AROP-2026

You hace an Azure subscription that uses Microsoft Defender for Cloud You use accounts for the following cloud services - Alibaba Cloud -Amazon Web Services (AWS) -Google Cloud Platform What can you add to Defender for Cloud?. AWS only. Microsoft Cloud and AWS only. AWS and GCP only. Microsoft Cloud, AWS, and GCP.

You have an Azure subscription that contains an Azure API Management instance named ContosoAPI1 ContosoAPI1 is configured with the Basic V2 pricing tier You need to configure SSL 3.0 support for ContosoAPI1 What should you do first in the Azure Portal?. Under Certificates, add a certificate. Under APIs. add an API tag. Under Protocols + ciphers, select a backend protocol. Under Pricing Tier, change the pricing tier.

You have an Azure subscription that contains a Virtual Network named VNET1. The subscription contains an Azure App Service web app named App1 You have an Azure Front Door profile named AFD1 That has an Azure Web Application Firewall (WAF) policy. You need to ensure that all inbound traffic to App1 is filtered through AFD1 What should you do?. Configure Microsoft Entra application proxy. For App1, Enable virtual network integration. For Vnet1, configure network security group (NSG) rules. For App1, configure the HTTP headers filter setting.

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a single subnet. The subscription contains a virtual machine named VM1 that is connected to VNet1. You plan to deploy an Azure SQL managed instance named SQL1. You need to ensure that VM1 can access SQL1. Which three components should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. a network security perimeter. a virtual network gateway. a subnet. a network security group (NSG). a route table.

You have the following resources: Group1: Security group Group2: Microsoft 365 group App1: App registration MI1: User-assigned managed identity You have the users shown in the following table: User1: Member of Group1 and Group2. Assigned Owner role for App1 and MI1. User2: Member of Group1 and Group2. Assigned Owner role for App1 and MI1. You create an Azure SQL managed instance named SQL1 and enable Microsoft Entra-only authentication. You need to ensure that both User1 and User2 are set as the Microsoft Entra admin for SQL1. Solution: You set App1 as the Microsoft Entra admin for SQL1. Does this meet the goal?. Yes. No.

You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table. Name Resource group storage1 RG1 storage2 RG1 storage3 RG2 You need to ensure that Defender for Storage is enabled for all the storage accounts. Enable the Defender for Storage plan for Sub1. For storage3, assign the AzDefenderPlanAutoEnable tag and set the value to off. Enable the Defender for Storage plan for RG1. Enable Defender for Storage for storage3. For storage3, disable the customer-managed keys.

RC1 contains an application rule named Rule1 that has the following settings: Source IP Addresses: 10.0.0.0/24 Target FQDNs: www.microsoft.com, * Protocol: HTTP You discover that users can browse multiple public websites from VNet1. You need to ensure that only www.microsoft.com is accessible, and access to any other public website is blocked. What should you do?. Add a new application rule collection that has Priority set to 200 and Action set to Deny for *. Add a network rule collection that has Priority set to 50 and Action set to Deny for *. Remove the target FQDN of * from RC1. Add a NAT rule collection that translates traffic to www.microsoft.com.