Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 221Question →

Your company has an Azure Storage account named storecorp2026 that contains a private blob container named insights. You need to grant an external partner temporary access to read and list blobs within the insights container. The partner must meet the following security requirements:
- Access must be limited to the IP address range 203.0.113.0/24.
- The access must expire automatically after 48 hours.
- Access must be secured using Microsoft Entra ID credentials to avoid exposing the storage account access keys.
- The partner must only connect using HTTPS.

Which two actions should you perform to configure the required access? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Storage Blob Data Delegator role to the Azure administrator who will generate the SAS.; Generate a User Delegation SAS token with the Allowed IP parameter set to 203.0.113.0/24 and the Allowed Protocols parameter set to HTTPS only.

Answer

The correct actions are to assign the Storage Blob Data Delegator role to the administrator generating the SAS, and to generate a User Delegation SAS token specifying the required IP range and HTTPS only.
To meet the requirement of avoiding storage account access keys, a User Delegation SAS must be used. Generating this token requires the administrator to possess the Storage Blob Data Delegator role to obtain the user delegation key. The SAS token itself must contain the parameters limiting access to the specific IP address range and requiring HTTPS.

Step-by-Step Solution

1
Ensure the administrator has the permissions to request a user delegation key from Microsoft Entra ID.
Assigning the Storage Blob Data Delegator role grants the necessary Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action action.
A User Delegation SAS cannot be generated without obtaining a user delegation key first.
2
Generate the User Delegation SAS with the specified security constraints.
A SAS token is created that restricts access to the IP range 203.0.113.0/24, requires HTTPS, and expires in 48 hours.
This uses Entra ID credentials for signing, avoiding access keys, and enforces all specified constraints.

Key Concept

Generating and securing access to storage using User Delegation SAS with Microsoft Entra ID credentials.
Question 222Question →

An administrator is designing a lifecycle management policy for a standard General Purpose v2 (GPv2) storage account named stdata2026. The policy must transition blobs to the Cool tier if they have not been read or written to for more than 30 days. Which of the following actions must the administrator perform first to ensure the lifecycle policy executes correctly based on this requirement?

Show answer & explanation

Answer: Enable blob last access time tracking on the storage account.

Answer

Enable blob last access time tracking on the storage account.
The correct option is to enable blob last access time tracking on the storage account. For a lifecycle policy to transition blobs based on when they were last read or written to, the policy uses the last accessed metric. On a standard GPv2 storage account, this tracking is disabled by default and must be explicitly enabled for the rules to function correctly.

Step-by-Step Solution

1
Analyze the requirement to transition blobs based on when they were last read or written (not just modified).
This requires using the 'last accessed' property in the lifecycle management policy rules.
Standard lifecycle rules default to using the last modified or creation times unless last access time tracking is active.
2
Identify the configuration needed to support last access time tracking on a GPv2 storage account.
Blob last access time tracking must be enabled on the storage account.
Access time tracking is disabled by default to optimize performance and metadata overhead, so it must be explicitly enabled before the lifecycle policy can evaluate this criteria.

Key Concept

Configuring access-time-based lifecycle management rules in Azure Blob Storage requires enabling last access time tracking.
Question 223Question →

An organization manages its Azure resources using the following hierarchy:
* Subscription: `Sub-Dev-01`
* Resource Group: `RG-App-01`
* Virtual Machine: `vm-dev-01`
* Resource Group: `RG-Data-01`
* Storage Account: `sa-dev-01`

You configure the following role assignments and group memberships:
* A Microsoft Entra ID group named `Dev-Team` is assigned the Contributor role at the `RG-App-01` scope.
* A user named `DevUser1` is a member of the `Dev-Team` group.
* `DevUser1` is assigned the Reader role at the `Sub-Dev-01` subscription scope.
* `DevUser1` is assigned the Owner role at the `sa-dev-01` storage account scope.

Which of the following actions can `DevUser1` perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a new virtual machine in RG-App-01; Assign the Reader role to another user on the sa-dev-01 storage account

Answer

The user can create a new virtual machine in RG-App-01 and assign the Reader role to another user on the sa-dev-01 storage account.
The correct options are creating a new virtual machine in RG-App-01 and assigning the Reader role to another user on the sa-dev-01 storage account. The Contributor role at the resource group level allows resource creation within that group, and the Reader assignment at the subscription level does not restrict this because Azure RBAC is additive. The Owner role on the storage account grants full management capabilities, including role assignments, specifically at that resource scope.

Step-by-Step Solution

1
Evaluate the permissions for RG-App-01.
The user is a member of Dev-Team, which has Contributor access at the resource group scope. Because Azure RBAC is additive, the Reader role assigned at the subscription scope does not override the Contributor role at the resource group scope. Therefore, the user can create resources in RG-App-01.
Azure RBAC roles are additive, meaning the effective permission is the union of all assignments.
2
Evaluate the permissions for the sa-dev-01 storage account.
The user has the Owner role assigned at the storage account scope. This role includes write permissions for role assignments on this specific resource, allowing the user to assign roles to others.
The Owner role contains permissions to modify access control (role assignments) at its assigned scope.
3
Evaluate the permissions for RG-Data-01 and the subscription.
The user only has Owner permissions at the storage account scope. These permissions do not inherit upwards to RG-Data-01. At the subscription scope, the user only has Reader access, which does not allow creating new resource groups.
Azure RBAC inheritance flows down the hierarchy (Subscription -> Resource Group -> Resource), never upwards.

Key Concept

Azure RBAC scopes, role inheritance, and the additive nature of role assignments.
Estimated Time:1m 30s
Question 224Question →

You plan to deploy a new Azure virtual machine. You need to ensure the virtual machine is protected against power, cooling, or network failures that affect an entire datacenter building within an Azure region. Which availability option should you configure when creating the virtual machine?

Show answer & explanation

Answer: Availability Zones

Answer

Availability Zones
Availability Zones provide physically separate locations within an Azure region, which protects virtual machine deployments from datacenter-level outages such as power, cooling, or networking issues.

Step-by-Step Solution

1
Determine the scope of failure protection needed.
The requirement is to protect against failures affecting an entire datacenter building.
This tells us that logical separation within a single datacenter is insufficient, and physically separate locations are required.
2
Compare availability features available during virtual machine creation.
Availability Zones represent physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Availability Sets distribute virtual machines across physical servers, storage units, and network switches within a single datacenter.
We must select the feature that maps to physical building-level redundancy.
3
Select the correct option that matches the physical redundancy requirement.
Select Availability Zones.
This guarantees that the virtual machine will be hosted in a separate physical building from resources in other zones, satisfying the requirement.

Key Concept

Distinguishing between Availability Zones (physical datacenter-level redundancy) and Availability Sets (rack-level redundancy inside a single datacenter) when creating Azure Virtual Machines.
Estimated Time:45s
Question 225Question →

An administrator needs to migrate a folder named `C:\Data` from an on-premises VM to a container named `migration-data` in an Azure Storage account named `mystorageacct` using AzCopy. The migration must meet the following security requirements:

- Authentication to the storage account must be performed using a Microsoft Entra ID service principal.
- Network access to the storage account must be restricted, allowing connections only from the migration VM's public IP address, which is 203.0.113.80203.0.113.80.

Which sequence of actions should the administrator perform on the Azure Portal and the migration VM to execute the migration successfully? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: First, assign the Storage Blob Data Contributor role to the service principal. Second, configure the storage account firewall to allow traffic from the public IP address. Third, set the client secret using the environment variable on the migration VM. Fourth, authenticate using the service principal login command. Fifth, execute the AzCopy copy command.
The correct order follows a progression from cloud authorization and network provisioning down to the local machine's environment setup, command-line login, and execution. Setting the RBAC permissions and updating the storage firewall on the Azure side ensures the cloud resources are ready. Setting the environment variable on the migration VM is a prerequisite for running the service principal login command. Once logged in, the copy command can interact with the storage container.

Step-by-Step Solution

1
Assign the Storage Blob Data Contributor role to the service principal.
The service principal is authorized to write blobs to the storage account.
Without this RBAC role assignment, any copy operations using Entra ID credentials will fail with an authorization error.
2
Add the public IP address 203.0.113.80203.0.113.80 to the storage account firewall rules.
The storage account permits inbound connections from the migration VM.
If the firewall is not configured, the migration VM will be unable to communicate with the storage endpoint.
3
Set the `AZCOPY_SPA_CLIENT_SECRET` environment variable on the migration VM.
The client secret is stored securely in the local shell environment.
AzCopy does not accept client secrets directly in the CLI syntax; it relies on reading this specific environment variable.
4
Execute the `azcopy login --service-principal` command using the Application ID and Tenant ID.
The local AzCopy session is successfully authenticated with Microsoft Entra ID.
Authentication must occur before attempting data transfer commands that use Microsoft Entra ID credentials.
5
Execute `azcopy copy "C:\Data" "https://mystorageacct.blob.core.windows.net/migration-data"`.
The folder content is uploaded to the target blob container.
This command initiates the actual data movement once security, firewall, and authentication configurations are complete.

Key Concept

Configuring secure authentication and network connectivity parameters for AzCopy migrations using Microsoft Entra ID and storage account firewalls.
Question 226Question →

Your organization is planning to deploy Azure File Sync to synchronize files from an on-premises Windows Server to an Azure file share. You need to configure the initial sync topology. Which sequence of actions should you perform to set up the sync topology? To answer, arrange the actions in the correct sequential order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure Azure File Sync, you first deploy the Storage Sync Service, install the Azure File Sync agent on the Windows Server, register the server to the service, and then create a Sync Group containing the Cloud Endpoint and the Server Endpoint.
Establishing Azure File Sync requires a logical sequence of prerequisites. First, the Storage Sync Service must exist in the cloud. Second, the agent must be installed on the local server. Third, that agent uses the service identity to register the server. Finally, the Sync Group, Cloud Endpoint (Azure File Share), and Server Endpoint (local path) are created to start syncing.

Step-by-Step Solution

1
Create the Storage Sync Service resource in the Azure portal.
The control plane for synchronization is deployed in Azure.
This resource is a prerequisite for registering servers and organizing synchronization groups.
2
Download and install the Azure File Sync agent on the target Windows Server.
The background services and PowerShell modules for synchronization are installed on the server.
The server cannot communicate with the Storage Sync Service or register without the agent software.
3
Run the server registration wizard or PowerShell commands to register the server.
The Windows Server is successfully registered under the Storage Sync Service.
A server must be registered before it can be used as a sync endpoint.
4
Create a Sync Group, assign the Azure file share as the Cloud Endpoint, and assign the local folder as the Server Endpoint.
File synchronization between the local folder and the cloud share is established.
This step links the cloud storage and local storage to initiate data sync.

Key Concept

Azure File Sync Deployment Sequence
Question 227Question →

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You deploy an Azure Storage account named storageapp2026 and configure a private endpoint for the storage account in Subnet1. You create a private DNS zone named privatelink.blob.core.windows.net and add the host record for storageapp2026. You discover that virtual machines in Subnet1 continue to resolve the fully qualified domain name (FQDN) of storageapp2026 to its public IP address instead of the private endpoint IP address. What should you do to ensure that the virtual machines resolve the FQDN to the private IP address?

Show answer & explanation

Answer: Link the privatelink.blob.core.windows.net private DNS zone to VNet1.

Answer

Link the privatelink.blob.core.windows.net private DNS zone to VNet1.
Linking the private DNS zone `privatelink.blob.core.windows.net` to `VNet1` is required because the Azure-provided DNS server (168.63.129.16) in the virtual network can only resolve records from the private DNS zone once the zone is linked to that virtual network. Without this link, name resolution queries from the virtual machines will fall back to public DNS servers and resolve to the public IP address of the storage account.

Step-by-Step Solution

1
Understand how Azure Private Endpoints use DNS resolution.
Clients need to resolve the storage account's FQDN to the private IP of the private endpoint instead of the public IP.
By default, the FQDN resolves to the public endpoint IP via public DNS.
2
Identify the configuration required for virtual machines in VNet1 to use the private DNS zone.
The private DNS zone privatelink.blob.core.windows.net must be linked to VNet1.
Without a virtual network link, the Azure-provided DNS service in VNet1 will not query the private DNS zone for name resolution.
3
Evaluate the proposed solutions.
Linking the private DNS zone to VNet1 is the correct step.
It allows VMs in VNet1 to resolve the storage FQDN to the private IP address.

Key Concept

Azure Private Endpoints require the associated Private DNS Zone to be linked to the virtual network for proper name resolution.
Question 228Question →

An organization has an Azure Storage account named saassessmentlogs that contains a blob container named securityaudit. You need to grant an external application temporary read-only access to the blobs inside the securityaudit container. The solution must meet the following security requirements:

- The access must be temporary and expire in 33 hours.
- Access to other containers or storage services must be prevented.
- Access must be restricted to HTTPS traffic originating from the IP range 198.51.100.0/24198.51.100.0/24.
- The generation and usage of the token must be auditable to a specific Microsoft Entra ID security principal, without utilizing or exposing the storage account access keys.

Which access delegation configuration should you implement to meet the requirements?

Show answer & explanation

Answer: Generate a User Delegation SAS using a security principal assigned the Storage Blob Delegator role at the storage account level and the Storage Blob Data Reader role at the container level.

Answer

Generate a User Delegation SAS using a security principal assigned the Storage Blob Delegator role at the storage account level and the Storage Blob Data Reader role at the container level.
The correct option satisfies the scenario because a User Delegation SAS is signed using Microsoft Entra ID credentials instead of the storage account key, satisfying the requirement to avoid exposing access keys. It uses the Storage Blob Delegator role to request the user delegation key and the Storage Blob Data Reader role to authorize container-level read operations. Furthermore, SAS tokens natively allow limiting access by IP address, restricting connections to HTTPS, and defining a specific expiration window.

Step-by-Step Solution

1
Identify the authentication method that avoids utilizing or exposing storage account keys while remaining auditable.
Determine that a User Delegation SAS must be used, which is signed using Microsoft Entra ID credentials.
Compliance requires that access keys are not used or exposed, and that token generation is auditable to a specific Entra ID identity.
2
Assign the necessary roles to the security principal that will generate the User Delegation SAS.
Assign the Storage Blob Delegator role at the storage account level (to generate the user delegation key) and the Storage Blob Data Reader role at the container level (to grant data plane read access).
A User Delegation SAS requires the signing principal to have control plane permissions to fetch the delegation key and data plane permissions corresponding to the target operations.
3
Generate the SAS token with the specified constraints.
Create the User Delegation SAS token specifying a 33-hour expiration, HTTPS-only protocol, and the allowed client IP range of 198.51.100.0/24198.51.100.0/24.
This ensures that access is tightly constrained to the required lifetime, network location, and secure transport channel.

Key Concept

User Delegation SAS utilizes Microsoft Entra ID credentials to secure the SAS, avoiding the exposure of storage account keys and providing auditability.
Estimated Time:2m 35s
Question 229Question →

When implementing governance in Microsoft Azure, you must understand the relationship between different Azure Policy components. Match each Azure Policy component on the left with its correct functional description on the right.

Click a left item, then click its matching right item

Items

Azure Policy Definition
Azure Policy Initiative
Azure Policy Assignment
Azure Policy Exclusion

Matches

Show answer & explanation

Answer

Azure Policy Definition matches the JSON file containing specific rules. Azure Policy Initiative matches a group of multiple policy definitions. Azure Policy Assignment matches the implementation at a specific scope. Azure Policy Exclusion matches a configuration that prevents a sub-scope from being evaluated.
Matching the policy definition to the JSON rule file, the initiative to the collection of definitions, the assignment to the application at a scope, and the exclusion to bypassing evaluation correctly maps each concept to its functional role in Azure resource governance.

Step-by-Step Solution

1
Identify the basic building block of Azure Policy that outlines conditions and effects.
Azure Policy Definition contains the core policy logic, conditions, and effects (such as Deny or Audit) written in JSON format.
This establishes that definitions are the individual rules.
2
Determine how multiple policy definitions are consolidated for simplified tracking.
Azure Policy Initiative groups related definitions (such as compliance controls for a framework like PCI-DSS) to track compliance status collectively.
This clarifies the grouping role of initiatives.
3
Explain how policies or initiatives are activated at a specific scope in the resource hierarchy.
Azure Policy Assignment is the act of applying the policy or initiative to a management group, subscription, or resource group.
This explains the application and enforcement mechanism.
4
Differentiate the mechanism for bypassing policy application on sub-resources.
Azure Policy Exclusion allows administrators to omit specific sub-scopes (like a particular resource group) from the active policy assignment.
This details how scoping exceptions are handled.

Key Concept

Azure Policy Definitions, Initiatives, and Assignments form the core components of Azure governance, allowing administrators to define compliance standards, group them for easier tracking, apply them to scopes, and exclude sub-scopes.
Question 230Question →

Your organization is configuring identity features in Microsoft Entra ID to support hybrid identity management and external collaboration. Match each Microsoft Entra feature to its corresponding administrative behavior.

Click a left item, then click its matching right item

Items

Microsoft Entra B2B collaboration
Microsoft Entra B2B direct connect
Self-Service Password Reset (SSPR) writeback

Matches

Show answer & explanation

Answer

Microsoft Entra B2B collaboration matches with creating a guest user account in the host tenant. Microsoft Entra B2B direct connect matches with collaborating without creating guest user accounts. SSPR writeback matches with synchronizing password changes back to an on-premises directory.
The correct matches represent the core features of Microsoft Entra ID. B2B collaboration creates guest accounts for external sharing. B2B direct connect allows direct collaboration without guest account creation. SSPR writeback enables hybrid password synchronization from Entra ID to on-premises Active Directory.

Step-by-Step Solution

1
Identify the mechanism used by Microsoft Entra B2B collaboration.
It creates a guest user object in the host tenant directory.
This guest account represents the external user and is used to assign permissions.
2
Identify the mechanism used by Microsoft Entra B2B direct connect.
It facilitates collaboration directly using home credentials, without creating any guest user account in the host directory.
Cross-tenant access settings establish a mutual trust between the two organizations.
3
Identify the function of Self-Service Password Reset (SSPR) writeback.
It writes password resets initiated in the cloud back to the on-premises Active Directory.
This ensures that passwords remain synchronized across hybrid environments.

Key Concept

Microsoft Entra identity features for external access (B2B collaboration vs. B2B direct connect) and hybrid password management (SSPR writeback).
Question 231Question →

You need to configure automatic scale-out rules for an Azure Virtual Machine Scale Set (VMSS) named vmss1vmss1. The scale-out rule must increase the instance count when the average CPU utilization exceeds 75%75\%. In which sequence should you perform the configuration steps in the Azure Portal?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, navigate to the scale set resource and select Scaling. Second, choose Custom autoscale. Third, add a scale rule for Percentage CPU greater than 75. Finally, click Save to apply the configuration.
The correct order begins with navigating to the scaling menu of the VMSS, followed by switching from manual scale to custom autoscale. Once custom autoscale is active, a scale-out rule targeting CPU percentage greater than 75% must be added, and finally, the configuration must be saved to apply the settings.

Step-by-Step Solution

1
Navigate to the VMSS and open the Scaling configuration page.
You are presented with the scaling configurations for the scale set.
This is the entry point for configuring scaling policies on a Virtual Machine Scale Set.
2
Select Custom autoscale.
The UI updates to allow configuring dynamic rules based on metrics.
This enables metric-based scaling as opposed to manual scale configuration.
3
Add a scale rule for CPU utilization greater than 75%.
A rule is added to the default profile that triggers scale-out under the defined condition.
This satisfies the requirement to trigger scale-out based on high CPU usage.
4
Save the configuration.
The autoscale settings are successfully saved and applied.
The autoscale settings only take effect after being saved.

Key Concept

Configuring metric-based autoscale settings for Virtual Machine Scale Sets in the Azure Portal.
Question 232Question →

Your company has a Microsoft Entra ID tenant named contoso.com. The tenant contains 500 internal users who are all assigned Microsoft Entra ID P1 licenses, and 100 guest users invited from an external partner organization via B2B collaboration. You configure Self-Service Password Reset (SSPR) for the tenant and set the Enablement setting to Selected, pointing the policy to a security group named Contoso-SSPR. You configure the following group membership and user assignments: User1 is an internal user with a Microsoft Entra ID P1 license and is added as a direct member of Contoso-SSPR. GroupA is added as a member of Contoso-SSPR. User2 is an internal user with a Microsoft Entra ID P1 license and is a member of GroupA (making User2 a nested member of Contoso-SSPR). User3 is a guest user invited via B2B collaboration and is added as a direct member of Contoso-SSPR. Which of the users can reset their passwords by using the contoso.com SSPR policy?

Show answer & explanation

Answer: User1 only

Answer

User1 only
Only the direct member of the SSPR-scoped group (User1) is eligible to reset their password using the Contoso SSPR policy. SSPR settings do not apply to nested group members (User2), and external B2B guest users (User3) must reset passwords through their home identity provider.

Step-by-Step Solution

1
Understand how SSPR scope configuration handles group nesting.
SSPR enabled for a 'Selected' group applies only to direct members of that group; it does not support nested groups.
Microsoft Entra ID SSPR policy evaluation does not traverse nested groups to determine who is enabled.
2
Analyze the behavior of SSPR for external B2B guest users.
Guest users (B2B collaboration) manage their passwords at their home identity provider, not via the resource tenant's SSPR policy.
The home tenant or external identity provider holds the authority for authentication credentials and password reset workflows.
3
Evaluate the capability of each user based on these rules.
User1 is a direct member and can use SSPR. User2 is in a nested group and cannot use SSPR. User3 is a guest user and cannot use SSPR.
Only direct members with appropriate licensing are eligible under the 'Selected' SSPR configuration.

Key Concept

Self-Service Password Reset (SSPR) group scoping constraints and B2B external identity authentication boundaries.
Question 233Question →

Apex Logistics plans to deploy a new shipment tracking application in the West US 2 region. The deployment will include three virtual machines named VM-Ship1, VM-Ship2, and VM-Ship3. The company has a business requirement to guarantee a virtual machine uptime Service Level Agreement (SLA) of at least 99.99%99.99\% for the application. Which configuration should you implement to meet this requirement?

Show answer & explanation

Answer: Deploy VM-Ship1, VM-Ship2, and VM-Ship3 in different Availability Zones, and distribute traffic by using a Standard Load Balancer.

Answer

Deploy VM-Ship1, VM-Ship2, and VM-Ship3 in different Availability Zones, and distribute traffic by using a Standard Load Balancer.
To achieve an SLA of 99.99%99.99\% for virtual machine uptime, Azure requires the VMs to be deployed across two or more Availability Zones in the same region. Additionally, a Standard Load Balancer must be used to route traffic across the zonal boundaries, as the Basic Load Balancer does not support backend pools that span multiple zones.

Step-by-Step Solution

1
Analyze the SLA requirements.
The requirement is an uptime SLA of at least 99.99%99.99\%.
To select the appropriate high availability feature, the SLA target must be identified. Availability Sets offer up to a 99.95%99.95\% SLA, while Availability Zones offer a 99.99%99.99\% SLA.
2
Determine the deployment target (Set vs Zone).
We must use Availability Zones to achieve the 99.99%99.99\% SLA.
Deploying the VMs across multiple Availability Zones protects the application from datacenter-wide failures and meets the 99.99%99.99\% SLA threshold.
3
Identify the correct load balancing resource.
Use a Standard Load Balancer.
Basic Load Balancer does not support backend pools containing VMs in different Availability Zones. A Standard Load Balancer is required to distribute traffic across zonal boundaries.

Key Concept

To achieve a 99.99%99.99\% uptime SLA for virtual machines in Azure, they must be deployed across two or more Availability Zones in the same region, and distributed using a Standard Load Balancer.
Question 234Question →

An administrator is configuring security for an Azure Storage account named storage1 to comply with a corporate security policy. The policy dictates that all access keys must be disabled, and shared key access must be blocked. The administrator sets the allowSharedKeyAccess property to false on storage1. A developer named User1 is assigned the Storage Blob Data Reader role scoped to a container named archive in storage1. User1 needs to generate a Shared Access Signature (SAS) token that allows an external application to read blobs from the archive container. The external application cannot authenticate using Microsoft Entra ID. User1 attempts to generate a SAS token, but the token is rejected by the storage account. You need to configure the resource permissions to ensure that User1 can successfully generate a functional SAS token to access the container while maintaining the principle of least privilege. Which action should you perform?

Show answer & explanation

Answer: Assign User1 the Storage Blob Delegator role at the storage account level, and have User1 generate a User Delegation SAS.

Answer

Assign User1 the Storage Blob Delegator role at the storage account level, and have User1 generate a User Delegation SAS.
Assigning the Storage Blob Delegator role at the storage account level provides the 'Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action' permission. Since shared key access is disabled, standard SAS tokens are blocked. A User Delegation SAS, which is signed using Microsoft Entra ID credentials, must be used instead. Scoping the Storage Blob Data Reader role to the container ensures that the user has data access only to the necessary container, conforming to the principle of least privilege.

Step-by-Step Solution

1
Identify the impact of disabling shared key access on Azure Storage.
Setting allowSharedKeyAccess to false blocks all SAS tokens signed with account access keys (Service and Account SAS).
The storage account enforces Microsoft Entra ID authorization and rejects shared key authentication.
2
Select the correct SAS type to bypass the shared key restriction.
A User Delegation SAS must be used because it is signed using Microsoft Entra ID credentials rather than the account access key.
This satisfies the requirement to authenticate using Microsoft Entra ID while allowSharedKeyAccess is false.
3
Identify the required permissions for generating a User Delegation SAS.
The user needs the 'Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action' permission, which is granted by the Storage Blob Delegator role.
This action is required to request the user delegation key from the storage account to sign the SAS token.
4
Apply the principle of least privilege for the final assignment.
Assign the Storage Blob Delegator role at the storage account scope (since it is a service-level action) and keep the Storage Blob Data Reader role at the container scope.
This grants the minimum necessary privileges required for both key delegation and data reading without giving write/delete access.

Key Concept

Enforcing Microsoft Entra ID authentication for Azure Storage by disabling shared key access and using the Storage Blob Delegator role to generate User Delegation SAS tokens.
Question 235Question →

An administrator needs to grant an external partner application read-only access to a specific blob container in an Azure storage account for exactly two hours. The access must be restricted to that container only, without granting access to other services in the storage account or requiring Microsoft Entra ID authentication.

Which action should the administrator perform?

Show answer & explanation

Answer: Generate a service Shared Access Signature (SAS) for the blob service, scoped to the specific container, with Read permission and an expiration time of two hours.

Answer

Generate a service Shared Access Signature (SAS) for the blob service, scoped to the specific container, with Read permission and an expiration time of two hours.
The correct action is to generate a service Shared Access Signature (SAS) scoped to the container. A service SAS is designed to delegate access to a specific resource (such as a blob container) within a single storage service. Specifying Read permission and an expiration window of two hours ensures the token complies with the principles of least privilege and limited duration, without requiring Microsoft Entra ID authentication.

Step-by-Step Solution

1
Determine the scope and duration required for access.
Access must be limited to a single container, expire in two hours, and not require Microsoft Entra ID.
This establishes that we need a scoped, time-bound credential rather than a broad or permanent key, and eliminates Entra ID RBAC solutions.
2
Choose between account SAS, service SAS, and access keys.
A service SAS is chosen because it can target a specific resource (a blob container) under the blob service.
A service SAS targets only one storage service (Blob service in this case) and can be restricted to a specific container, unlike account SAS which is broader, or access keys which grant full control.
3
Configure the token parameters.
Generate the token with 'Read' permission, start time, and expiry set to two hours from now.
This satisfies the temporal restriction and permission constraints.

Key Concept

Shared Access Signatures (SAS) allow administrators to delegate fine-grained, temporary access to storage account resources with specific permissions and expiration times without exposing the account access keys.
Question 236Question →

You manage an Azure environment that contains a management group named `Corp-MG` and two subscriptions named `Sub-Prod-01` and `Sub-Prod-02` under `Corp-MG`. A resource group named `RG-Operations` in `Sub-Prod-01` contains an Azure Automation runbook that deallocates virtual machines. A resource group named `RG-Resources` in `Sub-Prod-02` contains critical virtual machines with `ReadOnly` resource locks applied. You need to configure a cost control solution that monitors the combined monthly spending of both subscriptions and automatically triggers the runbook in `RG-Operations` to deallocate the virtual machines when the combined monthly spending reaches $10,000\$10,000. You attempt to create an Azure budget at the `Corp-MG` scope and link it to an action group that executes the runbook. Why does this configuration fail to meet the requirements?

Show answer & explanation

Answer: Action groups are not supported for budgets configured at the management group scope.

Answer

Action groups are not supported for budgets configured at the management group scope.
The correct answer is that action groups are not supported for budgets configured at the management group scope. In Azure Cost Management, budgets created at the management group scope support only email alerts (notifications). Automated actions via action groups (such as triggering Azure Automation runbooks, Azure Functions, or Logic Apps) are only supported for budgets defined at the subscription or resource group scopes.

Step-by-Step Solution

1
Analyze the scope requirements for Azure Cost Management budgets and action groups.
Identify that the requirements demand monitoring combined costs across multiple subscriptions (which requires a management group scope) and triggering an automated action via an action group (which requires subscription or resource group scopes).
Understanding scope capabilities and limitations is key to identifying why the proposed configuration fails.
2
Evaluate the capabilities of budgets defined at the Management Group level.
Determine that budgets scoped to management groups can only send email notifications and cannot be linked to action groups.
This identifies the technical block in the administrator's configuration.
3
Differentiate between control plane restrictions (resource locks) and budget alert execution.
Confirm that the ReadOnly lock on the target VMs does not prevent the budget alert configuration from being saved or executing, as the restriction is purely at the budget scope level.
This rules out resource lock inheritance as the root cause of the budget configuration failure.

Key Concept

Azure Cost Management Budget Scopes and Action Group Limitations
Question 237Question →

An enterprise environment contains a Microsoft Entra ID tenant with a dynamic security group named Group1 and an administrative unit named AU1.

To manage access and delegate administration, you need to identify valid configuration options for these resources.

Which two actions can you successfully perform?

Select all that apply

Show answer & explanation

Answer: Assign a Microsoft Entra ID administrative role at the AU1 scope to allow a user to manage the properties of other users within AU1.; Configure a dynamic membership rule for Group1 using the query syntax user.department -eq "Sales".

Answer

The correct options are: assigning a Microsoft Entra ID administrative role at the administrative unit scope, and configuring a dynamic membership rule using the user department attribute query.
Assigning a Microsoft Entra ID administrative role at the administrative unit scope is correct because administrative units allow delegating administrative authority over specific subsets of users, groups, or devices. Configuring a dynamic membership rule using the user department query is correct because it defines a valid rule using standard attributes and syntax for a dynamic user group.

Step-by-Step Solution

1
Analyze dynamic group membership requirements.
Dynamic groups automate membership based on defined queries. They do not allow manual overrides, and a single rule cannot mix user and device attributes.
This rules out the options involving manual member addition and mixed-attribute queries.
2
Analyze administrative unit capabilities.
Administrative units are directory-level containers used to scope Entra ID roles (like User Administrator) but do not integrate with Azure RBAC roles for Azure resource access.
This rules out the option attempting to assign Azure RBAC roles at the administrative unit scope.
3
Verify correct OData query syntax and role assignment scopes.
The query user.department -eq "Sales" is syntactically correct, and assigning an Entra ID role at the administrative unit scope is a supported configuration.
This identifies the two correct configurations.

Key Concept

Microsoft Entra ID dynamic groups automate membership based on user or device attributes, while Administrative Units provide scoped access control for Entra ID directory roles, distinct from Azure RBAC resource scopes.
Question 238Question →

A company has an on-premises file server named Server1 that is currently registered to a Storage Sync Service and configured as a server endpoint in SyncGroup1. You deploy a new on-premises server named Server2 to replace Server1.

You need to migrate the synchronization workload from Server1 to Server2 while ensuring users experience minimal disruption and no data is lost.

Which sequence of actions should you perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, install the Azure File Sync agent on Server2 and register Server2 with the Storage Sync Service; second, create a server endpoint for Server2 in SyncGroup1; third, wait for the initial sync of the file metadata namespace to complete on Server2; fourth, redirect user connections and network share mappings from Server1 to Server2; and finally, remove the server endpoint for Server1 from SyncGroup1.
The correct migration path is to first register Server2 and create a server endpoint in the existing sync group. This allows Server2 to synchronize the namespace (metadata) from the cloud. Once namespace sync is complete, client connections are redirected to Server2. Finally, Server1's endpoint is removed from the sync group.

Step-by-Step Solution

1
Install the Azure File Sync agent on Server2 and register it.
Server2 is registered and visible under registered servers in the Storage Sync Service.
A server must be registered with the Storage Sync Service before it can participate in synchronization.
2
Create a server endpoint for Server2 in SyncGroup1.
Server2 is added to SyncGroup1 as a server endpoint.
Creating the server endpoint registers Server2 as a sync participant for the specific Azure file share in the sync group.
3
Wait for the metadata namespace sync to finish.
Server2 downloads all file metadata and directory structures.
Users cannot access files on Server2 until the namespace synchronization has populated the file database locally.
4
Redirect client connections from Server1 to Server2.
Users access their shares on Server2 instead of Server1.
Redirecting users ensures new changes are made on Server2, which will sync up to Azure.
5
Remove the server endpoint for Server1.
Server1 is disconnected from SyncGroup1.
After users are migrated, Server1's endpoint can be safely removed, stopping its synchronization.

Key Concept

Server retirement and replacement migration using Azure File Sync
Estimated Time:3m 0s
Question 239Question →

You plan to deploy a new Azure virtual machine named VM1 in the East US region.

You need to configure the deployment to satisfy the following requirements:
- Protect the virtual machine against datacenter-wide failures within the East US region.
- Back up VM1 by using an existing Recovery Services Vault.

Which configuration should you use?

Show answer & explanation

Answer: Deploy VM1 in an Availability Zone and associate it with a Recovery Services Vault in the East US region.

Answer

Deploy VM1 in an Availability Zone and associate it with a Recovery Services Vault in the East US region.
Deploying the virtual machine in an Availability Zone protects against datacenter-wide failures because zones are physically separate datacenters within a region. The Recovery Services Vault must reside in the same region (East US) as the virtual machine it backs up.

Step-by-Step Solution

1
Identify the high availability requirement.
To protect against datacenter-wide failures, VM1 must be deployed across Availability Zones rather than Availability Sets.
Availability Zones represent physically separate datacenters with independent power, cooling, and networking within an Azure region, whereas Availability Sets only protect against localized hardware failures within a single datacenter.
2
Determine the backup vault regional compatibility requirement.
The Recovery Services Vault must be located in the same region as the virtual machine (East US).
Azure Backup requires the source resource and the Recovery Services Vault to reside in the same geographical region for backup operations to be supported.

Key Concept

Azure Virtual Machine high availability options and Recovery Services Vault regional requirements
Question 240Question →

Your company, Litware, Inc., has an Azure subscription containing a storage account named storage1 and an Azure Key Vault named vault1.

storage1 is configured with a system-assigned managed identity.

vault1 has both soft-delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) for its authorization model.

You need to configure customer-managed key (CMK) encryption for storage1 using a key stored in vault1.

Which RBAC role must you assign to the system-assigned managed identity of storage1 over vault1 to allow key wrapping and unwrapping operations?

Show answer & explanation

Answer: Key Vault Crypto Service Encryption User

Answer

Key Vault Crypto Service Encryption User
The correct role is Key Vault Crypto Service Encryption User. Under the Azure RBAC permission model for Key Vault, this specific role grants the required data-plane permissions (Microsoft.KeyVault/vaults/keys/wrap/action and Microsoft.KeyVault/vaults/keys/unwrap/action) needed by the storage account's managed identity to encrypt and decrypt the storage service keys.

Step-by-Step Solution

1
Identify the authorization model and requirements.
The target Key Vault uses Azure RBAC for authorization, meaning standard Azure RBAC roles must be assigned to grant access to the keys.
Azure Key Vault supports two permission models: vault access policies and Azure RBAC.
2
Determine the necessary key operations.
The storage account's system-assigned managed identity needs permission to perform key wrap and unwrap operations to encrypt and decrypt the storage service encryption keys.
Customer-managed key encryption relies on envelope encryption, where the storage account's root key is wrapped by the key stored in the Key Vault.
3
Select the correct role that matches the required operations with the least privilege.
The Key Vault Crypto Service Encryption User role grants permission to perform wrap/unwrap operations, which is the exact minimum privilege needed.
Control-plane roles like Key Vault Contributor or Key Vault Reader do not grant these data-plane cryptographic permissions.

Key Concept

Configuring customer-managed keys (CMK) for Azure Storage accounts requires granting the storage account's managed identity specific data-plane permissions (Key Vault Crypto Service Encryption User role or equivalent vault access policy) over the Key Vault containing the encryption key.
Estimated Time:1m 0s
PreviousPage 12 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin