Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 181Question →

You manage a Microsoft Entra ID tenant. You need to enable Self-Service Password Reset (SSPR) for a subset of users who belong to a group named SalesTeam.

Which configuration should you modify in the Microsoft Entra admin center to restrict SSPR to only these users?

Show answer & explanation

Answer: Set the SSPR enablement setting to Selected and choose the SalesTeam group.

Answer

Set the SSPR enablement setting to Selected and choose the SalesTeam group.
The correct option correctly states that SSPR enablement should be set to 'Selected' and the target group chosen. This limits the policy scope to members of that group.

Step-by-Step Solution

1
Navigate to the Password Reset section in the Microsoft Entra admin center.
You reach the Properties blade for SSPR settings.
This blade controls the scope of users who can use Self-Service Password Reset.
2
Select the option to enable SSPR for 'Selected' instead of 'All' or 'None'.
A group selection option becomes available.
Choosing 'Selected' allows scoping SSPR to one specific group.
3
Browse and select the SalesTeam group, then save the changes.
SSPR is enabled only for members of the SalesTeam group.
This configuration directly satisfies the requirement to restrict SSPR to only the target subset of users.

Key Concept

Scoping Self-Service Password Reset (SSPR) to a specific group in Microsoft Entra ID.
Question 182Question →

An administrator is designing a deployment strategy for an Azure Virtual Machine Scale Set (VMSS) named `VMSS1`. The scale set must meet the following requirements:
- Maximize application availability by distributing VM instances across multiple fault domains in a single region without using Availability Zones.
- Automate scaling based on average CPU utilization using Azure Monitor autoscale rules.
- Support the deployment of custom VM sizes within the same scale set.

The administrator configures the scale set to use Flexible orchestration mode and defines a virtual machine profile.

During testing, the administrator needs to roll out an updated OS image to the scale set. The update must be applied to all existing instances while maintaining application availability.

Which of the following actions should the administrator perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the `platformFaultDomainCount` property to a value greater than 11 during the creation of the scale set.; Manually apply the updated scale set model to the virtual machine instances in a staggered manner.

Answer

Configure the `platformFaultDomainCount` property to a value greater than 11 during the creation of the scale set, and manually apply the updated scale set model to the virtual machine instances in a staggered manner.
In Flexible orchestration mode, virtual machine scale sets only support the Manual upgrade policy for VM model updates. Therefore, to apply a new OS image or configuration change to existing instances, the administrator must manually apply the scale set model to the virtual machines. Applying the update in a staggered manner manually ensures that some instances remain online, satisfying the availability requirement. Furthermore, to distribute virtual machine instances across multiple fault domains in a single region without using Availability Zones, the `platformFaultDomainCount` property must be explicitly set to a value greater than 11 (such as 22 or 33) at the time the scale set is created.

Step-by-Step Solution

1
Determine the orchestration mode and upgrade policy constraints.
Identify that `VMSS1` is configured with Flexible orchestration mode. In this mode, the upgrade policy is restricted to Manual. Automatic and Rolling upgrade policies are not supported.
This determines how the OS image update must be applied to the existing VM instances.
2
Determine how to apply the model update.
Since only the Manual upgrade policy is supported, the update must be manually applied to each instance. To maintain application availability, the update should be applied in a staggered or batched manner.
This satisfies the requirement of updating existing instances while maintaining application availability.
3
Determine how to distribute VM instances across multiple fault domains without Availability Zones in Flexible mode.
Configure the `platformFaultDomainCount` property to a value greater than 11 (e.g., 22 or 33 depending on the region) during scale set creation.
This property must be set at creation time and cannot be modified later. Setting it greater than 11 ensures VMs are spread across separate physical hardware racks.

Key Concept

Azure VMSS Flexible Orchestration Mode Upgrade Policies and Fault Domain Configurations
Estimated Time:3m 0s
Question 183Question →

You manage an Azure subscription named Sub1. You plan to configure customer-managed key (CMK) encryption for an Azure storage account named contosostore1 by using an existing Azure key vault named contosokeyvault1. The resources are configured as follows:
- contosostore1 has a user-assigned managed identity named identity1 associated with it. The storage account firewall is enabled.
- contosokeyvault1 uses the Azure RBAC permission model. Soft-delete is enabled, but purge protection is disabled. The Key Vault firewall is configured to allow access from selected networks only.
You need to ensure that contosostore1 can encrypt data using a key from contosokeyvault1. The solution must follow the principle of least privilege.
Which two actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable purge protection on contosokeyvault1.; Assign the Key Vault Crypto Service Encryption User role to identity1 at the scope of contosokeyvault1.

Answer

Enable purge protection on the key vault, and assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity at the scope of the key vault.
To successfully configure customer-managed keys (CMK) for an Azure Storage account, two key requirements must be satisfied: Key Vault protection settings and appropriate data plane permissions. First, Azure Storage mandates that the Key Vault must have both soft-delete and purge protection enabled to prevent permanent data loss due to accidental or malicious key deletion. Because purge protection is disabled on the key vault, it must be enabled. Second, because the key vault uses the Azure RBAC permission model, permissions must be granted using Azure RBAC roles. The user-assigned managed identity associated with the storage account requires data plane permissions to perform key operations (specifically wrap and unwrap). The Key Vault Crypto Service Encryption User role is the least-privilege role that grants these permissions.

Step-by-Step Solution

1
Enable purge protection on the key vault.
The Key Vault meets the security prerequisites for Azure Storage CMK integration.
Azure Storage mandates that both soft-delete and purge protection be enabled on the Key Vault holding the encryption key to prevent permanent data loss due to accidental key deletion.
2
Identify the permission model of the key vault and assign the data plane role.
The user-assigned managed identity identity1 is granted key wrap/unwrap permissions.
Because the Key Vault uses Azure RBAC, control plane roles like Owner or Contributor do not grant data plane access to keys. The identity must be assigned the Key Vault Crypto Service Encryption User role at the Key Vault scope, which is the least-privilege data plane role required for storage encryption.

Key Concept

Azure Storage customer-managed key configuration requirements, including Key Vault protection settings and Azure RBAC data plane permissions.
Question 184Question →

An administrator creates a monthly budget named `Dev-Budget` for an Azure subscription. The budget is set to 500.Theadministratorwantstoensurethattheyarenotifiedviaemailwhentheactualsubscriptioncostexceeds90500. The administrator wants to ensure that they are notified via email when the actual subscription cost exceeds 90% of the budget. However, during the first month, the cost reaches 475, but no email notifications are received. What is the most likely cause of this issue?

Show answer & explanation

Answer: The administrator did not specify email recipients or associate an action group with the budget alert thresholds.

Answer

The administrator did not configure any email recipients or action groups for the budget alert thresholds.
The correct answer is that no email recipients or action groups were configured. Azure Cost Management budgets do not have default notification paths. When configuring a budget threshold (such as 90% of the budget), the administrator must explicitly enter email addresses or associate an action group to receive the notification.

Step-by-Step Solution

1
Analyze the budget scenario and check why the expected alert was not sent despite the cost (475)exceeding90475) exceeding 90% of the 500 budget ($450).
The cost has crossed the threshold, meaning an alert should have been triggered.
To verify that the threshold logic itself was met.
2
Review the configuration requirements for Azure budget alerts.
Azure budgets require defining either email recipients or an action group at the specific threshold level to send any notifications.
Without configuring recipients or action groups, the alert triggers silently with no action taken.

Key Concept

Azure budgets require explicit configuration of email recipients or action groups at the threshold level to send notifications.
Question 185Question →

An administrator needs to generate a Shared Access Signature (SAS) token to grant an external application access to a blob container. The administrator wants to secure the SAS token by limiting access to a specific network range and ensuring encrypted transit.

Which two settings should the administrator configure directly on the SAS token to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Allowed IP addresses; Allowed protocols set to HTTPS only

Answer

The correct settings to configure on the SAS token are 'Allowed IP addresses' and 'Allowed protocols set to HTTPS only'.
To restrict access to a specific network range, the 'Allowed IP addresses' parameter can be set when generating the SAS token. To ensure encrypted transit, the 'Allowed protocols set to HTTPS only' parameter must be configured. These settings are applied directly to the SAS token to enforce network and protocol security constraints.

Step-by-Step Solution

1
Identify the network restriction requirement.
The administrator must restrict access to a specific network range, which is achieved by specifying the Allowed IP addresses range.
This restricts the SAS token usage to client requests originating from designated IP addresses.
2
Identify the transit encryption requirement.
The administrator must ensure secure, encrypted transport, which is achieved by setting Allowed protocols to HTTPS only.
This prevents the token from being used over unencrypted HTTP connections.

Key Concept

Shared Access Signatures (SAS) allow delegation of access to Azure Storage resources with specific restrictions, such as IP constraints and protocol requirements.
Question 186Question →

Your Azure subscription contains two resource groups:

* `RG-App`, which has the tag `AppID: 9910` and a `CanNotDelete` resource lock.
* `RG-Database`, which has the tag `AppID: 9910` and a `ReadOnly` resource lock.

An Azure Policy is assigned at the subscription scope. The policy denies the deployment of any resources that do not have the `AppID` tag.

You attempt to perform the following operations:

1. Deploy a new virtual machine to `RG-App` while specifying the tag `AppID: 9910` in the deployment template.
2. Change the pricing tier (SKU) of an Azure SQL database located in `RG-Database`.
3. Delete a blob container from a storage account located in `RG-App`.
4. Deploy a new virtual network to `RG-App` without specifying any tags in the deployment template.

Which operations can be completed successfully?

Show answer & explanation

Answer: 1 and 3 only

Answer

The operations that can be completed successfully are deploying a new virtual machine to the first resource group with the required tag specified, and deleting a blob container from the storage account inside the first resource group.
The option stating '1 and 3 only' is correct. Operation 1 succeeds because a CanNotDelete lock allows the creation of new resources, and the deployment template includes the required tag to satisfy the Azure Policy. Operation 3 succeeds because the CanNotDelete lock on the resource group inherits to the storage account, preventing the storage account itself from being deleted, but it does not block data-plane or sub-resource deletions like removing a blob container.

Step-by-Step Solution

1
Evaluate the impact of locks and policies on Operation 1.
Operation 1 succeeds.
A CanNotDelete lock allows the creation of new resources. Since the deployment template explicitly includes the AppID tag, it satisfies the subscription-level Azure Policy.
2
Evaluate the impact of locks on Operation 2.
Operation 2 fails.
The SQL database inherits the ReadOnly lock from its parent resource group. A ReadOnly lock prevents all write and update operations, including changing the SKU of a database.
3
Evaluate the impact of locks on Operation 3.
Operation 3 succeeds.
The CanNotDelete lock on the parent resource group inherits to the storage account and prevents the deletion of the storage account resource itself. However, it does not restrict data-plane or sub-resource operations, so deleting a blob container is allowed.
4
Evaluate the impact of tag inheritance and policy on Operation 4.
Operation 4 fails.
Azure resources do not inherit tags from their parent resource group automatically. Without explicit tags in the deployment, the new virtual network will lack the AppID tag, causing the subscription's Deny policy to block the deployment.

Key Concept

Resource lock inheritance (ReadOnly vs. CanNotDelete) and tag inheritance behavior under Azure Policy evaluation.
Estimated Time:3m 0s
Question 187Question →

An organization has a standard General Purpose v2 (GPv2) storage account named stprocessing2026 in the East US region. The storage account is configured with Read-Access Geo-Redundant Storage (RA-GRS) and replicates data to West US. A lifecycle management policy is applied to the storage account to transition and delete old blobs. Due to a major disaster, a customer-managed failover is initiated, converting the storage account to West US. Which two statements correctly describe the behavior of the lifecycle policy and replication in this scenario? (Select two.)

Select all that apply

Show answer & explanation

Answer: Prior to the failover, deletions performed by the lifecycle policy on the primary endpoint are asynchronously replicated to the secondary endpoint.; The lifecycle management policy configuration is replicated to the secondary region and automatically runs on the new primary endpoint after the failover completes.

Answer

Prior to the failover, deletions performed by the lifecycle policy on the primary endpoint are asynchronously replicated to the secondary endpoint, and the lifecycle management policy configuration is replicated to the secondary region and automatically runs on the new primary endpoint after the failover completes.
The correct statements are that before failover, deletions performed by the lifecycle policy on the primary endpoint are asynchronously replicated to the secondary endpoint, and after failover, the lifecycle policy configuration executes on the new primary endpoint since it is replicated as part of the storage account metadata.

Step-by-Step Solution

1
Analyze lifecycle management execution location
Determine that lifecycle policies run on the active primary endpoint of the storage account. They do not run on the read-only secondary endpoint before failover.
Lifecycle actions require write/delete access, which is not available on a read-only secondary endpoint.
2
Analyze replication of lifecycle deletions
Identify that deletions and tier changes occurring on the primary endpoint are replicated asynchronously to the secondary endpoint as part of standard replication.
All data-plane changes made on the primary endpoint are replicated to the secondary endpoint under GRS/RA-GRS.
3
Analyze failover control-plane requirements
Determine that failover is a control-plane management task, requiring roles like Contributor or Storage Account Contributor.
Data-plane roles like Storage Blob Data Owner are for accessing blob data directly, not for managing resource state or initiating failovers.

Key Concept

Interaction of Blob Storage Lifecycle Management rules with Geo-Redundant Storage (GRS) failovers and the separation of control-plane versus data-plane roles.
Estimated Time:2m 0s
Question 188Question →

An administrator needs to configure secure private access to an Azure Storage account named corpstore2026 from a virtual network named VNet1. The solution must ensure that resources in VNet1 can resolve the storage account's fully qualified domain name (FQDN) to its private IP address. All public internet access to the storage account must be blocked. In which order should the administrator perform the configuration steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure secure private access and DNS resolution for the storage account, the administrator must first create the Private DNS zone, link it to the virtual network, deploy the private endpoint to allocate a private IP address, retrieve that private IP address, and finally create the DNS A record mapping the FQDN to the private IP address.
The correct sequence ensures that the DNS infrastructure is prepared and linked to the virtual network first. Once the private endpoint is created, its allocated private IP address can be retrieved and registered as an A record in the Private DNS zone. This ensures seamless transition and correct name resolution from resources within VNet1.

Step-by-Step Solution

1
Create the Private DNS zone named privatelink.blob.core.windows.net.
The Private DNS zone is created in the Azure subscription, preparing the namespace for private resolution.
You must establish the private zone before you can link it to virtual networks or add records to it.
2
Link the Private DNS zone to VNet1.
A virtual network link is established between the Private DNS zone and VNet1.
This step enables name resolution within the virtual network so that resources in VNet1 query the private zone.
3
Create the private endpoint for corpstore2026 in Subnet1 of VNet1.
A private endpoint is provisioned, and a private IP address is allocated from Subnet1's range.
Creating the private endpoint establishes the physical private network interface and generates the private IP address needed for the DNS record.
4
Retrieve the allocated private IP address from the private endpoint's network interface.
The specific private IP address is identified.
The exact private IP address must be known to create the correct A record in the next step.
5
Create a DNS A record in the Private DNS zone mapping corpstore2026.blob.core.windows.net to the private IP address.
The DNS record is added to the private zone.
This updates the DNS resolution path so that requests from VNet1 directed to the storage account resolve to the private endpoint instead of the public endpoint.

Key Concept

Configuring private access to Azure Storage requires deploying a private endpoint and setting up private DNS resolution so that clients resolve the storage account's FQDN to its private endpoint IP address.
Estimated Time:2m 0s
Question 189Question →

An administrator manages an Azure resource hierarchy with the following structure:
* Management Group: `MG-Corporate`
* Subscription: `Sub-Production`
- Resource Group: `RG-AppData`
- Key Vault: `kv-prod-secrets`

A compliance auditor named `User-Auditor` requires the Reader role at the `Sub-Production` subscription level. However, organization policy dictates that `User-Auditor` must not be able to view any resources in `RG-AppData`. The administrator assigns the Reader role to `User-Auditor` at the `Sub-Production` subscription scope, and then attempts to assign a custom role that denies read actions to `User-Auditor` at the `RG-AppData` scope.

What is the effect of this configuration on the auditor's permissions?

Show answer & explanation

Answer: The auditor will have read access to all resources in both Sub-Production and RG-AppData because Azure RBAC role assignments are additive and standard RBAC does not support user-defined deny assignments.

Answer

The auditor will have read access to all resources in both Sub-Production and RG-AppData because Azure RBAC role assignments are additive and standard RBAC does not support user-defined deny assignments.
The correct answer is that the auditor will have read access to all resources in both Sub-Production and RG-AppData. In Azure RBAC, role assignments are additive. A user's effective permissions are the union of all roles assigned to them. Permissions inherited from a higher scope (Subscription) cannot be restricted or blocked by standard role assignments at a lower scope (Resource Group), as standard RBAC does not support user-defined deny assignments.

Step-by-Step Solution

1
Evaluate the effect of assigning the Reader role at the subscription level.
The User-Auditor is granted Reader permissions across all child scopes within the subscription, including the RG-AppData resource group.
Azure RBAC uses inheritance; permissions assigned at a higher scope flow down to all child scopes.
2
Evaluate the attempt to block access using a custom role at the resource group scope.
The attempt to block or deny access using a custom role at the resource group scope has no effect.
Azure RBAC is strictly additive. Standard custom roles and role assignments do not support deny actions; deny assignments can only be created by system processes such as Azure Blueprints or Deployment Stacks.
3
Determine the final combined permissions for the compliance auditor.
The compliance auditor retains read access to all resources under the Sub-Production subscription, including RG-AppData.
Because roles are additive and cannot be overridden by standard lower-scope assignments, the inherited Reader permission remains active.

Key Concept

Azure RBAC inheritance and additive permissions
Estimated Time:1m 30s
Question 190Question →

Zephyr Energy is deploying a critical database-driven application to the South Central US region. The deployment consists of two web servers (VM-Web1 and VM-Web2) and two database servers (VM-DB1 and VM-DB2).

You must configure the infrastructure to meet the following requirements:
- The web servers must be protected against localized hardware and power failures within a single datacenter, while minimizing latency between them.
- The database servers must be protected against datacenter-wide outages (such as flooding or utility power loss affecting an entire facility).
- The configuration must achieve the highest possible Service Level Agreement (SLA) for virtual machine uptime for each tier.

Which two configuration actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM-Web1 and VM-Web2 to a single Availability Set.; Deploy VM-DB1 and VM-DB2 to different Availability Zones.

Answer

Deploy VM-Web1 and VM-Web2 to a single Availability Set, and deploy VM-DB1 and VM-DB2 to different Availability Zones.
Deploying the web servers to a single Availability Set satisfies the low-latency requirement while protecting against rack-level power and hardware failures within the datacenter. Deploying the database servers across different Availability Zones provides the necessary protection against facility-wide outages by using physically isolated datacenters.

Step-by-Step Solution

1
Analyze the high availability and latency requirements for the web tier.
The web tier requires protection against localized hardware/power failures within a single datacenter while maintaining low latency. This aligns with the capabilities of Azure Availability Sets, which offer a 99.95% SLA and keep virtual machines in close proximity within a single datacenter.
Identifying the correct HA feature for the web tier involves balancing localized redundancy and low network latency.
2
Analyze the high availability requirements for the database tier.
The database tier requires protection against facility-wide/datacenter-wide outages. This necessitates physical separation across different datacenters within the region, which is provided by Azure Availability Zones (offering a 99.99% SLA).
Identifying the correct HA feature for the database tier requires choosing the feature that protects against zone/datacenter failures.
3
Evaluate the options against constraints and mutually exclusive features in Azure.
Availability Sets cannot span multiple Availability Zones, and virtual machines cannot belong to both an Availability Set and an Availability Zone. Therefore, the web servers must be placed in a single Availability Set, and the database servers must be placed in separate Availability Zones.
Understanding Azure compute HA constraints prevents selecting invalid configuration combinations.

Key Concept

Azure Availability Sets provide redundancy within a single datacenter (99.95% SLA) with low latency, whereas Azure Availability Zones provide physical separation across datacenters in a region (99.99% SLA) to protect against facility-wide outages. These configurations cannot be combined on the same VM resource.
Question 191Question →

Your organization has a Microsoft Entra ID tenant and an Azure resource hierarchy configured as follows:
* Management Group: `mg-logistics`
* Subscription: `sub-shipping`
* Resource Group: `rg-tracking`
* Storage Account: `stlogisticsapps`
* Virtual Machine: `vm-router`

You configure the following administrative assignments:
* User1: Assigned the Global Administrator directory role in Microsoft Entra ID with no direct Azure RBAC role assignments.
* User2: Assigned the Reader role at the subscription level (`sub-shipping`) and the Storage Blob Data Contributor role at the resource group level (`rg-tracking`).
* User3: Assigned the Contributor role at the management group level (`mg-logistics`).

You need to evaluate the effective permissions for the users within this hierarchy. Which of the following statements are correct? (Select two.)

Select all that apply

Show answer & explanation

Answer: User3 can create new resource groups within the sub-shipping subscription.; User2 can read blob data in the stlogisticsapps storage account using Microsoft Entra ID credentials.

Answer

User3 can create new resource groups within the sub-shipping subscription, and User2 can read blob data in the stlogisticsapps storage account using Microsoft Entra ID credentials.
The correct statements are that User3 can create resource groups within the subscription and User2 can read storage blob data using Entra ID. User3 inherits Contributor permissions from the management group level, which includes resource group creation at the subscription level. User2 inherits the Storage Blob Data Contributor role from the resource group level to the storage account, enabling data plane access, while their subscription-level Reader role provides control plane visibility.

Step-by-Step Solution

1
Evaluate the inheritance of control plane permissions for User3.
User3 inherits Contributor permissions at the subscription level from the management group.
Azure RBAC assignments at a higher scope (Management Group) inherit down to child scopes (Subscriptions, Resource Groups, and Resources).
2
Evaluate data plane and control plane access for User2.
User2 has Reader access at the subscription level (control plane) and Storage Blob Data Contributor access at the resource group level (data plane).
Data plane roles inherit down to child resources (Storage Account), allowing blob read/write operations via Entra ID credentials, while the control plane Reader role allows directory listing.
3
Evaluate the permissions of User1 (Global Administrator).
User1 has no direct permissions to manage subscription resources.
Microsoft Entra ID roles and Azure RBAC roles are separate. A Global Administrator must elevate access to manage Azure resources.
4
Evaluate data plane access for User3 (Contributor).
User3 has control plane access but no data plane access using Entra ID credentials.
Standard roles like Contributor or Owner do not grant data plane access for storage accounts when accessing blobs via Microsoft Entra ID authentication.

Key Concept

Azure RBAC inheritance down the resource hierarchy and the separation between Microsoft Entra ID roles, Azure control plane roles, and data plane roles.
Question 192Question →

Your company plans to implement a hybrid storage solution using Azure File Sync. You need to deploy the required Azure resources before installing the sync agent on your local servers. Which two of the following resources must you create in Azure to establish the synchronization topology? (Select two.)

Select all that apply

Show answer & explanation

Answer: A Storage Sync Service; A storage account containing an Azure file share

Answer

The correct resources to create are a Storage Sync Service and a storage account containing an Azure file share.
To set up Azure File Sync, you must deploy a Storage Sync Service, which is the top-level resource that manages registered servers and sync groups. Additionally, you need an Azure file share within a standard storage account to serve as the cloud endpoint where the synchronized data is stored in the cloud.

Step-by-Step Solution

1
Deploy the Storage Sync Service in Azure.
Creates the central management resource that coordinates the synchronization relationships.
The Storage Sync Service is required to register servers and group endpoints.
2
Create a storage account and an Azure file share.
Prepares the cloud-based target location for the synchronized files.
The file share will be configured as the cloud endpoint within the sync group.

Key Concept

Azure File Sync topology configuration and core prerequisites.
Question 193Question →

Nebula Streaming is deploying a new web application in the East Asia region. You configure an Availability Set named AvSet-Prod with three fault domains and five update domains. You deploy six virtual machines named VM1, VM2, VM3, VM4, VM5, and VM6 in sequential order into AvSet-Prod. During a planned Azure maintenance event that updates the underlying host hardware, which virtual machines are subject to being rebooted at the same time?

Show answer & explanation

Answer: VM1 and VM6

Answer

VM1 and VM6
The correct option is VM1 and VM6. In an Availability Set with 5 update domains, VMs are distributed sequentially across these domains: VM1 to Update Domain 0, VM2 to Update Domain 1, VM3 to Update Domain 2, VM4 to Update Domain 3, VM5 to Update Domain 4, and VM6 to Update Domain 0. During planned maintenance, Azure reboots virtual machines one update domain at a time. Therefore, VM1 and VM6 will be rebooted at the same time because they are in the same update domain.

Step-by-Step Solution

1
Determine the distribution of VMs across update domains.
Since there are 5 update domains (UD 0, 1, 2, 3, 4), the 6 VMs are assigned sequentially: VM1 to UD0, VM2 to UD1, VM3 to UD2, VM4 to UD3, VM5 to UD4, and VM6 back to UD0.
Azure distributes VMs in an Availability Set sequentially across the configured update domains to ensure high availability during planned maintenance.
2
Determine which domain is affected by planned maintenance.
Planned maintenance events reboot one update domain at a time.
Update domains are logical groupings of VMs and underlying physical hardware that can be rebooted at the same time.
3
Identify the VMs that share the same update domain.
VM1 and VM6 both share Update Domain 0.
Since VM1 and VM6 are in the same update domain, they are subject to being rebooted at the same time during host updates.

Key Concept

Availability Set Update Domains
Question 194Question →

An organization is deploying Azure File Sync to synchronize files between an on-premises Windows Server and an Azure file share. The server's local volume D: has a total capacity of 2,000 GB2,000\text{ GB}. To optimize local storage costs while ensuring performance for active workloads, the administrator wants to configure cloud tiering to meet the following requirements:

* Keep at least 400 GB400\text{ GB} of local capacity on volume D: free at all times to accommodate local application growth.
* Archive files to the cloud if they have not been accessed for more than 14 days14\text{ days}, regardless of the volume's current capacity.

Which of the following actions should the administrator perform on the server endpoint to satisfy these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Set the volume free space policy to 20%20\%.; Set the date policy to 14 days14\text{ days}.

Answer

To satisfy the requirements, the administrator must configure the volume free space policy to 20%20\% and configure the date policy to 14 days14\text{ days} on the server endpoint.
To maintain at least 400 GB400\text{ GB} of free space on a 2,000 GB2,000\text{ GB} volume, the volume free space policy percentage must be set to 20%20\% (calculated as 400/2000=20%400 / 2000 = 20\%). To tier files that have not been accessed in more than 14 days14\text{ days}, the date policy should be set to 14 days14\text{ days}. These policies work in tandem, ensuring that the volume maintains its free space while also archiving stale files.

Step-by-Step Solution

1
Calculate the volume free space percentage.
The target free space is 400 GB400\text{ GB} on a 2,000 GB2,000\text{ GB} volume. The percentage is 4002000×100=20%\frac{400}{2000} \times 100 = 20\%.
The volume free space policy requires a percentage value representing the desired free space to maintain on the volume.
2
Specify the date policy threshold.
The date policy threshold is set to 14 days14\text{ days}.
This configuration ensures that files not accessed for more than 14 days14\text{ days} are eligible to be tiered to the cloud.
3
Enable both policies on the server endpoint.
Both the volume free space policy and the date policy are configured concurrently.
When both policies are enabled, Azure File Sync evaluates both and tiers files based on whichever policy causes more tiering, satisfying both the storage capacity constraint and the file age constraint.

Key Concept

Azure File Sync cloud tiering policy parameters and their concurrent evaluation logic.
Question 195Question →

Your company's Azure environment is organized under a Root Management Group and a Production Management Group. It contains Subscription A, which hosts two resource groups: RG1 (containing a storage account named sa-prod-01 and a Key Vault named kv-prod-01) and RG2 (containing multiple virtual machines). You need to configure access for a Microsoft Entra ID security group named DevOps-Staff to meet the following requirements:

1. Members must be able to create, delete, and manage virtual machines within RG2.
2. Members must be able to configure Azure role assignments on resources inside RG1.
3. Members must not have permissions to modify, delete, or write configuration settings to the sa-prod-01 storage account.

Which two of the following role assignments should you configure to meet the requirements while adhering to the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Assign the Virtual Machine Contributor role to the DevOps-Staff group at the RG2 scope.; Assign the User Access Administrator role to the DevOps-Staff group at the RG1 scope.

Answer

To meet the requirements, assign the Virtual Machine Contributor role to the DevOps-Staff group at the RG2 scope, and assign the User Access Administrator role to the DevOps-Staff group at the RG1 scope.
Assigning the Virtual Machine Contributor role at the RG2 scope allows management of virtual machines within that resource group, satisfying the first requirement under the principle of least privilege. Assigning the User Access Administrator role at the RG1 scope enables managing role assignments on resources inside RG1 without granting control plane write or delete permissions over the resources, satisfying the second and third requirements.

Step-by-Step Solution

1
Address the requirement to create and manage virtual machines within RG2.
Identify that the Virtual Machine Contributor role contains the required actions to manage VMs but limits its scope to RG2, adhering to least privilege.
Assigning permissions at the resource group scope prevents horizontal privilege escalation to other resource groups such as RG1.
2
Address the requirement to manage role assignments in RG1 without modifying sa-prod-01.
Identify that the User Access Administrator role permits authorization modifications (Microsoft.Authorization/*) at the RG1 scope, but lacks data plane or control plane write permissions on storage resources.
This configuration satisfies the access-management goal while preventing structural modifications to the storage account or other resources within RG1.
3
Evaluate and rule out directory-level administrative roles.
Confirm that Microsoft Entra ID roles (like Privileged Role Administrator) do not grant access to Azure subscription-level resources or local role-assignment management.
Azure Resource RBAC and Microsoft Entra ID roles exist in separate authorization planes.
4
Evaluate and rule out custom deny assignment configurations.
Verify that Azure RBAC is an additive-only permission model for user-defined assignments and does not support user-created deny assignments.
Deny assignments are restricted to system-level policies and deployments, meaning a Contributor assignment at the subscription scope cannot be customized with a selective block.

Key Concept

Azure RBAC scopes, built-in resource roles (User Access Administrator and Virtual Machine Contributor), Entra ID directory roles vs. Azure resource roles, and the read-only nature of deny assignments.
Question 196Question →

Lumina Financial plans to deploy two new virtual machines named VM-Finance1 and VM-Finance2 in the Australia East region. The company has a business requirement to ensure that the application remains available even if an entire physical datacenter facility within the region experiences a power or cooling failure. Which configuration should you use to deploy the virtual machines?

Show answer & explanation

Answer: Deploy the virtual machines across different Availability Zones in the region.

Answer

Deploy the virtual machines across different Availability Zones in the region.
Deploying the virtual machines across different Availability Zones in the region is correct because Availability Zones are physically separate datacenter facilities within an Azure region. Each zone has independent power, cooling, and networking, which ensures that if one datacenter goes down, the VM in the other zone remains available.

Step-by-Step Solution

1
Analyze the high availability requirement.
The requirement specifies protection against the failure of an entire physical datacenter facility (power or cooling outage) in the Australia East region.
Understanding the failure boundary helps differentiate between rack-level redundancy and datacenter-level redundancy.
2
Compare Azure high availability options against the failure boundary.
Availability Sets protect against local hardware failures within a single datacenter. Availability Zones are physically separate datacenters in the same region, providing protection against datacenter-wide outages.
Evaluating the capabilities of each option ensures alignment with the business constraint.
3
Select the configuration that satisfies the requirement.
Deploying the virtual machines across different Availability Zones is the correct design choice.
This is the only option that isolates virtual machines across separate physical locations to survive facility-level failures.

Key Concept

High Availability configurations: Availability Sets vs. Availability Zones
Question 197Question →

An organization has an Azure Storage account named corpstorage that contains a blob container named auditlogs. The storage account network firewall is enabled and configured to allow access only from selected networks.

An external auditing application, running on an on-premises server with the public IP address 198.51.100.45, requires read-only access to the auditlogs container for a period of 90 days. The external application does not support Microsoft Entra ID authentication.

You need to configure access for the auditing application to meet the following requirements:
1. The application must only be allowed to access blobs within the auditlogs container.
2. Access must be limited to HTTPS traffic originating from the server's public IP address.
3. You must be able to revoke the access token immediately at any time during the 90-day period without affecting other clients or rotating the storage account access keys.
4. The configuration must follow the principle of least privilege.

Which configuration should you implement?

Show answer & explanation

Answer: Create a stored access policy on the auditlogs container. Generate a Service SAS for the container that references this policy, specifying HTTPS-only and the allowed IP address 198.51.100.45. Add 198.51.100.45 to the firewall rules of the storage account.

Answer

Create a stored access policy on the auditlogs container, generate a Service SAS for the container referencing this policy with HTTPS-only and the allowed IP address set to 198.51.100.45, and add the server's IP address to the storage account firewall rules.
The correct configuration is to create a stored access policy on the specific container (auditlogs) and reference it in a Service SAS. A stored access policy allows the administrator to revoke the SAS immediately by deleting or modifying the policy, satisfying the revocation requirement without rotating the account access keys. Restricting the SAS parameters to HTTPS-only and the allowed IP (198.51.100.45), combined with adding the IP address to the storage account firewall rules, satisfies the network and transport layer security requirements while adhering to the principle of least privilege.

Step-by-Step Solution

1
Create a stored access policy on the auditlogs container.
A policy is defined at the container level, which can control permissions and expiry, and can be modified or deleted to instantly revoke access.
Stored access policies allow granular revocation of Service SAS tokens without rotating storage account keys.
2
Generate a Service SAS for the container that references the stored access policy.
A SAS token is generated that inherits its permissions and lifecycle from the policy and is restricted only to the auditlogs container.
A Service SAS is required to restrict access to a specific container and to support the stored access policy. User Delegation SAS cannot be used because the client does not support Entra ID authentication, and Account SAS does not support stored access policies.
3
Apply the HTTPS-only protocol constraint and restrict the allowed IP address range to 198.51.100.45 in the SAS token parameters.
The SAS token enforces security constraints at the token level, rejecting HTTP requests or requests from unauthorized IPs.
This satisfies the security requirement to restrict transit protocol and source IP at the authentication layer.
4
Add the public IP address 198.51.100.45 to the storage account firewall rules.
The network-level firewall allows traffic from the external server to reach the storage endpoint.
A SAS token with IP restrictions cannot bypass the storage network firewall; the firewall must be configured to allow the client's public IP address explicitly.

Key Concept

Stored Access Policies and Service SAS Revocation
Question 198Question →

Your organization has a Microsoft Entra ID tenant that contains an administrative unit named Office-AU.

Office-AU contains the following resources:
- A user named Admin1
- An assigned security group named Group1

A user named User1 is created in the Microsoft Entra ID tenant but is NOT a member of Office-AU.

Admin1 is assigned the Groups Administrator role scoped to Office-AU.

Determine if the following statement is true or false: Admin1 can add User1 as a member of Group1.

Show answer & explanation

Answer: True

Answer

True
The statement is true because the Groups Administrator role scoped to Office-AU grants Admin1 permission to modify the membership of Group1 since Group1 is within Office-AU. The users being added to the group do not need to be members of the same administrative unit.

Step-by-Step Solution

1
Identify the role and scope of the administrator.
Admin1 has the Groups Administrator role scoped to Office-AU.
This determines that Admin1 can manage groups that are members of Office-AU.
2
Determine if the target group is within the administrator's scope.
Group1 is a member of Office-AU.
Since Group1 is in Office-AU, Admin1 has permission to manage its membership.
3
Determine if the user being added must be within the same administrative unit.
No, Microsoft Entra ID allows administrative unit-scoped administrators to add any user from the tenant to a group in their scope.
The write operation is performed on the group's membership attribute, not on the user object itself. Therefore, the user does not need to be within the administrative unit.

Key Concept

Groups Administrator role permissions scoped to an administrative unit in Microsoft Entra ID
Question 199Question →

An administrator needs to grant a temporary contractor read-only access to a specific blob container in an Azure storage account. The contractor requires access for exactly two hours. To follow the principle of least privilege, which action should the administrator take?

Show answer & explanation

Answer: Generate a service Shared Access Signature (SAS) for the blob container and set its expiration time to two hours.

Answer

Generate a service Shared Access Signature (SAS) for the blob container and set its expiration time to two hours.
The correct action is to generate a service Shared Access Signature (SAS) for the blob container and set its expiration time to two hours. A service SAS restricts access to a specific resource (the blob container), and the two-hour expiration ensures that access is revoked automatically when no longer needed, following the principle of least privilege.

Step-by-Step Solution

1
Determine the resource scope required for access.
The contractor only needs access to a specific blob container, indicating a service-level SAS is appropriate rather than an account-level SAS or broad RBAC roles.
Restricting access to the specific resource minimizes security exposure.
2
Determine the required access duration.
The contractor needs access for two hours, so the SAS token expiration must be set to exactly two hours.
Setting an expiration time limits the lifetime of the delegated credentials, reducing the risk of abuse if the token is compromised.
3
Select the correct credential mechanism.
A service SAS with read permissions and a two-hour expiration window satisfies all constraints.
It fulfills the access requirement without exposing administrative keys or over-provisioning permissions.

Key Concept

Using service Shared Access Signatures (SAS) with minimum scope and short-lived expiration to implement the principle of least privilege.
Estimated Time:45s
Question 200Question →

Solas Health plans to deploy a new web application in the UK South region. The deployment will include two virtual machines named VM-Web1 and VM-Web2. The solution must guarantee a 99.99% SLA for virtual machine availability and protect the application against datacenter-wide outages within the region. Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM-Web1 in Zone 1 and VM-Web2 in Zone 2; Associate the virtual machines with a Standard SKU Load Balancer

Answer

To meet the requirements, you must deploy VM-Web1 in Zone 1 and VM-Web2 in Zone 2, and associate the virtual machines with a Standard SKU Load Balancer.
Deploying the virtual machines in separate Availability Zones guarantees protection against datacenter-wide failures and meets the 99.99% uptime SLA requirement. To load balance traffic across different zones, a Standard SKU Load Balancer must be used because it supports zone-redundant configurations.

Step-by-Step Solution

1
Evaluate the SLA and redundancy requirements.
Determined that a 99.99% VM uptime SLA and defense against datacenter-wide failures require the use of Availability Zones rather than Availability Sets (which only offer a 99.95% SLA).
Availability Zones host resources in separate physical locations within a region, providing higher SLA and protection against single-datacenter disasters.
2
Select the target placement for VM-Web1 and VM-Web2.
Deployed VM-Web1 in Zone 1 and VM-Web2 in Zone 2.
Distributing the virtual machines across two distinct zones provides physical isolation for the instances.
3
Select the load balancer tier required for zone-spanning backend pools.
Configured a Standard SKU Load Balancer to route traffic to the backend virtual machines.
Only Standard SKU Load Balancers support zone-redundant backend pools and zone-specific VM distributions, whereas Basic SKU Load Balancers do not.

Key Concept

Configuring virtual machines across Availability Zones and pairing them with Standard Load Balancers to achieve maximum high availability and datacenter-level fault tolerance.
Estimated Time:1m 30s
PreviousPage 10 / 63Next