An analytics rule creates alerts and incidents from detection logic. It is not a global mechanism for assigning every new incident from all sources or adding triage flags after incident creation. While a specific analytics rule can set some incident details for incidents it generates, it does not meet the stated goal for all new incidents in the workspace. Sentinel automation rules or playbooks are the correct tools. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel analytics rules; Microsoft Learn > analytics rules create incidents, not global assignment handling.

==============================================================

Choose Admin1 because the planned Defender for Cloud change is to enable the NIST SP 800-53 Rev. 5 regulatory compliance standard for Sub1. Defender for Cloud implements regulatory compliance standards through Azure Policy initiatives, and assigning a new standard requires permissions to create or manage policy assignments.

Microsoft states that assigning a regulatory compliance standard requires Owner or Policy Contributor permissions at the relevant scope. Microsoft Learn Admin1 has the Resource Policy Contributor Azure role on Sub1, which provides the policy-management permissions required to assign policy initiatives and therefore supports enabling the NIST standard without granting broader resource-management permissions.

Admin2 has User Access Administrator, which manages Azure RBAC assignments but does not provide the policy-management permissions required for this operation. Admin3 has Contributor, which can manage Azure resources but is restricted from performing certain Microsoft.Authorization operations, including policy assignment operations needed here. Admin4 is a Global Administrator in Microsoft Entra but has no Azure role assignment for Sub1; Microsoft Entra directory administration does not automatically provide subscription-level Defender for Cloud policy-management rights.

Because Admin1 already has the specific policy-management role required for the change, selecting Admin1 satisfies both the functional requirement and the principle of least privilege.

===============

AKS1: AcrPull; ID1: Contributor

AKS1 needs to pull images from Azure Container Registry, so AcrPull is the least-privilege registry role for the cluster identity. ID1 requires Contributor in the visible answer area because the referenced technical requirement requires resource changes beyond a read-only or pull-only role. The important distinction is scope: AKS image retrieval should not receive Contributor, while the separate managed identity receives the broader role only for its implementation task. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AKS and managed identities; Microsoft Learn > ACR pull role and Azure RBAC.

==============================================================

Storage2 must be configured to use an account encryption key. The planned storage account must support Azure Table storage, while the technical requirement specifies that all storage data must be encrypted using Fabrikam-managed keys, meaning customer-managed keys (CMKs).

Azure Storage treats Table and Queue encryption differently from Blob Storage and Azure Files. Microsoft states that to encrypt Table Storage or Queue Storage with a customer-managed key, the storage account must be configured at creation time to use an encryption key scoped to the account rather than the default service-scoped key. After creation, this setting cannot be changed. Microsoft Learn

An encryption scope does not solve this requirement because encryption scopes apply to Blob Storage containers and individual blobs, not Azure Table data. Microsoft Learn

An Azure RBAC assignment may later be required so that the storage account ' s managed identity can access the customer-managed key in Key Vault, but it does not itself configure Table Storage to support account-level CMK encryption. Purge protection applies to Azure Key Vault rather than storage2.

Therefore, when storage2 is created, configure Table Storage to use the account encryption key.

===============

The first step is to enable a system-assigned managed identity on VM1. The scenario requires VM1 to read data from storage1 and also specifies that when VM1 is deleted, the permissions associated with VM1 must effectively cease automatically.

A system-assigned managed identity has a one-to-one lifecycle relationship with the Azure resource to which it belongs. Microsoft explicitly states that when the associated resource is deleted, its system-assigned managed identity is automatically deleted from Microsoft Entra ID. In contrast, a user-assigned identity such as ID1 exists independently and remains after the VM is deleted. Microsoft Learn

After enabling the identity, the appropriate storage data-plane role—such as Storage Blob Data Reader when VM1 requires read access to blobs—can be granted to VM1 ' s managed identity at the required scope. Microsoft documents this exact pattern for a Windows VM accessing Azure Storage: enable its managed identity and assign Storage Blob Data Reader to that identity. Microsoft Learn

Federated credentials are unnecessary for a VM ' s native managed identity. Assigning ID1 would violate the lifecycle requirement because ID1 is user-assigned and survives VM1 deletion. A role assignment cannot be created for VM1 ' s system identity until that identity exists.

Therefore, first enable VM1 ' s system-assigned managed identity.

For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn

For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource-management capabilities such as Contributor or Owner. Microsoft Learn

Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.

Encryption type

ExpressRoute circuits

Layer 2 encryption

ER3 and ER4 only

Layer 3 encryption

ER1, ER2, ER3, and ER4

For Layer 2 encryption, Azure ExpressRoute uses MACsec (Media Access Control Security). Microsoft states that MACsec is available for ExpressRoute Direct connections because customers have dedicated physical ports connecting their edge routers directly to Microsoft Enterprise Edge routers. Therefore, both ER3 (ExpressRoute Direct) and ER4 (ExpressRoute Metro Direct) can use MACsec. Provider-based ExpressRoute circuits such as ER1 and ER2 do not expose dedicated ExpressRoute Direct ports to the customer and therefore do not support this native Layer 2 MACsec capability. Microsoft Learn

For Layer 3 encryption, ExpressRoute can use IPsec over ExpressRoute private peering. Unlike MACsec, IPsec is an end-to-end network-layer encryption mechanism and is not dependent on ExpressRoute Direct physical ports. Microsoft states that IPsec over ExpressRoute works with any ExpressRoute circuit, allowing encrypted connectivity between the on-premises network and Azure over private peering.

The technical requirement states that all outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. To accomplish this, the Function App hosting plan must support outbound virtual network integration, because the application must send outbound traffic into an Azure virtual network from which routes learned through or directed toward the ExpressRoute gateway can reach the on-premises environment.

Fa1, which uses the Flex Consumption plan, supports virtual network integration. Microsoft documents that Flex Consumption provides outbound virtual network connectivity and can therefore reach resources accessible through the integrated virtual network. Microsoft Learn

Fa3, which uses a Dedicated App Service plan, also supports outbound virtual network integration. Microsoft further documents that VNet-integrated Functions can have outbound traffic affected by BGP routes learned from an ExpressRoute gateway, and route tables can direct traffic through that gateway. Microsoft Learn

Fa2, however, uses the legacy Consumption plan, which does not support outbound virtual network integration. Consequently, it cannot meet the requirement to route its outbound on-premises traffic through ExpressRoute using this architecture. Microsoft Learn

Therefore, only Fa1 and Fa3 support the required networking configuration.

To create a new Azure AD directory named 28681041.onmicrosoft.com that contains a new user named user1@28681041.onmicrosoft.com, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select Domains.

Select Add domain.

In the Add a custom domain pane, enter the following information:

Domain name: Enter the domain name you want to use. For example, 28681041.onmicrosoft.com.

Add domain: Select Add domain.

In the left pane, select Users.

Select New user.

In the New user pane, enter the following information:

User name: Enter the user name you want to use. For example, user1@28681041.onmicrosoft.com.

Name: Enter the name of the user.

Password: Enter a password for the user.

Groups: Select the groups you want the user to be a member of.

Select Create.

You can find more information on these topics in the following Microsoft documentation:

Add a custom domain name to Azure Active Directory

Create a new user in your organization - Azure Active Directory

To configure Azure to allow RDP connections from the Internet to a virtual machine named VM1, you can follow the steps below:

Create a new inbound security rule in the network security group (NSG) that is associated with the virtual network subnet that contains VM1. The rule should allow RDP traffic from the Internet to the virtual network subnet. You can use the Azure portal, Azure PowerShell, or Azure CLI to create the rule.

Configure the network security group (NSG) to associate it with the virtual network subnet that contains VM1.

Configure the virtual machine to allow RDP traffic. You can use the Azure portal, Azure PowerShell, or Azure CLI to configure the virtual machine.

To minimize the attack surface of VM1, you can use the following best practices:

Use a strong password for the local administrator account on the virtual machine.

Use Network Security Groups (NSGs) to restrict traffic to only the necessary ports and protocols.

Use Azure Security Center to monitor and protect your virtual machines.