Question 100A compliance team applies Azure Policy to Arc-enabled Windows servers but mistakes a missing guest-configuration assignment for a fully compliant baseline. How can administrators make this correction durable through future changes? Include plan and extension checks in every Arc onboarding runbook and alert on disconnected security sensors. Check policy assignment scope and Arc extension drift whenever additional server subscriptions or resource groups are onboarded. Monitor data collection rule assignment and event-ingestion latency after changes to Arc servers and workspace routing. Assign remediation owners, exception expiry and evidence-based validation for server-security recommendations. ExplanationCorrect Answer B:Check policy assignment scope and Arc extension drift whenever additional server subscriptions or resource groups are onboarded. This preventive control maintains the intended protection because azure Policy assessments require correct assignment and compatible guest reporting; unassigned configurations cannot certify server compliance. The initial action remains: Deploy the supported policy/guest-configuration extension and explicitly assign an applicable initiative before interpreting compliance results. Other Answers A:Arc connection alone supplies management inventory; Defender capabilities depend on plan activation and required sensing components. Reducing this risk requires a practice to check policy assignment scope and Arc extension drift whenever additional server subscriptions or resource groups are onboarded. C:Microsoft Sentinel analysis requires ingestion; an analytics rule cannot detect events that no connector or DCR delivers. Reducing this risk requires a practice to check policy assignment scope and Arc extension drift whenever additional server subscriptions or resource groups are onboarded. D:Defender for Cloud recommendations are posture findings; closing a work item is not equivalent to changing the underlying host configuration. The stronger recurring control is to check policy assignment scope and Arc extension drift whenever additional server subscriptions or resource groups are onboarded.
Question 101A financial organization wants domain computers to exchange authenticated traffic but its proposed rule permits IPsec bypass on every network interface. What should the administrator change first to resolve the stated issue? Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. Inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. Configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. Add an explicit outbound Windows Firewall policy restricting SMB traffic to authorized destinations while preserving required local service flows. ExplanationCorrect Answer C:Configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. This resolves the observed failure because domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. A suitable acceptance check is: Test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection. Other Answers A:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. A more relevant action is to configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. B:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. The corrective action for this requirement is to configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. D:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. A more relevant action is to configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints.
Question 102A financial organization wants domain computers to exchange authenticated traffic but its proposed rule permits IPsec bypass on every network interface. Which cause-and-effect mechanism best fits this evidence? Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. Domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. ExplanationCorrect Answer D:Domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. The mechanism explains the corrective action: Configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. The associated validation is: Test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection. Other Answers A:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. By contrast, domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. B:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. In the stated system, domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. C:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. In the stated system, domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets.
Question 103A financial organization wants domain computers to exchange authenticated traffic but its proposed rule permits IPsec bypass on every network interface. What should the engineer check to distinguish success from a superficial fix? Attempt SMB connections to approved and unapproved targets and inspect expected allowed and blocked events. Review effective security rules and test the approved client connection while verifying disallowed sources remain blocked. Use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. Test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection. ExplanationCorrect Answer D:Test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection. This evidence tests whether the team actually completed: Configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. It addresses the risk because domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. Other Answers A:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. The relevant acceptance check is to test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection. B:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. The failure is checked more directly by a test to test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection. C:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. The relevant acceptance check is to test an authorized domain machine and an unmanaged device and confirm policy allows only the intended authenticated connection.
Question 104A financial organization wants domain computers to exchange authenticated traffic but its proposed rule permits IPsec bypass on every network interface. What should be added to the permanent maintenance checklist? Review application dependency changes before widening outbound SMB allowances for new service endpoints. Require narrow inbound administration rules and review active profiles and remote-address scopes after server redeployment. Audit connection security rules, certificate or Kerberos prerequisites, and exceptions during network topology changes. Manage Azure NSG and Windows firewall rules together in an end-to-end server connectivity change checklist. ExplanationCorrect Answer C:Audit connection security rules, certificate or Kerberos prerequisites, and exceptions during network topology changes. This preventive control maintains the intended protection because domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. The initial action remains: Configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. Other Answers A:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. The lasting safeguard is to audit connection security rules, certificate or Kerberos prerequisites, and exceptions during network topology changes. B:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. The lasting safeguard is to audit connection security rules, certificate or Kerberos prerequisites, and exceptions during network topology changes. D:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. The stronger recurring control is to audit connection security rules, certificate or Kerberos prerequisites, and exceptions during network topology changes.
Question 105An administrator opens TCP 3389 to all sources on a Windows Server because a single approved management subnet cannot connect. What is the most appropriate action given the observed constraints? Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. Inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. Add an explicit outbound Windows Firewall policy restricting SMB traffic to authorized destinations while preserving required local service flows. Offer temporary just-in-time management requests while retaining the unrestricted all-sources TCP 3389 Windows Firewall rule. ExplanationCorrect Answer A:Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. This resolves the observed failure because host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. A suitable acceptance check is: Use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. Other Answers B:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. The required change instead is to scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. C:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. This failure calls for a decision to scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. D:Offer temporary just-in-time management requests while retaining the unrestricted all-sources TCP 3389 Windows Firewall rule. Temporary requests do not reduce exposure while the Windows Server host firewall still permits RDP from all sources. This case needs explicit scoping of its inbound RDP rule to the approved subnet.
Question 106An administrator opens TCP 3389 to all sources on a Windows Server because a single approved management subnet cannot connect. What principle explains why the correct response works? Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. ExplanationCorrect Answer A:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. The mechanism explains the corrective action: Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. The associated validation is: Use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. Other Answers B:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. By contrast, host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. C:JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. In the stated system, host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. D:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. By contrast, host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally.
Question 107An administrator opens TCP 3389 to all sources on a Windows Server because a single approved management subnet cannot connect. What observable evidence would verify that the fix succeeded? Request authorized temporary access and confirm the management port closes again after the permitted interval expires. Use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. Attempt SMB connections to approved and unapproved targets and inspect expected allowed and blocked events. Review effective security rules and test the approved client connection while verifying disallowed sources remain blocked. ExplanationCorrect Answer B:Use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. This evidence tests whether the team actually completed: Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. It addresses the risk because host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. Other Answers A:JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. The failure is checked more directly by a test to use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. C:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. Proving this correction calls for a check to use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs. D:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. A more meaningful verification is to use Test-NetConnection from an approved jump host and a denied network segment, then inspect firewall logs.
Question 108An administrator opens TCP 3389 to all sources on a Windows Server because a single approved management subnet cannot connect. What control should be sustained after the immediate fix? Audit JIT access approvals and reject standing broad management exceptions without explicit risk acceptance. Review application dependency changes before widening outbound SMB allowances for new service endpoints. Manage Azure NSG and Windows firewall rules together in an end-to-end server connectivity change checklist. Require narrow inbound administration rules and review active profiles and remote-address scopes after server redeployment. ExplanationCorrect Answer D:Require narrow inbound administration rules and review active profiles and remote-address scopes after server redeployment. This preventive control maintains the intended protection because host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. The initial action remains: Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. Other Answers A:JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. The lasting safeguard is to require narrow inbound administration rules and review active profiles and remote-address scopes after server redeployment. B:Outbound host firewall enforcement constrains lateral movement even when upstream routing makes arbitrary TCP 445 destinations reachable. The stronger recurring control is to require narrow inbound administration rules and review active profiles and remote-address scopes after server redeployment. C:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. Reducing this risk requires a practice to require narrow inbound administration rules and review active profiles and remote-address scopes after server redeployment.
Question 109An Azure-hosted Windows VM permits HTTPS in the guest firewall but inbound connections still time out at the virtual network boundary. Which next corrective action best addresses this failure? Configure temporary just-in-time management access and remove the permanent broad inbound RDP allowance where the service supports it. Configure Windows Defender Firewall connection security rules that require supported domain authentication on the designated internal endpoints. Scope the Windows Defender Firewall inbound RDP rule to the authorized management subnet and verify profile/application of the policy. Inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. ExplanationCorrect Answer D:Inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. This resolves the observed failure because azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. A suitable acceptance check is: Review effective security rules and test the approved client connection while verifying disallowed sources remain blocked. Other Answers A:JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. A more relevant action is to inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. B:Domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. A more relevant action is to inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. C:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. The corrective action for this requirement is to inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services.
Question 110An Azure-hosted Windows VM permits HTTPS in the guest firewall but inbound connections still time out at the virtual network boundary. Why does the proposed solution address the underlying problem? Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. Domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. ExplanationCorrect Answer A:Azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. The mechanism explains the corrective action: Inspect effective network security group rules and correct the narrowly scoped inbound allow before changing unrelated Windows services. The associated validation is: Review effective security rules and test the approved client connection while verifying disallowed sources remain blocked. Other Answers B:Host firewall rules can limit permitted remote addresses and profiles, avoiding the risk of opening remote administration globally. By contrast, azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. C:JIT access narrows the temporal and source exposure of sensitive management ports compared with always-open NSG rules. In the stated system, azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG. D:Domain isolation uses authenticated IPsec-based connections to distinguish trusted domain traffic from unauthenticated network packets. In the stated system, azure NSGs filter traffic outside the guest OS, so a correctly configured Windows firewall does not override a blocking NSG.
