Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 481Question →

An administrator is planning the deployment of a new Azure virtual network named `VNet-Prod` in an Azure subscription. The address space for `VNet-Prod` is configured as 10.200.0.0/2210.200.0.0/22. The virtual network must support the following requirements:
- A subnet named `Subnet-App` that provides a minimum of 12 usable IP addresses for application servers.
- A subnet for secure administrative access to virtual machines using Azure Bastion.
- A subnet for a virtual network gateway to support a hybrid VPN connection.

The administrator wants to minimize address space allocation for each subnet.

Which three of the following subnet allocations should the administrator configure?

Select all that apply

Show answer & explanation

Answer: A subnet named `Subnet-App` with an address range of 10.200.0.0/2710.200.0.0/27; A subnet named `AzureBastionSubnet` with an address range of 10.200.0.32/2610.200.0.32/26; A subnet named `GatewaySubnet` with an address range of 10.200.0.96/2910.200.0.96/29

Answer

The correct subnet allocations are: the application subnet configured with a prefix of /27, the Azure Bastion subnet configured with a prefix of /26, and the GatewaySubnet configured with a prefix of /29.
The subnet named `Subnet-App` configured as 10.200.0.0/2710.200.0.0/27 is correct because a /28 subnet provides only 11 usable IP addresses after accounting for the 5 IP addresses reserved by Azure (16−5=1116 - 5 = 11), which is insufficient for the 12 hosts required. The subnet named `AzureBastionSubnet` configured as 10.200.0.32/2610.200.0.32/26 is correct because Azure Bastion has a strict requirement of a dedicated subnet named exactly `AzureBastionSubnet` with a minimum subnet prefix length of /26. The subnet named `GatewaySubnet` configured as 10.200.0.96/2910.200.0.96/29 is correct because a virtual network gateway requires a dedicated subnet named exactly `GatewaySubnet` with a minimum prefix length of /29.

Step-by-Step Solution

1
Determine the minimum size for the application subnet by accounting for Azure's reserved IP addresses.
The application subnet requires 12 usable host IP addresses. A /28 subnet provides 16 total IP addresses, but subtracting Azure's 5 reserved IP addresses leaves only 11 usable IPs (16−5=1116 - 5 = 11). A /27 subnet provides 32 total IP addresses, leaving 27 usable host IPs (32−5=2732 - 5 = 27), which satisfies the requirement.
Azure reserves the first four and the last IP address in each subnet for system usage.
2
Determine the minimum size and configuration requirements for the Azure Bastion subnet.
Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a minimum prefix length of /26.
A subnet smaller than /26 (such as /27) is not supported for Azure Bastion deployments.
3
Determine the minimum size and configuration requirements for the VPN Gateway subnet.
The virtual network gateway requires a dedicated subnet named exactly `GatewaySubnet` with a minimum prefix length of /29.
A subnet smaller than /29 (such as /30) is not supported for GatewaySubnet configurations.

Key Concept

Subnet sizing and service-specific naming and prefix constraints in Azure Virtual Networks, including Azure's 5 reserved IP addresses, `AzureBastionSubnet` sizing requirements, and `GatewaySubnet` sizing requirements.
Question 482Question →

A virtual machine named VM-Web01 is deployed in an Azure virtual network. The network interface (NIC) of VM-Web01 is currently configured with a private IP address that uses dynamic allocation. You need to ensure that VM-Web01 maintains its current private IP address even if the virtual machine is stopped and deallocated for maintenance. What should you do?

Show answer & explanation

Answer: Change the private IP address allocation method to Static.

Answer

Change the private IP address allocation method to Static.
The correct action is to change the private IP address allocation method to Static. In Azure, a dynamic private IP address is released when the virtual machine is stopped (deallocated). By changing the allocation method of the primary IP configuration on the network interface to Static, the current IP address is reserved and will not be released or changed during deallocation.

Step-by-Step Solution

1
Navigate to the network interface (NIC) associated with the virtual machine VM-Web01 in the Azure Portal.
The network interface resource blade is displayed.
IP configuration settings are managed directly on the network interface resource.
2
Under Settings, select IP configurations, and then select the primary IP configuration.
The configuration page for the primary IP configuration opens.
This allows access to the allocation method settings for the specific private IP address.
3
Change the private IP address assignment allocation method from Dynamic to Static, keep the current IP address, and save the changes.
The private IP address is now statically assigned.
Static allocation reserves the IP address for the NIC, preventing it from being released even when the virtual machine is stopped and deallocated.

Key Concept

Private IP Address Allocation Methods
Estimated Time:1m 0s
Question 483Question →

An administrator is planning a new virtual network named `VNet-Prod` with an address space of 10.10.0.0/1610.10.0.0/16. The virtual network must support the following requirements:
- A subnet for Azure Bastion named `AzureBastionSubnet`.
- A subnet for a VPN Gateway named `GatewaySubnet`.
- An application subnet named `Subnet-App` that will host 60 virtual machines.

Which of the following subnet allocations satisfies these requirements while minimizing IP address waste?

Show answer & explanation

Answer: AzureBastionSubnet: 10.10.1.0/2610.10.1.0/26; GatewaySubnet: 10.10.2.0/2710.10.2.0/27; Subnet-App: 10.10.3.0/2510.10.3.0/25

Answer

AzureBastionSubnet: 10.10.1.0/2610.10.1.0/26; GatewaySubnet: 10.10.2.0/2710.10.2.0/27; Subnet-App: 10.10.3.0/2510.10.3.0/25
The correct configuration allocates a /26 subnet for Azure Bastion, a /27 subnet for the VPN Gateway, and a /25 subnet for Subnet-App. A /26 prefix is the minimum required size for Azure Bastion. For Subnet-App, hosting 60 virtual machines requires at least 65 IP addresses because Azure reserves 5 IP addresses per subnet (the first four and the last one). A /26 subnet provides 64 total addresses, leaving only 59 usable, which is insufficient. A /25 subnet provides 128 total addresses (123 usable), which meets the requirement of 60 VMs while minimizing waste.

Step-by-Step Solution

1
Determine the minimum prefix size for Azure Bastion.
Azure Bastion requires a subnet named AzureBastionSubnet with a prefix of at least /26.
To ensure successful deployment and scaling of Azure Bastion host resources.
2
Calculate the required subnet size for Subnet-App.
Subnet-App needs to support 60 VMs. Since Azure reserves 5 IP addresses in each subnet, the subnet needs a capacity of at least 65 IP addresses. A /26 subnet provides 64 addresses (59 usable), which is too small. A /25 subnet provides 128 addresses (123 usable), which is the smallest standard prefix that satisfies the requirement.
Azure reserves the first four IP addresses and the last IP address in each subnet for its internal services.
3
Verify correct routing and name resolution configurations.
GatewaySubnet is correctly configured (recommended size is /27 or /28). Route tables for virtual appliances must use Virtual Appliance as the next hop, and Private DNS Zones must be linked at the VNet level rather than the subnet level.
Azure architecture enforces VNet-level scope for private DNS integration and distinct next hop types for virtual appliances vs VPN/ExpressRoute gateways.

Key Concept

Subnet sizing constraints and Azure-specific reserved IP address requirements.
Question 484Question →

You need to configure an Azure App Service web app named app1 to run a container image hosted in a private Azure Container Registry (ACR) named acr1. The web app must authenticate to the registry using its own system-assigned managed identity. Which sequence of actions should you perform? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, enable the system-assigned managed identity on the App Service web app. Second, assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry. Third, configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity. Finally, restart the App Service web app to trigger the pull of the container image.
To secure communications between Azure App Service and Azure Container Registry without hardcoded credentials, you must first enable the system-assigned managed identity on the web app. This creates a service principal. Next, you authorize this service principal by granting it the AcrPull role on the registry. Then, you configure the container deployment settings on the web app to utilize the registry and authentication via the managed identity. Finally, you restart the web app to apply the configuration and initiate the pull.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the App Service web app.
A service principal representing the web app is created in Microsoft Entra ID.
The security identity must exist in Microsoft Entra ID before it can be granted access to other Azure resources.
2
Assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry.
The identity is authorized to pull container images from the registry.
App Service requires permissions to read and download container images from the private registry.
3
Configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity.
The deployment settings of the web app are updated with the image destination and authentication mechanism.
This links the web app's deployment configuration to the container image and specifies authentication via the managed identity.
4
Restart the App Service web app to trigger the pull of the container image.
The web app pulls the image and runs the container.
Restarting the app applies the deployment configuration changes and starts the container hosting process.

Key Concept

Configuring container settings and system-assigned managed identities for Azure App Service to authenticate against Azure Container Registry.
Question 485Question →

An administrator is configuring a virtual machine named VM-Prod1 in the West US 2 region. VM-Prod1 has a single network interface named nic-prod1. The primary IP configuration on nic-prod1 (ipconfig-primary) uses the static private IP address 10.0.0.410.0.0.4 and is associated with a Standard SKU public IP address named pip-primary. The administrator needs to configure a secondary IP configuration named ipconfig-secondary on nic-prod1. The secondary configuration must be accessible from the internet. The administrator plans to deploy a new public IP address named pip-secondary for this purpose. Which configuration must the administrator use for pip-secondary and the private IP address of ipconfig-secondary?

Show answer & explanation

Answer: pip-secondary must use the Standard SKU and Static allocation. The private IP address of ipconfig-secondary can use either Dynamic or Static allocation.

Answer

pip-secondary must use the Standard SKU and Static allocation. The private IP address of ipconfig-secondary can use either Dynamic or Static allocation.
The correct option correctly identifies that pip-secondary must use the Standard SKU to match the existing Standard SKU public IP on the virtual machine, and it must use Static allocation because Standard SKU public IPs do not support Dynamic allocation. Additionally, it correctly states that the private IP address for a secondary IP configuration can use either Dynamic or Static allocation.

Step-by-Step Solution

1
Determine the required SKU for the new public IP address (pip-secondary).
Standard SKU is required.
Azure does not support mixing Basic and Standard SKU public IP addresses on the same virtual machine instance. Since the primary IP configuration already uses a Standard SKU public IP (pip-primary), any additional public IP addresses associated with VM-Prod1 must also use the Standard SKU.
2
Determine the allocation method for the Standard SKU public IP address.
Static allocation is required.
In Azure, Standard SKU public IP addresses only support Static allocation. Dynamic allocation is not supported for Standard SKU public IPs.
3
Determine the private IP address allocation rules for the secondary IP configuration.
Either Dynamic or Static allocation is supported.
Azure virtual network interfaces support both Dynamic and Static private IP allocation methods for both primary and secondary IP configurations.

Key Concept

Azure Public IP SKU compatibility rules and private IP allocation capabilities on multi-IP network interfaces.
Estimated Time:2m 0s
Question 486Question →

Your company has an Azure Storage account named `corpdata2026` that contains a blob container named `financial-reports`. A third-party auditing application needs to retrieve reports from this container. You must grant the application temporary access while adhering to the principle of least privilege. The solution must meet the following requirements:
- The application must only have read access to the `financial-reports` container.
- The access must be time-limited and expire in 4 hours.
- The access must be restricted to the auditing application's public IP address of `198.51.100.45`.
- The access must be authorized using Microsoft Entra ID credentials of the administrator, without exposing or using the storage account access keys.

Which of the following should you generate to meet these requirements?

Show answer & explanation

Answer: A User Delegation SAS with Read permissions on the container, configured with the allowed IP address of `198.51.100.45` and an expiration time of 4 hours.

Answer

A User Delegation SAS with Read permissions on the container, configured with the allowed IP address of `198.51.100.45` and an expiration time of 4 hours.
The correct answer is a User Delegation SAS with Read permissions, restricted to the client's public IP address, and set to expire in 4 hours. This is because a User Delegation SAS is secured using Microsoft Entra ID credentials to request a user delegation key, satisfying the requirement to avoid using storage account access keys. The other parameters correctly implement the read permission, time-limit, and IP restrictions.

Step-by-Step Solution

1
Identify the authentication mechanism requirement.
Since the solution must use Microsoft Entra ID credentials and avoid using the storage account access keys, a User Delegation SAS must be used instead of a Service SAS or Account SAS.
A User Delegation SAS is signed with a user delegation key acquired using Microsoft Entra ID credentials, protecting the storage account keys from exposure.
2
Evaluate the scope, duration, and network constraints.
The SAS must be configured with Read permission on the container, a lifetime of 4 hours, and restricted to the client IP address of `198.51.100.45`.
These constraints satisfy the least-privilege access, time-limit, and IP restrictions specified in the scenario.

Key Concept

User Delegation SAS vs Service/Account SAS and RBAC configuration
Question 487Question →

Your company has a Microsoft Entra ID tenant. You configure Self-Service Password Reset (SSPR) with the following settings:
- Enabled: Selected (Group: Sales-Group)
- Number of methods required to reset: 2
- Methods available to users: Email, Mobile app notification, Mobile phone

Sales-Group has the following members:
- User1 (direct member)
- User2 (direct member)
- GroupB (nested member; GroupB contains User3)

The users have registered the following authentication contact info:
- User1: Email only
- User2: Mobile phone and Email
- User3: Mobile phone, Email, and Mobile app notification

In the External Collaboration settings, "Guest invite restrictions" is configured to "Only users assigned to specific admin roles can invite guest users".

Which of the following statements are correct? (Select two.)

Select all that apply

Show answer & explanation

Answer: User2 can successfully reset their password using self-service password reset.; User3 cannot use self-service password reset because Microsoft Entra ID does not support nested group membership for SSPR scoping.

Answer

User2 can successfully reset their password, and User3 cannot use SSPR because Microsoft Entra ID does not support nested group membership for SSPR scoping.
The correct options are that User2 can reset their password because they are a direct member of the scoped group and have registered the required number of authentication methods, and User3 cannot reset their password because Microsoft Entra ID does not support nested group membership for SSPR scoping.

Step-by-Step Solution

1
Determine SSPR scoping eligibility for each user.
User1 and User2 are direct members of Sales-Group, so SSPR is enabled for them. User3 is a member of GroupB, which is nested inside Sales-Group. SSPR group scoping does not support nested groups, so SSPR is not enabled for User3.
SSPR scoping via the 'Selected' option only applies to direct members of the chosen group.
2
Verify if the eligible users meet the SSPR authentication methods requirement.
The SSPR policy requires two methods. User1 has only registered one method (Email) and cannot reset their password. User2 has registered two methods (Mobile phone and Email) and can reset their password.
Users must register at least the minimum number of authentication methods required by the active SSPR policy.
3
Analyze B2B external invitation restrictions against RBAC permissions.
Since guest invite restrictions are set to 'Only users assigned to specific admin roles can invite guest users', standard member users (even those with Azure Subscription Owner RBAC roles) cannot invite guests.
Azure RBAC roles do not grant administrative permissions within Microsoft Entra ID unless directory roles are explicitly assigned.

Key Concept

Microsoft Entra ID SSPR scoping limitations, authentication method requirements, and B2B invitation delegation boundaries.
Question 488Question →

You are designing autoscale rules for an Azure Virtual Machine Scale Set (VMSS) named `vmss-processing`. The scale set currently runs with a minimum of 2 instances and a maximum of 10 instances. The scale-out rule is configured to increase the instance count by 1 when the average CPU utilization exceeds 75% for 10 minutes.

You need to configure the scale-in rule to decrease the instance count by 1. To prevent instance thrashing (repeatedly scaling out and scaling in) immediately after a scale-out event occurs when the scale set has 2 instances, which CPU threshold should you configure for the scale-in rule?

Show answer & explanation

Answer: Decrease the instance count by 1 when the CPU utilization is less than 40%

Answer

Decrease the instance count by 1 when the CPU utilization is less than 40%
The correct option is the one stating to decrease the instance count when CPU utilization is less than 40%. When the scale set runs on 2 instances, a scale-out is triggered as CPU load exceeds 75%, meaning the total load is 150%. Once a third instance is added, the load is divided by 3, resulting in approximately 50% CPU load per instance. Setting the scale-in threshold to 40% ensures that the load must drop significantly further before scaling in, preventing thrashing.

Step-by-Step Solution

1
Calculate the total CPU load of the scale set when it is running at minimum capacity (2 instances) just before a scale-out event is triggered.
Total CPU load is approximately 2×75%=150%2 \times 75\% = 150\%.
Determining total CPU load allows us to calculate how that load will be distributed among the instances after scaling out.
2
Calculate the expected CPU utilization per instance immediately after the third instance is added, assuming the workload remains constant at 150%.
New CPU utilization per instance is 150%3=50%\frac{150\%}{3} = 50\%.
This determines the new metric value that the scale-in rule will evaluate once the scale-out action completes.
3
Select a scale-in threshold that is lower than the new CPU utilization to prevent the scale-in rule from triggering immediately.
The threshold must be strictly less than 50% (e.g., 40%).
If the scale-in threshold is set to 50% or higher, the post-scale-out CPU load of 50% will immediately satisfy the scale-in condition, resulting in instance thrashing.

Key Concept

Autoscale rule thrashing and metric thresholds
Estimated Time:1m 30s
Question 489Question →

An administrator is upgrading a legacy Azure virtual machine named VM1 to comply with modern Azure security and SKU support standards. VM1 is configured with a single network interface named nic1. The primary IP configuration of nic1 (ipconfig1) is associated with a legacy Basic SKU public IP address (PubIP1) that uses Dynamic allocation.

The administrator needs to assign a second public IP address to VM1 to support a new secure web service. They create a new Standard SKU public IP address named PubIP2. However, when attempting to associate PubIP2 with a new secondary IP configuration (ipconfig2) on nic1, the association fails with a SKU mismatch error.

Which configuration change should the administrator perform to resolve this error and successfully associate both public IP addresses with VM1?

Show answer & explanation

Answer: Change the allocation method of PubIP1 to Static, upgrade PubIP1 to the Standard SKU, and then associate PubIP2 with ipconfig2.

Answer

Change the allocation method of PubIP1 to Static, upgrade PubIP1 to the Standard SKU, and then associate PubIP2 with ipconfig2.
To resolve the SKU mismatch, all public IP addresses associated with a single virtual machine (regardless of whether they are on the same network interface or different network interfaces) must use the same SKU. Since the new public IP (PubIP2) is a Standard SKU, the legacy public IP (PubIP1) must be upgraded to the Standard SKU. To upgrade a Basic SKU public IP to Standard SKU, its allocation method must first be changed from Dynamic to Static. Once both public IPs are of the Standard SKU, they can be successfully associated with VM1.

Step-by-Step Solution

1
Change the allocation method of the legacy Basic SKU public IP (PubIP1) from Dynamic to Static.
PubIP1 is now configured with Static allocation, which is a prerequisite for upgrading to the Standard SKU.
Standard SKU public IP addresses only support Static allocation; you cannot upgrade a Dynamic Basic SKU IP directly.
2
Upgrade PubIP1 from the Basic SKU to the Standard SKU.
PubIP1 becomes a Standard SKU public IP address.
All public IP addresses associated with a single virtual machine instance must share the same SKU. Since the second IP (PubIP2) is Standard, PubIP1 must also be Standard.
3
Associate the new Standard SKU public IP (PubIP2) with the secondary IP configuration (ipconfig2) on nic1.
Both PubIP1 and PubIP2 are successfully associated with VM1 without causing a SKU mismatch error.
Both public IP addresses now use the Standard SKU, complying with Azure's SKU alignment constraints for virtual machines.

Key Concept

SKU alignment and upgrade requirements for Public IP addresses associated with a single Virtual Machine
Question 490Question →

An administrator configures a subnet in Microsoft Azure with the address block 172.16.5.0/29172.16.5.0/29. Is it true or false that this subnet has exactly 3 usable IP addresses available for virtual machines?

Show answer & explanation

Answer: True

Answer

The statement is true because a /29/29 subnet has 88 total IP addresses, and Azure reserves 55 of them, leaving 33 usable IP addresses.
The statement is correct because a /29/29 subnet provides 88 total IP addresses. Since Azure reserves 55 IP addresses per subnet, the number of usable IP addresses is 8−5=38 - 5 = 3.

Step-by-Step Solution

1
Calculate the total number of IP addresses in a /29/29 subnet.
A /29/29 subnet has 232−29=23=82^{32-29} = 2^3 = 8 total IP addresses.
To determine usable IP addresses, first find the total address space size.
2
Subtract the Azure-reserved IP addresses.
8−5=38 - 5 = 3 usable IP addresses.
Azure reserves the first four IP addresses and the last IP address of every subnet for internal services, totaling 55 reserved IPs.

Key Concept

Azure Subnet IP Address Reservation
Question 491Question →

You are deploying different containerized workloads to Azure Container Instances (ACI). Match each workload execution requirement to the most appropriate container restart policy.

Click a left item, then click its matching right item

Items

A continuous web server that must remain running and restart automatically if it crashes or stops.
A data migration task that runs to completion once, but must retry if the process terminates with an error.
A one-time setup script that should execute only once and must never be restarted under any circumstance.

Matches

Show answer & explanation

Answer

Continuous web server matches with Always restart policy; data migration task matches with OnFailure restart policy; one-time setup script matches with Never restart policy.
The correct matches align the execution patterns with their corresponding ACI restart policies. A continuous web server aligns with Always to maintain availability. A batch processing migration that should retry only on error aligns with OnFailure. A script that must run once and never rerun under any condition aligns with Never.

Step-by-Step Solution

1
Determine the restart requirement for the continuous web server.
Since the server must stay online indefinitely and restart if it stops for any reason, the Always restart policy is required.
The Always policy ensures container groups are restarted upon exit regardless of the exit code.
2
Determine the restart requirement for the data migration task.
Since the task runs once but must be retried only if it fails, the OnFailure restart policy is required.
The OnFailure policy restarts containers only if they exit with a non-zero code, indicating a failure.
3
Determine the restart requirement for the one-time setup script.
Since the script must not run again even if it exits with an error or succeeds, the Never restart policy is required.
The Never policy ensures the container group is never restarted after execution stops.

Key Concept

Azure Container Instances supports restart policies (Always, Never, and OnFailure) that determine whether containers restart when their execution terminates.
Question 492Question →

An administrator needs to configure a custom domain named shop.contoso.com for an Azure App Service web app named app-shop-prod. The web app currently runs on a Basic B1 App Service plan. The administrator plans to secure the custom domain by using a free Azure App Service Managed Certificate.

You need to identify the correct sequence of actions to achieve this goal. Which sequence of actions should the administrator perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Scale up the App Service plan of app-shop-prod to the Standard S1 tier, create the CNAME record in the DNS zone, add the custom domain to the web app, create the App Service Managed Certificate, and then add the TLS/SSL binding using the certificate.
To secure a custom domain using a free Azure App Service Managed Certificate, the web app must run on a Standard or higher plan. Therefore, scaling up the App Service plan to Standard S1 is the first requirement. Next, the DNS CNAME record must be created in the DNS zone to point to the default App Service URL. This allows Azure to verify ownership when adding the custom domain in the portal. Once the custom domain is successfully added and validated, the App Service Managed Certificate can be generated for it. Finally, you create the TLS/SSL binding to secure the custom domain with the certificate.

Step-by-Step Solution

1
Scale up the App Service plan from Basic B1 to Standard S1.
The App Service plan is upgraded to a tier that supports custom SSL certificates and managed certificates.
App Service Managed Certificates are not supported in the Basic tier.
2
Create a CNAME record pointing shop to app-shop-prod.azurewebsites.net.
DNS resolution is configured, allowing Azure to perform verification.
Azure verifies domain ownership during custom domain configuration by querying the public DNS records.
3
Add the custom domain shop.contoso.com to the web app in the Azure portal.
The custom domain is associated with the App Service web app.
A custom domain must be associated with the app before an App Service Managed Certificate can be generated for it.
4
Generate an App Service Managed Certificate for the custom domain.
A free SSL/TLS certificate is created and managed by Azure.
The certificate is issued specifically for the custom domain that is already mapped to the app.
5
Create an SNI SSL binding linking the custom domain to the managed certificate.
HTTPS is enabled for the custom domain.
This is the final step to secure traffic to the custom domain using the issued certificate.

Key Concept

Configuring custom domains and securing them with App Service Managed Certificates requires a minimum plan tier (Standard) and a specific sequence of verification, registration, certificate creation, and binding.
Question 493Question →

You are designing a deployment plan for multiple containerized workloads in Azure Container Instances (ACI). Match each workload's execution requirements to the appropriate ACI restart policy to ensure correct container lifecycle behavior.

Click a left item, then click its matching right item

Items

An API gateway container that must run continuously to process incoming HTTP requests and restart automatically if it crashes.
A scheduled data import container that runs a single batch task to completion and must restart automatically only if the task exits with an error code.
A one-time database migration container that executes a script to copy data and must not run again under any circumstances, even if it fails.

Matches

Show answer & explanation

Answer

The API gateway container matches the 'Always' restart policy; the scheduled data import container matches the 'OnFailure' restart policy; and the database migration container matches the 'Never' restart policy.
The correct pairings match the workload characteristics to the standard ACI restart policies: continuous services (API gateway) map to 'Always'; tasks that run once but need a retry on errors (scheduled data import) map to 'OnFailure'; and strict single-execution tasks (database migration) map to 'Never'.

Step-by-Step Solution

1
Analyze the API gateway container requirements.
The API gateway must run continuously and recover from crashes, meaning its lifecycle is long-running and persistent.
Azure Container Instances supports the 'Always' restart policy for containers that need to be kept running indefinitely.
2
Analyze the scheduled data import container requirements.
The import container runs a single task to completion but must retry if it fails (exits with a non-zero code).
The 'OnFailure' restart policy ensures that ACI restarts the container only when the process exits with a failure status code, preventing restarts on successful completion.
3
Analyze the database migration container requirements.
The migration script must execute exactly once and never retry, regardless of whether it succeeds or fails.
The 'Never' restart policy prevents ACI from restarting the container group under any conditions, ensuring single-execution semantics.

Key Concept

Azure Container Instances restart policies determine the lifecycle management and automatic recovery behavior of a container group based on its workload type.
Question 494Question →

An administrator is configuring public and private IP addresses for an Azure Virtual Machine (VM) network interface (NIC). Which of the following configurations are valid? (Select two.)

Select all that apply

Show answer & explanation

Answer: Add multiple IP configurations to the NIC, with each configuration assigned a unique private IP address; Associate a Standard SKU public IP address using Static allocation to an IP configuration on the NIC

Answer

Adding multiple IP configurations to the NIC (each assigned a unique private IP address) and associating a Standard SKU public IP address using Static allocation are valid configurations.
Azure network interfaces allow multiple IP configurations, where each configuration holds exactly one private IP address. Additionally, you can associate a public IP address with any IP configuration on a NIC, but if a Standard SKU public IP address is used, it must be configured with Static allocation.

Step-by-Step Solution

1
Analyze the capacity of a single IP configuration on a NIC.
An individual IP configuration on a NIC can map to exactly one private IP address.
To support multiple private IP addresses on a single NIC, multiple distinct IP configurations must be created.
2
Analyze the SKU and allocation method requirements for Standard SKU Public IP addresses.
Standard SKU Public IPs require Static allocation.
Dynamic allocation is unsupported for Standard SKU public IP addresses in Azure.

Key Concept

Azure VM NICs support multiple IP configurations, each containing one private IP. Standard SKU public IP addresses only support Static allocation.
Question 495Question →

You are planning the deployment of several Azure virtual machines. Match each VM deployment requirement to the appropriate Azure configuration feature. To answer, drag the appropriate feature from the column on the right to the requirement on the left. (Each feature may be used once, more than once, or not at all.)

Click a left item, then click its matching right item

Items

Run a configuration script inside a virtual machine immediately after deployment without manual login.
Troubleshoot startup and boot failures by inspecting OS serial log output and VM screenshots.
Run virtual machines on physical servers that are dedicated to a single Azure subscription to meet strict compliance requirements.
Cryptographically secure the virtual machine's OS and data disks using keys stored in Azure Key Vault.

Matches

Show answer & explanation

Answer

Match the requirements to the features as follows: Run script -> Custom Script Extension; Troubleshoot boot -> Boot Diagnostics; Dedicated physical servers -> Azure Dedicated Host; Encrypt disks -> Azure Disk Encryption.
The correct matches align with standard Azure VM feature capabilities. The Custom Script Extension is ideal for post-deployment scripts. Boot Diagnostics provides serial log and screenshot capabilities. Azure Dedicated Host ensures physical machine isolation for compliance. Azure Disk Encryption provides cryptographic disk protection using Key Vault.

Step-by-Step Solution

1
Analyze the requirement for automated post-provisioning scripting.
Identify that the Custom Script Extension executes scripts directly inside the guest OS during provisioning.
To automate VM configuration without requiring manual administrator login.
2
Analyze the requirement for troubleshooting boot failures using screenshots and logs.
Identify that Boot Diagnostics captures the VM's serial output and console screenshots.
To debug operating system startup issues when the VM is inaccessible via network protocols.
3
Analyze the compliance requirement for physical hardware isolation.
Identify that Azure Dedicated Host provides dedicated physical infrastructure at the host level.
To ensure host-level isolation from other customer workloads.
4
Analyze the disk encryption requirement with customer-managed keys.
Identify that Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) integration with Azure Key Vault.
To encrypt VM disks at the operating system level.

Key Concept

Selecting and configuring appropriate Azure Virtual Machine features and extensions based on deployment requirements.
Question 496Question →

A company plans to deploy a new web application to Azure App Service. The hosting environment must meet the following configuration requirements:
- Secure traffic using a custom domain name and a custom SSL certificate.
- Support a staging slot to test application updates before swapping them into production.

Which two App Service plan pricing tiers support these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: S1; P1v3

Answer

The Standard (S1) and Premium (P1v3) tiers are correct because both tiers support custom domains, custom SSL certificates, and deployment staging slots.
The Standard (S1) and Premium (P1v3) tiers support custom domains, custom SSL certificates, and deployment slots.

Step-by-Step Solution

1
Identify the tier requirements for staging and deployment slots.
Only Standard, Premium, and Isolated tiers support deployment slots.
Free, Shared, and Basic tiers do not support deployment slots.
2
Identify the tier requirements for custom domains and custom SSL certificates.
Basic, Standard, Premium, and Isolated tiers support custom domains and SSL certificates.
The Free tier does not support custom domains or SSL, and the Shared tier does not support custom SSL certificates.
3
Select the tiers that meet both requirements from the options provided.
The S1 and P1v3 tiers are selected as they meet all constraints.
Both Standard (S1) and Premium (P1v3) support custom SSL and deployment slots, whereas Basic (B1) and Shared (D1) lack support for deployment slots.

Key Concept

Understanding features supported by Azure App Service Plan tiers, particularly deployment slots and SSL capability.
Question 497Question →

An organization deploys a virtual machine named Mgmt-VM1 in the North Europe region. The virtual machine has a single network interface (NIC). You need to configure the IP address settings for Mgmt-VM1 to meet the following requirements:

1. The private IP address assigned to the NIC must not change when Mgmt-VM1 is stopped (deallocated).
2. Mgmt-VM1 must be accessible from the internet using a Public IP address resource that is secure by default (closed to inbound traffic unless explicitly permitted).
3. The Public IP address must be deployed in the North Europe region.

Which configuration should you apply to the network interface and the Public IP address?

Show answer & explanation

Answer: Configure the private IP address allocation as Static. Associate a Standard SKU public IP address with the NIC, and configure the public IP address allocation as Static.

Answer

Configure the private IP address allocation as Static. Associate a Standard SKU public IP address with the NIC, and configure the public IP address allocation as Static.
To ensure the private IP address does not change when the VM is stopped (deallocated), the private IP address allocation must be set to Static. To satisfy the secure-by-default requirement, a Standard SKU public IP address must be used, as it is closed by default to inbound traffic. Because Standard SKU public IP addresses only support Static allocation, the allocation method for the public IP address must also be set to Static.

Step-by-Step Solution

1
Evaluate private IP address requirements.
Determine that a Static private IP allocation must be used to ensure the address remains assigned to the NIC even when the virtual machine is stopped (deallocated).
Dynamic private IP addresses can be released and change when a virtual machine is stopped (deallocated) and restarted.
2
Evaluate public IP address security requirements.
Determine that a Standard SKU public IP address is required because it is secure by default (closed to inbound traffic unless explicitly allowed by a Network Security Group).
Basic SKU public IP addresses are open by default and do not offer secure-by-default behavior.
3
Determine the allocation method for the Standard SKU public IP address.
Configure the allocation method as Static.
Azure Standard SKU public IP addresses do not support Dynamic allocation; they only support Static allocation.

Key Concept

Azure Public and Private IP allocation methods and SKU characteristics
Estimated Time:1m 30s
Question 498Question →

Your company has an on-premises file server named Server1 that contains a 1000 GB1000\text{ GB} volume D:. You deploy Azure File Sync and configure a sync group containing an Azure file share cloud endpoint and a server endpoint targeting the `D:\Data` folder.

You need to configure the cloud tiering settings to meet the following requirements:
- Maintain a minimum of 200 GB200\text{ GB} of free space on volume D:.
- Cache files locally if they have been accessed within the last 14 days14\text{ days}, unless the volume free space constraint requires additional tiering.

Which configuration should you specify, and which policy will take precedence?

Show answer & explanation

Answer: Volume Free Space policy set to 20%20\% and Date policy set to 14 days14\text{ days}; the Volume Free Space policy takes precedence.

Answer

Volume Free Space policy set to 20%20\% and Date policy set to 14 days14\text{ days}; the Volume Free Space policy takes precedence.
To maintain 200 GB200\text{ GB} of free space on a 1000 GB1000\text{ GB} volume, you must set the Volume Free Space policy to 20%20\%. Setting the Date policy to 14 days14\text{ days} ensures that files not accessed within this window are tiered first. In the event of a conflict, the Volume Free Space policy takes precedence to protect the local volume from running out of space.

Step-by-Step Solution

1
Calculate the percentage required for the Volume Free Space policy.
The required free space is 200 GB200\text{ GB} out of a total volume capacity of 1000 GB1000\text{ GB}, which is 20%20\% (200 GB/1000 GB=20%200\text{ GB} / 1000\text{ GB} = 20\%).
The Volume Free Space policy specifies the percentage of capacity that must remain free on the local volume.
2
Identify the Date policy configuration.
The Date policy is set to 14 days14\text{ days}.
This guarantees that files accessed within the last 14 days14\text{ days} remain locally cached under normal circumstances.
3
Determine the precedence rules between the two policies.
The Volume Free Space policy takes precedence.
Under Azure File Sync rules, if both policies are enabled, the Volume Free Space policy always overrides the Date policy to prevent the local disk from running out of space.

Key Concept

Azure File Sync cloud tiering policies and their precedence rules
Estimated Time:1m 30s
Question 499Question →

A startup is deploying a landing page to Azure App Service. The web application hosting environment must meet the following requirements:
- Support mapping a custom DNS domain.
- Run on dedicated virtual machine instances to ensure isolated compute resources.

Which of the following is the most cost-effective App Service plan pricing tier that meets these requirements?

Show answer & explanation

Answer: Basic (B1)

Answer

Basic (B1)
The Basic (B1) tier is the entry-level dedicated tier in Azure App Service. It meets the requirement for dedicated virtual machine instances while also supporting custom DNS domain mapping, making it the most cost-effective choice for this scenario.

Step-by-Step Solution

1
Evaluate the custom DNS domain requirement against available tiers.
The Free (F1) tier is eliminated because it does not support custom DNS domains. The Shared (D1), Basic (B1), and Standard (S1) tiers support custom DNS domains.
Custom domains require a paid tier (Shared or higher) in Azure App Service.
2
Evaluate the dedicated virtual machine requirement against the remaining tiers.
The Shared (D1) tier is eliminated because it runs on shared infrastructure.
Dedicated compute resources (isolated CPU and memory) are only introduced at the Basic tier and above.
3
Identify the most cost-effective option between the remaining tiers.
Basic (B1) is chosen because it is cheaper than Standard (S1).
Basic (B1) is the entry-level dedicated tier and costs less than Standard (S1), which offers advanced features like staging slots and autoscaling that were not requested.

Key Concept

Azure App Service Plan Tiers and Capabilities
Estimated Time:45s
Question 500Question →

You have an Azure Storage account named `devstore2026` that contains a blob container named `project-templates`.

An administrator named Admin1 must generate a User Delegation Shared Access Signature (SAS) token for an external developer. The developer requires read-only access to read and list blobs in the container. The SAS token must be valid for 12 hours.

You need to assign the minimum required Azure Role-Based Access Control (RBAC) roles to Admin1 to enable them to generate the User Delegation SAS token.

Which two roles should you assign to Admin1? (Select two.)

Select all that apply

Show answer & explanation

Answer: Storage Blob Delegator; Storage Blob Data Reader

Answer

To generate a User Delegation SAS, Admin1 needs the Storage Blob Delegator role to obtain the user delegation key, and the Storage Blob Data Reader role to read and list the blob data.
To create a User Delegation SAS, the identity generating the SAS must first request a user delegation key from Microsoft Entra ID. The Storage Blob Delegator role grants the action required to generate this key. Additionally, because the SAS permissions are verified against the generator's Entra ID account, the generator must also have the data plane access they are delegation-granting. Thus, the Storage Blob Data Reader role is required to grant read and list access to the blobs.

Step-by-Step Solution

1
Identify the key-signing requirements for a User Delegation SAS.
A User Delegation SAS requires obtaining a user delegation key from Microsoft Entra ID.
The creator must have the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission, which is provided by the Storage Blob Delegator role.
2
Determine the data plane permissions required for reading and listing blobs in the container.
The creator needs the Storage Blob Data Reader role at a minimum.
Since the User Delegation SAS is evaluated against the creator's Entra ID identity at runtime, the creator must possess at least the permissions granted by the SAS token.

Key Concept

Generating a User Delegation SAS requires both the Storage Blob Delegator role (for control plane delegation) and appropriate data plane roles (like Storage Blob Data Reader) since permissions are bounded by the creator's identity.
PreviousPage 25 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin