Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 421Question →

An administrator needs to restrict access to an Azure Storage account named stdatafiles2026 so that it is only accessible from a specific subnet named Subnet1 in a virtual network named VNet1. The configuration must use service endpoints.

Arrange the steps in the correct order to configure the network access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure storage network access using service endpoints, first navigate to Subnet1 inside VNet1 and enable the Microsoft.Storage service endpoint. Then, access the stdatafiles2026 storage account networking settings, restrict access to selected virtual networks, and add Subnet1 to the allowed virtual networks list.
The correct sequence starts by enabling the Microsoft.Storage service endpoint on Subnet1 inside VNet1. This ensures that any traffic from Subnet1 to Azure Storage is routed through the Microsoft backbone with a private/subnet identifier. Next, you navigate to the networking configuration of the storage account stdatafiles2026, set the firewall to allow access only from selected networks, and add VNet1/Subnet1 to the authorized list. This binds the subnet to the storage account's network rules.

Step-by-Step Solution

1
Access Subnet1 settings in VNet1
Subnet configuration page is opened
To modify the subnet's network service properties
2
Enable Microsoft.Storage service endpoint on Subnet1
The subnet is configured to optimize traffic to Azure Storage
Allows traffic from this subnet to be identified by the storage account
3
Access stdatafiles2026 storage account networking settings
Networking configurations are visible
To change the access control lists (ACLs) of the storage account
4
Enable access from selected networks
The storage firewall restricts default public access
Ensures only authorized subnets and IPs can connect
5
Add Subnet1 of VNet1 to the storage firewall and save
Access is granted only to Subnet1
Completes the binding between the subnet's endpoint and the storage account

Key Concept

Configuring Azure Storage network security using Virtual Network Service Endpoints involves enabling the endpoint on the subnet first, then restricting the storage account to selected networks, and finally authorizing the subnet in the storage account firewall.
Question 422Question →

An administrator is configuring a swap with preview for an Azure App Service web app named WebApp1. WebApp1 runs on a Premium V3 App Service plan and has a production slot and a deployment slot named staging. Regional virtual network integration is configured as follows: the production slot is integrated with VNet1/Subnet1, and the staging slot is integrated with VNet1/Subnet2. An Azure SQL database named SQLDB1 is configured with a virtual network rule that allows connections only from VNet1/Subnet1. The App Setting DbConnectionString (with the Deployment slot setting checkbox unselected) points to SQLDB1 in the production slot and to TestDB in the staging slot. The administrator initiates a swap with preview from the staging slot to the production slot. During the preview phase of the swap, what will be the behavior when the application in the staging slot attempts to connect to a database?

Show answer & explanation

Answer: The application in the staging slot will attempt to connect to SQLDB1 using traffic routed through VNet1/Subnet2, and the connection will fail.

Answer

The application in the staging slot will attempt to connect to SQLDB1 using traffic routed through VNet1/Subnet2, and the connection will fail.
During the preview phase of a swap with preview, non-sticky settings (such as connection strings not marked as deployment slot settings) from the production slot are applied to the staging slot. Therefore, the application in the staging slot attempts to connect to the production database (SQLDB1). However, regional VNet integration is a sticky slot-specific setting, meaning it does not change. The staging slot continues using VNet1/Subnet2. Because the production database's firewall only permits connections from VNet1/Subnet1, the connection from Subnet2 fails.

Step-by-Step Solution

1
Identify the behavior of a swap with preview on App Settings.
Non-sticky App Settings and connection strings from the target slot (production) are applied to the source slot (staging).
This allows validating how the staging slot code behaves when running against production-equivalent environment variables before committing to the swap.
2
Determine the connection string value in the staging slot during the preview phase.
The DbConnectionString setting in the staging slot changes from pointing to TestDB to pointing to SQLDB1.
Because the Deployment slot setting checkbox is unselected, the connection string is non-sticky and is updated to match the production setting.
3
Evaluate the regional VNet integration configuration for the staging slot during the preview phase.
The staging slot remains integrated with VNet1/Subnet2.
Regional VNet integration is a sticky (slot-specific) setting, meaning it does not swap or copy over between slots.
4
Assess the network connectivity from VNet1/Subnet2 to SQLDB1.
The connection attempt fails.
SQLDB1 has a firewall rule configured to only allow connections from VNet1/Subnet1. Since the staging slot routes traffic via VNet1/Subnet2, the firewall blocks the request.

Key Concept

Azure App Service deployment slot swap settings stickiness and network integration behavior.
Estimated Time:3m 0s
Question 423Question →

An administrator is configuring access control for an Azure Storage account named corpdata2026 that hosts a blob container named audits.

A user named Auditor1 must be able to browse to the storage account in the Azure portal and download the blobs within the audits container. The configuration must satisfy the following constraints:
- Auditor1 must authenticate using Microsoft Entra ID.
- Auditor1 must not have read access to any other containers in the storage account.
- The solution must minimize permissions to adhere to the principle of least privilege.

Which two roles should you assign to Auditor1? (Select two.)

Select all that apply

Show answer & explanation

Answer: Reader assigned at the storage account scope; Storage Blob Data Reader assigned at the container scope

Answer

Reader assigned at the storage account scope, and Storage Blob Data Reader assigned at the container scope.
To successfully browse and access the blobs in the Azure portal using Microsoft Entra ID authentication, two separate permissions are needed: control-plane access and data-plane access. The Reader role assigned at the storage account scope provides control-plane access, allowing the user to navigate to the storage account and list the containers within the portal. The Storage Blob Data Reader role assigned at the container scope provides data-plane access, allowing the user to read and download the blobs. Limiting the data-plane role to the container scope and the control-plane role to the storage account scope ensures the principle of least privilege is followed.

Step-by-Step Solution

1
Identify the role needed for control-plane navigation in the Azure portal.
The Reader role at the storage account scope is selected.
To browse to the storage account and list containers in the Azure portal, the user requires control-plane read permission, which the Reader role provides.
2
Identify the role and scope needed for reading blob data under Microsoft Entra ID authentication.
The Storage Blob Data Reader role at the container scope is selected.
To read and download blobs using Entra ID authentication, a data-plane role is required. Scoping this role to the container level (audits) ensures the user cannot access other containers, satisfying the least privilege constraint.

Key Concept

To access blobs in the Azure portal using Entra ID authentication under least privilege, a user requires a control-plane role (Reader) at the storage account scope for portal navigation, and a data-plane role (Storage Blob Data Reader) scoped to the specific container for blob access.
Question 424Question →

An organization is planning to host two different web applications on Azure App Service:

* AppA is a development/testing application that requires a custom domain, custom SSL binding, testing in a staging environment prior to production swap, and up to 3 scale-out instances.
* AppB is a critical customer-facing API that requires 7 staging slots, automatic scaling up to 15 instances, and integration with an Azure Virtual Network to access on-premises resources via a VPN gateway.

You need to choose the most cost-effective App Service Plan tiers that satisfy the requirements for each application.

Which two pricing tiers should you choose? (Select two.)

Select all that apply

Show answer & explanation

Answer: Standard (S1) for AppA; Premium V3 (P1v3) for AppB

Answer

Standard (S1) for AppA and Premium V3 (P1v3) for AppB
To satisfy the requirements cost-effectively, Standard (S1) should be chosen for AppA because it is the lowest tier that supports deployment slots. Premium V3 (P1v3) should be chosen for AppB because Standard (S1) only supports up to 5 deployment slots and up to 10 instances, whereas Premium V3 supports up to 20 slots and up to 30 instances.

Step-by-Step Solution

1
Analyze the requirements for AppA.
AppA requires a custom domain, custom SSL binding, pre-swap testing using staging slots, and up to 3 scale-out instances.
Identifying AppA requirements helps determine the minimum App Service plan tier needed.
2
Evaluate the most cost-effective tier for AppA.
The Basic tier does not support staging slots. The Standard tier supports up to 5 staging slots, custom domains/SSL, and up to 10 instances with auto-scaling.
Standard (S1) is the lowest cost tier that supports staging slots, meeting all of AppA's requirements.
3
Analyze the requirements for AppB.
AppB requires 7 staging slots, auto-scaling up to 15 instances, and regional VNet integration.
Identifying AppB requirements helps determine the pricing tier constraints.
4
Evaluate the most cost-effective tier for AppB.
The Standard tier is limited to 5 staging slots and 10 scale-out instances. The Premium tier supports up to 20 staging slots and 30 instances. Regional VNet integration is supported in both tiers.
Premium V3 (P1v3) is the most cost-effective tier that meets all criteria for AppB, as Standard is technically insufficient and Isolated is more expensive.

Key Concept

Azure App Service Plan pricing tier capabilities, specifically scaling limits and deployment slot support.
Estimated Time:3m 0s
Question 425Question →

An administrator applies a tag named Dept: Marketing to an Azure resource group named rg-marketing. The resource group contains three virtual machines that do not have any tags applied.

Determine whether the following statement is true:
In Azure Cost Analysis, when filtering or grouping by the Dept: Marketing tag, the costs generated by the three virtual machines will be included in the results.

Show answer & explanation

Answer: False

Answer

False
The correct answer is False because, by default, Azure resources do not inherit tags from their parent resource group. Therefore, Cost Analysis cannot group or filter the virtual machines' costs under the resource group's tag.

Step-by-Step Solution

1
Analyze the target resources and tag assignment.
The tag Dept: Marketing is applied directly to the resource group rg-marketing, but not to the three virtual machines inside it.
To identify which specific scopes and resources have the tag metadata assigned.
2
Evaluate the tag inheritance behavior for Azure resources.
By default, resources within a resource group do not inherit the tags applied to that resource group.
To determine if the resource group's tag automatically propagates to the child virtual machines.
3
Determine the impact on Azure Cost Analysis filtering and grouping.
Because the virtual machines are untagged, Cost Analysis will not associate their billing data with the Dept: Marketing tag unless tags are directly applied to the VMs or tag inheritance is explicitly enabled at the billing scope level.
To evaluate the correctness of the statement based on default Azure behavior.

Key Concept

Resource tag inheritance behavior in Azure Cost Analysis
Question 426Question →

To protect a critical business application, an administrator plans to configure a daily scheduled backup for an Azure App Service web app named app-finance. The web app is currently hosted on a Basic (B1) App Service plan. When navigating to the backup configuration page in the Azure portal, the configuration options are disabled. Which action should the administrator perform first to resolve this issue?

Show answer & explanation

Answer: Scale up the App Service plan to the Standard (S1) tier or higher.

Answer

Scale up the App Service plan to the Standard (S1) tier or higher.
Azure App Service backups require the App Service plan to be in the Standard, Premium, or Isolated tier. The Basic (B1) tier does not support backup operations, causing the backup configuration options to be unavailable in the Azure portal.

Step-by-Step Solution

1
Identify the current pricing tier of the App Service plan.
The App Service plan is in the Basic (B1) tier.
Different Azure App Service features, including backups, custom domains, and slots, have minimum tier requirements.
2
Determine the minimum App Service plan tier required for native backup capabilities.
The minimum tier required for backups is Standard (S1).
Basic and Free/Shared tiers do not support App Service backup configurations.
3
Select the correct troubleshooting or configuration step in the Azure portal.
Scale up the App Service plan to Standard (S1) or higher.
Scaling up the plan changes the features available to all apps running in that plan, enabling the backup configuration option.

Key Concept

Azure App Service Plan Tier Feature Availability
Question 427Question →

An administrator is preparing to deploy Azure Bastion in a virtual network named VNet1VNet1. The virtual network has an address space of 172.20.0.0/16172.20.0.0/16. The administrator needs to create the subnet for the Bastion host. The design must minimize the number of unused IP addresses while complying with all Microsoft requirements for Azure Bastion. Which subnet configuration should the administrator create?

Show answer & explanation

Answer: Subnet name: `AzureBastionSubnet`; Address range: 172.20.10.0/26172.20.10.0/26

Answer

Subnet name: AzureBastionSubnet; Address range: 172.20.10.0/26
The correct subnet configuration must use the name 'AzureBastionSubnet' and have a subnet mask of /26 or larger. Since the goal is to minimize unused IP addresses, the smallest valid subnet mask is /26. The range 172.20.10.0/26 meets all criteria.

Step-by-Step Solution

1
Identify Azure Bastion subnet naming requirement
The subnet must be named exactly 'AzureBastionSubnet'
Azure Bastion searches for this specific subnet name during resource creation
2
Determine Azure Bastion subnet size requirement
The subnet prefix length must be /26 or larger
Azure Bastion requires a subnet of size /26 or larger to support scaling and operations
3
Find the smallest subnet prefix that meets the size requirement to minimize unused IP addresses
A /26 subnet prefix is selected
A /26 prefix provides 64 IP addresses, which is the smallest subnet size allowed by Azure Bastion, minimizing the consumption of the address space

Key Concept

Azure Bastion subnet requirements including exact naming and minimum subnet size (prefix length of /26 or larger).
Estimated Time:1m 30s
Question 428Question →

An Azure subscription contains a resource group named `rg-prod-data`. You apply a tag named `Environment: Production` and a `ReadOnly` resource lock to `rg-prod-data`. The resource group contains an Azure Storage account named `storage1`. An administrator with owner permissions attempts to access `storage1`. Which of the following describes the governance behavior for `storage1`?

Show answer & explanation

Answer: The administrator can read blob data in `storage1` using Microsoft Entra ID credentials, but is blocked from retrieving the storage account access keys and modifying the resource tags.

Answer

The administrator can read blob data in `storage1` using Microsoft Entra ID credentials, but is blocked from retrieving the storage account access keys and modifying the resource tags.
The correct option is correct because Azure Resource Locks apply only to the control plane (Azure Resource Manager). Thus, reading data plane blobs using Microsoft Entra ID credentials is not blocked by a ReadOnly lock. However, retrieving storage account access keys requires a POST request (`Microsoft.Storage/storageAccounts/listKeys/action`), which is blocked by a ReadOnly lock. Furthermore, modifying tags requires a write operation on the resource, which is also blocked by the inherited ReadOnly lock.

Step-by-Step Solution

1
Analyze the impact of the ReadOnly lock on control plane operations.
The ReadOnly lock applied to the resource group inherits to `storage1`. It blocks all write operations (like modifying tags) and POST actions (like listing storage keys).
ReadOnly locks prevent any configuration modifications and block actions requiring POST request methods.
2
Analyze the impact of the ReadOnly lock on data plane operations.
Data plane operations, such as reading or writing blobs in `storage1`, remain allowed for users with correct RBAC data plane permissions (e.g., Storage Blob Data Reader).
Azure Resource Locks only apply to control plane (Azure Resource Manager) actions, not data plane access.
3
Evaluate tag inheritance behavior.
The `Environment: Production` tag on the resource group is not inherited by `storage1` automatically.
In Azure, tags applied at the resource group level do not inherit to resources within that resource group.

Key Concept

Azure Resource Locks block control plane actions (including POST operations like listing keys) and inherit down the hierarchy, while data plane operations and tag inheritance are unaffected by locks and resource groups respectively.
Question 429Question →

A company's infrastructure team is preparing to provision a virtual machine named VM-Finance in the East US region. The virtual machine must satisfy the following criteria:
- Provide protection against physical datacenter-wide outages within the region.
- Enable daily backups to be managed automatically via Azure Backup.
- Ensure that authorized administrative users can read files inside the virtual machine's associated storage account blob containers, while preventing users with subscription-level Contributor roles from having direct data-plane read access.

Which deployment configuration should the team implement for VM-Finance?

Show answer & explanation

Answer: Deploy VM-Finance to an Availability Zone, create a Recovery Services vault in the East US region, and assign the Storage Blob Data Reader role to authorized administrative users for the associated storage account.

Answer

Deploy VM-Finance to an Availability Zone, create a Recovery Services vault in the East US region, and assign the Storage Blob Data Reader role to authorized administrative users for the associated storage account.
Deploying the virtual machine to an Availability Zone protects it against physical datacenter-wide failures by placing the instance in a separate, isolated physical location within the region. Since Recovery Services vaults can only back up resources within the same region, a vault must be deployed in the East US region. Finally, subscription-level roles like Contributor do not automatically grant direct access to blob data; therefore, the Storage Blob Data Reader role must be assigned to grant administrative users access to the storage account's data plane.

Step-by-Step Solution

1
Identify the high availability requirement to protect against physical datacenter-wide outages.
Determine that Availability Zones must be used instead of Availability Sets.
Availability Zones provide separate physical datacenters within a region with independent power, cooling, and networking, whereas Availability Sets only distribute VMs across update and fault domains within a single datacenter.
2
Verify the backup configuration requirement for the virtual machine.
Determine that the Recovery Services vault must reside in the East US region.
Azure Backup restricts VM backup operations to Recovery Services vaults located in the same region as the virtual machine being protected.
3
Determine the correct security role for data-plane access to blob storage.
Identify that the Storage Blob Data Reader role must be assigned to the administrators.
Subscription-level Contributor or Owner roles only manage the control plane (management operations) of the storage account. Accessing actual container data (data plane) requires specific Azure Active Directory (Microsoft Entra ID) roles such as Storage Blob Data Reader.

Key Concept

Azure Virtual Machine creation parameters including Availability Zones, Recovery Services Vault region matching, and storage data-plane access controls.
Estimated Time:1m 30s
Question 430Question →

An administrator is configuring the network topology for a resource group named `RG-Core` in an Azure subscription. The resource group contains a virtual network named `VNet-Core`. The administrator must add a new subnet named `Subnet-Workloads` to `VNet-Core` to host exactly 1212 virtual machines, with each requiring a dedicated private IP address. No other resources will be placed in this subnet. To minimize IP address allocation, the subnet must use the smallest possible prefix that accommodates the virtual machines. Which subnet mask should the administrator choose?

Show answer & explanation

Answer: /27/27

Answer

The /27/27 subnet mask is the smallest subnet that can accommodate the virtual machines, providing 2727 usable IP addresses out of 3232 total IP addresses after accounting for the 55 IP addresses reserved by Azure.
The /27/27 subnet mask is correct because a /27/27 block provides 3232 total IP addresses. Since Azure reserves 55 IP addresses in every subnet (the first 44 and the last 11 address), this leaves 32−5=2732 - 5 = 27 usable IP addresses. This is sufficient for the 1212 virtual machines and is the smallest available subnet prefix that meets the requirement.

Step-by-Step Solution

1
Calculate the total number of private IP addresses required by the virtual machines.
1212 IP addresses are required for the 1212 virtual machines.
Each virtual machine requires a single private IP address.
2
Add the number of IP addresses reserved by Azure in every subnet.
12+5=1712 + 5 = 17 total IP addresses are required.
Azure reserves 55 IP addresses in every subnet (the first 44 and the last 11 address).
3
Determine the smallest CIDR block that provides at least the required total number of IP addresses.
A /27/27 subnet mask provides 232−27=322^{32-27} = 32 total IP addresses (2727 usable), whereas a /28/28 subnet mask only provides 232−28=162^{32-28} = 16 total IP addresses (1111 usable).
The /28/28 subnet mask is too small (11<1211 < 12), so the next larger size, /27/27, must be used to minimize address space wastage while meeting the requirement.

Key Concept

Azure reserves 55 IP addresses in each subnet, which must be accounted for when planning subnet sizes.
Question 431Question →

An organization's infrastructure team is planning to deploy a hybrid cloud architecture in Microsoft Azure. The deployment includes a virtual network named VNet-Prod with an address space of 172.16.0.0/16172.16.0.0/16. The virtual network must host three subnets to support the following requirements:

1. A subnet named GatewaySubnet to connect to an on-premises datacenter via an Azure VPN Gateway.
2. A subnet named AzureBastionSubnet to provide secure management access to virtual machines.
3. A subnet named Subnet-App to host application virtual machines. The application tier requires at least 2828 usable IP addresses for virtual machines, plus any Azure reserved addresses.

The team configures the subnets with the following CIDR blocks:
- GatewaySubnet: 172.16.0.0/29172.16.0.0/29
- AzureBastionSubnet: 172.16.1.0/26172.16.1.0/26
- Subnet-App: 172.16.2.0/27172.16.2.0/27

Is the following statement true?
The proposed subnet configuration successfully meets the minimum prefix size requirements for GatewaySubnet and AzureBastionSubnet, and provides enough usable IP addresses for the application tier.

Show answer & explanation

Answer: False

Answer

The statement is false because a /27/27 subnet provides only 2727 usable IP addresses in Azure due to the 55 reserved IP addresses, failing to meet the requirement of at least 2828 usable IP addresses for the application tier.
The statement is false because Subnet-App (172.16.2.0/27172.16.2.0/27) provides only 2727 usable IP addresses. In Azure subnets, 55 IP addresses are always reserved (the first four and the last one). A /27/27 subnet has 3232 total IP addresses, so subtracting the 55 reserved addresses leaves only 2727 usable IP addresses, which is fewer than the required 2828 hosts.

Step-by-Step Solution

1
Verify the GatewaySubnet prefix size.
The GatewaySubnet prefix is /29/29.
Azure VPN Gateway requires a GatewaySubnet with a prefix of /29/29 or larger. Therefore, the /29/29 prefix meets the requirement.
2
Verify the AzureBastionSubnet prefix size.
The AzureBastionSubnet prefix is /26/26.
Azure Bastion requires a subnet named AzureBastionSubnet with a prefix of /26/26 or larger. Therefore, the /26/26 prefix meets the requirement.
3
Calculate the number of usable IP addresses for Subnet-App (172.16.2.0/27172.16.2.0/27).
There are 2727 usable IP addresses.
A /27/27 subnet has 232−27=322^{32-27} = 32 total IP addresses. Azure reserves 55 IP addresses per subnet, resulting in 32−5=2732 - 5 = 27 usable IP addresses.
4
Compare the usable IP addresses to the application requirement.
The subnet provides 2727 usable IP addresses, which is less than the required 2828.
Since 27<2827 < 28, the configuration fails to meet the application tier requirements, making the statement false.

Key Concept

Azure virtual network subnet prefix sizing and reserved IP addresses
Question 432Question →

You need to create a new deployment slot named 'staging' for an Azure App Service web app named App1. Which sequence of actions should you perform in the Azure portal to achieve this? Arrange the steps in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure a new deployment slot, you must first navigate to the web app in the Azure portal. Then, under the Deployment section of the resource menu, select Deployment slots. Next, click Add Slot and configure the slot details (such as the name and setting cloning source). Finally, click Add to create the slot.
The correct order begins with navigating to the App Service web app resource. Once in the resource blade, you select 'Deployment slots' under the Deployment section of the left-hand menu. From there, you click 'Add Slot' to open the configuration pane, enter the slot name, specify cloning options, and finally click 'Add' to provision the slot.

Step-by-Step Solution

1
Navigate to the App Service web app resource in the Azure portal.
The App Service web app overview page is displayed.
This is the entry point for configuring settings on the web app.
2
Locate and click 'Deployment slots' under the Deployment menu section.
The Deployment slots page opens, showing existing slots and configuration options.
All slot creation and management features are contained within this menu item.
3
Click 'Add Slot' and configure the slot name and clone settings source.
The Add a slot panel opens and is filled out with the required name 'staging'.
This specifies the settings and name for the new slot before creation.
4
Click 'Add'.
The new deployment slot is successfully created and provisioned.
This initiates the deployment slot creation process in Azure.

Key Concept

Deployment Slots Configuration in Azure App Service
Question 433Question →

Your company has an Azure Storage account named `sa-prod-backup` that stores database backups in a blob container named `db-dumps`. To comply with security policies, the storage account has Shared Key authorization disabled (`AllowSharedKeyAccess` set to `false`).

An administrator needs to use AzCopy on a local machine to upload files to the `db-dumps` container. The administrator generates an Account Shared Access Signature (SAS) token using the Azure portal and signs it with the storage account access key. When running the `azcopy copy` command with the generated SAS token, the operation fails with an HTTP 403 (Authentication Failed) error.

You need to resolve the error and ensure that the administrator can successfully upload the files using AzCopy while adhering to the security policy of the storage account.

Which of the following actions should you perform?

Show answer & explanation

Answer: Assign the Storage Blob Data Contributor role to the administrator and have them authenticate using the `azcopy login` command before running the transfer.

Answer

Assign the Storage Blob Data Contributor role to the administrator and have them authenticate using the `azcopy login` command before running the transfer.
When an Azure Storage account has Shared Key authorization disabled (`AllowSharedKeyAccess` set to `false`), all requests using account access keys or SAS tokens signed with account keys are blocked. To perform data operations with AzCopy, the administrator must authenticate using Microsoft Entra ID by running the `azcopy login` command. The administrator must also be assigned a data-plane role, such as Storage Blob Data Contributor, to have permissions to upload blobs to the container.

Step-by-Step Solution

1
Analyze the cause of the HTTP 403 error during the AzCopy operation.
The storage account has `AllowSharedKeyAccess` set to `false`. This blocks any requests authorized using storage account keys, including Account and Service SAS tokens signed with those keys.
Understanding the restriction helps identify that traditional SAS tokens cannot be used.
2
Determine the supported authentication methods under the security policy.
With Shared Key access disabled, authentication must be performed using Microsoft Entra ID (directly or via a User Delegation SAS).
Microsoft Entra ID authentication does not rely on storage account keys.
3
Select the correct RBAC role and command to enable the transfer.
The administrator must be assigned the Storage Blob Data Contributor role for data-plane access, and then run `azcopy login` to authenticate with Microsoft Entra ID before executing the copy command.
This configuration satisfies the security policy and provides the necessary data-plane permissions.

Key Concept

Disabling Shared Key authorization on an Azure Storage account blocks key-based Shared Access Signatures (SAS). To copy data using tools like AzCopy when Shared Key access is disabled, you must use Microsoft Entra ID authentication combined with appropriate data-plane RBAC roles like Storage Blob Data Contributor.
Question 434Question →

Your organization, Tailwind Traders, plans to deploy Azure File Sync to centralize file shares from a local branch office file server named OAK-SRV01. You have already created a storage account named tailwindstorageacct and an Azure file share named sales-share. You need to configure Azure File Sync to synchronize the local directory D:\SalesData on OAK-SRV01 with sales-share.

Which sequence of actions should you perform to establish the synchronization?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To establish synchronization using Azure File Sync, you must perform the following actions in order: first create the Storage Sync Service, then install the Azure File Sync agent on OAK-SRV01, next register OAK-SRV01 with the Storage Sync Service, then create a sync group and add sales-share as the cloud endpoint, and finally create a server endpoint pointing to the local directory D:\SalesData.
The correct order follows the logical dependency chain of Azure File Sync: the Storage Sync Service must be deployed first; then, the agent is installed on the local server; next, that server is registered to the Storage Sync Service; after registration, a sync group containing a cloud endpoint (referencing the Azure file share) is established; finally, the local directory is mapped as a server endpoint inside the sync group to initiate the synchronization.

Step-by-Step Solution

1
Deploy the Storage Sync Service.
A Storage Sync Service resource is available in Azure.
The Storage Sync Service is the management plane and parent resource for Azure File Sync. It must exist before server registration or endpoint creation can occur.
2
Install the Azure File Sync agent on OAK-SRV01.
The local server is prepared to run the synchronization service.
The server needs the local agent component to communicate with the Azure Storage Sync Service.
3
Register OAK-SRV01 with the Storage Sync Service.
The server OAK-SRV01 is registered and visible under Registered Servers in the Storage Sync Service.
Registration establishes a secure trust relationship between the local server and the Azure cloud service.
4
Create a sync group and a cloud endpoint.
A sync group is created containing a cloud endpoint mapped to sales-share.
A sync group defines the sync topology for a set of files. The cloud endpoint represents the hub (Azure file share) and must be created first before spokes (server endpoints) are added.
5
Create a server endpoint.
The local folder D:\SalesData is mapped to the sync group.
Adding the server endpoint connects the local path on the registered server to the cloud hub, triggering synchronization.

Key Concept

Deploying Azure File Sync requires a specific order: provision the cloud infrastructure (Storage Sync Service), configure the local host (install agent, register server), establish the logical sync topology (sync group, cloud endpoint), and connect the local filesystem (server endpoint).
Question 435Question →

You are a Global Administrator for a Microsoft Entra ID tenant.

You need to delegate the management of a group of users in the Sales department to a local administrator named Admin1. Admin1 has no directory-wide roles. Admin1 must be able to update user profiles and manage group memberships for the Sales department.

Additionally, you need to implement group-based licensing for the Sales department users using a Microsoft 365 license. The configuration must prevent any license assignment errors due to missing user properties.

Which sequence of actions should you perform to meet these requirements?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, create the Administrative Unit and add the Sales department users to it. Second, assign the User Administrator and Groups Administrator roles to Admin1 scoped to the Administrative Unit. Third, have Admin1 configure the Usage Location property for the Sales department users. Fourth, have Admin1 create a security group and add the Sales department users to it. Finally, as a Global Administrator, assign the Microsoft 365 licenses to the security group.
The correct sequence begins by creating the Administrative Unit and adding the target users to it, which establishes the administrative boundary. Next, the User Administrator and Groups Administrator roles are assigned to the local administrator scoped to the Administrative Unit, giving them the necessary permissions to manage the users and groups. The local administrator then configures the Usage Location for the users to satisfy the license prerequisite. Afterward, the local administrator creates the security group and adds the users. Finally, the Global Administrator assigns the licenses to the security group because license assignment requires tenant-wide permissions that cannot be scoped to an Administrative Unit.

Step-by-Step Solution

1
Create the Administrative Unit and add the Sales department users to it.
An Administrative Unit containing the Sales department users is created.
This defines the boundary/scope for the delegated administrative tasks.
2
Assign the User Administrator and Groups Administrator roles to Admin1, scoped to the Administrative Unit.
Admin1 receives administrative permissions restricted to the Sales department users.
Delegated roles must be scoped to the Administrative Unit so that Admin1 can manage users and groups within that scope.
3
Have Admin1 configure the Usage Location property for the Sales department users.
All Sales department users have their Usage Location set.
A Usage Location is a strict prerequisite for license assignment. Setting it first prevents licensing errors.
4
Have Admin1 create a security group and add the Sales department users to it.
A security group is created and populated with the target users.
The group must exist and contain the users so that group-based licensing can be applied.
5
As a Global Administrator, assign the Microsoft 365 licenses to the security group.
Licenses are successfully assigned and propagated to all users in the group.
License assignment is a tenant-wide privilege that requires a tenant-wide role like Global Administrator; a scoped administrator cannot perform this action.

Key Concept

Delegating administration via Microsoft Entra ID Administrative Units and configuring group-based licensing prerequisites.
Estimated Time:2m 0s
Question 436Question →

An administrator needs to deploy a containerized script to Azure Container Instances (ACI) that performs a one-time database backup. The script must run, complete the backup, and then stop. If the backup process fails, the container must attempt to run again. Which restart policy should the administrator configure for the container group?

Show answer & explanation

Answer: OnFailure

Answer

OnFailure
The correct answer is the restart policy that ensures the container runs to completion, stops upon success, and restarts only when a failure is encountered. In Azure Container Instances, this behavior is controlled by the 'OnFailure' restart policy.

Step-by-Step Solution

1
Identify the container workload type.
The workload is a task-based (run-to-completion) database backup script rather than a long-running service.
To select the correct restart policy, you must first determine if the container is intended to run indefinitely or terminate after completing a specific job.
2
Determine the failure handling requirement.
The container must retry if the process fails, but must stop upon successful completion.
This rules out the 'Never' policy, which would not retry on failure, and the 'Always' policy, which would keep restarting the container even after success.
3
Map the requirements to the supported Azure Container Instances restart policies.
The 'OnFailure' policy matches these requirements.
ACI supports 'Always', 'Never', and 'OnFailure'. Since we need a restart only on failure, 'OnFailure' is the correct configuration.

Key Concept

Configuring the restart policy for Azure Container Instances (ACI) based on workload requirements.
Question 437Question →

A company plans to deploy a web application on virtual machines in the East US region. The application must remain online even if an entire datacenter building experiences a power outage.

Which configuration should be used to protect the virtual machines against datacenter-wide failures?

Show answer & explanation

Answer: Deploy the virtual machines across multiple Availability Zones

Answer

Deploying the virtual machines across multiple Availability Zones provides protection against datacenter-wide failures.
Deploying the virtual machines across multiple Availability Zones protects the application against datacenter-wide failures because Availability Zones are physically separate locations within an Azure region, each equipped with independent power, cooling, and networking.

Step-by-Step Solution

1
Identify the scope of redundancy required by the scenario.
The requirement specifies protection against a datacenter-wide power outage.
This helps filter out high availability options that only protect against local rack or server failures.
2
Compare Availability Zones and Availability Sets.
Availability Zones locate virtual machines in physically separate datacenters with independent power and cooling, whereas Availability Sets locate them within the same datacenter.
Understanding the architectural boundaries of each feature determines which one survives a datacenter failure.
3
Select the option that meets the datacenter-wide redundancy requirement.
Deploying across multiple Availability Zones is the correct configuration.
This aligns with the requirement to keep the application online when an entire datacenter building goes down.

Key Concept

Azure Virtual Machine Redundancy Options
Estimated Time:1m 0s
Question 438Question →

An administrator is configuring a custom domain for a web app named App1 that runs on a Standard S1 App Service plan. The DNS zone for the domain contoso.com is hosted in Azure DNS. You need to configure App1 to be accessible via https://www.contoso.com using a free App Service Managed Certificate. Which two actions should you perform? Select two.

Select all that apply

Show answer & explanation

Answer: In the DNS zone for contoso.com, create a CNAME record that points www to app1.azurewebsites.net.; Add the custom domain www.contoso.com to App1.

Answer

To configure the custom domain and secure it with a managed certificate, you must create a DNS CNAME record pointing the www subdomain to the web app's default URL, and add the custom domain to the App Service web app configuration.
The correct configurations involve creating a CNAME record in public DNS to verify domain ownership and route traffic, followed by adding the custom domain to the App Service. Both steps are prerequisites before an App Service Managed Certificate can be created and bound to secure the domain.

Step-by-Step Solution

1
Configure the DNS mapping in public DNS.
A CNAME record for www pointing to app1.azurewebsites.net is created in the public DNS zone.
This establishes the routing of web traffic to the Azure App Service and satisfies the domain ownership validation requirement.
2
Map the custom domain in the Azure portal or CLI.
The custom domain www.contoso.com is bound to the App Service App1.
Azure requires the custom domain to be successfully added to the App Service web app configuration before an App Service Managed Certificate can be generated for it.
3
Generate and bind the App Service Managed Certificate.
An SSL binding is created using the free managed certificate.
Once the domain is verified and added, you can generate the managed certificate to secure HTTPS traffic.

Key Concept

Configuring public custom domains and securing them with App Service Managed Certificates requires a valid public DNS mapping and binding the custom domain to the App Service prior to certificate generation.
Question 439Question →

An administrator is configuring a public load balancer in Azure. The load balancer is configured with the Basic SKU. The administrator needs to configure the frontend IP and backend pool. Which of the following configurations are supported for this load balancer? (Select two.)

Select all that apply

Show answer & explanation

Answer: A Basic SKU public IP address associated with the frontend IP configuration; Virtual machines in the backend pool that are all part of the same availability set

Answer

The correct configurations are: a Basic SKU public IP address associated with the frontend IP configuration, and virtual machines in the backend pool that are all part of the same availability set.
A Basic SKU Load Balancer only supports association with Basic SKU public IP addresses for its frontend IP configuration. Additionally, its backend pool is restricted to virtual machines within the same availability set, virtual machine scale set, or single cloud service.

Step-by-Step Solution

1
Determine the SKU requirements for the public IP address of a Basic SKU Load Balancer.
Basic SKU Load Balancers can only be associated with Basic SKU public IP addresses.
Azure enforces SKU matching between load balancers and their associated public IP addresses.
2
Identify backend pool constraints for Basic SKU Load Balancers.
The backend pool virtual machines must reside in either a single availability set, a single virtual machine scale set, or a single cloud service.
Basic SKU Load Balancers do not support backend VMs distributed across different availability zones or arbitrary virtual networks without these groupings.

Key Concept

Basic SKU Load Balancer SKU compatibility and backend pool limitations
Question 440Question →

An administrator is configuring a new Azure App Service web app named app-finance-prod that runs on a Premium V3 App Service plan. The administrator must implement the following requirements:
1. The web app must connect to an Azure SQL database using a private endpoint located in a subnet named db-subnet inside a virtual network named VNet1. Outbound database traffic from the web app must be secured.
2. The custom application settings and database connection strings must remain specific to the production environment and must not be copied or swapped when deploying updates via a deployment slot named staging.
3. To resolve the database's private endpoint FQDN, the web app must use a private DNS zone named privatelink.database.windows.net.

Which three configurations should the administrator perform?

Select all that apply

Show answer & explanation

Answer: Configure regional virtual network integration for app-finance-prod using a dedicated subnet in VNet1 that is delegated to Microsoft.Web/serverFarms.; Link the private DNS zone privatelink.database.windows.net to VNet1.; Configure the database connection string as a deployment slot setting on app-finance-prod.

Answer

Configure regional virtual network integration using a dedicated subnet in VNet1, link the private DNS zone to VNet1, and configure the database connection string as a deployment slot setting.
To secure outbound database traffic, the web app must utilize regional virtual network integration, which requires a dedicated subnet in the target virtual network. To resolve the private IP of the database private endpoint, the corresponding private DNS zone must be linked to the virtual network. Finally, to ensure database connection strings do not swap when deploying changes from the staging slot, the setting must be configured as a deployment slot setting.

Step-by-Step Solution

1
Ensure the App Service Plan tier supports required features.
Confirm the Premium V3 tier is active, as deployment slots and VNet integration are required.
Lower tiers like Basic B1 do not support deployment slots.
2
Configure outbound connectivity from the App Service.
Enable regional VNet Integration using a dedicated subnet in VNet1 delegated to Microsoft.Web/serverFarms.
This allows outbound web app traffic to access the database private endpoint in the VNet.
3
Set up private DNS resolution for the integrated VNet.
Link the private DNS zone privatelink.database.windows.net to VNet1.
Ensures the web app resolves the Azure SQL Database FQDN to its private IP address.
4
Protect configuration settings from swapping.
Mark the database connection string as a deployment slot setting.
This makes the setting sticky to the production slot so it does not get replaced during a slot swap.

Key Concept

Azure App Service Hybrid Networking and Deployment Slot Configuration
PreviousPage 22 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin