Correct Answer: B

The option is Allow Anonymous requests. This option turns on authentication and authorization in App Service, but defers authorization decisions to your application code. For authenticated requests, App Service also passes along authentication information in the HTTP headers.

This option provides more flexibility in handling anonymous requests.

Incorrect Answers:

A. Function

Not a valid authentication level for public read-only operations.

C. Admin

Not a valid authentication level for public read-only operations.

Reference:

https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

Correct Answer: B

Need to provide read only operations and should not allow write operations. So GET only.

Reference:

https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

Correct Answer: B

Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. Traditional load balancers operate at the transport layer (OSI layer 4 - TCP and UDP) and route traffic based on source IP address and port, to a destination IP address and port.

Application Gateway can make routing decisions based on additional attributes of an HTTP request, for example URI path or host headers. For example, you can route traffic based on the incoming URL. So if /images is in the incoming URL, you can route traffic to a specific set of servers (known as a pool) configured for images. If /video is in the URL, that traffic is routed to another pool that's optimized for videos.

This type of routing is known as application layer (OSI layer 7) load balancing. Azure Application Gateway can do URL-based routing and more.

Reference:

https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq

https://docs.microsoft.com/en-us/azure/application-gateway/overview

Correct Answer: A

Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks.

Reference:

https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

Correct Answer: A

Azure active directory (AD) provides cloud based directory and identity management services.You can use azure AD to manage users of your application and authenticate access to your applications using azure active directory.

You register your application with Azure active directory tenant.

Incorrect Answers:

B. An Azure AD managed identity

Managed identities eliminate the need for developers to manage credentials. Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication.

C. Azure AD Application Proxy

Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications

Reference:

https://codingcanvas.com/using-azure-active-directory-authentication-in-your-web-application/

https://docs.microsoft.com/en-us/graph/auth-register-app-v2

Correct Answer: A

Conditional Access policies at their simplest are if-then statements, if a user wants to access a resource, then they must complete an action.

By using Conditional Access policies, you can apply the right access controls when needed to keep your organization secure and stay out of your user's way when not needed.

Conditional Access policies at their simplest are if-then statements, if a user wants to access a resource, then they must complete an action. Example: A payroll manager wants to access the payroll application and is required to perform multi-factor authentication to access it.

Incorrect Answers:

B. An Azure AD administrative unit

Administrative units restrict permissions in a role to any portion of your organization that you define. You could, for example, use administrative units to delegate the Helpdesk Administrator role to regional support specialists, so they can manage users only in the region that they support.

C. Azure application gateway

Application gateway is a load balancing solution.

D. Azure Blueprints

Azure Blueprints enables cloud architects and central information technology groups to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements.

E. Azure Policy

Azure policies are used to enforce organizational standards.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

Correct Answer: D

Conditional Access policies are at their most basic an if-then statement combining signals, to make decisions, and enforce organization policies. One of those signals that can be incorporated into the decision-making process is network location.

Locations are designated in the Azure portal under Azure Active Directory > Security > Conditional Access > Named locations. These named network locations may include locations like an organization's headquarters network ranges, VPN network ranges, or ranges that you wish to block.

Incorrect Answers:

A. a virtual network and two Microsoft Cloud App Security policies

Virtual network is not required to define MFA.

B. a named location and two Microsoft Cloud App Security policies

Microsoft Cloud App Security access policies enable real-time monitoring and control over access to cloud apps based on user, location, device, and app.

C. a conditional access policy and two virtual networks

Virtual network is not required to define MFA.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#named-locations

Correct Answer: A

Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) automatically signs users in when they are on their corporate devices connected to your corporate network. When enabled, users don't need to type in their passwords to sign in to Azure AD, and usually, even type in their usernames. This feature provides your users easy access to your cloud-based applications without needing any additional on-premises components.

Seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

Correct Answer: A

Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) automatically signs users in when they are on their corporate devices connected to your corporate network. When enabled, users don't need to type in their passwords to sign in to Azure AD, and usually, even type in their usernames. This feature provides your users easy access to your cloud-based applications without needing any additional on-premises components.

Seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

Correct Answer: B

Instead install and configure an Azure AD Connect server.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso