Plan and Implement Security AZ-140 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   Your Azure Virtual Desktop deployment uses a hub-spoke network topology. Session hosts are in a spoke virtual network that has a route table associated with its subnet. The route table contains a route for 0.0.0.0/0 with the next hop set to the Azure Firewall in the hub. You need to ensure that administrative RDP connections to the session hosts are only possible through Azure Bastion, which is deployed in the hub virtual network. You also need to prevent session hosts from being directly reachable from the internet. What should you do?

   • AAdd a route to the route table for the Azure Bastion subnet with the next hop set to VirtualNetworkGateway.
   • BAssociate a network security group (NSG) to the session host subnet that denies inbound RDP (port 3389) from the internet, and ensure the subnet has no public IP addresses assigned to the session host NICs.
   • CRemove the route table from the session host subnet to allow Azure Bastion to connect directly.
   • DConfigure the Azure Firewall to allow inbound RDP from the Azure Bastion service tag on the session host subnet.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has an Azure Virtual Desktop deployment with session hosts in a production subnet. They need to block inbound traffic from the internet to the session hosts while allowing RDP traffic from a specific management subnet. They also need to provide secure administrative access to the session hosts for IT staff who work remotely. What should you implement?

   • AApply an NSG to the session host subnet that denies all inbound internet traffic and allows RDP only from the management subnet, and deploy Azure Bastion for remote admin access.
   • BUse a UDR to route all inbound traffic to a network virtual appliance and enable RDP through a jump box.
   • CDeploy Azure Firewall to block all inbound traffic and configure a site-to-site VPN for remote admin access.
   • DApply an NSG that allows RDP from the internet only to the management subnet's public IP, and use just-in-time VM access.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is deploying Azure Virtual Desktop session hosts running Windows 11 Enterprise multi-session. They want to ensure real-time protection is enabled and that the Defender Antivirus engine is updated automatically. They also want to onboard the session hosts to Microsoft Defender for Endpoint for advanced threat detection. What should you configure during the session host image preparation?

   • AConfigure Microsoft Defender for Cloud to auto-provision Defender Antivirus and enable the Defender for Endpoint integration after the hosts are deployed.
   • BInstall a third-party antivirus solution and configure its cloud-delivered protection, then onboard to Defender for Endpoint using the Microsoft 365 Defender portal.
   • CEnable Microsoft Defender Antivirus via Group Policy, configure automatic security intelligence updates, and run the Defender for Endpoint onboarding script.
   • DEnable Controlled Folder Access and configure App Control for Business policies, then deploy the session hosts.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's Azure Virtual Desktop session hosts run Windows 11 Enterprise multi-session. They want to ensure that Microsoft Defender Antivirus is configured with the highest protection level and that users cannot disable it. They also want to protect the session hosts from malicious scripts. What should they configure?

   • AEnable Defender Antivirus cloud-delivered protection and configure scheduled scans.
   • BConfigure Controlled Folder Access and enable Defender Antivirus real-time protection.
   • CEnable Defender Antivirus tamper protection and configure attack surface reduction rules to block malicious scripts.
   • DEnable App Control for Business and configure Defender Antivirus exclusions for approved applications.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has Azure Virtual Desktop session hosts in a spoke virtual network peered to a hub. The security team requires that administrative RDP access to session hosts be possible only through a secure, audited connection that does not expose the session hosts to the internet. They also want to minimize the number of public IP addresses used. What should you implement?

   • ADeploy Azure Bastion in the hub virtual network and connect to session hosts through the peered network.
   • BAssign public IPs to each session host and configure NSG rules to allow RDP only from the IT team's public IP range.
   • CConfigure just-in-time VM access from Microsoft Defender for Cloud and enable RDP from the internet.
   • DSet up a point-to-site VPN for IT administrators and connect directly to session host private IPs.
   Reveal Solution Discussion Select an answer first