Plan and Implement Security AZ-140 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization uses Azure Virtual Desktop for clinical staff. They need to enforce a security baseline on session hosts that includes vulnerability assessments and recommendations from Microsoft Defender for Cloud. They also want to prevent ransomware from encrypting user documents by blocking unauthorized writes to known folders. What should you implement?

   • AConfigure Defender for Cloud's continuous export to a Log Analytics workspace and enable Defender Antivirus scheduled scans.
   • BDeploy Azure Policy with the Windows security baseline initiative and enable App Control for Business in enforcement mode.
   • CEnable Defender for Cloud's regulatory compliance dashboard and configure Microsoft Defender for Endpoint's attack surface reduction rules.
   • DApply a Defender for Cloud security policy to the subscription and enable Controlled Folder Access via Microsoft Defender for Endpoint.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When configuring Microsoft Defender for Endpoint on session hosts, which scanning option helps reduce the performance impact on user sessions while still providing protection?

   • AScan only files that have been modified
   • BExclusion paths
   • CFull scan
   • DQuick scan
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   You are planning Windows threat protection features for Azure Virtual Desktop session hosts. Which feature allows you to control which applications are allowed to run on the session hosts?

   • AControlled Folder Access
   • BWindows Defender Firewall
   • CApp Control for Business
   • DMicrosoft Defender Antivirus
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   You need to provide secure administrative access to Azure Virtual Desktop session hosts without exposing them to the internet. Which Azure service provides a fully managed RDP/SSH access solution that is accessed through the Azure portal?

   • ANetwork Security Group (NSG)
   • BAzure Firewall
   • CAzure Bastion
   • DJust-in-time (JIT) VM access
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A multinational company has Azure Virtual Desktop session hosts in multiple Azure regions. They need to ensure that all outbound traffic from session hosts is inspected and that traffic between regions is routed through a central security appliance. They also want to use Defender for Cloud to monitor for network security misconfigurations. What should you implement?

   • AApply NSGs to session host subnets to restrict outbound traffic and use Azure Monitor for network monitoring.
   • BDeploy a network virtual appliance in each region and configure ExpressRoute for inter-region traffic.
   • CUse a single Azure Firewall in one region and route all traffic from other regions through it using UDRs.
   • DDeploy Azure Firewall in each region's hub, create forced tunneling UDRs from session host subnets, and enable Defender for Cloud's network recommendations.
   Reveal Solution Discussion Select an answer first