All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

You have an Azure subscription that contains a storage account named sadata2026. The storage account contains a blob container named reports. A user named User1 is assigned the following Azure role-based access control (RBAC) roles:

* Reader at the storage account scope
* Storage Blob Data Reader at the reports container scope

User1 logs into the Azure Portal, navigates to the reports container, and attempts to view the list of blobs. User1 receives an error indicating that they are not authorized to list the blobs. You need to ensure that User1 can view and download the blobs in the container using the least privilege.

Which action should you instruct User1 to perform?

Switch the authentication method in the Azure Portal to Azure AD User Account.

Assign the Storage Account Contributor role to User1 at the storage account scope.

Assign the Directory Reader role to User1 in Microsoft Entra ID.

Assign the Reader role to User1 at the Azure subscription scope.

Show answer & explanation

Answer: Switch the authentication method in the Azure Portal to Azure AD User Account.

Answer

Instruct User1 to switch the authentication method in the Azure Portal to Azure AD User Account.

The correct action is to instruct User1 to switch the authentication method in the Azure Portal to Azure AD User Account. The Reader role at the storage account level does not grant permission to view the storage account's access keys. Because the Azure Portal defaults to using access keys to list blob containers and blobs, User1 receives an authorization error. By switching the authentication method to Azure AD User Account, the portal uses Microsoft Entra ID authentication, allowing User1 to successfully list and view the blobs using their Storage Blob Data Reader role assignment.

Step-by-Step Solution

Analyze the existing role assignments for User1.

User1 has control plane read access (Reader) at the storage account level and data plane read access (Storage Blob Data Reader) at the container level.

This establishes that User1 has the necessary permissions to read the blobs via Entra ID but lacks permissions to list access keys.

Identify the cause of the authorization error in the Azure Portal.

The Azure Portal defaults to Access Key authentication when browsing containers.

Because User1 only has the Reader role at the storage account scope, they cannot retrieve the access keys, resulting in an authorization failure.

Determine the least-privileged resolution.

Switching the portal's authentication method to Azure AD User Account leverages User1's existing Storage Blob Data Reader permission.

This uses Entra ID authentication directly and avoids granting excessive permissions such as Storage Account Contributor.

Key Concept

Azure Storage authenticates data plane requests using either Access Keys (control plane permission required) or Microsoft Entra ID (data plane RBAC roles required). The Azure Portal defaults to Access Keys, which requires switching the authentication method for users who only have Entra ID data plane permissions.

Question 402Question →

You manage an Azure App Service web app named WebApp1 and an Azure Storage account named storage1. Access to storage1 is restricted by a firewall.

You need to configure WebApp1 to perform scheduled custom backups to storage1 using a secure, identity-based connection without exposing storage1 to the public internet.

Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: First, enable a system-assigned managed identity on WebApp1. Second, assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1. Third, configure regional virtual network integration for WebApp1. Fourth, configure the network firewalls on storage1 to allow access from the subnet used by WebApp1. Finally, configure the backup settings in WebApp1 using the storage container and the managed identity.

The correct sequence resolves dependencies step-by-step: first creating the security principal (managed identity), then granting it access to write blobs (Storage Blob Data Contributor role), next routing WebApp1's outbound traffic through a virtual network subnet (regional VNet integration), allowing that subnet through the storage account firewall, and finally saving the backup configuration targeting the storage account using the identity.

Step-by-Step Solution

Enable a system-assigned managed identity on WebApp1.

A security principal for the Web App is registered in Microsoft Entra ID.

A managed identity is needed to authenticate WebApp1 to storage1 without storing credentials in the application configuration.

Assign the Storage Blob Data Contributor role to the managed identity of WebApp1 on storage1.

The managed identity is authorized to read, write, and delete blobs inside the storage account.

The backup system writes archives to storage container blobs, which requires data-plane write access.

Configure regional virtual network integration for WebApp1.

Outbound traffic from WebApp1 is routed through the integrated subnet.

Because storage1 is protected by a firewall, WebApp1 must route its traffic through a virtual network to reach it securely.

Configure the network firewalls on storage1 to allow access from the subnet used by WebApp1.

The storage account is configured to accept inbound connections from the App Service's subnet.

Without this rule, the storage firewall will block all inbound connection attempts originating from WebApp1.

Configure the backup settings in WebApp1 to target a container in storage1 using the managed identity.

The App Service successfully validates the connection and schedules the custom backup.

Validation succeeds because both authentication permissions and network accessibility have been configured.

Key Concept

Configuring App Service backups to secured storage using managed identities and VNet integration

Question 403Question →

An administrator configures secure network access to an Azure Storage account named stcorpdata. The administrator disables public network access to the storage account and deploys a Private Endpoint in Subnet-App within a virtual network named VNet-Core. A private DNS zone named privatelink.blob.core.windows.net is created and linked to VNet-Core, containing a DNS A record pointing stcorpdata.blob.core.windows.net to the private IP address of the Private Endpoint.

An Azure Virtual Machine named VM-App is deployed in a peered virtual network named VNet-Spoke. Although the virtual network peering between VNet-Core and VNet-Spoke is successfully established, applications on VM-App cannot connect to the storage account because they resolve stcorpdata.blob.core.windows.net to its public IP address instead of its private IP address.

What should the administrator do to resolve the DNS resolution issue from VM-App?

Link the private DNS zone privatelink.blob.core.windows.net to the VNet-Spoke virtual network.

Configure gateway transit on the virtual network peering connection between VNet-Core and VNet-Spoke.

Assign the Private DNS Zone Contributor role on the private DNS zone to the managed identity of VM-App.

Create an inbound Network Security Group (NSG) rule in Subnet-App that allows DNS queries (UDP port 53) from VNet-Spoke.

Show answer & explanation

Answer: Link the private DNS zone privatelink.blob.core.windows.net to the VNet-Spoke virtual network.

Answer

Link the private DNS zone privatelink.blob.core.windows.net to the VNet-Spoke virtual network.

Linking the private DNS zone to VNet-Spoke is the correct action. When a Private Endpoint is configured, the public FQDN of the storage account (stcorpdata.blob.core.windows.net) is updated to point to a CNAME alias (stcorpdata.privatelink.blob.core.windows.net). By linking the private DNS zone privatelink.blob.core.windows.net to VNet-Spoke, the DNS service in VNet-Spoke is able to resolve the private IP address of the Private Endpoint. Otherwise, the name resolution falls back to the public DNS system, returning the public IP address.

Step-by-Step Solution

Analyze the DNS resolution pathway in the peered virtual networks.

Identify that VM-App in VNet-Spoke is receiving the public IP address of the storage account because VNet-Spoke's DNS resolver does not have access to the private DNS zone.

By default, a private DNS zone is only queryable by virtual networks that are explicitly linked to it.

Identify the configuration required to share private DNS resolution with peered virtual networks.

Determine that linking the private DNS zone to the spoke VNet is necessary.

Establishing a virtual network link between privatelink.blob.core.windows.net and VNet-Spoke enables VMs in the spoke VNet to resolve records within that private zone.

Key Concept

Private Endpoint DNS Integration with Peered Virtual Networks

Estimated Time:1m 30s

Question 404Question →

An organization requires a new Azure virtual machine to host a database. To protect the database against the failure of an entire datacenter building within the chosen region, which configuration option should be specified when provisioning the virtual machine?

Availability Zones

Availability Sets

A Recovery Services vault in a different region

A Basic tier App Service Plan

Show answer & explanation

Answer: Availability Zones

Answer

Availability Zones

Availability Zones are physically unique locations within an Azure region. Each zone is made up of one or more datacenters equipped with independent power, cooling, and networking. By deploying a virtual machine to an Availability Zone, you ensure the workload is protected against the failure of an entire datacenter facility.

Step-by-Step Solution

Analyze the resiliency requirement specified in the scenario.

The requirement is protection against the failure of an entire datacenter building (datacenter-wide failure).

This determines the scope of isolation needed (physical separation vs. rack-level separation).

Evaluate the virtual machine availability configurations against the requirement.

Availability Zones offer physical isolation by placing VMs in distinct datacenters. Availability Sets only provide rack-level redundancy within the same datacenter.

Choosing the correct option requires understanding the boundary of protection each feature provides.

Select the option that meets the physical isolation requirement.

Availability Zones is the correct configuration.

Only Availability Zones protect against a full datacenter failure within an Azure region.

Key Concept

Azure Virtual Machine High Availability Options

Estimated Time:45s

Question 405Question →

Your company has an Azure environment with the following resource hierarchy:
* Tenant Root Group (Management Group)
* Finance-MG (Management Group)
* Sub-Finance (Subscription)
* RG-Core (Resource Group)
* RG-Archive (Resource Group)
* storarchive (Storage Account)

You need to grant permissions to a user named User1 to perform the following tasks:
1. Manage virtual machines located in RG-Core.
2. Configure Azure Backup for the virtual machines in RG-Core, which includes creating a new Recovery Services vault inside RG-Core.
3. Read and write blob data within the containers of the storarchive storage account.

You must follow the principle of least privilege.

Which role assignments should you configure?

Assign the Contributor role at the RG-Core scope, and the Storage Blob Data Contributor role at the storarchive scope.

Assign the Contributor role at the RG-Core scope, and the Contributor role at the RG-Archive scope.

Assign the Contributor role at the Sub-Finance scope.

Assign the Contributor role at the RG-Core scope, and the Microsoft Entra ID Global Reader role.

Show answer & explanation

Answer: Assign the Contributor role at the RG-Core scope, and the Storage Blob Data Contributor role at the storarchive scope.

Answer

Assign the Contributor role at the RG-Core scope, and the Storage Blob Data Contributor role at the storarchive scope.

The correct configuration provides the exact permissions required by the user while strictly adhering to the principle of least privilege. Assigning the Contributor role at the RG-Core scope grants the user write permissions to create the Recovery Services vault and manage VMs within that resource group only. Assigning the Storage Blob Data Contributor role at the storarchive scope grants the data-plane access needed to read and write blobs without giving the user administrative rights over the entire RG-Archive resource group.

Step-by-Step Solution

Analyze the requirements for RG-Core.

User1 needs to manage VMs and create a Recovery Services vault inside RG-Core.

Creating a Recovery Services vault requires write permissions on the resource group. The Contributor role at the RG-Core scope provides these write permissions along with VM management, restricting User1's administrative rights to this single resource group.

Analyze the requirements for the storage account.

User1 needs to read and write blob data inside the storarchive storage account.

Azure storage control-plane roles (like Contributor) do not grant direct data-plane access to blobs. To read and write blob data using Entra ID authorization, User1 must be assigned the Storage Blob Data Contributor role at the scope of the storarchive storage account.

Verify compliance with the principle of least privilege.

The combined role assignments limit User1's access to only the necessary resource scopes.

Assigning permissions at the resource group and resource level instead of the subscription level prevents over-provisioning access to other parts of the Azure environment.

Key Concept

Applying least privilege access by combining control-plane (Contributor) and data-plane (Storage Blob Data Contributor) roles at appropriate resource scopes.

Question 406Question →

An administrator is configuring a new virtual machine named VM1 in the East US region. The deployment has the following requirements:

- The OS disk must be deployed as an Ephemeral OS disk using the virtual machine's local temp disk to reduce read/write latency.
- The virtual machine must use the Standard_D4s_v5 size, which features $4$ vCPUs, $16$ GB of RAM, a $50$ GB cache limit, and a $100$ GB temp disk.
- The operating system must be deployed using a custom Windows Server 2022 image that has a size of $127$ GB.

What is the result when the administrator attempts to deploy this virtual machine?

The deployment fails because the

127

GB size of the custom OS image exceeds the

100

GB local temp disk capacity of the Standard_D4s_v5 virtual machine size.

The deployment fails because Ephemeral OS disks are unsupported when deploying virtual machines to an Availability Zone.

The deployment fails because the custom image must first be converted to a zone-redundant storage (ZRS) tier before it can be used for Ephemeral OS disk creation.

The deployment succeeds, but the OS disk is automatically provisioned as a Premium SSD managed disk, which will incur standard monthly storage charges.

Show answer & explanation

Answer: The deployment fails because the $127$ GB size of the custom OS image exceeds the $100$ GB local temp disk capacity of the Standard_D4s_v5 virtual machine size.

Answer

The deployment fails because the custom OS image size exceeds the local temp disk capacity of the virtual machine size.

The correct option states that the deployment will fail because the custom OS image size (

127

GB) exceeds the capacity of the local temp disk (

100

GB) of the Standard_D4s_v5 virtual machine size. Ephemeral OS disks are hosted on the local storage of the Azure VM host. Therefore, the size of the custom OS image cannot exceed the local cache or temp disk limit specified by the VM size.

Step-by-Step Solution

Determine the placement option for the Ephemeral OS disk.

The requirement specifies using the VM's local temp disk (resource disk) for Ephemeral OS disk placement.

Ephemeral OS disks can be placed either in the VM's OS cache or the temp disk, depending on the VM size and placement configuration.

Compare the size of the OS image with the capacity of the selected placement option.

The custom image size (

127

GB) is compared against the Standard_D4s_v5 temp disk capacity (

100

GB).

For an Ephemeral OS disk deployment to succeed, the OS image size must be less than or equal to the capacity of the cache or temp disk on the chosen VM size.

Evaluate the deployment outcome based on the storage limits.

Since

127

GB is greater than

100

GB, the deployment fails during the validation phase.

There is insufficient local storage on the Standard_D4s_v5 host temp disk to accommodate the

127

GB custom OS image.

Key Concept

Ephemeral OS Disk Sizing Limitations

Estimated Time:2m 0s

Question 407Question →

An administrator is planning the deployment of a new virtual machine named VM-Prod1 in the East US region. The virtual machine will host a database workload. The deployment must satisfy the following requirements:
- Use Ultra Disk storage for the database log files.
- Provide high availability with infrastructure protection against datacenter-wide failures.
- Position the virtual machine backend pool behind a public-facing load balancer.
- Configure daily backups for VM-Prod1.

You currently have an active Recovery Services Vault named RSV1 located in the West US region and a Public Load Balancer named LB1 configured with the Basic SKU.

Which configuration must you select to meet all deployment requirements?

Deploy VM-Prod1 in an Availability Set in the East US region, use the existing Basic SKU LB1, and create a new Recovery Services Vault in the East US region.

Deploy VM-Prod1 in an Availability Zone in the East US region, deploy a Standard SKU Load Balancer, and create a new Recovery Services Vault in the East US region.

Deploy VM-Prod1 in an Availability Zone in the East US region, use the existing Basic SKU LB1, and create a new Recovery Services Vault in the East US region.

Deploy VM-Prod1 in an Availability Zone in the East US region, deploy a Standard SKU Load Balancer, and use the existing RSV1 in the West US region.

Show answer & explanation

Answer: Deploy VM-Prod1 in an Availability Zone in the East US region, deploy a Standard SKU Load Balancer, and create a new Recovery Services Vault in the East US region.

Answer

Deploy the virtual machine in an Availability Zone in the East US region, deploy a Standard SKU Load Balancer, and create a new Recovery Services Vault in the East US region.

Deploying the virtual machine to an Availability Zone is necessary to support Ultra Disk storage and provide infrastructure redundancy that protects against datacenter-wide failures. Furthermore, a Standard Load Balancer is required to route traffic to resources deployed in Availability Zones, as Basic Load Balancers do not support zonal instances. Finally, virtual machine backups using a Recovery Services Vault must occur within the same target region as the source virtual machine, requiring a new vault in the East US region.

Step-by-Step Solution

Determine the high availability and storage requirements.

Ultra Disk storage and protection against datacenter-wide failures dictate that the virtual machine must be deployed in an Availability Zone rather than an Availability Set.

Ultra Disks are zonal resources, and Availability Zones provide the physical isolation needed for datacenter-wide failure protection.

Evaluate the Load Balancer compatibility.

A Standard SKU Load Balancer is required to support the backend pool members located in specific Availability Zones.

Basic SKU Load Balancers do not support zone-specific virtual machines.

Evaluate the backup vault regional constraint.

A new Recovery Services Vault must be created in the East US region.

Azure Backup requires the Recovery Services Vault to reside in the same region as the virtual machine being backed up.

Key Concept

Azure VM infrastructure redundancy, storage compatibility (Ultra Disk), load balancer SKU limitations, and backup regional constraints.

Estimated Time:2m 30s

Question 408Question →

You have an Azure subscription that contains a resource group named RG1. Inside RG1, you create a virtual network named VNet1. VNet1 has a subnet named Subnet1 with an address space of $10.0.1.0/28$ . You need to deploy a resource in Subnet1 and configure it with a static IP address of $10.0.1.3$ . Is the statement true that you can assign the IP address $10.0.1.3$ to the resource?

True

False

Show answer & explanation

Answer: False

Answer

False

In any Azure subnet, the first four IP addresses and the last IP address are reserved by Azure for internal routing, DNS, and broadcast functions. For the subnet address space

10.0.1.0/28

, the reserved IPs are

10.0.1.0

10.0.1.1

10.0.1.2

10.0.1.3

, and

10.0.1.15

. Because

10.0.1.3

is one of the reserved addresses, the statement is false.

Step-by-Step Solution

Calculate the IP range for the subnet based on its CIDR notation.

The subnet range for

10.0.1.0/28

spans from

10.0.1.0

10.0.1.15

, representing 16 total IP addresses.

Before analyzing availability, the total boundaries of the subnet must be established.

Identify the specific IP addresses reserved by Azure within the subnet.

Azure reserves the first four IP addresses (

10.0.1.0

10.0.1.1

10.0.1.2

10.0.1.3

) and the last IP address (

10.0.1.15

) of the subnet.

Azure enforces specific IP reservation rules for network control, gateway routing, DNS mapping, and broadcast functions.

Check if the desired IP address falls into the reserved IP range.

The IP address

10.0.1.3

matches the fourth reserved IP address in the subnet.

Since the IP address is reserved by Azure, it cannot be dynamically or statically assigned to user workloads.

Key Concept

Azure Subnet Reserved IP Addresses

Question 409Question →

You configure an Azure virtual network with an address space of $10.0.0.0/24$ and create a subnet named Subnet1 with the address range $10.0.0.0/26$ . Is the statement 'The maximum number of usable IP addresses for Azure resources in Subnet1 is 59' true or false?

True

False

Show answer & explanation

Answer: True

Answer

True

The statement is correct because Azure reserves 5 IP addresses in every subnet. A

/26

network contains 64 total addresses, resulting in 59 usable IP addresses.

Step-by-Step Solution

Calculate the total number of IP addresses in the subnet CIDR block.

/26

CIDR block contains

2^{32 - 26} = 64

total IP addresses.

Determining the total capacity is the starting point for calculating usable addresses.

Apply the Azure-specific subnet reservation rule.

Azure reserves 5 IP addresses per subnet: the first four addresses and the last address.

Azure virtual networking requires these reserved IP addresses for internal routing, DNS, and network identity.

Subtract the reserved IP addresses from the total number of IP addresses.

64 - 5 = 59

usable IP addresses.

This determines the exact count of IP addresses available for allocation to resources in the subnet.

Key Concept

Azure Subnet Reserved IP Addresses

Estimated Time:45s

Question 410Question →

Your company has an Azure subscription containing a resource group named RG1. You plan to deploy a new virtual network named VNet1 in RG1. VNet1 will use the $10.1.0.0/16$ address space.

You need to configure subnets within VNet1 to support the following requirements:
- Subnet-Web: Must support at least $250$ virtual machines.
- Azure Bastion: Must be deployed to secure management access.
- VPN Gateway: Must be deployed to support hybrid connectivity.

To conserve IP addresses for future subnets, you must minimize the address space allocated to each subnet.

Which subnet configuration should you use?

Subnet-Web: 10.1.0.0/24; AzureBastionSubnet: 10.1.1.0/26; GatewaySubnet: 10.1.1.64/29

Subnet-Web: 10.1.0.0/25; AzureBastionSubnet: 10.1.0.128/26; GatewaySubnet: 10.1.0.192/29

Subnet-Web: 10.1.0.0/24; AzureBastionSubnet: 10.1.1.0/27; GatewaySubnet: 10.1.1.32/29

Subnet-Web: 10.1.0.0/24; AzureBastionSubnet: 10.1.1.0/26; GatewaySubnet: 10.1.1.64/30

Show answer & explanation

Answer: Subnet-Web: 10.1.0.0/24; AzureBastionSubnet: 10.1.1.0/26; GatewaySubnet: 10.1.1.64/29

Answer

Subnet-Web: 10.1.0.0/24; AzureBastionSubnet: 10.1.1.0/26; GatewaySubnet: 10.1.1.64/29

The subnet configuration with Subnet-Web as 10.1.0.0/24, AzureBastionSubnet as 10.1.1.0/26, and GatewaySubnet as 10.1.1.64/29 is correct because it satisfies all size and host requirements without any overlapping ranges. The Web subnet provides

251

usable IP addresses (

256 - 5

reserved) which meets the

250

host requirement. The Bastion subnet meets the

/26

minimum requirement, and the VPN Gateway subnet meets the

/29

minimum requirement.

Step-by-Step Solution

Determine the minimum prefix size for Subnet-Web to support the host count.

/24

prefix is required.

Subnet-Web must support at least

250

hosts. Azure reserves

5

IP addresses in every subnet (first four and the last one). A

/25

prefix offers

128 - 5 = 123

usable hosts, which is insufficient. A

/24

prefix offers

256 - 5 = 251

usable hosts, satisfying the minimum requirement.

Determine the minimum prefix size for Azure Bastion.

/26

prefix is required.

Azure Bastion must be deployed into a dedicated subnet named AzureBastionSubnet. Microsoft requires this subnet to have a prefix of

/26

or larger.

Determine the minimum prefix size for the VPN Gateway.

/29

prefix is required.

The VPN Gateway must be deployed into a dedicated subnet named GatewaySubnet. The minimum supported prefix size for a GatewaySubnet is

/29

Verify subnet IP ranges for overlaps and select the non-overlapping combination.

Subnet-Web: 10.1.0.0/24, AzureBastionSubnet: 10.1.1.0/26, GatewaySubnet: 10.1.1.64/29.

The range

10.1.0.0/24

spans

10.1.0.0

10.1.0.255

. The range

10.1.1.0/26

spans

10.1.1.0

10.1.1.63

. The range

10.1.1.64/29

spans

10.1.1.64

10.1.1.71

. These ranges are adjacent and do not overlap.

Key Concept

Azure Subnet sizing requirements and reserved IP addresses

Estimated Time:2m 0s

Question 411Question →

An organization implements Microsoft Entra ID. You are tasked with delegating administrative duties for a specific subset of employees. A helpdesk worker named Alex must be able to perform password resets, modify profile fields, and assign licenses for users in the Finance department only. Alex must not have administrative permissions over users in other departments. Which action should you perform?

Create an administrative unit containing the Finance department users, and assign the User Administrator role to Alex scoped to the administrative unit.

Create an administrative unit containing the Finance department users, and assign the Helpdesk Administrator role to Alex scoped to the administrative unit.

Create an administrative unit containing the Finance department users, and assign the User Access Administrator role to Alex scoped to the administrative unit.

Assign the User Administrator role to Alex at the tenant scope.

Show answer & explanation

Answer: Create an administrative unit containing the Finance department users, and assign the User Administrator role to Alex scoped to the administrative unit.

Answer

Create an administrative unit containing the Finance department users, and assign the User Administrator role to Alex scoped to the administrative unit.

The correct action is to create an administrative unit containing the Finance department users and assign the User Administrator role to Alex scoped to that administrative unit. This configuration restricts Alex's administrative capabilities (including password resets, profile edits, and license assignments) strictly to the Finance department users, satisfying the requirement of least privilege.

Step-by-Step Solution

Identify the scope requirement.

The requirement states that permissions must be limited to users in the Finance department only. This requires creating a Microsoft Entra ID administrative unit to define the boundary.

Administrative units allow scoping of directory role permissions to a subset of users or groups.

Determine the required Microsoft Entra ID role.

The role must permit password resets, profile updates, and direct license assignments. The User Administrator role has all these permissions.

The Helpdesk Administrator role lacks license assignment and full profile editing capabilities.

Delegate the role at the correct scope.

Assign the User Administrator role to Alex specifically scoped to the newly created administrative unit.

This limits Alex's User Administrator permissions to only the users within the Finance administrative unit, fulfilling the least privilege constraint.

Key Concept

Delegating Microsoft Entra ID directory roles scoped to an administrative unit to enforce the principle of least privilege.

Question 412Question →

You have an Azure App Service web app named App1. You need to configure a custom domain named www.contoso.com for App1 and secure it using a free Azure App Service Managed Certificate.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, create a CNAME record with the DNS provider mapping the domain to the App Service; second, add the custom domain to the App Service web app; third, create the App Service Managed Certificate; and fourth, create the SNI SSL binding using the managed certificate.

To secure a custom domain using an App Service Managed Certificate, you must first create the CNAME record in DNS so Azure can validate ownership. Then, you add the custom domain to the App Service. Once the custom domain is successfully added, you generate the App Service Managed Certificate. Finally, you configure an SNI SSL binding to link the certificate to the custom domain.

Step-by-Step Solution

Create a CNAME record with your DNS provider that maps www.contoso.com to app1.azurewebsites.net.

The domain maps to the App Service, allowing Azure to validate ownership.

Azure validation requires a valid DNS record to prove ownership before the domain can be bound to the App Service.

Add the custom domain www.contoso.com to App1 in the Azure portal.

The hostname is registered and bound to the App Service instance.

The domain name must be registered on the App Service before a managed certificate can be issued for it.

Create an App Service Managed Certificate for www.contoso.com.

Azure generates and provisions a free certificate for the validated domain.

The certificate can only be generated for a domain that is actively bound to the App Service and resolves correctly.

Create an SNI SSL binding for www.contoso.com using the App Service Managed Certificate.

HTTPS traffic is enabled and secured for the custom domain.

Provisioning the certificate is not sufficient; the certificate must be explicitly bound to the custom domain mapping.

Key Concept

Configuring custom domains and TLS/SSL certificates on Azure App Services

Question 413Question →

You need to use AzCopy to upload a folder from an on-premises client computer to a blob container named `data` in an Azure Storage account named `store1`.

The storage account is configured to restrict network access to selected networks.

You plan to authenticate AzCopy using a Microsoft Entra ID service principal named `AzCopySP`.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To successfully perform the migration, you must first configure the storage account firewall to allow the public IP of the client computer, assign the Storage Blob Data Contributor role to the service principal, configure the `AZCOPY_SPA_CLIENT_SECRET` environment variable on the client, run `azcopy login` with the service principal's credentials, and finally run the `azcopy copy` command.

The correct sequence starts with setting up the infrastructure dependencies: first configuring the storage account firewall to permit traffic from the client's public IP address, and assigning the Storage Blob Data Contributor role to the service principal to authorize data plane actions. Next, on the client side, the environment variable `AZCOPY_SPA_CLIENT_SECRET` must be set because AzCopy does not accept the client secret as a direct parameter. Once the environment variable is configured, running `azcopy login` with the service principal parameters completes the authentication. Finally, executing `azcopy copy` transfers the files securely.

Step-by-Step Solution

Configure the firewall of the storage account `store1` to allow traffic from the public IP address of the client computer.

Network connectivity is established between the on-premises client computer and the storage account endpoints.

By default, a firewalled storage account blocks all traffic unless the client IP is explicitly allowed or configured as an exception.

Assign the Storage Blob Data Contributor role to the service principal `AzCopySP` at the storage account level.

The service principal is authorized to perform data write operations to the blob service.

Microsoft Entra ID authentication requires specific data plane roles like Storage Blob Data Contributor to write data; control plane roles like Owner or Contributor are insufficient.

Set the environment variable `AZCOPY_SPA_CLIENT_SECRET` to the service principal's client secret on the client computer.

The client secret is stored securely in the shell's environment.

For security reasons, AzCopy does not accept the client secret as a direct command-line parameter. It must be set as an environment variable prior to authentication.

Run the `azcopy login` command with the `--service-principal`, `--application-id`, and `--tenant-id` flags on the client computer.

AzCopy authenticates against Microsoft Entra ID using the service principal identity.

Running this command initiates the non-interactive login session needed for scripts or automated transfers.

Run the `azcopy copy` command with the source local directory and the destination container URL.

The directory and its files are copied successfully to the Azure Blob storage container.

Once network access, authorization, and authentication are in place, the copy command can interact with the storage account and write data.

Key Concept

Configuring non-interactive authentication and network access for secure AzCopy data transfers using Microsoft Entra ID service principals.

Question 414Question →

An administrator is deploying several Azure virtual machines (VMs) and must configure their storage, boot architecture, and encryption capabilities. How should the administrator match each Azure VM feature on the left with its correct description on the right?

Click a left item, then click its matching right item

Show answer & explanation

Answer

Ephemeral OS Disk matches the description of storing the operating system directly on local storage. Trusted Launch matches the description of protecting against boot/kernel malware via Secure Boot and vTPM. Encryption at Host matches the description of encrypting temp/ephemeral disks and caches on the VM host server. Generation 2 VM matches the description of enabling UEFI boot architecture and supporting OS disks larger than 2 TB.

The correct pairings align the specific capabilities of each feature: Ephemeral OS disks place the OS locally on the host node; Trusted Launch uses UEFI Secure Boot and vTPM for boot-path protection; Encryption at Host encrypts local host caches and temporary disks before sending data to Azure Storage; and Generation 2 VMs implement the UEFI boot architecture which supports disks larger than 2 TB.

Step-by-Step Solution

Analyze the Ephemeral OS Disk feature.

Ephemeral OS disks use the local node's SSD/cache storage to host the OS, avoiding remote storage latency and cost, matching the local storage description.

Understanding storage localization and latency benefits of Ephemeral OS disks.

Analyze the Trusted Launch feature.

Trusted Launch provides boot-time protection using Secure Boot and vTPM, protecting against bootkits and rootkits, matching the malware protection description.

Identifying VM security features for boot path integrity.

Analyze the Encryption at Host setting.

Encryption at Host encrypts caches and temp/ephemeral disks at the physical host level before network transfer to Azure Storage, matching the host-level encryption description.

Distinguishing host-based encryption from storage-service encryption (SSE) or Azure Disk Encryption (ADE).

Analyze the Generation 2 VM architecture.

Generation 2 VMs use UEFI instead of BIOS, support larger disks, and are required for Trusted Launch, matching the boot architecture description.

Differentiating VM generation features and boot architecture limitations.

Key Concept

Azure Virtual Machine creation and configuration settings including storage performance, boot architecture, and security enhancements.

Estimated Time:1m 30s

Question 415Question →

An organization, Titan Sports, is planning the deployment of a new multi-tier application in the Australia East region. The application consists of four virtual machines: VM-Web1, VM-Web2, VM-App1, and VM-App2. The deployment must guarantee a $99.99\%$ uptime SLA at the virtual machine level and protect the application against datacenter-wide failures. Which configuration should you implement?

Deploy VM-Web1 and VM-App1 in Availability Zone 1, and deploy VM-Web2 and VM-App2 in Availability Zone 2.

Deploy all four virtual machines within a single Availability Set in the Australia East region.

Deploy VM-Web1 and VM-Web2 in Availability Zone 1, and deploy VM-App1 and VM-App2 in Availability Zone 2.

Deploy all four virtual machines in a single Availability Set that spans across two Availability Zones.

Show answer & explanation

Answer: Deploy VM-Web1 and VM-App1 in Availability Zone 1, and deploy VM-Web2 and VM-App2 in Availability Zone 2.

Answer

Deploy VM-Web1 and VM-App1 in Availability Zone 1, and deploy VM-Web2 and VM-App2 in Availability Zone 2.

Deploying the web and application tier virtual machines across multiple Availability Zones ensures protection against datacenter-wide failures and provides a

99.99\%

VM uptime SLA. By placing VM-Web1 and VM-App1 in Zone 1, and VM-Web2 and VM-App2 in Zone 2, a failure in either zone leaves at least one active web server and one active application server running in the other zone.

Step-by-Step Solution

Analyze the SLA and high availability requirements.

The application requires a

99.99\%

virtual machine uptime SLA and protection against datacenter-wide failures.

An SLA of

99.99\%

for virtual machines in Azure requires deploying two or more instances across different Availability Zones. Availability Sets only offer a

99.95\%

SLA and do not protect against datacenter-wide outages.

Design the distribution of virtual machines across the tiers.

Each tier (Web and App) must have at least one virtual machine running in each zone.

If an entire tier is placed in a single zone, a zone failure will make that entire tier unavailable, rendering the application offline despite having other tiers running.

Map the VMs to the target Availability Zones.

VM-Web1 and VM-App1 go to Zone 1; VM-Web2 and VM-App2 go to Zone 2.

This cross-zone distribution maintains the availability of both tiers if either zone fails.

Key Concept

To achieve a

99.99\%

SLA and protect against datacenter-wide failures, virtual machines must be deployed across multiple Availability Zones. Workloads must be distributed such that each application tier has active instances in each zone.

Question 416Question →

An administrator is tasked with configuring a custom domain name for an Azure App Service web app named App1. The web app is currently hosted on a Free (F1) App Service plan. The administrator needs to ensure that App1 can use the custom domain.

What is the first action the administrator must take?

Configure a CNAME record at the DNS registrar pointing to the default App Service URL.

Enable HTTPS Only in the TLS/SSL settings of the web app.

Scale up the App Service plan of App1.

Configure a custom deployment slot named staging for the web app.

Show answer & explanation

Answer: Scale up the App Service plan of App1.

Answer

Scale up the App Service plan of App1.

To bind a custom domain to an Azure App Service web app, the web app's App Service plan must be scaled up to at least the Shared (D1) tier or higher. The Free (F1) tier does not support custom domains, so the administrator must first scale up the App Service plan.

Step-by-Step Solution

Identify the current pricing tier of the App Service plan hosting the web app.

The App Service plan is currently on the Free (F1) tier.

App Service plan features and limits are determined by their pricing tier.

Determine the minimum pricing tier required for the custom domain feature.

The Shared (D1) tier or higher is required to configure custom domains.

The Free (F1) tier does not support custom domains.

Perform a scale-up operation on the App Service plan to at least the Shared (D1) tier.

The web app is now hosted on a tier that supports custom domain bindings.

Upgrading the App Service plan unlocks the ability to bind custom domains in the Azure portal.

Key Concept

Azure App Service plan pricing tiers and feature support

Question 417Question →

An Azure subscription contains two resource groups named rg-network and rg-data.

The resource groups have the following configurations:
- rg-network: Has a CanNotDelete lock and is tagged with CostCenter value $1001$ . It contains a virtual network named vnet-core.
- rg-data: Has a ReadOnly lock and is tagged with CostCenter value $1002$ . It contains a storage account named sa-logs.

Neither vnet-core nor sa-logs has any directly applied locks or tags.

Which of the following statements are correct? (Select two.)

Select all that apply

The administrator can modify the configuration of vnet-core, but cannot delete it.

The administrator is blocked from retrieving the access keys for sa-logs.

The administrator can retrieve the access keys for sa-logs because locks only affect resource configuration changes.

The sa-logs storage account automatically inherits the CostCenter tag with value

1002

from rg-data.

Show answer & explanation

Answer: The administrator can modify the configuration of vnet-core, but cannot delete it.; The administrator is blocked from retrieving the access keys for sa-logs.

Answer

The administrator can modify the configuration of vnet-core, but cannot delete it; and the administrator is blocked from retrieving the access keys for sa-logs.

The CanNotDelete lock on the resource group allows modification of the virtual network configuration while blocking its deletion. Additionally, the ReadOnly lock on the resource group blocks POST operations such as listing the storage account access keys for child resources.

Step-by-Step Solution

Evaluate the effect of the CanNotDelete lock on rg-network.

The CanNotDelete lock inherits to vnet-core, preventing its deletion but allowing configuration updates.

Azure Resource Locks inherit from parent scopes (resource groups) to child resources.

Evaluate the effect of the ReadOnly lock on rg-data.

The ReadOnly lock inherits to sa-logs, preventing modifications, deletion, and control-plane POST actions like List Keys.

ReadOnly locks restrict control-plane write, delete, and action operations.

Evaluate tag inheritance from rg-data to sa-logs.

The CostCenter tag is not applied to sa-logs.

Azure tags do not automatically inherit from resource groups to child resources.

Key Concept

Azure Resource Lock inheritance and Tag inheritance rules

Question 418Question →

Your company has an on-premises datacenter connected to an Azure virtual network using a Site-to-Site VPN. An on-premises server named Server1 runs the Azure File Sync agent. You have an Azure storage account named storagedata1 that contains an Azure file share named share1. To comply with security policies, the firewalls and virtual networks settings for storagedata1 are configured to allow access only from selected networks. You need to ensure that Server1 can synchronize files with share1 over the VPN connection. Which of the following configurations should you implement?

Configure a private endpoint for the file service of storagedata1 within the Azure virtual network.

Enable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of storagedata1.

Assign the Storage Blob Data Contributor role for storagedata1 to the registered server's managed identity.

Generate a Shared Access Signature (SAS) token for storagedata1 and import it using the Azure File Sync agent on Server1.

Show answer & explanation

Answer: Configure a private endpoint for the file service of storagedata1 within the Azure virtual network.

Answer

Configure a private endpoint for the file service of storagedata1 within the Azure virtual network.

Configuring a private endpoint for the file service of the storage account is the correct solution. It allows the on-premises server, connected via Site-to-Site VPN, to route synchronization traffic to the private IP of the file share, bypassing the public firewall restriction.

Step-by-Step Solution

Configure the private endpoint.

A private endpoint for the file service of the storage account is created in the Azure virtual network.

This establishes a private IP address within the VNet for communication with the file share.

Ensure DNS resolution is configured.

The on-premises server resolves the storage account's FQDN to the private IP address.

Traffic must be routed over the VPN tunnel to the private IP rather than the public endpoint.

Key Concept

Azure File Sync network configuration with storage firewalls

Question 419Question →

You are deploying a new Azure virtual machine by using the Azure portal. You need to configure infrastructure redundancy for the virtual machine to protect the application from localized failures. Which two infrastructure redundancy options can you configure under the Availability options setting during VM creation? (Select two.)

Select all that apply

Availability zone

Availability set

Proximity placement group

Recovery Services vault

Show answer & explanation

Answer: Availability zone; Availability set

Answer

The correct answers are the options representing 'Availability zone' and 'Availability set'.

The correct options are Availability zone and Availability set. Availability zones isolate workloads by placing virtual machines in physically distinct datacenter facilities within the same region, ensuring protection against power, cooling, or structural failures. Availability sets isolate virtual machines across different physical hardware nodes (fault domains and update domains) within a single datacenter, guarding against isolated hardware issues.

Step-by-Step Solution

Analyze the goal of the configuration, which is to protect the virtual machine from localized failures using infrastructure redundancy.

Identify that the setting must be a placement redundancy option configured during virtual machine creation.

This isolates the options to standard VM high availability placement configurations.

Review the options available under the Availability options dropdown on the Basics tab in the Azure portal.

Determine that both Availability zones (datacenter-level redundancy) and Availability sets (hardware-level redundancy within a datacenter) are available placement options.

Both configurations allow Azure to deploy VMs across distinct fault boundaries.

Key Concept

Identifying infrastructure redundancy placement configurations during Azure virtual machine creation.

Estimated Time:1m 0s

Question 420Question →

An administrator is designing a virtual machine deployment strategy in Azure to support a high-performance, multi-tier application. You need to map each architectural requirement to the correct Azure Virtual Machine configuration or feature. Match each requirement on the left to its corresponding configuration or feature on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Stateless web servers with zero OS disk storage cost match with Ephemeral OS disk configured with the Local diff disk setting. Database workload requiring dynamic storage adjustment without reboot matches with Ultra Disk storage capability enabled in the virtual machine additional settings. Locating VMs in the same physical hardware cluster to minimize latency matches with Proximity Placement Group association. Installing and configuring a web server service immediately after provisioning without inbound ports matches with Custom Script Extension deployment using outbound agent communication.

The correct pairings align each workload characteristic to its corresponding Azure design solution. 1. Ephemeral OS disks are hosted on the VM's local SSD cache/temp disk, incurring zero storage fees. 2. Ultra Disks support dynamic performance adjustment (up to

160000\text{ IOPS}

and

2000\text{ MB/s}

) without rebooting, provided the VM has the Ultra SSD capability enabled. 3. Proximity Placement Groups physically cluster VMs together to minimize latency. 4. Custom Script Extensions run via the VM agent, using outbound communication to avoid inbound NSG requirements.

Step-by-Step Solution

Analyze the stateless server requirement with zero storage cost.

Identify that Ephemeral OS disks run on the VM's local SSD cache or temp disk, charging zero storage fees and offering lower latency.

Standard managed disks incur storage costs, whereas Ephemeral OS disks utilize existing VM local resources.

Analyze the storage throughput and IOPS scaling requirement without reboot.

Identify that Ultra Disk is the only Azure disk type that allows dynamic adjustment of IOPS and throughput without requiring a VM restart or disk detachment, provided the VM's Ultra SSD capability is enabled.

Premium and Standard SSDs require the VM to be deallocated or the disk to be detached to change sizes/performance tiers in most scenarios.

Analyze the requirement for physical co-location to reduce latency.

Identify that Proximity Placement Groups (PPGs) force VMs to be deployed in the same physical datacenter/hardware cluster.

Availability Zones spread VMs out to increase resilience, which can increase latency. PPGs do the opposite by grouping them close together.

Analyze the requirement for automatic configuration post-deployment without inbound management ports.

Identify that the Custom Script Extension runs locally via the guest VM agent. The VM agent communicates outbound to retrieve the script from Azure Storage, bypassing the need for inbound NSG rules.

Using remote management tools like WinRM or SSH would require open inbound ports (like TCP

5986

22

), whereas extensions execute internally via the local VM Agent.

Key Concept

Azure Virtual Machine deployment configurations, including Ephemeral OS disks, Ultra Disks, Proximity Placement Groups, and VM Extensions.

Estimated Time:2m 30s

PreviousPage 21 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept