Knowledge check

1.

A security engineer notices that a Gen2 VM has Trusted Launch enabled as its security type, but Microsoft Defender for Cloud isn't generating boot integrity alerts even after a suspected boot kit infection. Which Trusted Launch component is most likely not configured correctly?

Secure Boot

vTPM (virtual Trusted Platform Module)

Integrity monitoring

2.

An administrator needs to enable Trusted Launch on an existing Generation 1 virtual machine that runs a supported Windows Server workload. What is the correct approach?

Toggle the security type to Trusted Launch in the VM's Configuration settings in the Azure portal.

Migrate the VM to Generation 2 using the in-place upgrade process. The process converts the disk from Main Boot Record (MBR) to GUID Partition Table (GPT) and updates the firmware to UEFI.

Create a new Gen2 VM alongside the original and migrate data manually, then delete the Gen1 VM.

3.

A compliance team wants to ensure that all new Gen2 VMs deployed to a subscription are created with Trusted Launch enabled. They also want to identify existing Gen2 VMs that are eligible but not yet configured. Which combination of Azure Policy effects achieves both goals?

Apply the Audit effect to both the eligibility policy and the configuration policy.

Apply the Deny effect to the eligibility policy and the Audit effect to the configuration policy.

Apply the Audit effect to the eligibility policy and the Deny effect to the configuration policy.

Check your knowledge

Feedback