Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 241Question →

A Microsoft Entra tenant contains the following resource hierarchy:
* Root Management Group
* Subscription: `sub-shared-infra`
* Resource Group: `rg-network-hub`
* Virtual Network: `vnet-core`

A user named Admin1 is assigned only the Global Administrator directory role in Microsoft Entra ID. Admin1 needs to assign the Network Contributor role to a group named NetOps at the `rg-network-hub` scope. Currently, Admin1 cannot view `sub-shared-infra` or `rg-network-hub` in the Azure portal.

Which action should Admin1 take to assign the role?

Show answer & explanation

Answer: Elevate access in the Microsoft Entra admin center to obtain the User Access Administrator role at the root scope, and then perform the role assignment at the resource group scope.

Answer

Elevate access in the Microsoft Entra admin center to obtain the User Access Administrator role at the root scope, and then perform the role assignment at the resource group scope.
Elevating access in the Microsoft Entra admin center assigns the User Access Administrator role to the Global Administrator at the root scope. This permits the administrator to view all subscriptions and configure role assignments at any level of the Azure resource hierarchy.

Step-by-Step Solution

1
Elevate directory privileges for the Global Administrator in the Microsoft Entra admin center.
Admin1 is assigned the User Access Administrator role at the root scope (/).
By default, Microsoft Entra ID directory roles like Global Administrator do not have permissions to manage Azure subscriptions or resource groups.
2
Access the subscription and resource group scopes in the Azure portal or CLI.
Admin1 can now view the `sub-shared-infra` subscription and `rg-network-hub` resource group.
The User Access Administrator role at the root scope inherits down the entire hierarchy, granting the ability to view resources and manage access.
3
Assign the Network Contributor role to the NetOps group at the resource group scope.
The Network Contributor role is successfully assigned to the group for the target scope.
The User Access Administrator role provides the authorization required to write role assignments at the resource group level.

Key Concept

Azure RBAC Scope and Root Access Elevation for Global Administrators
Question 242Question →

Your organization manages resources across a multi-layered Azure resource hierarchy. An administrator needs to configure permissions for various identities while strictly adhering to the principle of least privilege.

Match each security identity and business requirement to the most restrictive (least privilege) Azure Role-Based Access Control (RBAC) role and scope combination that satisfies the requirement.

Click a left item, then click its matching right item

Items

A VM system-assigned managed identity (App-VM-MSI) that must retrieve application database connection strings stored as secrets from the vault named kv-prod-01 in App-RG. The key vault is configured to use Azure RBAC for authorization.
A security auditing group (Security-Auditors) that must view the configuration settings of all resources and check Azure Policy compliance states across all subscriptions under the Corp-MG management group, but must not view resource data or credentials.
A deployment service principal (Deploy-Agent) that must deploy virtual machines and storage accounts in Dev-RG, and must also assign required RBAC roles to those resources' managed identities during deployment.
A data synchronization service principal (Data-Sync-SP) that must read, write, and delete blobs inside the storage account sa-prod-data in Data-RG, but must not be allowed to modify the storage account's network firewalls or access keys.

Matches

Show answer & explanation

Answer

The correct matches pair App-VM-MSI with Key Vault Secrets User at the vault scope; Security-Auditors with Reader at the Corp-MG management group scope; Deploy-Agent with Contributor and User Access Administrator at the Dev-RG scope; and Data-Sync-SP with Storage Blob Data Contributor at the sa-prod-data scope.
The correct pairings accurately select roles mapped to the least privilege model and correct scopes. The Reader role at the management group level ensures read-only metadata visibility across all child subscriptions. The Key Vault Secrets User role at the vault scope allows the application VM to read secrets without permitting secrets management. The combination of Contributor and User Access Administrator at the resource group level enables resource deployment and role assignment without granting full subscription ownership. The Storage Blob Data Contributor role at the storage account scope allows blob manipulations without exposing control plane operations.

Step-by-Step Solution

1
Analyze the VM managed identity requirement.
It needs to read database connection strings (secrets) from a key vault using RBAC authorization.
Identify the minimum role that can read secret values (Key Vault Secrets User) and the narrowest scope (the specific key vault resource).
2
Analyze the security auditing group requirement.
It needs read-only metadata access to all resources and policy compliance across multiple subscriptions under a management group.
Identify the standard Reader role, which does not expose secrets/keys. Determine the inheritance scope at the parent management group (Corp-MG).
3
Analyze the deployment service principal requirement.
It needs to create resources (VMs and storage) and also configure RBAC role assignments for those resources' managed identities.
Recognize that creating resources requires Contributor, and configuring assignments requires User Access Administrator. Scope both to Dev-RG to restrict access to the development environment.
4
Analyze the data synchronization service principal requirement.
It needs read/write/delete operations on blobs (data plane) but must not modify firewalls or read access keys (control plane).
Identify the Storage Blob Data Contributor role, which target data plane access only. Restrict the scope to the specific storage account (sa-prod-data).

Key Concept

Azure RBAC configurations must separate control plane and data plane permissions, leverage management group and resource group scopes for inheritance, and combine specific built-in roles to meet complex automation requirements without violating the principle of least privilege.
Estimated Time:3m 0s
Question 243Question →

Meridian Transit plans to deploy a new critical scheduling application in the West Europe region. The application requires two virtual machines named `VM-Sched1` and `VM-Sched2`. The deployment must meet the following requirements:
- Protect the application against the failure of an entire datacenter.
- Achieve a virtual machine uptime Service Level Agreement (SLA) of 99.99%99.99\%.

Which configuration should you implement?

Show answer & explanation

Answer: Deploy `VM-Sched1` in Availability Zone 11 and `VM-Sched2` in Availability Zone 22, and associate them with a Standard Load Balancer.

Answer

Deploy the virtual machines in different Availability Zones (Availability Zone 11 and Availability Zone 22) and associate them with a Standard Load Balancer.
Deploying virtual machines across different Availability Zones provides protection against datacenter-wide failures because each zone is a physically separate location with independent power, cooling, and networking. This configuration qualifies for the highest Microsoft Azure VM uptime Service Level Agreement (SLA) of 99.99%99.99\%. A Standard Load Balancer is required when routing traffic to zone-redundant backend pools.

Step-by-Step Solution

1
Analyze the SLA and high availability requirements.
The requirement specifies a 99.99%99.99\% SLA and protection against an entire datacenter outage.
Determining these limits helps rule out Availability Sets, which only offer a 99.95%99.95\% SLA and do not protect against datacenter-wide failures.
2
Evaluate Availability Zones vs Availability Sets.
Availability Zones consist of unique physical locations within an Azure region, providing 99.99%99.99\% SLA and datacenter-level fault tolerance. Availability Sets are restricted to a single datacenter/zone.
Selecting Availability Zones is necessary to meet the 99.99%99.99\% SLA and datacenter redundancy requirements.
3
Determine the load balancer SKU requirements for zone-redundant backend pools.
A Standard Load Balancer is required to distribute traffic to virtual machines deployed across different Availability Zones.
A Basic Load Balancer does not support cross-zone backend configurations, which is necessary for this zonal deployment.

Key Concept

Deploying virtual machines across Availability Zones to achieve high availability and a 99.99%99.99\% SLA.
Estimated Time:2m 0s
Question 244Question →

When deploying virtual machines in Azure, you must select the appropriate managed disk type for the OS and data disks based on performance and workload requirements. Match each Azure managed disk type to its primary characteristic.

Click a left item, then click its matching right item

Items

Ultra Disk
Premium SSD
Standard SSD
Standard HDD

Matches

Show answer & explanation

Answer

Ultra Disk matches with the ability to dynamically scale IOPS and throughput with sub-millisecond latency. Premium SSD matches with high-performance production workloads that support host caching. Standard SSD matches with consistent entry-level performance for web servers. Standard HDD matches with low-cost storage for infrequently accessed data.
Each Azure managed disk option is tailored to specific performance tiers. Ultra Disk supports dynamic configuration scaling and ultra-low latency; Premium SSD targets production workloads with host caching; Standard SSD targets entry-level servers with consistent SSD reliability; and Standard HDD offers budget-friendly storage for archival purposes.

Step-by-Step Solution

1
Examine Ultra Disk characteristics.
Ultra Disk is identified by its unique ability to dynamically modify performance metrics (IOPS and throughput) on-the-fly and deliver sub-millisecond latency.
To align the highest-tier storage option with its distinct flexibility features.
2
Analyze Premium SSD characteristics.
Premium SSD is matched to high-performance production workloads that utilize read-only or read-write host-level caching.
To identify standard enterprise-grade SSD properties.
3
Distinguish between Standard SSD and Standard HDD.
Standard SSD provides consistent, solid-state reliability for light production/dev-test workloads, while Standard HDD provides low-cost magnetic storage for backups and archival data.
To correctly map entry-level SSDs and traditional HDDs based on performance consistency and cost factors.

Key Concept

Azure Managed Disk Types and Performance Characteristics
Question 245Question →

You plan to deploy an Azure Virtual Machine named VM1 in the East US region. VM1 will host a transaction-heavy database engine. You need to configure VM1 to satisfy the following requirements:
- Ensure the database files are stored on a disk that supports up to 80,000 IOPS and sub-millisecond latency.
- Protect the virtual machine against datacenter-wide failures.
- Allow VM1 to be placed in the backend pool of an existing public load balancer.
- Configure daily backups for the virtual machine.

Which configuration should you choose when deploying VM1?

Show answer & explanation

Answer: Deploy VM1 in Availability Zone 1, select a VM size that supports Ultra Disk, enable Ultra Disk compatibility, associate the VM with a Standard SKU load balancer, and configure backups to a Recovery Services Vault in the East US region.

Answer

Deploy VM1 in Availability Zone 1, select a VM size that supports Ultra Disk, enable Ultra Disk compatibility, associate the VM with a Standard SKU load balancer, and configure backups to a Recovery Services Vault in the East US region.
The configuration deploying the virtual machine to Availability Zone 1, enabling Ultra Disk compatibility with a supported VM size, using a Standard SKU load balancer, and choosing a Recovery Services Vault in the East US region satisfies all requirements. Availability Zones protect against datacenter-wide failures, and Ultra Disks are required for the sub-millisecond latency and high IOPS workload. A Standard SKU load balancer is needed to support virtual machines in Availability Zones, and the Recovery Services Vault must be in the same region (East US) as the VM.

Step-by-Step Solution

1
Select the high availability option that protects against datacenter-wide failures.
Availability Zones (specifically Availability Zone 1) must be selected, as Availability Sets only protect against hardware failures within a single datacenter.
Protecting against datacenter-wide outages requires physically separate zones within an Azure region.
2
Configure the VM size and settings to support Ultra Disk storage.
Choose a VM size that supports Ultra Disk, and enable the 'Ultra Disk compatibility' setting during the VM deployment process.
Ultra Disks are required to meet the 80,000 IOPS and sub-millisecond latency requirement, but they require explicit compatibility enablement on the host VM.
3
Select the correct load balancer SKU to support the zonal VM.
Associate the VM with a Standard SKU load balancer.
Basic SKU load balancers do not support zonal virtual machines in their backend pools.
4
Select the correct region for the Recovery Services Vault.
Configure backups to a Recovery Services Vault located in the East US region.
Azure Backup requires the Recovery Services Vault to be in the same geographic region as the virtual machine being backed up.

Key Concept

Deploying and configuring virtual machines with specific disk performance (Ultra Disk), high availability (Availability Zones), load balancing SKU compatibility, and region-matched backup resources.
Question 246Question →

Vortex Analytics is planning to deploy a new web application on Azure virtual machines in the North Europe region. The application requires a minimum virtual machine uptime SLA of 99.99%99.99\% and protection against datacenter-wide failures. You will deploy multiple virtual machines named VM-App-Prod1, VM-App-Prod2, and VM-App-Prod3. You need to configure the high availability and load balancing solution. Which of the following configuration steps should you perform? Select two.

Select all that apply

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones in the North Europe region.; Associate the virtual machines with the backend pool of an Azure Standard Load Balancer.

Answer

Deploy the virtual machines across two or more Availability Zones and associate them with the backend pool of an Azure Standard Load Balancer.
Deploying virtual machines across multiple Availability Zones provides physical separation within an Azure region, protecting against datacenter-wide outages and meeting the 99.99%99.99\% SLA requirement. A Standard Load Balancer is required to distribute traffic to virtual machines deployed across multiple zones, as it supports zone-redundant backend pools.

Step-by-Step Solution

1
Analyze the SLA and high availability requirements.
The application requires a 99.99%99.99\% SLA and protection against datacenter-wide failures.
This requirement determines the deployment target. Availability Sets only guarantee up to 99.95%99.95\% SLA and do not protect against datacenter-wide outages, whereas Availability Zones guarantee 99.99%99.99\% SLA and protect against datacenter failures.
2
Determine the deployment strategy for the virtual machines.
Select Availability Zones as the deployment target.
Deploying the virtual machines across two or more Availability Zones meets the 99.99%99.99\% SLA and datacenter-protection requirements.
3
Choose the appropriate load balancer tier.
Select an Azure Standard Load Balancer.
A Standard Load Balancer is required for distributing traffic across Availability Zones, as Basic Load Balancers do not support zone-redundant backend pools or zones.

Key Concept

Azure Virtual Machine High Availability configurations using Availability Zones and Standard Load Balancer
Estimated Time:1m 30s
Question 247Question →

You configure the Azure resource hierarchy for a business unit. The hierarchy includes a Management Group named Global-MG, an Azure subscription named Sub-Finance, and two resource groups named RG-Core and RG-Sandbox.

You assign the 'Allowed locations' Azure Policy definition to Sub-Finance. The policy definition is configured to permit resource creation only in the East US or West US regions. You add RG-Sandbox to the exclusion list (Not Scopes) of this policy assignment.

What is the result when an administrator attempts to deploy a new storage account in the West Europe region within RG-Sandbox?

Show answer & explanation

Answer: The storage account is successfully created in West Europe.

Answer

The storage account is successfully created in West Europe.
The correct answer is that the storage account is successfully created in West Europe. When a resource group is added to the exclusion list (Not Scopes) of a policy assignment, the policy is completely bypassed for any resources created within that resource group. Therefore, the restriction to East US or West US does not apply to RG-Sandbox.

Step-by-Step Solution

1
Analyze the policy assignment scope and exclusions.
The policy assignment target is the subscription Sub-Finance, but the resource group RG-Sandbox is explicitly excluded (Not Scopes).
Exclusions remove specific scopes from the evaluation of the policy assignment.
2
Determine the effect of the policy on the deployment request.
Since the resource is being deployed within the excluded RG-Sandbox resource group, the 'Allowed locations' policy is not evaluated for this deployment.
Azure Policy bypasses evaluation for any resources created within an excluded scope.
3
Determine the deployment outcome.
The deployment of the storage account in West Europe succeeds.
No policy constraints are active on RG-Sandbox to block the deployment.

Key Concept

Azure Policy exclusions (Not Scopes) prevent the policies assigned at higher scopes from being applied to the excluded resource groups or resources.
Question 248Question →

You need to generate a Shared Access Signature (SAS) token for an Azure Storage account. The access must be restricted to secure connections only and limited to a specific client network range.

Which two settings should you configure when generating the SAS token?

Select all that apply

Show answer & explanation

Answer: Allowed protocols; Allowed IP addresses

Answer

To restrict access to secure connections and a specific client network range, you must configure the Allowed protocols and Allowed IP addresses settings.
The correct parameters to configure are the allowed protocols and the allowed IP addresses. Restricting allowed protocols to HTTPS only enforces secure connections, and setting allowed IP addresses limits traffic to the specified client network range.

Step-by-Step Solution

1
Analyze the security constraints required for the Shared Access Signature (SAS) token.
The requirements are: 1) secure connections only, and 2) a specific client network range.
This helps target the correct configuration settings during token generation.
2
Select the parameter that controls the connection security protocol.
Configure Allowed protocols to require HTTPS only.
Allowed protocols restricts client requests to secure channels.
3
Select the parameter that restricts client requests by source IP address.
Configure Allowed IP addresses with the specific client network range.
Allowed IP addresses ensures only clients from the defined IP range can use the token.

Key Concept

Shared Access Signatures (SAS) allow granular delegation of access using constraints such as protocol validation and source IP address range filters.
Question 249Question →

You manage a Microsoft Entra ID tenant named corp.litware.com. The tenant contains the following:

* An administrative unit named AU1.
* A security group named Group1.
* A security group named Group2 that is a nested member of Group1.
* Standard internal member users and B2B guest users.

You need to configure the tenant to satisfy the following security and administration requirements:

1. Only the users in Group1 and Group2 must be permitted to use Self-Service Password Reset (SSPR).
2. Internal member users must be able to invite guest users, but B2B guest users must be blocked from inviting other guest users.
3. Guest invitations must be permitted only to the partner.com domain.

Which three actions should you perform? Each correct answer presents part of the solution.

Select all that apply

Show answer & explanation

Answer: Create a new flat security group containing all direct members of Group1 and Group2, and configure the Self-Service Password Reset enabled scope to Selected targeting the new group.; In the External collaboration settings, set the Guest invite restrictions to Member users and users assigned to specific admin roles can invite guest users.; In the External collaboration settings, select Allow invitations only to the specified domains under Collaboration restrictions, and add partner.com to the list of domains.

Answer

To configure the tenant correctly, you must: create a new flat security group containing all direct members of both groups and target that group for Self-Service Password Reset (SSPR) enablement; in the External collaboration settings, set the Guest invite restrictions to allow member users and specific admin roles to invite guest users; and under Collaboration restrictions, select 'Allow invitations only to the specified domains' and add the partner domain to the list.
To satisfy the SSPR requirement, we must create a flat security group containing all members of the nested groups and target it, because SSPR enablement only supports a single group and does not evaluate nested group structures. To allow only internal members and administrators to invite guests, the Guest invite restrictions should be set to 'Member users and users assigned to specific admin roles can invite guest users'. To restrict guest invitations to the partner domain, we must configure the Collaboration restrictions to allow invitations only to the specified domain and add the partner domain to the list.

Step-by-Step Solution

1
Address the nested SSPR requirement by creating a flat security group containing all users from both Group1 and Group2, then configuring SSPR enablement to 'Selected' targeting this new group.
All intended users in both groups are enabled for SSPR, overcoming the limitation where SSPR group scoping does not evaluate nested group memberships.
Microsoft Entra ID SSPR enablement is limited to a single group and does not support nested group evaluation.
2
Configure B2B guest invitation permissions in the External collaboration settings by setting Guest invite restrictions to 'Member users and users assigned to specific admin roles can invite guest users'.
Internal member users retain guest invitation privileges, but guest users are blocked from sending invitations.
This configuration selectively permits members and admins to invite guests while excluding B2B guest users.
3
Configure domain-level B2B restrictions by selecting 'Allow invitations only to the specified domains (most restrictive)' under Collaboration restrictions and adding 'partner.com'.
Invitations are blocked for all domains except for the specified partner domain.
This establishes an allowlist for external collaboration to restrict guest onboarding to the designated partner.

Key Concept

Microsoft Entra ID SSPR scope configuration rules and External Identities B2B collaboration settings.
Estimated Time:3m 0s
Question 250Question →

Contoso Corp has an Azure subscription containing a Key Vault named contosokey1 and a Storage Account named contosodata1. You plan to configure contosodata1 to use customer-managed keys (CMK) stored in contosokey1 to encrypt storage data.

Which two features must be enabled on contosokey1 before you can configure CMK encryption? (Select two.)

Select all that apply

Show answer & explanation

Answer: Soft delete; Purge protection

Answer

Soft delete and Purge protection must be enabled on the Key Vault.
To use customer-managed keys for storage encryption, the Key Vault must have both soft delete and purge protection enabled. Soft delete ensures that deleted vaults or keys can be recovered within a retention period, while purge protection prevents the permanent deletion of the key or vault until the retention period has elapsed.

Step-by-Step Solution

1
Identify key vault prerequisites for customer-managed key (CMK) encryption.
To protect against accidental key deletion, Azure Storage requires both soft delete and purge protection to be enabled on the target Key Vault.
If a key used for encryption is permanently deleted, all data in the storage account becomes unreadable. Soft delete and purge protection provide a safety window to recover the key.
2
Evaluate key vault role permissions.
The storage account requires data-plane permissions to wrap and unwrap keys (such as Key Vault Crypto Service Encryption User), not control-plane permissions like Key Vault Contributor.
Azure RBAC distinguishes between control-plane actions (managing the key vault resource) and data-plane actions (performing cryptographic operations on the keys).

Key Concept

Key Vault requirements for Storage Account Customer-Managed Keys (CMK)
Question 251Question →

An administrator is configuring autoscale rules for an Azure Virtual Machine Scale Set (VMSS) named `vmss-backend`. The scale-out rule is configured to add `22` instances when the average CPU utilization exceeds `75%75\%`. The administrator wants to configure a scale-in rule that decreases the instance count while preventing instance thrashing (continuous launching and terminating of VMs).

Which CPU utilization threshold should the administrator set for the scale-in rule?

Show answer & explanation

Answer: A scale-in threshold of `25%25\%` average CPU utilization

Answer

A scale-in threshold of `25%25\%` average CPU utilization
The correct answer is the option specifying a scale-in threshold of `25%25\%` average CPU utilization. In autoscale configurations, there must be a significant gap between the scale-out threshold and the scale-in threshold. When an instance is removed (scale-in), the workload is distributed among fewer virtual machines, which increases the average CPU utilization on those remaining. If the scale-in threshold is too close to the scale-out threshold, this sudden increase in average CPU usage will immediately trigger a scale-out event, causing continuous scaling cycles (thrashing). A low threshold like `25%25\%` prevents this.

Step-by-Step Solution

1
Analyze the scale-out configuration.
The scale-out rule is triggered when average CPU utilization exceeds `75%75\%`.
This establishes the upper bound for scaling up capacity.
2
Evaluate the risk of instance thrashing.
If the scale-in threshold is too close to the scale-out threshold, removing an instance increases the average CPU load on the remaining instances, immediately pushing it back above the scale-out threshold.
Thrashing occurs when the difference between scale-out and scale-in thresholds is not large enough to absorb the change in average resource consumption per VM after scaling.
3
Select a threshold that provides an adequate buffer.
A threshold of `25%25\%` provides a wide buffer, ensuring that the load must drop substantially before instances are removed, keeping the scale set stable.
This guarantees that scaling in only happens during sustained periods of low activity.

Key Concept

Avoiding instance thrashing in Virtual Machine Scale Sets by setting a sufficient margin between scale-out and scale-in thresholds.
Estimated Time:45s
Question 252Question →

Your company has an Azure subscription containing a resource group named RG1. RG1 contains an Azure Storage account named corpstorage1 that hosts a blob container named reports. You have an Azure virtual machine named VM1 that has a system-assigned managed identity enabled. You deploy a custom application on VM1. The application must perform the following tasks:
1. Retrieve a list of blobs from the reports container.
2. Generate a User Delegation SAS token to allow temporary read access to individual reports in the container.
You need to configure the minimal role assignments to allow the application on VM1 to perform these tasks using Microsoft Entra ID authentication under the principle of least privilege. Which two role assignments should you configure?

Select all that apply

Show answer & explanation

Answer: Assign the Storage Blob Delegator role to the system-assigned managed identity of VM1 at the corpstorage1 storage account scope.; Assign the Storage Blob Data Reader role to the system-assigned managed identity of VM1 at the reports container scope.

Answer

To configure access under the principle of least privilege, you should assign the Storage Blob Delegator role to the managed identity of VM1 at the corpstorage1 storage account scope, and assign the Storage Blob Data Reader role to the managed identity of VM1 at the reports container scope.
To create a User Delegation SAS, an identity must first request a User Delegation Key from the storage account. The action to request this key is Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action, which is granted by the Storage Blob Delegator role. Because this is a storage account-level service operation, the role must be assigned at the storage account level. To read the blobs, the identity needs the Storage Blob Data Reader role, which should be assigned at the container level (reports) to limit data access to only the necessary container, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the permission needed to generate a User Delegation SAS token.
Generating a User Delegation SAS token requires a User Delegation Key. This key is requested at the storage account level using the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action operation.
Before an identity can sign a User Delegation SAS, it must obtain a user delegation key from Azure Storage.
2
Determine the appropriate role and scope for key generation.
The Storage Blob Delegator role provides the necessary action. It must be scoped at the storage account level (corpstorage1) because the user delegation key is a service-wide resource.
Assigning the role at the container scope is insufficient since container scopes do not support generating service-wide keys.
3
Determine the minimum role and scope required to retrieve the list of blobs.
The application needs to read the blobs in the reports container. The Storage Blob Data Reader role should be assigned at the reports container scope.
This configuration adheres to the principle of least privilege by restricting data-plane access only to the target container.

Key Concept

Configuring Microsoft Entra ID authentication for Azure Storage access using role-based access control (RBAC), specifically separating the control plane (Storage Blob Delegator) and the data plane (Storage Blob Data Reader) under the principle of least privilege.
Question 253Question →

You are designing the configuration management and deployment workflows for virtual machines (VMs) in a Microsoft Azure subscription.

Match each administrative requirement to the most appropriate Azure Virtual Machine feature or tool. (To answer, match the appropriate tool on the right to the requirement on the left. Each tool may be used once, more than once, or not at all.)

Click a left item, then click its matching right item

Items

Configure automatic post-deployment software installation and OS customization on a newly provisioned Windows VM without maintaining custom images.
Execute a single ad-hoc troubleshooting script on a running VM that has no public network connectivity or open management ports.
Enforce a consistent configuration state across multiple VMs and automatically correct any configuration drift over time.
Create and maintain customized gold images with pre-installed applications and security patches across multiple regions.

Matches

Show answer & explanation

Answer

Configure automatic post-deployment software installation matches with Custom Script Extension; Execute a single ad-hoc troubleshooting script matches with Run Command; Enforce a consistent configuration state matches with Azure Automation State Configuration (DSC); Create and maintain customized gold images matches with Azure VM Image Builder.
The correct matches align each requirement with the specific capabilities of the Azure VM tools: Custom Script Extension is optimized for initial bootstrapping; Run Command bypasses network barriers via the local VM Agent for ad-hoc execution; Azure Automation State Configuration (DSC) handles continuous drift correction; and Azure VM Image Builder automates gold image pipelines.

Step-by-Step Solution

1
Analyze the requirement for automatic post-deployment software installation on a newly provisioned VM.
The Custom Script Extension is the ideal native tool to download and run scripts during or immediately after the VM provisioning phase.
This avoids the overhead of managing customized VM images.
2
Analyze the requirement to run an ad-hoc troubleshooting script on an unreachable VM.
The Run Command feature uses the Azure VM Agent to execute PowerShell or Bash scripts on a VM without requiring direct RDP, SSH, or public network access.
This allows troubleshooting when management ports are closed.
3
Analyze the requirement to enforce state and correct configuration drift across multiple VMs.
Azure Automation State Configuration (DSC) is the built-in configuration management service that compiles DSC configurations and periodically audits/enforces the specified state on targets.
Other extension-based scripting tools execute only once and cannot continuously monitor or correct drift.
4
Analyze the requirement to create, customize, and replicate gold VM images.
Azure VM Image Builder is a managed service designed specifically to automate the creation of customized base images and distribute them to multiple target regions.
It replaces manual VM sysprep and capture workflows.

Key Concept

Azure Virtual Machine configuration management, extensions, and imaging tools.
Estimated Time:1m 30s
Question 254Question →

An administrator has a standard General Purpose v2 (GPv2) storage account named stprodwest in the West US region with Geo-redundant storage (GRS) enabled. Due to a disaster in the primary region, the administrator performs a customer-managed failover of the storage account to the secondary region (East US).

Which of the following describes the replication state of the storage account immediately after the failover completes, and the action required to restore replication to the secondary region?

Show answer & explanation

Answer: The replication state becomes Locally-redundant storage (LRS), and the administrator must manually reconfigure the storage account to use Geo-redundant storage (GRS).

Answer

The replication state becomes Locally-redundant storage (LRS), and the administrator must manually reconfigure the storage account to use Geo-redundant storage (GRS).
Immediately after a customer-managed failover, the storage account's replication type is updated to Locally-redundant storage (LRS). The account is no longer geo-redundant. To configure the storage account for geo-redundancy again, the administrator must manually reconfigure the replication setting to Geo-redundant storage (GRS) or Read-access geo-redundant storage (RA-GRS).

Step-by-Step Solution

1
Determine the state of the storage account replication after customer-managed failover.
The storage account's replication setting changes from GRS to Locally-redundant storage (LRS) in the new primary region.
When a failover occurs, the secondary region becomes the new primary. Since there is no longer a secondary configured, the account is converted to LRS.
2
Determine the configuration process required to restore geo-redundancy.
The administrator must manually modify the replication configuration to GRS or RA-GRS.
This transition is a standard setting modification that can be done directly by the administrator without a support ticket or live migration.

Key Concept

Customer-managed failover behavior and replication configuration changes for Azure Storage accounts.
Estimated Time:1m 30s
Question 255Question →

The Azure resource hierarchy for a retail company consists of the following components:
* Management Group: `MG-Corporate`
* Subscription: `Sub-Production`
* Resource Group: `RG-Web-Apps`

An IT administrator named Admin1 is assigned only the Global Administrator role in the Microsoft Entra ID tenant.
Admin1 must delegate permissions to a development team by assigning the Contributor role at the `RG-Web-Apps` scope. However, Admin1 is currently unable to view `Sub-Production` or `RG-Web-Apps` in the Azure portal.
Which action should Admin1 perform to ensure they can assign the role?

Show answer & explanation

Answer: Elevate access in the properties of the Microsoft Entra directory to manage Azure resources.

Answer

Elevate access in the properties of the Microsoft Entra directory to manage Azure resources.
Elevating access in the properties of the Microsoft Entra directory temporarily grants the Global Administrator the User Access Administrator role at the root scope (//). Since permissions inherit down the Azure resource hierarchy, the administrator will receive the User Access Administrator role for all management groups, subscriptions, and resource groups associated with the directory, allowing them to assign roles at the resource group scope.

Step-by-Step Solution

1
Identify the separation of planes between Microsoft Entra ID (directory roles) and Azure RBAC (resource roles).
Confirm that being a Global Administrator does not automatically grant access to subscriptions or resource groups.
By default, Microsoft Entra ID roles do not inherit permissions into Azure resource management.
2
Elevate access in the Microsoft Entra directory properties.
Admin1 is assigned the User Access Administrator role at the root scope (//).
This toggle enables directory Global Administrators to manage access to all subscriptions and management groups associated with the tenant.
3
Utilize inherited permissions to manage role assignments.
The User Access Administrator role inherits down to the resource group level (`RG-Web-Apps`), granting Admin1 the necessary permission to assign the Contributor role.
Azure RBAC assignments are inherited from higher scopes to lower scopes.

Key Concept

Azure RBAC inheritance and directory-level access elevation
Estimated Time:1m 15s
Question 256Question →

You are planning to delegate user management tasks in a Microsoft Entra ID tenant. You need to create a new group named Identity-Managers and assign the User Administrator role directly to this group. Which configuration is required for the Identity-Managers group?

Show answer & explanation

Answer: The group membership type must be set to Assigned, and the option to assign Microsoft Entra roles must be enabled during group creation.

Answer

The group membership type must be set to Assigned, and the option to assign Microsoft Entra roles must be enabled during group creation.
The correct option is correct because assigning a Microsoft Entra ID role to a group requires creating a role-assignable group. This type of group must have the role-assignable property enabled during creation and only supports the 'Assigned' membership type to guarantee administrative oversight over the group's members.

Step-by-Step Solution

1
Identify the type of role being assigned.
The User Administrator role is a Microsoft Entra ID directory-level role, not an Azure RBAC role.
Entra ID directory roles have different assignment requirements and APIs compared to Azure resource role-based access control.
2
Determine group requirements for Microsoft Entra ID directory roles.
The target group must have its 'isAssignableToRole' attribute set to true. This property can only be set at group creation time and cannot be modified later.
This restriction ensures that unauthorized administrators cannot turn a regular group into a role-assignable group to elevate their own privileges.
3
Verify group membership restrictions for role-assignable groups.
The membership type must be 'Assigned'. Dynamic groups (Dynamic User or Dynamic Device) cannot be assigned to roles.
Using dynamic groups for role assignment would allow automatic, query-based privilege elevation, which presents a significant security risk.

Key Concept

Microsoft Entra ID role-assignable groups require the 'Assigned' membership type and must have the role assignment setting enabled at the time of creation.
Question 257Question →

Your organization's Azure environment features the following resource hierarchy:
- Tenant Root Group (Management Group)
- IT-MG (Management Group)
- Production-Sub (Subscription)
- App-RG (Resource Group)

You configure a system-assigned managed identity for an Azure App Service instance inside App-RG. You need to grant this managed identity the ability to view the configuration of all resources within App-RG. The identity must not be allowed to modify any resource configurations or change role assignments.

Which Azure role and scope should you assign to the managed identity to meet these requirements while adhering to the principle of least privilege?

Show answer & explanation

Answer: Assign the Reader role at the App-RG scope.

Answer

Assign the Reader role at the App-RG scope.
Assigning the Reader role at the resource group scope (App-RG) is correct because it grants read-only access to all resources in that specific resource group, satisfying the requirement to view resource configurations without permitting modifications, while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the target identity and the scope of access.
The target is a system-assigned managed identity, and the scope is the App-RG resource group.
Permissions should be assigned at the lowest scope that meets the requirements to satisfy the principle of least privilege.
2
Determine the required access permissions.
The identity needs to view configurations of all resources but must not modify resources or change assignments.
This aligns with the built-in Reader role, which permits read-only access to the resource control plane.
3
Assign the correct Azure RBAC role at the identified scope.
The Reader role is assigned directly to the managed identity at the App-RG scope.
This configuration provides the necessary read access to resources in the resource group while preventing unauthorized operations and access outside of App-RG.

Key Concept

Azure RBAC scopes and built-in roles application
Question 258Question →

An organization is configuring access control for its Azure environment. You have the following Azure resource hierarchy and assignments:

* Subscription1
* ResourceGroup1
* StorageAccount1 (contains a blob container named container1)
* ResourceGroup2
* VM1 (Virtual Machine)

You configure the following identity and access management settings:
- User1 is assigned the Microsoft Entra ID Global Administrator role.
- User1 is assigned the Storage Blob Data Reader role at the scope of Subscription1.
- User1 is assigned the Reader role at the scope of ResourceGroup2.

Which of the following actions can User1 perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Read blob data inside container1.; View the configuration settings of VM1.

Answer

User1 can read blob data inside container1 and view the configuration settings of VM1.
The correct actions are reading blob data inside container1 and viewing the configuration settings of VM1. The Storage Blob Data Reader role at the subscription level inherits down to the container level, granting the necessary data plane read permissions. Similarly, the Reader role at the resource group level inherits to VM1, allowing the user to view VM1's configuration details.

Step-by-Step Solution

1
Evaluate the permissions inherited from the subscription scope to the storage data plane.
The Storage Blob Data Reader role assigned at Subscription1 inherits down to all storage accounts and blob containers under it. This allows reading blob data inside container1.
Azure RBAC assignments at a higher scope (Subscription1) automatically flow down to child resources (ResourceGroup1 -> StorageAccount1 -> container1).
2
Evaluate the permissions inherited from the resource group scope to the virtual machine.
The Reader role assigned at ResourceGroup2 inherits to VM1, allowing the user to view VM1's configuration settings.
RBAC inheritance applies to resource group level assignments, flowing down to all child resources within that resource group.
3
Analyze the Microsoft Entra ID Global Administrator role's effect on subscription resources.
The Global Administrator role does not grant permissions to create resource groups in Subscription1.
Microsoft Entra ID roles (like Global Administrator) and Azure RBAC roles are separate. Entra ID roles manage directory resources, while RBAC roles manage Azure subscription resources.
4
Evaluate if inheritance can be blocked using deny assignments.
It is not possible to manually configure a deny assignment to block the inherited Storage Blob Data Reader role.
Azure RBAC is additive, and standard administrators cannot create manual deny assignments.

Key Concept

Azure RBAC roles are additive and inherit down the resource hierarchy. Microsoft Entra ID roles do not automatically grant permissions to subscription resources, and standard administrators cannot create manual deny assignments.
Question 259Question →

A company implements an Azure Storage account named `stbackupshare` to store business data. The storage account's firewall is configured to allow access only from a subnet named `Subnet-App` within the virtual network `VNet-Core`. Azure Backup is configured to back up the file shares in `stbackupshare`, but the backup jobs fail with a network access error. Which configuration adjustment must be made to allow Azure Backup to successfully back up the files?

Show answer & explanation

Answer: Enable the exception that allows trusted Microsoft services to access the storage account in the firewall settings.

Answer

Enable the exception that allows trusted Microsoft services to access the storage account in the firewall settings.
Enabling the 'Allow trusted Microsoft services to access this storage account' exception allows Azure Backup to bypass the firewall rules and perform backup and restore operations securely.

Step-by-Step Solution

1
Identify the cause of the network access failure.
The storage account firewall is configured to allow traffic only from a specific subnet, blocking external services.
By default, enabling the firewall blocks all external traffic, including Azure multi-tenant services like Azure Backup.
2
Evaluate the supported bypass options for Azure services.
Identify the 'Allow trusted Microsoft services to access this storage account' setting as the solution.
This setting creates a secure exception for specific Microsoft services to access the storage account even when the firewall is enabled.
3
Confirm configuration requirements.
Verify that Azure Backup is on the list of trusted Microsoft services.
Azure Backup is a trusted service and can securely access storage accounts when this exception is configured.

Key Concept

Bypassing Azure Storage firewalls for trusted Microsoft services
Estimated Time:1m 30s
Question 260Question →

An administrator is configuring an Azure Virtual Machine Scale Set (VMSS) named `vmss-processing` to handle a variable batch-processing workload. The VMSS must meet the following requirements:
- Use Flexible orchestration mode to allow a mix of Spot and Standard virtual machines.
- Support Azure Autoscale to dynamically increase and decrease the number of instances based on CPU utilization.

Which two settings must be configured on `vmss-processing` to support automatic scaling? Select two.

Select all that apply

Show answer & explanation

Answer: Set the platform fault domain count to 1.; Include a virtual machine profile in the scale set definition.

Answer

To support automatic scaling for a Virtual Machine Scale Set in Flexible orchestration mode, you must set the platform fault domain count to 1 and define a virtual machine profile in the scale set configuration.
To enable Azure Autoscale for a Virtual Machine Scale Set configured in Flexible orchestration mode, you must set the platform fault domain count to 1 and define a virtual machine profile. Setting the fault domain count to 1 satisfies the platform restriction for autoscale in Flexible mode, while the virtual machine profile provides the template required by the autoscale engine to deploy new instances during scale-out events.

Step-by-Step Solution

1
Analyze the orchestration mode and scale set requirements.
The scenario specifies a Virtual Machine Scale Set using Flexible orchestration mode that must support Azure Autoscale to dynamically scale based on CPU utilization.
Different orchestration modes have distinct requirements and limitations for enabling automatic scaling.
2
Evaluate the platform fault domain constraints for autoscale in Flexible mode.
Identify that Azure Autoscale in Flexible orchestration mode is only supported when the platform fault domain count is set to 1.
A fault domain count greater than 1 disables the autoscale capability in Flexible mode.
3
Determine how scale-out instances are provisioned.
Identify that a virtual machine profile must be included in the scale set definition.
Without a virtual machine profile, the scale set cannot define the configuration of new virtual machines to spin up during autoscale events.

Key Concept

Enabling Azure Autoscale on a Virtual Machine Scale Set in Flexible orchestration mode requires setting the platform fault domain count to 1 and configuring a virtual machine profile to act as a template for scaled-out instances.
PreviousPage 13 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin