All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

You have an Azure subscription that contains a virtual network named VNet1 and a storage account named stcorpdata. You need to configure secure private access to the storage account from VNet1 using a private endpoint. The solution must ensure that resources in VNet1 can resolve the storage account's FQDN to its private IP address. Which sequence of steps should you perform to complete the configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure secure private access to the storage account, you must first create the private DNS zone, link the zone to the virtual network, create the private endpoint, integrate it with the DNS zone to auto-register DNS records, and finally restrict the storage account's public network access.

The correct order establishes the prerequisite DNS infrastructure (creating the private DNS zone and linking it to the virtual network) before creating the private endpoint and integrating it. Finally, public access is disabled to restrict all traffic to the private network route.

Step-by-Step Solution

Create a private DNS zone named privatelink.blob.core.windows.net.

The DNS namespace for the private endpoint is established in the subscription.

You must create the private DNS zone first so that it can be linked to virtual networks and receive DNS records.

Link the private DNS zone to VNet1.

VMs in VNet1 are configured to query the private DNS zone for name resolution.

Without linking the zone to the VNet, resources in the VNet will be unable to resolve the private DNS zone records.

Create a private endpoint for the blob service of stcorpdata in VNet1.

A private IP address is allocated to the storage account within the VNet subnet.

The private endpoint must be created to establish a private network interface for the storage service.

Configure private DNS integration with the private DNS zone.

A DNS A record is registered mapping stcorpdata.privatelink.blob.core.windows.net to the private endpoint's IP address.

DNS integration ensures that clients can resolve the storage account's public endpoint FQDN to the private IP address.

Set the public network access of the storage account to Disabled.

Public internet traffic to the storage account is blocked, and access is restricted to private endpoints only.

This locks down the storage account to complete the security configuration once private connectivity is confirmed.

Key Concept

Configuring private network access and private DNS integration for Azure Storage accounts.

Question 282Question →

You plan to deploy a new Windows Server Azure virtual machine named VM1 in a new virtual network. You must configure the deployment to meet the following requirements:
- Provide protection against an entire datacenter outage within the Azure region.
- Allow secure Remote Desktop Protocol (RDP) management of VM1 from the internet using Azure Bastion.

Which two configurations should you deploy? (Choose two.)

Select all that apply

Deploy VM1 in an Availability Zone.

Create a subnet named AzureBastionSubnet with a prefix of /26.

Deploy VM1 in an Availability Set.

Create a subnet named BastionSubnet with a prefix of /28.

Show answer & explanation

Answer: Deploy VM1 in an Availability Zone.; Create a subnet named AzureBastionSubnet with a prefix of /26.

Answer

Deploy the virtual machine in an Availability Zone and create a subnet named AzureBastionSubnet with a prefix of /26.

Deploying the virtual machine in an Availability Zone ensures protection against datacenter-wide failures by placing the VM in a physically separate datacenter facility within the region. Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' with a subnet prefix of /26 or larger to function correctly.

Step-by-Step Solution

Determine the correct availability option to protect against datacenter outages.

Select Availability Zones as the deployment target.

Availability Zones locate virtual machine instances in physically isolated datacenters within a region, providing redundancy against facility-level outages.

Configure the virtual network subnet requirements for Azure Bastion.

Configure a subnet named AzureBastionSubnet with a prefix of /26.

Azure Bastion requires a dedicated subnet with the exact name 'AzureBastionSubnet' and a minimum size of /26 to support its gateway instances.

Key Concept

Azure Virtual Machine availability options and Azure Bastion subnet requirements

Estimated Time:1m 0s

Question 283Question →

Consider the following Azure resource hierarchy:
- Tenant Root Group (Management Group)
- Corp-MG (Management Group)
- Subscription1 (Subscription)
- RG-Storage (Resource Group)

You are configuring access for a Microsoft Entra ID security group named Storage-Ops. The members of this group must be able to manage storage accounts inside RG-Storage, including the ability to rotate storage keys. Additionally, they must be able to view and download blobs in the containers. You need to assign the appropriate Azure RBAC roles at the RG-Storage level while following the principle of least privilege.

Which two roles should you assign? (Select two.)

Select all that apply

Storage Account Contributor

Storage Blob Data Reader

Contributor

Reader

User Administrator

Show answer & explanation

Answer: Storage Account Contributor; Storage Blob Data Reader

Answer

Storage Account Contributor and Storage Blob Data Reader

To satisfy the requirements using the principle of least privilege, separate roles are needed for control plane management and data plane operations. The Storage Account Contributor role allows configuration management and access key rotation of storage accounts. The Storage Blob Data Reader role provides the necessary read-only permissions for blob data containers. Assigning both roles at the resource group scope ensures proper inheritance.

Step-by-Step Solution

Analyze control plane requirements.

The Storage-Ops group needs to manage storage accounts and rotate access keys. The Storage Account Contributor built-in role is the most restrictive role that allows these management actions.

This satisfies the control plane management requirement under the principle of least privilege.

Analyze data plane requirements.

The Storage-Ops group needs to view and download blobs. The Storage Blob Data Reader built-in role provides read-only access to blob containers and data.

This satisfies the data plane access requirement under the principle of least privilege.

Determine the scope of the assignments.

Both roles must be assigned at the RG-Storage resource group level.

Assigning the roles at the resource group level ensures the permissions inherit down to all storage accounts and blob containers within that resource group.

Key Concept

Azure RBAC Control Plane and Data Plane Separation for Storage Accounts

Estimated Time:1m 30s

Question 284Question →

An administrator is preparing to deploy a new virtual machine named VM-DB-01 in the West US 2 region to host a database workload. The deployment must satisfy the following requirements:

1. The virtual machine must be protected against the failure of an entire datacenter within the West US 2 region.
2. The virtual machine must be backed up daily using Azure Backup.
3. Database administrators must have permissions to manage database files stored on an Azure Storage account, but they must not have permissions to modify the configurations of the virtual machine or the storage account.

Which set of configurations should the administrator select during the deployment process?

Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in West US 2, and assign the database administrators the Storage Blob Data Contributor role on the storage account.

Deploy VM-DB-01 in an Availability Set, create a Recovery Services vault in West US 2, and assign the database administrators the Storage Blob Data Contributor role on the storage account.

Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in East US, and assign the database administrators the Storage Blob Data Contributor role on the storage account.

Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in West US 2, and assign the database administrators the Contributor role on the resource group containing the storage account.

Show answer & explanation

Answer: Deploy VM-DB-01 in an Availability Zone, create a Recovery Services vault in West US 2, and assign the database administrators the Storage Blob Data Contributor role on the storage account.

Answer

Deploy the virtual machine in an Availability Zone, create a Recovery Services vault in the same region (West US 2), and assign the Storage Blob Data Contributor role on the storage account to the database administrators.

Deploying the virtual machine in an Availability Zone ensures that the instance is protected against datacenter-wide failures. The Recovery Services vault must be deployed in the same region (West US 2) as the virtual machine to enable Azure Backup. Assigning the Storage Blob Data Contributor role provides the database administrators with data-plane access to manage files in the storage account without granting control-plane permissions to modify any resource configurations.

Step-by-Step Solution

Select the appropriate infrastructure redundancy option for datacenter-wide resilience.

Choose Availability Zones instead of Availability Sets to ensure virtual machine instances are isolated across different physical datacenters within the West US 2 region.

Availability Zones protect workloads from datacenter outages, whereas Availability Sets only protect against local hardware failures within a single datacenter.

Align the Recovery Services vault region with the virtual machine.

Deploy the Recovery Services vault in the West US 2 region.

Azure Backup requires the Recovery Services vault and the protected virtual machine to reside in the same region to function.

Configure the least-privilege access control for managing database files on the storage account.

Assign the database administrators the Storage Blob Data Contributor role.

This role grants data-plane access (reading, writing, and deleting blobs) without granting control-plane administrative access (Contributor or Owner) which would allow modifications to resource configurations.

Key Concept

Azure VM deployment configurations including availability options, region alignment for recovery services, and separation of data-plane and control-plane permissions.

Estimated Time:2m 30s

Question 285Question →

You plan to deploy a new virtual machine named VM1 in the East US region. You need to configure the deployment to meet the following requirements:
- Protect VM1 against datacenter-wide failures.
- Secure the resource group hosting VM1 to prevent accidental deletion of the resource group and its resources.
- Configure daily backups for VM1.

Which of the following configurations should you select?

Deploy VM1 in an Availability Zone, apply a CanNotDelete lock to the resource group, and back up VM1 to a Recovery Services Vault in the East US region.

Deploy VM1 in an Availability Set, apply a CanNotDelete lock to the resource group, and back up VM1 to a Recovery Services Vault in the East US region.

Deploy VM1 in an Availability Zone, apply a CanNotDelete lock to the resource group, and back up VM1 to a Recovery Services Vault in the West US region.

Deploy VM1 in an Availability Zone, apply a CanNotDelete lock only to VM1 because locks on a resource group do not inherit to child resources, and back up VM1 to a Recovery Services Vault in the East US region.

Show answer & explanation

Answer: Deploy VM1 in an Availability Zone, apply a CanNotDelete lock to the resource group, and back up VM1 to a Recovery Services Vault in the East US region.

Answer

Deploy the virtual machine in an Availability Zone, apply a CanNotDelete lock to the resource group, and back up the virtual machine using a Recovery Services Vault in the East US region.

The correct configuration deploys the virtual machine in an Availability Zone to protect against datacenter-wide failures, applies a CanNotDelete lock at the resource group level which inherits to all child resources to prevent accidental deletion, and uses a Recovery Services Vault in the same region (East US) as the virtual machine for backups.

Step-by-Step Solution

Select the appropriate availability option to protect against datacenter-wide failures.

Deploys VM1 in an Availability Zone.

Availability Zones locate VM instances in physically unique datacenters within a region, providing protection against datacenter-wide outages, unlike Availability Sets which only protect against local hardware failures.

Apply a resource lock to secure the resource group and its resources.

Applies a CanNotDelete lock to the resource group hosting VM1.

A CanNotDelete lock placed at the resource group level prevents the deletion of the resource group itself and, through lock inheritance, prevents the deletion of all resources within the group, including VM1.

Configure backups using a Recovery Services Vault.

Creates a Recovery Services Vault in the East US region and configures a backup policy for VM1.

Azure requires that the Recovery Services Vault used to back up a virtual machine resides in the same geographic region as that virtual machine.

Key Concept

Virtual Machine deployment parameters including Availability Zones, Resource Lock inheritance, and Recovery Services Vault regional limitations.

Question 286Question →

Your company, Tailwind Traders, has an Azure subscription containing a storage account named twtstorage1 and an Azure Key Vault named twtkeyvault1. You configure twtstorage1 to use a system-assigned managed identity. twtkeyvault1 is configured to use Azure Role-Based Access Control (RBAC) for authorization. On twtkeyvault1, recovery of deleted vaults is enabled, and protection against permanent deletion is activated. You need to configure customer-managed key encryption for twtstorage1 using a key from twtkeyvault1. Which role must you assign to the system-assigned managed identity of twtstorage1 on twtkeyvault1?

Key Vault Crypto Service Encryption User

Contributor

Owner

Storage Blob Data Contributor

Show answer & explanation

Answer: Key Vault Crypto Service Encryption User

Answer

Key Vault Crypto Service Encryption User

To configure customer-managed key encryption, the storage account's managed identity must be granted data plane permissions to wrap and unwrap keys on the Key Vault. The Key Vault Crypto Service Encryption User role is the built-in role designed for this purpose, providing only the required cryptographic data plane permissions without administrative access.

Step-by-Step Solution

Identify the resource where permissions must be granted.

The Key Vault storing the customer-managed key (twtkeyvault1) is the target resource.

The storage account's managed identity needs permission to access the cryptographic key stored inside the Key Vault.

Determine the required permission type (control plane vs. data plane).

Data plane permissions for key operations (wrap and unwrap) are required.

Encrypting and decrypting storage data using a customer-managed key is a data plane operation, which standard control plane roles like Owner or Contributor do not grant.

Select the built-in Key Vault RBAC role that provides these data plane permissions.

The Key Vault Crypto Service Encryption User role provides the necessary wrap and unwrap key permissions.

This role is specifically designed to allow managed identities (like those of storage accounts) to perform encryption operations without granting excess administrative rights.

Key Concept

Customer-managed key encryption for Azure Storage requires granting data plane permissions (wrap/unwrap keys) to the storage account's managed identity using specific roles like Key Vault Crypto Service Encryption User.

Estimated Time:45s

Question 287Question →

An administrator manages an Azure environment with a Management Group named Tenant-MG. Under Tenant-MG, there is a Subscription named Sub-01 containing a Resource Group named RG-01. A policy definition is created to prevent users from deploying virtual machines of a specific SKU size. The policy must block any deployment attempt that violates this rule within the Resource Group. Which Azure Policy effect should be used in the policy definition to block the deployment of non-compliant virtual machines?

Deny

Audit

DeployIfNotExists

Disabled

Show answer & explanation

Answer: Deny

Answer

Deny

The Deny effect prevents resource creation or modification requests that do not comply with the policy definition. In this scenario, it immediately blocks the deployment of virtual machines of the restricted SKU size.

Step-by-Step Solution

Analyze the compliance requirement

The requirement states that the deployment of non-compliant virtual machines must be blocked.

Identifying the desired outcome is the first step in selecting the correct policy effect.

Evaluate the behavior of each policy effect option

The Deny effect prevents the creation or update of resources that do not match the policy rules, while Audit only logs warnings and DeployIfNotExists deploys missing resources.

Comparing the policy effects determines which one achieves the goal of blocking the deployment.

Select the correct effect

Select the Deny effect.

Deny is the only effect that directly blocks resource creation requests upon policy evaluation failure.

Key Concept

Azure Policy effects determine what happens when a resource is evaluated against a policy rule during deployment or modification.

Question 288Question →

You need to configure a custom domain named www.contoso.com for an Azure App Service web app. In which sequence should you perform the configuration steps to verify domain ownership and bind the custom domain?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First retrieve the custom domain verification ID (asuid) from the Custom domains blade of the App Service, then create a TXT record with the host name 'asuid.www' pointing to the verification ID at your DNS registrar, and finally add and validate the custom domain name in the App Service custom domains settings.

The correct order requires retrieving the verification ID first, creating the corresponding TXT record in the DNS zone to prove ownership, and then adding and validating the domain name within the Azure App Service custom domains configuration.

Step-by-Step Solution

Retrieve the custom domain verification ID (asuid) from the App Service.

The verification ID is obtained from the Azure Portal.

This unique ID is required to configure the DNS TXT record for ownership verification.

Create the TXT record in your DNS zone at your domain registrar.

A TXT record with the host name 'asuid.www' pointing to the verification ID is created.

Azure queries this TXT record during the validation step to verify domain ownership.

Add the custom domain 'www.contoso.com' to the App Service and click Validate.

The custom domain is successfully validated and bound to the App Service.

This completes the binding process after ownership has been successfully verified via DNS.

Key Concept

Azure App Service Custom Domain Verification and Binding

Question 289Question →

An organization plans to sync an on-premises folder `D:\Marketing` on a file server named `Server1` to an Azure file share named `mktg-share` using Azure File Sync. The local drive `D:` has a total capacity of $1\text{ TB}$ ( $1000\text{ GB}$ ). The configuration must meet the following requirements:
- Drive `D:` must always maintain at least $300\text{ GB}$ of free space.
- Files that have not been accessed for more than $30\text{ days}$ must be moved to the cloud.
- The administrator who registers `Server1` must be granted the minimum necessary permissions to perform the registration.
Which two configurations should you implement? (Select two.)

Select all that apply

Create a server endpoint for `D:\Marketing` with cloud tiering enabled, a volume free space policy of

30\%

, and a date policy of

30\text{ days}

Create a server endpoint for `D:\Marketing` with cloud tiering enabled, a volume free space policy of

70\%

, and a date policy of

30\text{ days}

Assign the Storage Sync Service Administrator role to the user account used to register `Server1`.

Assign the Storage Blob Data Contributor role to the user account used to register `Server1`.

Generate a Shared Access Signature (SAS) token for the storage account with a

30\text{ days}

validity period and configure it on `Server1`.

Show answer & explanation

Answer: Create a server endpoint for `D:\Marketing` with cloud tiering enabled, a volume free space policy of $30\%$ , and a date policy of $30\text{ days}$ .; Assign the Storage Sync Service Administrator role to the user account used to register `Server1`.

Answer

The correct configurations are to create a server endpoint for `D:\Marketing` with cloud tiering enabled, a volume free space policy of

30\%

, and a date policy of

30\text{ days}

, and to assign the Storage Sync Service Administrator role to the user account used to register `Server1`.

To maintain at least

300\text{ GB}

of free space on a

1000\text{ GB}

volume, the volume free space policy must be configured to

30\%

(since

\frac{300}{1000} \times 100 = 30\%

). Enabling cloud tiering with both the volume free space policy and the date policy of

30\text{ days}

ensures both file age and space criteria are enforced. Additionally, registering a server to a Storage Sync Service requires permissions on the sync service, for which the Storage Sync Service Administrator role provides the minimum required privileges.

Step-by-Step Solution

Calculate the volume free space percentage required for the volume free space policy.

The required percentage is

30\%

To maintain at least

300\text{ GB}

of free space on a

1000\text{ GB}

drive, the volume free space policy must be configured as

\frac{300}{1000} \times 100 = 30\%

Identify the minimum required RBAC role for the administrator to register the server with the Storage Sync Service.

The Storage Sync Service Administrator role.

This role provides the minimum necessary permissions to register a server without granting excessive control plane access like Contributor or Owner on the resource group.

Identify the correct configurations from the options based on the calculations and role requirements.

Select the option specifying a

30\%

volume free space policy and the option assigning the Storage Sync Service Administrator role.

These two selections satisfy all given constraints, including the date policy of

30\text{ days}

and minimum administrative permissions.

Key Concept

Configuring cloud tiering policies and server registration permissions for Azure File Sync.

Estimated Time:2m 0s

Question 290Question →

An administrator is configuring a standard General Purpose v2 (GPv2) storage account named `stlogs2026` in the East US region. The storage account currently uses locally-redundant storage (LRS). The administrator needs to configure replication to support read-access in a secondary region, and implement a lifecycle management policy that moves blobs to the Archive tier. Which of the following statements are correct regarding the configuration of these requirements? (Select TWO.)

Select all that apply

The replication configuration can be changed directly from LRS to Read-access geo-redundant storage (RA-GRS) without submitting a support request.

The lifecycle management rules can transition blobs to the Archive tier when the storage account replication is configured as RA-GRS.

Converting the storage account from LRS to RA-GRS requires submitting a support ticket to Microsoft to perform a manual live migration.

Modifying the lifecycle management policy requires the administrator to have the Storage Blob Data Contributor role at the storage account scope.

Show answer & explanation

Answer: The replication configuration can be changed directly from LRS to Read-access geo-redundant storage (RA-GRS) without submitting a support request.; The lifecycle management rules can transition blobs to the Archive tier when the storage account replication is configured as RA-GRS.

Answer

The replication configuration can be changed directly from LRS to Read-access geo-redundant storage (RA-GRS) without submitting a support request, and the lifecycle management rules can transition blobs to the Archive tier when the storage account replication is configured as RA-GRS.

The correct statements recognize that converting a standard GPv2 storage account from LRS to RA-GRS can be performed directly through the Azure portal or CLI without initiating a manual support ticket, and that lifecycle management rules can transition blobs to the Archive tier when the storage account replication is set to RA-GRS.

Step-by-Step Solution

Determine the supported replication conversion paths for a standard GPv2 storage account.

LRS can be converted directly to GRS or RA-GRS via the configuration blade in the portal or through command-line tools without downtime.

This verifies whether a support ticket is required for GRS/RA-GRS migration.

Verify if the Archive tier is supported on the target replication configuration.

The Archive tier is supported on standard GPv2 storage accounts configured with LRS, GRS, and RA-GRS.

This confirms that transitioning to the Archive tier remains valid after changing the replication to RA-GRS.

Identify the required RBAC roles for configuring lifecycle policies.

Lifecycle policies are control plane configurations requiring Microsoft.Storage/storageAccounts/managementPolicies/write permissions, which are included in the Storage Account Contributor role, not data-plane roles.

This determines if the Storage Blob Data Contributor role is appropriate for managing the policy.

Key Concept

Azure storage account replication conversion paths and control plane versus data plane access for lifecycle policies.

Question 291Question →

You are designing the deployment and storage configuration for four Azure Virtual Machines (VMs) to support different application workloads. Match each workload scenario to its correct VM storage or deployment configuration.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Match VM-DB1 to Ultra Disk configuration, VM-Web1 to Ephemeral OS disk, VM-App1 to Premium SSD with Write Accelerator, and VM-Dev1 to Generation

2

VM with Trusted Launch.

The correct matches align each workload requirement with the specific Azure VM compute and storage features: Ultra Disks for extreme, dynamically scaleable performance; Ephemeral OS disks for stateless, cost-optimized hosting; Write Accelerator on Premium SSDs for sub-millisecond write latency on M-series VMs; and Generation

2

with Trusted Launch for UEFI, Secure Boot, and vTPM security features.

Step-by-Step Solution

Analyze the requirements for VM-DB1.

The workload requires up to

80,000

IOPS and

1,200\text{ MB/s}

throughput with dynamic scaling without deallocation. This profile exceeds standard Premium SSD performance and fits Ultra Disk capabilities. Ultra Disks require enabling compatibility during VM creation.

Ultra Disk is the only disk type that supports both these throughput/IOPS levels on a single disk and dynamic throughput adjustment without VM deallocation.

Analyze the requirements for VM-Web1.

The workload is stateless, needs fast boot times, and requires zero storage costs for the OS disk. This points to Ephemeral OS disks.

Ephemeral OS disks use local SSD storage (cache or temp disk) inside the host, avoiding remote Azure Storage costs and offering faster boot and reset speeds.

Analyze the requirements for VM-App1.

The VM is Standard_M16s (M-series) and requires sub-millisecond database log write latency. This fits Write Accelerator on Premium SSD.

Write Accelerator is specifically designed for write-intensive database logs on M-series VMs using Premium SSDs, and it requires Host Caching to be set to None.

Analyze the requirements for VM-Dev1.

The VM needs nested virtualization (Hyper-V containers), UEFI, Secure Boot, and vTPM. This requires a Generation

2

VM with Trusted Launch.

Trusted Launch provides the foundation for Secure Boot and vTPM, which are prerequisites for configuring advanced security and Hyper-V guest environments on Gen

2

VMs.

Key Concept

Selecting the correct Azure Virtual Machine configuration, disk types, and deployment options based on workload performance, cost, and security requirements.

Question 292Question →

A company hosts a web application on an Azure Virtual Machine Scale Set (VMSS) named `vmss-web`. The scale set is configured with Uniform orchestration mode, has a current instance count of $3$ , and uses a Manual upgrade policy. You configure an autoscale setting with the following rules:

* A scale-out rule that increases the instance count by $3$ when the average CPU percentage is greater than $80\%$ for $10$ minutes.
* A scale-in rule that decreases the instance count by $3$ when the average CPU percentage is less than $50\%$ for $10$ minutes.

During a peak load event, the scale set scales out to $6$ instances. However, immediately after the scale-out completes, the average CPU percentage drops to $45\%$ , which triggers a scale-in back to $3$ instances. This loop of scaling out and scaling in continues repeatedly. You need to prevent this thrashing behavior.

What configuration change should you implement?

Change the VMSS upgrade policy from Manual to Automatic.

Change the orchestration mode of the VMSS from Uniform to Flexible.

Decrease the scale-in CPU threshold to

35\%

Increase the scale-out CPU threshold to

95\%

Show answer & explanation

Answer: Decrease the scale-in CPU threshold to $35\%$ .

Answer

Decrease the scale-in CPU threshold to

35\%

Decreasing the scale-in threshold to

35\%

prevents the scale-in rule from triggering immediately after a scale-out. When the scale set expands from

3

6

instances, the average CPU load is divided by two, dropping from

80\%

40\%

. Because

40\%

is greater than the new

35\%

threshold, the instances remain running and thrashing is avoided.

Step-by-Step Solution

Calculate the total CPU load baseline prior to scaling.

The total CPU capacity utilized just before scale-out is approximately

3 \times 80\% = 240\%

This establishes the total amount of computational work being performed by the instances.

Calculate the post-scale-out CPU load distribution.

When

3

instances are added, the scale set size increases to

6

instances. The average CPU per instance becomes

240\% / 6 = 40\%

This identifies the average load per virtual machine after the additional capacity is provisioned.

Compare the new load against the scale-in threshold.

The post-scale-out average CPU of

40\%

is lower than the current scale-in threshold of

50\%

, triggering an immediate scale-in.

This shows why the scale-in rule is immediately satisfied, resulting in instance thrashing.

Identify the threshold adjustment to prevent the loop.

Setting the scale-in CPU threshold to

35\%

(which is below the post-scale-out load of

40\%

) stops the scale-in rule from triggering.

This maintains the scale set at

6

instances during the high-load period without falling into a loop.

Key Concept

Autoscale Thrashing Mitigation in VMSS

Question 293Question →

An administrator needs to configure a new Microsoft Entra ID group to automatically manage access. The group must dynamically include all users belonging to the Marketing department who are also using corporate-owned Windows 11 devices. Which of the following statements correctly describes a configuration requirement or limitation for this group?

The dynamic membership rule query must use syntax that combines both attributes, such as (user.department -eq 'Marketing') and (device.deviceOSVersion -startsWith '10.0').

To configure and save the dynamic rule, the administrator must be assigned the User Access Administrator Azure RBAC role at the resource group scope.

You must create two separate dynamic groups—one for users and one for devices—because a single dynamic group cannot evaluate both user and device attributes.

You must first place both the users and the devices in the same Administrative Unit to allow cross-attribute evaluation of users and devices.

Show answer & explanation

Answer: You must create two separate dynamic groups—one for users and one for devices—because a single dynamic group cannot evaluate both user and device attributes.

Answer

You must create two separate dynamic groups—one for users and one for devices—because a single dynamic group cannot evaluate both user and device attributes.

The correct option states that you must create two separate dynamic groups. In Microsoft Entra ID, dynamic groups are strictly typed as either Dynamic User or Dynamic Device. The membership rule engine does not support referencing both user and device attributes in the same query. To achieve the goal, separate groups for users and devices must be created.

Step-by-Step Solution

Analyze the requirements for the group membership.

The requirement is to dynamically group users based on their department (a user attribute) and their device operating system (a device attribute).

Identifying the target attributes allows the administrator to determine if they belong to the same object type.

Evaluate Microsoft Entra ID dynamic group capabilities and constraints.

Microsoft Entra ID dynamic group membership rules only support querying properties of a single object type (either users or devices) per group.

This determines whether a single query can fulfill the requirement or if separate groups are necessary.

Select the correct administrative approach based on the constraint.

Create separate dynamic groups for users and devices, or use alternative mechanisms like conditional access or endpoint management to enforce policies.

Since a single dynamic group cannot mix user and device attributes, separating them is the required workaround.

Key Concept

Microsoft Entra ID dynamic group membership rules must evaluate either user attributes or device attributes, but not both in a single query.

Estimated Time:1m 30s

Question 294Question →

You need to upload a local file to an Azure Blob storage container using AzCopy. You plan to use Microsoft Entra ID authentication instead of a Shared Access Signature (SAS) token. Arrange the steps in the correct sequence to perform this upload.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first assign the Storage Blob Data Contributor role, then log in using the `azcopy login` command, and finally execute the transfer using the `azcopy copy` command.

To perform a file upload using AzCopy with Microsoft Entra ID authentication, you must first ensure your user account has the required data plane permissions (such as Storage Blob Data Contributor). Then, you must authenticate the tool session by running `azcopy login`. Once logged in, you can run `azcopy copy` to copy the file to the destination URL.

Step-by-Step Solution

Assign the Storage Blob Data Contributor role to the administrator's user account.

The administrator's identity is authorized to perform data plane operations on the blob container.

Microsoft Entra ID authentication requires specific data plane RBAC roles. Management-plane roles like Owner or Contributor do not grant data plane access by default.

Run `azcopy login` and authenticate.

An active authenticated command-line session is established.

Before performing any commands that rely on Microsoft Entra ID authentication, the AzCopy tool must be logged in using your identity.

Run `azcopy copy` with the source and destination paths.

The local file is successfully uploaded to the destination blob container.

The copy command runs under the context of the logged-in identity to write the file to the container.

Key Concept

Microsoft Entra ID Authentication Sequence for AzCopy

Question 295Question →

Beacon Logistics is planning the infrastructure for a fleet monitoring system in the Canada Central region. The deployment includes two web servers: VM-Web1 and VM-Web2.

To meet the business requirements, the deployment must:
- Protect the web servers against datacenter-wide power or cooling outages.
- Provide a $99.99\%$ service level agreement (SLA) for the virtual machines.
- Load balance incoming traffic across VM-Web1 and VM-Web2.

Which of the following configuration options should you select to meet these requirements? Select two.

Select all that apply

Deploy VM-Web1 and VM-Web2 in separate Availability Zones in the Canada Central region.

Deploy VM-Web1 and VM-Web2 in a single Availability Set that spans multiple Availability Zones.

Deploy a Standard Load Balancer to distribute traffic to the virtual machines.

Deploy a Basic Load Balancer to distribute traffic to the virtual machines.

Show answer & explanation

Answer: Deploy VM-Web1 and VM-Web2 in separate Availability Zones in the Canada Central region.; Deploy a Standard Load Balancer to distribute traffic to the virtual machines.

Answer

Deploying the virtual machines in separate Availability Zones and using a Standard Load Balancer to distribute traffic.

To protect against datacenter-wide outages and achieve a

99.99\%

SLA, virtual machines must be distributed across separate Availability Zones in the region. Since the virtual machines will reside in different Availability Zones, a Standard Load Balancer must be used because it is zone-redundant and supports backend pools containing virtual machines from different zones.

Step-by-Step Solution

Determine the high availability boundary required to protect against datacenter-wide failures.

Availability Zones must be used instead of Availability Sets because Availability Zones are physically separate datacenters within an Azure region, whereas Availability Sets only protect against hardware failures within a single datacenter.

The scenario requires protection against datacenter-wide power or cooling outages.

Select the correct VM placement strategy to meet the

99.99\%

SLA requirement.

VMs must be deployed in separate Availability Zones to qualify for the

99.99\%

SLA.

Azure offers a

99.99\%

SLA for VMs when two or more instances are deployed across two or more Availability Zones in the same region, compared to

99.95\%

for Availability Sets.

Choose the appropriate Load Balancer SKU to route traffic across the Availability Zones.

A Standard Load Balancer must be deployed.

Only the Standard SKU Load Balancer is zone-redundant and can load balance traffic across VMs located in different Availability Zones.

Key Concept

High availability design for virtual machines using Availability Zones and Standard Load Balancers to meet SLA and fault tolerance requirements.

Question 296Question →

A web application runs on an Azure Virtual Machine Scale Set named `ecom-vmss`. You configure autoscale rules where scale-out occurs when CPU usage exceeds $75\%$ and scale-in occurs when CPU usage falls below $70\%$ . During periods of normal operation, the scale set repeatedly adds and removes instances in rapid succession. You need to resolve this issue. What should you do?

Decrease the scale-in metric threshold to a lower value, such as

40\%

Change the upgrade policy of the scale set from Automatic to Manual.

Change the orchestration mode of the scale set to Flexible.

Configure the scale-in policy to DeleteNewest.

Show answer & explanation

Answer: Decrease the scale-in metric threshold to a lower value, such as $40\%$ .

Answer

Decrease the scale-in metric threshold to a lower value, such as

40\%

Decreasing the scale-in metric threshold (for example, to

40\%

) creates a wider gap between the scale-out threshold (

75\%

) and the scale-in threshold. This buffer prevents the scale set from immediately deleting newly created instances when the average CPU load decreases post-scaling, thereby stopping the thrashing cycle.

Step-by-Step Solution

Analyze the symptoms of the scale set repeatedly adding and removing instances (thrashing).

Identify that the scale-out threshold (

75\%

) and scale-in threshold (

70\%

) are too close to each other.

When a new VM instance is added to the scale set, the average CPU load drops. Because the scale-in threshold is set to

70\%

, this drop immediately triggers the scale-in rule, leading to a loop of constant scaling.

Determine the resolution for autoscale thrashing.

Increase the gap between scale-out and scale-in thresholds by decreasing the scale-in metric threshold.

Setting the scale-in threshold to a lower value (like

40\%

) provides a sufficient buffer, ensuring that instances are only terminated when workload demand has significantly decreased.

Key Concept

Autoscale thresholds and thrashing prevention

Estimated Time:1m 0s

Question 297Question →

An enterprise establishes the following Azure resource hierarchy:
* A management group named `Enterprise-MG`
* A subscription named `Sub-Finance-01` under `Enterprise-MG`
* Two resource groups under `Sub-Finance-01` named `RG-Secured` and `RG-General`

The following Azure Policy assignments are active:
* Policy Assignment 1: Assigned at `Enterprise-MG`. It uses a policy definition that denies the creation of virtual machines unless they use the `Standard_E2s_v3` SKU. The resource group `RG-Secured` is configured as an exclusion.
* Policy Assignment 2: Assigned at `Sub-Finance-01`. It uses a policy definition that denies the creation of resources unless they have a tag named `CostCenter`. The resource group `RG-General` is configured as an exclusion.

An administrator attempts to perform the following virtual machine deployments:
* Deployment 1: A `Standard_D2s_v3` virtual machine with the tag `CostCenter: 101` in `RG-General`
* Deployment 2: A `Standard_E2s_v3` virtual machine without the `CostCenter` tag in `RG-Secured`
* Deployment 3: A `Standard_D2s_v3` virtual machine without the `CostCenter` tag in `RG-General`
* Deployment 4: A `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured`

Which of the virtual machine deployments will succeed?

The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured`

The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 101` in `RG-General`

The deployment of the `Standard_E2s_v3` virtual machine without the `CostCenter` tag in `RG-Secured`

The deployment of the `Standard_D2s_v3` virtual machine without the `CostCenter` tag in `RG-General`

Show answer & explanation

Answer: The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured`

Answer

The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured` is the only deployment that will succeed.

The deployment of the `Standard_D2s_v3` virtual machine with the tag `CostCenter: 102` in `RG-Secured` succeeds because `RG-Secured` is explicitly excluded from the SKU restriction policy (Policy Assignment 1) assigned at the management group level, allowing the `Standard_D2s_v3` SKU. Furthermore, while the tag requirement policy (Policy Assignment 2) applies to `RG-Secured`, this deployment successfully provides the required `CostCenter` tag, satisfying both evaluation contexts.

Step-by-Step Solution

Evaluate the impact of Policy Assignment 1 (SKU restriction) on all deployments.

Policy Assignment 1 is assigned at `Enterprise-MG` (the root of this hierarchy) and applies to all child scopes except for the configured exclusion: `RG-Secured`. Therefore, virtual machines deployed in `RG-General` must use the `Standard_E2s_v3` SKU. Deployments 1 and 3 are blocked because they attempt to deploy a `Standard_D2s_v3` SKU in `RG-General`. Deployments 2 and 4 are in `RG-Secured` (excluded from this policy) and are not blocked by Policy Assignment 1.

Identify which deployments are prevented by the inherited SKU restriction policy.

Evaluate the impact of Policy Assignment 2 (Tag requirement) on the remaining deployments.

Policy Assignment 2 is assigned at `Sub-Finance-01` and applies to all resource groups under the subscription except for the configured exclusion: `RG-General`. Therefore, resources deployed in `RG-Secured` must include the `CostCenter` tag. Deployment 2 fails because it is in `RG-Secured` and does not include the tag. Deployment 4 includes the tag `CostCenter: 102` and complies with the policy.

Identify which deployments are prevented by the tag requirement policy.

Determine the final compliance outcome for all deployment attempts.

Only Deployment 4 matches all requirements: it is excluded from Policy Assignment 1 (allowing the `Standard_D2s_v3` SKU) and complies with Policy Assignment 2 (having the required `CostCenter` tag).

Synthesize evaluations of both policy assignments and exclusions to identify the successful deployment.

Key Concept

Evaluation of nested Azure Policies, scopes, and exclusions

Estimated Time:2m 0s

Question 298Question →

An administrator needs to configure a Shared Access Signature (SAS) to grant a developer temporary access to upload logs to an Azure storage account. The configuration must follow the principle of least privilege and enforce security best practices. Which two settings should the administrator configure directly on the SAS token to minimize security risks?

Select all that apply

An expiration time set to a short duration, such as 2 hours

A restricted IP address or IP range from which the developer is allowed to connect

An expiration time set to 365 days to ensure uninterrupted access for the developer

The Storage Blob Data Contributor role assigned directly to the SAS token

The 'Allow trusted Microsoft services' exception setting

Show answer & explanation

Answer: An expiration time set to a short duration, such as 2 hours; A restricted IP address or IP range from which the developer is allowed to connect

Answer

The correct options are configuring an expiration time set to a short duration, such as 2 hours, and a restricted IP address or IP range from which the developer is allowed to connect.

Enforcing a short validity window (such as 2 hours) and limiting access to a specific public IP range are standard security configurations directly supported in the Shared Access Signature parameters. These restrict both the temporal and network bounds of the delegation.

Step-by-Step Solution

Determine how to limit the validity duration of the temporary access token.

Define a short expiration window (e.g., 2 hours) to minimize the risk window if the token is leaked.

Security best practices dictate that temporary access signatures must have a short, defined lifespan to prevent persistent unauthorized access.

Determine how to enforce network-level restrictions on the token request origin.

Specify the client IP address or CIDR range in the SAS parameters.

Restricting allowed IP addresses prevents the token from being used from unauthorized networks even if it is intercepted.

Key Concept

Applying the principle of least privilege to Shared Access Signatures (SAS) by restricting duration and network origin.

Question 299Question →

An administrator is configuring network access for an Azure Storage account named safinanceprod.

The storage account's firewall is configured to restrict access to selected virtual networks. The administrator adds a virtual network named vnetprod and its subnet named subnetapps to the allowed networks list of the storage account.

However, virtual machines in subnetapps are still blocked when attempting to access the storage account.

Which configuration change must be applied to subnetapps to allow the virtual machines to access the storage account?

Enable the Microsoft.Storage service endpoint on the subnet.

Assign the Storage Blob Data Reader RBAC role to the virtual machines' managed identities.

Enable the 'Allow trusted Microsoft services to access this storage account' setting on the storage account.

Add a high-priority outbound Network Security Group rule allowing traffic to the Storage service tag.

Show answer & explanation

Answer: Enable the Microsoft.Storage service endpoint on the subnet.

Answer

Enable the Microsoft.Storage service endpoint on the subnet.

The correct action is to enable the Microsoft.Storage service endpoint on the subnet. When a storage account firewall is configured to restrict access to selected virtual networks, it will only accept traffic from subnets that have been explicitly added to its configuration. However, for the storage account to recognize that the traffic is coming from the allowed subnet, the subnet itself must have the service endpoint enabled. This endpoint ensures that traffic is routed over the Azure backbone network and carries the virtual network identity.

Step-by-Step Solution

Analyze the network configuration of the storage account.

The storage account firewall is configured to restrict access to selected virtual networks, and the target subnet is added to the allowed list.

This establishes that the storage account is ready to receive traffic from the subnet, provided the traffic carries the virtual network identity.

Identify why the virtual machines' traffic is being blocked.

By default, traffic from subnets to public endpoints of Azure services uses public IP routing, meaning the storage account sees the public IP instead of the virtual network identity.

Understanding the routing behavior explains why simply adding the subnet to the storage firewall is not enough.

Select the configuration that exposes the subnet's identity to the storage account.

Enabling the Microsoft.Storage service endpoint on the subnet routes traffic through the Azure backbone and adds the subnet's network identity to the request headers.

This satisfies the firewall rule on the storage account, allowing traffic to flow securely.

Key Concept

Azure Virtual Network service endpoints extend your virtual network private address space and the identity of your VNet to Azure service endpoints over a direct connection.

Estimated Time:1m 30s

Question 300Question →

You are creating a new Azure virtual machine (VM). You need to configure the VM's infrastructure options to protect the hosted application from datacenter-wide power, cooling, or network failures within an Azure region. Which availability option should you select during the VM creation process?

Availability Sets

Availability Zones

A Recovery Services Vault in a different region

A Basic Load Balancer backend pool

Show answer & explanation

Answer: Availability Zones

Answer

Availability Zones

Selecting Availability Zones ensures that the virtual machine is deployed in physically separate datacenters within an Azure region. Each zone has independent power, cooling, and networking, protecting the application from datacenter-wide failures.

Step-by-Step Solution

Analyze the requirement for VM infrastructure redundancy.

The requirement specifies protection against datacenter-wide failures within an Azure region.

Datacenter-wide failures require physical isolation between the nodes within the region.

Evaluate the capability of Availability Zones.

Availability Zones place VMs in physically separate datacenters (each with independent power, cooling, and network) within the same region.

This aligns exactly with the requirement for protection against datacenter-wide failures.

Identify why alternative options like Availability Sets are insufficient.

Availability Sets distribute VMs across fault and update domains within a single datacenter, failing to protect against datacenter-wide outages.

Ensures the correct infrastructure option is selected.

Key Concept

Availability Zones provide infrastructure redundancy and high availability within a region by placing VMs in physically separate datacenters.

Estimated Time:1m 0s

PreviousPage 15 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept