All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An administrator is configuring a deployment slot named staging for an Azure App Service web app named app-finance that runs on a Standard S1 App Service plan. The web app connects to an Azure SQL database. The production slot must connect to a database named db-prod by retrieving a connection string from an Azure Key Vault named kv-prod. The staging slot must connect to a database named db-stage by retrieving a connection string from an Azure Key Vault named kv-stage. A system-assigned managed identity is enabled on both the production slot and the staging slot. The database connection string is configured in the App Service settings under the name DbConnectionString using Key Vault references. The administrator needs to configure the web app and Key Vaults to ensure that after a slot swap, the web app running in the production slot connects to db-prod and the web app running in the staging slot connects to db-stage, without any authentication failures. Which of the following configurations should the administrator implement?

Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Contributor role on the resource group containing the Key Vaults to both managed identities.

Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Secrets User role in kv-prod to the production slot's managed identity, and grant the Key Vault Secrets User role in kv-stage to the staging slot's managed identity.

Configure DbConnectionString as a deployment slot setting in both slots. Assign the Microsoft Entra ID Application Administrator role to the managed identities of both slots to allow them to read secrets from the Key Vaults.

Configure DbConnectionString as a standard (non-slot) setting in both slots, and scale down the App Service plan to the Basic B1 tier to reduce costs during testing.

Show answer & explanation

Answer: Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Secrets User role in kv-prod to the production slot's managed identity, and grant the Key Vault Secrets User role in kv-stage to the staging slot's managed identity.

Answer

The correct configuration requires marking the DbConnectionString setting as a deployment slot setting in both slots. This ensures that the setting is sticky to the slot and does not swap when the deployment slots are swapped, keeping the production slot pointing to the production Key Vault (kv-prod) and the staging slot pointing to the staging Key Vault (kv-stage). Additionally, because system-assigned managed identities are resource-specific and do not swap with the slots, the production slot's managed identity must be granted the Key Vault Secrets User role in kv-prod, and the staging slot's managed identity must be granted the Key Vault Secrets User role in kv-stage to read the secret values.

Step-by-Step Solution

Configure the DbConnectionString setting in both the production and staging slots using Key Vault references pointing to the respective Key Vault secrets.

The production slot points to the secret in kv-prod and the staging slot points to the secret in kv-stage.

Allows the App Service to securely retrieve database connection strings from Azure Key Vault without storing them in plain text.

Mark the DbConnectionString app setting as a deployment slot setting (sticky setting) in both slots.

The setting value is locked to the slot and does not swap during deployment slot swaps.

Prevents the production slot from swapping its connection string configuration with the staging slot, ensuring it always points to the production database.

Assign the Key Vault Secrets User role to the production slot's managed identity on kv-prod, and to the staging slot's managed identity on kv-stage.

Each slot's system-assigned managed identity has the required data-plane permissions to read secrets from its respective Key Vault.

System-assigned managed identities are resource-specific and sticky to their respective slots. Because they do not swap, each identity must be granted the specific permissions needed for its corresponding Key Vault.

Key Concept

Deployment slots and managed identities in Azure App Service. System-assigned managed identities are bound to the specific slot instance and do not swap, requiring separate Key Vault permissions for each slot. App settings must be configured as deployment slot settings to remain sticky during a slot swap.

Question 562Question →

An administrator is configuring a new virtual network named `vnet-prod` in an Azure subscription. The virtual network is assigned the address space $10.15.4.0/22$ . The administrator must create the following subnets:

* A subnet named `Subnet-App` to host up to $125$ virtual machines.
* A subnet to support an Azure Bastion host.
* A subnet named `GatewaySubnet` to support a VPN Gateway.

To conserve IP addresses for future expansion, the administrator wants to allocate the minimum required address space to each subnet. Which configuration of subnet prefix lengths should the administrator use?

/25

for `Subnet-App`,

/26

for `AzureBastionSubnet`, and

/29

for `GatewaySubnet`

/24

for `Subnet-App`,

/26

for `AzureBastionSubnet`, and

/29

for `GatewaySubnet`

/24

for `Subnet-App`,

/27

for `AzureBastionSubnet`, and

/29

for `GatewaySubnet`

/24

for `Subnet-App`,

/26

for `AzureBastionSubnet`, and

/30

for `GatewaySubnet`

Show answer & explanation

Answer: $/24$ for `Subnet-App`, $/26$ for `AzureBastionSubnet`, and $/29$ for `GatewaySubnet`

Answer

The configuration using

/24

for `Subnet-App`,

/26

for `AzureBastionSubnet`, and

/29

for `GatewaySubnet`.

The correct configuration uses

/24

for `Subnet-App` (providing

251

usable addresses, which accommodates the required

125

hosts after subtracting the

5

Azure reserved IP addresses),

/26

for `AzureBastionSubnet` (meeting the minimum prefix requirement of

/26

for Azure Bastion hosts), and

/29

for `GatewaySubnet` (meeting the minimum prefix requirement of

/29

for Azure VPN Gateways).

Step-by-Step Solution

Calculate the size required for `Subnet-App`.

/24

subnet prefix.

To host

125

virtual machines, the subnet must also accommodate the

5

IP addresses reserved by Azure (the first

4

and the last

1

address of the subnet). This requires a total of

125 + 5 = 130

IP addresses. A

/25

subnet provides

128

IP addresses (

123

usable), which is insufficient. A

/24

subnet provides

256

IP addresses (

251

usable), which is the minimum sufficient size.

Determine the size requirement for the Azure Bastion subnet.

/26

subnet prefix.

Azure Bastion must be deployed in a subnet named exactly `AzureBastionSubnet` and configured with a prefix length of

/26

or larger (e.g.,

/26

/25

/24

). A

/27

subnet is too small and is not supported.

Determine the size requirement for `GatewaySubnet`.

/29

subnet prefix.

The subnet used for an Azure Virtual Network Gateway must be named `GatewaySubnet`. It must have a minimum prefix length of

/29

to accommodate the gateway instances and Azure's

5

reserved IPs. A

/30

subnet is invalid as it only contains

4

total IP addresses.

Key Concept

Azure Virtual Network subnet sizing constraints, Azure reserved IP addresses, and specific subnet size requirements for Azure Bastion and VPN Gateways.

Question 563Question →

An administrator is planning the subnet topology for a new virtual network named `VNet-Prod` in an Azure subscription. `VNet-Prod` is assigned the address space $10.150.16.0/20$ .

The administrator must configure the following subnets within `VNet-Prod` to support a hybrid application deployment:
- A subnet for a virtual network gateway to enable hybrid connectivity with an on-premises network. This subnet must use the smallest valid address space allowed by Azure.
- A subnet for Azure Bastion to enable secure administrative access. This subnet must use the smallest valid address space allowed by Azure.
- A subnet named `Subnet-Compute` that must host up to $124$ virtual machines.
- A subnet named `Subnet-Database` that must host up to $27$ database instances.

The administrator wants to define these subnets sequentially starting from the beginning of the `VNet-Prod` address space ( $10.150.16.0/20$ ), minimizing unallocated address space, and ensuring that no subnets overlap.

Which of the following subnet configurations should the administrator select?

GatewaySubnet:

10.150.16.0/29

; AzureBastionSubnet:

10.150.16.64/26

; Subnet-Database:

10.150.16.128/27

; Subnet-Compute:

10.150.17.0/24

GatewaySubnet:

10.150.16.0/29

; AzureBastionSubnet:

10.150.16.64/26

; Subnet-Compute:

10.150.16.128/25

; Subnet-Database:

10.150.17.0/27

GatewaySubnet:

10.150.16.0/29

; AzureBastionSubnet:

10.150.16.8/27

; Subnet-Database:

10.150.16.64/27

; Subnet-Compute:

10.150.17.0/24

GatewaySubnet:

10.150.16.0/30

; AzureBastionSubnet:

10.150.16.64/26

; Subnet-Database:

10.150.16.128/27

; Subnet-Compute:

10.150.17.0/24

Show answer & explanation

Answer: GatewaySubnet: $10.150.16.0/29$ ; AzureBastionSubnet: $10.150.16.64/26$ ; Subnet-Database: $10.150.16.128/27$ ; Subnet-Compute: $10.150.17.0/24$

Answer

GatewaySubnet: 10.150.16.0/29; AzureBastionSubnet: 10.150.16.64/26; Subnet-Database: 10.150.16.128/27; Subnet-Compute: 10.150.17.0/24

The correct configuration uses the smallest valid subnet masks that meet Azure requirements and host counts, while respecting subnet alignment boundaries. Specifically, the gateway subnet uses a /29 prefix (the minimum size for a GatewaySubnet), the Azure Bastion subnet uses a /26 prefix (the minimum size for AzureBastionSubnet), the database subnet uses a /27 prefix (which provides exactly the 32 addresses required for 27 databases plus 5 Azure-reserved IPs), and the compute subnet uses a /24 prefix (since 124 VMs plus 5 reserved IPs equals 129 IPs, which exceeds the 128-address limit of a /25 prefix). All blocks are aligned on their respective mathematical boundaries (multiples of their sizes), resulting in a valid and non-overlapping configuration.

Step-by-Step Solution

Determine the minimum prefix sizes required for Azure infrastructure subnets.

GatewaySubnet requires a minimum prefix of /29. AzureBastionSubnet requires a minimum prefix of /26.

Azure enforces these minimum size requirements for gateway and bastion deployments to ensure sufficient IP space for internal routing and scaling.

Calculate the minimum prefix sizes for application and database subnets, accounting for Azure-reserved IP addresses.

Subnet-Compute requires a /24 prefix (124 VMs + 5 reserved = 129 IPs, which exceeds the 128-address limit of a /25). Subnet-Database requires a /27 prefix (27 databases + 5 reserved = 32 IPs, which fits exactly in a /27).

Azure reserves 5 IP addresses per subnet (the first 4 and the last 1). These must be added to the workload host count to determine the minimum valid subnet block size.

Align the subnets sequentially on their respective binary boundaries starting from 10.150.16.0.

GatewaySubnet occupies 10.150.16.0/29 (10.150.16.0 - 10.150.16.7). AzureBastionSubnet is a /26 block and must start on a multiple of 64, which is 10.150.16.64/26 (10.150.16.64 - 10.150.16.127). Subnet-Database is a /27 block and must start on a multiple of 32, which is 10.150.16.128/27 (10.150.16.128 - 10.150.16.159). Subnet-Compute is a /24 block and must start on a /24 boundary (where the fourth octet is 0), which is 10.150.17.0/24 (10.150.17.0 - 10.150.17.255).

Classless Inter-Domain Routing (CIDR) requires subnets to start on addresses that are multiples of their block sizes. This alignment prevents overlap and ensures routing validity.

Key Concept

Azure-specific subnet sizing requirements combined with standard CIDR boundary alignment rules.

Estimated Time:3m 0s

Question 564Question →

An administrator is planning the deployment of several Azure virtual machines to meet specific application requirements. Match each virtual machine deployment requirement on the left to the appropriate Azure configuration feature on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Configure a virtual machine during deployment to automatically download and execute a bash script stored in an Azure Storage account matches with Custom Script Extension. Group multiple virtual machines physically close to each other within a region to achieve the lowest possible network latency matches with Proximity Placement Group. Configure a virtual machine to support the attachment of high-performance storage that guarantees sub-millisecond latency matches with Ultra Disk compatibility. Configure a virtual machine to support Intel Software Guard Extensions (SGX) secure enclaves and boot volumes larger than

2\text{ TB}

matches with Generation 2 architecture.

The correct matches align each specific deployment need to the feature designed for that purpose: Custom Script Extension for bootstrapping code execution, Proximity Placement Groups for physical proximity/low latency, Ultra Disk compatibility for enabling high-performance storage, and Generation 2 architecture for advanced hardware capabilities.

Step-by-Step Solution

Analyze the post-deployment script execution requirement.

Matched with Custom Script Extension.

Azure Custom Script Extension allows for bootstrap configuration by executing custom scripts immediately after VM provisioning.

Analyze the network latency minimization requirement.

Matched with Proximity Placement Group.

A Proximity Placement Group ensures that VMs are deployed in the same physical datacenter to minimize latency.

Analyze the sub-millisecond storage requirement.

Matched with Ultra Disk compatibility.

Ultra Disks provide sub-millisecond latencies but require the VM to have Ultra Disk compatibility enabled.

Analyze the Intel SGX and larger boot volume requirement.

Matched with Generation 2 architecture.

Generation 2 VMs support modern features like UEFI boot, larger OS disks, and Intel SGX confidential computing, which are unsupported on Generation 1.

Key Concept

Azure Virtual Machine creation configurations, including extensions, hardware generation features, storage support, and placement groups.

Question 565Question →

You are managing an Azure environment in the East US region. You have an Azure Virtual Machine named VM-Mgmt that has a single network interface named nic-mgmt. Currently, nic-mgmt has a primary IP configuration named ipconfig1, which is a member of the backend pool of a Standard SKU public load balancer named LB-Prod. To facilitate direct administration, you need to assign a new public IP address named PIP-Mgmt directly to ipconfig1. All resources are located in the East US region. Which SKU and allocation method must you configure for PIP-Mgmt?

Basic SKU and Static allocation

Standard SKU and Dynamic allocation

Standard SKU and Static allocation

Basic SKU and Dynamic allocation

Show answer & explanation

Answer: Standard SKU and Static allocation

Answer

Standard SKU and Static allocation

The correct configuration is Standard SKU and Static allocation. When a virtual machine's network interface is associated with the backend pool of a Standard SKU load balancer, any public IP address directly assigned to that network interface must also be a Standard SKU public IP to maintain SKU compatibility. Furthermore, Standard SKU public IP addresses in Azure only support Static allocation.

Step-by-Step Solution

Identify the SKU of the load balancer associated with the virtual machine's network interface.

The load balancer (LB-Prod) is a Standard SKU load balancer.

Azure requires SKU matching between a load balancer and any public IP addresses associated with resources in its backend pool.

Determine the required SKU for the public IP address (PIP-Mgmt).

PIP-Mgmt must be configured with the Standard SKU.

Associating a Basic SKU public IP with a network interface in a Standard Load Balancer backend pool is not supported.

Determine the allocation method for the Standard SKU public IP address.

The allocation method must be set to Static.

Standard SKU public IP addresses in Azure only support Static IP address allocation.

Key Concept

Standard SKU Public IP allocation and SKU matching with Standard Load Balancer backend pools

Estimated Time:2m 0s

Question 566Question →

An administrator is deploying a new Azure Kubernetes Service (AKS) cluster in an environment with an existing virtual network ( $10.100.0.0/16$ ). To comply with a tenant security mandate, traffic from Pods to on-premises databases must not undergo network address translation (NAT), and each Pod must be assigned a unique, routable IP address from the virtual network subnet ( $10.100.1.0/24$ ). Which network model should the administrator configure for the AKS cluster?

Azure CNI

Kubenet

Azure Private Link

Virtual Network NAT

Show answer & explanation

Answer: Azure CNI

Answer

Azure CNI

The correct answer is Azure CNI. Under this model, every Pod gets an IP address from the subnet and can be accessed directly. This avoids network address translation (NAT) for outbound traffic from the node to the rest of the virtual network or on-premises networks.

Step-by-Step Solution

Analyze the requirement for Pod IP allocation and NAT.

Pods must receive IP addresses directly from the virtual network subnet and must not use NAT to communicate with external resources.

This is a direct feature of the Azure CNI network model, whereas Kubenet uses NAT for outbound node traffic.

Identify the network plugin that supports direct subnet IP allocation.

Azure CNI allocates IPs to Pods from the subnet, whereas Kubenet allocates IPs from a logical private range.

Choosing Azure CNI satisfies both the no-NAT requirement and the direct subnet IP assignment requirement.

Key Concept

Azure CNI assigns IP addresses from the subnet directly to the Pods, avoiding NAT for communication with other resources in the virtual network.

Estimated Time:1m 0s

Question 567Question →

An administrator configures a Network Security Group (NSG) associated with a subnet. The subnet contains two virtual machines: `VM-Web` (associated with Application Security Group `ASG-Web`) and `VM-DB` (associated with `ASG-DB`).

The NSG has the following inbound security rules:

Rule	Priority	Source	Destination	Port	Protocol	Action
Rule 1	$100$	ASG-Web	ASG-DB	$1433$	TCP	Allow
Rule 2	$200$	Any	ASG-DB	$1433$	TCP	Deny

Which two of the following statements correctly describe how traffic is processed by these rules?

Select all that apply

TCP traffic on port

1433

from `VM-Web` to `VM-DB` is allowed.

TCP traffic on port

1433

from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.

TCP traffic on port

1433

from `VM-Web` to `VM-DB` is denied because Rule 2 has a higher priority number.

TCP traffic on port

1433

from all virtual machines to `VM-DB` is denied because Rule 2 is evaluated first.

Show answer & explanation

Answer: TCP traffic on port $1433$ from `VM-Web` to `VM-DB` is allowed.; TCP traffic on port $1433$ from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.

Answer

TCP traffic on port

1433

from `VM-Web` to `VM-DB` is allowed, and TCP traffic on port

1433

from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.

TCP traffic on port

1433

from `VM-Web` to `VM-DB` is allowed because Rule 1 (priority

100

) is evaluated first and matches the source and destination ASGs. For virtual machines not in `ASG-Web`, Rule 1 does not match, meaning evaluation falls through to Rule 2 (priority

200

), which explicitly denies all inbound TCP traffic on port

1433

to `ASG-DB`.

Step-by-Step Solution

Determine the evaluation order of the NSG rules based on priority.

Rule 1 (priority

100

) is evaluated before Rule 2 (priority

200

Azure NSGs process rules sequentially starting from the lowest priority number.

Evaluate traffic originating from `VM-Web` to `VM-DB` on port

1433

The traffic matches Rule 1 because the source `VM-Web` is in `ASG-Web` and the destination `VM-DB` is in `ASG-DB`. The action is Allow.

Once a rule matches, no further rules are evaluated for that traffic.

Evaluate traffic originating from other virtual machines to `VM-DB` on port

1433

The traffic does not match Rule 1. It is then evaluated against Rule 2, which matches the source as Any and denies the traffic.

If a rule does not match, processing continues to the next priority rule.

Key Concept

Network Security Group rules are evaluated in order of priority (lowest number first). Once a rule matches, evaluation stops. Application Security Groups allow rules to be scoped to specific groups of VMs.

Question 568Question →

You have a Network Security Group (NSG) associated with an Azure subnet. The NSG contains the following two inbound security rules:

* `Rule1`: Priority $200$ , Source: `Internet`, Destination: `*`, Port: $3389$ , Protocol: `TCP`, Action: `Deny`
* `Rule2`: Priority $150$ , Source: `Internet`, Destination: `*`, Port: $3389$ , Protocol: `TCP`, Action: `Allow`

A user attempts to establish a Remote Desktop Protocol (RDP) connection from the Internet to a virtual machine in the subnet. Which of the following describes the outcome of this connection attempt?

Blocked, because Deny rules always override Allow rules in Network Security Groups

Allowed, because the rule with priority

150

is processed before the rule with priority

200

Blocked, because the rule with priority

200

is processed before the rule with priority

150

Allowed, because default inbound rules permit RDP traffic from the Internet

Show answer & explanation

Answer: Allowed, because the rule with priority $150$ is processed before the rule with priority $200$

Answer

The connection is allowed because the rule with priority

150

is evaluated before the rule with priority

200

, and it permits the traffic.

In Azure Network Security Groups (NSGs), security rules are processed in priority order, where lower numbers have higher precedence. When traffic matches a rule, processing stops. Because the rule with priority

150

(Allow) is lower than the rule with priority

200

(Deny), the Allow rule is evaluated first and the traffic is permitted.

Step-by-Step Solution

Identify the priority numbers of the matching rules.

Rule 1 has a priority of

200

, and Rule 2 has a priority of

150

NSG rules are evaluated in order of priority.

Determine which rule takes precedence based on the priority numbers.

Rule 2 (priority

150

) takes precedence over Rule 1 (priority

200

) because a lower number indicates higher priority.

In Azure NSGs, lower priority numbers have higher precedence.

Apply the action of the rule with the highest precedence.

The traffic is allowed because Rule 2's action is Allow.

Once a rule matches the traffic, that rule is applied and subsequent rules are not evaluated.

Key Concept

Azure NSG rule processing order is based on priority numbers, where smaller numbers have higher priority.

Question 569Question →

An administrator has uploaded a private PFX SSL certificate to an Azure App Service web app. The administrator now needs to configure the custom domain www.contoso.com for the web app and secure it using the uploaded certificate.

Which three actions should the administrator perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure the custom domain and secure it with the uploaded certificate, first create a CNAME record pointing the custom domain to the App Service default domain. Next, add the custom domain to the App Service. Finally, create an SNI SSL binding for the custom domain using the uploaded certificate.

To configure a custom domain and secure it, the DNS record must be created first to pass the Azure ownership verification check. Once the domain is added, the SSL binding can be created to link the domain with the uploaded PFX certificate.

Step-by-Step Solution

Create a CNAME record in the DNS registrar's zone pointing the custom domain to the App Service default domain.

Domain ownership validation requirement is satisfied.

Azure requires validation of domain ownership before a custom domain can be added to the App Service.

Add the custom domain to the App Service.

The custom domain is registered and mapped to the App Service.

The hostname must be registered with the App Service before SSL bindings can be applied to it.

Create an SNI SSL binding for the custom domain using the uploaded certificate.

HTTPS traffic to the custom domain is secured with the PFX certificate.

Binds the certificate to the custom domain to enable HTTPS encryption.

Key Concept

Configuring custom domains and SSL bindings in Azure App Services.

Estimated Time:2m 0s

Question 570Question →

Your company has an on-premises Windows Server named FileServer-West1 that has a single volume E: with a total capacity of 2 TB (2,000 GB). You implement Azure File Sync to synchronize volume E: with an Azure file share.

You need to configure Azure File Sync cloud tiering to meet the following requirements:
* A minimum of 400 GB of free space must always be maintained on volume E:.
* Files that have not been accessed or modified within the last 14 days must be cached in the cloud, provided the volume free space target is not compromised.

How should you configure the cloud tiering settings on the server endpoint?

Enable cloud tiering, set the Volume Free Space policy to 20%, and enable the Date policy set to 14 days.

Enable cloud tiering, set the Volume Free Space policy to 400 GB, and enable the Date policy set to 14 days.

Configure an Azure Blob Storage Lifecycle Management policy on the destination storage account to tier files to the Cool tier after 14 days of inactivity.

Enable cloud tiering on the server endpoint, assign the Storage File Data Privileged Reader role to the registered server, and generate a SAS token with a 14-day expiration.

Show answer & explanation

Answer: Enable cloud tiering, set the Volume Free Space policy to 20%, and enable the Date policy set to 14 days.

Answer

Enable cloud tiering, set the Volume Free Space policy to 20%, and enable the Date policy set to 14 days.

The correct configuration requires enabling cloud tiering on the server endpoint, setting the Volume Free Space policy to 20% (since 400 GB is 20% of the 2 TB volume capacity), and enabling the Date policy set to 14 days. When both policies are enabled, the Volume Free Space policy takes precedence to ensure that the specified local volume free space is maintained.

Step-by-Step Solution

Calculate the required Volume Free Space percentage.

The target free space is 400 GB out of a total volume capacity of 2 TB (2,000 GB). The percentage is calculated as follows:

\frac{400\text{ GB}}{2000\text{ GB}} \times 100\% = 20\%

Note that Azure File Sync cloud tiering requires specifying the free space as a percentage.

Azure File Sync cloud tiering's Volume Free Space policy is defined as a percentage from 0% to 100% of the volume's total capacity.

Determine the configuration of the Date policy.

The Date policy must be enabled and set to 14 days.

This policy tiers files that have not been accessed or modified within the specified number of days to the cloud, as long as the Volume Free Space policy threshold is not violated.

Configure the server endpoint settings.

Apply the cloud tiering configuration directly to the server endpoint.

Azure File Sync cloud tiering policies are configured at the server endpoint level within the Storage Sync Service.

Key Concept

Azure File Sync cloud tiering policies (Volume Free Space and Date policies)

Estimated Time:1m 30s

Question 571Question →

An administrator is configuring a daily database backup utility using Azure Container Instances (ACI). The utility consists of a single container that connects to a database, exports the data, uploads it to an Azure Blob Storage container, and then terminates.

The backup script is designed to return an exit code of $0$ on success, and a non-zero exit code if the upload fails due to transient network issues. If the upload fails, the utility must automatically attempt to rerun the backup. To avoid unnecessary costs, the container must not run after a successful backup.

The administrator deploys the container instance using the default configuration settings. However, they notice that the container group continuously restarts and runs the backup script in an infinite loop, even when the upload succeeds.

Which of the following modifications should the administrator make to achieve the desired behavior?

Change the restart policy of the container group to OnFailure

Change the restart policy of the container group to Never

Configure a container lifecycle hook to stop the container group after the backup script exits

Deploy the container group inside a virtual network and configure a custom route table to terminate the connection

Show answer & explanation

Answer: Change the restart policy of the container group to OnFailure

Answer

Change the restart policy of the container group to OnFailure

By default, Azure Container Instances (ACI) deploys container groups with a restart policy of 'Always'. This causes the container to restart indefinitely, regardless of its exit code. Changing the restart policy to 'OnFailure' ensures the container group will automatically restart if the backup script fails (returns a non-zero exit code) and will stop running (terminating the container group) once it completes successfully (returns an exit code of 0).

Step-by-Step Solution

Identify the default restart policy of Azure Container Instances.

By default, ACI container groups are deployed with a restart policy of 'Always'.

This explains why the container group enters an infinite loop, running the script repeatedly even after returning an exit code of 0.

Analyze the requirements for container execution and termination.

The container must stop on successful completion (exit code 0) but must restart if it fails (non-zero exit code).

This narrows down the required restart policy to one that distinguishes between success and failure exit codes.

Determine the correct restart policy to apply.

The 'OnFailure' restart policy restarts containers only when they fail, and transitions the group to a terminated state upon successful completion.

This satisfies both requirements of stopping on success and retrying on failure.

Key Concept

Restart policies control the lifecycle and automatic restart behavior of container groups in Azure Container Instances.

Question 572Question →

An administrator is configuring an Azure Virtual Machine named VM-App1. The virtual machine has a single network interface named nic-app1. The primary IP configuration (ipconfig1) of nic-app1 has a private IP address and is associated with a Standard SKU public IP address named PIP1. The administrator needs to add a secondary IP configuration (ipconfig2) to nic-app1. The secondary configuration requires its own public IP address named PIP2. Which configuration must be selected for PIP2?

Standard SKU and Static allocation

Standard SKU and Dynamic allocation

Basic SKU and Static allocation

Basic SKU and Dynamic allocation

Show answer & explanation

Answer: Standard SKU and Static allocation

Answer

Standard SKU and Static allocation

The correct configuration is Standard SKU and Static allocation. Azure requires all public IP addresses associated with a single network interface to use the same SKU. Since the primary public IP address (PIP1) uses the Standard SKU, the secondary public IP address (PIP2) must also use the Standard SKU. Furthermore, Standard SKU public IP addresses only support Static allocation, whereas Basic SKU public IP addresses support both Static and Dynamic allocation.

Step-by-Step Solution

Analyze the SKU of the existing public IP address associated with the network interface.

The existing public IP address (PIP1) is a Standard SKU public IP.

Azure enforces SKU consistency on a single network interface, meaning all public IP configurations must use the same SKU.

Determine the required SKU for the new public IP address (PIP2).

PIP2 must be created with the Standard SKU.

Mixing Standard and Basic SKU public IPs on the same network interface is not supported.

Determine the supported allocation method for the Standard SKU public IP address.

The allocation method must be set to Static.

Standard SKU public IP addresses in Azure only support Static allocation and do not support Dynamic allocation.

Key Concept

SKU alignment and allocation rules for multiple Public IP addresses on a single network interface

Question 573Question →

An organization has an Azure resource hierarchy consisting of a management group named MG-Finance and two child subscriptions named Sub-Billing and Sub-Reporting.

An administrator creates an Azure Policy initiative named Finance-Compliance-Initiative that contains the following policy definitions:
- A policy that restricts storage account creation to the East US region (Effect: Deny).
- A policy that requires secure transfer (HTTPS) to be enabled for all storage accounts (Effect: Deny).

The administrator assigns Finance-Compliance-Initiative to MG-Finance and adds Sub-Reporting to the exclusion list of the assignment.

The administrator then attempts to perform the following operations:
- Operation A: In Sub-Billing, create a storage account in the West US region with HTTPS enabled.
- Operation B: In Sub-Reporting, create a storage account in the West US region with HTTPS disabled.

Which of the following describes the outcome of these operations?

Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.

Both Operation A and Operation B are blocked because policy exclusions assigned to initiatives do not override location restrictions.

Operation A succeeds because secure transfer is enabled, but Operation B is blocked because it violates the secure transfer policy.

Both Operation A and Operation B are allowed, but the storage account created in Operation B is flagged as non-compliant because the secure transfer policy uses an Audit effect by default.

Show answer & explanation

Answer: Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.

Answer

Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.

The correct option is that Operation A is blocked due to the location policy, and Operation B succeeds. Azure Policy evaluates assignments down the resource hierarchy. Because the initiative is assigned to the management group, it inherits to child subscriptions. However, because Sub-Reporting is explicitly excluded, none of the policies apply to Operation B, allowing the storage account to be created. Sub-Billing is not excluded, so its resource creation (Operation A) is evaluated. Even though secure transfer is enabled, the location (West US) violates the allowed locations policy, and the Deny effect prevents the creation.

Step-by-Step Solution

Identify the scope of the policy initiative assignment and inheritance.

The initiative is assigned at MG-Finance, which covers child subscriptions Sub-Billing and Sub-Reporting by inheritance.

Understanding scope helps determine which resources are subject to policy evaluation.

Apply the exclusion configuration to the inheritance path.

Sub-Reporting is excluded, meaning no policies in the initiative apply to it. Sub-Billing remains fully subject to the policies.

Exclusions bypass policy evaluation for the designated scope.

Evaluate Operation A against the active policies in Sub-Billing.

The location is West US, which violates the 'East US only' allowed locations policy. Because the policy effect is Deny, the operation is blocked.

A Deny effect blocks the resource creation immediately if any policy rule in the assignment is violated.

Evaluate Operation B against the active policies in Sub-Reporting.

Since Sub-Reporting is excluded from the assignment, the policies are not evaluated, allowing the operation to succeed.

Excluding a scope prevents any actions from being blocked or audited by the assignment.

Key Concept

Azure Policy scopes, exclusions, inheritance, and the Deny effect.

Question 574Question →

An organization is deploying Azure File Sync to synchronize files from an on-premises Windows Server named NY-FS01 to an Azure file share. The destination file share is hosted in a storage account named stsyncdata which has its firewall configured to restrict network access to 'Selected networks'. The organization's security policy prohibits exposing storage traffic to the public internet. Which of the following actions should you perform to enable successful file synchronization while adhering to the security policy?

Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.

Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account stsyncdata.

Generate a Shared Access Signature (SAS) token on the storage account stsyncdata with a 365-day expiration and configure the Azure File Sync agent to authenticate using this token.

Assign the 'Storage File Data SMB Share Contributor' role in Microsoft Entra ID to the on-premises server's computer identity.

Show answer & explanation

Answer: Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.

Answer

Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.

Configuring a private endpoint for the file sub-resource of the storage account allows the on-premises sync agent to transfer files over a private IP address using VPN or ExpressRoute. This satisfies the 'Selected networks' firewall constraint without exposing the storage account's endpoints to the public internet.

Step-by-Step Solution

Determine the network path requirements for the Azure File Sync agent.

Identify that the agent must communicate with the Storage Sync Service and the Storage Account directly to upload/download data.

Although the Storage Sync Service orchestrates the sync topology, data plane traffic goes directly to the Azure File share endpoint in the storage account.

Evaluate the network security constraints of the storage account.

Recognize that because the storage account firewall is set to 'Selected networks', public internet connections from the on-premises server will be blocked.

An on-premises server is treated as an untrusted public source by default under 'Selected networks' rules.

Identify the private networking solution that meets the security policy.

Implement a private endpoint for the file sub-resource of the storage account, allowing traffic to transit privately via VPN or ExpressRoute.

A private endpoint maps a private IP address from a virtual network to the storage account, keeping the sync traffic within the private network boundary.

Key Concept

Secure network connectivity for Azure File Sync and Azure Files using private endpoints

Estimated Time:1m 30s

Question 575Question →

An administrator needs to configure temporary access for a partner application to download blobs from a container named incoming-transfers in an Azure Storage account named partnerdataretrieval. The access configuration must meet the following security requirements:
- The partner application must only connect from the public IP address 198.51.100.55.
- The connection must be restricted to HTTPS.
- Access must automatically expire after 8 hours.
- The administrator must be able to revoke this access immediately before the 8-hour period expires without affecting other active SAS tokens or rotating the storage account access keys.

Which two actions should the administrator perform to meet these requirements?

Select all that apply

Create a stored access policy on the incoming-transfers container.

Generate a Service SAS for the container that references the stored access policy, specifying the allowed IP address and requiring HTTPS.

Assign the Reader Azure RBAC role to the partner application at the resource group level.

Generate an Account SAS that specifies the allowed IP address, HTTPS protocol, and expiration time.

Show answer & explanation

Answer: Create a stored access policy on the incoming-transfers container.; Generate a Service SAS for the container that references the stored access policy, specifying the allowed IP address and requiring HTTPS.

Answer

Create a stored access policy on the container and generate a Service SAS for the container that references the stored access policy while specifying the allowed IP address and requiring HTTPS.

To support immediate revocation of the Shared Access Signature (SAS) without affecting other tokens, you must associate the SAS with a stored access policy on the container. A Service SAS supports association with stored access policies, allowing revocation by simply deleting or modifying the policy. The specific constraints for the client IP address and HTTPS protocol are specified when generating the SAS token.

Step-by-Step Solution

Determine the type of SAS required for immediate revocation without key rotation.

Identify that a Service SAS is required because it supports stored access policies, whereas an Account SAS does not.

Stored access policies allow immediate revocation by deleting or changing the policy, which meets the security requirement.

Create the stored access policy on the target container.

A stored access policy is created directly on the incoming-transfers container.

Stored access policies are defined at the container or resource level, not at the storage account level.

Generate the Service SAS token referencing the policy and applying network/protocol constraints.

The Service SAS is generated with the client IP address restricted to 198.51.100.55 and protocol restricted to HTTPS.

Constraints like allowed IP addresses and protocols must be defined on the SAS token itself during generation.

Key Concept

Manage Storage Access Keys and Shared Access Signatures (SAS)

Question 576Question →

An administrator is configuring an Azure Virtual Machine Scale Set (VMSS) named VMSS1 that uses Uniform orchestration. VMSS1 currently has five instances running a web application, and the upgrade policy is set to Manual. You need to configure VMSS1 to meet the following requirements:
- When a new version of the OS image is published, the instances must be updated automatically in batches to prevent application downtime.
- VMSS1 must scale out by two instances when the average CPU utilization exceeds $80\%$ for 10 minutes.
- VMSS1 must scale in by one instance when CPU utilization drops, but you must prevent rapid scaling loops (thrashing).

Which two configuration settings should you implement? (Select two.)

Select all that apply

Change the upgrade policy of VMSS1 to Rolling.

Change the upgrade policy of VMSS1 to Automatic.

Configure a scale-in rule with an average CPU threshold of

30\%

and a cooldown period of 10 minutes.

Configure a scale-in rule with an average CPU threshold of

75\%

and a cooldown period of 1 minute.

Show answer & explanation

Answer: Change the upgrade policy of VMSS1 to Rolling.; Configure a scale-in rule with an average CPU threshold of $30\%$ and a cooldown period of 10 minutes.

Answer

To configure the scale set correctly, you must change the upgrade policy to Rolling to ensure updates occur in batches without causing application downtime, and configure a scale-in rule with a low CPU threshold (such as

30\%

) and an adequate cooldown period (such as 10 minutes) to prevent instance thrashing.

The Rolling upgrade policy updates instances in batches, which prevents downtime by keeping a subset of instances online. To prevent instance thrashing, the scale-in metric threshold must be set significantly lower than the scale-out threshold, and the cooldown period must be long enough to let the system stabilize after scaling actions.

Step-by-Step Solution

Select the appropriate upgrade policy for batch updates.

The Rolling upgrade policy is chosen, as it updates instances in sequential batches rather than all at once.

This maintains application availability during image upgrades.

Determine the scale-in CPU threshold and cooldown window to prevent thrashing.

A threshold of

30\%

CPU utilization with a 10-minute cooldown is selected.

This leaves a wide margin between scale-out (

80\%

) and scale-in (

30\%

), giving the new instances time to boot and handle load before another scaling decision is made, preventing rapid scale-up/scale-down cycles.

Key Concept

Configuring Virtual Machine Scale Set upgrade policies and preventing autoscale thrashing.

Question 577Question →

An organization configures the External Collaboration settings for their Microsoft Entra ID tenant as follows:
- Guest user access: Guest users have limited access to properties and memberships of directory objects
- Guest invite settings: Only users assigned to specific admin roles can invite guest users

The tenant has the following users:
- User1: Assigned the User Administrator role at the tenant level in Microsoft Entra ID.
- User2: Assigned the Owner role at the subscription level for the Azure subscription linked to the tenant.
- User3: A guest user who has been assigned the Guest Inviter role in Microsoft Entra ID.
- User4: Assigned the User Administrator role scoped to a specific Administrative Unit within the tenant.

Which users can invite external guest users to the tenant?

User1 and User3 only

User1, User2, and User3 only

User1, User3, and User4 only

User1, User3, and any member of a dynamic group that is assigned the Guest Inviter role

Show answer & explanation

Answer: User1 and User3 only

Answer

User1 and User3 only

The correct answer is the option containing User1 and User3 only. In Microsoft Entra ID, when the guest invite settings are restricted to specific administrative roles, the permitted roles by default include Global Administrator, User Administrator, and Guest Inviter. User1 is a tenant-level User Administrator, and User3 has the Guest Inviter role, which allows them to invite guests even though User3 is a guest user. User2 has subscription-level Owner permissions, which is an Azure RBAC role and does not grant Microsoft Entra ID directory permissions. User4 is scoped to an Administrative Unit, which limits their administrative actions to that unit and does not allow them to perform tenant-level actions like inviting guest users. Finally, dynamic groups cannot be assigned directory roles, making that configuration invalid.

Step-by-Step Solution

Identify the Entra ID tenant-level roles that are permitted to invite guest users when guest invite settings are restricted to specific admin roles.

The permitted roles include Global Administrator, User Administrator, Directory Writers, and Guest Inviter.

This establishes the baseline of directory-level permissions required for guest invitation under the restricted policy.

Evaluate each user's permissions and scope against the permitted roles.

User1 holds the tenant-wide User Administrator role (permitted). User2 holds a subscription-level RBAC role, which does not grant Entra ID directory permissions (not permitted). User3 holds the Guest Inviter role (permitted). User4 is scoped to an Administrative Unit, which prevents tenant-wide actions like inviting guest users (not permitted).

This determines which of the individual users are capable of inviting guests based on their role and scope.

Evaluate the group assignment option for dynamic groups.

Entra ID roles cannot be assigned to dynamic groups; they can only be assigned to role-assignable groups with assigned membership.

This rules out the possibility of assigning the Guest Inviter role to a dynamic group.

Key Concept

Microsoft Entra ID External Collaboration settings control guest invitation rights. When restricted to specific admin roles, only tenant-wide administrative roles (such as User Administrator and Guest Inviter) are authorized. Azure RBAC roles do not grant these directory rights, and Administrative Unit scopes restrict directory administrators from performing tenant-wide operations.

Question 578Question →

Your company plans to deploy a new Azure virtual network named `VNet-Core` in an Azure subscription. The virtual network will be assigned the address space ` $172.16.0.0/22$ .

You need to configure the following three subnets within `VNet-Core`:
- A subnet for a VPN gateway named `GatewaySubnet`.
- A subnet for Azure Bastion named `AzureBastionSubnet`.
- A subnet named `Subnet-App` that must support at least $58$ virtual machines.

Which two of the following subnet configurations should you implement? (Select two.)

Select all that apply

`GatewaySubnet` using the address range `

172.16.0.0/30

`AzureBastionSubnet` using the address range `

172.16.1.0/27

`Subnet-App` using the address range `

172.16.2.0/27

`Subnet-App` using the address range `

172.16.2.0/26

`AzureBastionSubnet` using the address range `

172.16.3.0/26

Show answer & explanation

Answer: `Subnet-App` using the address range ` $172.16.2.0/26$ `; `AzureBastionSubnet` using the address range ` $172.16.3.0/26$ `

Answer

The correct subnet configurations are Subnet-App using the address range 172.16.2.0/26 and AzureBastionSubnet using the address range 172.16.3.0/26.

The correct configurations are the workload subnet Subnet-App using the 172.16.2.0/26 address space and the AzureBastionSubnet using the 172.16.3.0/26 address space. Subnet-App requires 58 usable IP addresses. A /26 subnet provides 64 total addresses, leaving 59 usable after Azure's 5 reserved IP addresses are subtracted, which is sufficient. AzureBastionSubnet requires a prefix of at least /26, which is satisfied by 172.16.3.0/26.

Step-by-Step Solution

Calculate the minimum prefix size required for Subnet-App to support at least

58

virtual machines.

/26

prefix is required.

Azure reserves

5

IP addresses in every subnet (the first four and the last one). For

58

virtual machines, the subnet must have a total capacity of at least

58 + 5 = 63

IP addresses. A

/27

subnet provides only

32

total addresses (

32 - 5 = 27

usable), whereas a

/26

subnet provides

64

total addresses (

64 - 5 = 59

usable), which meets the requirement.

Determine the prefix size requirement for AzureBastionSubnet.

A prefix size of

/26

or larger is required.

Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a prefix size of at least

/26

(e.g.,

/26

/25

, etc.) to accommodate its scale-out instances. A prefix of

/27

is invalid.

Determine the prefix size requirement for GatewaySubnet.

A prefix size of

/29

or larger is required.

The VPN Gateway requires a subnet named exactly `GatewaySubnet` with a prefix size of at least

/29

. A prefix of

/30

is invalid and has zero usable IP addresses after accounting for the

5

reserved IPs.

Verify that the chosen correct subnet address ranges do not overlap and fit within the VNet address space.

The subnet ranges `172.16.2.0/26` and `172.16.3.0/26` do not overlap and both reside within the `172.16.0.0/22` address space.

The `172.16.0.0/22` address space covers `172.16.0.0` through `172.16.3.255`. The subnets `172.16.2.0/26` (covering `172.16.2.0` to `172.16.2.63`) and `172.16.3.0/26` (covering `172.16.3.0` to `172.16.3.63`) are distinct and valid.

Key Concept

Azure virtual networks reserve five IP addresses in every subnet (first four and the last one). Dedicated subnets like GatewaySubnet (minimum /29) and AzureBastionSubnet (minimum /26) have strict prefix size constraints.

Estimated Time:2m 30s

Question 579Question →

An administrator is planning the deployment of a critical web application to Azure App Service. The application has the following hosting requirements:
- Must automatically scale out up to $12$ instances during periods of high CPU utilization.
- Must support at least $2$ deployment slots to enable zero-downtime deployments.
- Must minimize overall hosting costs.

Which App Service plan pricing tier should you select to meet these requirements?

Standard (S1)

Premium v3 (P1v3)

Basic (B1)

Isolated v2 (I1v2)

Show answer & explanation

Answer: Premium v3 (P1v3)

Answer

Premium v3 (P1v3)

The Premium v3 (P1v3) pricing tier is correct because it supports automatic scale-out up to

30

instances (meeting the

12

instances requirement) and supports up to

20

staging slots (meeting the

2

slots requirement), while being the most cost-effective option that satisfies all criteria.

Step-by-Step Solution

Evaluate the scaling requirements against the instance limits of the App Service plan tiers.

Basic (B1) supports up to

3

instances (manual only). Standard (S1) supports up to

10

instances (automatic). Premium v3 (P1v3) supports up to

30

instances (automatic). Isolated v2 (I1v2) supports up to

100

instances (automatic). Standard (S1) and Basic (B1) are eliminated because they cannot scale to

12

instances.

This step determines which tiers can satisfy the scaling target of

12

instances.

Evaluate the deployment slot requirements for the remaining tiers.

Both Premium v3 (P1v3) and Isolated v2 (I1v2) support up to

20

deployment slots, which easily satisfies the requirement of at least

2

slots.

This step ensures that the hosting environment can support zero-downtime deployment workflows using staging slots.

Compare the cost profiles of the remaining compliant tiers to find the most cost-effective option.

Premium v3 (P1v3) operates on multi-tenant dedicated hardware and is significantly cheaper than Isolated v2 (I1v2), which runs inside a dedicated App Service Environment (ASE). Premium v3 is chosen as the most cost-effective tier.

This satisfies the cost-minimization constraint of the scenario.

Key Concept

App Service Plan pricing tier capabilities and limits

Estimated Time:2m 0s

Question 580Question →

You are configuring a virtual network named `vnet-dev` for a testing environment. Within `vnet-dev`, you create a subnet named `subnet-test` and assign it the address prefix $10.10.5.0/28$ . What is the maximum number of virtual machines that can be successfully deployed and receive IP addresses in `subnet-test`?

Show answer & explanation

Answer: 11

Answer

A subnet configured with a

/28

prefix has

16

total IP addresses (

2^{32-28} = 16

). Azure reserves the first four IP addresses and the last IP address of the subnet range, totaling

5

reserved IPs. Subtracting these

5

reserved IPs from the

16

total IPs results in

11

usable IP addresses available for virtual machines.

Step-by-Step Solution

Determine the total number of IP addresses in the subnet's CIDR block.

/28

subnet prefix has a total of

2^{32-28} = 2^4 = 16

IP addresses.

The CIDR prefix determines the host bits and total address pool.

Apply Azure-specific subnet reservations.

Azure reserves the first four IP addresses (

10.10.5.0

10.10.5.1

10.10.5.2

10.10.5.3

) and the last IP address (

10.10.5.15

) in the subnet range, which is

5

addresses in total.

Azure virtual networks always reserve five IP addresses in every subnet for protocol and service operations.

Calculate the usable IP addresses for host virtual machines.

16 \text{ total addresses} - 5 \text{ reserved addresses} = 11

usable IP addresses.

Only non-reserved IP addresses in a subnet can be assigned to virtual machines.

Key Concept

Azure Subnet IP Address Reservation

PreviousPage 29 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept