Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 301Question →

You have an Azure Storage account named storage1. You need to grant a user named User1 the ability to read blob data within the containers of storage1 by using Microsoft Entra ID authentication. Your solution must follow the principle of least privilege. Which Azure role-based access control (RBAC) role should you assign to User1?

Show answer & explanation

Answer: Storage Blob Data Reader

Answer

Storage Blob Data Reader
To read blob data using Microsoft Entra ID authentication, a user must be assigned a data-plane RBAC role. The Storage Blob Data Reader role provides read access to blob data and containers, satisfying the requirements while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the data access requirements
User1 requires read-only access specifically to blob data within the storage account containers.
Determining the scope of access helps select the appropriate data-plane role.
2
Select the correct role based on the principle of least privilege
The Storage Blob Data Reader role is selected because it provides read-only access to blob data without granting control plane management capabilities.
Assigning the most restrictive built-in role that satisfies the requirement complies with security best practices.

Key Concept

Azure RBAC roles for storage data plane access
Estimated Time:45s
Question 302Question →

Your company uses an Azure Virtual Machine Scale Set (VMSS) named vmss-web to host a web application. You need to configure a custom autoscale policy to scale out the VMSS when CPU usage exceeds 7575 percent. In what sequence must you perform these actions in the Azure Portal?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, navigate to the Scaling settings of the Virtual Machine Scale Set. Second, enable Custom autoscale. Third, add the rule specifying the CPU threshold and scale-out behavior. Finally, save the settings.
To set up a custom autoscale policy, you must first browse to the scaling options of the target VMSS. Since VMSS defaults to manual scale, you must switch the configuration to Custom autoscale. Once enabled, you configure the specific CPU metric rule and then save the changes to commit them to the resource.

Step-by-Step Solution

1
Open the Virtual Machine Scale Set scaling section
Displays scaling configuration options
Allows you to modify the scaling policy from default manual configuration
2
Enable Custom autoscale
Unlocks the ability to add scale rules
By default, scale sets are set to manual scale and do not support metric-based triggers without enabling custom autoscale
3
Configure the scale-out rule based on CPU metric
Creates the trigger definition
Associates the 7575 percent threshold with the scale-out action
4
Save the configuration
Applies the autoscale setting to the VMSS
The rules will not execute until saved and provisioned by the Azure Resource Manager

Key Concept

Configuring metric-based custom autoscale rules on an Azure Virtual Machine Scale Set
Estimated Time:1m 0s
Question 303Question →

Your organization has an Azure subscription containing a single resource group named RG1. You need to assign the appropriate built-in Azure Role-Based Access Control (RBAC) roles to three administrative users to meet their specific requirements while adhering to the principle of least privilege. Match each user requirement on the left to the correct built-in Azure RBAC role on the right.

Click a left item, then click its matching right item

Items

Delegate access permissions to other users for all resources within RG1.
Create and manage virtual machines, including restarting them and attaching disks, without managing network settings or assigning permissions.
View the configuration and status of all resources in RG1 without making any modifications.

Matches

Show answer & explanation

Answer

Match the requirement to delegate access permissions to the Owner role; match the requirement to create and manage virtual machines without network or permission privileges to the Virtual Machine Contributor role; and match the requirement to view resource configurations without making modifications to the Reader role.
Matching the requirements to Owner, Virtual Machine Contributor, and Reader aligns with Azure RBAC roles designed for authorization delegation, VM-specific management, and read-only access respectively.

Step-by-Step Solution

1
Analyze the requirement to delegate permissions.
Delegating permissions requires the Microsoft.Authorization/roleAssignments/write permission. This action is allowed by the Owner role but not by the Contributor role.
We must find a built-in role that allows modifying role assignments.
2
Analyze the requirement to manage virtual machines but not network settings or permissions.
The Virtual Machine Contributor role allows managing virtual machines and their disks without granting permissions on network resources or access management.
We need to identify the built-in role designed for virtual machine administration.
3
Analyze the requirement to view resource configurations without making modifications.
The Reader role provides read-only access to resources without permitting write or delete actions.
We need to find the built-in role that grants read-only access.

Key Concept

Azure Built-in Roles and Least Privilege
Question 304Question →

You are planning to deploy a new Azure virtual machine named VM1 to host a database workload. The database requires extremely high I/O throughput and sub-millisecond latency. You decide to use Ultra Disk storage for the database data. Which two settings must you configure during the creation of VM1 to support the attachment of Ultra Disks? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable Ultra Disk compatibility in the disk configuration.; Deploy the virtual machine in a specific Availability Zone.

Answer

To support Ultra Disks, you must deploy the virtual machine in a specific Availability Zone and enable Ultra Disk compatibility in the disk configuration.
To successfully deploy an Azure virtual machine with Ultra Disks, you must configure two key settings during creation. First, you must enable Ultra Disk compatibility in the virtual machine disk configuration settings. Second, because Ultra Disks are zonal resources, the virtual machine must be deployed in a specific Availability Zone.

Step-by-Step Solution

1
Determine the availability options for the virtual machine.
Identify that Ultra Disks require the virtual machine to be deployed in an Availability Zone.
Ultra Disks are zonal resources and do not support Availability Sets.
2
Configure the disk capabilities for the virtual machine.
Enable the 'Ultra Disk compatibility' setting under the Advanced disk configuration.
Ultra Disks cannot be attached to a virtual machine unless compatibility is explicitly enabled during virtual machine creation.
3
Select the correct disk type for the operating system (OS) disk.
Ensure the OS disk uses Standard HDD, Standard SSD, or Premium SSD.
Operating system (OS) disks do not support the Ultra Disk type.

Key Concept

Configuring virtual machine storage and availability settings during creation to support Ultra Disks.
Question 305Question →

An organization wants to delegate management of Self-Service Password Reset (SSPR) and external collaboration configurations to different administrators using the principle of least privilege.

Which minimum administrative roles must be assigned to perform each of the specified directory and external identity configuration scenarios?

Click a left item, then click its matching right item

Items

Configure federation with Google or Facebook as external identity providers for B2B collaboration.
Invite external guest users to the tenant when guest invitations are restricted to administrative roles in external collaboration settings.
Configure tenant-wide Self-Service Password Reset (SSPR) authentication methods and registration policies.
Reset the password of a user who is assigned the Helpdesk Administrator role.

Matches

Show answer & explanation

Answer

Configure federation with Google or Facebook maps to External Identity Provider Administrator; Invite external guest users maps to Guest Inviter; Configure tenant-wide SSPR settings maps to Authentication Policy Administrator; Reset the password of a Helpdesk Administrator maps to User Administrator.
The correct matches pair each directory administration task with its minimum required role based on the principle of least privilege. External Identity Provider Administrator manages federation, Guest Inviter permits B2B invitations under restrictions, Authentication Policy Administrator manages SSPR methods, and User Administrator handles password resets for Helpdesk Administrators.

Step-by-Step Solution

1
Analyze the role required for external identity provider federation.
Configuring Google or Facebook federation requires managing identity providers, which corresponds to the External Identity Provider Administrator role.
This role is dedicated to setting up external federation options for B2B collaboration without requiring broader Global Administrator privileges.
2
Determine the minimum role required for B2B guest invitations under restricted settings.
Inviting B2B guest users when restrictions are in place maps to the Guest Inviter role.
The Guest Inviter role is specifically scoped to bypass guest invitation restrictions for standard users without granting general directory management capabilities.
3
Identify the minimum administrative role that can modify global SSPR settings.
Managing tenant-wide SSPR authentication methods and policies maps to the Authentication Policy Administrator role.
The Authentication Policy Administrator is the least-privileged directory role that can manage authentication policies, registration policies, and security questions.
4
Determine which role can reset the password of a Helpdesk Administrator.
Resetting the password of a Helpdesk Administrator requires the User Administrator role.
Helpdesk Administrators can only reset passwords for non-administrative users. User Administrators can reset passwords for non-administrators and specific administrative roles including Helpdesk Administrator, but cannot reset passwords for high-privileged roles like Global Administrator.

Key Concept

Delegating administrative permissions using least privilege for Microsoft Entra ID Self-Service Password Reset (SSPR) and external collaboration settings.
Question 306Question →

Your organization manages its Azure resources using a hierarchy that contains the Enterprise-MG management group, the Finance-Sub subscription, the Logs-RG resource group, and a storage account named financelogs2026.

An auditor named Jordan needs to view blob data stored in the containers of the financelogs2026 storage account to verify compliance. Jordan must not be able to modify the storage account configuration or view data in other storage accounts within the subscription.

Which role assignment meets this requirement while adhering to the principle of least privilege?

Show answer & explanation

Answer: Assign the Storage Blob Data Reader role at the scope of the financelogs2026 storage account

Answer

Assign the Storage Blob Data Reader role at the scope of the financelogs2026 storage account
Assigning the Storage Blob Data Reader role at the scope of the financelogs2026 storage account satisfies the requirement. It provides data-plane access to read container blobs for the specific storage account, while restricting the user from making modifications or accessing other storage accounts, thus adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the type of access required.
The requirement is to read blob data (data plane), not just manage the storage resource (control plane).
This determines whether a standard control-plane role (like Reader) or a data-plane role (like Storage Blob Data Reader) is needed.
2
Apply the principle of least privilege by targeting the correct scope.
The user only needs access to the financelogs2026 storage account, not the entire resource group or subscription.
Assigning the role at the storage account level prevents access to other storage accounts in the resource group or subscription.
3
Select the correct role type.
The Storage Blob Data Reader role grants the required data-plane read permissions, whereas Microsoft Entra ID roles do not apply to subscription resources.
This satisfies the technical requirement while keeping access restricted to the minimum permissions needed.

Key Concept

Azure RBAC roles separate control-plane and data-plane access, and should be assigned at the narrowest scope possible to enforce least privilege.
Question 307Question →

An administrator is managing an Azure Virtual Machine Scale Set (VMSS) named `vmss-app` that uses Uniform orchestration, has a current instance count of 5, and uses a Manual upgrade policy. The administrator needs to deploy a custom shell script that configures a web server on all current and future VM instances in the scale set.

Which sequence of actions should the administrator perform to ensure that the configuration is registered in the scale set model and applied to all active instances? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, upload the script to the Azure Storage blob container. Second, generate a SAS token for the script blob. Third, add the Custom Script Extension to the VMSS model referencing the blob URI and SAS token. Fourth, manually trigger an upgrade on the existing VMSS instances to apply the updated model.
The correct sequence begins with uploading the script and generating a SAS token, as the VMSS model configuration requires a valid URI and credentials to be defined. Once the model is updated, the manual upgrade must be triggered last so that the instances pull the newly modified model rather than the old one.

Step-by-Step Solution

1
Upload the script file to a container in an Azure Storage account.
The configuration script is stored securely in Azure, ready to be retrieved.
The Custom Script Extension requires a URI to download the configuration script during execution.
2
Generate a Shared Access Signature (SAS) token for the script blob.
A secure access token is created for the blob.
The VMSS instances need read-only access to download the script without making the storage container public.
3
Add the Custom Script Extension to the VMSS configuration model.
The VMSS model is updated with the extension configuration, ensuring future instances will apply it automatically.
Modifying the scale set model registers the extension but does not automatically push it to currently running instances when using Manual upgrade mode.
4
Select the existing VM instances in the scale set and trigger a manual upgrade.
The 5 existing instances pull the updated VMSS model and execute the Custom Script Extension.
Under a Manual upgrade policy, existing instances must be explicitly upgraded to adopt the latest VMSS model.

Key Concept

Applying configuration changes to existing and future instances of a Virtual Machine Scale Set (VMSS) with a Manual upgrade policy.
Question 308Question →

You are configuring Azure File Sync to synchronize an on-premises folder named E:\Data on a Windows Server named Server1 with an Azure file share named share1. The storage account hosting share1 has its firewall configured to restrict access to selected virtual networks and IP addresses. Server1 accesses the internet through a public IP address that is not allowed in the storage account firewall settings. You need to ensure that Server1 can synchronize files with share1 and that cloud tiering is enabled to maintain at least 30% free space on volume E. Which two configurations are required to achieve this goal? (Select two.)

Select all that apply

Show answer & explanation

Answer: Add the public IP address of Server1 to the firewall settings of the storage account.; Create a sync group in the Storage Sync Service containing a cloud endpoint for share1 and a server endpoint for E:\Data with cloud tiering enabled and volume free space set to 30%.

Answer

To configure sync and satisfy the network and space requirements, you must add the public IP address of Server1 to the storage account firewall settings, and create a sync group containing a cloud endpoint for share1 and a server endpoint for E:\Data with cloud tiering enabled and volume free space set to 30%.
Synchronizing files requires that the on-premises server has direct network connectivity to the storage account endpoints. Since a firewall is active, adding the server's public IP address to the allowed list permits the agent to communicate. Additionally, configuring the sync group with a cloud endpoint and server endpoint establishes the replication relationship, and setting the cloud tiering volume free space policy to 30% ensures that the server actively tiers files to maintain the required free space on volume E.

Step-by-Step Solution

1
Configure storage account networking
The public IP address of Server1 is added to the allowed IP ranges under the storage account's Networking settings.
This allows the Azure File Sync agent on Server1 to directly establish HTTPS connections to the Azure File Share endpoints, bypassing the default block rule.
2
Define the sync topology
A sync group is created with a cloud endpoint mapping to share1.
A sync group defines the synchronization topology for a set of files.
3
Add and configure the server endpoint
The path E:\Data is added as a server endpoint inside the sync group, with cloud tiering set to 30% volume free space.
This establishes the local folder as a endpoint for sync and tells the agent to tier cold files to the cloud when free space on volume E falls below 30%.

Key Concept

Azure File Sync configuration, including storage account firewall bypass limitations, sync groups, endpoints, and cloud tiering volume free space policies.
Question 309Question →

An organization has an Azure resource hierarchy with a subscription named sub-billing-data that contains a resource group named rg-invoice-processing. You need to configure access control to meet the following requirements:

* User1 must be able to view all resource configurations and view all role assignments within the sub-billing-data subscription, but must not be able to make any changes.
* User2 must be able to assign Azure roles to other users at the rg-invoice-processing resource group scope, but must not have access to other resource groups. User2 is currently a Microsoft Entra ID Global Administrator and has no Azure RBAC assignments.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Reader role to User1 at the sub-billing-data subscription scope.; Assign the User Access Administrator role to User2 at the rg-invoice-processing resource group scope.

Answer

Assign the Reader role to User1 at the subscription scope, and assign the User Access Administrator role to User2 at the resource group scope.
The Reader role assigned at the subscription scope provides User1 with the necessary read-only permissions for all resources and role assignments. The User Access Administrator role assigned at the resource group scope enables User2 to manage access control strictly within that resource group, satisfying the principle of least privilege and scope containment.

Step-by-Step Solution

1
Determine the role and scope required for User1.
User1 needs read-only access to resources and access control settings across the entire subscription. The Reader role assigned at the subscription scope provides this capability.
The Reader role is a built-in role that allows viewing all resources and role assignments but does not grant permission to make changes.
2
Determine the role and scope required for User2.
User2 needs to manage access control at a specific resource group. The User Access Administrator role assigned at the resource group scope meets this requirement.
The User Access Administrator role allows managing role assignments but restricts access to the specified scope (the resource group), preventing broader subscription-level access.
3
Evaluate why User2's existing Global Administrator role is insufficient.
Microsoft Entra ID directory roles like Global Administrator do not automatically grant permissions to manage Azure resources.
Azure Resource Manager (RBAC) and Microsoft Entra ID use separate authorization systems, so explicit resource-level roles must be assigned.

Key Concept

Azure Role Assignments and Scopes
Question 310Question →

An organization has an Azure environment structured with a Management Group named Corp-MG, a Subscription named Sub-Prod, and a Resource Group named RG-Core. You assign various Azure Policy definitions at these scopes. You need to match the policy effect configured for a Virtual Machine deployment to its corresponding operational behavior when an administrator attempts to deploy a new Virtual Machine resource named VM-App-01 into RG-Core.

Match each Azure Policy effect on the left to its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

Modify
DeployIfNotExists
Deny
AuditIfNotExists

Matches

Show answer & explanation

Answer

Modify matches the behavior of altering properties or tags before the request reaches the resource provider and requiring a managed identity. DeployIfNotExists matches triggering a template deployment after successful creation and requiring a managed identity. Deny matches preventing the deployment request from reaching the resource provider if non-compliant. AuditIfNotExists matches checking if a dependency exists and marking the resource non-compliant without blocking if it is missing.
The matching correctly pairs each Azure Policy effect with its precise execution phase, behavior, and managed identity requirements: Modify alters resource tags or properties before creation/update; DeployIfNotExists deploys a resource template after a successful deployment; Deny blocks non-compliant deployment requests pre-evaluation; AuditIfNotExists audits dependent resources post-evaluation without blocking.

Step-by-Step Solution

1
Analyze the execution timing of each policy effect.
Modify and Deny run before the resource provider is called. DeployIfNotExists and AuditIfNotExists run after the resource provider successfully processes the request.
Understanding execution phases distinguishes between pre-deployment enforcement (blocking or altering requests) and post-deployment auditing or remediation.
2
Evaluate the requirement for managed identities.
Effects that perform write operations (Modify and DeployIfNotExists) require a managed identity to remediate existing resources or deploy new ones.
Remediation tasks require Azure Role-Based Access Control (RBAC) permissions, which are granted to the policy assignment's managed identity.
3
Differentiate between conditional checks (AuditIfNotExists vs DeployIfNotExists) and enforcement checks (Deny vs Modify).
Deny blocks the request. Modify alters the request. AuditIfNotExists only logs compliance status. DeployIfNotExists deploys missing templates.
This matches each specific policy effect to its corresponding scenario behavior for VM-App-01 in RG-Core.

Key Concept

Azure Policy effects determine how compliance is evaluated and enforced during resource creation or update.
Estimated Time:2m 0s
Question 311Question →

You host a web application in an Azure App Service web app. During peak hours, the web application experiences high traffic, causing the CPU utilization of the hosting App Service plan to reach 90%. You need to configure the App Service plan to automatically add more virtual machine instances to distribute the load. Which scaling action should you configure?

Show answer & explanation

Answer: Scale out

Answer

Scale out
Scaling out is a horizontal scaling action that adds more virtual machine instances to the App Service plan, allowing the web app to handle higher traffic by distributing the load across multiple instances.

Step-by-Step Solution

1
Analyze the requirement to add more virtual machine instances to distribute the traffic load.
This requires horizontal scaling, which increases the instance count.
Horizontal scaling distributes load across multiple virtual machine instances.
2
Differentiate between horizontal and vertical scaling actions.
Scaling out corresponds to horizontal scaling (adding instances), whereas scaling up corresponds to vertical scaling (increasing size).
Vertical scaling (scaling up) changes the pricing tier or hardware specification but maintains the same instance count.
3
Identify the correct direction of horizontal scaling.
Scaling out increases the instance count, while scaling in decreases the instance count.
Since the system is under high CPU load, we need to increase capacity by scaling out.

Key Concept

Horizontal scaling (scaling out) vs. Vertical scaling (scaling up) in Azure App Service
Estimated Time:45s
Question 312Question →

You are configuring group membership and delegation in a Microsoft Entra ID tenant. You plan to create a security group named DevOps-Staff that dynamically includes all users whose department is Engineering and who are not guest users.

Which of the following statements are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The dynamic membership rule must be configured using the query (user.department -eq "Engineering") and (user.userType -ne "Guest").; To delegate the ability to update user attributes (such as department) for a subset of users, you can assign the User Administrator role scoped to an Administrative Unit containing those users.

Answer

The correct statements are that the dynamic membership rule must be configured using the query (user.department -eq "Engineering") and (user.userType -ne "Guest"), and that the ability to update user attributes for a subset of users can be delegated by assigning the User Administrator role scoped to an Administrative Unit containing those users.
The dynamic membership rule must be configured using the query (user.department -eq "Engineering") and (user.userType -ne "Guest") because it is a syntactically correct OData query that accurately captures both conditions. Additionally, assigning the User Administrator role scoped to an Administrative Unit allows localized delegation of user management (like department updates), which in turn feeds into the dynamic group membership evaluation.

Step-by-Step Solution

1
Analyze the dynamic membership rule requirement.
The query must target user attributes. The syntax '(user.department -eq "Engineering") and (user.userType -ne "Guest")' correctly uses the OData v3.0 syntax for Microsoft Entra ID dynamic user groups.
Dynamic groups require precise OData queries using supported user properties to evaluate membership automatically.
2
Evaluate the possibility of manual membership modifications in dynamic groups.
Dynamic groups determine membership exclusively via rules; manual additions or exceptions are not permitted.
Once a group is set to Dynamic User or Dynamic Device, its membership list is read-only for manual updates.
3
Evaluate administrative delegation using Administrative Units (AUs).
Assigning a User Administrator role scoped to an Administrative Unit containing the target users allows management of their attributes (like Department), which triggers dynamic rule evaluation and updates membership.
Administrative Units allow restricting the scope of directory roles to specific users and groups for delegation.
4
Evaluate the difference between Azure RBAC and Microsoft Entra ID roles.
An Azure Subscription Owner does not have permissions to modify Microsoft Entra ID directory objects (like groups) unless explicitly assigned a directory role.
Azure RBAC controls access to Azure resources, whereas Microsoft Entra ID roles control directory-level management.

Key Concept

Microsoft Entra ID group management, dynamic membership rules, administrative units, and directory delegation.
Estimated Time:1m 30s
Question 313Question →

A company stores compliance archives in an Azure Blob Storage account named stlogscollector in the East US region. The storage account is configured for Read-access geo-redundant storage (RA-GRS) and has an active lifecycle management policy that transitions block blobs to the Archive tier after 30 days of inactivity. Due to a prolonged outage in the primary region, a customer-managed failover is successfully completed. What is the replication configuration and lifecycle policy status of the storage account immediately after the failover process finishes?

Show answer & explanation

Answer: The replication type becomes Locally-redundant storage (LRS), and the lifecycle management policy continues to function normally.

Answer

The replication type becomes Locally-redundant storage (LRS), and the lifecycle management policy continues to function normally.
The correct option explains that when a failover is initiated for a Geo-redundant storage (GRS) or Read-access geo-redundant storage (RA-GRS) account, the storage account replication type is automatically converted to Locally-redundant storage (LRS) in the new primary region. Additionally, lifecycle management policies are part of the storage account configuration and are preserved during failover, meaning they will continue to run normally in the new primary region.

Step-by-Step Solution

1
Determine the impact of a customer-managed failover on the replication configuration of the storage account.
The replication configuration changes from Read-access geo-redundant storage (RA-GRS) to Locally-redundant storage (LRS) in the new primary region.
When a failover is executed, the secondary region becomes the new primary, and geo-replication is terminated, forcing the replication type to LRS.
2
Evaluate the state of the existing lifecycle management policy following the failover.
The lifecycle management policy remains active and continues to execute in the new primary region.
Lifecycle policies are metadata and control plane configurations associated with the storage account itself, which are preserved and remain functional across regional failovers.
3
Verify whether administrator data-plane role assignments are required to resume lifecycle operations.
No role modifications are necessary because the lifecycle policy runs as a built-in service process.
Azure Storage executes lifecycle rules internally using system permissions, meaning user role changes have no effect on policy execution.

Key Concept

Storage account replication failover behavior and lifecycle policy persistence
Question 314Question →

A company is setting up a high-performance transactional database in the North Europe region. The database requires a virtual machine, which must be configured to achieve the following:

* Maintain write performance of up to 9000090{}000 IOPS and sub-millisecond latency on a dedicated data disk.
* Secure the workload against a localized datacenter outage.
* Apply automated software installations immediately after the OS starts.

Which two options must you configure for the virtual machine during deployment to support these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable the Ultra Disk compatibility setting on the virtual machine during its creation.; Deploy the virtual machine into a specific Availability Zone.

Answer

Enable the Ultra Disk compatibility setting on the virtual machine during its creation, and deploy the virtual machine into a specific Availability Zone.
To support a workload requiring 9000090{}000 IOPS and sub-millisecond latency, Azure Ultra Disk storage is required. Ultra Disks can only be used if the virtual machine has the Ultra Disk capability enabled during creation. Additionally, Ultra Disks are zonal resources, meaning the virtual machine must be deployed in a specific Availability Zone, which also satisfies the requirement to protect against localized datacenter outages.

Step-by-Step Solution

1
Analyze the performance requirements (9000090{}000 IOPS and sub-millisecond latency).
Determine that Azure Ultra Disk is the only disk type that can meet these requirements, as Premium SSD (excluding v2) has lower limits and higher latency.
Ultra Disks support up to 160000160{}000 IOPS and sub-millisecond latency.
2
Identify the deployment constraints for Ultra Disks.
Ultra Disks require enabling the Ultra Disk capability on the VM during creation and must be deployed in an Availability Zone. They cannot be used as OS disks and are not supported in Availability Sets or B-series VMs.
Azure enforces these configuration requirements to ensure the VM is capable of routing I/O to the Ultra Disk subsystem.
3
Verify the availability and resiliency requirements.
Deploying the VM in an Availability Zone meets both the Ultra Disk requirement and protects the workload against localized datacenter outages.
Availability Zones provide physical separation within an Azure region to protect against datacenter failures.

Key Concept

Azure Ultra Disk requirements including VM capability enablement, Availability Zone placement, and disk role limitations.
Estimated Time:2m 0s
Question 315Question →

You are using the AzCopy command-line tool to upload log files from an on-premises client computer to an Azure Blob storage container. The storage account has its firewall configured to allow access only from selected networks. When you execute the AzCopy upload command, the transfer fails, and you receive an HTTP 403 Forbidden error. Which action should you perform to resolve the upload failure?

Show answer & explanation

Answer: Add the public IP address of the on-premises client computer to the firewall configuration of the storage account.

Answer

Add the public IP address of the on-premises client computer to the firewall configuration of the storage account.
The correct action is to add the public IP address of the client computer to the storage account firewall. This is because the HTTP 403 Forbidden error under a restricted network configuration indicates that the client machine is blocked from accessing the storage endpoint at the network layer.

Step-by-Step Solution

1
Identify the cause of the failure based on the HTTP 403 Forbidden error.
The error indicates that the network request is being rejected by a security boundary, specifically the storage account firewall.
Understanding the error code helps isolate whether the issue is related to credentials or network-level access control.
2
Analyze the storage account firewall settings.
The firewall is configured to block all traffic except from selected networks, which excludes the on-premises client by default.
You must identify where the request is originating from to authorize it within the firewall rules.
3
Modify the firewall rule to allow the client's public IP address.
The network block is removed, allowing AzCopy to successfully establish a connection and upload the files.
Adding the specific client IP address permits traffic while maintaining a secure default-deny posture for all other untrusted networks.

Key Concept

Configuring network access and firewalls for Azure Storage accounts during data movement operations.
Estimated Time:1m 0s
Question 316Question →

Veloce Logistics has an existing virtual machine named `VM-Prod1` running in the South Central US region. Due to budget constraints, the company wants to reuse this virtual machine while configuring a high-availability solution that includes a new virtual machine named `VM-Prod2`. The solution must protect the virtual machines against localized hardware failures within the datacenter. Which configuration should you implement?

Show answer & explanation

Answer: Recreate `VM-Prod1` and deploy both `VM-Prod1` and `VM-Prod2` into a new Availability Set.

Answer

Recreate `VM-Prod1` and deploy both `VM-Prod1` and `VM-Prod2` into a new Availability Set.
The correct option is to recreate the existing virtual machine and deploy both instances into a new Availability Set. Azure does not support adding a virtual machine to an Availability Set after the virtual machine has been created. To achieve high availability within a datacenter, both virtual machines must reside in the same Availability Set, which requires recreating the first virtual machine.

Step-by-Step Solution

1
Determine the limitation of adding existing virtual machines to Availability Sets.
Identify that Azure does not allow adding an existing virtual machine to an Availability Set; the virtual machine must be created inside the Availability Set.
This establishes that the configuration of the existing virtual machine must change via deletion and recreation.
2
Analyze high-availability requirements and scope.
Determine that protection against localized hardware failures within a datacenter is best served by an Availability Set, whereas Availability Zones protect against entire datacenter outages.
This confirms that an Availability Set is the correct high-availability target structure.
3
Evaluate configuration constraints for regional services.
Verify that helper services (like Recovery Services Vaults) must align with the resources' primary region (South Central US).
This rules out cross-region configurations that violate service placement rules.

Key Concept

Azure virtual machines can only be assigned to an Availability Set during their creation process. To place an existing virtual machine in an Availability Set, it must be recreated.
Estimated Time:1m 30s
Question 317Question →

An Azure subscription contains a resource group with the following configurations:

Resource Group NameTagResource Lock
RG-ServicesCostCenter: 4002ReadOnly

You deploy a new Azure Storage account named storebilling inside RG-Services.

You need to perform the following tasks:
- View the configuration properties of storebilling.
- Add a new tag with the key-value pair Project: Audit directly to storebilling.

Which of the following describes the outcome of these tasks?

Show answer & explanation

Answer: You can view the storage account properties, but you cannot add the Project: Audit tag. The CostCenter: 4002 tag is not inherited by the storage account.

Answer

You can view the storage account properties, but you cannot add the Project: Audit tag. The CostCenter: 4002 tag is not inherited by the storage account.
The correct option correctly states that viewing the properties is successful because ReadOnly locks allow GET requests. It also correctly states that you cannot add the tag because adding tags is a write operation blocked by the inherited ReadOnly lock. Finally, it correctly reflects that tags applied to a resource group are not inherited by resources.

Step-by-Step Solution

1
Determine the impact of the ReadOnly lock on viewing properties.
Viewing properties is allowed.
ReadOnly resource locks allow read-only operations (GET requests) to succeed on the resource.
2
Determine the impact of the ReadOnly lock on adding a tag.
Adding the tag is blocked.
A ReadOnly lock prevents any create, update, or delete operations (PUT, POST, DELETE requests). Adding a tag is a write operation and is therefore blocked.
3
Evaluate tag inheritance from the resource group to the storage account.
The storage account does not inherit the CostCenter: 4002 tag.
In Azure, tags applied at the resource group level do not automatically inherit to resources inside that resource group.

Key Concept

Azure resource locks (specifically ReadOnly locks) are inherited by child resources and prevent write operations while allowing read operations. Azure tags are not inherited from resource groups to child resources.
Question 318Question →

An administrator needs to configure automated backups for an Azure App Service web app named `app-orders-prod`. The web app runs on a Standard S1 App Service plan. Backups must be stored in an Azure Storage account named `storagecorp` that is configured with a firewall restricting access to selected networks.

The administrator attempts to configure the backup using a standard connection string, but the backup operation fails with a network access error.

Which configuration should you perform to enable successful backups of the web app to the storage account?

Show answer & explanation

Answer: Configure a managed identity for the web app, assign the Storage Blob Data Contributor role to the identity on the storage account, and configure the storage account firewall to allow trusted Microsoft services.

Answer

Configure a managed identity for the web app, assign the Storage Blob Data Contributor role to the identity on the storage account, and configure the storage account firewall to allow trusted Microsoft services.
To back up an Azure App Service web app to a storage account protected by a firewall, the backup operation must run as a trusted Microsoft service. This is accomplished by configuring a managed identity for the web app, assigning that identity the Storage Blob Data Contributor role on the destination storage account, and enabling the 'Allow trusted Microsoft services' bypass in the storage account firewall settings. This allows the platform's backup service to authenticate as the app and bypass the firewall.

Step-by-Step Solution

1
Enable a system-assigned or user-assigned managed identity on the App Service web app.
The web app is registered in Microsoft Entra ID with its own identity.
Managed identities are required for App Service backups to securely authenticate with a firewall-protected storage account.
2
Assign the Storage Blob Data Contributor role to the App Service's managed identity on the destination storage account.
The identity gains the required data-plane permissions to read, write, and delete blobs.
Standard control-plane roles like Owner or Contributor do not grant data plane access to upload backups.
3
Enable the 'Allow Azure services on the trusted services list to access this storage account' option in the storage account's firewall settings.
The storage account allows the App Service backup platform service to bypass network restrictions.
Since the backup service is managed by the platform, it uses the trusted Microsoft services path rather than the customer's VNet integration path.

Key Concept

Azure App Service backups to firewall-secured storage accounts require using managed identities and the trusted Microsoft services exception.
Estimated Time:2m 0s
Question 319Question →

An organization deploys an application hosted on Azure Virtual Machines in a subnet named AppSubnet within a virtual network named VNet-Core. The virtual machines must access a storage account named stmigration2026 to store application state. To secure the environment, the network security policy mandates that all public internet access to the storage account must be blocked, and access must be restricted to traffic originating from AppSubnet. The administrative team decides to use Virtual Network service endpoints.

Which two configuration actions must you perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enable the Microsoft.Storage service endpoint on the configuration settings of AppSubnet.; Configure the firewall settings on stmigration2026 to allow access from selected networks, and add the virtual network VNet-Core and subnet AppSubnet.

Answer

Enable the Microsoft.Storage service endpoint on the AppSubnet configuration settings, and configure the firewall settings on stmigration2026 to allow access from VNet-Core and AppSubnet.
To secure network access using service endpoints, two steps are required. First, the virtual network subnet must be configured to route traffic to the storage service over the Azure backbone by enabling the Microsoft.Storage service endpoint. Second, the storage account's network firewall must be configured to restrict access to selected networks and explicitly allow the specific virtual network and subnet.

Step-by-Step Solution

1
Enable the service endpoint on the subnet.
The Microsoft.Storage service endpoint is enabled on AppSubnet, allowing VMs in that subnet to route traffic to Azure Storage directly through the Microsoft backbone network.
Before the storage firewall can accept traffic from a specific subnet, the subnet itself must be configured to route storage traffic via the service endpoint.
2
Configure the storage firewall rules.
The firewall on stmigration2026 is configured to restrict access to selected networks and allow traffic from the VNet-Core / AppSubnet combination.
This blocks all public internet access and only accepts traffic that has been routed from the designated subnet.

Key Concept

Configuring Storage Account Network Access using Virtual Network Service Endpoints
Question 320Question →

Your company has an Azure subscription containing a resource group named RG-Production. RG-Production contains an Azure Storage account named safiles2026. The storage account hosts a blob container named archives. You need to grant a Microsoft Entra ID group named AuditTeam the ability to read files in the archives container using Microsoft Entra ID authentication. You must follow the principle of least privilege. Which two role assignments can you use to achieve this goal? Each correct answer presents a complete solution.

Select all that apply

Show answer & explanation

Answer: Storage Blob Data Reader assigned at the scope of the archives container; Storage Blob Data Reader assigned at the scope of the safiles2026 storage account

Answer

Assigning the Storage Blob Data Reader role at either the archives container scope or the safiles2026 storage account scope.
To read blob data using Microsoft Entra ID authentication, the group must be assigned a data-plane role such as Storage Blob Data Reader. This role can be assigned at the individual container scope (least privilege) or at the storage account scope, which propagates permissions down to all containers in that storage account by inheritance.

Step-by-Step Solution

1
Determine the data plane access requirements.
The requirement is to read blobs using Microsoft Entra ID authentication, which requires a role with data plane read permissions.
Control plane roles (like Reader or Contributor) do not grant direct access to blob data plane operations.
2
Identify the appropriate built-in role.
The Storage Blob Data Reader role is the built-in role that allows read access to blob data.
This role is designed specifically for reading blob data via Entra ID auth under the least privilege model.
3
Verify scope application and inheritance.
The role can be assigned at the container level or inherited from the parent storage account level.
Azure RBAC assignments flow down the resource hierarchy (Subscription -> Resource Group -> Storage Account -> Container).

Key Concept

Azure RBAC separates control plane and data plane permissions for storage accounts. Reading blob data via Entra ID authentication requires specific data plane roles applied at a valid scope.
PreviousPage 16 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin