Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 341Question →

An administrator is managing a standard General Purpose v2 (GPv2) storage account named `strecords2026` in the West Europe region. The storage account currently uses locally-redundant storage (LRS) replication. The administrator needs to configure the storage account to use zone-redundant storage (ZRS) to protect against datacenter failures within the region. The configuration must be performed with no downtime and without migrating data to a new storage account. Which of the following actions should the administrator perform?

Show answer & explanation

Answer: Submit a support request to Microsoft to perform a live migration of the storage account.

Answer

Submit a support request to Microsoft to perform a live migration of the storage account.
To migrate a storage account from locally-redundant storage (LRS) to zone-redundant storage (ZRS) without downtime and keeping the same storage account, you must submit a support request to Microsoft to perform a live migration. Microsoft handles the data replication in the background while the storage account remains fully accessible.

Step-by-Step Solution

1
Identify the current replication configuration and the target redundancy requirement.
The storage account is currently configured with locally-redundant storage (LRS), and the target is zone-redundant storage (ZRS).
This determines the migration path and identifies standard support paths in Azure.
2
Evaluate the direct conversion options in the Azure portal.
Direct configuration changes from LRS to ZRS are not available in the storage account configuration blade.
Azure limits self-service replication changes primarily to upgrading to geo-redundant options like GRS.
3
Determine the method that avoids downtime and retains the same storage account.
Submitting a support request for a live migration meets these criteria.
Microsoft Support can perform a background copy to ZRS, which keeps the existing account active and preserves the endpoints.

Key Concept

Storage replication conversion limitations and migration paths in Azure Storage.
Question 342Question →

Your organization's Azure environment is structured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Corp-MG (Management Group)
- Corp-Sub (Subscription)
- Dev-RG (Resource Group)
- VM1 (Virtual Machine)
- Storage1 (Storage Account)

You need to assign Azure Role-Based Access Control (RBAC) roles to a developer named User1 at the Dev-RG scope. User1 must be able to start, stop, and restart VM1, and view the configuration settings of Storage1. User1 must not be able to delete or modify any other resources in the resource group.

Which two built-in Azure RBAC roles should you assign to User1 to meet the requirements while adhering to the principle of least privilege? Select two.

Select all that apply

Show answer & explanation

Answer: Virtual Machine Contributor; Reader

Answer

Assign the Virtual Machine Contributor role and the Reader role to the developer.
To meet the requirements, the user must be assigned the Virtual Machine Contributor role, which allows managing virtual machine power states (start, stop, restart), and the Reader role, which allows viewing resource configurations (such as the storage account) without making any modifications. Together, these roles grant the exact permissions needed without exceeding the scope of the developer's tasks.

Step-by-Step Solution

1
Analyze the virtual machine requirement.
The developer needs to start, stop, and restart VM1. The Virtual Machine Contributor role grants full management of virtual machines without granting access to the virtual network or storage account they are connected to.
This satisfies the VM management requirement with least privilege.
2
Analyze the storage account configuration viewing requirement.
The developer needs to view the configuration of Storage1 but not modify it. The Reader role allows viewing all resources within the resource group (including Storage1) without granting write permissions.
This satisfies the viewing requirement with least privilege.
3
Combine the assignments and evaluate alternatives.
Assigning both Virtual Machine Contributor and Reader roles at the Dev-RG scope meets the objectives. Other roles like Contributor or Global Administrator grant excessive permissions.
Ensures adherence to the principle of least privilege.

Key Concept

Azure Role-Based Access Control (RBAC) Built-in Roles and Least Privilege
Question 343Question →

A security audit requires an external analytics platform to pull diagnostic reports from a container named `audit-reports` in an Azure Storage account named `corpsecuredatalake`.

The following security policy rules must be enforced:
- The access credentials must be tied to a Microsoft Entra ID security principal to track token generation in activity logs.
- The connection must be restricted to the analytics platform's public IP address of `198.200.150.12`.
- The connection must enforce HTTPS-only traffic.
- The token's validity must not exceed 24 hours.
- The platform must only be permitted to view the list of files and download them.

Which two of the following actions are required to configure and authorize this access?

Select all that apply

Show answer & explanation

Answer: Grant the security principal used to sign the token the Storage Blob Delegator and Storage Blob Data Reader roles.; Create a User Delegation SAS token with read (r) and list (l) permissions, HTTPS-only protocol, and the allowed IP address of `198.200.150.12`.

Answer

To configure and authorize the required access, you must grant the security principal the Storage Blob Delegator and Storage Blob Data Reader roles, and create a User Delegation SAS token with read and list permissions, HTTPS-only protocol, and the allowed IP address.
To satisfy the auditing requirement, the Shared Access Signature must be signed using Microsoft Entra ID credentials, which necessitates a User Delegation SAS. This requires granting the security principal both the Storage Blob Delegator role (to generate the user delegation key) and the Storage Blob Data Reader role (since the client's access is checked against the signing user's active RBAC permissions at the time of the request). The SAS token itself must then be generated with the appropriate constraints including read and list permissions, the allowed public IP, and HTTPS-only protocol.

Step-by-Step Solution

1
Determine the SAS type that supports Microsoft Entra ID user identity tracking.
A User Delegation SAS is selected.
Only a User Delegation SAS is signed using a user delegation key acquired via Microsoft Entra ID, allowing the token creation and data access to be associated with an Entra ID security principal.
2
Assign the necessary Azure RBAC roles to the security principal.
The principal is granted the Storage Blob Delegator and Storage Blob Data Reader roles.
The Storage Blob Delegator role allows the principal to obtain the user delegation key, while the Storage Blob Data Reader role grants the required data-plane permission (read/list) which is evaluated when the SAS is used.
3
Generate the User Delegation SAS token with the specified constraints.
The token is configured with read and list permissions, HTTPS-only protocol, allowed IP range, and a 24-hour expiration.
These constraints ensure compliance with the lease-privilege policy, secure communications, and validity limits.

Key Concept

Authorization and configuration of User Delegation Shared Access Signatures (SAS) using Microsoft Entra ID.
Question 344Question →

Your organization uses a multi-tier Azure resource hierarchy structure. The hierarchy contains a Management Group named Corp-MG, a subscription named Finance-Sub under Corp-MG, and a resource group named Finance-Prod-RG inside Finance-Sub. A compliance team needs to audit role assignments and resource configurations. They must be able to:

1. View all resource configurations inside the Finance-Sub subscription.
2. Read all logs and role assignments inside Finance-Prod-RG.
3. Manage (create, delete, and update) role assignments specifically within Finance-Prod-RG.

They must not be able to modify any resource configurations or access data plane objects (such as reading storage blob data or key vault secrets). You need to configure role assignments for the compliance team's security group.

Which two role assignments should you configure to meet the requirements while adhering to the principle of least privilege? (Select two.)

Select all that apply

Show answer & explanation

Answer: Reader assigned at the Finance-Sub subscription level; User Access Administrator assigned at the Finance-Prod-RG resource group level

Answer

Configure Reader assigned at the Finance-Sub subscription level and User Access Administrator assigned at the Finance-Prod-RG resource group level.
To satisfy the requirements using the principle of least privilege, the compliance team must be assigned the Reader role at the subscription scope (Finance-Sub), which allows them to view all configurations in the subscription and all child resource groups. Additionally, they must be assigned the User Access Administrator role at the resource group scope (Finance-Prod-RG), which enables them to manage role assignments only within that specific resource group without inheriting administrative rights upward or across other subscriptions.

Step-by-Step Solution

1
Analyze the requirement for viewing resource configurations.
The compliance team needs to view all resource configurations within the Finance-Sub subscription. The Reader role grants this read-only access. Assigning it at the subscription scope ensures it inherits to all child resource groups.
Ensures the team can audit resource configurations across the entire subscription scope.
2
Analyze the requirement for managing role assignments.
The compliance team must manage role assignments specifically within the Finance-Prod-RG resource group. The User Access Administrator role allows managing role assignments. To restrict this to the resource group, the role must be scoped at the Finance-Prod-RG level.
Adheres to the principle of least privilege by scoping administrative access to the specific resource group rather than the subscription or management group.
3
Verify exclusions and data plane access restrictions.
The combination of Reader (at subscription level) and User Access Administrator (at resource group level) does not grant data plane access (like reading storage blob data) or resource modification rights, meeting all security constraints.
Validates compliance with the constraint preventing data plane access or modification of configurations.

Key Concept

Azure RBAC inheritance, scope scoping, and the distinction between control plane (Reader, User Access Administrator) and data plane (Storage Blob Data Reader) roles.
Question 345Question →

You need to deploy a new application that requires full administrative control over the operating system, including custom registry settings and background services. The application must also be protected from datacenter-wide outages. Which Azure resource configuration should you deploy?

Show answer & explanation

Answer: An Azure Virtual Machine deployed in an Availability Zone

Answer

An Azure Virtual Machine deployed in an Availability Zone
Deploying an Azure Virtual Machine provides full administrative access to the guest operating system, which is required to modify registry settings and configure custom background services. Deploying the virtual machine within an Availability Zone ensures that the instance is placed in a physically separate facility within the region, protecting the workload from datacenter-wide outages.

Step-by-Step Solution

1
Analyze the operating system control requirements.
The application requires custom registry settings and background services, which necessitates an infrastructure-as-a-service (IaaS) solution.
Platform-as-a-service (PaaS) options like App Service or container options like Container Instances do not permit direct registry access or operating system level customizations.
2
Analyze the redundancy requirements.
The application must be protected from datacenter-wide outages.
Availability Zones distribute VMs across physically separate datacenter facilities within the same region, providing protection against datacenter-wide failures. Availability Sets only protect against localized hardware failures within the same datacenter.
3
Combine the requirements to select the correct configuration.
An Azure Virtual Machine deployed in an Availability Zone meets both administrative and high availability requirements.
This combined option ensures both OS-level access control and physical isolation across datacenters.

Key Concept

Selecting and configuring Azure virtual machines based on OS administrative requirements and high availability needs.
Estimated Time:1m 0s
Question 346Question →

An administrator is deploying Windows Server virtual machines in an Azure subscription. The subscription is configured as an Azure Dev/Test subscription. Determine whether the following statement is true or false: Applying Azure Hybrid Benefit for Windows Server to these virtual machines reduces their billing rate below the standard Linux virtual machine compute rate.

Show answer & explanation

Answer: False

Answer

The statement is false because Azure Dev/Test subscriptions already waive the Windows Server license fee to charge the baseline Linux compute rate, and Azure Hybrid Benefit cannot be used to reduce the rate below this baseline.
The correct answer is false. Windows Server virtual machines in an Azure Dev/Test subscription are already billed at the standard Linux compute rate. Applying Azure Hybrid Benefit has no effect since the Windows Server license fee is already waived by the subscription type.

Step-by-Step Solution

1
Analyze the billing behavior of Windows Server virtual machines in an Azure Dev/Test subscription.
In an Azure Dev/Test subscription, Windows Server virtual machines are charged at the same rate as standard Linux virtual machines because the Windows Server licensing fee is waived.
This provides a cost-effective environment for development and testing workloads.
2
Analyze how Azure Hybrid Benefit (AHB) affects Windows Server virtual machine costs.
AHB allows organizations to use on-premises Windows Server licenses with active Software Assurance to run Windows Server VMs in Azure at the Linux compute rate.
This is designed to waive the Azure Windows Server licensing fee for standard subscriptions.
3
Evaluate the combination of Dev/Test rates and Azure Hybrid Benefit.
Because the Dev/Test subscription rate is already identical to the baseline Linux compute rate, the Windows licensing fee is already $0. Applying Azure Hybrid Benefit does not provide any additional discount below the base Linux compute rate.
You cannot stack these benefits to reduce the cost below the compute-only rate.

Key Concept

Azure Dev/Test subscription pricing and Azure Hybrid Benefit interaction
Question 347Question →

An administrator configures the following Azure resource hierarchy:
* A management group named `Contoso-Org-MG`
* A subscription named `Sub-Procurement-01` under `Contoso-Org-MG`
* Two resource groups within `Sub-Procurement-01` named `rg-operational-prod` and `rg-testing-dev`

The administrator configures two Azure Policy assignments:
1. Assignment 1: Assigns a policy definition that denies the deployment of virtual machines unless they use the `Standard_D8s_v5` or `Standard_D16s_v5` SKU. This policy is assigned at the `Contoso-Org-MG` management group scope, with an exclusion configured for the `rg-testing-dev` resource group.
2. Assignment 2: Assigns a policy definition that denies the deployment of resources unless they contain a tag named `DeptCode`. This policy is assigned at the `Sub-Procurement-01` subscription scope, with no exclusions configured.

A developer attempts to perform the following actions:
* Action 1: Create a virtual machine using the `Standard_D8s_v5` SKU and a tag named `DeptCode` in the `rg-operational-prod` resource group.
* Action 2: Create a virtual machine using the `Standard_B2s` SKU and a tag named `DeptCode` in the `rg-testing-dev` resource group.
* Action 3: Create a virtual machine using the `Standard_D16s_v5` SKU and no tags in the `rg-operational-prod` resource group.
* Action 4: Create a virtual machine using the `Standard_B2s` SKU and no tags in the `rg-testing-dev` resource group.

Which of the actions will succeed? (Select two)

Select all that apply

Show answer & explanation

Answer: Action 1; Action 2

Answer

The actions that will succeed are Action 1 and Action 2.
The actions that succeed are Action 1 and Action 2. In Action 1, the virtual machine meets both policy conditions (the SKU is permitted, and the DeptCode tag is present). In Action 2, the target resource group (rg-testing-dev) is excluded from the SKU restriction (Assignment 1), meaning the Standard_B2s SKU is allowed, and the deployment satisfies the tagging requirement (Assignment 2) by including the DeptCode tag.

Step-by-Step Solution

1
Evaluate Action 1 against the active policy assignments for rg-operational-prod.
The target resource group rg-operational-prod inherits both Assignment 1 and Assignment 2. The virtual machine uses the allowed Standard_D8s_v5 SKU (satisfying Assignment 1) and contains the required DeptCode tag (satisfying Assignment 2). Action 1 succeeds.
To verify if the deployment succeeds, the resource must satisfy all policies applied to its scope and parent scopes.
2
Evaluate Action 2 against the active policy assignments for rg-testing-dev.
The target resource group rg-testing-dev is excluded from Assignment 1, meaning the SKU restriction does not apply. It still inherits Assignment 2, which requires the DeptCode tag. Since the tag is present, Action 2 succeeds.
Policy exclusions prevent the policy rules of a specific assignment from being evaluated against resources at that excluded scope.
3
Evaluate Action 3 against the active policy assignments for rg-operational-prod.
Although the SKU Standard_D16s_v5 is allowed under Assignment 1, the deployment fails because the virtual machine lacks the required DeptCode tag mandated by Assignment 2.
Azure Policies are cumulative; failing any single policy with a Deny effect blocks the entire resource deployment.
4
Evaluate Action 4 against the active policy assignments for rg-testing-dev.
Even though Assignment 1's SKU restriction is bypassed due to the exclusion, Assignment 2 still applies because there are no exclusions configured for Assignment 2. Since the resource lacks the DeptCode tag, Action 4 fails.
An exclusion on one policy assignment does not exempt the resource from other assignments targeting the same scope.

Key Concept

Azure Policy assignment inheritance, cumulative evaluation of Deny policies, and scope-specific exclusions.
Estimated Time:2m 30s
Question 348Question →

Zenith Trading plans to deploy a critical line-of-business application on Azure virtual machines in the East US 2 region. The application infrastructure must survive a local datacenter-wide outage and maintain a minimum virtual machine uptime SLA of 99.99%99.99\%. Which deployment configuration should you use to meet these requirements?

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones in the region.

Answer

Deploy the virtual machines across two or more Availability Zones in the region.
Deploying virtual machines across different Availability Zones ensures they are located in physically separate datacenters within the region. This isolates them from datacenter-wide failures (such as power, cooling, or structural outages) and meets the 99.99%99.99\% virtual machine uptime SLA requirement.

Step-by-Step Solution

1
Analyze the high availability requirements.
The application must survive a datacenter-wide outage and require a 99.99%99.99\% virtual machine uptime SLA.
This establishes that logical isolation within a single datacenter (which only provides a 99.95%99.95\% SLA) is insufficient.
2
Evaluate the capabilities of Azure Availability Zones.
Availability Zones consist of physically separate datacenters within an Azure region, protecting against datacenter-level failures and yielding a 99.99%99.99\% SLA when two or more VMs are deployed across zones.
This aligns perfectly with both the outage survival and SLA requirements.
3
Evaluate the capabilities of Azure Availability Sets.
Availability Sets deploy VMs across different hardware racks (fault and update domains) within a single datacenter, protecting against localized hardware failure but not datacenter-wide outages.
This rules out options utilizing Availability Sets as a solution for datacenter-wide protection.

Key Concept

Azure Availability Zones protect applications and data from datacenter failures by placing virtual machines in physically unique locations within a region, providing a 99.99%99.99\% VM uptime SLA.
Question 349Question →

You are planning the deployment of several Azure virtual machines (VMs) for different workloads. Match each workload requirement to the appropriate Azure VM configuration feature.

Click a left item, then click its matching right item

Items

Deploy application and database VMs physically close to each other to minimize inter-VM network latency.
Run VM workloads on dedicated physical hardware that is not shared with other Azure customer subscriptions.
Provision stateless VMs with high-speed local OS disks that incur no remote storage transaction costs.
Run batch processing jobs that can tolerate sudden VM evictions in exchange for significant cost savings.

Matches

Show answer & explanation

Answer

Each workload requirement matches to a specific Azure VM feature: lowest latency requires a Proximity Placement Group, dedicated hardware requires an Azure Dedicated Host, stateless VMs with no storage cost require an Ephemeral OS disk, and interruptible workloads with cost savings require an Azure Spot Virtual Machine.
Each workload requirement maps to a specific VM configuration: proximity placement groups minimize inter-VM network latency; dedicated hosts satisfy strict hardware isolation requirements; ephemeral OS disks run on local storage for stateless workloads at zero remote storage cost; and spot VMs offer discounted rates for interruptible workloads.

Step-by-Step Solution

1
Analyze the low-latency workload requirement.
Identify that Proximity Placement Groups are logical groupings used to ensure that Azure compute resources are physically located close to each other to minimize network latency.
This directly aligns the low latency requirement to the Proximity Placement Group feature.
2
Analyze the isolated hardware compliance requirement.
Identify that Azure Dedicated Host provides physical servers dedicated to a single Azure subscription to address compliance and isolation standards.
This links dedicated hardware requirements with the Dedicated Host service.
3
Analyze the stateless VM storage cost requirement.
Identify that Ephemeral OS disks run on the local VM storage (cache or temp disk) and incur no remote storage costs while providing fast local read/write capabilities.
This matches the local OS disk and cost avoidance requirement to Ephemeral OS disks.
4
Analyze the fault-tolerant cost-reduction requirement.
Identify that Azure Spot Virtual Machines allow you to take advantage of unused capacity at a significant cost reduction but can be evicted when Azure needs the capacity back.
This aligns interruptible workloads with Azure Spot VMs.

Key Concept

Azure Virtual Machine creation and configuration options including Proximity Placement Groups, Dedicated Hosts, Ephemeral OS disks, and Spot VMs.
Question 350Question →

An administrator needs to configure permissions for a developer named User1 to access blob data in a storage account named devstorage99. The developer must be able to read blobs using Microsoft Entra ID authentication.

Which two built-in Azure role-based access control (RBAC) roles should the administrator assign to User1 to permit this data access? (Select two)

Select all that apply

Show answer & explanation

Answer: Storage Blob Data Reader; Storage Blob Data Contributor

Answer

Storage Blob Data Reader and Storage Blob Data Contributor
To read blob data using Microsoft Entra ID authentication, a user must be assigned an Azure RBAC role that operates on the data plane. The Storage Blob Data Reader role allows read-only access to blobs. The Storage Blob Data Contributor role allows read, write, and delete access to blobs, which also satisfies the requirement to read blobs.

Step-by-Step Solution

1
Identify the data plane requirements for Azure Storage blob access.
The user needs to read blob data, which requires data-plane RBAC permissions.
Control-plane roles like Reader or Storage Account Contributor do not grant permissions to read or write data inside containers.
2
Evaluate the built-in Azure Storage data-plane roles.
Storage Blob Data Reader provides read-only access to blob data, and Storage Blob Data Contributor provides read and write access to blob data.
Both roles satisfy the requirement to read blob data using Microsoft Entra ID authentication.

Key Concept

Azure RBAC Control Plane vs Data Plane for Storage Accounts
Question 351Question →

You are configuring an Azure Virtual Machine Scale Set (VMSS) named `vmss-processor` that processes messages from an Azure Service Bus queue. The VMSS is configured with the following parameters:
- Orchestration mode: Flexible
- Upgrade policy: Manual
- Current instance count: 4
- Scale-in policy: Default

You need to configure autoscale rules to meet the following requirements:
1. Scale out by 2 instances when the average queue depth exceeds 1,000 messages.
2. Scale in by 1 instance when the average queue depth falls below 200 messages.
3. Prevent instance thrashing (frequent, consecutive scale-out and scale-in actions).

Which of the following configurations should you apply to the autoscale rules? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the scale-out rule with a threshold of 1,000 messages and the scale-in rule with a threshold of 200 messages.; Configure a cooldown period of 10 minutes for both the scale-out and scale-in rules.

Answer

To configure the VMSS autoscale rules correctly, you should configure the scale-out threshold to 1,000 messages and the scale-in threshold to 200 messages, and configure a cooldown period of 10 minutes for both rules.
Establishing a wide gap between the scale-out threshold of 1,000 messages and the scale-in threshold of 200 messages prevents rapid fluctuations in queue depth from triggering conflicting scale actions. Additionally, setting a cooldown period of 10 minutes ensures that Azure Monitor allows the VMSS to stabilize and the queue metrics to catch up after a scale action before evaluating the rules again.

Step-by-Step Solution

1
Analyze the scaling thresholds to prevent thrashing.
Identify that the scale-out threshold is 1,000 messages and the scale-in threshold must be significantly lower, such as 200 messages.
If the thresholds are set too close to each other, the added processing capacity from a scale-out event will immediately lower the queue depth below the scale-in threshold, initiating an loop of constant instance provisioning and deprovisioning.
2
Determine the appropriate cooldown settings for the autoscale rules.
Set a cooldown period (e.g., 10 minutes) for both rules.
The cooldown period prevents the scale set from executing consecutive scaling decisions without giving the newly created or remaining instances enough time to start up and stabilize the workload metrics.

Key Concept

Virtual Machine Scale Set (VMSS) Autoscale Rules and Thrashing Prevention
Question 352Question →

You manage an Azure App Service web app named App1 that is hosted on a Basic (B1) App Service plan named ASP1. You need to configure App1 to automatically scale out up to a maximum of 8 instances when the average CPU utilization exceeds 80%. What should you do first?

Show answer & explanation

Answer: Scale up ASP1 to the Standard (S1) pricing tier.

Answer

Scale up ASP1 to the Standard (S1) pricing tier.
Scaling up the App Service plan to the Standard (S1) pricing tier is required because the current Basic (B1) tier does not support autoscaling and is restricted to a maximum of 3 instances under manual scaling. The Standard tier is the lowest-cost tier that supports autoscale rules and up to 10 instances, making it the correct first action.

Step-by-Step Solution

1
Analyze the current tier capabilities.
The web app is hosted on a Basic (B1) App Service plan, which is limited to manual scaling up to 3 instances.
To determine if the current plan can meet the requirements of autoscaling and scaling up to 8 instances.
2
Determine the requirements for autoscaling and instance count.
The requirements are: 1) automatic scaling based on CPU, and 2) a maximum instance count of 8.
To evaluate which App Service pricing tiers support these specific configurations.
3
Select the lowest-cost tier that meets all requirements.
The Standard (S1) tier supports autoscale and up to 10 instances, while Basic (B1) and Shared (D1) do not.
To satisfy the scaling needs at the minimum possible cost.

Key Concept

App Service Plan scaling tiers and resource limits
Question 353Question →

A team configures an Azure resource group named `rg-billing-prod` by assigning a tag named `CostCenter: IT` and configuring a `CanNotDelete` lock on the resource group. The team then deploys a virtual network named `vnet-prod-01` inside `rg-billing-prod`.

What is the status of the tag and the resource lock on `vnet-prod-01`?

Show answer & explanation

Answer: The virtual network inherits the CanNotDelete lock, but it does not inherit the CostCenter tag.

Answer

The virtual network inherits the CanNotDelete lock, but it does not inherit the CostCenter tag.
In Azure, resource locks (such as CanNotDelete) are inherited by all child resources under the scope where the lock is applied. Therefore, the virtual network inherits the CanNotDelete lock. However, tags applied to a resource group are not automatically inherited by the resources inside it.

Step-by-Step Solution

1
Determine lock inheritance behavior.
The virtual network inherits the CanNotDelete lock.
Azure resource locks apply to the scope they are set on and are automatically inherited by all child resources.
2
Determine tag inheritance behavior.
The virtual network does not inherit the CostCenter tag.
Tags applied to a resource group are not inherited by resources inside that resource group.

Key Concept

Resource lock inheritance versus tag non-inheritance in Azure resource groups
Question 354Question →

You have an Azure App Service web app named WebApp1 that is hosted on a Basic (B1) App Service plan. You need to configure a custom domain name for WebApp1 and enable daily automated backups of the web application. Which action should you perform first?

Show answer & explanation

Answer: Scale up the App Service plan to the Standard tier.

Answer

Scale up the App Service plan to the Standard tier.
Scaling up the App Service plan to the Standard tier is correct because the Standard tier is the minimum pricing tier that supports automated backups of Azure App Service web apps. While the Basic (B1) tier supports custom domains, it does not support backups.

Step-by-Step Solution

1
Evaluate the current tier requirements for App Service features.
The web app is hosted on a Basic (B1) plan, which supports custom domains but does not support automated backups.
Native automated backups in Azure App Service require a minimum tier of Standard (S1) or higher.
2
Determine the correct scaling direction to unlock features.
Scaling up (vertical scaling) to the Standard tier is required.
Scaling up changes the pricing tier and unlocks advanced features like backups and deployment slots, whereas scaling out only increases instance count.

Key Concept

Azure App Service plan tier features and scaling
Question 355Question →

An administrator is deploying a new Azure virtual machine named VM1 in the West US 2 region. The deployment must meet the following requirements:

- Protect the virtual machine against datacenter-level failures.
- Automatically install a web server role immediately after the virtual machine is provisioned.

Which two configurations should the administrator select? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM1 to an Availability Zone.; Configure the Custom Script Extension on VM1.

Answer

Deploy the virtual machine to an Availability Zone, and configure the Custom Script Extension on the virtual machine.
Deploying the virtual machine to an Availability Zone ensures that the virtual machine is located in a physically separate datacenter facility within the region, providing protection against datacenter-level failures. Using the Custom Script Extension allows the administrator to automatically run a script (e.g., to install IIS or Apache) once the VM is provisioned.

Step-by-Step Solution

1
Analyze the high-availability requirement to protect VM1 against datacenter-level failures.
Identify that Availability Zones provide physical separation of datacenters within an Azure region, protecting against datacenter-level outages. Availability Sets only protect against localized hardware failures within a single datacenter.
This determines the correct redundancy option.
2
Analyze the automation requirement to install a web server role immediately after VM1 is provisioned.
Identify that the Custom Script Extension is the correct VM extension to run post-deployment scripts, such as software installations or system configuration.
This determines the correct VM extension option.

Key Concept

Configuring Azure Virtual Machines for high availability (Availability Zones vs Availability Sets) and post-deployment automation using VM extensions.
Estimated Time:45s
Question 356Question →

Your company has an Azure environment that contains a management group named Tenant-MG. Tenant-MG contains an Azure subscription named Sub1. Inside Sub1, there is a resource group named RG-App.

You have a Microsoft Entra ID security group named App-Admins.

You need to ensure that members of App-Admins can manage Azure RBAC role assignments for resources within RG-App. The solution must follow the principle of least privilege and prevent App-Admins from managing role assignments for other resource groups in Sub1 or modifying the configuration of resources within RG-App.

Which administrative action should you perform?

Show answer & explanation

Answer: Assign the User Access Administrator role to App-Admins at the RG-App scope.

Answer

Assign the User Access Administrator role to App-Admins at the RG-App scope.
Assigning the User Access Administrator role at the RG-App scope is correct because the User Access Administrator role specifically grants the authorization actions needed to manage Azure RBAC role assignments without granting contributor or owner access to the resources. Applying this at the resource group scope ensures that permissions are constrained only to resources within that specific group, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the required permissions for managing role assignments.
The action requires Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/roleAssignments/delete permissions.
This determines which roles are capable of managing access control.
2
Select the built-in role that satisfies these permissions with least privilege.
The User Access Administrator role allows managing role assignments but does not grant access to modify the resources themselves, whereas Owner would grant both.
To adhere to the principle of least privilege and meet the constraint that configuration changes are prohibited.
3
Determine the appropriate scope for the role assignment.
The assignment must be at the RG-App scope.
Assigning at the subscription level would inherit down to other resource groups, violating the scope restriction requirement.

Key Concept

Azure RBAC roles allow delegating specific management duties like access control separately from resource configuration management, and the scope of these assignments controls the boundary of the delegated permissions.
Question 357Question →

You need to implement a hybrid file distribution solution using Azure File Sync. The environment consists of a local Windows Server 2025 file server and an Azure storage account containing an empty file share. You must deploy Azure File Sync to synchronize the local folder with the Azure file share. Which sequence of steps should you perform to complete the deployment and start synchronization?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Deploy the Storage Sync Service, install the Azure File Sync agent on the local Windows Server, register the server with the Storage Sync Service, create a Sync Group and add the Azure file share as a cloud endpoint, and then create a server endpoint representing the local directory.
The correct deployment sequence starts with creating the Storage Sync Service in Azure. Next, you install the agent on the Windows Server and register that server to the Storage Sync Service. After the server is registered, you create a Sync Group and define the cloud endpoint (Azure file share). Finally, you add the server endpoint mapping the local folder to start synchronization.

Step-by-Step Solution

1
Deploy the Storage Sync Service resource in Azure.
A top-level Storage Sync Service is available in the Azure subscription to manage the sync topology.
You must establish the cloud management infrastructure before attempting to connect on-premises servers.
2
Install the Azure File Sync agent on the local Windows Server.
The File Sync agent services and command-line tools are installed on the local operating system.
The server requires the agent binaries to communicate and coordinate sync activities with Azure.
3
Register the Windows Server with the Storage Sync Service.
The server is registered and appears in the Registered Servers list of the Storage Sync Service.
This establishes trust between the local server and the Azure Storage Sync Service resource.
4
Create a Sync Group and add the cloud endpoint (Azure file share).
A Sync Group is established with the Azure file share acting as the master repository.
The cloud endpoint defines where the synced data resides in Azure and must be configured before local endpoints are mapped.
5
Create a server endpoint inside the Sync Group.
The local folder path is mapped as a server endpoint, initiating synchronization between the server and the cloud.
This finalizes the sync path, triggering the actual replication of files.

Key Concept

Azure File Sync deployment order requires establishing the Azure-side management resource, preparing and registering the server, defining the sync group topology with a cloud endpoint, and lastly establishing the server endpoint.
Question 358Question →

An administrator needs to configure secure private access to the blob service of an Azure Storage account named `ststorage1` from a virtual network named `VNet1`. The storage account must not be accessible over the public internet.

Which five actions should the administrator perform in sequence? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: 1. Create a Private DNS zone named `privatelink.blob.core.windows.net`. 2. Link the Private DNS zone to the virtual network `VNet1`. 3. Create a private endpoint in `VNet1` targeting the blob sub-resource of `ststorage1`. 4. Integrate the private endpoint with the Private DNS zone `privatelink.blob.core.windows.net`. 5. Configure the firewalls and virtual networks settings of `ststorage1` to disable public network access.
To secure private access to an Azure Storage account using a Private Endpoint, you first create the Private DNS zone `privatelink.blob.core.windows.net`. Next, you link this Private DNS zone to the virtual network so clients in the network can resolve names using it. You then create the private endpoint itself in the virtual network. Once created, you integrate it with the Private DNS zone to register the DNS A records. Finally, you disable public network access on the storage account to enforce that all connections must go through the private endpoint.

Step-by-Step Solution

1
Create the Private DNS zone named `privatelink.blob.core.windows.net`.
The Private DNS zone is created in Azure.
The zone must exist before it can be linked to the virtual network or integrated with the private endpoint.
2
Link the Private DNS zone to `VNet1`.
The Private DNS zone is linked to the virtual network.
This enables DNS resolution of the private link domain name from within the virtual network.
3
Create the private endpoint in a subnet of `VNet1`.
A private endpoint is deployed with a private IP address.
This establishes physical network connectivity between the virtual network and the storage account.
4
Integrate the private endpoint with the Private DNS zone.
The DNS A record is registered in the Private DNS zone.
This ensures that DNS requests to the storage account from the virtual network resolve to the private endpoint's private IP instead of its public IP.
5
Disable public network access on the storage account.
Public network access is blocked, securing the storage account.
Once private access is established and DNS resolution is verified, public access can be disabled to complete the security configuration.

Key Concept

Azure Private Endpoint and Private DNS integration for Azure Storage
Question 359Question →

You plan to implement group-based licensing for a set of new users in a Microsoft Entra ID tenant. You need to configure the group-based licensing workflow and ensure any potential license assignment issues are addressed. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To implement group-based licensing, you must first create a Microsoft Entra ID security group, assign the licenses to that group, add the target users to the group, and finally verify and resolve any license assignment errors.
The correct sequence begins with creating the Microsoft Entra ID security group, followed by assigning the license to the group. Once the group is licensed, adding the users to the group triggers the automatic assignment engine. Finally, the administrator verifies the licensing status and resolves any assignment errors, such as users with missing usage locations.

Step-by-Step Solution

1
Create a Microsoft Entra ID security group.
A security group is created to act as the licensing container.
Licenses in Microsoft Entra ID are assigned to groups, which must exist before they can be configured.
2
Assign the licenses to the security group.
The licenses are configured on the group level, specifying which services are enabled.
Configuring licenses on the group before adding users ensures immediate license propagation upon membership.
3
Add the target users as members of the security group.
Users inherit the group's licenses.
Group membership triggers the Microsoft Entra ID group-based licensing engine.
4
Verify the license assignment status and resolve any assignment errors.
Any errors, such as missing usage locations or license conflicts, are identified and fixed.
License assignment errors are only generated and visible after the system attempts to assign licenses to the group members.

Key Concept

Group-based licensing configuration and troubleshooting workflow in Microsoft Entra ID.
Question 360Question →

Your organization has an Azure subscription containing a resource group named rg-finance. The resource group contains an Azure Storage account named stfinance2026. Inside stfinance2026, there is a blob container named audits. A security auditor named User1 needs to use the Azure portal to navigate to the storage account, view its configurations, and download reports from the audits container. User1 must authenticate using Microsoft Entra ID. Access keys and Shared Access Signatures (SAS) must be disabled and not used. You need to grant User1 the necessary access using the principle of least privilege. Which combination of Azure role assignments should you configure?

Show answer & explanation

Answer: Assign the Reader role at the scope of the stfinance2026 storage account, and assign the Storage Blob Data Reader role at the scope of the audits container.

Answer

Assign the Reader role at the scope of the stfinance2026 storage account, and assign the Storage Blob Data Reader role at the scope of the audits container.
The correct configuration provides the minimum necessary permissions. Navigating the Azure portal to view the storage account configuration requires a control plane role, which is satisfied by the Reader role at the storage account scope. Downloading blobs requires data-plane access via Microsoft Entra ID, which is satisfied by the Storage Blob Data Reader role at the specific container scope.

Step-by-Step Solution

1
Determine the control plane access requirements.
User1 needs to navigate to the storage account in the Azure portal. This requires control plane access, which is provided by the Reader role at the storage account level.
Control plane roles are necessary to view Azure Resource Manager (ARM) resources in the portal.
2
Determine the data plane access requirements.
User1 needs to download reports from the audits container. Since Microsoft Entra ID authentication is required and access keys are disabled, User1 needs the Storage Blob Data Reader role at the audits container scope.
Data plane roles are required to access blob storage content when using Microsoft Entra ID authentication.
3
Apply the principle of least privilege.
Assign Reader at the storage account level (rather than the resource group level) and Storage Blob Data Reader at the container level (rather than the storage account level).
This restricts control and data plane permissions to the smallest possible scopes that satisfy the requirement.

Key Concept

Azure RBAC splits control plane (management) and data plane (content) access. Storage data access via Microsoft Entra ID requires data-plane roles like Storage Blob Data Reader, while navigating the portal requires control-plane roles like Reader.
Estimated Time:2m 30s
PreviousPage 18 / 63Next