delegated permissions are needed, an administrator must explicitly grant admin consent to the application. This allows App1 to access Microsoft Graph on behalf of signed-in users without triggering interactive consent prompts for each user, satisfying both requirements.❌ Why the other choices are incorrect:* Option A is incorrect: Requiring user assignment controls who can sign in but does not address the application’s permission consent process for delegated permissions.* Option B is incorrect: Application permissions allow the app to act without a user, which contradicts the requirement to act "on behalf of the signed-in user".* Option C is incorrect: User consent is explicitly disabled in the tenant, making it impossible to rely on user consent during sign-in.

Reference: https://learn.microsoft.com/en-us/entra/identity-platform/howto-grant-and-manage-admin-consent

• B: Require approval to activate directly addresses the requirement that elevated access must be evaluated by another administrator before it is granted. This setting enforces an approval workflow for role activation.
• E: Activation maximum duration fulfills the requirement that privileged access must be removed automatically after a fixed period. This setting defines the maximum time an activated role can be held, after which access is automatically revoked.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure-role-settings

✅ Option D (Correct)
Reasoning: By default, a Global Administrator does not have elevated access to Azure resources. Enabling ‘Access management for Azure resources’ grants the Global Administrator the User Access Administrator role at the root scope (/) of the Azure tenant. This permission then allows Admin1 to manage Azure RBAC roles for all subscriptions, including Sub1, enabling them to remove User1’s Owner role.
❌ Why the other choices are incorrect:

• Option A is incorrect: Moving Sub1 to MG1 does not grant Admin1 the necessary permissions to manage roles on Sub1. Admin1 still lacks specific Azure RBAC permissions on the subscription.
• Option B is incorrect: Admin1 cannot assign themselves the User Access Administrator role for Sub1 because User1 is the sole owner. Admin1 needs a higher-level permission first to perform this assignment.
• Option C is incorrect: The Security Administrator role in Microsoft Entra ID does not grant Azure RBAC permissions to manage access to Azure subscriptions. PIM for this role is irrelevant for this scenario.

Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

Assigning the policy to MG1 ensures all new Foundry deployments within the entire management group (Sub1 and Sub2) are governed. Excluding RG-Exception from this assignment explicitly prevents the policy from restricting deployments within that specific resource group, directly meeting both requirements. This method applies the policy broadly while providing a precise exemption.

Reference: https://learn.microsoft.com/azure/governance/policy/concepts/scope

To ensure App1 can retrieve secrets from KV1 without using credentials stored in the application configuration, a managed identity for App1 is the correct solution. A managed identity provides an Azure Active Directory identity for App1, allowing it to authenticate to Key Vault using RBAC without storing any secrets in its configuration. The existing firewall rule allowing access from App1’s virtual network addresses network connectivity.

Reference: https://docs.microsoft.com/azure/key-vault/general/tutorial-net-create-vault-azure-web-app

Correct Mapping:

✅ Step 1: Microsoft Authenticator matches with -> Passwordless sign-in
Reasoning: The Microsoft Authenticator app enables passwordless sign-in through phone sign-in. Users receive a push notification on their registered mobile device and approve it using a PIN or biometrics, meeting the requirement to sign in without a password using a mobile device.

✅ Step 2: Temporary Access Pass matches with -> First-time sign-in for new users
Reasoning: A Temporary Access Pass (TAP) is a time-limited, helpdesk-issuable passcode. Its primary purpose is to allow new users to sign in for the first time to register their permanent passwordless authentication methods, such as the Authenticator app. This perfectly aligns with the requirement for an expiring, helpdesk-issued method for new users.

Reference: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-phone-sign-in

An app consent policy allows administrators to define the conditions under which users can consent to applications. This is the precise mechanism to enable users to grant consent for low-risk permissions while ensuring that requests for higher-privilege permissions still require administrator approval. You can create a custom app consent policy to categorize permissions and specify which ones users can consent to without admin intervention.

Why the other choices are incorrect:

• A is incorrect: Granting tenant-wide admin consent to App1 would approve all its permissions by an administrator, overriding individual user consent and not differentiating between low and high risk. It bypasses the requirement for users to grant consent for low-risk permissions.
• B is incorrect: Configuring application assignments controls which users or groups have access to the application, not the mechanism by which consent is granted.
• C is incorrect: Privileged Identity Management (PIM) is used for managing and monitoring administrative role assignments, not for defining user consent policies for applications.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/configure-user-consent

✅ Option C (Correct)
Reasoning: The User Access Administrator role is specifically designed to manage user access to Azure resources, including assigning roles. Assigning this role at the management group (MG1) scope ensures its members can assign roles across all contained subscriptions (Sub1 and Sub2). This adheres to the principle of least privilege by granting only the necessary permissions for role assignment.

❌ Why the other choices are incorrect:

• Option A is incorrect: The Contributor role allows managing all resources but does not include permissions to assign roles to others. It lacks the necessary access management capabilities.
• Option B is incorrect: Similar to option A, the Contributor role, even when applied at the subscription scopes, does not grant the permission to assign roles.
• Option D is incorrect: The Owner role provides full access to manage all resources and assign roles. While it fulfills the requirement, it violates the principle of least privilege as User Access Administrator provides the specific necessary permissions without granting excessive control over all resources.

Reference: https://learn.microsoft.com/azure/role-based-access-control/built-in-roles

Plan to enable: Defender Cloud Security Posture Management (CSPM)

Reasoning: To detect secrets like plaintext tokens and SSH keys on virtual machines, you need the ‘sensitive data discovery’ capability within Microsoft Defender for Cloud. This feature is a component of the paid Defender Cloud Security Posture Management (CSPM) plan. This plan provides advanced security features beyond the foundational free tier, including scanning resources for sensitive information.

Feature to enable: Agentless machine scanning

Reasoning: The requirement to ‘minimize administrative changes to the virtual machines’ directly points to an agentless solution. Agentless machine scanning works by taking snapshots of the VM disks and analyzing them for vulnerabilities, software inventory, and secrets without requiring any software to be installed or configured inside the guest operating system. This meets the requirement perfectly, as it avoids the overhead of deploying and managing agents across all 50 VMs.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-agentless-scanning

Answer Area Selections:

✅ Definition effect: DeployIfNotExists

Reasoning: The `DeployIfNotExists` effect is required to check for the presence of a related resource (the custom security extension) after a virtual machine is created or updated. If the extension is missing, this effect triggers a template deployment to install it, fulfilling the requirement to automatically install it on new VMs and identify existing ones for remediation.

✅ For remediation, define: A managed identity that has the Contributor role

Reasoning: A remediation task executes the deployment defined in the policy on existing non-compliant resources. To perform this action, Azure Policy requires an identity. A managed identity is the secure, standard mechanism for this. The identity needs sufficient permissions to deploy the extension to the VM, which the `Contributor` role provides.

Reference: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#deployifnotexists

To enforce multifactor authentication (MFA) for database administrators accessing SQLdb1, two key steps are required. First, SQLServer1, which currently uses Microsoft SQL Server authentication, must be configured to use Microsoft Entra authentication. This enables users to authenticate with their Microsoft Entra identities. Second, a Conditional Access policy in Microsoft Entra ID is necessary to target the database administrators and specifically require MFA when they attempt to access the Azure SQL Database resource (SQLdb1).

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview; https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

✅ Option C (Correct)Reasoning: To meet the technical requirement of encrypting all data in storage accounts using Fabrikam-managed keys, Azure Storage must be configured to use Customer-Managed Keys (CMK). This involves integrating the storage account with Azure Key Vault to use a key that Fabrikam controls. Configuring the storage account to use an ‘account encryption key’ from a key vault directly implements this requirement.❌ Why the other choices are incorrect:* Option A is incorrect: Purge protection is a Key Vault feature preventing permanent deletion of keys; it does not configure storage account data encryption with customer-managed keys.* Option B is incorrect: Encryption scopes provide granular control for keys within a storage account but are not the primary mechanism for setting the entire account to use customer-managed keys by default.* Option D is incorrect: Azure RBAC manages access to the storage account, not the encryption method used for the data at rest.

Reference: https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview

✅ Option C (Correct)Reasoning: Enabling Microsoft Entra-only authentication for an Azure SQL Database logical server explicitly denies all SQL authentication attempts. This ensures that existing legacy SQL authentication logins cannot be used for sign-in, while allowing them to remain in the databases, meeting all stated requirements.❌ Why the other choices are incorrect:* Option A is incorrect: Running CREATE USER … FROM EXTERNAL PROVIDER creates Microsoft Entra ID users but does not disable SQL authentication for existing logins.* Option B is incorrect: Conditional Access policies control access based on conditions for Microsoft Entra ID authentication, they do not disable SQL authentication itself at the server level.* Option D is incorrect: Assigning the SQL Server Contributor role is an Azure RBAC permission for managing the server resource, not for controlling the authentication methods allowed for client connections to the database.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication

✅ Option B (Correct)

Reasoning: Microsoft Defender for Open-Source Relational Databases is specifically designed to protect Azure Database for PostgreSQL, MySQL, and MariaDB instances. Enabling this plan directly addresses the security needs of an Azure Database for PostgreSQL instance while minimizing costs by targeting the specific database type.

❌ Why the other choices are incorrect:

• Option A is incorrect: Microsoft Defender for Servers protects virtual machines and physical servers, not Azure PaaS database instances like PostgreSQL.
• Option C is incorrect: Microsoft Defender for SQL Servers on Machines is for SQL Servers running on IaaS VMs or on-premises, not Azure PaaS PostgreSQL.
• Option D is incorrect: Microsoft Defender for Azure SQL Databases is specifically for Azure SQL Database, Azure SQL Managed Instance, and SQL Servers on Azure VMs (via specific configurations), not PostgreSQL.
• Option E is incorrect: Microsoft Defender for Storage protects Azure Storage accounts (Blob, Files, Data Lake), not relational database services.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-databases-introduction

✅ Option D (Correct)Assigning the Storage File Data Privileged Reader role to App1’s managed identity enables access to Azure Files using Microsoft Entra ID-based authorization. This eliminates the need for App1 to use storage account keys for access.❌ Why the other choices are incorrect:Option A is incorrect: Storing keys in Key Vault still means App1 would use keys, not access without them.Option B is incorrect: Disabling storage account key access would also prevent administrators from using keys, contradicting the scenario.Option C is incorrect: This setting configures default authorization for portal access, not programmatic access by a managed identity to file shares.

Reference: https://docs.microsoft.com/azure/storage/files/storage-files-identity-auth-active-directory-enable

✅ Option C (Correct)

Reasoning: Azure Event Grid is the correct choice because it provides a serverless event-driven architecture that can subscribe to security alerts generated by Microsoft Defender for Storage. These alerts act as events, and Event Grid can then route them to an automated handler, such as an Azure Logic App or Azure Function, to perform remediation actions like quarantining or deleting detected malware. This directly addresses the requirement for automated remediation.

❌ Why the other choices are incorrect:

• Option A is incorrect: Application Insights is primarily for monitoring the performance and usage of applications. It collects telemetry but does not inherently provide an event-driven mechanism to trigger automated remediation workflows for security alerts.
• Option B is incorrect: Azure Event Hubs is a highly scalable data streaming platform designed for ingesting large volumes of data. While it can handle events, it is not optimized for routing discrete events to trigger specific automated actions in response to security alerts, unlike Event Grid.
• Option D is incorrect: Azure Policy is used for enforcing organizational standards and compliance for Azure resources. It can prevent non-compliant resource deployments or audit existing ones, but it is not designed to automate real-time remediation responses to runtime security incidents like malware detection.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

To ensure that only VM2 can connect to VM3 while accommodating potential IP address changes, Application Security Groups (ASGs) must be used.

✅ ASG1 matches with -> Source Reasoning: The traffic originates from VM2. VM2 is a member of ASG1. Using ASG1 as the source for the security rule ensures that the rule continues to apply to VM2 even if its private IP address changes. This directly fulfills a key requirement of the question.

✅ ASG2 matches with -> Destination Reasoning: The traffic is destined for VM3. VM3 is a member of ASG2. Since we are configuring an inbound rule that will be processed at the destination’s network interface, specifying ASG2 as the destination correctly targets the rule to apply to traffic arriving at VM3.

Reference: https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups

Application rules in Azure Firewall allow filtering of outbound HTTP/S and SQL traffic based on Fully Qualified Domain Names (FQDNs). To ensure FW1 allows access to only "updates.contoso.com" and blocks all other outbound traffic, an application rule is the correct mechanism for FQDN-based control.

Reference: https://docs.microsoft.com/azure/firewall/application-rules

A security admin configuration in Azure Virtual Network Manager allows centrally defining security rules, such as blocking specific ports, that apply across all virtual networks within a network group. This approach minimizes administrative effort compared to managing individual NSGs, as the rules are enforced consistently from a single management plane. The rules are also processed before NSG rules.

Reference: https://learn.microsoft.com/en-us/azure/virtual-network-manager/security-admin-overview

✅ <B>Option B (Correct)</B>
Reasoning: Azure Firewall Manager centrally manages Azure Firewalls across multiple Azure Virtual WAN hubs. It enables creation of global firewall policies to secure traffic and ensures security rules automatically sync across secured virtual hubs in different regions, meeting the requirement for consistent security.

❌ Why the other choices are incorrect:

• Option A is incorrect: Azure Network Function Manager deploys network functions to hybrid environments, not for central management of Azure Firewalls in Virtual WAN.
• Option C is incorrect: Azure Virtual Network Manager manages network connectivity and security policies within virtual networks, but lacks the specific functionality for central Azure Firewall policy synchronization across Virtual WAN hubs.
• Option D is incorrect: Azure Front Door is a global CDN and WAF service for web applications, unrelated to managing Virtual WAN secured hubs or firewall policies.

Reference: https://docs.microsoft.com/azure/firewall-manager/overview

✅ Option D (Correct)Reasoning: The Storage Blob Data Contributor role grants read, write, and delete permissions to Azure Storage blob containers and blobs. Assigning this role at the scope of container1 adheres to the principle of least privilege, providing exactly the required access.
❌ Why the other choices are incorrect:

• Option A is incorrect: Storage Account Contributor manages the storage account itself, not the data (blobs) within it. It does not provide data plane access.
• Option B is incorrect: Storage Blob Delegator is used to delegate access with Shared Access Signatures (SAS) and does not directly provide read, write, or delete permissions to blobs.
• Option C is incorrect: Owner grants full control, including managing role assignments, which vastly exceeds the necessary permissions for simple blob operations and violates the principle of least privilege.

Reference: https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor