You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com.
Sub1 contains a Recovery Services vault named RSVault1 that stores virtual machine backups.
Your company's security team maintains a dedicated Microsoft Entra tenant named security.contoso.com.
You need to ensure that modifying the backup settings of RSVault1 requires approval from an approver in security.contoso.com.
What should you do in contoso.com?

• A. Create a private endpoint for RSVault1 on the virtual network.
• B. Configure Privileged Identity Management (PIM) activation for the Backup Operator role.
• C. Enable immutability for RSVault1 and lock the immutability setting.
• D. Enable Multi-user authorization (MUA) for RSVault1.

You have an Azure subscription that has the Microsoft Defender for Cloud Foundational Cloud Security Posture Management (CSPM) plan enabled.
You have an Amazon Web Services (AWS) account connected to Defender for Cloud for posture management.
In Defender for Cloud, security recommendations for the resources in Azure and AWS have a risk level of Not evaluated.
You need to ensure that Defender for Cloud assigns a risk level to the recommendations.
What should you do?

• A. Assign the CIS AWS Foundations v3.0.0 standard to the AWS account.
• B. Enable the Defender CSPM plan.
• C. Onboard all the virtual machines in the AWS account to Azure Arc.
• D. Enable Microsoft Defender for Servers Plan 2.

You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.
You have a user named User1 and a global administrator named Admin 1
You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.
You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.
What should you do first?

• A. Instruct Admin1 to enable Access management for Azure resources.
• B. Move Sub1 to MG1.
• C. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
• D. Assign Admin1 the User Access Administrator role for Sub1.

You have a Microsoft 365 subscription. All users have Microsoft Exchange Online mailboxes.
You use Microsoft Entra Agent ID to register and manage AI agents.
The developers at your company create the following two agents:
*Agent 1: An interactive agent that helps users summarize their own Exchange Online email
*Agent2: An autonomous agent that sends nightly updates to a Microsoft Teams channel You need to grant each agent access to Microsoft Graph. The solution must minimize the access scope, while meeting each agent ' s operating model.
Which type of permission should you assign to each agent? To answer, drag the appropriate permission types to the correct agents. Each permission type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

You have 15 Azure virtual machines in a resource group named RG1.
All the virtual machines run identical applications.
You need to prevent unauthorized applications and malware from funning on the virtual machines.
Authorized applications must be able to run on the virtual machines.
What should you do?

• A. From Microsoft Defender for Cloud, configure adaptive application controls.
• B. Apply a resource lock to RG1.
• C. Configure Microsoft Entra ID Protection.
• D. Apply an Azure policy to RG1.