All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An administrator manages an Azure subscription named sub-engineering-prod. The subscription contains a resource group named rg-core-databases. To control costs, the administrator configures a monthly budget at the subscription scope. The budget includes a threshold alert set to trigger when actual spending reaches 90% of the budgeted amount. During the billing cycle, the spending exceeds the threshold, but no email notifications are sent to the administration team. You need to identify the reason why the notifications were not sent. Which of the following is the most likely cause of this issue?

The budget was configured at the subscription scope, which excludes resources within child resource groups from the cost calculation.

A CanNotDelete resource lock applied to the subscription prevents Cost Management from generating notifications.

The budget threshold was created without associating any email addresses or Action Groups to the alert.

The budget requires a separate Azure Monitor metric alert rule to route cost thresholds to the administration team.

Show answer & explanation

Answer: The budget threshold was created without associating any email addresses or Action Groups to the alert.

Answer

The budget threshold was created without associating any email addresses or Action Groups to the alert.

The correct answer is correct because Azure Cost Management budgets require explicit configuration of email recipients or Action Groups for each threshold alert. If these are not specified, the alert triggers internally when the threshold is met but cannot deliver any notifications to administrators.

Step-by-Step Solution

Analyze the configuration of Azure Cost Management budgets and alert thresholds.

Identify that a budget threshold was set to 90% but notifications were not received.

To determine why the alert was silent despite the costs exceeding the threshold.

Evaluate the role of resource locks and scopes on Cost Management alerts.

Determine that the subscription scope includes child resource groups and that a CanNotDelete lock does not block notifications.

To rule out scope configuration and resource locks as the cause of the missing alerts.

Verify the notification settings configured on the budget threshold.

Establish that email recipients or Action Groups must be explicitly defined under the budget's alert threshold conditions.

To identify the root cause of the silent budget alert.

Key Concept

Azure Cost Management Budgets and Alert Thresholds

Question 462Question →

You have an Azure subscription that contains a virtual machine named VM1 and a Basic Load Balancer named LB1. VM1 is currently associated with the backend pool of LB1. You need to assign a public IP address directly to the primary network interface (NIC) of VM1 to allow direct external access for management. Which configuration should you select for the new public IP address?

A Basic SKU public IP address with Dynamic allocation

A Standard SKU public IP address with Static allocation

A Standard SKU public IP address with Dynamic allocation

A Basic SKU public IP address with zone-redundant availability

Show answer & explanation

Answer: A Basic SKU public IP address with Dynamic allocation

Answer

A Basic SKU public IP address with Dynamic allocation

The correct configuration is a Basic SKU public IP address with Dynamic allocation. Since the virtual machine is currently associated with a Basic Load Balancer, any public IP address directly attached to the virtual machine's network interface must match the load balancer's SKU. Basic SKU public IPs support both Dynamic and Static allocation methods, making this configuration valid.

Step-by-Step Solution

Identify the existing resources and constraint associations.

The target virtual machine (VM1) is part of a Basic Load Balancer's backend pool.

Azure enforces SKU alignment across resources attached to the same virtual machine network interfaces. A virtual machine in the backend pool of a Basic Load Balancer can only be associated with Basic SKU public IP addresses.

Filter public IP SKU options based on compatibility rules.

Standard SKU public IP options must be discarded due to SKU mismatch, leaving only Basic SKU configurations.

Standard SKU public IPs cannot be associated with a network interface if the VM is bound to a Basic Load Balancer.

Evaluate the capabilities and configuration options of the Basic SKU public IP.

Select a Basic SKU public IP with Dynamic allocation, and rule out zone redundancy.

Basic SKU public IPs support Dynamic allocation but do not support availability zones or zone-redundant configurations, which are features exclusive to the Standard SKU.

Key Concept

SKU alignment and compatibility rules for Azure Public IP addresses and Load Balancers

Estimated Time:1m 30s

Question 463Question →

You are configuring two new Azure Web Apps that have the following requirements:

* App1 requires a custom domain name and SSL bindings, but only needs manual scaling.
* App2 requires deployment slots for staging environments.

You need to select the most cost-effective App Service plan pricing tier for each web app.

Which two pricing tiers should you select?

Select all that apply

Basic (B1) for App1

Standard (S1) for App2

Shared (D1) for App1

Basic (B1) for App2

Premium V3 (P1v3) for App2

Show answer & explanation

Answer: Basic (B1) for App1; Standard (S1) for App2

Answer

Basic (B1) for App1 and Standard (S1) for App2

Basic (B1) is the most cost-effective tier that supports custom domains and SSL bindings, satisfying the requirements for App1. Standard (S1) is the most cost-effective tier that supports deployment slots, satisfying the requirements for App2.

Step-by-Step Solution

Analyze the requirements for App1.

App1 requires custom domains and SSL bindings with manual scaling. The Shared (D1) tier supports custom domains but not SSL. The Basic (B1) tier is the lowest tier that supports both custom domains and custom SSL.

To identify the most cost-effective tier that meets all criteria for the first workload.

Analyze the requirements for App2.

App2 requires deployment slots. The Free, Shared, and Basic tiers do not support deployment slots. The Standard (S1) tier supports up to 5 deployment slots and is cheaper than Premium tiers.

To identify the most cost-effective tier that meets all criteria for the second workload.

Combine the optimal selections.

Basic (B1) is chosen for App1, and Standard (S1) is chosen for App2.

To select the correct pair of answers representing the minimum costs for both workloads.

Key Concept

Azure App Service plan pricing tiers and feature support

Question 464Question →

You manage an Azure environment that contains a virtual network named `VNet1` ( $10.200.0.0/16$ ). `VNet1` contains three subnets:
* `Subnet-Web` ( $10.200.1.0/24$ )
* `Subnet-App` ( $10.200.2.0/24$ )
* `Subnet-Secure` ( $10.200.3.0/24$ )

An Azure ExpressRoute gateway is connected to `VNet1` and propagates BGP routes from an on-premises network ( $192.168.10.0/24$ ) to all subnets.

You deploy a network virtual appliance (NVA) in `Subnet-Secure` that has the private IP address of $10.200.3.4$ .

You create a custom route table named `RT1` and associate it with `Subnet-Web`. `RT1` has a single user-defined route for $0.0.0.0/0$ with the next hop set to the NVA at $10.200.3.4$ .

You have the following routing requirements for traffic originating from `Subnet-Web`:
* All traffic destined for the internet must be routed through the NVA.
* All traffic destined for `Subnet-App` must route directly, bypassing the NVA.
* All traffic destined for the on-premises network ( $192.168.10.0/24$ ) must be routed through the NVA.

What should you do on `RT1` to meet these requirements?

Disable gateway route propagation on the route table.

Add a route for

192.168.10.0/24

with a next hop type of Virtual network gateway.

Disable gateway route propagation on the route table and add a route for

10.200.2.0/24

with a next hop type of Virtual appliance pointing to

10.200.3.4

Add a route for

10.200.2.0/24

with a next hop type of Virtual network gateway.

Show answer & explanation

Answer: Disable gateway route propagation on the route table.

Answer

Disable gateway route propagation on the route table.

Disabling gateway route propagation prevents the route table from learning BGP-propagated routes. With the

192.168.10.0/24

route removed from the table, traffic to the on-premises network falls back to the default route (

0.0.0.0/0

) pointing to the NVA. Concurrently, local VNet routing to the application subnet is unaffected because default system routes for the local VNet (

10.200.0.0/16

) cannot be disabled and always take precedence over

0.0.0.0/0

due to Longest Prefix Match (LPM).

Step-by-Step Solution

Analyze the local VNet routing requirement from the web subnet to the application subnet.

The target subnet (

10.200.2.0/24

) is within the local virtual network range (

10.200.0.0/16

). Due to Longest Prefix Match (LPM), the default system route for the local virtual network (

10.200.0.0/16

-> Virtual network) is more specific than the default user-defined route (

0.0.0.0/0

-> NVA). Thus, traffic destined for the application subnet naturally routes directly, bypassing the NVA.

More specific system routes (longer prefix) take precedence over less specific user-defined routes.

Analyze the routing behavior for the on-premises network (

192.168.10.0/24

With gateway route propagation enabled, the route table learns the

192.168.10.0/24

route via BGP, which has a next hop type of Virtual network gateway. Because

192.168.10.0/24

is more specific than the default route (

0.0.0.0/0

), traffic to on-premises will bypass the NVA and go directly to the gateway.

Propagated BGP routes are more specific than a default route (

0.0.0.0/0

Determine the configuration change required to redirect the on-premises traffic to the NVA.

Disabling gateway route propagation prevents the route table from learning the BGP routes. As a result, the route to

192.168.10.0/24

is removed from the route table. Traffic destined for the on-premises network will then match the default route (

0.0.0.0/0

), sending it to the NVA.

Removing the propagated BGP route forces the traffic to fall back to the default UDR pointing to the NVA.

Key Concept

Azure Route Precedence and Route Propagation Control

Question 465Question →

An organization has a Microsoft Entra ID tenant. You create an Administrative Unit named Operations-AU, then add all user accounts for the operations department and a security group named Operations-Group to Operations-AU. You assign a user named Admin1 the User Administrator role scoped to Operations-AU. Admin1 needs to assign Microsoft 365 E3 licenses to all operations department users. Admin1 attempts to assign the licenses to Operations-Group, but the operation fails due to insufficient permissions. Which action should Admin1 take to successfully assign the licenses to the operations department users?

Assign the Microsoft 365 E3 licenses directly to the individual user accounts within Operations-AU.

Request a Global Administrator to assign the License Administrator role to Admin1 scoped to Operations-AU.

Assign the Contributor role to Admin1 on the Azure subscription, then assign the licenses to Operations-Group.

Configure a dynamic membership rule on Operations-Group to automatically assign the licenses to its members.

Show answer & explanation

Answer: Assign the Microsoft 365 E3 licenses directly to the individual user accounts within Operations-AU.

Answer

Assign the Microsoft 365 E3 licenses directly to the individual user accounts within Operations-AU.

The correct action is to assign the licenses directly to the individual user accounts within Operations-AU. As a User Administrator scoped to the administrative unit, Admin1 possesses the necessary privileges to manage user accounts within that scope, including direct license assignment. However, group-based licensing requires tenant-level License Administrator or Global Administrator privileges because configuring licenses on groups affects tenant-wide directory settings, and the License Administrator role cannot be scoped to an administrative unit.

Step-by-Step Solution

Analyze the administrative privileges and scope of Admin1.

Admin1 is a User Administrator scoped to the Operations-AU administrative unit.

This scoped role allows Admin1 to manage user object properties—including direct license assignments—for users that are members of Operations-AU.

Determine the limitation preventing group-based license assignment.

Group-based license configuration requires tenant-level permissions (such as License Administrator or Global Administrator).

The License Administrator role cannot be scoped to an administrative unit, meaning Admin1 cannot assign licenses to groups.

Identify the direct assignment capability within the administrative unit scope.

Admin1 can assign licenses directly to individual user accounts in Operations-AU.

Since the target users are members of the administrative unit and direct license assignment is a user-level operation, the AU-scoped User Administrator role is sufficient.

Key Concept

Administrative Unit scoped roles and the distinction between direct user licensing and group-based licensing requirements.

Estimated Time:1m 30s

Question 466Question →

You have an Azure Storage account named stcopy104 that has its firewall configured to 'Enabled from selected virtual networks and IP addresses'. An administrator named Admin1 is assigned the Storage Blob Data Contributor role for stcopy104. From an on-premises virtual machine, Admin1 runs the 'azcopy login' command and authenticates successfully using Microsoft Entra ID. Admin1 then attempts to upload files to a blob container in stcopy104 by running 'azcopy copy', but the command fails with an HTTP 403 (Authorization Failure) error. Which configuration change is required to resolve this issue?

Assign the Storage Blob Data Owner role to Admin1.

Generate a Shared Access Signature (SAS) token with an expiration window of 24 hours and use it for authentication.

Add the public IP address of the on-premises virtual machine to the firewall settings of stcopy104.

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting on stcopy104.

Show answer & explanation

Answer: Add the public IP address of the on-premises virtual machine to the firewall settings of stcopy104.

Answer

Add the public IP address of the on-premises virtual machine to the firewall settings of stcopy104.

The correct answer is to add the public IP address of the on-premises virtual machine to the firewall settings of the storage account. When the firewall of a storage account is configured for selected networks, all incoming requests to the storage account's data plane (such as blob upload requests) are blocked unless the source IP address is explicitly allowed. Even though authentication via Entra ID succeeds because the client can reach the global Entra ID login endpoints, the actual file transfer is blocked at the storage account boundary.

Step-by-Step Solution

Analyze the authentication and access paths.

The command 'azcopy login' authenticates against the Microsoft Entra ID endpoint, which is open to the public internet, explaining why login succeeded.

To distinguish between control/identity plane and data plane security boundaries.

Evaluate the current data-plane RBAC role permissions.

Admin1 is assigned the Storage Blob Data Contributor role, which is sufficient for upload operations.

To rule out permission-related issues on the data plane.

Evaluate the network firewall restrictions on the storage account.

The firewall is enabled for selected networks and currently blocks traffic from the on-premises virtual machine's public IP address.

To identify the root cause of the HTTP 403 (Authorization Failure) error during data transfer.

Determine the correct firewall bypass mechanism.

The client's public IP must be added to the allowed IP ranges of stcopy104, as AzCopy on-premises does not qualify as a trusted Microsoft service.

To configure the network rule that permits the AzCopy data transfer.

Key Concept

Azure Storage firewall restrictions on data plane operations versus Entra ID control plane authentication

Estimated Time:2m 30s

Question 467Question →

Your company has an Azure subscription containing a resource group named `RG-Operations` and a virtual network named `VNet-Core` with an address space of $172.16.0.0/12$ . You need to create a new subnet named `Subnet-App` to deploy 28 virtual machines that require individual private IP addresses. What is the smallest subnet size (CIDR prefix) you can configure for `Subnet-App` to support these virtual machines?

`/27`

`/26`

`/28`

`/25`

Show answer & explanation

Answer: `/26`

Answer

The smallest subnet size (CIDR prefix) that can support 28 virtual machines is `/26`.

To host 28 virtual machines, you need 28 IP addresses. Since Azure reserves 5 IP addresses in every subnet, the total number of IP addresses required is

28 + 5 = 33

. A prefix of `/27` only yields

32

total IP addresses (27 usable), which is one address short. Therefore, the next larger size, which is `/26` (providing

64

total addresses and 59 usable addresses), is the smallest prefix size that can support the requirements.

Step-by-Step Solution

Identify the host requirement and the Azure subnet reservation rule.

28 virtual machines are required, and Azure reserves 5 IP addresses per subnet (the first 4 and the last 1).

To find the minimum address space, we must sum the required host IP addresses and Azure's reserved IP addresses.

Calculate the total minimum number of IP addresses required.

28 \text{ hosts} + 5 \text{ reserved IPs} = 33 \text{ IP addresses}

Any subnet size chosen must provide at least 33 total IP addresses.

Determine the smallest CIDR block that provides at least 33 IP addresses.

A `/27` subnet provides

2^{32-27} = 32

IP addresses (too small). A `/26` subnet provides

2^{32-26} = 64

IP addresses.

A `/26` subnet is the smallest standard block that can accommodate the required 33 IP addresses.

Key Concept

Subnet sizing and Azure reserved IP addresses

Question 468Question →

You are planning the deployment of Azure File Sync. You have an on-premises Windows Server 2022 named FS01 and an Azure Storage account named storage1. The storage1 account contains an Azure file share named share1.

For security reasons, the firewall on storage1 is enabled and configured to allow access only from selected virtual networks and IP addresses.

You need to configure the environment to allow FS01 to synchronize files with share1.

Which of the following actions can you perform to allow FS01 to connect to storage1? (Select two.)

Select all that apply

Create a private endpoint for the File service of storage1.

Add the public IP address of FS01 to the firewall settings of storage1.

Enable the 'Allow trusted Microsoft services to access this storage account' setting on storage1.

Map the local synchronization path on FS01 to a second server endpoint in another sync group.

Show answer & explanation

Answer: Create a private endpoint for the File service of storage1.; Add the public IP address of FS01 to the firewall settings of storage1.

Answer

Create a private endpoint for the File service of storage1, and add the public IP address of FS01 to the firewall settings of storage1.

To establish connection from an on-premises server to a firewalled storage account, you can either create a private endpoint for the File service of storage1 (which routes traffic over a private connection like VPN/ExpressRoute) or add the public IP address of FS01 to the firewall allowed list (which allows public traffic from the server).

Step-by-Step Solution

Identify the networking requirements for Azure File Sync when a storage account firewall is enabled.

Determine that Azure File Sync requires a direct connection to the storage account's endpoint, which is blocked by the default firewall rule.

To find valid connectivity options for the on-premises server.

Evaluate the options for bypassing or routing through the storage account firewall.

You can configure a private endpoint for the File service of storage1 to route traffic over a private network, or add the public IP address of FS01 to the firewall settings to allow traffic over the public internet.

To establish network connectivity between the registered server and the Azure file share.

Assess and eliminate invalid bypass or endpoint configuration options.

Reject the trusted Microsoft services option since Azure File Sync is not included, and reject the multiple sync group mapping option because server endpoint paths cannot overlap.

To eliminate incorrect configurations that do not restore connectivity or are unsupported.

Key Concept

Configuring network access and firewalls for Azure Files and Azure File Sync.

Question 469Question →

An administrator is configuring a custom domain named portal.contoso.com for an Azure App Service web app named app-portal-prod. To secure the backend databases, the administrator configures a Private Endpoint for the web app and disables public network access. The administrator needs to secure the custom domain portal.contoso.com using a TLS/SSL certificate. The certificate must support automatic renewal to minimize administrative overhead. Which configuration should the administrator implement to secure the custom domain while meeting the security and renewal requirements?

Configure the custom domain using DNS TXT record validation, and bind a custom TLS/SSL certificate imported from Azure Key Vault with certificate auto-rotation enabled.

Create a free Azure App Service Managed Certificate for the custom domain and configure SNI-based SSL binding.

Configure regional VNet Integration for the web app, and configure a Private DNS Zone link to verify the domain ownership.

Generate a self-signed certificate, upload it directly to the App Service TLS/SSL settings, and enable the App Service auto-renew setting.

Show answer & explanation

Answer: Configure the custom domain using DNS TXT record validation, and bind a custom TLS/SSL certificate imported from Azure Key Vault with certificate auto-rotation enabled.

Answer

Configure the custom domain using DNS TXT record validation, and bind a custom TLS/SSL certificate imported from Azure Key Vault with certificate auto-rotation enabled.

Configuring the custom domain using DNS TXT records allows the control plane to verify ownership. Binding a custom certificate from Azure Key Vault with auto-rotation enabled satisfies the requirement for automatic renewal. Since public network access is disabled, the public Certificate Authority cannot reach the web app to perform the HTTP-01 challenge needed for issuing or renewing a free App Service Managed Certificate. Azure Key Vault manages the certificate lifecycle independently and syncs it to the App Service automatically.

Step-by-Step Solution

Analyze the web app network security status.

The web app has public network access disabled and uses a Private Endpoint.

This restricts inbound HTTP/HTTPS traffic to the private network, meaning the web app is not reachable from the public internet.

Evaluate the custom domain verification requirement.

Domain ownership must be verified using a DNS TXT record.

Because the web app cannot receive public HTTP traffic, standard HTTP-based validation cannot be performed.

Evaluate certificate validation limitations.

Azure App Service Managed Certificates cannot be used.

Managed certificates require public HTTP-01 challenge verification. Since public access is disabled, the public Certificate Authority cannot reach the app to verify the domain during creation or renewal.

Determine the correct certificate and automation method.

Import a custom TLS/SSL certificate from Azure Key Vault with auto-rotation enabled.

Key Vault handles the renewal process externally, and App Service automatically syncs the rotated certificate from Key Vault without requiring public inbound access.

Key Concept

Configuring custom domains and TLS/SSL certificates for network-isolated Azure App Services.

Estimated Time:3m 0s

Question 470Question →

Vanguard Systems is deploying a critical database workload in the East Asia region. You need to configure four virtual machines (VMs) to host the application. The deployment must meet the following requirements:
- Guarantee a virtual machine uptime SLA of $99.99\%$ .
- Protect the application from datacenter-wide power or cooling failures.
- Distribute incoming traffic across the virtual machines.

Which of the following actions should you perform to meet the requirements? (Select two.)

Select all that apply

Deploy the virtual machines across separate Availability Zones in the East Asia region.

Associate the virtual machines with a Standard SKU Load Balancer.

Deploy the virtual machines in an Availability Set that spans across multiple Availability Zones.

Associate the virtual machines with a Basic SKU Load Balancer.

Show answer & explanation

Answer: Deploy the virtual machines across separate Availability Zones in the East Asia region.; Associate the virtual machines with a Standard SKU Load Balancer.

Answer

To meet the requirements, you must deploy the virtual machines across separate Availability Zones to satisfy the SLA and protect against zone-level failures, and use a Standard SKU Load Balancer to distribute traffic across those zones.

Deploying the virtual machines across separate Availability Zones provides datacenter-level isolation, meeting the

99.99\%

SLA and safeguarding against datacenter-wide power or cooling outages. Since the VMs are distributed across different zones, a Standard SKU Load Balancer is required to distribute incoming traffic, as the Basic SKU Load Balancer is restricted to a single Availability Set or zone.

Step-by-Step Solution

Evaluate the SLA and power/cooling protection requirements.

Determine that Availability Zones are required instead of Availability Sets.

An uptime SLA of

99.99\%

requires virtual machines to be spread across multiple Availability Zones. Availability Sets only provide up to

99.95\%

SLA and do not protect against datacenter-wide failures.

Determine the load balancer SKU required for the zonal backend pool.

Identify that a Standard SKU Load Balancer must be used.

Only Standard Load Balancers support routing traffic to virtual machines deployed across multiple Availability Zones.

Key Concept

Deploying virtual machines across Availability Zones for high availability and distributing traffic using a Standard Load Balancer.

Question 471Question →

An administrator deploys an e-commerce application to an Azure App Service web app named `app-checkout-prod` that runs on a Standard S1 App Service plan. The App Service plan is configured to run on 5 active instances. The application stores shopping cart data in-memory within each instance. During initial user testing, testers notice that their active shopping carts are periodically lost and reset to empty as they navigate between different pages of the website. Which setting under the General settings configuration of the web app must the administrator enable to resolve this issue?

Always On

Session affinity

Web sockets

A higher pricing tier, by migrating the App Service plan to Premium V3

Show answer & explanation

Answer: Session affinity

Answer

Session affinity

The correct option is Session affinity. In a scaled-out Azure App Service hosting an application with local in-memory session state, client requests must consistently route to the same backend instance. Enabling Session affinity (ARR affinity) instructs the Azure front-end load balancer to append an affinity cookie (ARRAffinity) to the response headers, directing subsequent requests from that user to the same instance that established the session.

Step-by-Step Solution

Analyze the application architecture and state storage.

The application runs on 5 active instances and stores shopping cart data in-memory locally on each instance.

Understanding where user session data is held helps determine why users lose their cart data when navigating between pages.

Evaluate request routing behavior across the multi-instance App Service plan.

By default, when Session affinity is disabled, client requests are distributed among the 5 instances using a round-robin or load-based distribution.

If a user's next request goes to a different instance than the one containing their in-memory shopping cart, the session state is not found and the cart appears empty.

Determine the configuration setting to pin user requests to the correct instance.

Enabling Session affinity under General settings configures the front-end load balancer to use the ARRAffinity cookie to keep routing the user to the same instance.

This guarantees that all subsequent requests from the same user session reach the instance holding their active shopping cart data.

Key Concept

Configuring Session affinity (ARR affinity) for Azure App Services to maintain stateful client sessions across scaled-out instances.

Estimated Time:2m 0s

Question 472Question →

You deploy a containerized web API to Azure Container Instances (ACI). The API must run continuously to process incoming client requests. Which restart policy should you configure for the container instance?

Always

Never

OnFailure

Configure the container to use an App Service Plan autoscale rule for restarts.

Show answer & explanation

Answer: Always

Answer

Always

The correct option is 'Always'. For Azure Container Instances (ACI), the 'Always' restart policy ensures that the container is restarted automatically when it stops. This is the correct configuration for continuous workloads such as web applications and APIs.

Step-by-Step Solution

Identify the workload type and availability requirement.

The workload is a web API that must run continuously to process client requests.

Uptime and continuous running are required for this scenario.

Determine the appropriate Azure Container Instances (ACI) restart policy.

The 'Always' policy is selected because it restarts the container automatically if it stops.

This matches the requirement for a continuous service, unlike 'Never' or 'OnFailure' which are for run-to-completion tasks.

Key Concept

Azure Container Instances restart policies

Question 473Question →

An administrator manages a Windows web app named App1 that runs on an Azure App Service plan named ASP-Prod. Currently, ASP-Prod is configured on the Basic (B1) pricing tier.

You need to configure the hosting environment and backup solution to meet the following requirements:
* Enable autoscale to automatically scale the application up to 15 instances during high-traffic events.
* Support up to 6 deployment slots for staging, testing, and pre-production builds.
* Configure daily automated backups of App1 to an Azure storage account named store1.
* Secure traffic to store1 by enabling its firewall to restrict access to selected networks only.

Which TWO actions should you perform to meet these requirements while minimizing costs?

Select all that apply

Scale up the App Service plan to the Premium v2 (P1v2) tier.

Configure a system-assigned managed identity for App1 and assign it the Storage Blob Data Contributor role on store1.

Scale up the App Service plan to the Standard (S1) tier.

Configure the backup of App1 using the primary access key of store1.

Show answer & explanation

Answer: Scale up the App Service plan to the Premium v2 (P1v2) tier.; Configure a system-assigned managed identity for App1 and assign it the Storage Blob Data Contributor role on store1.

Answer

Scale up the App Service plan to the Premium v2 (P1v2) tier, and configure a system-assigned managed identity for the web app with the Storage Blob Data Contributor role on the storage account.

To meet the requirements of 15 instances and 6 deployment slots, the App Service plan must be scaled up to at least the Premium v2 tier, as the Standard tier only supports up to 10 instances and 5 slots. To backup to a storage account with the firewall enabled, access keys are blocked. Instead, a system-assigned managed identity must be enabled on the web app and granted the Storage Blob Data Contributor role on the storage account.

Step-by-Step Solution

Evaluate the instance scaling and deployment slot requirements.

The requirements demand 15 scale-out instances and 6 deployment slots.

This rules out the Standard tier, which is limited to a maximum of 10 instances and 5 deployment slots.

Identify the most cost-effective App Service plan tier that meets these limits.

The Premium v2 (P1v2) tier supports up to 20 instances and 20 deployment slots.

Premium v2 meets the requirements and is more cost-effective than Premium v3 or Isolated tiers.

Analyze backup requirements to a firewall-secured storage account.

Access keys cannot bypass the storage account firewall.

Azure App Service requires a managed identity (system-assigned or user-assigned) and the Storage Blob Data Contributor role to securely perform backups to a firewalled storage account.

Key Concept

Azure App Service Plan pricing tier capabilities and secure backup configurations

Question 474Question →

An administrator manages an Azure environment that contains a management group named MG-Engineering and a subscription named Sub-Dev-01. Sub-Dev-01 contains a resource group named rg-shared-testing. Inside rg-shared-testing, you have a storage account named storedata99 and five virtual machines used for daily testing. You need to configure the environment to meet the following requirements:
1. Automatically deallocate the virtual machines when the monthly cost of Sub-Dev-01 exceeds 100% of its budgeted limit.
2. Prevent users from deleting storedata99, while allowing them to create, modify, and delete the virtual machines.
Which two actions should you perform?

Select all that apply

Create a budget for Sub-Dev-01, set the alert threshold to 100%, and configure an Action Group to trigger the VM deallocation runbook.

Apply a CanNotDelete lock directly to the storedata99 storage account.

Apply a CanNotDelete lock to the rg-shared-testing resource group.

Create a budget for Sub-Dev-01, set the alert threshold to 100%, and define the VM deallocation runbook directly inside the budget settings without creating an Action Group.

Show answer & explanation

Answer: Create a budget for Sub-Dev-01, set the alert threshold to 100%, and configure an Action Group to trigger the VM deallocation runbook.; Apply a CanNotDelete lock directly to the storedata99 storage account.

Answer

Create a budget for the subscription with a 100% alert threshold linked to an Action Group that triggers the VM deallocation runbook, and apply a CanNotDelete lock directly to the storage account resource.

Applying a CanNotDelete lock directly to the storage account ensures that only that specific resource is protected from deletion, satisfying the requirement to allow virtual machine deletion. To automate the VM deallocation when the cost threshold is reached, you must associate the budget alert threshold with an Action Group configured to trigger an Automation runbook.

Step-by-Step Solution

Evaluate the resource lock requirements to prevent deletion of the storage account while permitting virtual machine deletions.

Determine that placing a CanNotDelete lock at the resource group level would inherit down to the virtual machines and block their deletion. Therefore, the lock must be applied directly to the storage account.

Resource locks are inherited by all child resources under the scope where they are applied.

Evaluate the automation requirement to shut down virtual machines when the subscription budget is exceeded.

Identify that budget alerts require an Action Group to execute custom actions such as runbooks, functions, or logic apps.

Budgets can trigger alerts, but the actual administrative or orchestration task must be delegated to an Action Group.

Key Concept

Resource locks prevent accidental deletion or modification of Azure resources, and their scope inheritance must be managed carefully. Budget alerts require Action Groups to execute automated runbooks.

Question 475Question →

An administrator is deploying a web application to Azure App Service. The application must meet the following requirements:
- Use a custom DNS domain name.
- Scale manually up to three instances.

You need to recommend the most cost-effective App Service plan pricing tier that meets the requirements.

Which App Service plan pricing tier should you select?

F1 (Free)

D1 (Shared)

B1 (Basic)

S1 (Standard)

Show answer & explanation

Answer: B1 (Basic)

Answer

B1 (Basic)

The B1 (Basic) pricing tier is the most cost-effective tier that supports both custom domains and manual scaling up to three instances. Tiers lower than B1 (such as F1 and D1) do not support scaling, and F1 also lacks custom domain support.

Step-by-Step Solution

Identify the minimum pricing tier that supports custom domain names.

The D1 (Shared) tier is the minimum tier that supports custom domains.

The F1 (Free) tier does not support custom domains, so it is eliminated.

Identify the minimum pricing tier that supports manual scaling to three instances.

The B1 (Basic) tier is the minimum tier that supports dedicated resources and manual scale-out up to three instances.

The D1 (Shared) tier runs on shared infrastructure and does not support scaling out to multiple instances, so it is eliminated.

Compare the remaining tiers (B1 and S1) to find the most cost-effective option.

B1 (Basic) is more cost-effective than S1 (Standard).

Both B1 (Basic) and S1 (Standard) meet the requirements, but B1 (Basic) has a lower monthly cost.

Key Concept

Azure App Service pricing tiers and their capability limits regarding custom domains and scaling.

Estimated Time:45s

Question 476Question →

You are configuring the deployment settings for an Azure virtual machine named VM1 in the East US region. VM1 will host a database server that has the following requirements:
- High-speed storage capability supporting up to $80,000$ IOPS.
- Zero storage costs for the operating system drive, with minimal write latency.
- Resiliency against datacenter-wide failures within the region.

Which two options should you select when creating VM1? (Select two.)

Select all that apply

Deploy VM1 to an Availability Zone.

Enable Ultra Disk compatibility on the virtual machine.

Deploy VM1 to an Availability Set.

Create a subnet named BastionSubnet with a

/28

prefix to host Azure Bastion for administrative access.

Show answer & explanation

Answer: Deploy VM1 to an Availability Zone.; Enable Ultra Disk compatibility on the virtual machine.

Answer

Deploying the virtual machine to an Availability Zone and enabling Ultra Disk compatibility on the virtual machine.

The correct configurations are deploying the virtual machine to an Availability Zone and enabling Ultra Disk compatibility on the virtual machine. Availability Zones provide protection against datacenter-wide failures. Enabling Ultra Disk compatibility is a prerequisite for attaching Ultra Disks, which are required to meet the high IOPS demand.

Step-by-Step Solution

Analyze the storage requirements for VM1.

The database workload requires up to

80,000

IOPS, which exceeds the capabilities of standard storage options and requires the use of Ultra Disk storage.

Ultra Disks are necessary for workloads requiring very high IOPS and low latency.

Determine the availability and placement requirements for Ultra Disk storage.

Ultra Disks require deploying the virtual machine to an Availability Zone and enabling the Ultra Disk compatibility setting on the virtual machine during creation.

These configurations ensure the underlying infrastructure supports Ultra Disk attachments.

Analyze the high availability and resiliency requirements.

Protection against datacenter-wide outages requires deploying VM1 in an Availability Zone, which aligns with the requirement for Ultra Disk support.

Availability Zones provide datacenter-level redundancy, whereas Availability Sets only provide rack-level redundancy within a single datacenter.

Key Concept

Virtual Machine Creation Settings, Ultra Disk Requirements, and High Availability Options

Question 477Question →

A team needs to provision a virtual machine named SalesVM in the North Europe region. The virtual machine must remain accessible even if a power outage or natural disaster affects an entire datacenter facility in that region. Furthermore, the virtual machine requires daily automated backups. Which configuration options should be selected to meet these requirements?

Deploy SalesVM to an Availability Set, and configure backup to a Recovery Services vault located in North Europe.

Deploy SalesVM to an Availability Zone, and configure backup to a Recovery Services vault located in West Europe.

Deploy SalesVM to an Availability Zone, and configure backup to a Recovery Services vault located in North Europe.

Deploy SalesVM using a Basic App Service Plan, and configure backup to a Recovery Services vault located in North Europe.

Show answer & explanation

Answer: Deploy SalesVM to an Availability Zone, and configure backup to a Recovery Services vault located in North Europe.

Answer

Deploy SalesVM to an Availability Zone, and configure backup to a Recovery Services vault located in North Europe.

Deploying the virtual machine to an Availability Zone provides redundancy against a complete datacenter outage by placing the resource in a physically separate zone within the region. The Recovery Services vault must be deployed in the same region (North Europe) as the virtual machine to support Azure Backup.

Step-by-Step Solution

Determine the high availability option required to protect against an entire datacenter outage.

Availability Zones must be selected because they place virtual machines in physically separate datacenters within a region.

Availability Sets only protect against rack or power failures within a single datacenter, whereas Availability Zones protect against datacenter-wide failures.

Determine the region requirements for configuring Azure virtual machine backup.

The Recovery Services vault must be created in the same region as the virtual machine (North Europe).

Cross-region backups of virtual machines to a different vault region are not supported during standard configuration.

Verify that the compute resource type matches the virtual machine requirement.

A standard Virtual Machine deployment must be used rather than an App Service Plan.

App Service Plans do not support standard virtual machine workloads.

Key Concept

Selecting appropriate availability options and matching backup vault regions during virtual machine deployment.

Estimated Time:1m 30s

Question 478Question →

An administrator is configuring a virtual machine named VM-Prod1 in the East US region. The virtual machine hosts a web application that requires two separate public IP addresses. VM-Prod1 has a single network interface named NIC-Prod1. You need to configure NIC-Prod1 to support this requirement. Which of the following actions should you perform? Select two.

Select all that apply

Add a secondary IP configuration to NIC-Prod1.

Associate a public IP address with the secondary IP configuration.

Associate a second public IP address to the primary IP configuration of NIC-Prod1.

Configure the secondary IP configuration to use a Standard SKU public IP address with dynamic allocation.

Show answer & explanation

Answer: Add a secondary IP configuration to NIC-Prod1.; Associate a public IP address with the secondary IP configuration.

Answer

To support multiple public IP addresses, you must add a secondary IP configuration to the network interface, and then associate a public IP address with that secondary IP configuration.

To support multiple public IP addresses on a single network interface, you must configure multiple IP configurations. Each configuration is allocated a private IP address and can optionally be associated with one public IP address.

Step-by-Step Solution

Add a secondary IP configuration to the network interface.

NIC-Prod1 is configured with a secondary IP configuration, which automatically receives a private IP address from the subnet's range.

Azure network interfaces require a unique private IP configuration for each public IP address you want to associate with the interface.

Associate a public IP address with the secondary IP configuration.

The second public IP address is bound to the secondary IP configuration on the network interface.

This allows external traffic targeted at the second public IP address to reach the secondary private IP on VM-Prod1.

Key Concept

Azure network interfaces support multiple IP configurations, with each configuration supporting one private IP address and up to one public IP address.

Question 479Question →

An organization has an Azure subscription containing a virtual network named `VNet-Prod` ( $192.168.0.0/16$ ) with three subnets:

* `Subnet-A`: $192.168.1.0/24$ , delegated to `Microsoft.Web/serverFarms`
* `Subnet-B`: $192.168.2.0/24$ , delegated to `Microsoft.Sql/managedInstances`
* `Subnet-C`: $192.168.3.0/24$ , which has no subnet delegation

An administrator wants to perform the following deployments:
1. Integrate an Azure App Service Web App with `Subnet-A`.
2. Deploy a new Azure Virtual Machine (`VM-Admin`) into `Subnet-A` to manage the Web App.
3. Deploy an Azure Bastion host into `Subnet-C`.

Based on this scenario, is the statement 'The administrator can successfully complete all three deployments using the existing subnets' true or false?

True

False

Show answer & explanation

Answer: False

Answer

The statement is false because standard virtual machines cannot be deployed in a delegated subnet, and Azure Bastion must be deployed in a subnet named exactly `AzureBastionSubnet`.

The correct answer is false. Standard virtual machines cannot be deployed into `Subnet-A` because it is delegated to `Microsoft.Web/serverFarms`, which restricts the subnet's resources to App Service integrations. Additionally, Azure Bastion cannot be deployed into `Subnet-C` because it requires a dedicated subnet named exactly `AzureBastionSubnet`.

Step-by-Step Solution

Evaluate the first deployment: Integrating an Azure App Service Web App with `Subnet-A`.

The integration is successful because `Subnet-A` is delegated to `Microsoft.Web/serverFarms`, which is the correct delegation for App Service regional VNet integration.

Azure App Service VNet integration requires a subnet delegated to `Microsoft.Web/serverFarms`.

Evaluate the second deployment: Deploying a new virtual machine (`VM-Admin`) into `Subnet-A`.

The deployment fails because `Subnet-A` is delegated.

Subnet delegation reserves the subnet exclusively for the delegated service. No other resource types, including standard virtual machines, can be deployed into a delegated subnet.

Evaluate the third deployment: Deploying an Azure Bastion host into `Subnet-C`.

The deployment fails because the subnet name is incorrect.

Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a subnet mask of `/26` or larger. It cannot be deployed into `Subnet-C`.

Key Concept

Subnet delegation constraints and Azure Bastion subnet requirements.

Question 480Question →

You are deploying an Azure Virtual Machine named VM-WebProd. You create a Standard SKU public IP address to associate with the network interface of VM-WebProd. Which two characteristics describe this Standard SKU public IP address? (Select two.)

Select all that apply

It is secure by default and blocks inbound traffic until explicitly permitted by a network security group (NSG).

It supports only the static allocation method.

It supports both static and dynamic allocation methods.

It allows all inbound traffic by default without a network security group (NSG) requirement.

Show answer & explanation

Answer: It is secure by default and blocks inbound traffic until explicitly permitted by a network security group (NSG).; It supports only the static allocation method.

Answer

The Standard SKU public IP address supports only the static allocation method and is secure by default, meaning inbound traffic is blocked until explicitly allowed by a network security group (NSG).

Standard SKU public IP addresses in Azure are secure by default, meaning inbound traffic is blocked unless specifically permitted by a Network Security Group (NSG). Additionally, they only support the static allocation method, ensuring that the IP address does not change throughout the resource's lifecycle.

Step-by-Step Solution

Evaluate the allocation methods supported by the Standard SKU public IP address.

Confirm that the Standard SKU supports static allocation only.

Azure Standard SKU public IP addresses require static allocation to ensure IP address persistence.

Evaluate the default inbound security behavior of the Standard SKU public IP address.

Confirm that the Standard SKU is secure by default and requires an NSG to allow inbound traffic.

Standard SKU public IPs implement a secure-by-default posture to enhance safety.

Key Concept

Standard SKU public IP address features including static allocation and secure-by-default behavior.

PreviousPage 24 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept