All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An administrator configures a monthly budget of $5,000 for a resource group named rg-experimental-workloads. To prevent unauthorized changes to the resource group's configuration, the administrator applies a ReadOnly resource lock to rg-experimental-workloads. A budget alert is configured at a 90% threshold to trigger an Azure Automation runbook via an Action Group to deallocate all running virtual machines (VMs) in the resource group. When the budget threshold is reached, the alert fires, but the VMs remain running and continue to incur costs. What is the cause of this issue?

The ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action.

ReadOnly locks are not inherited by the virtual machines within the resource group, requiring the lock to be applied to each virtual machine individually.

The Automation runbook is blocked because the Service Principal executing it requires a Deny assignment at the resource group level to override the resource lock.

Budget alerts configured at the resource group scope can only send email notifications and do not support Action Groups.

Show answer & explanation

Answer: The ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action.

Answer

The ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action.

The correct answer is that the ReadOnly lock applied to the resource group prevents the deallocation of the virtual machines because stopping a virtual machine is a write action. A ReadOnly lock blocks any actions that modify the resource state, which includes VM power operations such as stopping or deallocating.

Step-by-Step Solution

Analyze the scope of the resource lock and budget.

The ReadOnly lock is applied at the resource group scope (rg-experimental-workloads), and the budget and VMs are also in this resource group.

To understand how the lock inheritance affects the resources in the group.

Evaluate the inheritance behavior of resource locks in Azure.

Locks are inherited by all resources inside the resource group, meaning the VMs inside rg-experimental-workloads inherit the ReadOnly lock.

To determine if the lock applies to the VMs.

Determine the impact of a ReadOnly lock on VM power operations.

Stopping or deallocating a VM is a write/action operation (Microsoft.Compute/virtualMachines/powerOff/action) which is blocked by a ReadOnly lock.

To identify why the runbook failed to stop the VMs despite the alert firing.

Key Concept

Resource lock inheritance and its impact on virtual machine management tasks

Question 322Question →

Sienna Foods plans to deploy a new inventory management system consisting of two virtual machines, VM-Inv1 and VM-Inv2, in the UK South region. The company has a service level agreement (SLA) requirement that guarantees virtual machine uptime of at least $99.99\%$ to protect against localized datacenter failures. Which deployment configuration should you recommend?

Deploy both virtual machines to a single Availability Set configured with three fault domains.

Deploy the virtual machines to a single Availability Set that spans across two Availability Zones.

Deploy the virtual machines across two different Availability Zones in the UK South region.

Deploy VM-Inv1, and then add VM-Inv2 to the same Availability Set after VM-Inv1 has been running.

Show answer & explanation

Answer: Deploy the virtual machines across two different Availability Zones in the UK South region.

Answer

Deploy the virtual machines across two different Availability Zones in the UK South region.

Deploying virtual machines across two or more Availability Zones in the same region provides a

99.99\%

uptime SLA and protects against localized datacenter outages because the VMs are placed in physically separate datacenters with independent power, cooling, and networking.

Step-by-Step Solution

Identify the SLA requirement.

The requirement is an SLA of at least

99.99\%

uptime.

This helps determine which high availability option is capable of meeting the constraint.

Compare Availability Sets and Availability Zones SLA guarantees.

Availability Sets guarantee

99.95\%

uptime, whereas Availability Zones guarantee

99.99\%

uptime.

Choosing the option that guarantees at least

99.99\%

uptime.

Verify regional and resource grouping rules.

Availability Zones deploy VMs to physically separate datacenters in a region, whereas Availability Sets group VMs logically within a single datacenter and cannot span zones.

To ensure the chosen deployment strategy is valid and protects against datacenter-wide failures.

Key Concept

Availability Zones vs Availability Sets

Question 323Question →

Your company is implementing Azure File Sync to centralize file shares in Azure while maintaining local caching to optimize access latency. You need to configure cloud tiering on an on-premises Windows Server named FileServer1 to minimize local storage usage on volume F: while keeping active files cached.

Volume F: has a total capacity of $2\text{ TB}$ . You enable Cloud Tiering on the server endpoint with the following settings:
- Volume free space policy: $30\%$
- Date policy: Tier files that have not been accessed within the last $30$ days.

Currently, the local volume F: contains $1.6\text{ TB}$ of files cached locally (resulting in $20\%$ free space). The cached files consist of:
- $100\text{ GB}$ of files that have not been accessed for more than $30$ days.
- $1.5\text{ TB}$ of files that were accessed within the last $5$ days.

Which of the following describes the resulting tiering behavior on volume F: when Azure File Sync evaluates the cloud tiering policies?

Azure File Sync tiers only the

100\text{ GB}

of files older than

30

days, leaving

1.5\text{ TB}

of files cached locally, because the remaining files were accessed within the last

5

days.

Azure File Sync tiers all

1.6\text{ TB}

of files on volume F: because a volume free space deficit triggers a complete tiering of all local cache to prevent data synchronization failure.

Azure File Sync tiers the

100\text{ GB}

of files older than

30

days and force-tiers

100\text{ GB}

of the files accessed within the last

5

days, leaving

1.4\text{ TB}

of files cached locally.

Azure File Sync tiers only the

100\text{ GB}

of files older than

30

days and blocks new file write operations on volume F: until the volume free space naturally reaches

30\%

Show answer & explanation

Answer: Azure File Sync tiers the $100\text{ GB}$ of files older than $30$ days and force-tiers $100\text{ GB}$ of the files accessed within the last $5$ days, leaving $1.4\text{ TB}$ of files cached locally.

Answer

Azure File Sync tiers the

100\text{ GB}

of files older than

30

days and force-tiers

100\text{ GB}

of the files accessed within the last

5

days, leaving

1.4\text{ TB}

of files cached locally.

The volume free space policy always takes precedence over the date policy. Because the volume currently has only

20\%

free space and the target free space is

30\%

, Azure File Sync must free up space. First, it applies the date policy to tier the

100\text{ GB}

of files that have not been accessed within

30

days. This increases the free space to

25\%

(

1.5\text{ TB}

cached). Since this is still below the

30\%

target, the volume free space policy forces the tiering of the least recently accessed files among the recently accessed

1.5\text{ TB}

of files until the

30\%

free space target (

600\text{ GB}

free,

1.4\text{ TB}

cached) is achieved, which requires tiering an additional

100\text{ GB}

Step-by-Step Solution

Calculate the target free space and maximum cached capacity for volume F:.

Target free space is

30\%

2\text{ TB}

(

2000\text{ GB}

), which is

600\text{ GB}

. The maximum allowed cached capacity is

1.4\text{ TB}

(

1400\text{ GB}

This establishes the threshold that the cloud tiering engine must achieve.

Apply the Date Policy to tier eligible files.

100\text{ GB}

of files older than

30

days are tiered, leaving

1.5\text{ TB}

(

1500\text{ GB}

) of cached files and

500\text{ GB}

(

25\%

) of free space.

The date policy is evaluated first to tier files that have exceeded the specified age threshold.

Evaluate the Volume Free Space Policy and force-tier recently accessed files to meet the target.

Since

25\%

free space is less than the

30\%

target, Azure File Sync force-tiers another

100\text{ GB}

of the least recently accessed files from the remaining

1.5\text{ TB}

, resulting in

1.4\text{ TB}

cached and

600\text{ GB}

(

30\%

) free space.

The Volume Free Space policy takes precedence and must be satisfied even if it requires tiering files that do not meet the Date Policy age criteria.

Key Concept

Azure File Sync Cloud Tiering policy interaction and precedence

Estimated Time:2m 30s

Question 324Question →

You manage an Azure App Service web app named WebApp1 that has a deployment slot named Staging. WebApp1 currently connects to a production database, and Staging connects to a testing database. The database connection settings are stored as an application setting named DB_CONNECTION.

You need to ensure that when Staging is swapped to production, the production slot continues to connect to the production database and the Staging slot continues to connect to the testing database.

Which configuration should you apply?

Upgrade the App Service Plan pricing tier to Premium V3 to enable multi-slot configuration synchronization.

Configure an autoscale rule to dynamically modify the DB_CONNECTION setting based on slot status.

Configure the DB_CONNECTION setting as a deployment slot setting in both WebApp1 and Staging.

Configure an Azure Monitor alert action group to run an automation runbook that rewrites the settings after every swap.

Show answer & explanation

Answer: Configure the DB_CONNECTION setting as a deployment slot setting in both WebApp1 and Staging.

Answer

Configure the DB_CONNECTION setting as a deployment slot setting in both WebApp1 and Staging.

The correct option is correct because configuring a setting as a deployment slot setting (also known as a slot-sticky setting) pins that specific configuration to the slot. When the deployment slots are swapped, the app code and most configurations are exchanged, but settings marked as deployment slot settings remain unchanged in their respective slots. This ensures the production slot continues pointing to the production database, and the Staging slot continues pointing to the testing database.

Step-by-Step Solution

Identify how Azure App Service handles configuration settings during a slot swap.

By default, application settings and connection strings are swapped along with the slot content.

This allows settings to travel with the codebase unless explicitly configured otherwise.

Determine the configuration required to keep a setting slot-specific.

Marking the setting as a 'deployment slot setting' (slot-sticky) prevents it from being swapped.

This pins the database connection setting to each respective environment (production vs. testing).

Apply this configuration to the target setting in both the production slot and the Staging slot.

The DB_CONNECTION setting remains tied to its slot after the swap.

This ensures the production slot continues pointing to the production database, and the Staging slot continues pointing to the testing database.

Key Concept

App Service Deployment Slot Settings (Sticky Settings)

Estimated Time:1m 30s

Question 325Question →

An organization's Azure environment is configured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Group-MG (Management Group)
- Billing-Sub (Subscription)
- Data-RG (Resource Group)
- storage1 (Storage Account)

A security administrator needs to delegate authority to a user named Admin-User1. Admin-User1 must be able to assign the Reader role to external auditors for resources within Data-RG. Admin-User1 must not be able to modify the resources themselves, nor assign roles for any resources outside of Data-RG.

Which of the following actions should the administrator perform to meet these requirements with the least privilege?

Assign the User Access Administrator role to Admin-User1 at the scope of the Data-RG resource group.

Assign the Owner role to Admin-User1 at the scope of the Data-RG resource group.

Assign the Global Administrator role to Admin-User1 in Microsoft Entra ID.

Assign the User Access Administrator role to Admin-User1 at the scope of the Billing-Sub subscription.

Show answer & explanation

Answer: Assign the User Access Administrator role to Admin-User1 at the scope of the Data-RG resource group.

Answer

Assign the User Access Administrator role to Admin-User1 at the scope of the Data-RG resource group.

Assigning the User Access Administrator role at the resource group scope (Data-RG) allows the user to manage role assignments (such as assigning the Reader role) only within that specific resource group. Since User Access Administrator does not grant permissions to modify the resources themselves (which would require a role like Contributor or Owner), it satisfies the requirement of least privilege.

Step-by-Step Solution

Determine the narrowest resource scope required for role delegation.

The target scope is the Data-RG resource group.

Assigning permissions at the subscription scope (Billing-Sub) would violate requirements by allowing role assignments in other resource groups via inheritance.

Evaluate the administrative role that allows assigning roles without permitting resource modification.

The User Access Administrator role is selected.

The Owner role would grant resource modification permissions, violating the restriction against resource changes.

Verify that Azure resource RBAC is used instead of Microsoft Entra ID directory roles.

Avoid tenant-level roles like Global Administrator.

Directory roles govern identity management rather than subscription resource-level RBAC assignments, and they exceed the scope of least privilege.

Key Concept

Azure RBAC scopes, role delegation, and the difference between Owner and User Access Administrator roles.

Question 326Question →

You are configuring backups for an Azure App Service web app. Which two configurations are required to enable custom backups for the web app? (Select two.)

Select all that apply

An App Service plan in the Standard tier or higher

An Azure Storage account and a blob container

An App Service plan in the Basic tier or higher

An Azure Recovery Services vault

Show answer & explanation

Answer: An App Service plan in the Standard tier or higher; An Azure Storage account and a blob container

Answer

An App Service plan in the Standard tier or higher and an Azure Storage account and a blob container are required to configure custom backups.

To configure custom backups for an Azure App Service web app, you must meet two main requirements: the web app must run on an App Service plan scaled to the Standard, Premium, or Isolated tier, and you must specify an Azure Storage account with a blob container to store the backup files.

Step-by-Step Solution

Verify the App Service plan pricing tier.

Ensure the App Service plan is scaled to the Standard tier or higher (Premium or Isolated).

Lower pricing tiers, such as Basic, Free, or Shared, do not support the custom backup feature in Azure App Services.

Configure the backup storage destination.

Create or select an Azure Storage account and a blob container.

Azure App Service stores custom backups as zip files directly in a specified Azure Blob Storage container.

Key Concept

Azure App Service Custom Backup Configuration Requirements

Estimated Time:1m 0s

Question 327Question →

You need to use the AzCopy command-line utility to upload data from an on-premises client computer to a blob container in an Azure Storage account. The storage account has public network access enabled from selected networks.

Which of the following configurations will allow you to successfully authenticate and execute the upload? (Select two.)

Select all that apply

Authenticate by running the azcopy login command with a Microsoft Entra ID account that has the Storage Blob Data Contributor role assigned.

Append a Shared Access Signature (SAS) token that has write permissions directly to the destination container URL.

Authenticate by running the azcopy login command with a Microsoft Entra ID account that only has the Contributor role assigned at the storage account level.

Configure the storage account firewall to block all public network traffic, and check the 'Allow trusted Microsoft services to access this storage account' setting to allow AzCopy traffic from your client computer.

Show answer & explanation

Answer: Authenticate by running the azcopy login command with a Microsoft Entra ID account that has the Storage Blob Data Contributor role assigned.; Append a Shared Access Signature (SAS) token that has write permissions directly to the destination container URL.

Answer

To successfully execute the upload, you must either authenticate via Microsoft Entra ID using a login session with the Storage Blob Data Contributor role, or append a valid Shared Access Signature (SAS) token with write permissions to the destination container URL.

To upload data using AzCopy, you need data-plane permissions. This can be achieved by authenticating with Microsoft Entra ID via the azcopy login command, provided the account has the Storage Blob Data Contributor role assigned. Alternatively, you can authorize the request by appending a valid Shared Access Signature (SAS) token with write permissions directly to the destination container URL.

Step-by-Step Solution

Identify the tool's access requirements.

Determine that AzCopy requires authentication and data-plane authorization to upload blobs to a storage account.

AzCopy requires explicit data-plane permissions to perform write operations in a storage container.

Evaluate Microsoft Entra ID configuration.

Find that control-plane roles like Contributor do not grant container data access, whereas data-plane roles like Storage Blob Data Contributor do.

Running azcopy login requires a data-plane role to authorize write operations on blobs.

Evaluate Shared Access Signature (SAS) configuration.

Identify that appending a write-enabled SAS token directly to the destination container URL is a supported authentication method for AzCopy.

SAS tokens provide delegated access with specific permissions and scopes directly within the resource URI.

Evaluate network security.

Identify that AzCopy executes from client environments and cannot bypass firewalls using the 'Allow trusted Microsoft services' setting.

AzCopy is a client utility, not an internal trusted Azure service, meaning its traffic originates from the client's public IP.

Key Concept

Data plane authorization and firewall traversal for AzCopy

Estimated Time:1m 0s

Question 328Question →

An administrator is configuring a new Azure virtual machine named VM-APP-10 in the West US region using the Azure portal. The administrator intends to enable Azure Backup on the Management tab during the creation process and associate the virtual machine with an existing Recovery Services Vault named RSV-Backup. However, RSV-Backup does not appear as an option in the Recovery Services vault dropdown list.

What is the most likely reason RSV-Backup is unavailable for selection?

RSV-Backup is located in a different Azure region than the virtual machine.

A ReadOnly resource lock is applied to the resource group containing RSV-Backup, which prevents it from being listed during VM deployment.

The administrator is assigned the Reader role on the resource group containing RSV-Backup and requires a data-plane role to associate the vault.

The storage account configured for the VM's diagnostic logs does not have the 'Allow trusted Microsoft services' bypass enabled for its firewall.

Show answer & explanation

Answer: RSV-Backup is located in a different Azure region than the virtual machine.

Answer

RSV-Backup is located in a different Azure region than the virtual machine.

The correct answer is correct because Azure Recovery Services Vaults are region-bound. A virtual machine deployed in West US can only be protected by a vault also deployed in West US. If the vault is in a different region, such as West US 2, it will not be listed in the dropdown selection on the Management tab during the virtual machine creation process.

Step-by-Step Solution

Analyze the regional constraint of the virtual machine and the Recovery Services Vault.

The virtual machine VM-APP-10 is being deployed in the West US region. A Recovery Services Vault can only back up virtual machines located within its own region.

Azure enforces regional boundaries for Recovery Services Vaults to ensure low latency and high availability during backup and restore operations.

Evaluate the visibility of the vault in the VM creation wizard.

Because the vault is in a different region, the wizard automatically filters it out, making it unavailable in the dropdown menu.

Filtering unavailable resources prevents the administrator from choosing an unsupported configuration during deployment.

Key Concept

Recovery Services Vault region constraints during VM creation

Question 329Question →

An administrator manages a standard General Purpose v2 (GPv2) storage account named stbackup2026 in the East US region. The storage account currently uses Locally Redundant Storage (LRS). To meet new corporate policies, the administrator must ensure the storage account is protected against regional outages. Additionally, any logs stored in a container named 'temp-logs' must be automatically deleted 30 days after they are created. Which two actions should the administrator perform to meet these requirements?

Select all that apply

Change the replication configuration of the storage account from Locally Redundant Storage (LRS) to Geo-Redundant Storage (GRS).

Create a lifecycle management policy with a rule that filters by the 'temp-logs' prefix and deletes blobs 30 days after creation.

Initiate a customer-managed account failover to convert the storage account from Locally Redundant Storage (LRS) to Geo-Redundant Storage (GRS).

Assign the Storage Blob Data Owner role at the storage account scope to the system-assigned managed identity of the lifecycle management policy.

Show answer & explanation

Answer: Change the replication configuration of the storage account from Locally Redundant Storage (LRS) to Geo-Redundant Storage (GRS).; Create a lifecycle management policy with a rule that filters by the 'temp-logs' prefix and deletes blobs 30 days after creation.

Answer

The administrator should change the replication configuration of the storage account to Geo-Redundant Storage (GRS) and configure a lifecycle management policy with a rule that targets the 'temp-logs' container to delete blobs 30 days after creation.

To satisfy the requirements, the administrator needs to change the replication type of the storage account to a geo-redundant option (such as Geo-Redundant Storage) to protect against regional outages, and configure a native lifecycle management rule with a prefix filter matching the specific container name to automatically delete the blobs 30 days after creation.

Step-by-Step Solution

Navigate to the storage account configuration settings in the Azure portal or use Azure CLI/PowerShell, and change the replication from Locally Redundant Storage (LRS) to Geo-Redundant Storage (GRS).

The storage account data is replicated asynchronously to the paired secondary region, meeting the protection requirement against regional outages.

GRS provides regional disaster recovery protection by keeping three copies of data in the primary region and three copies in the secondary region.

Navigate to the lifecycle management blade under data management, add a new rule targeting blob creation time, set the action to delete the blob 30 days after creation, and apply a prefix filter matching the 'temp-logs' container name.

A native lifecycle policy is established to automatically clean up the log files without administrative overhead.

Lifecycle management provides automated, rule-based deletion and tiering transitions, and the prefix filter limits the rule scope to the designated container.

Key Concept

Azure Storage replication conversion paths and Blob lifecycle management policy rules.

Estimated Time:1m 30s

Question 330Question →

An organization has a Microsoft Entra ID tenant. The tenant contains a user named Admin1, a security group named Europe-Sales that has 50 member users, and an administrative unit named Europe-AU. Europe-AU contains the Europe-Sales group as its only member.

You assign the User Administrator role to Admin1 with Europe-AU as the scope.

Which action is Admin1 permitted to perform?

Add new members to the Europe-Sales group

Reset the passwords of the users who are members of the Europe-Sales group

Assign the Virtual Machine Contributor role to the Europe-Sales group for an Azure resource group

Configure a dynamic membership rule for the Europe-Sales group based on user attributes

Show answer & explanation

Answer: Add new members to the Europe-Sales group

Answer

Add new members to the Europe-Sales group

An administrator assigned the User Administrator role at the Administrative Unit (AU) scope can manage the properties and membership of groups that are direct members of the AU. Since Europe-Sales is a member of Europe-AU, Admin1 can add or remove members from it.

Step-by-Step Solution

Identify the role and scope assignment

Admin1 is assigned the User Administrator role scoped to the Europe-AU Administrative Unit.

This determines the boundary of the administrator's management capabilities.

Determine the direct members of the Administrative Unit

The Europe-Sales group is the only direct member of Europe-AU. The individual users within the group are not direct members of the AU.

Administrative Unit scope is non-transitive. Only objects directly added to the AU are within the management scope.

Evaluate the administrative permissions on the group object versus its members

Admin1 can perform group management actions on Europe-Sales (such as updating properties and managing membership) but cannot perform user management actions (such as password resets) on the group's members.

To manage the users inside the group, those users must be explicitly added as direct members of the Europe-AU.

Key Concept

Administrative Unit scoping and the non-transitive nature of group memberships in Microsoft Entra ID

Estimated Time:1m 30s

Question 331Question →

You manage an Azure environment. You create a new resource group named rg-finance-prod to hold production database resources. You apply a tag with the key CostCenter and value Finance-101 to rg-finance-prod. Additionally, you configure a CanNotDelete resource lock on rg-finance-prod. Afterwards, you deploy an Azure SQL database named db-finance into rg-finance-prod. Which of the following statements correctly describe the resource governance settings applied to the database? Select two.

Select all that apply

The database inherits the CanNotDelete lock from the resource group, preventing its deletion.

The database does not inherit the CostCenter tag from the resource group.

The database automatically inherits the CostCenter tag from the resource group.

The CanNotDelete lock prevents users from modifying the database configuration or connection strings.

Show answer & explanation

Answer: The database inherits the CanNotDelete lock from the resource group, preventing its deletion.; The database does not inherit the CostCenter tag from the resource group.

Answer

The database inherits the CanNotDelete lock from the resource group, preventing its deletion, and the database does not inherit the CostCenter tag from the resource group.

Resource locks in Azure are inherited by all child resources in the scope where they are applied. Therefore, applying a CanNotDelete lock to the resource group prevents the database from being deleted. Conversely, tags are not inherited by resources from the parent resource group, meaning the database will not have the CostCenter tag automatically applied.

Step-by-Step Solution

Evaluate lock inheritance for the SQL database inside the resource group.

The CanNotDelete lock applied to the resource group rg-finance-prod is inherited by the child database db-finance, preventing its deletion.

In Azure, resource locks applied at a parent scope are inherited by all child resources.

Evaluate tag inheritance for the SQL database inside the resource group.

The CostCenter tag is not inherited by the database db-finance.

Azure resources do not automatically inherit tags from their parent resource group.

Key Concept

Resource lock inheritance applies to child resources, while tag inheritance does not occur automatically from resource groups to child resources.

Question 332Question →

You have an existing Availability Set named AvSet1 in the East US region. You need to deploy a new virtual machine named VM2 and configure it to be part of AvSet1. Which configuration must be applied during the creation of VM2?

Deploy VM2 first, and then use the Azure portal to associate the running virtual machine with AvSet1.

Select AvSet1 during creation, ensuring that VM2 is deployed in the same region and resource group as AvSet1.

Configure VM2 to deploy to Availability Zone 1, and then select AvSet1 as the secondary redundancy option.

Deploy VM2 in the West US region within the same resource group, and then select AvSet1 during creation.

Show answer & explanation

Answer: Select AvSet1 during creation, ensuring that VM2 is deployed in the same region and resource group as AvSet1.

Answer

Select the existing Availability Set during the creation process, ensuring that the new virtual machine is deployed in the same Azure region and resource group as the Availability Set.

To place a virtual machine in an Availability Set, the configuration must be specified during the creation wizard. Because an Availability Set is a regional resource and bound to a single resource group, the new virtual machine must be deployed in the same region (East US) and resource group as the target Availability Set.

Step-by-Step Solution

Determine the phase when an Availability Set must be associated with a virtual machine.

The virtual machine must be added to the Availability Set during VM creation. Azure does not support adding an existing virtual machine to an Availability Set.

This is a configuration constraint for Azure virtual machines.

Verify scope and dependency requirements for Availability Sets.

The virtual machine must be created in the same Azure region and the same resource group as the target Availability Set.

Availability Sets are regional resources and logical groupings restricted to a single resource group.

Evaluate availability option compatibility.

Availability Zones and Availability Sets cannot be configured simultaneously for the same virtual machine.

They are mutually exclusive high availability mechanisms.

Key Concept

Availability Set Configuration Rules

Estimated Time:1m 30s

Question 333Question →

An administrator is configuring access control for an Azure environment where the Prod-MG management group contains the Sub1 subscription, which in turn contains the Data-RG resource group. A storage account named storage1 is deployed in Data-RG. A developer needs to upload and read blobs in storage1. The developer must not have permissions to modify the configuration of the storage account or any other resources in the subscription. Which built-in role and scope should the administrator assign to the developer to meet these requirements while adhering to the principle of least privilege?

Storage Blob Data Contributor assigned at the storage1 scope

Storage Account Contributor assigned at the Data-RG scope

User Administrator assigned at the Prod-MG scope

Reader assigned at the Sub1 scope

Show answer & explanation

Answer: Storage Blob Data Contributor assigned at the storage1 scope

Answer

Assign the Storage Blob Data Contributor role at the storage1 scope.

Assigning the Storage Blob Data Contributor role at the storage1 scope is correct because it grants the specific data plane permissions required to upload and read blobs on that specific storage account, satisfying the principle of least privilege without providing management access to other resources.

Step-by-Step Solution

Analyze the required permissions for the developer.

The developer needs data plane access (upload and read blobs) but must not have administrative privileges to modify resource configurations.

This identifies that a data plane role like Storage Blob Data Contributor is needed, rather than a control plane role like Storage Account Contributor.

Determine the correct scope following the principle of least privilege.

The scope should be restricted to the specific storage account (storage1) rather than the resource group (Data-RG) or subscription (Sub1).

Assigning permissions at the resource level restricts access to only what is necessary, preventing access to other resources.

Select the appropriate Azure RBAC role and scope combination.

Assign Storage Blob Data Contributor at the storage1 scope.

This satisfies both the data access requirement and the least privilege constraint.

Key Concept

Azure RBAC roles distinguish between control plane and data plane operations, and scopes define the boundary of these permissions.

Estimated Time:1m 0s

Question 334Question →

An organization's Azure environment contains a resource group named RG-Data that hosts a storage account named storageapp2026. An administrator needs to configure permissions so that a user named Jordan can download files from a blob container named 'logs'. The configuration must use Microsoft Entra ID authentication and follow the principle of least privilege, ensuring Jordan cannot modify any data or change storage account settings. Which Azure role-based access control (RBAC) role should the administrator assign to Jordan?

Storage Blob Data Reader

Reader

Storage Account Contributor

User Administrator

Show answer & explanation

Answer: Storage Blob Data Reader

Answer

Storage Blob Data Reader

The correct answer is the Storage Blob Data Reader role because it grants data plane access to read and list blob containers and their contents using Microsoft Entra ID authentication. This matches the requirements of downloading files under the principle of least privilege, without allowing management actions or write operations.

Step-by-Step Solution

Determine the type of operation needed for the user to download files from a blob container.

The operation is a data plane access request (reading blob content).

Downloading blob content requires permissions on the data plane, not just management permissions on the control plane.

Select the built-in Azure RBAC role that provides read-only data access to blobs while adhering to least privilege.

The Storage Blob Data Reader role is selected.

This role allows reading and listing blobs within container resources without permitting modifications or configuration changes.

Key Concept

Separation of control plane and data plane RBAC roles in Azure Storage

Estimated Time:45s

Question 335Question →

You have an Azure App Service web app named WebApp1 and an Azure Key Vault named Vault1. You need to store a database connection string in Vault1 as a secret and configure WebApp1 to securely retrieve the connection string without exposing the raw secret value in the App Service configuration. Which sequence of steps should you perform to complete this configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To securely reference a Key Vault secret in WebApp1, you must first enable a system-assigned managed identity for WebApp1, then assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1, retrieve the Secret Identifier URL of the database connection string secret from Vault1, and finally create an application setting in WebApp1 that references the Secret Identifier using the key vault reference syntax.

The correct sequence starts with enabling the system-assigned managed identity because the identity must exist in Microsoft Entra ID before any access permissions can be granted. Once created, the Key Vault Secrets User role must be assigned to the identity so that WebApp1 can read secrets. Next, the Secret Identifier URL is retrieved from Vault1 to point to the correct secret. Finally, the App Service application settings must be updated with this URI using the Key Vault reference syntax so that the runtime can fetch the secret.

Step-by-Step Solution

Enable a system-assigned managed identity for WebApp1.

A service principal is registered in Microsoft Entra ID for the web app, allowing it to authenticate to other Azure services.

An identity must exist before permissions can be assigned to it.

Assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1.

The web app's managed identity is granted read access to secrets in Vault1.

By default, App Services do not have permission to read secrets from Key Vault; authorization is required.

Retrieve the Secret Identifier URL of the database connection string secret from Vault1.

You obtain the specific URI pointing to the secret version in Key Vault.

The App Service application setting configuration requires this URI to resolve the secret value.

Create an application setting in WebApp1 that references the retrieved Secret Identifier using the key vault reference syntax.

WebApp1 resolves the secret at runtime and exposes it as an environment variable to the application code.

The `@Microsoft.KeyVault` syntax tells the App Service runtime to fetch the secret on behalf of the application.

Key Concept

Azure App Service Key Vault references allow web apps to pull secrets from Key Vault at runtime using managed identities, keeping credentials out of the application configuration.

Estimated Time:1m 30s

Question 336Question →

Your organization has an on-premises Windows Server named Server1. You need to configure Azure File Sync to synchronize a local folder on Server1 with a new Azure file share. You have already created a resource group and a storage account in Azure. Which sequence of actions should you perform to establish synchronization? To answer, move the appropriate actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Deploy a Storage Sync Service resource in the Azure subscription, install the Azure File Sync agent on Server1, register Server1 with the Storage Sync Service, create a Sync Group and add the Azure file share as a Cloud Endpoint, and then create a Server Endpoint on Server1 pointing to the local folder.

To deploy Azure File Sync, you must first create the Storage Sync Service in Azure. Next, you must install the Azure File Sync agent on the on-premises Windows Server. Once the agent is installed, you register the Windows Server with the Storage Sync Service. After the server is registered, you create a sync group and define the cloud endpoint (the Azure file share). Finally, you create a server endpoint to link the local path on the registered server to the sync group.

Step-by-Step Solution

Deploy the Storage Sync Service in Azure.

The central management resource is available to coordinate synchronization.

All servers must register to a Storage Sync Service, and sync groups reside within it.

Install the Azure File Sync agent on Server1.

The file sync driver and registration utility are installed on the local server.

The registration utility and sync agent are required on the host OS before registration can occur.

Server1 appears as a registered server in the Storage Sync Service resource.

Establishing a trust relationship is required before the server can host sync endpoints.

Create a Sync Group and add the Azure file share as a Cloud Endpoint.

The sync topology container is established, linking the cloud storage.

A sync group and a cloud endpoint must exist before any local folders can be added to the sync topology.

Create a Server Endpoint on Server1 pointing to the local folder.

Synchronization begins between the local folder on Server1 and the Azure file share.

The server endpoint links the registered server's local path to the sync group.

Key Concept

Azure File Sync deployment order and topological dependencies

Estimated Time:2m 30s

Question 337Question →

You manage an Azure App Service web app that is hosted on a Free (F1) App Service plan. You need to configure a custom domain and bind a custom TLS/SSL certificate to the web app. What is the minimum App Service plan pricing tier you must select to support these requirements?

Basic

Shared

Standard

Free

Show answer & explanation

Answer: Basic

Answer

Basic

The correct answer is the Basic tier. In Azure App Service, the Basic pricing tier is the minimum tier that supports custom SSL/TLS bindings (both SNI and IP-based). The Free tier supports neither custom domains nor SSL bindings. The Shared tier supports custom domains but not custom SSL bindings. While the Standard tier supports custom SSL bindings, it is not the minimum tier required.

Step-by-Step Solution

Identify the features required for the App Service web app.

The requirements are configuring a custom domain and binding a custom TLS/SSL certificate.

This determines which pricing tiers can support the workload.

Evaluate the capabilities of the entry-level App Service plan tiers.

The Free tier supports neither custom domains nor SSL. The Shared tier supports custom domains but not TLS/SSL bindings.

This rules out the Free and Shared tiers.

Determine the minimum tier that supports TLS/SSL bindings.

The Basic tier is the cheapest tier that supports custom domains and custom TLS/SSL bindings.

This provides the required functionality at the lowest cost.

Key Concept

Azure App Service Plan pricing tiers and feature support

Question 338Question →

An administrator is deploying a high-availability application that consists of three virtual machines in the East US region. The virtual machines are placed in a resource group named RG-Prod. A ReadOnly resource lock is applied to RG-Prod.

The deployment requirements and configurations are:
- The virtual machines must be protected against datacenter-wide failures, so they are deployed across three Availability Zones in East US.
- The virtual machines must be backed up daily, so a Recovery Services vault is created in the East US 2 region.
- Boot diagnostics for the virtual machines must be written to an Azure storage account that restricts public access. The storage account firewall is configured to allow access from selected networks only, and the 'Allow trusted Microsoft services to access this storage account' option is disabled.

You need to identify the configuration issues and operational limitations of this setup.

Which of the following statements are correct? (Select two.)

Select all that apply

The daily backups will fail to configure because the Recovery Services vault and the virtual machines are not in the same region.

Administrators will be unable to start or stop the virtual machines from the Azure Portal because the ReadOnly resource lock prevents these actions.

To satisfy the requirement of protecting the virtual machines from datacenter-wide failures, they should be deployed in an Availability Set instead of Availability Zones.

The boot diagnostics will write successfully to the storage account because virtual machine diagnostic agents automatically bypass storage firewall rules without requiring the 'Allow trusted Microsoft services' setting.

Show answer & explanation

Answer: The daily backups will fail to configure because the Recovery Services vault and the virtual machines are not in the same region.; Administrators will be unable to start or stop the virtual machines from the Azure Portal because the ReadOnly resource lock prevents these actions.

Answer

The daily backups will fail to configure because the Recovery Services vault and the virtual machines are not in the same region, and administrators will be unable to start or stop the virtual machines because of the ReadOnly lock on the resource group.

The configuration will fail to configure backups because the Recovery Services vault and virtual machines must reside in the same region. Additionally, the ReadOnly lock applied at the resource group level inherits to all VMs within it, preventing any state modification operations (including starting and stopping).

Step-by-Step Solution

Evaluate the backup configuration against region constraints.

The Recovery Services vault in East US 2 cannot back up virtual machines in East US.

Azure Backup enforces that the vault and the target VMs must reside in the same region.

Determine the impact of the ReadOnly lock on VM management.

Starting and stopping the VMs is blocked.

Power management commands modify the resource state, which constitutes a write action blocked by a ReadOnly lock.

Compare Availability Zones and Availability Sets for resiliency.

Availability Zones protect against datacenter-wide failures, while Availability Sets protect only against single-datacenter hardware faults.

Zones are physically separate datacenters, providing the required level of high availability.

Analyze storage firewall settings for boot diagnostics.

Boot diagnostics will fail to write to the storage account because the trusted services bypass is disabled.

When a storage account firewall is active, access must be explicitly allowed for diagnostic data transit.

Key Concept

Azure Virtual Machine creation and configuration including high availability options, resource locks, regional backup constraints, and storage diagnostics settings.

Question 339Question →

An administrator successfully logs in to AzCopy using a Microsoft Entra ID account. However, when the administrator attempts to copy files to an Azure Blob storage container, the copy operation fails with an authorization error. The administrator's user account has the Contributor role for the storage account. Which action should the administrator perform to resolve the authorization error?

Assign the Storage Blob Data Contributor role to the administrator's user account.

Assign the Storage Queue Data Contributor role to the administrator's user account.

Regenerate the storage account access keys.

Enable the 'Allow trusted Microsoft services to access this storage account' setting on the storage account firewall.

Show answer & explanation

Answer: Assign the Storage Blob Data Contributor role to the administrator's user account.

Answer

Assign the Storage Blob Data Contributor role to the administrator's user account.

The correct answer is to assign the Storage Blob Data Contributor role. Microsoft Entra ID authorization requires specific data-plane roles for storage data access. Control plane roles like Contributor manage the storage account structure but do not allow writing or reading Blob data directly.

Step-by-Step Solution

Identify the authentication mechanism used in the AzCopy command.

The administrator successfully logged in with a Microsoft Entra ID account, which indicates they are using token-based authentication.

Identifying the authentication method determines whether permissions are managed via RBAC data-plane roles or storage access keys.

Analyze the administrator's current RBAC role assignment.

The administrator has the Contributor role at the storage account level.

Standard Azure management roles like Contributor only govern control-plane access. They do not grant default authorization to view or write blob data (data-plane).

Determine the required data-plane role for Blob storage operations.

The Storage Blob Data Contributor role provides data-plane access to write blobs to containers.

Assigning this role resolves the authorization error by granting the necessary data plane permissions to the Entra ID user account.

Key Concept

Data-plane versus control-plane permissions for Azure Storage using Microsoft Entra ID authentication

Estimated Time:1m 0s

Question 340Question →

An administrator is planning the deployment of several Azure virtual machines (VMs) to support different enterprise workloads. Each workload has specific performance, placement, or security requirements.

Match each workload requirement to the most appropriate Azure VM configuration feature or option.

Click a left item, then click its matching right item

Show answer & explanation

Answer

To meet the requirements, match the dynamic performance scale database to Ultra Disk, the stateless web VM pool to Ephemeral OS Disk, the low-latency cluster to Proximity Placement Group, and the host-level encryption to Encryption at Host.

The correct matches align each workload requirement with its specific Azure VM architectural option:
- Dynamic performance adjustments of IOPS and throughput on the fly are unique to Ultra Disks.
- Storing the OS disk directly on the local VM host's storage to minimize latency and enable rapid re-imaging is the primary use case of Ephemeral OS Disks.
- Grouping VMs in close physical proximity within a single data center to reduce network latency is achieved using Proximity Placement Groups.
- Encrypting data directly at the virtual machine physical host level before sending it over the network to Azure Storage is configured using Encryption at Host.

Step-by-Step Solution

Analyze the database requirement for dynamically adjusting storage performance (IOPS and throughput) without VM downtime.

Identify Ultra Disk as the appropriate storage option.

Ultra Disks allow modifying IOPS and throughput dynamically without detaching the disk or restarting the VM.

Evaluate the requirement for stateless VMs requiring low OS disk latency and rapid re-imaging using local host storage.

Identify Ephemeral OS Disk as the correct selection.

Ephemeral OS Disks utilize the local VM host's cache or temp disk instead of remote Azure Storage, enabling faster read/write latency and rapid re-imaging.

Analyze the requirement for reducing physical distance and network latency between VMs in a cluster.

Identify Proximity Placement Groups as the correct option.

Proximity Placement Groups group VMs physically close within the same data center to reduce inter-VM latency.

Identify the feature that encrypts OS and temp disks at the VM host level before sending data to Azure Storage.

Identify Encryption at Host as the correct option.

Encryption at Host ensures that data stored on the VM host (like temporary disk and OS/data disk caches) is encrypted at rest and encrypted end-to-end as it flows to Azure Storage.

Key Concept

Azure VM storage, placement, and host security configuration options.

Estimated Time:3m 0s

PreviousPage 17 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept