Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 21Question →

Your company has an Azure subscription named Sub1 that contains a resource group named RG1. You need to ensure that a user named User1 can view all resources inside RG1. User1 must not be able to view resources in any other resource groups within Sub1, nor modify any resources. Which action should you perform?

Show answer & explanation

Answer: Assign the Reader role to User1 at the RG1 resource group scope.

Answer

Assign the Reader role to User1 at the RG1 resource group scope.
Assigning the Reader role at the resource group scope grants the user read-only permissions for all resources within that specific resource group. Because the scope is restricted to the resource group, the user cannot view resources in other resource groups within the subscription, satisfying all requirements.

Step-by-Step Solution

1
Determine the minimum permission required to view resources.
The Reader role is identified as the appropriate built-in role to view resources without permission to modify them.
The Reader role allows viewing resources but does not allow any modifications.
2
Determine the correct scope for the role assignment to restrict access to a single resource group.
The resource group (RG1) scope is selected.
Assigning a role at the resource group scope limits the permissions to only that resource group, whereas assigning it at the subscription scope would allow inheritance to all other resource groups in the subscription.

Key Concept

Azure RBAC inheritance and scopes
Question 22Question →

An administrator is managing a standard general-purpose v2 storage account named storage1. The storage account currently uses Locally Redundant Storage (LRS) and contains a blob container named archive.

The administrator needs to meet the following requirements:
1. Ensure the storage account is replicated to a secondary region to protect against regional outages.
2. Automatically move blobs in the archive container to the Archive storage tier if they have not been modified for more than 90 days.

Which two actions should the administrator perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Change the replication setting of the storage account to Geo-redundant storage (GRS) in the storage account configuration.; Create a lifecycle management rule that includes a prefix match filter of archive/ and a rule action to transition blobs to the Archive tier after 90 days.

Answer

To meet the requirements, the administrator must change the replication of the storage account to Geo-redundant storage (GRS) and create a lifecycle management rule with a prefix match of archive/ to transition the blobs to the Archive tier after 90 days.
To protect against regional outages, the replication configuration of the storage account must be modified to Geo-redundant storage (GRS), which is a supported self-service change. To automate the transition of blobs to the Archive tier after 90 days, a lifecycle management rule is required. The prefix filter for the container must be defined starting directly with the container name (e.g., 'archive/') and cannot start with a leading slash.

Step-by-Step Solution

1
Navigate to the configuration blade of the storage account in the Azure portal and change the replication setting.
The replication configuration of the storage account is changed from LRS to GRS.
GRS replicates the data asynchronously to a secondary region, providing protection against regional outages. This conversion path is supported directly without a support request.
2
Create a lifecycle management rule under the Lifecycle Management blade of the storage account.
A new lifecycle management policy rule is defined.
Lifecycle management rules allow automating transitions to colder tiers and deleting blobs based on their modification age.
3
Configure the rule's prefix filter to target the archive container using 'archive/' and set the transition action to Archive tier after 90 days.
The rule is scoped to target only the blobs in the archive container and transition them to the Archive tier.
The prefix filter must start with the container name and must not contain a leading slash. Setting the days after modification to 90 satisfies the lifecycle requirement.

Key Concept

Configuring Geo-redundant storage replication conversion and setting up Azure Blob Storage Lifecycle Management rules using prefix matching.
Question 23Question →

You manage a Microsoft Entra ID tenant. You create an administrative unit named Regional-AU and add several security groups to it.

You need to delegate the ability to manage the membership of these security groups to a user named Admin1. The solution must follow the principle of least privilege.

Which role and scope should you assign to Admin1?

Show answer & explanation

Answer: Groups Administrator role scoped to Regional-AU

Answer

Groups Administrator role scoped to Regional-AU
Assigning the Groups Administrator role scoped to Regional-AU is correct because it grants the specific permissions needed to manage group memberships, and administrative units allow directory role delegation to be scoped to a subset of directory objects, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the administrative tasks and the target objects.
The task is to manage membership for security groups placed inside an Administrative Unit.
Understanding the scope of administration helps narrow down the required role and boundary.
2
Compare the permissions of User Administrator and Groups Administrator.
Groups Administrator allows managing group properties and memberships. User Administrator has broader access, including user and password management.
Least privilege requires choosing the role with the fewest permissions that still accomplishes the task.
3
Determine the appropriate scope for the assignment.
The groups are contained within Regional-AU. Directory roles can be scoped to administrative units, whereas Azure RBAC scopes (resource groups/subscriptions) cannot be used for directory roles.
Assigning the role at the administrative unit scope ensures the permission is restricted to the specific groups.

Key Concept

Delegating group management using Administrative Units and least privilege directory roles
Estimated Time:1m 30s
Question 24Question →

An organization uses an Azure tenant hierarchy configured as follows:
- Tenant Root Group (Management Group)
- MG-Prod (Management Group)
- Sub-Prod-01 (Subscription)
- RG-Sec (Resource Group)
- RG-App (Resource Group)
- VM-App-01 (Virtual Machine)

You have two users with the following role configurations:
- User1 is assigned the Global Administrator directory role in Microsoft Entra ID. No other roles are assigned.
- User2 is assigned the User Access Administrator role at the MG-Prod management group scope.

User1 needs to assign the Contributor role to a security group at the RG-App scope.
User2 needs to assign the Reader role to a service principal at the RG-Sec scope.

Who can perform their respective role assignments without modifying any existing permissions or configurations?

Show answer & explanation

Answer: Only User2

Answer

Only User2 can perform the role assignment without modifying existing permissions.
The correct option is that only User2 can perform the role assignment. User2 has the User Access Administrator role at the MG-Prod scope, which grants them the ability to write role assignments. Because of Azure RBAC inheritance, this permission flows down to all child scopes including the Sub-Prod-01 subscription and the RG-Sec resource group. User1, despite being a Microsoft Entra ID Global Administrator, cannot perform resource-level role assignments by default. Global Administrators must first elevate their access in the Azure portal, which explicitly assigns them the User Access Administrator role at the Tenant Root Group level before they can manage Azure subscription permissions.

Step-by-Step Solution

1
Analyze the Microsoft Entra ID role assignment for User1.
User1 has the Global Administrator directory role.
Microsoft Entra ID roles are structurally separate from Azure RBAC roles. A Global Administrator has no default permissions to manage Azure resources (subscriptions, resource groups, etc.) until they explicitly elevate their access in the Entra ID settings.
2
Analyze the Azure RBAC role assignment and scope for User2.
User2 has the User Access Administrator role at the MG-Prod management group scope.
The User Access Administrator role contains the `Microsoft.Authorization/roleAssignments/write` data action, which allows the user to configure role assignments at their assigned scope.
3
Apply the principles of RBAC scope inheritance down the hierarchy.
User2's permissions at MG-Prod inherit down through Sub-Prod-01 to RG-Sec.
Azure RBAC assignments are inherited from parent scopes (Management Groups) to child scopes (Subscriptions and Resource Groups). Since RG-Sec is a child of Sub-Prod-01, which is a child of MG-Prod, User2 has effective User Access Administrator rights at the RG-Sec level.

Key Concept

Azure RBAC roles inherit down the resource hierarchy (Management Group -> Subscription -> Resource Group -> Resource), whereas Microsoft Entra ID directory roles do not automatically grant permissions on Azure resources without explicit access elevation.
Estimated Time:2m 0s
Question 25Question →

An organization has an Azure subscription containing a General Purpose v2 (GPv2) storage account named storage1 configured with Geo-Redundant Storage (GRS). The storage account contains two blob containers:

* media-delivery – Stores active, frequently accessed media assets used by a web application.
* compliance-logs – Stores historical logs.

To minimize storage costs, a lifecycle management policy is applied to storage1 with a rule that transitions all blobs in compliance-logs to the Archive tier 30 days after creation.

A major regional outage occurs in the primary region of storage1. An administrator attempts to initiate a customer-managed failover of storage1 to the secondary region to restore write capabilities for the web application, but the failover operation is blocked.

Which of the following is the most appropriate action to resolve this issue and ensure the web application can fail over to the secondary region in the event of a future primary region outage?

Show answer & explanation

Answer: Create a separate storage account for the historical logs, configure its lifecycle policy to archive the logs, and keep only the active media assets in storage1.

Answer

Create a separate storage account for the historical logs, configure its lifecycle policy to archive the logs, and keep only the active media assets in storage1.
The correct action is to split the active and archived workloads into separate storage accounts. Azure customer-managed failover is blocked for any storage account that contains archived blobs. Because rehydration is a write operation that cannot be performed when the primary endpoint is offline, the administrator cannot rehydrate the blobs during an outage to bypass the block. Separating the logs to a different storage account ensures the active media storage account contains no archived blobs and can be failed over immediately.

Step-by-Step Solution

1
Identify the blocker preventing the customer-managed failover of the storage account.
The failover is blocked because the storage account contains archived blobs, which is a known limitation of customer-managed failover in Azure.
Azure blocks customer-managed failover for any storage account containing one or more blobs in the Archive tier.
2
Evaluate the viability of rehydrating the blobs or modifying the lifecycle policy during a primary region outage.
Both rehydration and lifecycle policy modifications are write operations that must be processed by the primary endpoint, which is currently offline.
During a primary region outage, the secondary endpoint is read-only (in RA-GRS) and cannot accept write commands, meaning blobs cannot be rehydrated and policies cannot be modified.
3
Formulate a design pattern to prevent this failover blocker in future scenarios.
Split the workloads by creating a separate storage account for the compliance logs (which require archiving) and keeping the active media assets in the primary GRS storage account.
Separating the active and archived workloads ensures that the active storage account does not contain archived blobs, allowing customer-managed failover to succeed instantly during a disaster.

Key Concept

Customer-managed failover limitations with archived blobs and storage account design
Estimated Time:3m 0s
Question 26Question →

An organization's Azure environment is structured with the following hierarchy:
- Tenant Root Group
- Corporate-MG (Management Group)
- Production-MG (Management Group)
- Azure Subscription A
- Resource Group: RG-Shared-01

The following configurations are implemented:
1. A CanNotDelete resource lock is applied to RG-Shared-01.
2. A user is assigned the Owner role at the Corporate-MG level.
3. The administrator assigns the same user a custom RBAC role at the RG-Shared-01 level. The custom role contains a NotActions statement for deleting resources.

The user attempts to delete an Azure storage account that resides inside RG-Shared-01.

What is the outcome of the user's deletion attempt?

Show answer & explanation

Answer: The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.

Answer

The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.
The correct option is the one stating that the deletion attempt fails due to resource lock inheritance. Resource locks applied at the resource group scope are inherited by all resources within that group. A CanNotDelete lock prevents any user—including those with Owner or Contributor permissions—from deleting the resource. Therefore, the user cannot delete the storage account.

Step-by-Step Solution

1
Determine the user's effective RBAC permissions down the hierarchy.
The user has the Owner role inherited from Corporate-MG. The custom role with NotActions at the resource group level does not restrict this access because Azure RBAC is additive.
Understanding inheritance and the additive nature of RBAC is required to evaluate permissions.
2
Evaluate the impact of the resource lock.
The CanNotDelete lock is applied to RG-Shared-01. It inherits to the storage account.
Locks take precedence over RBAC user permissions and prevent deletion for all users.
3
Combine RBAC and resource lock effects to determine the final outcome.
The deletion fails due to the inherited resource lock.
Confirming that locks block write/delete operations even for subscription Owners.

Key Concept

Resource locks take precedence over RBAC permissions and are inherited down the resource hierarchy.
Estimated Time:1m 30s
Question 27Question →

An administrator needs to import 22 TB22\text{ TB} of data from an on-premises Windows file server to an Azure storage account. The target destination is an Azure Files share. Due to limited WAN bandwidth, the administrator decides to use the Azure Import/Export service to ship physical hard drives to an Azure datacenter.

Which of the following processes must the administrator use to prepare the hard drives and configure the import job?

Show answer & explanation

Answer: Format the drives as NTFS, run the WAImportExport V2 tool on a local Windows machine using the storage account access key to copy the data and encrypt the drives with BitLocker, and upload the generated journal (.jrn) files when creating the import job in the Azure portal.

Answer

Format the drives as NTFS, run the WAImportExport V2 tool on a local Windows machine using the storage account access key to copy the data and encrypt the drives with BitLocker, and upload the generated journal (.jrn) files when creating the import job in the Azure portal.
The correct process for importing data into Azure Files using the Import/Export service requires formatting the drives as NTFS and running the WAImportExport V2 tool on a local Windows machine. The tool uses the storage account access key to copy the data, encrypts the drives with BitLocker, and generates journal (.jrn) files. These journal files must then be uploaded to Azure when creating the import job to allow the Azure datacenter to decrypt and ingest the data.

Step-by-Step Solution

1
Format the physical SATA hard drives as NTFS using a local Windows machine.
The drives are prepared with the required file system for the Azure Import/Export service.
Azure Import/Export only supports NTFS-formatted drives for Windows-based data prep.
2
Run the WAImportExport V2 tool, specifying the source path, destination Azure Files share, and the storage account access key.
The data is copied to the drives, the drives are encrypted using BitLocker, and journal (.jrn) files are generated.
WAImportExport version 2 is specifically designed for Azure Files import. The storage account access key is needed to authenticate and encrypt the drives.
3
Create an import job in the Azure portal and upload the generated journal (.jrn) files.
The import job is configured and transition details (like shipping carrier tracking info) are provided.
Azure uses the journal files to identify the drives, decrypt them, and copy the files to the correct target share.

Key Concept

Drive preparation and prerequisite handling using the WAImportExport tool for Azure Files imports via the Import/Export service.
Estimated Time:2m 30s
Question 28Question →

Zenith Retail Group uses the following Azure Management Group hierarchy:

* Tenant Root Group (Policy assigned: Allowed locations restricted to `East US` with Deny effect)
* Retail-Operations (Management Group) (Policy assigned: Allowed locations restricted to `East US 2` with Deny effect; Role assignment: User1 is assigned the Contributor role)
* Online-Store (Management Group)
* Sub-Online-Prod (Subscription) (Role assignment: User1 is assigned the Reader role)
* RG-Web-Prod (Resource Group) (Resource Lock: CanNotDelete lock applied)

User1 attempts to create a new virtual machine in the resource group `RG-Web-Prod` in the `East US 2` region.

Which of the following describes the outcome of the deployment attempt?

Show answer & explanation

Answer: The deployment is denied because it violates the Allowed locations policy assigned at the Tenant Root Group level.

Answer

The deployment is denied because it violates the Allowed locations policy assigned at the Tenant Root Group level.
The correct option is correct because Azure Policy evaluation is cumulative across all hierarchical scopes. A resource deployment must comply with the policy assignments at the resource scope, resource group scope, subscription scope, and all parent management group scopes. The virtual machine deployment in East US 2 satisfies the policy at the Retail-Operations level, but violates the Tenant Root Group policy, which only permits East US.

Step-by-Step Solution

1
Evaluate the effective RBAC permissions for User1 on the target resource group.
User1 has effective Contributor permissions.
Azure RBAC role assignments are additive. The inherited Contributor assignment from the Retail-Operations management group level is not canceled or overridden by the more specific Reader assignment at the subscription level.
2
Evaluate the impact of the resource lock on the resource group.
The CanNotDelete lock does not block virtual machine creation.
A CanNotDelete lock prevents authorized users from deleting a resource, but allows creating, reading, or modifying resources.
3
Evaluate the cumulative effect of the assigned Azure Policies.
The deployment is blocked by the Tenant Root Group policy.
Azure Policy evaluations are cumulative. For a resource to be successfully deployed, it must satisfy the policy rules at all scopes in its path. Since the Tenant Root Group restricts deployments to East US and the Retail-Operations group restricts them to East US 2, deploying a resource in East US 2 violates the Tenant Root Group policy.

Key Concept

Azure Policy and RBAC inheritance and evaluation within Management Group hierarchies
Estimated Time:3m 0s
Question 29Question →

Your company has a Microsoft Entra ID tenant. You need to delegate password reset capabilities to a user named Admin1. Admin1 must only be allowed to reset passwords for users who meet both of the following criteria:

* Belong to the Sales department.
* Have their usage location set to the United States (US).

You need to implement a solution that requires the minimum administrative effort and follows the principle of least privilege.

Which configuration should you implement?

Show answer & explanation

Answer: Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.

Answer

Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.
The correct configuration uses an Administrative Unit (AU) with a dynamic membership rule configured with standard OData v3.0 query syntax (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'). The Helpdesk Administrator role can be scoped to an AU, which delegates password reset permissions for the members of that AU to Admin1, satisfying the least privilege principle.

Step-by-Step Solution

1
Determine the administrative scope delegation mechanism
Administrative Unit (AU) is selected as the container for delegation
Microsoft Entra ID roles cannot be scoped to a group to delegate user administration of that group's members. Instead, Administrative Units must be used to restrict the administrative scope of directory roles.
2
Write the dynamic membership rule using correct OData syntax and attributes
(user.department -eq 'Sales') -and (user.usageLocation -eq 'US')
The dynamic query syntax requires OData v3.0 operators (e.g., -eq instead of ==) and valid user attribute names (e.g., user.usageLocation instead of user.location).
3
Assign the least privileged role to Admin1
Admin1 is assigned the Helpdesk Administrator role scoped to the AU
The Helpdesk Administrator role allows resetting passwords for non-administrator users. Scoping this role to the AU ensures Admin1 can only perform resets for users matching the AU's dynamic membership criteria.

Key Concept

Delegating administrative permissions over specific users using Administrative Units and dynamic membership rules in Microsoft Entra ID.
Question 30Question →

An administrator manages a General Purpose v2 (GPv2) storage account named storagelogsa in the East US region. The storage account is currently configured to use Locally Redundant Storage (LRS) and contains block blobs in a container named activitylogs.

A lifecycle management policy is applied to the storage account with a single rule:
- Filter: Blob prefix is activitylogs/archive/
- Action: Transition blobs to the Archive tier 30 days after modification.

Currently, the container contains:
- 500 blobs under activitylogs/raw/ (all modified 45 days ago, currently in the Hot tier)
- 200 blobs under activitylogs/archive/ (all modified 45 days ago, currently in the Archive tier)

You need to change the replication configuration of the storage account from LRS to Zone-Redundant Storage (ZRS) to ensure zonal availability. When you attempt to change the replication setting in the Azure portal, the option is unavailable.

Which of the following actions should you perform first to enable the replication configuration change?

Show answer & explanation

Answer: Rehydrate the 200 blobs in the activitylogs/archive/ path to the Hot or Cool tier.

Answer

Rehydrate the 200 blobs in the activitylogs/archive/ path to the Hot or Cool tier.
The correct action is to rehydrate the archived blobs. Azure Storage replication conversions (such as moving from Locally Redundant Storage to Zone-Redundant Storage) are blocked if the storage account contains any blobs in the Archive tier. Rehydrating the blobs under the archived path to Hot or Cool tier satisfies this prerequisite.

Step-by-Step Solution

1
Analyze the current state of the blobs and lifecycle policy rules.
Identify that the 200 blobs under the prefix activitylogs/archive/ have been transitioned to the Archive tier because they were modified 45 days ago, which exceeds the 30-day threshold defined in the lifecycle policy.
Understanding the tier of the existing blobs is critical since replication changes have specific tier restrictions.
2
Evaluate the replication conversion requirements for Azure storage accounts.
Identify that Azure blocks changing the replication configuration (e.g., LRS to ZRS) of any storage account that contains blobs in the Archive tier.
Archived blobs are offline and must be rehydrated to an online tier (Hot or Cool) before metadata or configuration changes like replication conversion can be applied.
3
Select the correct remediation step.
Determine that the archived blobs must be rehydrated first to allow the replication change to proceed.
Rehydrating the blobs brings them back to an online tier, fulfilling the prerequisite for changing the storage account replication configuration.

Key Concept

Azure Storage replication changes are blocked if the storage account contains any blobs in the Archive tier. Before converting replication (such as LRS to ZRS), all archived blobs must be rehydrated to Hot or Cool.
Question 31Question →

An organization has the following Azure resource hierarchy and configuration:
- A management group named MG-Production contains an Azure subscription named Sub-App.
- Sub-App contains a resource group named RG-Data.
- RG-Data contains a storage account named storage1.
- A ReadOnly resource lock is applied directly to the storage1 resource.

The following security principals are configured:
- User1 is a Microsoft Entra ID user with the Global Administrator directory role. The 'Access management for Azure resources' setting is disabled in the directory properties.
- User2 has the Reader role assigned at the MG-Production level and the Storage Blob Data Contributor role assigned at the RG-Data level.
- User3 has the Contributor role assigned at the Sub-App level.

All users attempt to access resources using Microsoft Entra ID authentication. Which of the following describes the effective permissions of the users?

Show answer & explanation

Answer: User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 is blocked from regenerating access keys for storage1.

Answer

User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 is blocked from regenerating access keys for storage1.
The correct option is correct because User1's Global Administrator directory role does not grant Azure resource access unless the access management elevation toggle is enabled. User2 holds the Storage Blob Data Contributor role, which allows them to upload blobs since resource locks only restrict Azure Resource Manager control-plane actions and do not block data-plane operations. Finally, User3 is prevented from regenerating access keys because key regeneration is a control-plane write action that is explicitly blocked by the ReadOnly lock applied to the storage account.

Step-by-Step Solution

1
Evaluate User1's permissions based on their directory role.
User1 has no access to subscription resources.
Microsoft Entra ID administrator roles (like Global Administrator) do not automatically grant permissions to Azure subscription resources. Since 'Access management for Azure resources' is disabled, User1 has no inherited roles in the subscription.
2
Evaluate User2's permissions and the impact of the ReadOnly lock on data plane actions.
User2 can upload blobs to storage1.
User2 inherits control-plane read access (from the Reader assignment at the management group level) and has direct data-plane write access (from the Storage Blob Data Contributor assignment at the resource group level). The ReadOnly resource lock applied to the storage account only prevents control-plane modifications (write/delete) and does not block data-plane actions like uploading blobs.
3
Evaluate User3's permissions and the impact of the ReadOnly lock on control plane actions.
User3 is blocked from regenerating access keys on storage1.
User3 inherits the Contributor role, which would normally allow regenerating storage account keys. However, key regeneration is a control-plane write operation. The ReadOnly lock applied directly to the resource blocks all control-plane write and delete operations, regardless of whether the Contributor role was inherited from a higher scope.

Key Concept

Azure resource locks only restrict control-plane (management) operations and do not block data-plane operations. Additionally, Microsoft Entra ID administrative roles do not implicitly grant Azure RBAC permissions unless explicitly elevated, and subscription Contributor does not provide data-plane access for storage.
Question 32Question →

You manage a Microsoft Entra ID tenant. You are planning to create dynamic groups to automate administrative tasks.

Statement: A single Microsoft Entra ID dynamic group can contain both user objects and device objects as members simultaneously.

Is this statement true or false?

Show answer & explanation

Answer: False

Answer

The statement is false. A dynamic group in Microsoft Entra ID can contain either users or devices, but not both types of objects simultaneously.
The correct answer is False because Microsoft Entra ID dynamic groups must be configured as either dynamic user groups or dynamic device groups. The membership rule engine only evaluates attributes of the selected object type, making it impossible to have a mixed membership of users and devices in a single dynamic group.

Step-by-Step Solution

1
Identify the group type and membership rule requirements in Microsoft Entra ID.
Microsoft Entra ID supports two membership types for dynamic groups: Dynamic User and Dynamic Device.
This classification determines which properties are available for writing the membership rule.
2
Analyze whether a dynamic rule can reference both user and device properties.
A dynamic rule is restricted to either the 'user' schema or the 'device' schema. You cannot combine user properties (e.g., user.department) and device properties (e.g., device.operatingSystem) in the same query.
Microsoft Entra ID enforces a strict separation between user and device dynamic group memberships to prevent schema mismatch errors during evaluation.

Key Concept

Dynamic group membership in Microsoft Entra ID is restricted to a single object type (either users or devices) per group.
Question 33Question →

You are planning the replication configuration for a new Azure Storage account. The storage account must meet the following requirements:

* Provide protection against a datacenter failure within the primary region by replicating data across three availability zones.
* Provide protection against a regional disaster by replicating data to a secondary region.

Which two replication options should you select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Geo-zone-redundant storage (GZRS); Read-access geo-zone-redundant storage (RA-GZRS)

Answer

Geo-zone-redundant storage (GZRS) and Read-access geo-zone-redundant storage (RA-GZRS)
The correct options are Geo-zone-redundant storage (GZRS) and Read-access geo-zone-redundant storage (RA-GZRS). Both options synchronously replicate data across three availability zones in the primary region, protecting against datacenter failures, and then asynchronously replicate the data to a secondary region for disaster recovery.

Step-by-Step Solution

1
Analyze the primary region redundancy requirement.
The requirement to protect against datacenter failure by replicating across three availability zones requires zone-redundant storage (ZRS) replication in the primary region.
Locally-redundant storage (LRS) only replicates within a single datacenter, whereas ZRS replicates across three zones.
2
Analyze the secondary region disaster recovery requirement.
The requirement to replicate to a secondary region requires geo-replication.
Only GRS, RA-GRS, GZRS, and RA-GZRS replicate data to a secondary region.
3
Select the configurations that meet both requirements.
Combining primary zone-redundancy (ZRS) and secondary geo-redundancy leads to Geo-zone-redundant storage (GZRS) and Read-access geo-zone-redundant storage (RA-GZRS).
Both GZRS and RA-GZRS offer zone redundancy in the primary region and copy data to a secondary region.

Key Concept

Combining zone-redundant storage (ZRS) with geo-redundancy to achieve Geo-zone-redundancy in Azure Storage replication.
Question 34Question →

An organization's Azure environment is structured with the following resource hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-Production`
- Resource Group: `RG-App-Services`

A user named Admin1 is assigned the Global Administrator directory role in Microsoft Entra ID. Admin1 logs into the Azure portal but is unable to view the resources within `RG-App-Services` or the subscription itself. What should you do to allow Admin1 to view the web apps inside `RG-App-Services`?

Show answer & explanation

Answer: Assign Admin1 the Reader Azure RBAC role at the `Sub-Production` subscription scope.

Answer

Assign Admin1 the Reader Azure RBAC role at the `Sub-Production` subscription scope.
Assigning the Reader role at the subscription scope ensures that the read permission inherits down through the resource hierarchy to the resource group and individual resources. Because Entra ID directory roles do not automatically grant permissions to manage subscription resources, an explicit Azure RBAC assignment is necessary.

Step-by-Step Solution

1
Identify the relationship between Entra ID roles and Azure RBAC roles.
Confirm that the Global Administrator directory role does not automatically grant permissions to Azure subscription resources.
Entra ID and Azure RBAC have separate authorization control planes.
2
Evaluate the target scope and minimum permissions required to fulfill the request.
The requirement is to view the web apps inside the `RG-App-Services` resource group.
Choosing the correct built-in role (Reader) and the proper scope (subscription or resource group) is necessary to grant the access.
3
Determine the proper assignment scope that will propagate down to the resources.
Assigning the Reader role at the `Sub-Production` subscription scope will propagate via inheritance down to the `RG-App-Services` resource group and the web apps inside it.
Azure RBAC utilizes a hierarchical inheritance model where permissions applied at a parent scope flow down to all child scopes.

Key Concept

Azure RBAC role assignment scopes and role inheritance, specifically the separation between Microsoft Entra ID roles and Azure RBAC roles.
Estimated Time:1m 30s
Question 35Question →

An organization needs to retrieve 35 TB35\text{ TB} of archival data stored in an Azure Files share and transfer it to an on-premises Windows Server 2022 file server. The on-premises facility has an internet connection with a maximum dedicated bandwidth of 20 Mbps20\text{ Mbps} for this transfer. The data transfer must be completed as quickly as possible. Which service or configuration should the administrator use to export the data?

Show answer & explanation

Answer: A single Azure Data Box device.

Answer

A single Azure Data Box device.
A single Azure Data Box device is correct because Azure Data Box supports exporting data from Azure Files. With a usable capacity of 80 TB80\text{ TB}, a single device can easily hold the 35 TB35\text{ TB} dataset. Shipping a physical device overcomes the high transfer time associated with the 20 Mbps20\text{ Mbps} network connection.

Step-by-Step Solution

1
Analyze the source storage type and operational direction.
The source is an Azure Files share, and the operation is a data export (egress from Azure to on-premises).
The solution must support exporting data specifically from the Azure Files service.
2
Calculate the network transfer duration under the bandwidth constraints.
Transferring 35 TB35\text{ TB} (3.5×1013 bytes3.5 \times 10^{13}\text{ bytes}) over a 20 Mbps20\text{ Mbps} (2×107 bps2 \times 10^7\text{ bps}) connection requires: 3.5×1013×8 bits2×107 bps=1.4×107 seconds≈162 days\frac{3.5 \times 10^{13} \times 8\text{ bits}}{2 \times 10^7\text{ bps}} = 1.4 \times 10^7\text{ seconds} \approx 162\text{ days}
This network transfer time is too high, showing that offline physical transfer is necessary to complete the transfer quickly.
3
Evaluate the capabilities of physical offline storage options.
Data Box Disk only supports imports. Azure Import/Export does not support exporting from Azure Files. Only Azure Data Box supports exporting from Azure Files and has a matching capacity of 80 TB80\text{ TB}.
This identifies the correct offline transfer tool that meets both the export capabilities and the capacity limits.

Key Concept

Azure offline data transfer capabilities and limitations for export operations.
Question 36Question →

An enterprise retail company, Contoso Sports, organizes its Azure environment using the following Management Group (MG) hierarchy:

- Tenant Root Group
- MG-Retail-Global
- MG-Retail-APAC
- Sub-APAC-Online (Subscription)
- Sub-APAC-Backoffice (Subscription)
- MG-Retail-EMEA
- Sub-EMEA-Online (Subscription)

The following security controls and configurations are applied:
1. At MG-Retail-Global, an Azure Policy definition is assigned that denies the creation of public IP addresses (Microsoft.Network/publicIPAddresses).
2. At MG-Retail-APAC, the Owner role is assigned to User1.
3. At Sub-APAC-Online, a ReadOnly resource lock is applied to a resource group named 'rg-ecom-prod'.

User1 attempts to perform the following three tasks:
- Task A: Create a Virtual Network inside the 'rg-ecom-prod' resource group in the Sub-APAC-Online subscription.
- Task B: Create a Virtual Network inside a new resource group in the Sub-APAC-Backoffice subscription.
- Task C: Create a Public IP address in a new resource group in the Sub-APAC-Backoffice subscription.

Which of the tasks can User1 successfully complete?

Show answer & explanation

Answer: Task B only

Answer

Only Task B (creating a Virtual Network inside a new resource group in Sub-APAC-Backoffice) can be successfully completed.
The correct option is the one stating that only Task B can be successfully completed. User1 inherits the Owner role at the MG-Retail-APAC level, which gives them full control over all subscriptions beneath it, including Sub-APAC-Online and Sub-APAC-Backoffice. In Sub-APAC-Backoffice, User1 can create a new resource group and deploy a Virtual Network, as there are no locks or policy restrictions preventing this action. Task A is blocked because the resource group has a ReadOnly lock, which prevents any configuration changes, including creating child resources like a Virtual Network. Task C is blocked because the policy denying public IP address creation is assigned at the higher MG-Retail-Global level, and policy assignments inherit down the management group hierarchy to all child subscriptions, overriding User1's local Owner permissions.

Step-by-Step Solution

1
Determine User1's effective permissions across the hierarchy.
User1 inherits the Owner role on Sub-APAC-Online and Sub-APAC-Backoffice.
Azure RBAC role assignments inherit down the management group hierarchy to all child subscriptions and resource groups.
2
Evaluate the impact of the resource lock on Task A.
Task A is blocked by the ReadOnly lock on 'rg-ecom-prod'.
A ReadOnly lock at the resource group level prevents creating new child resources, such as a Virtual Network, inside that resource group.
3
Evaluate the impact of the Azure Policy on Task C.
Task C is blocked by the Azure Policy denying public IP addresses.
Azure Policy assignments inherit down the hierarchy. Even with Owner permissions, the resource deployment fails because the policy denies public IP resource creation.
4
Evaluate Task B under the effective permissions and controls.
Task B succeeds since User1 has Owner access, and no policies or locks block the creation of a resource group or Virtual Network (without public IPs) in Sub-APAC-Backoffice.
The write action is authorized by RBAC and is not restricted by any policies or locks at or above this scope.

Key Concept

Azure Management Groups govern access, policy, and compliance across multiple subscriptions through hierarchical inheritance.
Estimated Time:2m 30s
Question 37Question →

An administrator is configuring a General Purpose v2 (GPv2) storage account named corpstore01 in the East US region. The storage account currently uses Locally Redundant Storage (LRS) and hosts critical application logs. The administrator must meet the following requirements:

- Replicate the storage account to the West US region to protect against regional outages while allowing read access to the replicated data in West US under normal operations.
- Automatically move block blobs inside the container named telemetry that begin with the prefix daily/ to the Archive storage tier if they have not been modified for more than 90 days.
- Ensure that the storage account is prepared for customer-managed failover, and understand the redundancy state of the account after a failover is executed.

Which of the following configurations and statements are correct for this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the replication of the storage account to Read-Access Geo-Redundant Storage (RA-GRS).; Create a lifecycle management policy rule with a prefix filter set to telemetry/daily/ to transition the blobs to the Archive tier.

Answer

Configure the replication of the storage account to Read-Access Geo-Redundant Storage (RA-GRS), and create a lifecycle management policy rule with a prefix filter set to telemetry/daily/ to transition the blobs to the Archive tier.
To satisfy the requirements, the storage account must be configured for Read-Access Geo-Redundant Storage (RA-GRS) to allow read access to the secondary region under normal operations. Additionally, lifecycle rules require prefix filters to start with the container name, meaning the correct path is telemetry/daily/.

Step-by-Step Solution

1
Select the appropriate replication tier to meet read-access requirements.
Read-Access Geo-Redundant Storage (RA-GRS) is selected because it replicates data to West US and allows read access to the secondary endpoint under normal operations.
Standard GRS does not allow read access to the secondary endpoint unless a failover is initiated, making RA-GRS the correct choice.
2
Determine the prefix formatting for the lifecycle management policy rule.
The prefix must be formatted as telemetry/daily/.
Azure lifecycle management policies evaluate prefixes starting with the container name. A prefix of daily/ would look for a container named daily instead of targeting the container named telemetry.
3
Evaluate the behavior of customer-managed failover on replication redundancy.
The failover converts the account to Locally Redundant Storage (LRS) in the new primary region.
When a failover occurs, the secondary region becomes the primary region, and the account replication changes to LRS. Redundancy is not automatically preserved as RA-GRS.

Key Concept

Azure Storage account replication options and Blob Lifecycle Management prefix rule filters.
Question 38Question →

You manage two General Purpose v2 (GPv2) storage accounts in the East US region:

* `storage1`: Configured with Locally Redundant Storage (LRS).
* `storage2`: Configured with Zone-Redundant Storage (ZRS).

You need to update the replication configuration of both storage accounts to meet the following requirements:

* Replicate all data to a secondary region (West US).
* Maintain zone redundancy in the primary region.
* Ensure there is no downtime or data loss during the configuration change.
* Avoid manual data replication.

Which two actions should you perform?

Select all that apply

Show answer & explanation

Answer: For storage2, change the replication setting to Geo-zone-redundant storage (GZRS) in the Azure portal.; For storage1, submit a support request to Microsoft to perform a live migration to Geo-zone-redundant storage (GZRS).

Answer

To meet the requirements, you should change the replication setting of storage2 to Geo-zone-redundant storage (GZRS) in the Azure portal, and submit a support request to Microsoft to perform a live migration to Geo-zone-redundant storage (GZRS) for storage1.
To maintain zone redundancy in the primary region and replicate to a secondary region, the storage accounts must use Geo-zone-redundant storage (GZRS). For the storage account configured with ZRS (storage2), converting to GZRS is a self-service operation that can be performed directly in the Azure portal. For the storage account configured with LRS (storage1), converting to GZRS cannot be done via self-service and requires submitting a support request to Microsoft to perform a live migration, which avoids downtime and data copying.

Step-by-Step Solution

1
Determine the required replication type.
Both storage accounts must be zone-redundant in East US and geo-replicated to West US, which requires Geo-zone-redundant storage (GZRS).
GZRS replicates data synchronously across three Azure availability zones in the primary region and asynchronously to a secondary region.
2
Evaluate the migration path for storage2.
Changing from Zone-Redundant Storage (ZRS) to Geo-zone-redundant storage (GZRS) is supported as a direct self-service conversion.
Azure allows self-service changes from ZRS to GZRS directly from the Azure portal, PowerShell, or Azure CLI.
3
Evaluate the migration path for storage1.
Changing from Locally Redundant Storage (LRS) to Geo-zone-redundant storage (GZRS) requires a live migration.
Self-service conversion from LRS directly to GZRS is not supported. To avoid downtime and manual copy, a support ticket must be submitted for a Microsoft-managed live migration.

Key Concept

Replication migration paths and constraints for Azure GPv2 storage accounts
Question 39Question →

Your company has a Microsoft Entra ID tenant. The tenant contains an Administrative Unit named Corporate-AU. The following resources are members of Corporate-AU:

* A user named User1
* A dynamic user group named HQ-Staff

A user named Admin1 is currently assigned the Groups Administrator role scoped to Corporate-AU. You need to ensure that User1 is added to HQ-Staff. The solution must follow the principle of least privilege. Which action should you perform?

Show answer & explanation

Answer: Assign the User Administrator role scoped to Corporate-AU to Admin1, and then modify the attributes of User1 to match the dynamic membership rule.

Answer

Assign the User Administrator role scoped to Corporate-AU to Admin1, and then modify the attributes of User1 to match the dynamic membership rule.
The correct answer is to assign the User Administrator role scoped to Corporate-AU to Admin1 and modify the attributes of User1. Because HQ-Staff is a dynamic group, membership is calculated automatically by Microsoft Entra ID based on the user's attributes matching the group's dynamic membership rule. To trigger membership, User1's attributes must be modified. Since User1 is in Corporate-AU, assigning the User Administrator role scoped to Corporate-AU to Admin1 provides the exact permissions required to modify User1's attributes without granting unnecessary directory-wide permissions, following the principle of least privilege.

Step-by-Step Solution

1
Analyze the group type of HQ-Staff.
HQ-Staff is a dynamic user group.
You cannot manually add or remove members in a dynamic group; membership is managed by the system based on rules.
2
Identify the minimum administrative change required to add User1 to the dynamic group.
Modify User1's attributes to match the dynamic membership rule of HQ-Staff.
This is the only valid way to add a user to a dynamic group.
3
Determine the administrative role needed to modify User1's attributes within the scope of Corporate-AU.
User Administrator role scoped to Corporate-AU.
Since User1 is a member of Corporate-AU, an administrator with the User Administrator role scoped to Corporate-AU can modify User1's attributes without requiring tenant-wide permissions, satisfying the least privilege requirement.

Key Concept

Microsoft Entra ID dynamic group membership management and administrative unit role delegation.
Question 40Question →

An organization is designing its Azure Management Group hierarchy to manage multiple subscriptions. Which of the following statements regarding the structure and inheritance behavior of Azure Management Groups are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A management group hierarchy supports up to six levels of depth, excluding the root management group and subscriptions.; Each child management group or subscription can have only one parent management group.

Answer

A management group hierarchy supports up to six levels of depth, excluding the root management group and subscriptions; and each child management group or subscription can have only one parent management group.
The correct statements are that a management group hierarchy supports up to six levels of depth (excluding the root and subscriptions) and that each child management group or subscription can have only one parent management group. These represent standard structural constraints in Azure resource governance.

Step-by-Step Solution

1
Analyze the structural rules of Azure Management Group hierarchies.
Determine that the maximum depth of the hierarchy is six levels (excluding the root management group and subscriptions), and the structure is a strict tree where each node has exactly one parent.
This establishes the fundamental layout constraints for management groups.
2
Evaluate the inheritance behavior of resource locks and policies across the hierarchy.
Confirm that both policies and resource locks are inherited down the hierarchy and cannot be bypassed or blocked by lower-level configurations.
This rules out the options claiming that resource locks do not inherit or that policy inheritance can be blocked.
3
Verify the properties and lifecycle of the Root Management Group.
Confirm that the Root Management Group is a system-created, undeletable container that serves as the root of the hierarchy.
This rules out the option stating that the Root Management Group can be deleted.

Key Concept

Azure Management Groups allow logical grouping of subscriptions and resources in a hierarchical tree structure to apply policies and RBAC roles that inherit down the hierarchy. The hierarchy supports up to six levels of depth (excluding root and subscriptions), and each child node can have only one parent.
PreviousPage 2 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin