You have an Azure subscription that contains the Azure key vaults shown in the following table.You create a virtual machine that has the following configurations:Name: VM1Resource group: RG1Azure region: East USOperating system: Windows ServerYou need to enable Azure Disk Encryption for VM1.Which key vault can you use to store the encryption key for VM1?
Answer(s): C
Vault1 and Vault2 are in the same region as VM1.Note: When using Azure Disk Encryption (ADE), the Azure Key Vault that stores the encryption keys must be in the same Azure region and same Microsoft Entra tenant as the virtual machine (VM) to be encrypted. This is a requirement for ADE to control and manage the encryption keys for the VM's disks.
https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a network security group (NSG) named NSG1 and a virtual network named VNet1.NSG1 contains only default security rules. VNet1 contains the subnets shown in the following table.The subscription contains virtual machines that run Windows Server as shown in the following table.You configure just-in-time (JIT) VM access as shown in the following exhibit.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: YesYes - From VM1, a Remote Desktop connection to VM3 will be terminated after three hours.VM1 is connected to Subnet1, listening ports is 3389, and is associated with NSG1.Subnet1 has IP address space 10.10.0.0/24.VM3 is connected to Subnet3, listening ports is 3389 and 8080, and is associated with NSG1.Subnet3 has IP address space 192.168.10.0/24.JIT VM access is allowed on port 3389, IP range allows Subnet1 and Subnet3, and time range is 3 hours.Note: NSG1 contains only default security rules.The standard port for a Remote Desktop connection, using the Remote Desktop Protocol (RDP), is TCP port 3389.Box 2: NoNo - From VM2, you must request access before you can establish a Remote Desktop connection to VM1.Per request is configured only for the 8080 Port.Box 3: YesYes- From VM3, you can establish a Remote Desktop connection to VM1 without requesting access.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains a user named User1.You deploy a read-only domain controller (RODC) named RODC1.You need to ensure that User1 is a local administrator on RODC1. The solution must use the principle of least privilege.What should you use?
Answer(s): D
Correct:* Computer Management* Local Users and GroupsNote: See Step 6 below.1. Click Start > Computer Management2. In the console tree navigate to Computer Management > System Tools > Local Users and Groups > Users3. In Actions menu click More Actions > New user4. Fill in the user information and adjust password settings.5. Click Create and then click Close*-> 6. In the console tree navigate to Computer Management > System Tools > Local Users and Groups > Groups7. Right-click Administrators. Select Properties8. Click Add9. Enter the name of the User created in Step 510. Click Check Names. Then click OK > OKIncorrect:* Active Directory Sites and ServicesActive Directory Sites and Services is used for managing replication topology and site configuration, not for granting local administrator access to a read-only domain controller (RODC).Active Directory Users and Computers could be used.* dsamain.exe dsamain.exe is the Active Directory Database Mounting Tool on Windows Servers, used to mount a snapshot or backup of the Active Directory (AD) or AD LDS database. It exposes the database as an LDAP server, allowing administrators to access and analyze the data offline without affecting the live environment, which is useful for data recovery, auditing, and forest recovery purposes.* dsmgmt.exe dsmgmt.exe is an interactive, command-line tool included in Windows Server that facilitates the management of Active Directory Lightweight Directory Services (AD LDS) and related features, such as FSMO roles, partitioning, and metadata cleanup. It requires an elevated command prompt and provides a text-based interface for various tasks related to AD LDS and abandoned domain controller cleanup.* net userThe net user command allows you to add, modify, or delete user accounts, and display detailed information about user accounts on a local computer or domain.This solution does not use the principle of least privilege.* Ntdsutil.exeNtdsutil.exe is a command-line utility for experienced Windows Server administrators to manage and maintain Active Directory (AD) and Active Directory Lightweight Directory Services (AD LDS), providing tools for database maintenance, role management, and metadata cleanup. It allows for tasks such as repairing and defragmenting the AD database, seizing and transferring FSMO roles (Flexible Single Master Operations) from domain controllers, removing metadata of improperly decommissioned servers, and performing database analysis.* Local Users and Groups* System Configuration
https://support.intermedia.com/app/articles/detail/a_id/10375/~/how-do-i-create-a-local-administrator%3F https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that runs Windows Server and is in an organizational unit (OU) named OU1.You have a Group Policy Object (GPO) that is linked to OU1 and has the Windows Defender SmartScreen settings shown in the following table.You have the apps shown in the following table.Which apps can you install on Server1?
* App1 - Yes* App2, App3 - NoIf Windows Defender SmartScreen is configured to "Allow Apps from Store only" and "Warn and prevent bypass" for an app, then the application cannot be installed from a network share or USB drive. This policy specifically blocks installation of unverified executables from anywhere other than the Microsoft Store and prevents users from bypassing the warning to install them.
https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/ microsoft-defender-smartscreen/available-settings
You have an Azure subscription. The subscription contains a Microsoft Sentinel workspace named Workspace1 and 100 virtual machines that run Windows Server.You configure Workspace1 to collect logs from the virtual machines.You need to query the collected logs for failed logon events.Which table should you query?
To get Windows failed logon events (Event ID 4625) into your Microsoft Sentinel workspace, ensure you've configured a Azure Monitor Agent (AMA) data collection rule or a Windows Security Events data connector to send security logs to the SecurityEvent table. Verify that the Azure Arc-enabled server or Azure VM is sending data to the correct Log Analytics workspace by checking its configuration and validating the data in the SecurityEvent table using the query SecurityEvent | where EventID == 4625.
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/securityevent
Post your Comments and Discuss Microsoft AZ-801 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-801 content, but please register or login to continue.