Plan and Implement Security AZ-140 Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A company's Azure Virtual Desktop session hosts are in a subnet that currently allows RDP from the internet. The security team wants to eliminate this exposure while still allowing administrators to connect for troubleshooting. They also want to ensure that all administrative connections are logged and audited. What should they implement?

   • ARemove the internet-facing NSG rule for RDP and deploy Azure Bastion in the virtual network.
   • BKeep the NSG rule and enable Defender for Cloud's just-in-time VM access.
   • CRemove the NSG rule and configure a site-to-site VPN for administrative access.
   • DKeep the NSG rule but restrict it to a specific IP range and enable just-in-time VM access.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   You want to use just-in-time (JIT) VM access to manage administrative access to session hosts. Which Azure service provides JIT VM access as a feature?

   • AAzure Bastion
   • BAzure Firewall
   • CAzure Policy
   • DMicrosoft Defender for Cloud
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   Contoso has an Azure Virtual Desktop deployment with session hosts in a single subnet. They need to restrict outbound internet access from session hosts to only allow Windows Update and Microsoft Defender for Endpoint cloud services. They also need to provide secure administrative access to session hosts for their IT team without exposing RDP to the internet. What should you implement?

   • AApply an NSG to the session host subnet that denies all outbound traffic except to the Microsoft service IP ranges, and assign public IPs to session hosts for direct RDP access.
   • BDeploy Azure Firewall with network rules for the Microsoft service IP ranges, and configure just-in-time VM access for session hosts instead of Bastion.
   • CUse a UDR to route all traffic to a network virtual appliance, and enable RDP through a site-to-site VPN for administrative access.
   • DConfigure a route table with a default route to Azure Firewall, create application rules for the required Microsoft services, and deploy Azure Bastion in the same virtual network.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   Your company is deploying Azure Virtual Desktop session hosts that run Windows 11 Enterprise. Security requirements mandate that all session hosts be onboarded to Microsoft Defender for Endpoint and that real-time protection remain active. You plan to use Microsoft Defender Antivirus as the primary antimalware solution. During onboarding, you notice that the session hosts are not appearing in the Microsoft 365 Defender portal. You verify that the hosts have internet connectivity and that the required endpoints are reachable. What should you do first to resolve the onboarding issue?

   • ADisable the Microsoft Defender Antivirus real-time protection to allow the Defender for Endpoint sensor to initialize.
   • BVerify that the session hosts have the Microsoft Defender for Endpoint sensor service (MsSense.exe) running and that the service startup type is set to Automatic.
   • CInstall the Microsoft Defender for Endpoint client using the Microsoft Endpoint Configuration Manager console.
   • DRun the Microsoft Defender for Endpoint onboarding script with the -RemoveInternetExplorerPolicy parameter.
   Reveal Solution Discussion Select an answer first