Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 541Question →

An administrator is deploying a multi-container group to Azure Container Instances (ACI) using an Azure Resource Manager (ARM) template. The group contains an application container that runs a continuous processing service and a sidecar container that collects and processes local logs. The deployment must meet the following requirements:

- The container group must reside within an existing Azure Virtual Network (VNet) inside a dedicated subnet.
- The application container must write logs to a shared directory that the sidecar container can access.
- Both containers must be restarted automatically if the application container fails.

Which of the following configurations must be defined in the template to successfully deploy this container group? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Delegate the VNet subnet to Microsoft.ContainerInstance/containerGroups and ensure that no public IP addresses or DNS name labels are configured for the container group.; Define an emptyDir volume in the container group properties, and define volume mounts referencing this volume in both container definitions.

Answer

Delegate the subnet to Microsoft.ContainerInstance/containerGroups with no public IP allocation, and define a shared emptyDir volume mounted to both containers.
Integrating Azure Container Instances with a VNet requires delegating the subnet to Microsoft.ContainerInstance/containerGroups and omitting public IP or DNS name label configurations. Sharing local directories within a container group requires defining an emptyDir volume and mapping it in the volumeMounts of both containers.

Step-by-Step Solution

1
Determine virtual network integration prerequisites.
The subnet must be delegated to Microsoft.ContainerInstance/containerGroups and public IP/DNS label properties must be omitted from the container group properties.
Subnet delegation is required for ACI VNet injection, and public endpoints are not supported within a VNet.
2
Configure the shared directory volume.
Create an emptyDir volume in the container group template resource and add corresponding volumeMounts to the application and sidecar container properties.
An emptyDir volume provides a shared, local, ephemeral directory visible to all containers in the same container group.
3
Verify restart policy configuration hierarchy.
Configure restartPolicy at the group level, and avoid setting it at the individual container configuration level.
ACI does not support setting distinct restart policies per container; the restart policy applies to the entire group resource.
4
Determine the correct network configuration inside the container group.
Ensure containers communicate over localhost using distinct ports, as they share the same network namespace and IP address.
Separate IP addresses cannot be assigned to containers within a single container group.

Key Concept

Azure Container Instances container group configurations including virtual network integration, shared volumes, network namespaces, and group-level restart policies.
Question 542Question →

You are planning the IP addressing schema for a new Azure Virtual Network named `VNet-Prod` that has an allocated address space of 172.16.0.0/21172.16.0.0/21. The network must host the following resources:
- A VPN Gateway, which requires a dedicated subnet named `GatewaySubnet` (minimum recommended size is /27/27).
- An Azure Bastion host, which requires a dedicated subnet named `AzureBastionSubnet`.
- A web application tier named `Subnet-Web` that must support at least 124124 concurrent virtual machines.
- An application tier named `Subnet-App` that must support at least 251251 concurrent virtual machines.

You propose the following subnet configuration:
- `AzureBastionSubnet`: 172.16.0.0/26172.16.0.0/26
- `GatewaySubnet`: 172.16.0.64/27172.16.0.64/27
- `Subnet-Web`: 172.16.0.128/25172.16.0.128/25
- `Subnet-App`: 172.16.1.0/24172.16.1.0/24

Determine if the following statement is true or false: The proposed configuration is valid, meets all resource requirements, and avoids any overlapping address spaces.

Show answer & explanation

Answer: False

Answer

The statement is false because the proposed subnet block for the web tier does not provide enough usable IP addresses to support the minimum number of virtual machines.
The proposed statement is false because the web tier subnet configured with the /25/25 prefix (172.16.0.128/25172.16.0.128/25) provides only 123123 usable IP addresses (128−5128 - 5), which does not meet the requirement to support at least 124124 virtual machines.

Step-by-Step Solution

1
Calculate the minimum number of IP addresses required for each subnet by adding the host requirements to the 55 IP addresses reserved by Azure in every subnet.
`Subnet-Web` requires 124+5=129124 + 5 = 129 total IP addresses. `Subnet-App` requires 251+5=256251 + 5 = 256 total IP addresses.
Azure reserves the first four and the last IP address of every subnet, making them unavailable for host allocation.
2
Evaluate the CIDR block sizes for the proposed configuration to determine their total and usable capacities.
- `AzureBastionSubnet` (172.16.0.0/26172.16.0.0/26) provides 6464 IPs (valid for Bastion).
- `GatewaySubnet` (172.16.0.64/27172.16.0.64/27) provides 3232 IPs (valid for VPN Gateway).
- `Subnet-Web` (172.16.0.128/25172.16.0.128/25) provides 128128 total IPs, resulting in 128−5=123128 - 5 = 123 usable IPs.
- `Subnet-App` (172.16.1.0/24172.16.1.0/24) provides 256256 total IPs, resulting in 256−5=251256 - 5 = 251 usable IPs.
This step determines whether the proposed CIDR scopes can accommodate the minimum required host counts.
3
Verify subnet boundary alignments and ensure no overlapping IP address ranges exist.
The subnets do not overlap, and all proposed ranges reside within the 172.16.0.0/21172.16.0.0/21 virtual network range (172.16.0.0172.16.0.0 to 172.16.7.255172.16.7.255). However, because `Subnet-Web` only provides 123123 usable IPs and requires 124124, the overall configuration is invalid.
Even though there are no overlaps, all individual subnet requirements must be satisfied for the proposed architecture to be valid.

Key Concept

Azure subnet IP address reservation rules and prefix calculation constraints.
Question 543Question →

You have an Azure virtual network named VNet1 that contains two subnets named SubnetA (10.0.1.0/24) and SubnetB (10.0.2.0/24). A Network Virtual Appliance (NVA) with the IP address 10.0.2.4 is deployed in SubnetB. By default, system routes allow direct communication between the two subnets. You want to route all outbound internet traffic from SubnetA through the NVA in SubnetB. You create a route table and associate it with SubnetA. You add a route for the destination 0.0.0.0/0. Which next hop type should you configure in the route?

Show answer & explanation

Answer: Virtual appliance

Answer

Virtual appliance
Selecting 'Virtual appliance' as the next hop type allows you to specify a private IP address (such as 10.0.2.4) belonging to a virtual machine or internal load balancer that acts as a firewall or router, directing the SubnetA traffic through the NVA.

Step-by-Step Solution

1
Analyze the traffic requirement.
Outbound internet traffic from SubnetA must go through the NVA at 10.0.2.4.
This requires routing traffic destined for 0.0.0.0/0 to a custom VM/firewall in a different subnet.
2
Identify the correct next hop type in the User-Defined Route.
The next hop type must be set to 'Virtual appliance'.
Azure requires the 'Virtual appliance' next hop type to forward traffic to private IP addresses of virtual machines or internal load balancers acting as NVAs.

Key Concept

To redirect traffic to a Network Virtual Appliance (NVA), you must configure a User-Defined Route (UDR) with the next hop type set to 'Virtual appliance' and provide the NVA's private IP address.
Question 544Question →

An organization is deploying a multi-tenant web application on a single Azure Virtual Machine. The network architecture requires a single network interface to receive traffic on two distinct private IP addresses, each mapped to a dedicated public IP address for external access. The virtual network uses the address space 10.0.0.0/1610.0.0.0/16 and the subnet uses 10.0.1.0/2410.0.1.0/24. The network interface currently has a single IP configuration named `ipconfig-primary` with a dynamic private IP address of 10.0.1.410.0.1.4 and a Standard SKU public IP address. Which of the following configuration steps must be performed to implement the secondary IP configuration? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Add a secondary IP configuration named `ipconfig-secondary` to the network interface and assign it a private IP address within the 10.0.1.0/2410.0.1.0/24 range.; Associate a Standard SKU public IP address configured with static allocation to the secondary IP configuration.

Answer

To implement the secondary IP configuration, you must add a secondary IP configuration to the network interface with a private IP in the same subnet range, and associate it with a Standard SKU public IP address configured with static allocation.
To successfully configure a secondary IP configuration for internet access on an existing network interface, you must first add a secondary IP configuration and assign it a private IP address within the same subnet (10.0.1.0/2410.0.1.0/24). Then, because the primary configuration already uses a Standard SKU public IP, any secondary public IP associated with the same network interface must also be a Standard SKU public IP. Standard SKU public IP addresses in Azure require static allocation, so you must create and associate a Standard SKU public IP with static allocation.

Step-by-Step Solution

1
Add a secondary IP configuration on the network interface.
The secondary configuration is created but requires a valid private IP address in the same subnet as the primary configuration.
All IP configurations on a single network interface must belong to the same subnet.
2
Create a new Standard SKU Public IP address with static allocation.
A new Standard SKU public IP is provisioned.
Azure requires all public IP addresses on a single network interface to share the same SKU. Since the primary is Standard, the secondary must also be Standard. Standard public IPs only support static allocation.
3
Associate the Standard SKU public IP address with the secondary IP configuration.
The secondary IP configuration is successfully mapped to the new public IP address, allowing external traffic to reach the secondary private IP.
This completes the binding of the public IP to the secondary private IP configuration.

Key Concept

Configuring multiple IP configurations on a single network interface and aligning Public IP SKUs and allocation methods.
Question 545Question →

An administrator is configuring a virtual network named `vnet-prod` in a resource group named `rg-prod`. The virtual network is assigned the address space of 172.16.0.0/16172.16.0.0/16. The administrator needs to create a new subnet to host a database cluster that requires a minimum of 1212 usable IP addresses. Which of the following is the smallest subnet mask that meets this requirement in Azure?

Show answer & explanation

Answer: /27

Answer

The correct subnet mask is /27 because it is the smallest prefix that provides at least 12 usable IP addresses after accounting for the 5 IP addresses reserved by Azure.
The correct subnet mask is /27. A /27/27 subnet has 3232 total IP addresses. Azure always reserves the first four and the last IP addresses in any subnet (a total of 55 addresses). Therefore, a /27/27 subnet provides 32−5=2732 - 5 = 27 usable IP addresses, which is sufficient to meet the requirement of 1212 hosts. A /28/28 subnet only provides 1111 usable IP addresses (16−5=1116 - 5 = 11), which is not enough, making /27 the smallest viable subnet mask.

Step-by-Step Solution

1
Determine the number of usable IP addresses required.
The requirement is 1212 usable IP addresses.
To host the database cluster, the subnet must support at least 1212 hosts.
2
Account for Azure's reserved IP addresses.
Add 55 to the required host count: 12+5=1712 + 5 = 17 total IP addresses needed.
Azure reserves the first four IP addresses and the last IP address of every subnet, making them unavailable for resource assignment.
3
Find the smallest subnet size that accommodates the total needed IP addresses.
A /27/27 subnet provides 3232 total IP addresses (2(32−27)=322^{(32-27)} = 32), which is the smallest power of 2 greater than or equal to 1717.
A /28/28 subnet only provides 1616 total IP addresses (which results in 1111 usable addresses), while a /27/27 subnet provides 3232 total IP addresses (resulting in 2727 usable addresses).

Key Concept

Azure Virtual Network Subnet IP Allocation and Reservations
Question 546Question →

You are configuring a virtual machine named VM-App1. The virtual machine has a single network interface named nic-app1. The primary IP configuration of nic-app1 is associated with the backend pool of a Standard Load Balancer. You need to configure a secondary IP configuration on nic-app1 that includes a public IP address. Which of the following configurations should you select for the secondary public IP address? Select two.

Select all that apply

Show answer & explanation

Answer: SKU: Standard; Assignment: Static

Answer

SKU: Standard and Assignment: Static
The correct configurations are SKU: Standard and Assignment: Static. In Azure, when a virtual machine's network interface is associated with a Standard Load Balancer backend pool, any public IP addresses associated with that network interface must also use the Standard SKU. Standard SKU public IP addresses require static allocation.

Step-by-Step Solution

1
Analyze the load balancer association.
The network interface nic-app1 belongs to the backend pool of a Standard Load Balancer.
This establishes that all resources, including public IP addresses associated with the backend virtual machine's network interface, must use the Standard SKU to avoid SKU mismatch.
2
Determine the required SKU for the secondary public IP address.
The SKU must be Standard.
Basic SKU public IP addresses cannot be mixed with Standard SKU load balancers or associated resources.
3
Determine the allocation method for the selected SKU.
The allocation method must be Static.
Standard SKU public IP addresses support static IP address allocation.

Key Concept

Standard Load Balancer backend pool members must use Standard SKU public IP addresses, which require static allocation.
Question 547Question →

A developer requires temporary access to read and add messages to a single storage queue named orders-queue in the Azure Storage account productionstore. The access must comply with the following requirements:
- Access must be limited to the IP address range 198.51.100.40 to 198.51.100.50.
- All connection requests must use the HTTPS protocol.
- The access must be revocable at any time without rotating the storage account access keys and without affecting other clients.

Which configuration should you implement to meet these requirements?

Show answer & explanation

Answer: Create a stored access policy on the queue, and then generate a Service Shared Access Signature (SAS) that references this policy.

Answer

Create a stored access policy on the queue, and then generate a Service Shared Access Signature (SAS) that references this policy.
Creating a stored access policy on the queue and linking a Service SAS to it is the only way to satisfy all requirements. The stored access policy allows immediate revocation of the SAS by deleting or editing the policy, without rotating the storage account keys and affecting other clients. The SAS token itself supports constraints for HTTPS-only and specific IP address ranges.

Step-by-Step Solution

1
Determine the resource type and verify SAS support.
The target resource is a queue. Since User Delegation SAS only supports Blob storage, a Service SAS or Account SAS must be used.
Ensures the selected SAS type is compatible with Azure Queue storage.
2
Evaluate the key rotation and revocation requirement.
The SAS must be revocable without rotating the primary or secondary storage account keys. This requires linking the SAS to a stored access policy.
Stored access policies allow instant revocation of associated Service SAS tokens by deleting or altering the policy.
3
Apply the IP and protocol constraints.
Configure HTTPS-only and the allowed IP range (198.51.100.40 to 198.51.100.50) directly on the Service SAS token definition.
Limits the scope of the token to satisfy security constraints without applying global firewall rules to the entire storage account.

Key Concept

Using stored access policies with Service SAS to enable revocation without access key rotation, and understanding resource support limitations of User Delegation SAS.
Estimated Time:1m 30s
Question 548Question →

A company establishes the following Azure resource hierarchy:
- A Management Group named `Corp-MG`
- A subscription named `Sub-Production` located under `Corp-MG`
- A resource group named `RG-App-Prod` in `Sub-Production`
- A resource group named `RG-App-Shared` in `Sub-Production`

The following governance configurations are applied:
1. An Azure Policy initiative named `Gov-Initiative` is assigned at the `Sub-Production` subscription level. The initiative contains a policy definition that restricts allowed virtual machine SKUs to `Standard_D2s_v3` (Effect: `Deny`) and a policy definition that requires the `CostCenter` tag (Effect: `Audit`).
2. An exclusion is configured on the `Gov-Initiative` assignment for the `RG-App-Shared` resource group.
3. An Azure Policy definition that restricts storage account replication SKUs to `Standard_LRS` (Effect: `Deny`) is assigned directly to the `RG-App-Shared` resource group.

A technician attempts to perform the following operations:
- Operation 1: Create a virtual machine with the `Standard_F2s_v2` SKU in `RG-App-Prod` without any tags.
- Operation 2: Create a virtual machine with the `Standard_F2s_v2` SKU in `RG-App-Shared` without any tags.
- Operation 3: Create a storage account with the `Standard_GRS` SKU in `RG-App-Shared`.

Which two of the following outcomes will occur?

Select all that apply

Show answer & explanation

Answer: Operation 1 is denied, and Operation 2 succeeds.; Operation 3 is denied, and Operation 2 succeeds.

Answer

The correct outcomes are: Operation 1 is denied, Operation 2 succeeds, and Operation 3 is denied.
Operation 1 is blocked by the inherited virtual machine SKU policy which contains a Deny effect. Operation 2 is permitted because its resource group is excluded from the subscription-level initiative assignment. Operation 3 is blocked by a policy directly assigned to the target resource group that restricts storage replication to LRS.

Step-by-Step Solution

1
Evaluate Operation 1 against the policy assignments.
Operation 1 is denied.
The virtual machine is being created in a resource group that inherits the subscription-level initiative. The initiative has a policy restricting VM SKUs to Standard_D2s_v3 with a Deny effect. Attempting to deploy a Standard_F2s_v2 VM triggers the Deny effect, blocking the operation.
2
Evaluate Operation 2 against the policy assignments.
Operation 2 succeeds.
Although the subscription-level initiative is inherited by default, the resource group has an explicit exclusion from this assignment. Thus, neither the VM SKU policy nor the tag policy applies, allowing the creation of the Standard_F2s_v2 VM.
3
Evaluate Operation 3 against the policy assignments.
Operation 3 is denied.
A separate policy is assigned directly to the resource group that denies storage account replication SKUs other than Standard_LRS. Attempting to create a Standard_GRS storage account triggers this Deny effect, blocking the operation.

Key Concept

Azure Policy evaluation rules, including inheritance, exclusions, and the difference between Deny and Audit effects.
Question 549Question →

Your company has two web applications that will be deployed to Azure App Service: WebApp1 and WebApp2.

You need to create App Service plans for both applications to meet the following requirements:
- WebApp1 requires 10 deployment slots (including the production slot) and must scale automatically based on CPU utilization.
- WebApp2 must support a custom domain name, SSL binding, and manual scale-out of up to three instances. WebApp2 does not require staging slots, Virtual Network (VNet) integration, or auto-scaling.

To minimize costs, you must deploy each application to the lowest pricing tier that satisfies its requirements.

Which two App Service plan pricing tiers should you recommend? (Select two.)

Select all that apply

Show answer & explanation

Answer: Premium V3 (P1v3) pricing tier for WebApp1; Basic (B1) pricing tier for WebApp2

Answer

The Premium V3 (P1v3) pricing tier for WebApp1 and the Basic (B1) pricing tier for WebApp2
The Premium V3 (P1v3) pricing tier is the most cost-effective option for WebApp1 because it supports up to 20 deployment slots and automatic scaling, whereas the Standard tier is limited to 5 slots. The Basic (B1) pricing tier is the most cost-effective option for WebApp2 because it supports custom domains, SSL bindings, and manual scaling up to 3 instances. The Free tier does not support custom domains or scaling, and the Standard tier is more expensive than Basic and is not cost-optimal.

Step-by-Step Solution

1
Evaluate the requirements for WebApp1: 10 deployment slots and automatic scaling.
Identify that the Standard tier supports a maximum of 5 deployment slots, meaning a Premium tier is required. The Premium V3 tier supports up to 20 deployment slots and automatic scaling.
To find the lowest pricing tier that meets the slot and autoscale requirements.
2
Evaluate the requirements for WebApp2: custom domain, SSL binding, manual scale-out up to three instances, and no VNet integration or slot requirements.
Identify that the Free tier does not support custom domains or scaling, whereas the Basic tier supports custom domains, SSL, and manual scale-out up to three instances.
To find the lowest pricing tier that meets the basic hosting and scaling needs of WebApp2.
3
Compare the cost of the identified tiers to select the most cost-optimal configuration.
WebApp1 must use Premium V3 (P1v3) because Standard is insufficient. WebApp2 can use Basic (B1), which is cheaper than Standard (S1).
To satisfy the requirement of minimizing costs.

Key Concept

Selecting the most cost-effective Azure App Service plan pricing tier based on slot, scale-out, and feature requirements.
Question 550Question →

You need to deploy a Virtual Machine Scale Set (VMSS) named `vmss-app` that automatically installs an application during provisioning. The installation script is stored in a private Azure Storage account. Which sequence of steps should you perform to configure the VMSS to retrieve and run the script securely?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To securely run a script on a new VMSS from a private storage account, first upload the script to a private container, generate a SAS token with Read permissions, configure the Custom Script Extension in the VMSS template using the SAS URL, and then deploy the VMSS.
To deploy a VMSS that securely runs a custom installation script stored in a private Azure Storage account, you must first upload the script to the storage account. Once uploaded, you generate a Shared Access Signature (SAS) token to provide temporary, secure read access. Next, you reference this SAS URL in the VMSS Custom Script Extension configuration within your deployment template. Finally, you deploy the VMSS, which provisions the instances and executes the script.

Step-by-Step Solution

1
Upload the script to Azure Storage
The script is stored in a private container, preventing public access.
The file must exist in Azure before you can configure access to it.
2
Generate a SAS token
A secure SAS URL is created with Read-only access to the script.
The VMSS extension needs a secure way to access the script without using the storage account key.
3
Configure VMSS resource definition
The VMSS Custom Script Extension configuration includes the SAS URL.
This tells the VMSS where to find the script and how to authenticate to download it.
4
Deploy the VMSS
VMSS instances are deployed and automatically run the script during provisioning.
Initiates the deployment process to create the virtual machines with the specified extension configuration.

Key Concept

Configuring Custom Script Extensions on a VMSS using private storage with SAS authentication
Question 551Question →

You have an Azure App Service web app named app-sales that currently runs on a Shared (D1) App Service plan. You need to configure a custom domain named sales.contoso.com and bind a custom SSL certificate to the domain. What is the minimum App Service plan pricing tier required to support this configuration?

Show answer & explanation

Answer: Basic (B1)

Answer

Basic (B1)
The correct pricing tier is the Basic tier, as it is the minimum tier that supports both custom domains and custom SSL bindings (SNI and IP-based SSL).

Step-by-Step Solution

1
Analyze the requirements for custom domain and SSL binding.
The configuration requires both a custom domain (sales.contoso.com) and a custom SSL certificate binding.
Different Azure App Service pricing tiers offer different capabilities for custom domains and SSL.
2
Evaluate the capabilities of the pricing tiers.
Free (F1) offers no custom domains or SSL. Shared (D1) supports custom domains but no SSL bindings. Basic (B1) supports both custom domains and custom SSL bindings (SNI/IP-based). Standard (S1) supports both as well but at a higher cost.
To identify the minimum required pricing tier that satisfies the requirement at the lowest cost.
3
Select the correct minimum tier.
Basic (B1) is the minimum tier that supports custom SSL bindings.
Basic (B1) provides the necessary features while keeping the cost lower than Standard (S1).

Key Concept

Azure App Service plan pricing tiers and features
Question 552Question →

An administrator needs to change the size of an Azure virtual machine named VM1 from Standard_D2s_v5 to Standard_F4s_v2 to optimize performance for a CPU-bound workload. Currently, VM1 is running. When attempting to resize VM1 in the Azure portal, the Standard_F4s_v2 size is not displayed in the list of available sizes. What should the administrator do to make the Standard_F4s_v2 size available for selection?

Show answer & explanation

Answer: Stop and deallocate VM1, and then select the new size.

Answer

Stop and deallocate VM1, and then select the new size.
Stopping and deallocating the virtual machine releases it from the physical hardware cluster where it is currently running. Once deallocated, Azure can allocate the virtual machine to a different hardware cluster that supports the desired size.

Step-by-Step Solution

1
Stop and deallocate the virtual machine.
The virtual machine status changes to Stopped (deallocated), releasing the hardware reservation on the current physical host.
Resizing a running virtual machine is limited to sizes supported by the hardware cluster currently hosting the virtual machine.
2
Select the new virtual machine size (Standard_F4s_v2) and apply the change.
The virtual machine size is updated successfully in the configuration.
Once deallocated, Azure can allocate the virtual machine to a different hardware cluster that has the physical resources to support the Standard_F4s_v2 size.
3
Start the virtual machine.
The virtual machine starts successfully with the new size.
This resumes the workload on the new virtual machine instance.

Key Concept

Virtual Machine Resizing and Sizing Constraints
Question 553Question →

Your company plans to deploy an Azure Kubernetes Service (AKS) cluster in an existing virtual network. The virtual network has a limited subnet address space, and you must conserve IP addresses. The design must ensure that pods do not receive IP addresses directly from the virtual network subnet, and instead use network address translation (NAT) to communicate with other resources. Which two configuration settings should you select when deploying the AKS cluster to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Set the network plugin to Kubenet.; Specify a separate, non-overlapping Pod CIDR address range.

Answer

To configure the AKS cluster to conserve IP addresses using NAT, you must set the network plugin to Kubenet and specify a separate, non-overlapping Pod CIDR address range.
The correct configuration settings are to set the network plugin to Kubenet and specify a separate, non-overlapping Pod CIDR address range. Kubenet is a basic routing model where pods do not receive IP addresses from the virtual network subnet, which conserves subnet IP addresses. Instead, pods receive IPs from a specified Pod CIDR range, and their traffic is routed through the nodes using NAT.

Step-by-Step Solution

1
Identify the IP address conservation requirement.
Since the subnet address space is limited, a networking model that does not assign virtual network IP addresses to each pod must be chosen. Kubenet meets this requirement by using NAT.
Kubenet assigns pods IPs from a private, internal space, whereas Azure CNI assigns subnet IPs directly to pods.
2
Select the appropriate network plugin.
Choose the Kubenet network plugin.
Setting the plugin to Kubenet enables the NAT-based pod networking model.
3
Configure the Pod CIDR range.
Provide a custom Pod CIDR range that does not overlap with the virtual network subnet or any peered networks.
Kubenet requires a dedicated address range from which it allocates IP addresses to the pods running inside the cluster.

Key Concept

Azure Kubernetes Service (AKS) networking models, specifically the differences between Kubenet (NAT-based) and Azure CNI (VNet-integrated) plugins.
Question 554Question →

Your Azure environment has a subnet containing two virtual machines: VM1\text{VM1} and VM2\text{VM2}. VM1\text{VM1} is associated with an Application Security Group (ASG) named ASG-Web\text{ASG-Web}. VM2\text{VM2} is associated with an ASG named ASG-Database\text{ASG-Database}.

The subnet is associated with a Network Security Group (NSG) that has the following inbound security rules:
* Rule 1: Priority 100100, Source: ASG-Web\text{ASG-Web}, Destination: ASG-Database\text{ASG-Database}, Port: 14331433, Protocol: TCP, Action: Deny
* Rule 2: Priority 120120, Source: Any, Destination: ASG-Database\text{ASG-Database}, Port: 14331433, Protocol: TCP, Action: Allow

A user attempts to establish a SQL database connection over TCP port 14331433 from VM1\text{VM1} to VM2\text{VM2}. Which outcome will occur?

Show answer & explanation

Answer: The connection is denied because Rule 1 has a lower priority number, giving it higher precedence than Rule 2.

Answer

The connection is denied because Rule 1 has a lower priority number (100), which gives it higher precedence than Rule 2 (120).
The connection is blocked because when multiple security rules match a specific traffic flow, Azure processes them in order of priority (from the lowest numerical value to the highest). Since the rule stating that traffic from the web group to the database group is denied has a priority of 100, which is lower than the allow rule's priority of 120, it is evaluated first, and its Deny action is applied.

Step-by-Step Solution

1
Identify the matching NSG rules for the traffic flow from VM1 to VM2 on TCP port 1433.
Both Rule 1 (source ASG-Web, destination ASG-Database) and Rule 2 (source Any, destination ASG-Database) match the traffic flow.
VM1 belongs to ASG-Web, VM2 belongs to ASG-Database, and the destination port is 1433 over TCP.
2
Compare the priority numbers of the matching rules to determine which one is evaluated first.
Rule 1 has priority 100, and Rule 2 has priority 120. Rule 1 is evaluated first because 100 is less than 120.
Azure NSG rules are processed in sequential order from lowest priority number to highest priority number.
3
Apply the action of the rule with the highest precedence (lowest priority number) and stop further evaluation.
The Deny action from Rule 1 is applied, and the connection is blocked.
Once a matching rule is found and applied, no further rules are evaluated for that network flow.

Key Concept

Azure NSG rule evaluation logic processes rules sequentially based on their priority numbers, where a lower number indicates higher precedence.
Estimated Time:45s
Question 555Question →

Your organization has a hybrid Active Directory environment and a Microsoft Entra ID tenant with Microsoft Entra ID P1 licenses. You must implement the following identity and access management requirements:
1. On-premises user accounts must be able to change their passwords in the cloud, and these changes must synchronize back to the on-premises Active Directory Domain Services (AD DS) domain.
2. External guest users must not be permitted to invite other guest users unless they are explicitly assigned a directory role that allows invitations.
3. Users must be allowed to reset their own passwords using either email or the Microsoft Authenticator app.

Which of the following actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable password writeback in the Microsoft Entra Connect Sync configuration.; Set the Guest invite restrictions setting in the External collaboration settings to: Only users assigned to specific admin roles can invite guest users.

Answer

To satisfy the hybrid password sync and external guest invite requirements, you must enable password writeback in the Microsoft Entra Connect Sync settings and restrict guest invitations to users assigned to specific administrative roles in the External collaboration settings.
Enabling password writeback in Microsoft Entra Connect Sync is necessary for hybrid environments so that cloud-based password resets are written back to on-premises AD DS in real-time. Restricting guest invitations in the External collaboration settings to only users assigned to specific admin roles successfully blocks standard guests from sending invites unless they have been explicitly assigned a role like Guest Inviter.

Step-by-Step Solution

1
Enable password writeback in Microsoft Entra Connect Sync.
This enables cloud-initiated password resets to be written back to the on-premises AD DS environment, satisfying the hybrid password sync requirement.
Password writeback is required to synchronize password updates back to the on-premises directory.
2
Configure Guest invite restrictions in Microsoft Entra External collaboration settings.
Setting this option to limit guest invitations to users assigned to specific administrative roles prevents standard guest users from sending invitations.
This enforces the security policy restricting guest invitation privileges to authorized roles only.

Key Concept

Self-Service Password Reset (SSPR) with hybrid password writeback and External Identities guest invitation restriction policies.
Question 556Question →

Your company plans to implement Azure File Sync to synchronize files between an on-premises server named SRV-Retail01 and an Azure file share named salesdata. The salesdata share is located in a storage account named storaretail2026.

You configure the firewall on storaretail2026 to restrict access, permitting traffic only from selected networks.

Which two of the following settings or configurations must you implement to ensure that Azure File Sync can successfully synchronize files with the salesdata file share? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of storaretail2026.; Configure a private endpoint for the file sub-resource on the storaretail2026 storage account.

Answer

To sync files behind a restricted storage firewall, you must enable the trusted Microsoft services bypass on the storage account firewall and create a private endpoint for the storage account's file sub-resource.
The correct configurations are enabling the trusted Microsoft services bypass on the storage account firewall and setting up a private endpoint for the storage account's file sub-resource. The Storage Sync Service must have metadata access, which is allowed by the trusted services exception. The agent on the on-premises server requires private access to transfer data, which is provided by the private endpoint.

Step-by-Step Solution

1
Ensure the Azure Storage Sync Service can communicate with the storage account.
The Storage Sync Service can orchestrate sync operations and coordinate metadata changes.
By enabling the 'Allow trusted Microsoft services to access this storage account' setting, the cloud service bypasses the firewall constraints for metadata access.
2
Establish secure data plane connectivity for the Azure File Sync agent.
The agent on the local server can transfer file data to the Azure file share over a private IP address.
Creating a private endpoint for the file sub-resource enables the agent to bypass the public endpoint restriction via VPN or ExpressRoute.

Key Concept

Azure File Sync firewall and private endpoint configuration
Question 557Question →

In an Azure virtual network, a subnet configured with the address prefix 10.0.0.0/2910.0.0.0/29 has exactly three usable IP addresses available for resource allocation.

Show answer & explanation

Answer: True

Answer

The statement is true because a /29/29 subnet contains 88 total IP addresses, and Azure's standard reservation of 55 IP addresses leaves exactly 33 usable IP addresses.
The statement is true because a /29/29 subnet has 88 total IP addresses, and subtracting the 55 addresses Azure reserves leaves exactly 33 usable addresses.

Step-by-Step Solution

1
Calculate the total number of IP addresses in a /29/29 prefix.
The total number of IP addresses is 232−29=23=82^{32-29} = 2^3 = 8.
Prefix length of 2929 leaves 33 bits for host addresses (32−29=332 - 29 = 3).
2
Identify the number of IP addresses reserved by Azure in each subnet.
Azure reserves exactly 55 IP addresses in every subnet.
Azure reserves the first four IP addresses and the last IP address for networking and service functionality.
3
Subtract the reserved IP addresses from the total IP addresses to find the usable count.
Usable IP addresses = 8−5=38 - 5 = 3.
This determines the remaining addresses available for virtual machines and other resources.

Key Concept

Azure Subnet IP Address Reservation
Question 558Question →

An organization has a hub-and-spoke virtual network topology in Microsoft Azure configured as follows:
- VNet-Hub (address space 10.100.0.0/1610.100.0.0/16) contains a subnet named Subnet-DMZ (10.100.1.0/2410.100.1.0/24) and a subnet named Subnet-Data (10.100.5.0/2410.100.5.0/24).
- Subnet-DMZ hosts a Network Virtual Appliance (NVA) with the private IP address 10.100.1.410.100.1.4.
- VNet-Spoke1 (address space 10.101.0.0/1610.101.0.0/16) contains a subnet named Subnet-App1 (10.101.1.0/2410.101.1.0/24).
- VNet-Hub and VNet-Spoke1 are connected via virtual network peering with default settings.

You must implement a routing policy for traffic originating from Subnet-App1 that meets the following requirements:
1. All traffic destined for the hub virtual network (10.100.0.0/1610.100.0.0/16) must be inspected by the NVA.
2. All traffic destined for the database servers in Subnet-Data (10.100.5.0/2410.100.5.0/24) must bypass the NVA and connect directly over the virtual network peering connection.
3. The NVA must be permitted to forward traffic that is not destined for its local network interfaces.

Which three configuration steps should you perform to meet these requirements? (Select three.)

Select all that apply

Show answer & explanation

Answer: Enable IP forwarding on the Azure network interface associated with the Network Virtual Appliance (NVA).; Create a route table, associate it with Subnet-App1, and add a route for 10.100.0.0/1610.100.0.0/16 with a next hop type of Virtual appliance and a next hop IP address of 10.100.1.410.100.1.4.; In the route table associated with Subnet-App1, add a route for 10.100.5.0/2410.100.5.0/24 with a next hop type of Virtual network.

Answer

To meet the requirements, you must enable IP forwarding on the Network Virtual Appliance (NVA) network interface, create a route table associated with Subnet-App1 containing a route for 10.100.0.0/1610.100.0.0/16 pointing to the NVA (10.100.1.410.100.1.4) as a Virtual Appliance, and add a more specific route in the same route table for 10.100.5.0/2410.100.5.0/24 with a next hop type of Virtual network to allow database traffic to bypass the NVA.
To inspect traffic destined for the hub VNet from the spoke, a User-Defined Route (UDR) for 10.100.0.0/1610.100.0.0/16 with a next hop of Virtual Appliance (pointing to the NVA's IP) must be applied to the application subnet. To bypass this NVA for the database subnet (10.100.5.0/2410.100.5.0/24), Azure's Longest Prefix Match (LPM) algorithm is leveraged by adding a more specific route for 10.100.5.0/2410.100.5.0/24 with a next hop type of Virtual network, which directs the traffic directly over the peered connection. Lastly, the NVA's network interface in Azure must have IP forwarding enabled so that it is permitted to process and forward packets that do not originate from or terminate at its own IP address.

Step-by-Step Solution

1
Configure the NVA's NIC settings in Azure.
IP forwarding is enabled on the network interface of the NVA (10.100.1.410.100.1.4), allowing it to process and forward packets destined for other IP addresses.
By default, Azure drops traffic sent to a VM NIC if the destination IP does not match the NIC's own IP configuration.
2
Define the broader route to redirect traffic to the NVA.
A route table is created and associated with Subnet-App1. A route for 10.100.0.0/1610.100.0.0/16 is added with next hop type Virtual appliance pointing to 10.100.1.410.100.1.4.
This redirects all traffic destined for VNet-Hub to the NVA for security inspection, overriding the default system route that would send it directly via peering.
3
Define the bypass route for the database subnet.
A route for 10.100.5.0/2410.100.5.0/24 with next hop type Virtual network is added to the same route table.
Due to Azure's Longest Prefix Match (LPM) rule, traffic to 10.100.5.0/2410.100.5.0/24 matches this prefix instead of the broader 10.100.0.0/1610.100.0.0/16 prefix, directing the traffic over the peered network path directly and bypassing the NVA.

Key Concept

Azure User-Defined Routes (UDR) next hop selection, Longest Prefix Match (LPM) precedence, and NVA IP forwarding requirements.
Question 559Question →

Your company has a Hub-and-Spoke network topology in Azure. The Hub VNet (10.100.0.0/1610.100.0.0/16) hosts custom DNS servers (10.100.1.410.100.1.4 and 10.100.1.510.100.1.5) that resolve corporate DNS names and forward all other requests to the Azure recursive resolver (168.63.129.16168.63.129.16). The Spoke VNet (10.200.0.0/1610.200.0.0/16) is peered with the Hub VNet. Virtual network peering is configured to allow forward traffic, but gateway transit is disabled. You deploy a private Azure Kubernetes Service (AKS) cluster named `aks-prod` in a subnet (10.200.1.0/2410.200.1.0/24) within the Spoke VNet. You use the default option to let Azure manage the private DNS zone, which creates a zone named `privatelink.eastus.azmk8s.io` in the node resource group. Developers working on virtual machines located in the Hub VNet report that they cannot connect to the AKS cluster because the API server fully qualified domain name (FQDN) does not resolve to a private IP address. Which of the following actions should you perform to resolve the DNS resolution issue?

Show answer & explanation

Answer: Link the auto-created private DNS zone privatelink.eastus.azmk8s.io to the Hub VNet.

Answer

Link the auto-created private DNS zone privatelink.eastus.azmk8s.io to the Hub VNet.
For a private AKS cluster, the API server is exposed via a private endpoint. The FQDN resolves to a private IP within the AKS subnet using an Azure Private DNS Zone (`privatelink.eastus.azmk8s.io`). Since the custom DNS servers reside in the Hub VNet and forward unresolved queries to the Azure recursive resolver (168.63.129.16168.63.129.16), the Hub VNet must be linked to the Private DNS Zone. This allows the Azure recursive resolver to look up records in that zone when queried by the custom DNS servers in the Hub VNet.

Step-by-Step Solution

1
Identify the DNS resolution path of the client virtual machines.
VMs in the Hub VNet query the custom DNS servers (10.100.1.410.100.1.4 and 10.100.1.510.100.1.5).
Since the custom DNS servers are configured to handle DNS requests, they must be able to resolve the FQDN of the AKS private endpoint.
2
Determine how the custom DNS servers resolve external and Azure-specific names.
Unresolved queries are forwarded to the Azure recursive resolver at 168.63.129.16168.63.129.16.
The Azure recursive resolver can resolve private DNS zones linked to the VNet from which the query originates.
3
Link the Hub VNet to the private DNS zone.
The auto-created private DNS zone `privatelink.eastus.azmk8s.io` is linked to the Hub VNet.
By linking the private DNS zone to the Hub VNet, the Azure recursive resolver can resolve the private DNS records for any queries originating from the Hub VNet (including those sent by the custom DNS servers).

Key Concept

Private AKS DNS Resolution in Hub-and-Spoke Topologies
Question 560Question →

You are configuring an Azure Virtual Machine Scale Set (VMSS) named `vmss-finance` to handle a queue-based processing workload. The scale set is configured with a Flexible orchestration mode, a current instance count of 8, and a Manual upgrade policy. You need to configure a scale-in policy to ensure that when the queue depth decreases and the scale set scales in, the virtual machines that have been running the longest are deleted first. Which scale-in policy should you configure?

Show answer & explanation

Answer: OldestVM

Answer

OldestVM
The correct policy is 'OldestVM'. This policy deletes the oldest virtual machine in the scale set based on its creation time. This satisfies the requirement to delete the virtual machines that have been running the longest.

Step-by-Step Solution

1
Analyze the VMSS requirements and parameters.
The goal is to delete the virtual machines that have been running the longest (the oldest VMs) during scale-in events.
This helps clean up VMs that may have accumulated temporary state or older configurations over time.
2
Evaluate the available scale-in policies in Azure VMSS.
The three valid scale-in policies are Default, OldestVM, and NewestVM.
Azure provides these built-in policies to control which virtual machines are removed during scale-in.
3
Select the policy that targets the oldest virtual machines.
The 'OldestVM' policy aligns with the requirement, while 'Default' balances zones/fault domains first and 'NewestVM' targets the most recently created instances.
Choosing 'OldestVM' ensures that the virtual machines with the earliest creation time are deleted first.

Key Concept

Azure VMSS Scale-In Policies
PreviousPage 28 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin