- (Exam Topic 3)
Your company plans to provision blob storage by using an Azure Storage account The blob storage will be accessible from 20 application sewers on the internet. You need to recommend a solution to ensure that only the application servers can access the storage account. What should you recommend using to secure the blob storage?

1. A. service tags in network security groups (NSGs)
2. B. managed rule sets in Azure Web Application Firewall (WAF) policies
3. C. inbound rules in network security groups (NSGs)
4. D. firewall rules for the storage account
5. E. inbound rules in Azure Firewall

Correct Answer: D

- (Exam Topic 3)
Your company is developing an invoicing application that will use Azure Active Directory (Azure AD) B2C. The application will be deployed as an App Service web app. You need to recommend a solution to the application development team to secure the application from identity related attacks. Which two configurations should you recommend? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

1. A. Azure AD Conditional Access integration with user flows and custom policies
2. B. Azure AD workbooks to monitor risk detections
3. C. custom resource owner password credentials (ROPC) flows in Azure AD B2C
4. D. access packages in Identity Governance
5. E. smart account lockout in Azure AD B2C

Correct Answer: AE
https://docs.microsoft.com/en-us/azure/active-directory-b2c/threat-management
https://docs.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow?pivots=b2c-user-flow

- (Exam Topic 3)
You are designing the security standards for containerized applications onboarded to Azure. You are evaluating the use of Microsoft Defender for Containers.
In which two environments can you use Defender for Containers to scan for known vulnerabilities? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

1. A. Linux containers deployed to Azure Container Registry
2. B. Linux containers deployed to Azure Kubernetes Service (AKS)
3. C. Windows containers deployed to Azure Container Registry
4. D. Windows containers deployed to Azure Kubernetes Service (AKS)
5. E. Linux containers deployed to Azure Container Instances

Correct Answer: AB
https://docs.microsoft.com/en-us/learn/modules/design-strategy-for-secure-paas-iaas-saas-services/9-specify-sec https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction#view-vulnerabi