Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 201Question →

You are configuring the Self-Service Password Reset (SSPR) policy for users in a Microsoft Entra ID tenant. You need to select the methods that users can use to reset their passwords. Which two of the following authentication methods can be enabled directly within the Microsoft Entra ID SSPR authentication methods policy?

Select all that apply

Show answer & explanation

Answer: Email; Mobile app notification

Answer

The correct authentication methods that can be enabled directly in the SSPR policy are Email and Mobile app notification.
Email and Mobile app notification are both standard, natively supported authentication methods that can be selected in the SSPR policy configuration within Microsoft Entra ID.

Step-by-Step Solution

1
Identify the policy settings for Self-Service Password Reset (SSPR) in Microsoft Entra ID.
Access the SSPR configuration blade in the Microsoft Entra admin center under password reset authentication methods.
To see which native methods are configurable for password resets.
2
Evaluate the available options for SSPR methods against the choices.
Confirm that Email and Mobile app notification are supported, whereas FIDO2 keys and RBAC role assignments are not configured within this policy.
To select the correct, directly-supported SSPR authentication factors.

Key Concept

SSPR Authentication Methods configuration in Microsoft Entra ID.
Question 202Question →

An organization uses an Azure subscription named `Contoso-Dev-Sub` for testing new applications. Inside `Contoso-Dev-Sub`, a resource group named `rg-sandbox-vms` contains several virtual machines.

You want to implement cost controls and governance policies that satisfy the following requirements:
- Automatically deallocate all virtual machines in `rg-sandbox-vms` when the actual monthly consumption reaches 85%85\% of the designated 10,00010,000 USD budget.
- Prevent administrators and developers from accidentally deleting the `rg-sandbox-vms` resource group or its contents.
- Allow developers to continue starting, stopping, and resizing the virtual machines as needed, provided the budget threshold has not been exceeded.

Which administrative actions should you perform to meet these requirements?

Show answer & explanation

Answer: Create a budget at the `Contoso-Dev-Sub` scope with an alert threshold set to 85%85\% of actual cost, link the alert to an Action Group that triggers an Azure Automation runbook to stop the virtual machines, and apply a Delete (`CanNotDelete`) resource lock to the `rg-sandbox-vms` resource group.

Answer

Create a budget at the subscription scope with an alert threshold set to 85%85\% of actual cost, link the alert to an Action Group that triggers an Azure Automation runbook to stop the virtual machines, and apply a Delete lock to the resource group.
The correct option satisfies all constraints by using a Delete (CanNotDelete) resource lock, which prevents deletion of the resource group and its virtual machines due to lock inheritance, but allows developers and the Azure Automation runbook to continue starting, stopping, and resizing the virtual machines. It also configures a budget at the subscription level with an alert threshold set to 85%85\% of actual cost, which executes the required runbook via an Action Group.

Step-by-Step Solution

1
Determine the resource lock type that prevents deletion while allowing operations.
A Delete (CanNotDelete) resource lock must be used.
A ReadOnly lock blocks POST operations, which includes starting, stopping (deallocating), and resizing virtual machines. A Delete lock allows these actions but prevents deletion of the resource group or its child resources.
2
Determine the method to automate VM deallocation when the budget threshold is reached.
Create a budget and link its threshold alert to an Action Group that triggers an Azure Automation runbook.
Azure budgets do not natively stop VMs. Budget alerts can trigger Action Groups, which can then execute runbooks or webhooks to perform administrative actions such as VM deallocation.

Key Concept

Resource locks and automated budget alerts interact to govern resource lifecycle and billing controls without blocking operational workflows.
Question 203Question →

You are configuring a new monthly budget in Azure Cost Management to monitor spending on an Azure subscription. You want to ensure that the administration team is notified when the spending threshold is exceeded.

Which of the following components can be configured directly within the budget alert settings to handle notifications or trigger actions? Select TWO.

Select all that apply

Show answer & explanation

Answer: Email recipients; Action groups

Answer

Email recipients and Action groups
When configuring a budget in Azure Cost Management, you can define thresholds based on actual or forecasted costs. To handle events when these thresholds are met, Azure Budgets natively support adding email recipients directly to receive alerts, and selecting Action Groups to trigger automated procedures or webhooks.

Step-by-Step Solution

1
Analyze the requirements for notifying the administration team when Azure subscription budget thresholds are met.
Identify that Azure Cost Management budgets support two native mechanisms for alerts: direct email alerts and orchestration via Action Groups.
This establishes the valid notification and action methods built into the budget creation workflow.
2
Evaluate the incorrect options such as Resource Locks and Azure Policies.
ReadOnly resource locks are governance controls that prevent modifications to resources. Azure Policies are compliance rules. Neither can be directly attached to a budget alert configuration to notify users.
This rules out non-alerting options.

Key Concept

Azure Budgets Alert Configuration
Question 204Question →

Your company has a Microsoft Entra ID tenant. You need to delegate user and license administration tasks for the Sales department. The solution must meet the following requirements:
- A user named Admin1 must be able to reset passwords and manage license assignments for users in the Sales department.
- Admin1's administrative permissions must be restricted to the Sales department users only.
- Licensing conflicts for Sales department users must be resolved by prioritizing group-based licensing over direct assignments.

Which four actions should you perform in sequence? (To answer, arrange the appropriate actions from the list of actions in the correct order.)

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, create the Sales-AU administrative unit and add the Sales department users. Next, assign the User Administrator role to Admin1 at the Sales-AU scope. Then, assign the license to the Sales-Group security group. Finally, remove the direct license assignments from the individual user accounts.
To delegate management of a specific subset of users, you must first define that scope using an administrative unit (Sales-AU) and add the users to it. Next, assign the User Administrator role to Admin1, scoping it specifically to the Sales-AU. Group-based licensing is configured by assigning the license to the security group containing the users. Finally, direct user-level licenses are removed to resolve conflicts and fully transition to group-based licensing.

Step-by-Step Solution

1
Create an administrative unit named Sales-AU and add the Sales department users to it.
An administrative boundary (Sales-AU) containing only the Sales department users is established.
This sets up the scope for delegating administrative tasks.
2
Assign the User Administrator role to Admin1 with the scope set to Sales-AU.
Admin1 is granted User Administrator rights restricted only to the members of Sales-AU.
This complies with the principle of least privilege, preventing Admin1 from managing users outside the Sales department.
3
Assign the license to the Sales-Group security group that contains the Sales department users.
Group-based licensing is configured, allowing all group members to inherit the license.
This establishes group-based licensing as required to minimize administrative overhead.
4
Remove the direct license assignments from the individual user accounts in Sales-AU.
The direct assignments are cleared, leaving only the inherited group licenses active.
This resolves licensing conflicts and ensures that licensing is managed at the group level.

Key Concept

Administrative Units (AUs) allow scoping directory roles (such as User Administrator) to a subset of users. Group-based licensing enables license assignment to a group, which is inherited by its members. Transitioning from direct to group-based licensing requires assigning the license to the group and then removing the direct assignments from individual users.
Question 205Question →

Your organization needs to migrate files from an on-premises server to a container named uploads in an Azure Storage account named corpstore. The on-premises server connects to the internet via a public IP address of 203.0.113.15203.0.113.15.

The firewall for the corpstore storage account is configured as follows:
- Allowed networks: 'Enabled from selected virtual networks and IP addresses'
- Allowed IP addresses: None
- Exception: 'Allow Azure services on the trusted services list to access this storage account' is selected.

You log in to the server, install AzCopy, and run the command `azcopy login` using an administrator account that has been assigned the 'Contributor' and 'Reader and Data Access' roles at the storage account level. When you run `azcopy sync "/data" "https://corpstore.blob.core.windows.net/uploads"`, the synchronization fails with network and authorization errors.

Which combination of actions will allow the synchronization to complete successfully using Microsoft Entra ID authentication?

Show answer & explanation

Answer: Add 203.0.113.15203.0.113.15 to the allowed IP address ranges of the storage account firewall, and assign the Storage Blob Data Contributor role to the administrator account.

Answer

Add the server's public IP address 203.0.113.15203.0.113.15 to the storage account firewall allowed ranges, and assign the Storage Blob Data Contributor role to the administrator account.
The correct action requires resolving both the network block and the authorization failure. Adding the server's public IP address 203.0.113.15203.0.113.15 to the allowed IP address ranges in the storage account firewall settings allows network traffic from the on-premises server. Assigning the Storage Blob Data Contributor role provides the data-plane write and read permissions required by the Entra ID-authenticated AzCopy session to sync files to the blob container.

Step-by-Step Solution

1
Analyze the network configuration.
The storage account firewall is configured to block all traffic except from specific IP addresses. Since the on-premises server has the public IP address 203.0.113.15203.0.113.15 and it is not whitelisted, the traffic is blocked.
To allow the local server to connect to the storage account over the public internet, its public IP must be whitelisted.
2
Analyze the Entra ID authentication and RBAC roles.
The administrator is authenticated via `azcopy login` (Microsoft Entra ID) and has the Contributor and Reader and Data Access roles. Neither role grants data-plane permissions (e.g., Storage Blob Data Contributor or Storage Blob Data Owner) required to write blobs.
Microsoft Entra ID authentication for Azure Storage data-plane operations requires explicit data-plane RBAC roles, independent of control-plane roles.
3
Select the correct combination of changes.
Adding 203.0.113.15203.0.113.15 to the allowed IP address ranges resolves the network block, and assigning Storage Blob Data Contributor resolves the authorization mismatch.
Both network access and data-plane authorization must be properly configured for the sync command to succeed.

Key Concept

Data plane authentication and network security configuration for Azure Storage data movement
Estimated Time:3m 0s
Question 206Question →

You manage a standard General Purpose v2 (GPv2) storage account named `streports2026` in the North Europe region. The storage account is configured with Locally-Redundant Storage (LRS) and contains a container named `finance`.

You have the following requirements:
1. Replicate the storage account data to the West Europe region and ensure the data is immediately readable in the secondary region.
2. Automatically transition blobs in the `finance` container to the Cool tier 30 days after modification, and delete them after 365 days.

Which of the following actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Change the replication configuration of the storage account from Locally-redundant storage (LRS) to Read-access geo-redundant storage (RA-GRS).; Create a lifecycle management policy rule that filters by the prefix finance/ and applies transition and deletion actions based on last modification time.

Answer

The correct actions are to change the replication configuration of the storage account from Locally-redundant storage (LRS) to Read-access geo-redundant storage (RA-GRS), and to create a lifecycle management policy rule that filters by the prefix finance/ and applies transition and deletion actions based on last modification time.
To satisfy the replication requirement, the storage account's replication configuration must be changed from Locally-redundant storage (LRS) to Read-access geo-redundant storage (RA-GRS), which replicates the data to the paired region and makes it immediately readable. To satisfy the lifecycle requirement, a lifecycle management policy rule must be created that applies prefix filtering (specifying the container name 'finance/') and defines the transition and deletion actions based on the number of days since last modification.

Step-by-Step Solution

1
Change the storage account's replication setting from Locally-redundant storage (LRS) to Read-access geo-redundant storage (RA-GRS) via the Redundancy blade in the Azure Portal.
The storage account is configured to replicate data asynchronously to the paired region (West Europe) with read access enabled for the secondary endpoint.
This is a direct configuration update that satisfies the requirement for readable secondary geo-replication without requiring a support ticket.
2
Add a new rule in the Lifecycle Management blade of the storage account.
A rule is defined with a prefix filter matching the container path.
Lifecycle management rules require prefix filters (e.g., 'finance/') to target specific containers rather than the entire storage account.
3
Define the rule actions to transition blobs to the Cool tier 30 days after modification, and delete them 365 days after modification.
The lifecycle policy automatically processes the blobs in the 'finance' container according to the defined timeline.
This implements automated tiering and cleanup based on the last modified date to optimize storage costs.

Key Concept

Configuring Azure Blob Storage replication changes and setting up container-scoped lifecycle management policies.
Question 207Question →

You manage an Azure Storage account named storagedata. An external partner application requires temporary access to read and write blobs in a container named incoming. You must generate a Shared Access Signature (SAS) that meets the following security requirements:

- The access token must be immediately revoked if the primary storage access key (key1) is rotated.
- The access token must remain valid if the secondary storage access key (key2) is rotated.
- The partner application must only be allowed to connect from the public IP address 192.0.2.55192.0.2.55.

In the Azure portal, you set the allowed protocols to HTTPS only. Which two configurations should you select to generate the SAS? (Select two.)

Select all that apply

Show answer & explanation

Answer: Signing key set to Key 1; Allowed IP addresses set to 192.0.2.55192.0.2.55

Answer

Select Key 1 as the signing key and set the allowed IP addresses to the specific IP address 192.0.2.55192.0.2.55.
The correct configurations are setting the signing key to Key 1 and setting the allowed IP addresses to the single IP address 192.0.2.55192.0.2.55. Setting the signing key to Key 1 ensures that the SAS is invalidated when Key 1 is rotated but remains valid if Key 2 is rotated. Restricting the allowed IP addresses to the specific IP address limits access to only the partner application.

Step-by-Step Solution

1
Determine the correct signing key that binds the SAS token's lifetime to Key 1.
Select Key 1 as the signing key.
A Service or Account SAS is signed using one of the storage account keys. Rotating the key used to sign the SAS immediately invalidates it.
2
Configure the IP access restriction to match the partner's single IP address.
Set the Allowed IP addresses field to 192.0.2.55192.0.2.55.
Specifying the exact IP address ensures that only traffic originating from that IP can access the container using the SAS token, adhering to the least privilege principle.

Key Concept

Shared Access Signature (SAS) token configuration, key rotation binding, and network access restrictions.
Estimated Time:2m 0s
Question 208Question →

Solaris Grid plans to deploy a new web application in the Japan East region. The deployment requires three virtual machines named VM-App1, VM-App2, and VM-App3. The application must achieve a virtual machine uptime SLA of 99.99%99.99\%. You need to configure a high-availability solution and a load balancer to distribute traffic across the virtual machines. Which configuration should you implement?

Show answer & explanation

Answer: Deploy the three virtual machines across three separate Availability Zones in the Japan East region, and associate them with the backend pool of a Standard Load Balancer.

Answer

Deploy the three virtual machines across three separate Availability Zones in the Japan East region, and associate them with the backend pool of a Standard Load Balancer.
Deploying the virtual machines across three separate Availability Zones guarantees a 99.99%99.99\% SLA for VM uptime, and using a Standard Load Balancer ensures compatibility with zonal deployments.

Step-by-Step Solution

1
Analyze the SLA requirement of 99.99%99.99\% for VM uptime.
Determine that Availability Zones are required since Availability Sets only offer a 99.95%99.95\% SLA.
Meeting the high-availability target of 99.99%99.99\% requires physically separate datacenters (zones) within the region.
2
Evaluate the load balancer requirements for Availability Zones.
Select the Standard Load Balancer SKU.
Basic Load Balancers do not support zone-redundant backend pools or routing traffic across multiple Availability Zones.
3
Validate the VM deployment workflow constraints.
Ensure the VMs are created directly within the Availability Zones and configured during creation.
VMs cannot be retroactively added to an Availability Set or moved between zones once provisioned.

Key Concept

To achieve a 99.99%99.99\% virtual machine uptime SLA in Azure, VMs must be deployed across two or more Availability Zones in the same region, and a Standard Load Balancer must be used to distribute traffic across these zones. Availability Sets are limited to a single zone/datacenter, providing only a 99.95%99.95\% SLA, and VMs cannot be added to an Availability Set after creation.
Estimated Time:2m 30s
Question 209Question →

An administrator needs to configure secure access to a blob container named confidential in an Azure Storage account named corpstore104 for an external partner application. The solution must meet the following requirements:
- The partner application must only be allowed to read and list blobs in the container.
- Access must be granted for a maximum of 8 hours.
- Access must be restricted to the partner application's public IP address range of 198.51.100.0/24198.51.100.0/24 using HTTPS only.
- In accordance with the least-privilege security policy, access must be authorized using a Microsoft Entra ID security principal rather than the storage account's shared access keys.

Which two actions should the administrator perform?

Select all that apply

Show answer & explanation

Answer: Assign the Storage Blob Data Reader and Storage Blob Data Delegator roles to the Microsoft Entra ID security principal at the storage account level.; Generate a User Delegation SAS token using the credentials of the security principal, specifying the HTTPS protocol, the IP range 198.51.100.0/24198.51.100.0/24, and read/list permissions.

Answer

Assign the Storage Blob Data Reader and Storage Blob Data Delegator roles to the Microsoft Entra ID security principal at the storage account level, and generate a User Delegation SAS token using the credentials of the security principal, specifying the HTTPS protocol, the IP range 198.51.100.0/24198.51.100.0/24, and read/list permissions.
To satisfy the requirement of using a Microsoft Entra ID security principal rather than access keys, a User Delegation SAS must be used. Generating this type of SAS requires two main parts: first, the security principal must be assigned the Storage Blob Data Delegator role to retrieve the user delegation key, and the Storage Blob Data Reader role to allow data-plane read operations on the container. Second, the SAS token itself must be generated using these Entra ID credentials while enforcing the HTTPS, IP range, and read/list permissions constraints.

Step-by-Step Solution

1
Determine the SAS type required.
A User Delegation SAS is chosen.
The security requirements demand that access is authorized using a Microsoft Entra ID security principal instead of the storage account's shared access keys.
2
Assign the required role permissions to the Entra ID identity.
The Storage Blob Data Delegator role (to generate the user delegation key) and the Storage Blob Data Reader role (to read/list data plane blobs) are assigned.
User Delegation SAS validation checks the generator's RBAC roles at runtime, and the delegator role is needed to sign the token.
3
Generate the User Delegation SAS token.
A User Delegation SAS is created with HTTPS, IP constraint 198.51.100.0/24198.51.100.0/24, read/list permissions, and an expiration under 8 hours.
This directly meets the connection security, network isolation, and temporal constraints specified in the scenario.

Key Concept

Configuring secure container access via User Delegation SAS signed by a Microsoft Entra ID principal.
Question 210Question →

An administrator is setting up Azure File Sync. The administrator configures a storage account to restrict network access using a firewall. To allow the Azure File Sync service to access the Azure file share inside this secured storage account, which setting should the administrator enable on the storage account's firewalls and virtual networks configuration?

Show answer & explanation

Answer: Allow trusted Microsoft services to access this storage account

Answer

Allow trusted Microsoft services to access this storage account
Allowing trusted Microsoft services to access the storage account is the correct configuration. Azure File Sync is a trusted Microsoft service, and enabling this setting allows the service to bypass storage account firewalls to access the Azure file share.

Step-by-Step Solution

1
Identify the requirement to allow Azure File Sync to communicate with an Azure file share located inside a storage account that has a firewall enabled.
Recognize that network access is blocked by default when the storage account firewall is configured to restrict traffic.
By default, enabling the storage firewall blocks all external services unless an exception is made.
2
Determine the correct bypass mechanism for Azure File Sync.
Identify that Azure File Sync is classified as a trusted Microsoft service.
Microsoft provides a built-in exception to allow trusted services to securely access the storage account over the Azure backbone.
3
Select the option to allow trusted Microsoft services within the firewalls and virtual networks settings of the storage account.
Azure File Sync successfully connects to the Azure file share to establish the cloud endpoint.
This setting enables the required secure communication channel between Azure File Sync and the storage account.

Key Concept

Configuring storage account firewall exceptions for Azure File Sync
Question 211Question →

An Azure subscription contains a resource group named RG-Gov. A tag with the key-value pair Dept: Finance is applied to RG-Gov, and a ReadOnly lock is placed on the RG-Gov scope. Within RG-Gov, you deploy an Azure Storage account named store1 with no direct locks or tags.

An administrator asserts that if they query resources using the Dept: Finance tag, store1 will be included in the query results, and that they can rotate the access keys of store1 without removing the lock from RG-Gov.

Is the administrator's assertion correct?

Show answer & explanation

Answer: False

Answer

The administrator's assertion is incorrect.
The correct answer is False because tags are not inherited from resource groups to child resources, and the inherited ReadOnly lock prevents key listing and rotation operations on the storage account.

Step-by-Step Solution

1
Evaluate tag inheritance from the resource group to the storage account.
The storage account store1 does not inherit the Dept: Finance tag.
Tags applied to an Azure resource group are not automatically inherited by the resources inside that resource group.
2
Evaluate lock inheritance from the resource group to the storage account.
The storage account store1 inherits the ReadOnly lock from RG-Gov.
Azure resource locks applied at a parent scope (resource group) propagate to all child resources within that scope.
3
Determine if key rotation is allowed under a ReadOnly lock.
Key rotation (which involves listing and regenerating keys) is blocked by the ReadOnly lock.
A ReadOnly lock restricts operations that modify the resource or use POST requests at the control plane level, including listing keys (listKeys) and regenerating keys.

Key Concept

Tags are not inherited from resource groups to child resources. Resource locks are inherited by child resources, and ReadOnly locks prevent control plane POST operations such as listing or rotating access keys.
Question 212Question →

You manage an Azure Virtual Machine Scale Set named `VMSS1` configured with Uniform orchestration mode. You configure an Azure Autoscale setting for `VMSS1` containing two profiles as shown in the following table:

Profile NameMinimum CapacityMaximum CapacityScale-out RuleScale-in RuleSchedule
Profile 1 (Default)2266CPU > 80% (add 1)CPU < 30% (remove 1)Always active
Profile 2 (PeakHours)661212CPU > 70% (add 2)CPU < 40% (remove 2)Monday-Friday, 08:00-18:00

On Monday at 07:55 AM, `VMSS1` has 44 running instances, and the average CPU usage is 50%50\%. The average CPU usage remains stable at 50%50\% until 08:30 AM.

At 08:30 AM, what is the total number of running instances in `VMSS1`?

Show answer & explanation

Answer: 6

Answer

6 running instances
When Profile 2 (PeakHours) becomes active at 08:00 AM on Monday, the autoscale engine evaluates the capacity limits. Because the current instance count of 4 is less than the minimum capacity of 6 defined in Profile 2, the scale set immediately scales out to 6 instances to meet the minimum capacity requirement. Since the CPU usage remains at 50% (which is between the 40% scale-in and 70% scale-out thresholds of Profile 2), no further scaling rules are triggered by 08:30 AM, resulting in a total of 6 running instances.

Step-by-Step Solution

1
Evaluate the active autoscale profile at 07:55 AM.
Profile 1 (Default) is active with 4 instances running and CPU at 50%.
Profile 1 is always active, and since it is before 08:00 AM on Monday, the schedule for Profile 2 has not started yet.
2
Determine the active profile transition at 08:00 AM.
Profile 2 (PeakHours) becomes the active profile.
The schedule for Profile 2 is Monday through Friday, 08:00 to 18:00. At 08:00 AM on Monday, this profile takes precedence over the default profile.
3
Compare current instance count with the boundaries of the newly active profile.
The instance count is adjusted from 4 to 6.
Profile 2 defines a minimum capacity of 6. Since the current capacity is 4, Azure Autoscale immediately scales out the VMSS to meet the minimum capacity requirement.
4
Evaluate the autoscale rules for Profile 2 under the stable 50% CPU load between 08:00 AM and 08:30 AM.
No scaling actions are triggered; capacity remains at 6.
The CPU usage of 50% is within the non-scaling range (above the 40% scale-in threshold and below the 70% scale-out threshold) of Profile 2.

Key Concept

Autoscale profile capacity boundaries and scheduling
Estimated Time:3m 0s
Question 213Question →

An administrator creates an Azure budget named Mgmt-Prod-Budget scoped to a management group named Prod-MG to monitor spending across multiple subscriptions. The administrator can configure Mgmt-Prod-Budget to trigger an Azure Action Group that executes a Logic App when the actual monthly cost reaches 100% of the budget.

Show answer & explanation

Answer: False

Answer

False
Azure Cost Management budgets configured at the Management Group scope only support email notifications. They do not support Action Groups, which prevents the administrator from triggering a Logic App directly from the budget alert at this scope.

Step-by-Step Solution

1
Determine the scope of the budget configuration.
The budget Mgmt-Prod-Budget is scoped to the management group Prod-MG.
Budget capabilities vary depending on the scope at which they are defined (Management Group, Subscription, Resource Group, or Resource).
2
Evaluate the alert and action capabilities supported at the Management Group scope.
Management Group-scoped budgets support only email notification alerts to specified recipients.
Unlike Subscription and Resource Group scopes, Management Group scopes do not support Action Groups, meaning automated actions like triggering Logic Apps or Runbooks are unavailable.
3
Compare the requirements of the administrator's plan with the supported capabilities.
The attempt to configure an Action Group for the management group budget will fail.
Since the administrator is attempting to associate an Action Group with a Management Group-scoped budget, the statement is false.

Key Concept

Azure Budgets Scope Limitations
Question 214Question →

An organization manages its Azure environment using a management group named Tenant-MG, which contains an Azure subscription named Sub-01. Sub-01 contains two resource groups named RG-Prod and RG-Dev.

You assign an Azure Policy definition that restricts allowed virtual machine SKUs at the Sub-01 subscription level. You add the RG-Dev resource group to the exclusion list of this policy assignment. A developer attempts to deploy a virtual machine with a disallowed SKU to the RG-Dev resource group.

What is the outcome of this deployment?

Show answer & explanation

Answer: The deployment succeeds because the exclusion at the resource group level prevents the policy from being applied to resources within RG-Dev.

Answer

The deployment succeeds because the exclusion at the resource group level prevents the policy from being applied to resources within RG-Dev.
The deployment succeeds because policy exclusions allow you to exempt specific resource groups or resources from a policy assignment. Since the assignment is excluded from RG-Dev, any virtual machines deployed inside RG-Dev are not evaluated against this policy, allowing the VM to be deployed even with a disallowed SKU.

Step-by-Step Solution

1
Determine the scope of the policy assignment and the resource group location of the target deployment.
The policy is assigned at the subscription level (Sub-01), but the target resource group (RG-Dev) is explicitly listed as an exclusion on that assignment.
Exclusions define scopes within the assignment's boundary where the policy will not be applied.
2
Evaluate the effect of the exclusion on policy enforcement for resources in the excluded scope.
Resources in RG-Dev are completely exempt from the policy assignment and do not undergo evaluation.
When a resource group is excluded from an assignment, Azure Policy ignores all resources within that group for this specific assignment.
3
Conclude the final deployment outcome for the virtual machine with the disallowed SKU in RG-Dev.
The deployment of the virtual machine succeeds.
Since the policy is not evaluated for RG-Dev, the restriction on virtual machine SKUs does not apply to this deployment.

Key Concept

Azure Policy assignment scopes and exclusions
Question 215Question →

You manage a Microsoft Entra ID tenant. You configure the Self-Service Password Reset (SSPR) policy and set the enablement scope to a group named SSPR-Users. A user who is a direct member of the SSPR-Users group attempts to reset their password but receives an error indicating that they cannot reset their password. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The user has not registered the minimum number of authentication methods required by the SSPR policy.

Answer

The user has not registered the minimum number of authentication methods required by the SSPR policy.
The correct answer is correct because Microsoft Entra ID requires users to register the required number of enabled authentication methods (such as email, mobile app, or phone) before they can perform a self-service password reset. Even if SSPR is enabled for their group, they cannot reset their password without this registration.

Step-by-Step Solution

1
Identify the SSPR enablement scope and group membership.
The user is in the group SSPR-Users, which is scoped for SSPR, meaning they are permitted to use SSPR.
To determine if the user is authorized by policy to use SSPR.
2
Check for registration requirements.
A user must have registered the required authentication methods before they can perform a reset.
SSPR cannot function if there is no registered method to verify the user's identity.
3
Evaluate misconceptions regarding group type, administrative units, and subscription roles.
Dynamic groups are supported; Administrative Units do not block tenant SSPR; Azure RBAC subscription roles do not bypass Entra ID tenant policies.
To rule out the other options as incorrect configurations or unrelated scopes.

Key Concept

Self-Service Password Reset (SSPR) registration requirements
Estimated Time:1m 0s
Question 216Question →

Your organization has an Azure active directory tenant integrated with an Azure resource hierarchy structured as follows:
- Production-MG (Management Group)
- Subscription-A (Subscription)
- RG-Secure (Resource Group)
- sa-audit (Storage Account)
- RG-Compute (Resource Group)

You must configure access for a security group named Audit-Admins to meet the following requirements:
1. Members must be able to assign Azure RBAC roles to other users only within the scope of RG-Secure.
2. Members must be able to view and download audit logs stored in the blob service of sa-audit. They must not be able to modify firewall settings, delete the storage account, or view access keys.
3. Members must be able to add and remove members from Microsoft Entra ID security groups used for auditing.

You must follow the principle of least privilege and minimize administrative overhead.

Which combination of role assignments should you configure?

Show answer & explanation

Answer: In Azure RBAC: Assign the User Access Administrator role to Audit-Admins at the RG-Secure scope, and assign the Storage Blob Data Reader role to Audit-Admins at the sa-audit scope. In Microsoft Entra ID: Assign the Groups Administrator role to Audit-Admins.

Answer

In Azure RBAC: Assign the User Access Administrator role to Audit-Admins at the RG-Secure scope, and assign the Storage Blob Data Reader role to Audit-Admins at the sa-audit scope. In Microsoft Entra ID: Assign the Groups Administrator role to Audit-Admins.
To satisfy the requirements with the least privilege, you must assign the User Access Administrator role at the RG-Secure scope, which restricts role assignment capabilities to that resource group. Data-plane blob access is granted via the Storage Blob Data Reader role at the specific sa-audit resource scope, which prevents the group from performing control-plane actions like modifying firewall configurations, deleting the storage account, or listing access keys. Finally, since group membership management is a Microsoft Entra ID directory task rather than an Azure resource task, the Groups Administrator directory role must be assigned.

Step-by-Step Solution

1
Determine the role and scope required for managing Azure RBAC assignments.
User Access Administrator role at the RG-Secure resource group scope.
This role allows the group to assign RBAC roles to others, and scoping it to RG-Secure ensures they cannot assign roles outside this resource group.
2
Determine the least-privileged role and scope required for viewing and downloading blobs from the storage account.
Storage Blob Data Reader role at the sa-audit storage account scope.
The Storage Blob Data Reader role provides data-plane access to read blobs. Assigning it directly to sa-audit prevents access to other storage accounts. Standard control-plane roles like Contributor or Storage Account Contributor are rejected because they allow modifying firewall configurations and regenerating access keys.
3
Determine the directory role required for managing Entra ID security group memberships.
Groups Administrator role at the Microsoft Entra ID tenant level.
Azure RBAC roles do not manage Entra ID directory objects like groups. The Groups Administrator role is the least-privileged directory role that can manage group memberships.

Key Concept

Azure RBAC role assignments must follow the principle of least privilege, separating control-plane from data-plane access, and distinguishing between Azure resource roles and Microsoft Entra ID directory roles.
Estimated Time:3m 0s
Question 217Question →

An administrator is configuring a dynamic group in Microsoft Entra ID named Corporate-Marketing. The administrator wants the group to dynamically include all users from the Marketing department who are currently assigned a corporate Windows 11 laptop. The administrator attempts to save the following membership rule for a group with the membership type set to Dynamic User:

(user.department -eq "Marketing") -and (device.deviceOSVersion -startsWith "10.0.22")

Why does the configuration fail?

Show answer & explanation

Answer: A single dynamic membership rule cannot combine user and device attributes; dynamic groups must target either users or devices exclusively.

Answer

A single dynamic membership rule cannot combine user and device attributes; dynamic groups must target either users or devices exclusively.
Microsoft Entra ID dynamic groups support evaluating either user objects or device objects, but a single dynamic rule cannot combine both user and device attributes. The group must be configured with a membership type of either Dynamic User (to evaluate user properties) or Dynamic Device (to evaluate device properties).

Step-by-Step Solution

1
Analyze the proposed dynamic membership rule syntax: (user.department -eq "Marketing") -and (device.deviceOSVersion -startsWith "10.0.22")
The rule contains both user attributes (user.department) and device attributes (device.deviceOSVersion).
To identify which objects are being evaluated by the rule.
2
Recall the structural constraints of Microsoft Entra ID dynamic groups.
A group's membership type must be explicitly set to either Dynamic User or Dynamic Device. The evaluation engine does not support hybrid rules containing both object types.
To determine the limitation on rule evaluation.
3
Determine why the configuration failed and select the matching reason.
The rule fails because it attempts to combine user and device properties, which is unsupported.
To select the correct option.

Key Concept

Microsoft Entra ID dynamic groups require a single, distinct object type (either user or device) and cannot mix user and device attributes in a single membership rule.
Question 218Question →

An administrator is configuring Azure File Sync to synchronize files between an on-premises Windows Server and an Azure file share named share-a in a storage account named storagea. The on-premises server connects to an Azure virtual network using a Site-to-Site VPN. To meet security requirements, all synchronization traffic must traverse the VPN connection instead of the public internet. The administrator creates a private endpoint for the Storage Sync Service in the virtual network. Which configuration must be completed to ensure the on-premises server can successfully synchronize files with share-a?

Show answer & explanation

Answer: Create a private endpoint for storagea targeting the file sub-resource, and configure DNS resolution on-premises for both the Storage Sync Service and storagea private IP addresses.

Answer

Create a private endpoint for storagea targeting the file sub-resource, and configure DNS resolution on-premises for both the Storage Sync Service and storagea private IP addresses.
To route all Azure File Sync traffic over a private connection (such as a VPN or ExpressRoute), both the management endpoint (Storage Sync Service) and the data transfer endpoint (Storage Account File share) must have private endpoints configured. Additionally, the on-premises DNS must be configured to resolve these service endpoints to their respective private IP addresses instead of their public IPs.

Step-by-Step Solution

1
Analyze network path requirements
Identify that the Storage Sync Service private endpoint alone is insufficient because actual file transfer occurs directly between the server and the storage account (Azure Files).
Azure File Sync consists of management traffic (to Storage Sync Service) and data transfer traffic (to the storage account hosting the file share).
2
Determine Storage Account private link requirement
Establish that a private endpoint targeting the 'file' sub-resource of storagea must be created.
Both endpoints must reside within the private network space to keep all synchronization traffic off the public internet.
3
Ensure DNS name resolution
Configure the local DNS forwarders or hosts file on-premises to resolve the Storage Sync Service and storage account FQDNs to their private IP addresses.
Without correct DNS resolution, the agent will continue to attempt connecting to the public IP addresses of the services.

Key Concept

Azure File Sync Private Endpoint Configuration
Question 219Question →

A developer is configuring a CI/CD pipeline that uploads build artifacts to a private blob container in an Azure Storage account. The pipeline requires access to upload these files but should not have administrative control over the storage account. You decide to generate a Shared Access Signature (SAS) token for this purpose.

To adhere to the principle of least privilege and secure access, which two settings should you configure? (Select two.)

Select all that apply

Show answer & explanation

Answer: Set the allowed protocol parameter to HTTPS only; Configure the SAS permissions to include only Write

Answer

Enforce HTTPS only for the protocol and select only the Write permission.
Configuring the Shared Access Signature (SAS) token to allow only HTTPS ensures secure, encrypted data transmission. Restricting permissions to Write only satisfies the principle of least privilege, as the pipeline only needs to upload artifacts and does not require read or delete access.

Step-by-Step Solution

1
Analyze the CI/CD pipeline's requirements.
The pipeline only needs to upload files (Write permission) and requires secure communication.
To conform to the principle of least privilege and security best practices.
2
Identify the appropriate protocol setting in the SAS token configuration.
Restrict the allowed protocol to HTTPS only.
Enforcing HTTPS prevents unencrypted transit of sensitive build data.
3
Select the required permissions for the token.
Enable the Write permission and leave Read, List, and Delete unchecked.
Providing only the Write permission ensures the pipeline cannot read, list, or delete existing blobs in the container.

Key Concept

Configuring Shared Access Signatures (SAS) to enforce least privilege access and secure protocols.
Estimated Time:45s
Question 220Question →

An administrator deploys an Azure Virtual Machine Scale Set (VMSS) named `vmss1` using the Uniform orchestration mode. The upgrade policy is set so that when the VMSS model is updated, existing virtual machine instances do not automatically receive the updates, while any new instances created by scaling out are deployed with the updated model. Which upgrade policy is currently configured for `vmss1`?

Show answer & explanation

Answer: Manual

Answer

Manual upgrade policy
The Manual upgrade policy ensures that existing virtual machine instances in the scale set are not modified when the scale set model is updated. The administrator must manually apply the update to each existing instance. However, any new instances created due to scale-out operations are automatically created using the updated model configuration.

Step-by-Step Solution

1
Analyze the upgrade behavior for existing instances described in the scenario.
Existing instances do not automatically receive the updates when the scale set model is updated.
This behavior indicates that the system is not actively pushing updates automatically to the running instances.
2
Analyze the upgrade behavior for new instances.
New instances created by scaling out are deployed using the updated model.
This is standard behavior across scale set upgrade policies when a new model is defined, as new instances are always created from the latest scale set model version.
3
Identify the upgrade policy that matches these two conditions.
The Manual upgrade policy matches these conditions perfectly because it requires administrators to manually trigger updates on existing instances, while automatically applying the new model to new instances.
This identifies the correct configuration option from the available Azure VMSS upgrade policies.

Key Concept

Azure Virtual Machine Scale Set Upgrade Policies
PreviousPage 11 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin