Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 441Question →

An administrator is creating a new virtual network named `VNet1` with an address space of 10.0.0.0/1610.0.0.0/16 to host a new application. The administrator needs to configure subnets for `VNet1`. Which two statements describe correct configurations or requirements for the subnets?

Select all that apply

Show answer & explanation

Answer: Azure reserves the first four and the last one IP addresses of each subnet's address range.; The address range of any subnet created within `VNet1` must be a subset of the 10.0.0.0/1610.0.0.0/16 address space.

Answer

The correct statements are that Azure reserves the first four and the last one IP addresses of each subnet, and the address range of any subnet must be a subset of the virtual network's address space.
The correct statements are that Azure reserves the first four and the last one IP addresses of each subnet, and the address range of any subnet must be a subset of the virtual network's address space. Azure reserves these five IP addresses within every subnet for network routing, DNS, and DHCP services. Furthermore, any subnet created within a virtual network must fall completely within the address space allocated to the virtual network.

Step-by-Step Solution

1
Review Azure subnet IP reservation rules.
Within any Azure subnet, 5 IP addresses are reserved: the first four (network address, default gateway, two DNS addresses) and the last one (network broadcast address). Thus, the statement regarding Azure reserving the first four and the last one IP addresses is correct.
Azure reserves these for internal protocol and routing purposes.
2
Check the address range constraint for subnets within a virtual network.
Subnets must fall entirely within the address space of their parent virtual network. Therefore, any subnet in VNet1 must use a range within 10.0.0.0/16.
Azure requires subnets to partition or match the VNet address space.
3
Evaluate Azure Bastion requirements.
Azure Bastion requires the subnet name to be exactly 'AzureBastionSubnet' and the size must be /26 or larger. The option stating BastionSubnet and /28 is incorrect.
Azure Bastion has strict naming and size requirements for its gateway subnet.
4
Evaluate Private DNS Zone requirements.
A Private DNS Zone must be manually linked to a virtual network via virtual network links. It is not automatic and applies at the virtual network level, not individual subnets. The option stating that the Private DNS Zone is automatically linked to subnets is incorrect.
Azure DNS private zones require explicit virtual network links to resolve names.

Key Concept

Azure virtual network subnets have strict size constraints, address allocation rules, and reserve 5 IP addresses per subnet.
Question 442Question →

An administrator is planning the deployment of a critical web application to Azure App Service. The application must meet the following requirements:

* Must support autoscaling based on memory usage, up to a maximum of 12 instances.
* Must support at least 4 deployment slots (excluding the production slot) for testing.
* Must support automated backups scheduled twice daily.

Which of the following is the most cost-effective App Service Plan pricing tier that meets all these requirements?

Show answer & explanation

Answer: P1v3

Answer

The Premium v3 (P1v3) tier is the correct choice because it is the most cost-effective tier that supports autoscaling up to 30 instances (meeting the 12-instance requirement), up to 20 deployment slots, and up to 50 daily automated backups.
The Premium v3 (P1v3) tier meets all the requirements. It supports autoscaling up to 30 instances (satisfying the 12-instance requirement), up to 20 deployment slots (satisfying the 4-slot requirement), and up to 50 daily backups (satisfying the twice-daily backup requirement). It is the most cost-effective tier that does so, as the Isolated tier is more expensive.

Step-by-Step Solution

1
Analyze the scale-out requirement.
The application requires autoscaling up to 12 instances. Basic (B1) supports manual scale up to 3 instances. Standard (S1) supports autoscaling but limits the maximum scale-out to 10 instances. Premium v3 (P1v3) supports autoscaling up to 30 instances, and Isolated v2 (I1v2) supports up to 100 instances.
Determine which tiers meet the scale-out constraint.
2
Analyze the deployment slots requirement.
The application requires at least 4 deployment slots. Basic (B1) does not support deployment slots. Standard (S1) supports up to 5 deployment slots. Premium v3 (P1v3) supports up to 20 deployment slots, and Isolated v2 (I1v2) supports up to 20 deployment slots.
Determine which tiers meet the deployment slot constraint.
3
Analyze the backup requirement.
The application requires automated backups twice daily. Basic (B1) does not support scheduled backups. Standard (S1) supports up to 10 daily backups. Premium v3 (P1v3) supports up to 50 daily backups, and Isolated v2 (I1v2) supports up to 50 daily backups.
Determine which tiers meet the backup constraint.
4
Compare the valid tiers (P1v3 and I1v2) for cost-effectiveness.
Both Premium v3 (P1v3) and Isolated v2 (I1v2) meet all requirements. Since P1v3 is significantly less expensive than I1v2, it is the most cost-effective option.
Select the lowest-cost tier that satisfies all requirements.

Key Concept

Azure App Service Plan Tier Limits and Capabilities
Question 443Question →

Your company has an Azure subscription containing a resource group named rg-finance. Within rg-finance, you have a storage account named storefinprod that contains a blob container named confidential-reports. A user named User1 must be able to read and download the blobs within the confidential-reports container using the Azure portal. The user must authenticate by using their Microsoft Entra ID credentials. Your configuration must follow the principle of least privilege. Which configuration should you implement to meet these requirements?

Show answer & explanation

Answer: Assign User1 the Reader role at the storefinprod storage account level, and assign the Storage Blob Data Reader role at the confidential-reports container level.

Answer

Assign User1 the Reader role at the storefinprod storage account level, and assign the Storage Blob Data Reader role at the confidential-reports container level.
The correct configuration requires both control plane and data plane roles. The Reader role (control plane) at the storage account level allows the user to find and list the storage account in the Azure portal. The Storage Blob Data Reader role (data plane) at the container level allows the user to read the blobs in the container while following the principle of least privilege by restricting data access to only that container.

Step-by-Step Solution

1
Identify the access requirements
The user needs both portal navigation access (control plane) and blob read access (data plane) using Microsoft Entra ID credentials.
Azure portal navigation requires Resource Manager permissions, whereas blob container access requires data plane permissions.
2
Select the least privilege control plane role
Assign the Reader role at the storage account level.
This allows the user to see the storage account in the portal directory and list its properties, without granting write or administrative privileges.
3
Select the least privilege data plane role
Assign the Storage Blob Data Reader role at the container level.
This provides read access to the blobs inside the target container while restricting data access to only that container, following the least privilege principle.

Key Concept

To access blob container data using Microsoft Entra credentials in the Azure portal, a user requires a control-plane role (such as Reader) at the storage account level to navigate the portal, and a data-plane role (such as Storage Blob Data Reader) at the appropriate resource scope to read the blobs.
Estimated Time:2m 0s
Question 444Question →

You are configuring a web application hosted on an Azure Virtual Machine to upload user profile images to a blob container named `profile-images` in an Azure Storage account named `webappassets2026`.

The application has the following requirements:
* Access must be limited exclusively to the `profile-images` container.
* Access must be restricted to HTTPS connections originating from the virtual machine's public IP address (`198.51.100.12`).
* Access credentials must automatically expire after 8 hours.
* The storage account access keys must not be used or exposed to sign the token.

Which configuration should you implement to meet the requirements under the principle of least privilege?

Show answer & explanation

Answer: Generate a User Delegation SAS scoped to the profile-images container by using a security principal assigned the Storage Blob Data Delegator role, restricted to HTTPS and the IP address 198.51.100.12.

Answer

Generate a User Delegation SAS scoped to the profile-images container by using a security principal assigned the Storage Blob Data Delegator role, restricted to HTTPS and the IP address 198.51.100.12.
A User Delegation SAS is the only option that satisfies the requirement to avoid using or exposing the storage account access keys, as it is signed with a user delegation key acquired via Microsoft Entra ID authentication. To generate this key, the security principal requires the Storage Blob Data Delegator role. Scoping the SAS token to the container level with HTTPS-only and IP address constraints enforces the principle of least privilege.

Step-by-Step Solution

1
Identify the authentication method that avoids using storage account access keys.
Determine that a User Delegation SAS must be used, which is signed by a user delegation key obtained using Microsoft Entra ID credentials.
This avoids exposing or using the storage account access keys, satisfying the organization's security policy.
2
Identify the required RBAC role to generate a User Delegation SAS.
Determine that the security principal generating the SAS must be assigned the Storage Blob Data Delegator role.
The Storage Blob Data Delegator role contains the control plane permission (Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action) required to obtain the delegation key.
3
Apply the requested scope and network/protocol constraints to the SAS token.
Configure the SAS to target only the 'profile-images' container, restrict the protocol to HTTPS-only, and limit the allowed IP addresses to the virtual machine's public IP (198.51.100.12) with an 8-hour expiration.
This satisfies the remaining least-privilege requirements for scope, transit encryption, IP filtering, and duration.

Key Concept

User Delegation SAS and RBAC
Question 445Question →

A company hosts a web application in Azure App Service named app-portal-prod. The application's App Service plan is currently configured for the Basic (B1) tier.

You are tasked with configuring the environment to support the following requirements:
- Enable zero-downtime deployments by using a staging environment to validate changes before routing them to production.
- Configure daily automated backups of the web application content and configuration.

Which two actions should you perform to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Scale up the App Service plan to the Standard (S1) pricing tier.; Create a deployment slot named staging on the web app.

Answer

Scale up the App Service plan to the Standard (S1) pricing tier and create a deployment slot named staging on the web app.
Scaling up the App Service plan to the Standard (S1) tier is correct because both deployment slots and custom automated backups require the Standard tier or higher. Creating a deployment slot named staging is correct because it establishes the staging environment needed for testing and zero-downtime swaps.

Step-by-Step Solution

1
Analyze the requirements for deployment slots and custom backups against the current Basic (B1) App Service plan tier.
Identify that both deployment slots and backups require a Standard (S1) tier or higher.
The Basic tier does not support deployment slots or automated custom backups.
2
Propose scaling up the App Service plan.
Scale the App Service plan from Basic (B1) to Standard (S1) tier.
This unlocks the deployment slots and custom backup features required by the scenario.
3
Create a new deployment slot on the web app.
A new slot named staging is successfully created.
This establishes the staging environment necessary for performing zero-downtime swaps.

Key Concept

Azure App Service plan tier features and capabilities, specifically deployment slots and backups.
Question 446Question →

An enterprise migration plan requires transferring virtual machine image files from an on-premises Windows server to an Azure storage account named stmigrationprod. The target destination is a private blob container named images.

The storage account network configuration is set to 'Enabled from selected virtual networks and IP addresses'. No virtual network or firewall IP rules are currently configured.

An administrator logs in to AzCopy using Microsoft Entra ID credentials that have been assigned the User Access Administrator and Contributor roles for the subscription containing the storage account.

When running the azcopy copy command, the administrator receives a 403 Forbidden error.

Which of the following configuration changes must the administrator perform to resolve this error and complete the file transfer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add the public IP address of the local Windows server to the firewall settings of the storage account.; Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.

Answer

To resolve the 403 Forbidden error during the AzCopy data movement, the administrator must add the local Windows server's public IP address to the storage account firewall settings and assign the Storage Blob Data Contributor role to their Microsoft Entra ID account.
To successfully transfer data using AzCopy with Microsoft Entra ID authentication to a secured storage account, two conditions must be met: network access and data-plane authorization. First, since the storage account's firewall is restricted to selected networks, the on-premises client's public IP address must be added to the allowed IP ranges. Second, because control plane roles (like Contributor or Owner) do not inherit data-plane permissions, the administrator must be assigned a data-plane role such as Storage Blob Data Contributor.

Step-by-Step Solution

1
Configure the storage account network firewall rules.
The public IP address of the Windows server is added to the allowed IP ranges of the storage account.
Since the firewall is restricted to selected networks, the on-premises client cannot initiate a connection unless its IP address is explicitly permitted.
2
Assign the appropriate data-plane role in Microsoft Entra ID.
The Storage Blob Data Contributor role is assigned to the administrator's account.
Standard Azure RBAC roles like Contributor or Owner only manage the control plane and do not grant data plane read/write permissions for blobs.

Key Concept

Successful data transfer using AzCopy with Microsoft Entra ID authentication requires both network firewall exceptions for the client's public IP and data-plane specific RBAC permissions (such as Storage Blob Data Contributor).
Question 447Question →

You are deploying a Standard Load Balancer in Azure to distribute traffic across a set of virtual machines. You need to configure a new Public IP address for the front-end IP configuration of this Load Balancer. Which combination of SKU and allocation method must you select for the Public IP address?

Show answer & explanation

Answer: Standard SKU and Static allocation

Answer

Standard SKU and Static allocation
A Standard Load Balancer requires a Standard SKU Public IP address for its front-end configuration. Standard SKU Public IP addresses only support the Static allocation method. Therefore, selecting the Standard SKU and Static allocation method is the only correct configuration.

Step-by-Step Solution

1
Determine the SKU requirement of the Load Balancer.
Since a Standard Load Balancer is being deployed, the associated front-end Public IP address must also use the Standard SKU to avoid SKU mismatch.
Azure enforces SKU alignment between load balancers and their associated public IP addresses.
2
Determine the supported IP allocation method for the Standard SKU Public IP.
Standard SKU Public IP addresses support only the Static allocation method.
Dynamic allocation is not supported for Standard SKU Public IP addresses in Azure.

Key Concept

Standard Load Balancer and Public IP SKU alignment requirements
Question 448Question →

An administrator is setting up Azure File Sync to centralize file shares from an on-premises file server named SRV-Prod1. The server contains a single volume F: with the following directory structure:
- F:\CorpData\Accounting
- F:\CorpData\Marketing

The administrator registers SRV-Prod1 with a Storage Sync Service named Sync-Service-Alpha. They create two sync groups: accounting-sync-group and corp-sync-group. The administrator successfully creates a server endpoint for F:\CorpData\Accounting in accounting-sync-group. However, when attempting to create a server endpoint for F:\CorpData in corp-sync-group, the operation fails.

What is the cause of this failure?

Show answer & explanation

Answer: Azure File Sync does not support overlapping namespaces; because the directory F:\CorpData\Accounting is nested under F:\CorpData, they cannot be used as endpoints in different sync groups.

Answer

Azure File Sync does not support overlapping namespaces; because the directory F:\CorpData\Accounting is nested under F:\CorpData, they cannot be used as endpoints in different sync groups.
The correct answer is that Azure File Sync does not support overlapping namespaces. Because F:\CorpData\Accounting is nested under F:\CorpData, they cannot coexist as server endpoints on the same registered server, even if they belong to different sync groups.

Step-by-Step Solution

1
Analyze the directory structure and paths of the planned server endpoints.
The paths are F:\CorpData\Accounting and F:\CorpData.
To verify if the paths have any overlapping namespaces.
2
Evaluate the namespace relationship between the two paths.
F:\CorpData\Accounting is a subdirectory of F:\CorpData, resulting in a namespace overlap.
Azure File Sync requires that the namespace of any server endpoint does not overlap with another server endpoint on the same server, regardless of the sync group.
3
Identify the constraint preventing configuration.
The attempt to create a server endpoint at F:\CorpData fails because F:\CorpData\Accounting is already registered as an endpoint.
To maintain sync state integrity, the Azure File Sync agent rejects overlapping directories on the same registered server.

Key Concept

Azure File Sync namespace overlap constraints
Question 449Question →

An administrator plans to deploy a new virtual machine named VM1 to host a critical line-of-business application. The administrator currently has a resource group named RG-Prod located in the East US region, which contains a Recovery Services vault named Vault-Prod.

The deployment must meet the following requirements:
- VM1 must be protected against datacenter-wide failures.
- VM1 must be backed up daily using Vault-Prod.
- Authorized administrators must be prevented from accidentally deleting VM1, while maintaining the ability to perform VM restarts and configuration updates.

Which configuration should the administrator use to deploy VM1?

Show answer & explanation

Answer: Deploy VM1 in the East US region, configure Availability Zones for the availability options, and apply a Delete lock to VM1.

Answer

Deploy VM1 in the East US region, configure Availability Zones for the availability options, and apply a Delete lock to VM1.
The correct configuration is to deploy VM1 in the East US region, configure Availability Zones, and apply a Delete lock. This ensures the VM is in the same region as the Recovery Services vault (allowing backups), resides in physically separated datacenters (protecting against datacenter-wide failures), and is locked against deletion while still allowing operations team members to perform updates and restarts.

Step-by-Step Solution

1
Determine the region requirement for VM1 backup.
VM1 must be deployed in the East US region.
Azure Recovery Services vaults only support backing up virtual machines that are located in the same region as the vault.
2
Select the appropriate availability option to protect against datacenter-wide failures.
Configure Availability Zones for VM1.
Availability Zones place VM instances in physically separate datacenters within the same region, protecting against datacenter-wide failures. Availability Sets only protect against localized hardware failures within a single datacenter.
3
Select the correct resource lock type.
Apply a Delete (CanNotDelete) lock to VM1.
A Delete lock allows administrators to read and modify resources (including starting, stopping, and updating configuration) but prevents deletion. A ReadOnly lock prevents all modifications and restarts.

Key Concept

Azure Virtual Machine deployment planning, focusing on regional constraints for backups, high availability options, and resource lock types.
Question 450Question →

An administrator plans to deploy a new Azure virtual machine named VM1 in the East US region. The deployment must meet the following requirements:
- VM1 must host a database workload that requires Ultra Disk storage.
- VM1 must be protected against datacenter-wide failures.
- VM1 must be backed up daily using Azure Backup.
Currently, the subscription contains an existing Recovery Services Vault named RSV1 located in the West US region.
How should the administrator configure the deployment of VM1?

Show answer & explanation

Answer: Deploy VM1 in an Availability Zone in East US, enable Ultra Disk compatibility during deployment, and create a new Recovery Services Vault in East US.

Answer

Deploy VM1 in an Availability Zone in East US, enable Ultra Disk compatibility during deployment, and create a new Recovery Services Vault in East US.
The correct configuration is to deploy the virtual machine in an Availability Zone, enable Ultra Disk compatibility, and create a new Recovery Services Vault in East US. Availability Zones protect against datacenter-wide failures and are a prerequisite for using Ultra Disks. Additionally, the Recovery Services Vault must be in the same region as the virtual machine to configure backups, and the deployment target must not have a ReadOnly lock that prevents resource creation.

Step-by-Step Solution

1
Evaluate the resiliency and disk requirements for the virtual machine.
The virtual machine must be deployed in an Availability Zone (not an Availability Set) to protect against datacenter-wide outages and to support Ultra Disk storage.
Availability Zones partition resources across physically separate datacenters within a region, providing protection against datacenter-wide outages, and are a technical requirement for mounting Ultra Disks.
2
Determine the backup configuration requirement.
A new Recovery Services Vault must be created in the East US region.
Azure Backup requires the Recovery Services Vault to reside in the same geographical region as the virtual machine being backed up. The existing vault RSV1 is in West US and cannot be used.
3
Analyze resource group lock constraints.
The target resource group must not have a ReadOnly lock applied during deployment.
A ReadOnly lock prevents any write operations, including the creation of new resources like virtual machines, disks, or network interfaces.

Key Concept

Virtual machine deployment requirements including Availability Zones, region-matching for backups, and resource lock implications during creation.
Estimated Time:2m 0s
Question 451Question →

Krypton Solutions is deploying a critical accounting application to the Germany West Central region. The application will run on two virtual machines named VM-App1 and VM-App2. The deployment must guarantee a virtual machine uptime SLA of at least 99.99%99.99\%. Which deployment strategy should you use to meet the SLA requirement?

Show answer & explanation

Answer: Deploy VM-App1 and VM-App2 to separate Availability Zones.

Answer

Deploy the virtual machines to separate Availability Zones within the same region.
Deploying two or more virtual machines across separate Availability Zones in the same region guarantees an SLA of at least 99.99%99.99\%. Availability Zones are physically separate datacenters with independent power, cooling, and networking.

Step-by-Step Solution

1
Identify the high availability requirements and SLA target.
The target SLA is 99.99%99.99\% uptime for two virtual machines.
Determining the target SLA helps choose between Availability Sets and Availability Zones.
2
Compare the SLA levels provided by Azure HA options.
Availability Sets provide 99.95%99.95\% SLA, while Availability Zones provide 99.99%99.99\% SLA for virtual machines.
To achieve 99.99%99.99\% SLA, the virtual machines must be placed in separate Availability Zones.
3
Evaluate the architectural constraints of the selected option.
Availability Zones are physically separate datacenters within the same region. Availability Sets cannot span multiple zones or regions.
This confirms that deploying the virtual machines to separate Availability Zones is the correct and valid configuration.

Key Concept

Azure Virtual Machine High Availability Options and SLAs
Estimated Time:1m 30s
Question 452Question →

An administrator is configuring a new virtual network named `VNet1` in an Azure subscription. The virtual network is assigned an address space of 10.200.0.0/1610.200.0.0/16.

The administrator has the following requirements:
- Deploy Azure Bastion to secure access to virtual machines.
- Create a subnet named `Subnet-Web` that must support at least 1212 virtual machines.

Which two of the following subnet configurations should the administrator implement to meet the requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: A subnet named `AzureBastionSubnet` with the address range 10.200.2.0/2610.200.2.0/26; A subnet named `Subnet-Web` with the address range 10.200.1.0/2710.200.1.0/27

Answer

A subnet named AzureBastionSubnet with the address range 10.200.2.0/26 and a subnet named Subnet-Web with the address range 10.200.1.0/27
To deploy Azure Bastion, the subnet must be named exactly AzureBastionSubnet and have a subnet prefix of /26 or larger. Therefore, the subnet named AzureBastionSubnet with the range 10.200.2.0/26 is correct. To host 12 virtual machines in Subnet-Web, the subnet must support at least 17 IP addresses because Azure reserves 5 IP addresses in every subnet (the first four and the last one). A /28 subnet only provides 11 usable IP addresses (16 - 5), whereas a /27 subnet provides 27 usable IP addresses (32 - 5), making the range 10.200.1.0/27 the minimum size that meets this requirement.

Step-by-Step Solution

1
Calculate the required subnet size for Subnet-Web.
Minimum IP addresses needed is 12 (VMs)+5 (Azure reserved IPs)=1712 \text{ (VMs)} + 5 \text{ (Azure reserved IPs)} = 17 IP addresses.
Azure reserves the first four and the last IP address of every subnet.
2
Select the correct CIDR block for Subnet-Web.
A /27/27 subnet (3232 total IPs, 2727 usable) is required because a /28/28 subnet only provides 1111 usable IPs (16−5=1116 - 5 = 11).
The subnet size must be the smallest available range that accommodates at least 1717 IP addresses.
3
Determine name and size requirements for Azure Bastion.
The subnet must be named exactly `AzureBastionSubnet` and have a prefix of /26/26 or larger.
Azure Bastion enforces strict naming and minimum subnet size (at least /26/26) constraints.

Key Concept

Azure virtual network subnet sizing including the 5 reserved IP addresses and Azure Bastion configuration requirements.
Question 453Question →

An administrator is designing a new virtual network named VNet1VNet1 in an Azure subscription. The address space for VNet1VNet1 is configured as 10.12.0.0/2210.12.0.0/22. The administrator must configure the following subnets within VNet1VNet1 to meet specific workload requirements:

* `Subnet-DB` must support at least 124124 database servers.
* `Subnet-App` must support at least 2828 application servers.
* A dedicated subnet for Azure Bastion to enable secure browser-based management.
* A dedicated subnet for an Azure VPN Gateway.

To minimize IP address waste, each subnet must use the smallest possible CIDR block (largest prefix size) that meets its requirements. All subnets must be non-overlapping.

Which subnet configuration meets the requirements?

Show answer & explanation

Answer: Subnet-DB: 10.12.0.0/2410.12.0.0/24, Subnet-App: 10.12.1.0/2610.12.1.0/26, AzureBastionSubnet: 10.12.1.64/2610.12.1.64/26, GatewaySubnet: 10.12.1.128/2910.12.1.128/29

Answer

The correct subnet configuration is Subnet-DB: 10.12.0.0/2410.12.0.0/24, Subnet-App: 10.12.1.0/2610.12.1.0/26, AzureBastionSubnet: 10.12.1.64/2610.12.1.64/26, GatewaySubnet: 10.12.1.128/2910.12.1.128/29.
The correct configuration uses Subnet-DB as 10.12.0.0/2410.12.0.0/24, Subnet-App as 10.12.1.0/2610.12.1.0/26, AzureBastionSubnet as 10.12.1.64/2610.12.1.64/26, and GatewaySubnet as 10.12.1.128/2910.12.1.128/29. It satisfies all of Azure's sizing and naming constraints: Subnet-DB requires a /24/24 block to support 124124 database servers (since a /25/25 only has 123123 usable IPs due to the 55 reserved IPs); Subnet-App requires a /26/26 block to support 2828 application servers (since a /27/27 only has 2727 usable IPs); AzureBastionSubnet has the correct name and satisfies the minimum prefix size of /26/26; GatewaySubnet has the correct name and satisfies the minimum prefix size of /29/29; and none of the subnets overlap.

Step-by-Step Solution

1
Calculate the minimum subnet size for Subnet-DB.
To support 124124 database servers, we must add Azure's 55 reserved IP addresses, totaling 129129 IP addresses. A /25/25 subnet (128128 addresses, 123123 usable) is too small, so we must use a /24/24 subnet (256256 addresses, 251251 usable).
Azure reserves the first four and the last IP address in each subnet.
2
Calculate the minimum subnet size for Subnet-App.
To support 2828 application servers, we add the 55 reserved IPs, requiring 3333 IP addresses. A /27/27 subnet (3232 addresses, 2727 usable) is too small, so we must use a /26/26 subnet (6464 addresses, 5959 usable).
Azure reserves the first four and the last IP address in each subnet.
3
Determine Azure Bastion and Gateway subnet requirements.
Azure Bastion requires the subnet name to be exactly 'AzureBastionSubnet' and the prefix size to be at least /26/26. The VPN Gateway subnet must be named 'GatewaySubnet' and must be at least /29/29.
These are Azure service-specific architecture constraints.
4
Arrange the subnets within the VNet address space without overlapping.
Aligning the subnets on valid binary boundaries: Subnet-DB at 10.12.0.0/2410.12.0.0/24, Subnet-App at 10.12.1.0/2610.12.1.0/26, AzureBastionSubnet at 10.12.1.64/2610.12.1.64/26, and GatewaySubnet at 10.12.1.128/2910.12.1.128/29. This fits within the 10.12.0.0/2210.12.0.0/22 range and has no overlaps.
Subnet ranges must be aligned with their prefix sizes and cannot share IP addresses.

Key Concept

Azure Virtual Network subnetting requires accounting for 5 reserved IP addresses per subnet and adhering to system naming and prefix requirements for special subnets such as AzureBastionSubnet (minimum /26) and GatewaySubnet (minimum /29).
Estimated Time:3m 0s
Question 454Question →

An administrator needs to configure temporary access to a container named reports-archive in an Azure Storage account named corpdatafiles2026. The access must be restricted to an on-premises application running on a server with the IP address 198.51.100.85198.51.100.85. The application only requires read access for a duration of exactly 4 hours, and the connection must be secured using HTTPS. The administrator must also ensure that access can be revoked immediately if a security compromise occurs, without impacting other applications that are currently using different SAS tokens. Which configuration should the administrator implement to meet these requirements?

Show answer & explanation

Answer: Generate a Service SAS associated with a Stored Access Policy on the container.

Answer

Generate a Service SAS associated with a Stored Access Policy on the container.
Generating a Service SAS associated with a Stored Access Policy is the correct approach. A Stored Access Policy allows you to define permissions and expiration times on the container level. If the SAS is compromised, the administrator can delete or modify the policy, which immediately invalidates all SAS tokens generated from it, without disrupting other SAS tokens or requiring storage account key rotation.

Step-by-Step Solution

1
Determine the type of Shared Access Signature (SAS) required for granular resource control and revocation.
A Service SAS is chosen because it targets a specific resource (the blob container) and supports Stored Access Policies, unlike an Account SAS.
An Account SAS cannot be associated with a Stored Access Policy, making individual revocation impossible without rotating the storage account access keys.
2
Configure a Stored Access Policy on the target container.
A Stored Access Policy is created on the container with the read permission and a 4-hour validity window.
By placing the constraints within the Stored Access Policy rather than directly on the token, the policy can be modified or deleted to immediately revoke access.
3
Generate the Service SAS token linked to the Stored Access Policy.
A Service SAS token is generated, incorporating the IP restriction to the specified address and requiring HTTPS connection.
Linking the SAS to the policy satisfies all security constraints while ensuring independent revocation capabilities.

Key Concept

Stored Access Policies allow control over Service SAS parameters, enabling instant revocation of specific tokens by deleting or altering the underlying policy without rotating the account access keys.
Question 455Question →

An administrator is planning to deploy a new Azure virtual machine named VM-DB1 to host a high-performance database workload. The database requires the use of Azure Ultra Disks for its data volume to achieve sub-millisecond latency. Which of the following configurations must be set during the creation of VM-DB1 to support the use of Ultra Disks? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Enable Ultra Disk compatibility on the virtual machine.; Deploy the virtual machine into a supported Availability Zone.

Answer

Enable Ultra Disk compatibility on the virtual machine, and deploy the virtual machine into a supported Availability Zone.
To successfully deploy a virtual machine that uses Ultra Disks, you must select an Availability Zone during creation (since Ultra Disks are zonal resources) and enable the 'Ultra Disk compatibility' setting on the virtual machine. This ensures that the VM is placed in a cluster that can support Ultra Disk attachments.

Step-by-Step Solution

1
Identify the storage requirements for the database workload.
The database workload requires Azure Ultra Disks to achieve sub-millisecond latency.
Ultra Disks have specific deployment prerequisites that must be configured during virtual machine provisioning.
2
Determine the availability and placement requirements for Ultra Disks.
The virtual machine must be deployed in a supported Availability Zone within the target region.
Ultra Disks are zonal resources and cannot be associated with virtual machines in Availability Sets.
3
Determine the virtual machine capabilities setting required for Ultra Disks.
Enable the Ultra Disk compatibility capability on the virtual machine.
By default, virtual machines do not have Ultra Disk support enabled, which prevents attaching Ultra Disks as data disks.

Key Concept

Deploying and configuring virtual machines with Ultra Disk compatibility and zonal placement.
Estimated Time:1m 30s
Question 456Question →

You plan to deploy a containerized batch job to Azure Container Instances (ACI) to process imported data. You need to ensure that the container does not restart after a successful execution. Which of the following restart policies can you configure to prevent restarts after a successful execution? (Select two.)

Select all that apply

Show answer & explanation

Answer: Never; OnFailure

Answer

To prevent a container from restarting after a successful execution in Azure Container Instances, you can configure either the Never or OnFailure restart policies.
For containerized tasks that run once and should not restart upon successful completion, both the Never policy (which prohibits restarts under any condition) and the OnFailure policy (which only restarts the container if the process exits with an error code) are valid configuration choices.

Step-by-Step Solution

1
Identify the container behavior requirement.
The container must run a batch job and must not restart if the execution is successful.
Understanding the desired lifecycle prevents deploying a policy that triggers infinite restart loops.
2
Evaluate the supported restart policies in Azure Container Instances.
ACI supports three valid restart policies: Always, Never, and OnFailure.
This allows filtering out invalid policy names and identifying correct options.
3
Determine which valid policies satisfy the requirement.
The Never policy prevents all restarts. The OnFailure policy only restarts on a non-zero exit code (failure) and prevents restarts on exit code 0 (success). Therefore, both policies satisfy the requirement.
Both choices successfully prevent the container from restarting after a successful run.

Key Concept

Azure Container Instances supports three restart policies: Always, Never, and OnFailure. For workloads that run to completion and should not run again after a successful execution, both Never and OnFailure are valid choices.
Question 457Question →

An administrator manages an Azure App Service web app named WebApp1 that runs on a Standard S1 App Service plan. You need to configure WebApp1 to scale out to a maximum of 15 instances based on CPU utilization. What should you do first?

Show answer & explanation

Answer: Scale up the App Service plan to a Premium tier.

Answer

Scale up the App Service plan to a Premium tier.
Scaling up the App Service plan to a Premium tier is correct because the Standard tier enforces a maximum limit of 10 instances. To scale out to 15 instances, the App Service plan must first be scaled up to a Premium tier, which supports up to 20 or 30 instances.

Step-by-Step Solution

1
Determine the scale-out instance capacity requirements.
The target configuration requires scaling out to a maximum of 15 instances.
This establishes the minimum scale-out capacity requirement.
2
Identify the instance limit of the current App Service plan tier.
The current Standard S1 plan has a maximum limit of 10 instances.
This shows that the current tier cannot support the required 15 instances.
3
Determine the first configuration change required to meet the capacity.
Scale up the App Service plan to a Premium tier, which supports 20 or 30 instances.
Changing the pricing tier (scaling up) must occur first to raise the instance limit before the scale-out rule can function.

Key Concept

Azure App Service plan scaling limits and the difference between scaling up (changing the pricing tier) and scaling out (increasing the instance count).
Question 458Question →

Your company has an Azure Storage account named storagecorp2026 that contains a blob container named software-deployments. You need to grant a partner company temporary read access to the software-deployments container for 7 days. The solution must meet the following requirements:
- The partner company must only have access to the software-deployments container.
- You must be able to revoke the access immediately before the 7-day period ends, without affecting other applications or rotating the storage account access keys.

Which two actions should you perform?

Select all that apply

Show answer & explanation

Answer: Create a stored access policy on the container.; Generate a service SAS that references the stored access policy.

Answer

Create a stored access policy on the container and generate a service SAS that references the stored access policy.
To grant granular, temporary access that can be revoked immediately without affecting other applications, you must use a service SAS associated with a stored access policy on the container. Modifying or deleting the stored access policy instantly invalidates any service SAS tokens referencing it.

Step-by-Step Solution

1
Create a stored access policy on the target blob container.
A policy is defined at the container level containing permissions and expiration settings.
Stored access policies provide the ability to group parameters and revoke or modify SAS tokens that reference them.
2
Generate a service SAS for the container and associate it with the stored access policy.
A service SAS token is generated that delegates access to the container.
A service SAS supports stored access policies and is scoped to a single resource type (the container), fulfilling the least privilege and revocation requirements.

Key Concept

Using stored access policies with service SAS tokens to enable revocation without rotating account keys.
Question 459Question →

You are designing the IP addressing and subnetting strategy for a new Azure Virtual Network (VNet). You plan to deploy both an Azure Bastion host and an Azure VPN Gateway. Which two of the following configuration requirements must you meet when creating the subnets for these resources? (Select two)

Select all that apply

Show answer & explanation

Answer: The subnet hosting the Azure Bastion service must be named AzureBastionSubnet; The subnet hosting the VPN Gateway must be named GatewaySubnet

Answer

The subnet hosting the Azure Bastion service must be named AzureBastionSubnet, and the subnet hosting the VPN Gateway must be named GatewaySubnet.
Azure enforces strict, case-sensitive naming conventions for certain platform-managed subnets. The subnet for Azure Bastion must be named exactly AzureBastionSubnet, and the subnet for a VPN Gateway must be named exactly GatewaySubnet. These specific names allow the Azure platform to correctly provision and manage these services within the virtual network.

Step-by-Step Solution

1
Identify the naming conventions for specialized Azure subnets.
The Azure Bastion subnet must be named AzureBastionSubnet, and the Virtual Network Gateway subnet must be named GatewaySubnet.
Azure services look for these exact, case-sensitive names to bind and deploy the gateway and bastion resources.
2
Determine the subnet size requirements for Azure Bastion.
The Azure Bastion subnet requires a prefix size of /26 or larger.
A size of /26 provides 64 IP addresses (59 usable after Azure reservations), which is the minimum requirement for Bastion scaling.

Key Concept

Azure Virtual Networks require specific names and size constraints for dedicated subnets like AzureBastionSubnet and GatewaySubnet.
Estimated Time:45s
Question 460Question →

An administrator is designing a virtual network architecture in Microsoft Azure to support a hybrid application. The architecture consists of the following components:

* A hub virtual network named `VNet-Hub` with an address space of 10.1.0.0/2210.1.0.0/22.
* A spoke virtual network named `VNet-Spoke` with an address space of 10.2.0.0/2210.2.0.0/22.
* A web workload in `VNet-Spoke` that requires 2828 virtual machines, each needing a dynamic private IP address.
* An Azure Bastion host deployed in `VNet-Hub` to secure management access.
* An Azure VPN Gateway deployed in `VNet-Hub` to connect to the on-premises network.

The administrator wants to ensure that:

1. Virtual machines in `VNet-Spoke` can communicate with the on-premises network via the VPN Gateway in `VNet-Hub`.
2. Name resolution works for a private DNS zone named `corp.internal` across both virtual networks.
3. The Azure Bastion host is deployed in `VNet-Hub` using the minimum supported subnet size to conserve IP addresses.
4. The web workload subnet in `VNet-Spoke` is configured with the smallest possible subnet prefix that can support the 2828 virtual machines.

Which configuration meets the requirements?

Show answer & explanation

Answer: Deploy Azure Bastion in a subnet named AzureBastionSubnet with a 10.1.3.0/2610.1.3.0/26 prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Enable gateway transit on the peering from VNet-Hub to VNet-Spoke and configure VNet-Spoke to use the remote gateway. Create a virtual network link in the corp.internal Private DNS zone for both virtual networks.

Answer

Deploy Azure Bastion in a subnet named AzureBastionSubnet with a 10.1.3.0/2610.1.3.0/26 prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Enable gateway transit on the peering from VNet-Hub to VNet-Spoke and configure VNet-Spoke to use the remote gateway. Create a virtual network link in the corp.internal Private DNS zone for both virtual networks.
The correct configuration addresses all sizing, routing, name resolution, and specialized subnet constraints. Sizing the web workload subnet with a /26 prefix is necessary because a /27 subnet only offers 27 usable IP addresses (32−5=2732 - 5 = 27 usable due to Azure's five reserved IPs), which cannot support the 28 virtual machines. Furthermore, the configuration correctly defines a /26 prefix for the subnet named 'AzureBastionSubnet', establishes gateway transit for transit routing to the on-premises gateway, and links the Private DNS zone to both virtual networks.

Step-by-Step Solution

1
Calculate the required subnet size for the web workload.
A /26 prefix is required.
The web workload needs to support 2828 virtual machines. Azure reserves 55 IP addresses in every subnet (first four and the last one). Therefore, 28+5=3328 + 5 = 33 total IP addresses are required. A /27 subnet provides 3232 addresses (32−5=2732 - 5 = 27 usable), which is one too few. The next size up is a /26 subnet which provides 6464 addresses (5959 usable).
2
Identify the minimum requirements for the Azure Bastion subnet.
The subnet must be named 'AzureBastionSubnet' and use a prefix size of at least /26.
Azure enforces specific naming and size requirements for the Bastion subnet; configuring a smaller prefix (such as /27) results in deployment failures.
3
Configure hybrid connectivity for the spoke virtual network.
Enable 'Use the remote virtual network's gateway' on VNet-Spoke and 'Use this virtual network's gateway' (gateway transit) on VNet-Hub.
VNet peering is not transitive by default. To route spoke traffic to the on-premises network through the hub gateway, transit settings must be enabled.
4
Configure Private DNS resolution.
Create virtual network links from the Private DNS zone 'corp.internal' to both VNet-Hub and VNet-Spoke.
Private DNS zone resolution does not automatically propagate over peered networks; virtual network links must be configured for each VNet.

Key Concept

Azure Virtual Network planning, containing specific requirements for subnet sizing (incorporating Azure's five reserved IP addresses), specialized subnets (Azure Bastion and VPN Gateway), peering transit, and Private DNS linking.
Estimated Time:2m 30s
PreviousPage 23 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin