Refer to the Exhibit Practice Questions

The policy does not include all cloud apps

Why wrong: The policy includes 'All' applications.

The policy excludes specific locations

Why wrong: No location exclusion is shown in the policy.

The policy does not include session controls to enforce MFA re-prompt

Why wrong: Session controls are not required for MFA; the grant control itself triggers MFA.

The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.

Why wrong: In an inbound NSG rule, sourcePortRange '*' is a valid wildcard meaning the rule applies to packets from any source port, which is standard for inbound web traffic because the client's ephemeral source port is unpredictable. Using '*' here does not create a conflict with the DenyAll rule; rule precedence is determined solely by the priority number, not by port range specifications. The only way AllowHTTP would 'conflict' with DenyAll is if their destination port ranges overlap and DenyAll has a better (lower) priority, so blaming sourcePortRange '*' is incorrect.

The NSG is not associated with the subnet or network interface where the web server is deployed.

Why wrong: If the NSG were not associated, the default Azure security rules would apply, which include a 'DenyAllInbound' rule that blocks internet HTTP traffic. However, the question assumes the NSG was created and associated, making rule priority a more direct cause.

The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.

Why wrong: In Azure NSG rules, the protocol wildcard '*' matches all protocols, including TCP where HTTP runs, so it indeed matches HTTP traffic. However, the protocol specification alone does not cause the blocking; NSG evaluation is based on priority order, and a lower-priority AllowHTTP rule for destination port 80 would still permit traffic if its priority number were smaller. Because the DenyAll rule's action is what ultimately applies for the match, the blocking is primarily a result of priority ordering, not merely the use of the '*' protocol wildcard.

The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.

Why wrong: This option is incorrect because in an 'auditIfNotExists' policy, the 'existenceCondition' field paths are evaluated relative to the child resource type specified in 'details.type' (e.g., 'Microsoft.Compute/virtualMachines/extensions'), not relative to the parent virtual machine. Therefore, using just 'publisher' is the correct field reference—it directly accesses the extension resource's property. Pre-pending the full type path would be invalid because Azure Policy would attempt to resolve a non-existent property within the already-scoped extension resource.

The policy is assigned to a management group, but the VMs are in a subscription under a different management group.

Why wrong: A policy assigned at a management group scope automatically applies to every child management group and subscription within that hierarchy. If the VMs' subscription is a descendant of the management group where the policy is assigned, the assignment reaches those VMs regardless of how many other management groups exist above them. The only way this option would be valid is if the subscription were in a completely separate management group tree, which is not the case in the exhibit—so inheritance makes this a non-issue.

The policy effect should be 'Deny' instead of 'auditIfNotExists'.

Why wrong: The 'auditIfNotExists' effect is correct for a security audit because it evaluates existing VMs and flags them as noncompliant without disrupting current workloads. Changing to 'Deny' would only block the creation of future resources and would not provide any visibility into already-deployed VMs, defeating the purpose of an audit. Furthermore, the real problem is the overly restrictive 'if' condition, not the effect; switching effects would mask the underlying issue and could cause unintended deployment failures for legitimate resources.

Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.

Why wrong: Azure Policy Guest Configuration is specifically designed for auditing and applying settings inside virtual machines (e.g., OS baseline, application config), not for enforcing resource-level attributes like allowed Azure regions, NSG rules on subnets/NICs, or storage HTTPS requirements. Furthermore, assigning policies per subscription scatters management and bypasses the centralized enforcement that a root management group assignment provides; Azure Automation runbooks would run only on a schedule or manually, offering reactive and inconsistent remediation rather than the continuous, event-driven repair that Azure Policy's DeployIfNotExists effect provides.

Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.

Why wrong: Azure Blueprints is deprecated in favor of Azure Policy, template specs, and other native tools; while blueprints could package policy assignments, they are no longer a supported long-term governance solution. Moreover, assigning a blueprint per management group is redundant and misses the simpler pattern of assigning the underlying policies directly at the root management group, from which inheritance flows. Finally, manual remediation after blueprint assignment is inefficient and does not provide the automated, ongoing enforcement and repair that DeployIfNotExists with remediation tasks delivers, leaving the environment exposed to configuration drift.

Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.

Why wrong: A custom PowerShell script run daily creates only a point-in-time compliance snapshot and cannot guarantee continuous enforcement or prevent non-compliant configurations from being created between runs. Logic Apps alerts merely notify staff; they do not implement any technical control, and having IT staff manually fix issues is error-prone and does not scale across a large enterprise. This approach misses Azure Policy's native capabilities: declarative rules, automatic evaluation on resource creation/change, and integrated remediation actions that provide real-time drift detection and correction.

Enforce HTTPS traffic only

Why wrong: This is implemented but not the only one; the question may have multiple correct? But we need one best. Actually, the template does enforce HTTPS, but also network default deny. I'll choose the network default deny as it's a strong security control.

Restrict network access by IP address

Why wrong: Restrict network access by IP address is incorrect because the ARM template's networkAcls object contains an empty ipRules array. That means no specific IPv4 or IPv6 CIDR ranges are allowlisted; the template does not use IP-based filtering at all. Instead, network security is achieved solely through the defaultAction property, so this option describes a control that is not present in the deployment.

Enable soft delete for blobs

Why wrong: Enable soft delete for blobs is incorrect because the template does not contain a deleteRetentionPolicy property under the blob service, nor any softDelete configuration. Soft delete is a data-protection feature that preserves deleted blobs for recovery, but it is unrelated to the network access controls being evaluated. Since this setting is absent from the ARM template, this option does not reflect any security control actually deployed.

The grant controls operator is set to 'OR' instead of 'AND'

Why wrong: The grant controls operator is set to 'OR' rather than 'AND', but this is not the problem. When only one grant control (for example, MFA) is configured, 'OR' is the correct and standard operator because there is only a single condition to satisfy. 'AND' would be necessary only if multiple controls had to be simultaneously required, such as requiring both MFA and device compliance. Therefore, the operator setting does not explain the unexpected MFA prompt.

The policy is in 'Report-only' mode

Why wrong: The policy is not in 'Report-only' mode; the JSON explicitly shows the state is 'Enabled'. In Report-only mode, the policy would be evaluated and results written to logs, but it would not enforce any controls or block access. Because the policy is enabled, it actively enforces the MFA grant control, which is consistent with users being challenged for MFA. Thus, the mode is not the root cause of the issue.

The policy applies to all cloud apps, not just Azure management

Why wrong: The policy does not apply to all cloud apps; the JSON shows the includeApplications condition contains the specific application ID for Microsoft Azure Management. If the policy applied to all cloud apps, it would affect sign-ins to every integrated application, which could produce broader unexpected prompts. However, the actual policy is scoped narrowly to Azure management, so this is not the cause of the MFA challenge. The problem is related to the location condition, not the app scope.

Blocks sign-ins from locations with high sign-in risk

Why wrong: The policy shown does not include a sign-in risk condition — only user risk is evaluated — and sign-in risk is not configured in the conditional access policy. In Microsoft Entra ID, sign-in risk and user risk are independent risk dimensions with separate conditions and separate risk levels. Because the sign-in risk condition is absent, this policy cannot block based on sign-in risk, making the statement incorrect.

Blocks all sign-ins from any user

Why wrong: The policy does not indiscriminately block all sign-ins because the user risk condition acts as a guard that limits enforcement to accounts scored as high risk. Users with low or medium user risk are not affected by this policy even if they are in scope. Therefore, stating that it blocks every sign-in from any user overstates the policy's scope and ignores the risk filter.

Requires multifactor authentication for high-risk users

Why wrong: The access control configured in this policy is 'Block,' not 'Grant,' so multifactor authentication is never offered or required. A require-MFA outcome would be implemented via the Grant control with the 'Require multifactor authentication' checkbox selected, which is not present here. Instead, high-risk users are denied outright after risk evaluation, with no MFA challenge step.

The policy state is set to 'enabled' but not 'enforced'

Why wrong: There is no 'enforced' state; enabled means it's on.

The user risk level is set to 'high' but sign-in risk is 'medium'

Why wrong: Both are set to high.

The grant control is set to 'block' but should be 'require MFA'

Why wrong: Block is correct for high risk.

To list all successful logon events in the last 7 days.

Why wrong: The query uses EventID 4625 which is failed logon, not success.

To calculate the total number of failed logons per hour.

Why wrong: The query does not include a time bin.

To detect account lockout events.

Why wrong: Account lockout is EventID 4740, not 4625.

Emails are deleted

Why wrong: The 'mark as spam' mail flow rule action does not delete the message; it only modifies the spam confidence level (SCL) so that the message is treated as spam. Deletion requires a distinct action such as 'delete the message without notifying the recipient' or 'quarantine to' in the same rule. Therefore, messages still exist in the user's mailbox, just not in the Inbox.

Emails have a custom header added

Why wrong: Applying the 'mark as spam' verdict does not inject any custom header into the message; it changes the internal SCL rating used by Exchange Online for anti-spam processing. Custom headers are added via the 'modify the message properties' and 'set a message header' actions, which are explicitly defined by the mail flow rule. So the absence of a custom header is expected from this rule.

Emails are blocked and not delivered

Why wrong: Choosing 'mark as spam' does not block or reject the message during the transport pipeline; it allows delivery but assigns a high spam confidence level so that the mailbox filters move it to Junk Email. Blocking delivery would require a rule action like 'reject the message with a DSN' or 'silently drop', which prevents the message from reaching the mailbox entirely. Thus, this option is incorrect.

The rule should be Allow to deny traffic

Why wrong: Deny is correct for blocking.

The priority of the Deny rule is too low (100)

Why wrong: Priority 100 is high; lower numbers are higher priority.

The direction should be Outbound

Why wrong: Inbound is correct for incoming traffic to the database.

The policy does not include any applications.

Why wrong: The policy JSON clearly specifies an includeApplications array containing the value 'All', which is a reserved identifier that encompasses every cloud application registered in the tenant. The presence of this condition means the policy is application-scoped to all apps, not zero apps. Therefore, the assertion that no applications are included is factually incorrect when reading the conditions.applications block.

The grant control requires a compliant device instead of MFA.

Why wrong: Within the grantControls object, the builtInControls array is set to ['mfa'], and the operator is 'OR', indicating that the policy requires multi-factor authentication as the sole grant control. There is no reference to 'compliantDevice' or 'requireDeviceCompliance' anywhere in the grant section, so the policy cannot be said to be demanding a compliant device. The claim conflates MFA with device compliance, which are distinct conditional access grant options.

The policy state is disabled.

Why wrong: The state property in the policy JSON is explicitly set to 'enabled', which means the policy is actively being enforced by the Conditional Access engine for all matching sign-in attempts. A policy with this state is live during authentication, whereas a disabled policy would have state set to 'disabled' or possibly be in report-only mode with 'enabledForReporting'. Therefore, the statement that the policy is disabled is demonstrably false and would misrepresent the policy's operational status.

The Azure Firewall in East US is not configured to allow traffic from West US to AAD DS.

Why wrong: Azure Firewall in East US is not the cause of the authentication failure because Azure AD Domain Services (AAD DS) is accessed privately within the East US virtual network, and authentication traffic never traverses the Azure Firewall as a transit point. A UDR in the West US spoke would need to explicitly send traffic to the firewall's public IP or internal load balancer for the firewall to even see it, and Azure Firewall is not an intermediary for AAD DS authentication. The firewall's application or network rules would only matter for traffic that is actually forwarded to it, but the root issue is the routing path taken by the West US spoke, not a missing allow rule.

The VNet peering between East and West US hubs is not properly configured with 'Allow forwarded traffic' enabled.

Why wrong: The 'Allow forwarded traffic' setting on VNet peering controls whether traffic from a peered VNet can be forwarded through a network virtual appliance (NVA) in the hub to another VNet or on-premises. For cross-region traffic, disabling this setting would prevent the NVA from forwarding packets between the West US spoke and the East US hub, but AAD DS traffic is destined to the East US region, and a more specific route could handle it directly without requiring forwarding. The actual misconfiguration is that the West US spoke's default route sends all traffic to the local NVA, which may then discard or send it out of region; even if 'Allow forwarded traffic' were enabled, it would not cause traffic to be directed to AAD DS across regions, so this is not the root cause.

The ExpressRoute circuit is down, causing traffic to be routed over the internet.

Why wrong: ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, but AAD DS authentication in this scenario involves Azure VNet-to-VNet traffic between the West US application spoke and the East US AAD DS deployment, not on-premises traffic. A failed ExpressRoute circuit would only affect connectivity to on-premises resources, and since the workload is already in Azure, authentication requests would be routed over the Azure backbone regardless of ExpressRoute status. Therefore, an ExpressRoute outage is irrelevant to the inability to authenticate to AAD DS from the West US application; the issue lies solely in the incorrect routing configuration within the Azure virtual network.

The severity filter should be 'Low' to capture all assessments

Why wrong: The automation rule's severity filter currently restricts triggers to assessments classified as High, which aligns with the stated requirement to address only high-severity security findings. Switching the filter to Low would cause every assessment, including informational and low-priority items, to invoke the playbook, increasing noise and cost without adding value. Therefore, the current High filter is correct and not the cause of the failure.

The eventSource should be 'Alerts' instead of 'Assessments'

Why wrong: The eventSource 'Assessments' is correct because security assessments represent the compliance and vulnerability findings that the playbook is designed to act upon. Changing it to 'Alerts' would narrow the trigger to active security alerts (e.g., detected attacks), which do not include the assessment-generated recommendation data. Since the goal is to act on assessments, the current eventSource is not the problem, and altering it would break the automation for the intended use case.

The API version should be '2020-01-01'

Why wrong: The API version '2020-01-01' is a valid and stable version for configuring automation rules and does not influence whether the action type can invoke a playbook. Even if a newer API version were used, the action type property would still be 'EventHub', leading to the same failure. The root cause is the action type itself, not the API version, so changing the API version would not resolve the issue.

All Azure resources that are not compliant

Why wrong: The policy scope is restricted to the Microsoft.Compute/virtualMachines resource type, as shown in the assignment, so it cannot evaluate non-compliance on other Azure resource categories like storage or networking. The concept of 'not compliant' is an outcome of the policy evaluation, not a resource attribute that the policy condition can match. Thus, this option incorrectly broadens the policy's applicability beyond its defined scope.

All virtual machines with unmanaged disks

Why wrong: Unmanaged-disk VMs use page blobs in storage accounts instead of managed disk objects, so they lack the Microsoft.Compute/disks/sku.name property that the policy's exists condition checks for. Because the condition only applies when the managed disk SKU is present, classic VHD-based VMs are not evaluated against the Premium_LRS requirement and therefore are not marked non-compliant. The policy was deliberately designed to govern only managed-disk SKUs, leaving unmanaged-disk deployments outside its influence.

Virtual machines with Premium_LRS managed disks and disk size 1024 GB

Why wrong: Premium_LRS is the exact value that the policy's notEquals condition explicitly excludes, so a Premium_LRS disk can never satisfy the non-compliance predicate. The disk size of 1024 GB is ignored entirely because the policy definition has no size component; it only evaluates the SKU name. Therefore, a VM with a Premium_LRS managed disk remains fully compliant, making this option an incorrect characterization of the policy's effect.