Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 361Question →

You plan to configure continuous deployment for an Azure App Service web app named WebApp1 from a repository hosted on GitHub. You need to configure the connection using GitHub Actions. Which sequence of administrative steps should you perform in the Azure portal? Move the steps from the list of steps to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Navigate to the Deployment Center blade of the App Service web app, select GitHub as the source and authorize the connection, select the organization, repository, branch, and build provider, and then save the configuration settings.
To set up continuous deployment, you first need to go to the Deployment Center blade in the Azure portal. You must then select GitHub and authorize Azure to connect to your account. After authorization, you specify the target repository, branch, and build provider. Saving the configuration completes the setup by automatically committing the required GitHub Actions workflow file to your repository.

Step-by-Step Solution

1
Navigate to the Deployment Center blade
Deployment settings interface is displayed.
This is where all continuous integration and continuous deployment (CI/CD) settings are configured.
2
Select GitHub and authorize the account
Azure is granted access to the user's GitHub repositories.
Azure must verify permissions to read repository data and write files to the repository.
3
Select repository and build settings
The target repository branch and build provider are mapped.
Specifies exactly which code to build and deploy when changes are pushed.
4
Save the settings
The workflow YAML file is committed to the GitHub repository.
Saving the configuration triggers the automatic generation and commit of the GitHub Actions workflow.

Key Concept

Azure App Service continuous deployment integration with GitHub Actions
Estimated Time:1m 0s
Question 362Question →

Aether Dynamics has an Azure subscription named sub-aether-prod. You deploy an Azure Storage account named sa-aether-data and an Azure Key Vault named kv-aether-keys. To comply with security standards, all data stored in sa-aether-data must be encrypted using customer-managed keys (CMK). You configure a user-assigned managed identity named uami-storage-enc. The key vault is configured with retention and purge prevention settings active, and uses the Vault access policy permission model. You configure sa-aether-data to use CMK and select uami-storage-enc as the encryption identity. However, when you attempt to save the configuration, the operation fails with an access denied error. What is the most likely cause of this failure?

Show answer & explanation

Answer: The vault access policy for kv-aether-keys is configured to grant Get, Wrap Key, and Unwrap Key permissions to the system-assigned managed identity of sa-aether-data, but no permissions are assigned to uami-storage-enc.

Answer

The vault access policy for kv-aether-keys is configured to grant Get, Wrap Key, and Unwrap Key permissions to the system-assigned managed identity of sa-aether-data, but no permissions are assigned to uami-storage-enc.
When a storage account is configured to use customer-managed keys (CMK) with a user-assigned managed identity, that specific user-assigned identity (not the system-assigned identity) must be granted the required Key Vault data-plane permissions (Get, Wrap Key, and Unwrap Key) in the Key Vault access policies. If permissions are granted to the system-assigned identity instead, the storage account will fail to authenticate using the configured user-assigned identity, resulting in an access denied error.

Step-by-Step Solution

1
Identify the identity configured for customer-managed key encryption on the storage account.
The encryption is configured to use the user-assigned managed identity named uami-storage-enc.
The correct identity must be identified to verify its permissions on the Key Vault.
2
Analyze the permission model and configuration of the Key Vault.
The Key Vault uses the Vault access policy permission model and has retention/purge prevention active.
This indicates that key permissions must be assigned via Key Vault access policies (Get, Wrap Key, Unwrap Key) directly to the configured identity.
3
Evaluate why the access denied error occurred during configuration.
The permissions were granted to the storage account's system-assigned managed identity rather than the selected user-assigned identity uami-storage-enc.
An identity without the required data-plane permissions cannot perform the necessary cryptographic operations on the Key Vault keys.

Key Concept

Configure Storage Encryption and Customer-Managed Keys
Estimated Time:2m 30s
Question 363Question →

You plan to deploy a new Azure virtual machine named VM1. You have an existing Recovery Services Vault named Vault1 located in the East US region. You must ensure that VM1 can be backed up to Vault1. Which configuration setting must you select for VM1 during its creation?

Show answer & explanation

Answer: Region: East US

Answer

Region: East US
The correct answer is the option specifying the East US region. To back up an Azure virtual machine using a Recovery Services Vault, both the virtual machine and the vault must reside in the same Azure region.

Step-by-Step Solution

1
Identify the region of the existing Recovery Services Vault (Vault1).
Vault1 is located in the East US region.
Azure Backup requires that the Recovery Services Vault and the target virtual machine be located in the same geographical region to enable backup protection.
2
Determine the required region setting for VM1.
VM1 must be deployed in the East US region.
Deploying the VM in any other region (such as West US or East US 2) prevents it from being registered with or backed up to Vault1.

Key Concept

Recovery Services Vault region alignment during virtual machine creation
Estimated Time:1m 30s
Question 364Question →

An organization implements an Azure governance model with the following hierarchy and configuration:

* A management group named `Tenant-MG` contains a child management group named `Biz-MG`.
* `Biz-MG` contains a subscription named `Sub-Finance`.
* `Sub-Finance` contains two resource groups named `RG-Prod` and `RG-Dev`.

The following policy assignments are applied:

* At `Biz-MG`, an Azure Policy Initiative named `Governance-Initiative` is assigned. An exclusion is configured on this assignment for the scope of `RG-Dev`. The initiative contains two policy definitions:
* A policy that denies the creation of resources without the tag `Env`.
* A policy that denies the creation of Storage Accounts unless the SKU is `Standard_LRS` or `Standard_GRS`.
* At `Sub-Finance`, a policy named `SKU-Limit-Policy` is assigned that denies the creation of Storage Accounts unless the SKU is `Standard_LRS`.

An administrator attempts to perform several deployments. Which deployment action will succeed?

Show answer & explanation

Answer: Creating a Storage Account with the Standard_LRS SKU and no tags in RG-Dev

Answer

Creating a Storage Account with the Standard_LRS SKU and no tags in RG-Dev
Creating a Storage Account with the Standard_LRS SKU and no tags in RG-Dev is the only successful action. The management group level assignment of Governance-Initiative contains an exclusion for RG-Dev, meaning the tag requirement does not apply to this resource group. However, RG-Dev still inherits SKU-Limit-Policy from the subscription level, which allows the Standard_LRS SKU. Since the deployment meets the Standard_LRS SKU requirement and is exempt from the tag policy, it succeeds.

Step-by-Step Solution

1
Evaluate the management group policy assignment (Governance-Initiative) for the target resource group.
For RG-Dev, the policy initiative is not evaluated because RG-Dev is explicitly configured as an exclusion on the assignment. For RG-Prod, the policy initiative is active and enforces both the Env tag requirement and the SKU restriction (Standard_LRS or Standard_GRS).
Policy exclusions prevent the assignment from applying to the specified scope and any of its children.
2
Evaluate the subscription policy assignment (SKU-Limit-Policy) for the target resource group.
Both RG-Prod and RG-Dev inherit the SKU-Limit-Policy from Sub-Finance. This policy restricts all Storage Account creations to the Standard_LRS SKU.
Azure Policies are inherited by all child resources and scopes beneath the assignment level unless an explicit exclusion is defined.
3
Analyze each deployment action against the combined policy compliance results.
Creating a Storage Account with Standard_LRS and no tags in RG-Dev is the only successful action because the management group's tag requirement is bypassed via the exclusion, and the SKU matches the subscription's allowed SKU.
All active Deny policies across all inherited scopes must evaluate to allowed for a deployment to succeed.

Key Concept

Azure Policy evaluation order, inheritance, and exclusions
Question 365Question →

An administrator is designing the deployment of a new virtual machine named `VM-Prod-DB` to host a database. The database requires storage that supports up to 90,00090,000 IOPS and sub-millisecond latency. Additionally, the database must be protected against datacenter-level outages. The administrator must also ensure that:

1. `VM-Prod-DB` is backed up daily to an existing Recovery Services Vault named `RSV-Prod-01` located in the East US 2 region.
2. `VM-Prod-DB` is placed in the backend pool of a public load balancer.

Which of the following configurations should the administrator select to deploy `VM-Prod-DB` successfully?

Show answer & explanation

Answer: Deploy the virtual machine in the East US 2 region, select an Availability Zone, enable Ultra Disk compatibility, and associate the virtual machine with a Standard SKU load balancer.

Answer

Deploy the virtual machine in the East US 2 region, select an Availability Zone, enable Ultra Disk compatibility, and associate the virtual machine with a Standard SKU load balancer.
To support the storage requirement of 90,00090,000 IOPS and sub-millisecond latency, Azure Ultra Disks must be used. Enabling Ultra Disk compatibility on a virtual machine requires selecting a supported size and deploying the VM in an Availability Zone (Availability Sets are not supported). Availability Zones also fulfill the requirement to protect the database against datacenter-level outages. Because the target Recovery Services Vault is located in the East US 2 region, the virtual machine must also be deployed in East US 2. Finally, a Standard SKU load balancer must be used because Basic SKU load balancers cannot have backend pools that contain virtual machines in Availability Zones.

Step-by-Step Solution

1
Determine the required region for the virtual machine based on backup constraints.
The virtual machine must be deployed in the East US 2 region.
Azure Recovery Services Vault backups are region-locked. Since the existing Recovery Services Vault is in East US 2, the virtual machine must reside in the same region to configure backup.
2
Identify the availability and disk requirements for the workload.
The virtual machine must use Availability Zones and have Ultra Disk compatibility enabled during creation.
Datacenter-level protection requires Availability Zones. Furthermore, hosting a database requiring 90,00090,000 IOPS and sub-millisecond latency requires Ultra Disks, which must be enabled at the virtual machine level during initial creation and are only supported when deploying in Availability Zones or as standalone VMs (Availability Sets are unsupported).
3
Verify load balancer SKU compatibility with the selected availability options.
The public load balancer must be a Standard SKU load balancer.
Basic SKU load balancers do not support backend pool members deployed in Availability Zones. Standard SKU is required to support zonal virtual machines.

Key Concept

Virtual machine deployment planning requiring alignment of storage performance (Ultra Disk compatibility and Availability Zone constraints), region dependencies (Recovery Services Vault constraints), and network SKU requirements (Load Balancer constraints).
Estimated Time:3m 0s
Question 366Question →

Orion FinTech plans to deploy a new web portal consisting of two virtual machines named VM-Web1 and VM-Web2 in the Japan East region. The deployment must guarantee a virtual machine SLA of at least 99.99%99.99\% and protect the application from datacenter-wide failures. You need to configure the compute and load balancing infrastructure. Which two options should you select? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM-Web1 and VM-Web2 in separate Availability Zones.; Deploy an Azure Standard Load Balancer to distribute traffic to the virtual machines.

Answer

Deploy the virtual machines in separate Availability Zones and deploy an Azure Standard Load Balancer to distribute traffic.
To meet the 99.99%99.99\% SLA requirement and protect against datacenter-wide outages, virtual machines must be deployed across separate Availability Zones. Additionally, routing traffic to these VMs across zones requires an Azure Standard Load Balancer, as the Basic SKU is not zone-aware.

Step-by-Step Solution

1
Analyze the high availability and SLA requirements.
The requirement demands a 99.99%99.99\% SLA and protection against datacenter-wide outages.
This level of resilience can only be met by distributing VMs across physically separate datacenter locations, which corresponds to Azure Availability Zones.
2
Select the VM deployment target.
Select separate Availability Zones for VM-Web1 and VM-Web2 instead of an Availability Set.
Availability Sets limit VMs to a single datacenter (SLA 99.95%99.95\%), whereas Availability Zones distribute them across datacenters (SLA 99.99%99.99\%).
3
Determine the load balancer SKU required for the zonal deployment.
Choose a Standard Load Balancer.
Standard Load Balancer supports backend pools spanning multiple Availability Zones and provides zone redundancy, whereas the Basic Load Balancer does not support zonal deployments.

Key Concept

High availability configuration using Availability Zones and Standard Load Balancer
Question 367Question →

You plan to deploy a new virtual machine named `VM-DB-prod` in the East US region to host a database workload. The database requires storage capable of handling up to 80,00080,000 IOPS and 1,200 MB/s1,200\text{ MB/s} throughput. The deployment must meet the following requirements:
- Protect the database instance against datacenter-level failures in the region.
- Allow the addition of Ultra Disk managed disks to meet the performance targets.

Which configuration must you select during the virtual machine creation process to satisfy these requirements?

Show answer & explanation

Answer: Deploy the virtual machine in an Availability Zone and enable Ultra Disk compatibility.

Answer

Deploy the virtual machine in an Availability Zone and enable Ultra Disk compatibility.
Deploying the virtual machine in an Availability Zone provides physical separation and protection against datacenter-level failures. Enabling Ultra Disk compatibility on the VM during creation is a mandatory step that allows the VM to support attaching Ultra Disk managed disks later.

Step-by-Step Solution

1
Select a supported region and Availability Zone for the virtual machine during creation.
The VM is placed in a specific Availability Zone, satisfying the physical isolation and datacenter-level resiliency requirement since Availability Zones represent physically separate datacenters within a region.
Ultra Disks are zone-specific resources and require the virtual machine to be deployed in a supporting Availability Zone in that region.
2
Enable the Ultra Disk compatibility capability on the virtual machine configuration.
The virtual machine is provisioned with additional capabilities that allow Ultra Disk attachment.
Ultra Disks cannot be attached to a virtual machine unless the capability is explicitly enabled during the creation of the virtual machine.
3
Select a virtual machine size that supports Ultra Disks.
A supported series (e.g., Dsv5 or Esv5) is selected, ensuring compute and storage compatibility.
Not all virtual machine sizes support Ultra Disks.

Key Concept

Virtual machine storage compatibility and availability options during creation
Estimated Time:2m 30s
Question 368Question →

You are configuring security for an application that must retrieve log files from a blob container within an Azure Storage account named applogs. The application service principal requires read access to the logs using Microsoft Entra ID authentication, but must not be allowed to modify the blobs or manage the storage account metadata. Which built-in Azure role-based access control (RBAC) role is the most appropriate to assign to the service principal?

Show answer & explanation

Answer: Storage Blob Data Reader

Answer

Storage Blob Data Reader
The correct role is Storage Blob Data Reader because it grants read-only data plane access to Azure Blob storage containers, allowing the service principal to authenticate via Microsoft Entra ID and retrieve log files without modifying data or settings.

Step-by-Step Solution

1
Identify the data plane access requirement.
The application needs to read actual blob data inside the container rather than just managing storage account configuration settings (control plane).
This establishes that a data-plane RBAC role is required instead of a standard control-plane role.
2
Determine the principle of least privilege.
The application only requires read access (not write or delete) and should not manage the storage account itself.
This rules out Contributor or Owner variants of data-plane roles.
3
Select the appropriate built-in Azure RBAC role.
The Storage Blob Data Reader role provides read-only access to blob data via Microsoft Entra ID authentication.
It matches all requirements of the scenario under the principle of least privilege.

Key Concept

Separation of control plane and data plane permissions for Azure Storage using Microsoft Entra ID authentication
Question 369Question →

Your organization's Azure environment is structured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Security-MG (Management Group)
- Subscription1 (Subscription)
- RG-Secure (Resource Group)

You need to grant a security auditor named Auditor1 the ability to view all resources and access control assignments within RG-Secure. Auditor1 must not be able to modify any resources or manage access control assignments.

Which role should you assign to Auditor1 to meet the requirement under the principle of least privilege?

Show answer & explanation

Answer: Reader assigned at the RG-Secure scope

Answer

Reader assigned at the RG-Secure scope
The Reader role at the RG-Secure scope allows the auditor to view all resources and access control configurations in that specific resource group without modifying them or inheriting broader permissions from higher scopes, adhering to the principle of least privilege.

Step-by-Step Solution

1
Determine the required access levels.
The requirement is read-only access (viewing resources and access control assignments) without write or management permissions.
This points to the built-in Reader role, which permits read operations but no write or action operations.
2
Identify the correct scope according to the principle of least privilege.
The target scope is the resource group RG-Secure, rather than the entire Subscription1 or Security-MG.
Assigning permissions at the resource group level ensures the user only has access to the specified resources, not the entire subscription.
3
Verify if Microsoft Entra ID roles are appropriate.
Directory roles like Global Reader do not grant control plane access to subscription resources by default.
Azure RBAC roles and Microsoft Entra ID roles operate on different control planes, and Azure RBAC is required here.

Key Concept

Azure RBAC Built-in Roles and Scopes
Estimated Time:1m 0s
Question 370Question →

A company implements network-level security on an Azure Storage account named stdata2026. The storage account's network access is set to 'Enabled from selected virtual networks and IP addresses', and the virtual network VNet-App and subnet Subnet-Web are added to the allowed networks list. However, virtual machines running inside Subnet-Web are unable to access the storage containers in stdata2026. You need to resolve this issue and allow the virtual machines to access the storage account over the Azure backbone network. Which configuration should you perform on Subnet-Web?

Show answer & explanation

Answer: Configure the service endpoint settings for Microsoft.Storage on the subnet properties.

Answer

Configure the service endpoint settings for Microsoft.Storage on the subnet properties.
For a storage account configured with a firewall that restricts access to a specific virtual network subnet, the subnet must have the Microsoft.Storage service endpoint enabled. This ensures that the traffic originating from the subnet is routed with its virtual network identity intact so the storage account firewall can validate and permit the request.

Step-by-Step Solution

1
Analyze the network configuration of the storage account.
The storage account firewall is configured to restrict access to selected virtual networks, specifically Subnet-Web.
When access is restricted to selected networks, the storage account expects incoming traffic to carry the virtual network and subnet identifier.
2
Identify the missing requirement on the subnet level.
The Subnet-Web subnet does not have the Microsoft.Storage service endpoint enabled.
Without the service endpoint enabled on the subnet, traffic to the storage account is sent using public IP routing rather than virtual network routing, causing the storage account firewall to reject it.
3
Enable the service endpoint on the subnet.
The virtual machines in Subnet-Web can now successfully authenticate and access the storage account over the Azure backbone network.
Enabling the Microsoft.Storage service endpoint configures the subnet to inject the virtual network ID into the route header, satisfying the storage account's network access rules.

Key Concept

Azure Storage Account Network Security and Service Endpoints
Question 371Question →

An organization's Azure environment features a management group named `MG-Global` that contains two subscriptions: `Sub-APAC` and `Sub-EMEA`. A storage account named `stglobalcosts` is located in a resource group named `rg-reporting` inside the `Sub-APAC` subscription.

You need to configure a daily export of the combined cost data for both subscriptions to the `stglobalcosts` storage account.

What should you do?

Show answer & explanation

Answer: Configure a single cost export at the `MG-Global` management group scope, and select `stglobalcosts` as the destination.

Answer

Configure a single cost export at the `MG-Global` management group scope, and select `stglobalcosts` as the destination.
Azure Cost Management exports can be configured at the management group scope. This allows combined cost data from all subscriptions under the management group to be exported to a single storage account within the same Microsoft Entra tenant.

Step-by-Step Solution

1
Identify the target scope to aggregate cost data from both subscriptions.
The target scope must be the parent management group, `MG-Global`, which encompasses both `Sub-APAC` and `Sub-EMEA` subscriptions.
Creating exports at the individual subscription level would require managing multiple export schedules and manually merging separate output datasets.
2
Select the destination storage account for the export.
Choose the `stglobalcosts` storage account located within `Sub-APAC`.
Azure Cost Management exports configured at the management group scope can write to any storage account in the same tenant, regardless of which subscription hosts the storage account.
3
Evaluate the impact of subscription-level configurations such as locks.
Ensure no `ReadOnly` resource locks are applied to the subscription containing the destination storage account.
A `ReadOnly` lock would inherit down to the storage account, preventing the Cost Management export service from writing new data files to it.

Key Concept

Azure Cost Management Export scopes and storage destinations
Question 372Question →

You have an Azure App Service web app named WebApp1 that is hosted on a Standard (S1) App Service plan. WebApp1 has a production slot and a deployment slot named Staging. You need to configure the deployment slots to meet the following requirements:
- The database connection string must always point to the production database for the production slot, and to the staging database for the Staging slot, even after a slot swap is performed.
- A subset of users must be automatically routed to the Staging slot without requiring manual URL changes or custom cookies.

Which two configuration actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Select the Deployment slot setting option for the database connection string in both slots.; In the Deployment slots blade of the web app, set the Traffic % value of the Staging slot to a non-zero percentage.

Answer

To meet the requirements, you must select the Deployment slot setting option for the database connection string in both slots, and set the Traffic % value of the Staging slot to a non-zero percentage in the Deployment slots blade of the web app.
Selecting the Deployment slot setting option ensures that the connection string remains with its respective slot and does not swap during a deployment slot swap. Setting the Traffic % value of the Staging slot to a non-zero percentage utilizes the native App Service routing capability to automatically distribute a percentage of production traffic to the Staging slot.

Step-by-Step Solution

1
Open the configuration settings for the database connection string in both the production and Staging slots.
The connection string configuration settings are displayed.
This allows you to modify the behavior of the connection string during slot swaps.
2
Select the Deployment slot setting checkbox for the connection string in both slots.
The connection string becomes 'sticky' to its respective slot.
This prevents the connection string from being swapped, ensuring each slot maintains its connection to its target database.
3
Navigate to the Deployment slots blade of the web app and set the Traffic % column for the Staging slot to the desired percentage.
Azure automatically routes the specified percentage of user requests to the Staging slot.
This implements the 'testing in production' feature to automatically distribute user traffic without manual client changes.

Key Concept

Azure App Service deployment slot settings (sticky settings) and slot traffic routing
Estimated Time:1m 30s
Question 373Question →

You are configuring a Virtual Machine Scale Set (VMSS) named `vmss-worker` that runs a CPU-bound processing service. The VMSS is configured with a minimum instance count of 2 and a maximum instance count of 10. The scale-out rule is configured to increase the instance count by 1 when the average CPU percentage is greater than 75% for 10 minutes. You need to configure a scale-in rule that decreases the instance count by 1 when the workload decreases. The scale-in rule must prevent thrashing (immediate scale-in) when the scale set is running at its minimum capacity of 2 instances and triggers a scale-out. Which of the following is the maximum CPU percentage threshold you should configure for the scale-in rule?

Show answer & explanation

Answer: 45%

Answer

45%
The threshold of 45% is the only option that is strictly below 50%. When the scale set scales out from 2 instances (exceeding 75% average CPU, or 150% total CPU load) to 3 instances, the workload is distributed, reducing the average CPU per instance to 50%. A scale-in threshold of 45% ensures the new workload level (50%) does not trigger an immediate scale-in event, avoiding thrashing.

Step-by-Step Solution

1
Calculate the total CPU workload at the scale-out threshold.
2×75%=150%2 \times 75\% = 150\% total CPU capacity.
When running at the minimum instance count of 2, the scale-out rule is triggered when the average CPU exceeds 75%.
2
Calculate the post-scale-out average CPU usage per instance.
150%/3=50%150\% / 3 = 50\% average CPU usage.
When the scale-out triggers, the scale set increases from 2 to 3 instances. The total workload of 150% is now distributed across 3 instances.
3
Determine the maximum scale-in threshold to prevent thrashing.
The scale-in threshold must be strictly less than 50%.
If the scale-in threshold is 50% or higher, the post-scale-out average CPU (50%) will immediately trigger a scale-in event, causing thrashing.

Key Concept

To prevent VMSS autoscale thrashing, the scale-in metric threshold must be set lower than the expected resource usage per instance after a scale-out event occurs.
Question 374Question →

An administrator is configuring an Azure App Service web app to ensure it remains active and does not unload from memory during periods of no user traffic. Which configuration setting should the administrator enable, and what is the minimum required App Service plan tier for this setting?

Show answer & explanation

Answer: Enable the Always On setting on a Basic (B1) or higher App Service plan.

Answer

Enable the Always On setting on a Basic (B1) or higher App Service plan.
To keep an Azure App Service web app loaded in memory and avoid cold starts during periods of inactivity, the Always On setting must be enabled. This setting requires a Basic (B1) or higher App Service plan (such as Standard or Premium).

Step-by-Step Solution

1
Identify the configuration parameter required to keep the Azure App Service worker process active and prevent it from unloading due to inactivity.
Determine that the Always On setting is the appropriate configuration to prevent cold start latency.
By default, App Service unloads idle applications from memory. Always On keeps the process constantly loaded.
2
Evaluate the App Service Plan pricing tier requirements for the identified setting.
Verify that Always On is only available starting at the Basic (B1) tier, and is disabled for Free (F1) and Shared (D1) plans.
Shared and Free tiers run on shared infrastructure where persistent worker processes are restricted.

Key Concept

Always On configuration and App Service Plan tier limitations
Question 375Question →

An administrator is creating a new Azure virtual machine. Which configuration limit is directly determined by the selected virtual machine size?

Show answer & explanation

Answer: The maximum number of data disks that can be attached to the virtual machine

Answer

The correct answer is the maximum number of data disks that can be attached to the virtual machine.
The virtual machine size determines the hardware resources allocated to the virtual machine, including the maximum number of data disks, network interface cards, vCPUs, memory, and temporary disk capacity.

Step-by-Step Solution

1
Identify the resource configurations that are constrained by the virtual machine size in Azure.
The virtual machine size dictates vCPUs, memory, temporary storage capacity, IOPS limits, maximum number of data disks, and maximum network interfaces.
Understanding virtual machine size specifications is necessary to determine which parameters are bound by the size choice.
2
Evaluate the options against the identified parameters determined by the virtual machine size.
The maximum number of data disks is a direct constraint of the virtual machine size.
This confirms the correct option based on Azure documentation.

Key Concept

Virtual machine size limits and configuration
Question 376Question →

You have two Azure App Service web apps named webapp1 and api1. Both web apps run on the Standard S1 App Service plan. You configure regional virtual network integration for webapp1 to Subnet1 in a virtual network named VNet1. You need to ensure that api1 only accepts incoming traffic from webapp1. The solution must ensure that all communication from webapp1 to api1 traverses VNet1. You must minimize administrative effort and avoid using private endpoints. Which set of actions should you perform?

Show answer & explanation

Answer: Enable the Microsoft.Web service endpoint on Subnet1, enable the Route All setting on the virtual network integration of webapp1, and add an access restriction rule on api1 that allows traffic from Subnet1.

Answer

Enable the Microsoft.Web service endpoint on Subnet1, enable the Route All setting on the virtual network integration of webapp1, and add an access restriction rule on api1 that allows traffic from Subnet1.
The correct action is to enable the Microsoft.Web service endpoint on Subnet1, enable the Route All setting on webapp1's virtual network integration, and add an access restriction rule on api1 allowing Subnet1. By default, regional virtual network integration only routes traffic destined for private IP addresses (RFC1918). Because api1 has a public IP address, traffic from webapp1 to api1 will bypass VNet1 unless the Route All setting is enabled. Enabling Route All forces all outbound traffic from webapp1 through VNet1, applying the Microsoft.Web service endpoint identity from Subnet1, which is then permitted by api1's access restrictions.

Step-by-Step Solution

1
Enable the Microsoft.Web service endpoint on Subnet1.
Allows Subnet1 to securely identify its traffic when connecting to Azure App Services (Microsoft.Web).
This is a prerequisite for adding virtual network-based access restrictions on Azure App Services.
2
Enable the Route All setting on webapp1's virtual network integration.
Forces all outbound traffic from webapp1, including public IP traffic destined for api1, to be routed through VNet1.
By default, regional virtual network integration only routes RFC1918 private IP traffic. Since api1 has a public IP address, Route All is required to force webapp1's traffic to api1 into VNet1 so it can use the service endpoint.
3
Configure an access restriction rule on api1 to allow traffic from Subnet1.
Secures api1 so that only traffic originating from Subnet1 (which now includes webapp1's routed traffic) is permitted, while other public traffic is blocked.
This achieves the security requirement of restricting inbound traffic to api1 to only come from webapp1 via VNet1.

Key Concept

Azure App Service Regional VNet Integration and Access Restrictions using Service Endpoints
Estimated Time:3m 0s
Question 377Question →

An Azure subscription contains a resource group named `rg-prod-data`. The resource group contains an Azure Storage account named `storelogs1`. A `ReadOnly` lock is applied directly to the resource group `rg-prod-data`. No other locks or tags are applied to the resource group or the storage account. An administrator needs to retrieve the access keys for `storelogs1` using the Azure portal. Does the lock applied to `rg-prod-data` prevent the administrator from retrieving the access keys for `storelogs1`?

Show answer & explanation

Answer: True

Answer

The ReadOnly lock inherited by the storage account prevents the retrieval of the access keys.
The correct answer is that the lock prevents the retrieval of the keys. A ReadOnly lock applied to a resource group is inherited by all resources within that group. In addition to blocking write and delete operations, a ReadOnly lock blocks POST operations, which includes the request to retrieve (list) storage account access keys.

Step-by-Step Solution

1
Analyze lock inheritance behavior in Azure.
The ReadOnly lock applied to the resource group is inherited by all child resources, including the storage account.
Azure Resource Locks are inherited by all child resources within the scope where the lock is applied.
2
Evaluate the permissions blocked by a ReadOnly lock.
A ReadOnly lock blocks all write and delete operations, as well as control plane POST operations.
This prevents configurations from being modified and blocks actions that generate or return sensitive keys.
3
Determine if listing storage keys is blocked.
Retrieving storage account keys requires a POST action, which is blocked by the inherited ReadOnly lock.
Listing access keys is a control plane operation that uses the POST method, making it subject to ReadOnly lock restrictions.

Key Concept

Azure Resource Lock inheritance and ReadOnly lock constraints on POST operations
Question 378Question →

A company's Microsoft Entra ID tenant contains a security group named Engineering-Dept. You assign a Microsoft 365 E5 license to Engineering-Dept. Several users in Engineering-Dept report that they cannot access Microsoft 365 services. When checking the license status, you find a 'License assignment error' state due to a missing usage location on the user objects. You need to resolve the licensing error and delegate the management of these users to a local administrator named Admin1. The solution must minimize administrative privileges and prevent Admin1 from managing users outside of Engineering-Dept. Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create an administrative unit, add the members of Engineering-Dept to the administrative unit, and assign the User Administrator role to Admin1 scoped to the administrative unit.; Update the Usage Location property on the user accounts of the affected members of Engineering-Dept.

Answer

Create an administrative unit, add the members of Engineering-Dept to the unit, assign the User Administrator role to Admin1 scoped to that unit, and update the Usage Location property on the affected user accounts.
To delegate administration under the principle of least privilege, you should group the target users into an administrative unit and assign the User Administrator role to the local administrator scoped to that unit. Additionally, because Microsoft Entra ID requires a usage location to assign licenses, setting the Usage Location property on the affected user accounts is necessary to resolve the license assignment error.

Step-by-Step Solution

1
Create an administrative unit and add the members of the target group to it.
An administrative boundary is defined containing only the users who need local administration.
This sets up the scope for delegating administrative privileges to a subset of users.
2
Assign the User Administrator role to the local administrator (Admin1) scoped to the administrative unit.
Admin1 is granted permissions to manage only the users within the administrative unit.
This limits Admin1's administrative rights, satisfying the requirement to prevent management of users outside the group.
3
Set the Usage Location property on the user objects of the affected members.
The prerequisite for license assignment is met, resolving the group-based licensing error.
Microsoft Entra ID requires a usage location to be specified for a user before a license can be applied via group-based licensing.

Key Concept

Delegating administrative permissions using Administrative Units and resolving group-based licensing requirements in Microsoft Entra ID.
Question 379Question →

Your company has an Azure subscription named sub-nebula-prod that contains the following resources:
- An Azure Storage account named sanebuladata
- A user-assigned managed identity named uami-storage-encrypt
- An Azure Key Vault named kv-nebula-keys

The Key Vault has soft delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) as its permission model.

You associate uami-storage-encrypt with sanebuladata.
You need to configure sanebuladata to use a customer-managed key stored in kv-nebula-keys for encryption.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Key Vault Crypto Service Encryption User role for kv-nebula-keys to uami-storage-encrypt.; Configure the encryption settings of sanebuladata to use a customer-managed key, specifying the key vault URI and selecting the uami-storage-encrypt identity.

Answer

To configure customer-managed key encryption using a user-assigned managed identity on a Key Vault with the Azure RBAC permission model, assign the Key Vault Crypto Service Encryption User role on the Key Vault to the user-assigned managed identity, and configure the storage account's encryption settings to use the customer-managed key using that identity.
To encrypt an Azure Storage account using customer-managed keys (CMK) with a user-assigned managed identity on a vault that uses Azure RBAC, you must configure two elements. First, you must grant the user-assigned managed identity the permission to read and perform cryptographic actions on the keys. Under the Azure RBAC model, the Key Vault Crypto Service Encryption User role provides the minimum required data-plane access. Second, you must configure the storage account itself to use the customer-managed key, specifying the URI of the vault and assigning the user-assigned managed identity to authenticate the storage service's access to the Key Vault.

Step-by-Step Solution

1
Assign the appropriate data-plane role on the Key Vault to the user-assigned managed identity.
The identity is authorized to access the key and perform cryptographic operations.
Since the Key Vault uses Azure RBAC, permissions to perform key operations (wrap, unwrap, get) must be granted via Azure RBAC roles. The Key Vault Crypto Service Encryption User role is the minimum privilege required.
2
Configure the storage account encryption settings to target the customer-managed key.
The storage account begins using the customer-managed key from the Key Vault for encryption.
You must specify the customer-managed key type, the Key Vault URI, and select the user-assigned managed identity that will authenticate the request to the vault.

Key Concept

Configuring Customer-Managed Keys (CMK) for Azure Storage using user-assigned managed identities and Azure Key Vault under the Azure RBAC permission model.
Question 380Question →

Your company has an Azure subscription that contains an Azure Virtual Machine named VM-App1 and a storage account named storeevents2026. VM-App1 runs a custom background service that must retrieve and delete messages from a queue named processing-queue in storeevents2026. You need to configure authentication for the service to access the queue. The solution must meet the following requirements:
- Use Microsoft Entra ID authentication.
- Follow the principle of least privilege.

Which two configurations should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable a system-assigned managed identity on VM-App1.; Assign the Storage Queue Data Message Processor role to the VM-App1 managed identity.

Answer

Enable a system-assigned managed identity on VM-App1 and assign the Storage Queue Data Message Processor role to the VM-App1 managed identity.
To authenticate and authorize access to Azure Storage Queues using Microsoft Entra ID under the principle of least privilege, two components are required: first, the virtual machine running the service must have an identity in Microsoft Entra ID. Enabling a system-assigned managed identity on the virtual machine provides it with an identity automatically managed by Azure, eliminating the need to store credentials in code or configuration. Second, the managed identity must be assigned a data-plane role that permits reading, retrieving (dequeuing), and deleting messages from the queue. The Storage Queue Data Message Processor role is the built-in role designed specifically for this purpose, providing the minimum permissions necessary to process queue messages without granting full administrative rights over the queue or the storage account.

Step-by-Step Solution

1
Enable a system-assigned managed identity on VM-App1.
VM-App1 is registered in Microsoft Entra ID and obtains its own identity credentials managed automatically by Azure.
This establishes a secure, passwordless identity for the virtual machine to authenticate with Microsoft Entra ID.
2
Identify the data-plane operations required (retrieving and deleting queue messages) and map them to the least-privilege role.
The Storage Queue Data Message Processor role is selected because it permits peeking, retrieving, and deleting queue messages.
Other data-plane roles like Storage Queue Data Reader do not permit deleting (dequeuing) messages, while control-plane roles do not grant data-plane access.
3
Assign the Storage Queue Data Message Processor role to the VM-App1 managed identity at the scope of the queue or storage account.
The managed identity is authorized to perform message processing operations on the queue.
This completes the authorization step required by Azure role-based access control (RBAC) for Microsoft Entra ID.

Key Concept

Using Microsoft Entra ID and Azure RBAC data-plane roles to authorize access to Azure Storage resources (Queues) from an Azure Virtual Machine.
Estimated Time:2m 0s
PreviousPage 19 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin