Online Access Free 70-535 Practice Test

Resources must authenticate to an identity provider.
You need to configure the Azure Access Control service.
What should you recommend? To answer, select the appropriate responses for each requirement in the answer area.

Correct Answer:

Explanation

Box 1:
* Token - A user gains access to an RP application by presenting a valid token that was issued by an authority that the RP application trusts.
* Identity Provider (IP) - An authority that authenticates user identities and issues security tokens, such as Microsoft account (Windows Live ID), Facebook, Google, Twitter, and Active Directory. When Azure Access Control (ACS) is configured to trust an IP, it accepts and validates the tokens that the IP issues. Because ACS can trust multiple IPs at the same time, when your application trusts ACS, you can your application can offer users the option to be authenticated by any of the IPs that ACS trusts on your behalf.
Box 2: WS-Trust is a web service (WS-*) specification and Organization for the Advancement of Structured Information Standards (OASIS) standard that deals with the issuing, renewing, and validating of security tokens, as well as with providing ways to establish, assess the presence of, and broker trust relationships between participants in a secure message exchange. Azure Access Control (ACS) supports WS-Trust 1.3.
Incorrect: ACS does not support Kerberos.
References:

A company requires secure communication between virtual machines (VMs) without exposing credentials.
The security officer wants to perform proof-of-concept testing using managed service identities.
You need to recommend a solution for performing proof-of-concept testing.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

Here's an example of how System Assigned Identities work with Azure Virtual Machines:

References: https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview

A company uses several Azure services.
You need to design a solution to automatically detect security issues by using Azure Security Center.
Which three detection capabilities should you recommend? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point

• A.security playbooks
• B.anomaly detection
• C.behavioral analytics
• D.integrated threat intelligence
• E.just in time access control

You are designing an Azure application that provides online backup storage for hundreds of media files. Each file is larger than 1GB.
The data storage solution has the following requirements:
* Be capable of storing an average of 2 terabytes (TB) of data for each user.
* Support sharing of data between all Microsoft Azure instances
* Provide random read/write access
You need to recommend a durable data storage solution.
What should you recommend?

• A.Azure Page Blob service
• B.Local storage on the VM
• C.Azure Block Blob service
• D.Store data in the VHD file

You are converting an existing ASP.NET web application to use the Azure Active Directory (AD) Access Control service for authentication. The application will authenticate users by using their Yahoo account credentials. You need to determine the correct payload for each stage of the authentication process. What should you do? To answer, drag the appropriate payload format to the correct location on the dialog box. Each payload format may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Correct Answer:

Explanation

Azure AD can support password-based single sign on for any cloud-based app that has an HTML-based sign-in page. By using a custom browser plugin, AAD automates the user's sign in process via securely retrieving application credentials such as the username and the password from the directory, and enters these credentials into the application's sign in page on behalf of the user.
Microsoft Azure Active Directory Access Control (also known as Access Control Service or ACS) supports federation with Yahoo! as an identity provider using the OpenID 2.0 authentication protocol.
References:
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis
https://msdn.microsoft.com/en-us/library/azure/gg185921.aspx