Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 501Question →

Your team is setting up a high-traffic web platform in the North Europe region. You deploy a Standard Load Balancer named `lb-retail-prod`. The backend pool will consist of two virtual machines, `vm-app-01` and `vm-app-02`, both running in the same virtual network subnet.

You need to configure the public-facing frontend IP configuration and the backend pool for `lb-retail-prod`.

Which two configurations must you apply? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure a frontend IP address using a Standard SKU Public IP address with its allocation method set to Static.; Add the network interfaces of both virtual machines to the backend pool of the load balancer.

Answer

Configure a frontend IP address using a Standard SKU Public IP address with its allocation method set to Static, and add the network interfaces of both virtual machines to the backend pool of the load balancer.
The Standard Load Balancer requires frontend Public IP addresses of the Standard SKU. Standard SKU Public IPs only support Static allocation. Additionally, the network interfaces of the backend virtual machines must be added to the backend pool of the load balancer to receive traffic.

Step-by-Step Solution

1
Select the correct Public IP SKU for the Standard Load Balancer.
A Standard SKU Public IP address is chosen.
Standard Load Balancers require Standard SKU Public IP addresses for their frontend configuration; Basic SKU Public IPs are incompatible.
2
Configure the allocation method for the selected Public IP.
The allocation method is configured as Static.
Standard SKU Public IP addresses only support Static allocation in Azure.
3
Configure the backend pool of the load balancer.
The network interfaces of the backend VMs are added to the backend pool.
This allows the Standard Load Balancer to route incoming frontend traffic to the virtual machines.

Key Concept

Standard Load Balancer SKU alignment and Public IP allocation constraints
Question 502Question →

You manage a Microsoft Entra ID tenant. You configure Self-Service Password Reset (SSPR) with the following settings:

* Self-service password reset enabled: All
* Number of methods required to reset: 1
* Methods available to users: Email, Mobile phone

You have two users in the tenant:

* User1: A standard user who has registered their mobile phone number.
* User2: A user assigned the User Administrator directory role who has registered their mobile phone number.

Both users attempt to reset their password using the SSPR portal.

Which of the following describes the outcome of their password reset attempts?

Show answer & explanation

Answer: User1 can successfully reset their password. User2 cannot reset their password because Microsoft Entra ID enforces a two-gate password reset policy for administrator roles.

Answer

User1 can successfully reset their password. User2 cannot reset their password because Microsoft Entra ID enforces a two-gate password reset policy for administrator roles.
The correct answer is that the standard user can reset their password while the administrator cannot. In Microsoft Entra ID, a default two-gate password reset policy is automatically enforced for all administrator roles, regardless of any custom SSPR settings configured in the portal. Since the administrator has only registered one authentication method, they do not meet the two-gate requirement and are blocked from resetting their password. The standard user is subject to the tenant policy and only needs one method.

Step-by-Step Solution

1
Analyze the SSPR policy for standard users.
Standard users only require one authentication method (either Email or Mobile phone) to reset their password.
The custom SSPR policy is configured with 'Number of methods required to reset' set to 1, and User1 is a standard user who has registered a mobile phone.
2
Analyze the SSPR policy behavior for administrator roles.
Users assigned to Entra ID administrator roles are subject to a default, non-configurable two-gate (two-method) password reset policy.
Microsoft Entra ID enforces a stronger security policy for administrators to prevent unauthorized password resets.
3
Evaluate registration status for the administrator user (User2).
User2 has only registered one method (mobile phone) and thus fails to meet the two-gate requirement.
User2 cannot perform SSPR until they register a second authentication method (e.g., email).

Key Concept

Microsoft Entra ID enforces a default two-gate password reset policy for administrators, which cannot be bypassed by custom tenant-wide SSPR configurations that require fewer methods.
Estimated Time:1m 30s
Question 503Question →

Your organization has an Azure subscription that contains a resource group named rg-dev-apps. To control costs, you configure an Azure budget at the subscription scope with a monthly limit of 10,00010,000. You configure a budget alert threshold at 90%90\% that triggers an Action Group. The Action Group is configured to run an Azure Automation runbook that automatically deallocates all virtual machines in rg-dev-apps. You need to ensure that the runbook can successfully deallocate the virtual machines when the budget threshold is met, while still preventing users from accidentally deleting any virtual machines in rg-dev-apps. Which lock configuration should you apply to rg-dev-apps?

Show answer & explanation

Answer: Apply a CanNotDelete lock to the rg-dev-apps resource group.

Answer

Apply a CanNotDelete lock to the rg-dev-apps resource group.
Applying a CanNotDelete lock to the resource group prevents the deletion of any resource within it, including virtual machines. However, it still allows authorized users or service principals (such as the Azure Automation managed identity running the runbook) to perform write operations, which includes modifying resource state such as starting, stopping, and deallocating virtual machines.

Step-by-Step Solution

1
Analyze the action performed by the automation runbook when the budget threshold is met.
The runbook deallocates the virtual machines in rg-dev-apps to stop incurring costs.
Understanding the operation type (write/update vs. delete) is necessary to determine which resource lock is compatible.
2
Evaluate the effects of Azure resource locks on virtual machine deallocation.
A ReadOnly lock prevents deallocation because stopping a virtual machine is a state-changing write operation. A CanNotDelete lock allows state changes (write operations) but prevents resource deletion.
To ensure the runbook succeeds while protecting the VMs from deletion, a lock that permits write operations but blocks delete operations must be selected.
3
Identify the resource lock that meets both cost-control automation and resource protection requirements.
Applying a CanNotDelete lock at the rg-dev-apps resource group level prevents deletion of the VMs while allowing the deallocation runbook to run successfully.
This configuration satisfies the dual requirements of preventing accidental deletion and allowing automated deallocation.

Key Concept

The difference between ReadOnly and CanNotDelete resource locks and their impact on automated cost control actions.
Estimated Time:1m 30s
Question 504Question →

An administrator configures a virtual network named `VNet-Prod` with an address space of 10.0.0.0/2410.0.0.0/24. The virtual network contains a subnet named `AzureBastionSubnet` with an address space of 10.0.0.0/2610.0.0.0/26, and a subnet named `Subnet-App` with an address space of 10.0.0.64/2610.0.0.64/26. `Subnet-App` must support at least 60 virtual machines. Statement: The proposed configuration is valid and provides enough usable IP addresses for the virtual machines in `Subnet-App`. Is the statement true?

Show answer & explanation

Answer: False

Answer

The statement is false because a /26 subnet in Azure only provides 59 usable IP addresses, which is insufficient to support the required 60 virtual machines.
The statement is false because a /26 prefix provides 64 total IP addresses. After subtracting Azure's 5 reserved IP addresses, only 59 usable addresses remain, which is not enough to support the 60 virtual machines required in the subnet.

Step-by-Step Solution

1
Calculate the total number of IP addresses in a /26 subnet prefix.
64 total IP addresses (232−26=642^{32 - 26} = 64).
To determine the maximum address pool size for the subnet prefix.
2
Apply the Azure-specific reserved IP address constraint.
59 usable IP addresses (64−5=5964 - 5 = 59).
Azure reserves 5 IP addresses per subnet: the network address, default gateway, two DNS/DHCP addresses, and the broadcast address.
3
Compare the available usable IP addresses in the subnet against the workload requirement.
59 usable IP addresses is less than the required 60 virtual machines.
To determine if the configuration meets the specified virtual machine capacity.

Key Concept

Azure subnets reserve 5 IP addresses (the first 4 and the last 1 address), which reduces the number of usable IP addresses available for resources.
Question 505Question →

You are deploying a database schema migration task to Azure Container Instances (ACI). If the migration script fails during execution, running it a second time automatically could result in data corruption. You must ensure that the container does not restart under any circumstances once it stops. Which restart policy should you configure for the container group?

Show answer & explanation

Answer: Never

Answer

Never
The 'Never' restart policy guarantees that the container will execute exactly once. It will not attempt to restart regardless of whether the process finishes successfully (zero exit code) or fails with an error (non-zero exit code). This is ideal for tasks like database migrations where automatic retries could corrupt data.

Step-by-Step Solution

1
Analyze the workload requirements for the container group.
The container runs a database schema migration script once, and must not restart under any circumstances (success or failure) to avoid data corruption.
Identifying the desired lifecycle behavior determines the correct restart policy.
2
Evaluate the available Azure Container Instances (ACI) restart policies.
ACI supports three restart policies: 'Always', 'Never', and 'OnFailure'.
Knowing the valid options helps eliminate invalid configurations.
3
Select the policy that matches the requirement of zero restarts.
The 'Never' policy matches the requirement because it prevents restarts for both successful and failed executions.
Matching the requirements to the definition of 'Never' yields the correct configuration.

Key Concept

Azure Container Instances (ACI) Restart Policies
Question 506Question →

You are preparing to host a corporate web application on Azure. The application must satisfy the following criteria:
- Associate the web application with a custom DNS domain name.
- Provide a minimum of one deployment slot to perform staging tests.

You need to identify the most cost-effective App Service plan tier that supports these requirements.
Which App Service plan tier should you choose?

Show answer & explanation

Answer: Standard (S1)

Answer

Standard (S1)
The Standard (S1) tier is the most cost-effective App Service plan that supports both custom domains and deployment slots.

Step-by-Step Solution

1
Evaluate the requirement for a custom DNS domain name.
The Free (F1) tier is eliminated because it does not support custom domains. The Basic (B1), Standard (S1), and Premium v3 (P1v3) tiers support custom domains.
Custom domains are supported starting at the Shared (D1) and Basic (B1) tiers.
2
Evaluate the requirement for at least one staging/deployment slot.
The Basic (B1) tier is eliminated because it does not support deployment slots. Standard (S1) supports up to 5 slots, and Premium v3 (P1v3) supports up to 20 slots.
Deployment slots require at least a Standard tier plan.
3
Select the most cost-effective tier from the remaining compliant options.
The Standard (S1) tier is selected as it meets all requirements and is less expensive than the Premium v3 (P1v3) tier.
The objective is to minimize cost while meeting all specified requirements.

Key Concept

Selecting the minimum App Service plan tier required to support custom domains and deployment slots.
Question 507Question →

You are creating a new Azure virtual machine named VM1 in a resource group named RG1. You need to ensure VM1 is protected against datacenter-wide power outages. During the deployment, you also plan to configure VM1 to use an existing Recovery Services vault named Vault1 for daily backups. Vault1 is located in the East US region. Which deployment settings should you select for VM1?

Show answer & explanation

Answer: Select East US as the region, configure the availability option as Availability Zones, and select Vault1 for the backup configuration.

Answer

Select East US as the region, configure the availability option as Availability Zones, and select Vault1 for the backup configuration.
To protect the virtual machine from datacenter-wide outages, it must be deployed using Availability Zones. Additionally, because the Recovery Services vault is in the East US region, the VM must also be created in the East US region. Lastly, the resource group must not have a ReadOnly lock applied, as this would block the deployment of new resources.

Step-by-Step Solution

1
Evaluate the high availability requirement.
Availability Zones must be selected to protect the application from datacenter-wide outages by spreading instances across physically separate datacenters.
Availability Sets only safeguard against localized hardware failures inside a single datacenter.
2
Determine the required region for the virtual machine based on backup configuration.
The virtual machine must be deployed in the East US region.
Azure Recovery Services vaults can only back up virtual machines that reside in the same geographic region. Since Vault1 is in East US, the VM must also be in East US.
3
Analyze the impact of resource locks on VM creation.
Do not apply a ReadOnly lock on the target resource group prior to deploying the VM.
A ReadOnly lock blocks write operations, which prevents the resource group from accepting new resource deployments such as a virtual machine.

Key Concept

Azure virtual machine deployment options including Availability Zones, regional resource alignment for backups, and the effect of Resource Locks.
Question 508Question →

An administrator is configuring a Virtual Machine Scale Set (VMSS) named `vmss-prod` that uses a Rolling upgrade policy. You need to configure the rolling upgrade settings to meet the following requirements:

* Ensure that a maximum of 25% of the total virtual machine instances are upgraded simultaneously.
* Configure a 10-minute delay after each batch of upgrades is completed to allow the application to stabilize.

Which two properties of the rolling upgrade policy should you configure? (Select two.)

Select all that apply

Show answer & explanation

Answer: `maxBatchPercent`; `pauseTimeBetweenBatches`

Answer

Configure the `maxBatchPercent` property to limit the percentage of instances upgraded in each batch, and configure the `pauseTimeBetweenBatches` property to set the stabilization delay between batches.
The property defining the maximum percentage of instances that can be upgraded in a single batch is `maxBatchPercent`, which directly satisfies the requirement to limit the upgrade to 25% of instances at a time. The property specifying the duration to pause after a batch is upgraded is `pauseTimeBetweenBatches`, which allows the application to stabilize for 10 minutes before the next batch begins.

Step-by-Step Solution

1
Identify the property that limits the number of instances upgraded concurrently in a rolling upgrade batch.
The `maxBatchPercent` property controls the percentage of instances processed in each batch.
By setting this property to 25, you ensure that no more than 25% of the virtual machines in the scale set are upgraded at the same time.
2
Identify the property that introduces a pause or delay after a batch completes.
The `pauseTimeBetweenBatches` property accepts an ISO 8601 duration string to pause execution.
Setting this property to `PT10M` enforces a 10-minute wait time after completing a batch before the next batch begins, allowing the application to stabilize.

Key Concept

Azure Virtual Machine Scale Set (VMSS) Rolling Upgrade Policies
Question 509Question →

A company hosts a web application on an Azure virtual machine named VM-AppServer1. The virtual machine has a single network interface named nic-app1 connected to a subnet named Subnet1. To host a second web service on VM-AppServer1 that requires its own public IP entry point, you plan to add a new IP configuration named ipconfig-tenant2 to nic-app1. Which of the following configuration actions are required to successfully add the new configuration and associate a Standard SKU public IP address? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Assign a private IP address to ipconfig-tenant2 within the address space of Subnet1.; Associate a Standard SKU public IP address that is configured with the Static allocation method.

Answer

Assign a private IP address to the secondary IP configuration within the subnet range, and associate a Standard SKU public IP address configured with the Static allocation method.
To successfully add a secondary public IP configuration to a network interface, you must first assign a private IP address to the new IP configuration from the subnet's address range. Additionally, because the scenario requires a Standard SKU public IP, its allocation method must be set to Static, as Standard SKU public IPs do not support Dynamic allocation.

Step-by-Step Solution

1
Configure the secondary IP configuration on the network interface.
The secondary configuration ipconfig-tenant2 is created and assigned a private IP address from the subnet's address block.
Every IP configuration on an Azure network interface must have a private IP address. A public IP cannot exist on a configuration without a private IP.
2
Create and associate a Standard SKU public IP address.
A Standard SKU public IP is associated with ipconfig-tenant2 using Static allocation.
Standard SKU public IP addresses only support Static allocation, and all public IPs associated with a single network interface must share the same SKU.

Key Concept

Rules for configuring multiple IP configurations on a single network interface and Standard SKU public IP constraints.
Question 510Question →

A user who is assigned only the Billing Reader role at the Azure subscription scope can create and configure budget alerts in Azure Cost Management for that subscription.

Show answer & explanation

Answer: False

Answer

The statement is false because the Billing Reader role only provides read-only access to billing information and does not allow creating or configuring budgets.
The correct answer is false because the Billing Reader role only provides read-only access to billing and subscription cost data. It does not grant the write permissions necessary to define budgets or configure alerts.

Step-by-Step Solution

1
Analyze the permissions associated with the Billing Reader role.
The Billing Reader role is designed for read-only access to billing data, invoices, and cost details.
To determine whether the role allows creating objects like budgets.
2
Check the required permissions to create a budget in Azure Cost Management.
Creating or modifying a budget requires write permissions, specifically the Microsoft.Consumption/budgets/write action.
To compare the required write permissions against the read-only permissions of the Billing Reader role.
3
Evaluate if the Billing Reader role contains the required write action.
The Billing Reader role does not contain any write actions for the Microsoft.Consumption provider.
To conclude if the user can perform the budget configuration task.

Key Concept

Azure RBAC Roles for Cost Management
Question 511Question →

An administrator is configuring a virtual machine named VM-Prod1 in the East US region. VM-Prod1 has a single network interface named nic-prod1 connected to a subnet with the address prefix 10.10.1.0/24. VM-Prod1 is currently a member of the backend pool of an active Standard Load Balancer.

The administrator needs to associate an additional public IP address named pip-mgmt to VM-Prod1 to allow direct administrative access to a secondary service running on the virtual machine.

Which of the following configuration steps must the administrator perform to support this design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a secondary IP configuration on nic-prod1 with a Static private IP address allocation.; Provision pip-mgmt using the Standard SKU.

Answer

Creating a secondary IP configuration on the network interface using a static private IP address, and provisioning the new public IP address using the Standard SKU.
To support the design, the administrator must configure a secondary IP configuration on the network interface with a static private IP allocation and provision the public IP using the Standard SKU. This is because any public IP address associated with a virtual machine in the backend pool of a Standard Load Balancer must also be of the Standard SKU. Additionally, Azure requires all secondary IP configurations on a network interface to have a static private IP address allocation, as dynamic allocation is restricted to the primary IP configuration.

Step-by-Step Solution

1
Determine the SKU requirement for the new public IP address.
Since the VM is part of a Standard Load Balancer's backend pool, the public IP directly attached to its NIC must also be a Standard SKU.
Azure does not support mixing Basic SKU and Standard SKU public IP resources on the same virtual machine or load balancer backend pool.
2
Determine the allocation method for the Standard SKU public IP.
The Standard SKU public IP must be allocated statically.
Standard SKU public IP addresses in Azure only support the Static allocation method.
3
Configure the private IP address settings for the new configuration on the network interface.
Create a secondary IP configuration and set its private IP allocation method to Static.
Azure virtual network interfaces only support Dynamic private IP allocation on the primary IP configuration; all secondary configurations must use Static private IP allocation.

Key Concept

Standard SKU alignment and secondary IP configuration constraints on virtual machine network interfaces.
Question 512Question →

An administrator manages an Azure subscription that contains two resource groups: `RG-Shared-Services` (which hosts core virtual networks) and `RG-Dev-Test` (which hosts development virtual machines).

The administrator must implement the following controls:
1. Prevent the accidental deletion of any resources within `RG-Shared-Services`.
2. Automatically trigger a script to deallocate virtual machines in `RG-Dev-Test` when the subscription's monthly spend reaches $8,000\$8,000.
3. Allow a junior analyst named User1 to view cost analysis reports for the entire subscription, while ensuring they cannot view or modify the configuration of the virtual machines or network resources.

To achieve this, the administrator applies a CanNotDelete resource lock to `RG-Shared-Services`, configures an Azure Cost Management budget for the subscription with a $8,000\$8,000 limit and a 100%100\% threshold alert without an action group, and assigns the Billing Reader role to User1 at the `RG-Dev-Test` resource group scope.

Which of the following adjustments must be made to fully satisfy all requirements?

Show answer & explanation

Answer: Associate an Action Group containing the deallocation script with the budget alert threshold, and assign the Billing Reader role to User1 at the subscription scope.

Answer

Associate an Action Group containing the deallocation script with the budget alert threshold, and assign the Billing Reader role to User1 at the subscription scope.
To automate resource actions when a budget threshold is crossed, the budget alert must be associated with an Action Group that targets an automation resource (like a Logic App or Automation Runbook). To allow User1 to view subscription-wide cost analysis without viewing resource configurations, the Billing Reader role must be assigned at the subscription scope. Assigning the role at the resource group scope limits their view to that specific group, failing the requirement.

Step-by-Step Solution

1
Evaluate the automation requirement for budget alerts.
Identify that budget alerts require association with an Action Group (which can trigger Automation Runbooks or Logic Apps) to execute scripts automatically.
Default budget alerts only send notifications and do not execute scripts unless an Action Group is configured.
2
Evaluate access requirements and scope for User1.
Determine that the Billing Reader role must be assigned at the subscription scope, not the resource group scope.
Assigning Billing Reader at the resource group scope limits cost visibility to that specific resource group, whereas subscription-wide cost analysis requires the assignment to be at the subscription level. The Billing Reader role is correct as it restricts access to resource configurations.
3
Verify lock requirements.
Confirm that a CanNotDelete lock on the shared services resource group is correct because it prevents deletion while allowing write modifications.
Changing the lock to ReadOnly would block standard updates to networking configurations, violating operational needs.

Key Concept

Azure Cost Management scopes, budgets, action groups, and billing RBAC roles.
Question 513Question →

You need to create a public IP address to be used by a Standard Load Balancer. Which combination of SKU and allocation method must be selected for the new public IP address?

Show answer & explanation

Answer: Standard SKU and Static allocation

Answer

Standard SKU and Static allocation
Standard Load Balancers require a Standard SKU public IP address, and Standard SKU public IP addresses only support the static allocation method.

Step-by-Step Solution

1
Determine the required SKU for the public IP address based on the resource type.
Since the resource is a Standard Load Balancer, the public IP address must also use the Standard SKU.
Azure enforces SKU alignment between load balancers and their frontend public IP addresses.
2
Select the correct allocation method for the chosen SKU.
Standard SKU public IP addresses only support static allocation.
Dynamic allocation is not an available option for Standard SKU public IP resources.

Key Concept

Standard Load Balancers require Standard SKU public IP addresses, which are static by design.
Question 514Question →

A web application named `app-shop` is currently deployed on a Basic (B1) App Service plan. The management wants to establish a pre-production environment using a staging deployment slot and schedule automatic daily backups of the application to a container in an Azure Storage account. Which configuration action should be performed to enable these features?

Show answer & explanation

Answer: Scale up the App Service plan to the Standard (S1) tier.

Answer

Scale up the App Service plan to the Standard (S1) tier.
Scaling up the App Service plan to the Standard (S1) tier is the correct action because features such as deployment slots and automated backups are only available in the Standard tier and higher. The Basic tier does not support these features regardless of instance size (B1, B2, or B3).

Step-by-Step Solution

1
Identify the tier requirements for the desired App Service features.
Deployment slots and custom automated backups require a minimum of the Standard (S) tier.
These management and lifecycle features are not supported in the Free, Shared, or Basic tiers of Azure App Service plans.
2
Evaluate the current tier and identify the scaling action.
The current plan is Basic (B1). It must be scaled up to at least Standard (S1).
Standard (S1) is the entry-level production tier that unlocks these features.

Key Concept

Azure App Service plan tier capabilities and feature support
Estimated Time:1m 30s
Question 515Question →

Your company is designing a secure hub-and-spoke network topology in Azure. The hub virtual network, named `vnet-prod-us`, is allocated the address space 10.100.0.0/2210.100.0.0/22. The following subnets must be provisioned within `vnet-prod-us`:

- A subnet for Azure Bastion to secure administrative access.
- A subnet for a VPN Gateway to connect with an on-premises datacenter.
- A subnet named `snet-web-api` to host public web API endpoints that require at least 28 usable IP addresses.
- A subnet named `snet-microservices` to host application microservices that require at least 120 usable IP addresses.

Additionally, you deploy a Private DNS Zone named `private.contoso.com` for internal name resolution, and you peer `vnet-prod-us` with a spoke virtual network named `vnet-spoke-01` that has no gateway of its own. Spoke VMs must be able to resolve records in `private.contoso.com` and access the on-premises datacenter via the hub's VPN Gateway.

Which of the following configurations meets the subnet sizing requirements while ensuring valid name resolution and routing?

Show answer & explanation

Answer: Configure `AzureBastionSubnet` as 10.100.0.0/2610.100.0.0/26, `GatewaySubnet` as 10.100.0.64/2710.100.0.64/27, `snet-web-api` as 10.100.0.128/2610.100.0.128/26, and `snet-microservices` as 10.100.1.0/2510.100.1.0/25. Create virtual network links in the `private.contoso.com` Private DNS Zone to both `vnet-prod-us` and `vnet-spoke-01$. Enable gateway transit on the peering link from `vnet-prod-us` and configure the peering link from `vnet-spoke-01` to use the remote gateway.

Answer

The configuration that sets `AzureBastionSubnet` to /26, `GatewaySubnet` to /27, `snet-web-api` to /26, `snet-microservices` to /25, links the Private DNS zone to both virtual networks, and configures peering with gateway transit enabled.
The correct configuration establishes valid subnet sizes aligned to subnet boundaries without overlap. The `AzureBastionSubnet` is configured as /26, meeting the minimum deployment requirement. The `GatewaySubnet` is configured as /27, meeting the recommended size. The `snet-web-api` is configured as /26, which provides 59 usable IP addresses (exceeding the requirement of 28, whereas a /27 only provides 27 usable IPs due to the 5 reserved addresses in Azure). The `snet-microservices` is configured as /25, providing 123 usable IP addresses (exceeding the requirement of 120). Finally, it links the Private DNS Zone to both virtual networks to support name resolution and configures peering transit to allow spoke VMs to reach the on-premises VPN Gateway.

Step-by-Step Solution

1
Calculate the prefix size needed for the Azure Bastion subnet.
The subnet must be named `AzureBastionSubnet` and have a prefix size of at least /26 (e.g., 10.100.0.0/2610.100.0.0/26).
Microsoft Azure mandates that Azure Bastion must be deployed in a dedicated subnet named `AzureBastionSubnet` with a minimum prefix size of /26.
2
Calculate the subnet size needed for `snet-web-api` to host at least 28 usable IP addresses.
A /26 prefix size is required.
Azure reserves 5 IP addresses in every subnet (first 4 and last 1). A /27 subnet provides 32 addresses, leaving only 27 usable IPs (32−5=2732 - 5 = 27), which fails the requirement. A /26 subnet provides 64 addresses, leaving 59 usable IPs (64−5=5964 - 5 = 59), which satisfies the requirement.
3
Calculate the subnet size needed for `snet-microservices` to host at least 120 usable IP addresses.
A /25 prefix size is required.
A /25 subnet provides 128 addresses. After subtracting Azure's 5 reserved IP addresses, it yields 123 usable IPs (128−5=123128 - 5 = 123), which is sufficient for 120 hosts.
4
Determine the necessary configuration for Private DNS name resolution.
The Private DNS Zone `private.contoso.com` must be explicitly linked to both `vnet-prod-us` and `vnet-spoke-01`.
Private DNS Zone resolution does not transitively extend over virtual network peerings. Every virtual network containing VMs that require resolution must have a virtual network link to the Private DNS Zone.
5
Determine the required peering parameters to allow spoke VMs to access the on-premises datacenter via the hub gateway.
Enable 'Allow gateway transit' on the peering link from the hub, and enable 'Use remote gateways' on the peering link from the spoke.
Virtual network peering is non-transitive by default. Transit routing through a hub gateway must be explicitly enabled on both sides of the peering relationship.

Key Concept

Subnet planning in Azure requires accounting for 5 reserved IP addresses, complying with strict prefix sizing constraints for system subnets (like Azure Bastion), and explicitly configuring transit routing and DNS links in multi-VNet environments.
Estimated Time:3m 0s
Question 516Question →

An administrator is planning the deployment of two containerized workloads to Azure Container Instances (ACI):
- A web application container that must run continuously to process incoming HTTP requests.
- A daily data processing container that runs once every 24 hours to aggregate logs, write them to an Azure Storage account, and then exit.

The administrator must minimize ACI compute costs and administrative overhead.

Which deployment architecture and configuration should the administrator implement?

Show answer & explanation

Answer: Deploy the web application in a container group with a restart policy set to Always. Deploy the data processing workload in a separate container group with a restart policy set to Never, and trigger it daily using an Azure Logic App.

Answer

Deploy the web application in a container group with a restart policy set to Always, and deploy the data processing workload in a separate container group with a restart policy set to Never, triggering it daily using an Azure Logic App.
Deploying the continuous web application and the ephemeral daily task in separate container groups is the correct approach. It allows the web application's group to be configured with the Always restart policy to ensure high availability, while the daily task's group is configured with the Never or OnFailure policy. Triggering the daily group externally via an Azure Logic App ensures resources are only provisioned and billed during the execution time, minimizing compute costs.

Step-by-Step Solution

1
Analyze the execution lifecycles of the two workloads.
The web application must run continuously, whereas the data processing script is an ephemeral task that runs once daily.
Understanding the lifecycle differences helps determine whether they can share a container group's restart configuration.
2
Evaluate the scoping of ACI restart policies.
ACI restart policies (Always, Never, OnFailure) are applied at the container group level, affecting all containers in that group.
Since individual containers within a group cannot have different restart policies, workloads with mismatching execution models must be evaluated for separation.
3
Compare the cost and operational implications of shared vs. separated container groups.
Placing both in one group forces a shared restart policy, causing either infinite restart loops for the daily task or failure to reschedule it. Separating them allows the daily task to run only on-demand.
Separation satisfies the requirement to minimize compute billing by avoiding idle resource allocation or infinite execution loops.
4
Identify the orchestration mechanism for the daily task.
An Azure Logic App triggers the ephemeral container group's deployment or start action once every 24 hours.
ACI lacks built-in cron scheduling, requiring an external trigger such as Logic Apps or Azure Functions to automate the execution of the group configured with a 'Never' restart policy.

Key Concept

Azure Container Instances (ACI) restart policies and multi-container group lifecycle management
Estimated Time:2m 0s
Question 517Question →

Your company is planning to deploy Azure Bastion inside a virtual network named `VNet-Core`, which has an address space of 10.240.0.0/1610.240.0.0/16. An administrator proposes the following candidate subnets to host the Bastion service:

Proposed Subnet NameAddress RangePurpose
`Bastion-Subnet`10.240.10.0/2610.240.10.0/26Azure Bastion
`AzureBastionSubnet`10.240.20.0/2710.240.20.0/27Azure Bastion
`AzureBastionSubnet`10.240.30.0/2610.240.30.0/26Azure Bastion
`BastionSubnet`10.240.40.0/2810.240.40.0/28Azure Bastion

Which of the proposed subnets in the table is configured correctly to support the Azure Bastion deployment?

Show answer & explanation

Answer: The subnet named `AzureBastionSubnet` with the address range 10.240.30.0/2610.240.30.0/26

Answer

The subnet named `AzureBastionSubnet` with the address range 10.240.30.0/2610.240.30.0/26
The subnet named `AzureBastionSubnet` with the address range 10.240.30.0/2610.240.30.0/26 is correct because Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a subnet mask of /26/26 or larger.

Step-by-Step Solution

1
Check naming requirements for Azure Bastion subnets
The subnet hosting the Azure Bastion service must be named exactly `AzureBastionSubnet`.
Azure uses the specific name `AzureBastionSubnet` to provision and bind the Bastion resources automatically.
2
Check size requirements for Azure Bastion subnets
The subnet prefix size must be /26/26 or larger (e.g., /26/26, /25/25, /24/24).
Azure Bastion requires a minimum space of /26/26 to accommodate scale instances and manage network addresses.
3
Filter candidate subnets based on name and prefix constraints
Only the subnet named `AzureBastionSubnet` with the address range 10.240.30.0/2610.240.30.0/26 meets both the naming convention and the size requirement.
Other candidates either use incorrect names (such as `Bastion-Subnet` or `BastionSubnet`) or prefixes that are too small (such as /27/27 or /28/28).

Key Concept

Azure Bastion subnet configuration requirements (naming and minimum size)
Estimated Time:1m 30s
Question 518Question →

Your company is migrating an on-premises file share to Azure. You plan to use Azure File Sync to centralize file sharing in Azure Files, while maintaining local access to frequently accessed files on a Windows Server named SRV-Share01. You have already created a storage account and an Azure file share. You need to deploy Azure File Sync and establish synchronization. In which sequence should you perform the configuration steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, create a Storage Sync Service. Second, install the Azure File Sync agent on the server. Third, register the server with the Storage Sync Service. Fourth, create a sync group and add a cloud endpoint. Finally, create a server endpoint on the registered server.
The correct sequence starts with creating the Storage Sync Service in Azure. Next, the Azure File Sync agent must be installed on the local server. Once the agent is installed, the server can be registered with the Storage Sync Service. A sync group containing a cloud endpoint must then be created to define the topology and point to the Azure file share. Finally, the server endpoint is created on the registered server to link the local path and start synchronization.

Step-by-Step Solution

1
Deploy the Storage Sync Service resource in the Azure portal or via CLI/PowerShell.
The top-level coordination resource for Azure File Sync is created in Azure.
You must have a Storage Sync Service resource before registering any servers or creating any sync relationships.
2
Download and install the Azure File Sync agent on the local Windows Server (SRV-Share01).
The File Sync agent components and registration tool are installed on the server.
The server needs the agent to communicate with the Azure Storage Sync Service.
3
Run the Server Registration wizard or PowerShell commands to register the server with the Storage Sync Service.
SRV-Share01 is successfully registered and appears in the Storage Sync Service registered servers list.
Registration establishes trust and enables the server to participate in sync groups.
4
Create a sync group in the Storage Sync Service and add a cloud endpoint pointing to the Azure file share.
A sync group is established with the target Azure file share as the central hub.
The cloud endpoint defines the central sync target and must exist before local server endpoints can be associated.
5
Create a server endpoint in the sync group, specifying the local path on SRV-Share01.
Synchronization begins between the local path on SRV-Share01 and the Azure file share.
The server endpoint represents the source/destination on the registered server and is the final link in the sync topology.

Key Concept

Azure File Sync deployment order requires establishing the cloud control plane (Storage Sync Service), preparing the local host (agent installation and registration), configuring the sync group topology (cloud endpoint), and finally mapping the local filesystem path (server endpoint).
Question 519Question →

You have an Azure Storage account named `datashareeast` that contains a blob container named `reports`.

You need to grant an external partner read-only access to the `reports` container. The access must meet the following requirements:
- Allow access only from the IP address range 203.0.113.0/24203.0.113.0/24.
- Allow access only via HTTPS.
- Expire in 1414 days.
- Support the ability to immediately revoke access to the partner without rotating the storage account access keys or impacting other active SAS tokens.

Which configuration should you use?

Show answer & explanation

Answer: A service SAS associated with a stored access policy on the container

Answer

A service SAS associated with a stored access policy on the container
The correct option is a service SAS associated with a stored access policy on the container. A service SAS delegates access to a resource in just one of the storage services, such as Blob storage. By associating the service SAS with a stored access policy on the container, you can revoke the SAS token immediately by modifying or deleting the policy, without having to rotate the storage account access keys or impacting other active SAS tokens.

Step-by-Step Solution

1
Analyze the scope of the required access.
Access is needed for a single container ('reports'), which can be accomplished using either a service SAS or a user delegation SAS. An account SAS has a broader scope (account-level) but is not required here.
Least privilege principles dictate targeting the narrowest scope possible.
2
Evaluate the revocation requirement.
The SAS must be immediately revocable without rotating storage account keys or affecting other SAS tokens. Only a service SAS associated with a Stored Access Policy (SAP) on the container supports this capability.
Stored access policies allow changing constraints or deleting the policy to invalidate associated SAS tokens instantly.
3
Verify IP and protocol constraints configuration.
The service SAS and stored access policy support specifying allowed IP ranges (203.0.113.0/24203.0.113.0/24) and HTTPS-only protocols.
These constraints must be embedded in the SAS token definition to enforce the security requirements.

Key Concept

Shared Access Signature (SAS) types and revocation mechanisms using Stored Access Policies
Estimated Time:1m 30s
Question 520Question →

An administrator is configuring a new virtual network named `vnet-shared` in an Azure subscription. The virtual network is assigned the address space 172.16.100.0/24172.16.100.0/24. The administrator must create three subnets within this virtual network:

- `subnet-app`: Must host a backend API service that requires a minimum of 2828 usable IP addresses for virtual machines.
- `AzureBastionSubnet`: Must support the deployment of Azure Bastion using the minimum possible address space.
- `GatewaySubnet`: Must connect to an on-premises network via a VPN Gateway, using a prefix size of exactly /27/27.

The administrator wants to define the subnets sequentially starting from the beginning of the virtual network's address space without leaving any unassigned gaps or overlapping ranges. Which of the following subnet configurations should the administrator deploy?

Show answer & explanation

Answer: `subnet-app`: 172.16.100.0/26172.16.100.0/26
`AzureBastionSubnet`: 172.16.100.64/26172.16.100.64/26
`GatewaySubnet`: 172.16.100.128/27172.16.100.128/27

Answer

The correct subnet configuration assigns 172.16.100.0/26172.16.100.0/26 to `subnet-app`, 172.16.100.64/26172.16.100.64/26 to `AzureBastionSubnet`, and 172.16.100.128/27172.16.100.128/27 to `GatewaySubnet`.
To support 2828 virtual machines, `subnet-app` needs a minimum of 3333 IP addresses after adding the 55 Azure-reserved IP addresses. The smallest CIDR block that fits this is /26/26 (6464 addresses). A /27/27 block only provides 2727 usable addresses (32−5=2732 - 5 = 27), which is too small. `AzureBastionSubnet` requires a minimum subnet size of /26/26. In order to align sequentially without gaps or overlaps, `subnet-app` is assigned 172.16.100.0/26172.16.100.0/26 (covering .0.0 to .63.63), `AzureBastionSubnet` is assigned 172.16.100.64/26172.16.100.64/26 (covering .64.64 to .127.127), and `GatewaySubnet` is assigned 172.16.100.128/27172.16.100.128/27 (covering .128.128 to .159.159). All starting addresses are correctly aligned to their respective block boundaries.

Step-by-Step Solution

1
Determine the required IP address capacity for the application subnet.
2828 VM host addresses + 55 Azure-reserved addresses = 3333 total IP addresses.
Azure reserves the first four IP addresses and the last IP address of every subnet for internal networking services.
2
Determine the minimum prefix size for the application subnet and the Bastion subnet.
Both `subnet-app` and `AzureBastionSubnet` require a minimum prefix size of /26/26.
A /27/27 subnet only provides 2727 usable IP addresses (32−532 - 5), which is insufficient for 2828 VMs. Azure Bastion has a hard requirement for a minimum subnet prefix of /26/26.
3
Map the subnets sequentially and align them to valid CIDR block boundaries.
`subnet-app` starts at .0/26.0/26 (range: .0.0-.63.63). `AzureBastionSubnet` starts at .64/26.64/26 (range: .64.64-.127.127). `GatewaySubnet` starts at .128/27.128/27 (range: .128.128-.159.159).
Each subnet's starting address must be a multiple of its size to align correctly under CIDR subnet rules and avoid overlapping errors in Azure.

Key Concept

Azure subnet sizing, reserved IP addresses, service-specific prefix requirements, and CIDR block alignment.
Estimated Time:2m 30s
PreviousPage 26 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin