Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 41Question →

Your organization has 15 TB15\text{ TB} of archival data stored on-premises that needs to be transferred to Azure. You decide to employ the Azure Import/Export service. Before shipping the physical hard drives to the Azure datacenter, you must prepare them on-premises.

Which of the following requirements must be met during the drive preparation phase? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The drives must be formatted with the NTFS file system.; The drives must be basic disks containing only a single partition.

Answer

The drives must be formatted with the NTFS file system and must be basic disks containing only a single partition.
For Azure Import/Export import jobs, each physical drive must be formatted with the NTFS file system and configured as a basic disk containing a single partition. These requirements ensure compatibility with the Azure datacenter import environment.

Step-by-Step Solution

1
Determine the supported file systems for the Azure Import/Export service.
The service supports only the NTFS file system for drives used in import jobs.
NTFS is the mandatory file system required by the Microsoft Azure Import/Export tool when copying files to Azure Storage.
2
Determine the supported disk and volume configurations.
Only basic disks with a single volume partition are supported.
The service does not support dynamic disks, external spanning, RAID configurations, or multiple partitions on the same physical drive.

Key Concept

Drive preparation requirements for Azure Import/Export service
Question 42Question →

Your company has a requirement to copy on-premises archival data to Microsoft Azure by shipping physical hard drives. You decide to use the Azure Import/Export service. Which two Azure storage services can you specify as direct destinations for the import job? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Blob storage; Azure Files

Answer

Azure Blob storage and Azure Files
The Azure Import/Export service is designed for transferring file-based and object-based data. It supports importing directly into Azure Blob storage (block blobs and page blobs) and Azure Files (file shares).

Step-by-Step Solution

1
Review the supported target storage services for the Azure Import/Export service.
The service supports copying files to Azure Blob storage (block blobs and page blobs) and Azure Files.
This determines which storage accounts and service endpoints can receive the imported data.
2
Identify the incorrect options based on service limitations.
Azure Queue storage and Azure Table storage are not files-based or object-based storage services that support physical disk imports.
This helps eliminate unsupported destinations.

Key Concept

Azure Import/Export supported destination storage types
Estimated Time:45s
Question 43Question →

An organization has the following Azure resource hierarchy and configuration:

* A management group named `MG-Finance`.
* An Azure subscription named `Sub-FinanceProd` that is associated with `MG-Finance`.
* A resource group named `RG-Payments` within `Sub-FinanceProd`.
* A virtual machine named `vm-pay1` and a storage account named `sa-paylogs` within `RG-Payments`.

The following role assignments are configured:

* `User1` is assigned the Microsoft Entra ID `Global Administrator` role. The directory setting Access management for Azure resources is set to No.
* `User2` is assigned the `Reader` role at the `MG-Finance` management group level, and the `Contributor` role at the `RG-Payments` resource group level.
* `User3` is assigned the `User Access Administrator` role at the `Sub-FinanceProd` subscription level.

Which TWO actions can be performed based on the configured permissions? (Select two.)

Select all that apply

Show answer & explanation

Answer: User2 can create a new virtual machine in RG-Payments.; User3 can assign the Reader role to another user on vm-pay1.

Answer

User2 can create a new virtual machine in RG-Payments, and User3 can assign the Reader role to another user on vm-pay1.
The correct actions are those where the assigned roles grant the necessary control plane permissions at the appropriate scopes. The user assigned the Contributor role at the resource group level inherits write permissions within that specific scope, which allows virtual machine creation. The user assigned the User Access Administrator role at the subscription level inherits authorization management permissions, allowing role assignments on the virtual machine.

Step-by-Step Solution

1
Analyze the effective permissions of User1.
User1 is a Microsoft Entra ID Global Administrator but access elevation is set to No.
Verify if directory-level administrator roles automatically inherit subscription-level Azure resource permissions.
2
Analyze the effective permissions of User2.
User2 has Reader at the management group and Contributor at the resource group.
Determine the effective permissions at the resource group scope, noting that RBAC assignments are additive and the more permissive Contributor role applies locally.
3
Analyze the effective permissions of User3.
User3 has User Access Administrator at the subscription level.
Verify that the User Access Administrator role inherits to child resources to allow modifying role assignments.
4
Evaluate data plane access for User2 on the storage account.
User2 has Contributor on the resource group containing the storage account, but this does not grant data plane access for blobs via Microsoft Entra ID authentication.
Check the separation between control plane and data plane RBAC roles in Azure Storage.

Key Concept

Understanding Azure RBAC role assignments, scoping, inheritance, and the separation of Entra ID directory roles from Azure resource roles.
Question 44Question →

An organization has a Microsoft Entra ID tenant. The tenant contains a dynamic security group named IT-Personnel and an administrative unit named IT-AU. The IT-Personnel group is a member of IT-AU. A user named Admin1 is assigned the Groups Administrator role scoped to IT-AU. You need to determine if Admin1 can update the dynamic query that defines the membership of the IT-Personnel group.

Is the statement 'Admin1 can modify the dynamic membership rule of the IT-Personnel group' true or false?

Show answer & explanation

Answer: False

Answer

False
The correct answer is False because administrative unit-scoped directory roles do not grant permissions to modify the membership rules of dynamic groups. Changing the query definition of a dynamic group requires a tenant-wide administrator role.

Step-by-Step Solution

1
Analyze the administrator's scoped role assignment.
Admin1 has the Groups Administrator role scoped to the IT-AU administrative unit.
This establishes the scope boundary of Admin1's administrative authority.
2
Determine the capabilities of a Groups Administrator role scoped to an administrative unit.
An administrative unit-scoped Groups Administrator can manage standard properties, licenses, and member lists of assigned groups in their scope.
To distinguish permissions between assigned and dynamic groups.
3
Evaluate permissions required to modify dynamic group membership rules.
Modifying dynamic group membership rules is a tenant-wide action requiring tenant-level roles, such as tenant-level Groups Administrator or Global Administrator.
To verify that administrative unit delegation does not cover dynamic query modifications.

Key Concept

Delegated administrative permissions and their limitations on dynamic groups within Microsoft Entra ID Administrative Units.
Question 45Question →

You are a Microsoft Azure administrator managing a Microsoft Entra ID tenant. You plan to configure a security group to assign Microsoft Entra roles directly to the group's members. Is the following statement true or false?

In Microsoft Entra ID, you can configure a security group with a dynamic user membership type if the group has the 'Roles can be assigned to the group' (isAssignableToRole) property set to Yes.

Show answer & explanation

Answer: False

Answer

False
The statement is false. Microsoft Entra ID explicitly prevents security groups that are assignable to Microsoft Entra roles (isAssignableToRole set to Yes) from using dynamic membership rules. Role-assignable groups must use the 'Assigned' membership type to prevent security vulnerabilities like privilege escalation via user attribute modifications.

Step-by-Step Solution

1
Analyze the configuration requirement for a role-assignable security group.
Setting the 'Roles can be assigned to the group' (isAssignableToRole) property to Yes allows Microsoft Entra ID roles to be assigned directly to the group.
To identify the baseline capabilities and constraints of role-assignable groups.
2
Examine the membership type requirements for role-assignable groups.
Microsoft Entra ID enforces that any group with 'isAssignableToRole' set to Yes must use the 'Assigned' membership type.
To determine whether dynamic membership rules are compatible with role-assignable groups.
3
Compare this enforcement with the statement in the question.
The statement asserts that a dynamic membership group can also have roles assigned to it, which contradicts Entra ID's security restrictions.
To deduce the truth value of the statement.

Key Concept

Microsoft Entra ID restricts role-assignable groups to the 'Assigned' membership type, preventing the use of dynamic membership rules.
Question 46Question →

Your company has an Azure environment with a subscription named Sub1. Inside Sub1, there is a resource group named RG-Dev that contains several virtual machines.

You need to grant a user named User1 the permission to restart the virtual machines and to delegate role assignments to other team members within RG-Dev. The solution must use the principle of least privilege.

Which two of the following role assignments should you configure? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Virtual Machine Contributor role to User1 at the RG-Dev scope.; Assign the User Access Administrator role to User1 at the RG-Dev scope.

Answer

To meet the requirements, you must assign the Virtual Machine Contributor role to User1 at the RG-Dev scope to allow virtual machine management, and assign the User Access Administrator role to User1 at the RG-Dev scope to allow delegating role assignments.
To satisfy the requirements, two roles must be assigned at the resource group level: Virtual Machine Contributor (to manage the virtual machines) and User Access Administrator (to delegate role assignments to other users). These roles represent the least privilege configuration required for the scenario.

Step-by-Step Solution

1
Identify the minimum required role for virtual machine management.
The Virtual Machine Contributor role is selected, as it permits restarting and managing virtual machines without excess permissions.
This fulfills the requirement to manage virtual machines under the principle of least privilege.
2
Identify the minimum required role for role delegation.
The User Access Administrator role is selected, as it permits managing role assignments without granting full resource ownership (Owner role).
This fulfills the requirement to delegate role assignments under the principle of least privilege.
3
Evaluate the correct scope for these assignments.
The role assignments must be applied at the resource group scope (RG-Dev) to target the specific resources and limit access.
Applying roles at the resource group level ensures the permissions inherit only to resources within RG-Dev, satisfying the scope requirement.

Key Concept

Azure RBAC roles are scoped to specific resource hierarchies (Management Group, Subscription, Resource Group, Resource). Assigning Virtual Machine Contributor allows VM management, while User Access Administrator allows role delegation. Microsoft Entra ID directory roles and Administrative Units do not directly grant Azure resource permissions.
Question 47Question →

An aviation logistics company, SkyRoute Global, organizes its Azure infrastructure using the following Management Group hierarchy:

- Tenant Root Group
- SkyRoute-MG (Management Group)
- Production-MG (Management Group)
- Sub-Prod-01 (Subscription)
- Sub-Prod-02 (Subscription)
- NonProd-MG (Management Group)
- Sub-Dev-01 (Subscription)

A policy restricting virtual machine SKUs is assigned at the SkyRoute-MG level.
Pat is assigned the Owner role at the Production-MG level.
Sam is assigned the Reader role at the Tenant Root Group level and the Contributor role at the Sub-Dev-01 subscription level.

Which two of the following statements correctly describe the behavior of policy and RBAC inheritance within this hierarchy?

Select all that apply

Show answer & explanation

Answer: Pat can manage resources and assign permissions within both Sub-Prod-01 and Sub-Prod-02.; The VM SKU policy assigned at SkyRoute-MG applies to virtual machines created within Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01.

Answer

The correct statements are that Pat can manage resources and assign permissions within both Sub-Prod-01 and Sub-Prod-02, and the VM SKU policy assigned at SkyRoute-MG applies to virtual machines created within Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01.
The Owner role assigned to Pat at the Production-MG level inherits downward to Sub-Prod-01 and Sub-Prod-02, granting full administrative control over both subscriptions. Additionally, the VM SKU policy applied at the SkyRoute-MG level inherits downward to all child scopes, meaning it applies to Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01.

Step-by-Step Solution

1
Analyze the RBAC role inheritance for the Owner role assignment.
Pat's Owner role is assigned at Production-MG. Since Sub-Prod-01 and Sub-Prod-02 are child subscriptions under Production-MG, the Owner permissions inherit downward to both subscriptions.
Azure RBAC assignments inherit downward through the Management Group and subscription hierarchy.
2
Analyze the policy inheritance for the VM SKU policy.
The VM SKU policy is assigned at SkyRoute-MG. Because SkyRoute-MG is the parent of both Production-MG and NonProd-MG, all child subscriptions (Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01) inherit this policy.
Azure Policy assignments inherit downward through the management group hierarchy and cannot be bypassed at child scopes unless an explicit exemption is configured.
3
Evaluate the directional limits of RBAC, policies, and locks.
Sam's Reader role inherits downward from the Tenant Root Group, policy exemptions do not apply laterally to sibling scopes, and resource locks do not inherit upward.
Permissions and locks only flow downward in the Azure hierarchy, and exemptions are scoped strictly to their defined targets.

Key Concept

Azure Management Groups provide a hierarchical structure for organizing subscriptions, allowing policies and RBAC roles to inherit downward systematically.
Estimated Time:1m 30s
Question 48Question →

You manage a standard General Purpose v2 (GPv2) storage account named `storagedata2026` in the East US region. The storage account is configured to use locally-redundant storage (LRS). A lifecycle management policy is active on `storagedata2026` that automatically moves blobs to the Archive tier if they have not been modified for 30 days. Currently, the storage account contains 10 TB of blobs in the Archive tier. You need to convert the storage account to use zone-redundant storage (ZRS). The solution must minimize application downtime and avoid manual data replication. Which of the following actions should you perform first?

Show answer & explanation

Answer: Rehydrate the archived blobs to the Hot or Cool tier, and then submit a support request to initiate a live migration.

Answer

Rehydrate the archived blobs to the Hot or Cool tier, and then submit a support request to initiate a live migration.
To migrate an LRS storage account to ZRS while avoiding downtime (via live migration) and avoiding manual copying, you must submit a support request. However, a primary prerequisite for live migration to ZRS is that the storage account cannot contain any archived blobs. Therefore, the administrator must first rehydrate all archived blobs to the Hot or Cool tier before requesting the migration.

Step-by-Step Solution

1
Identify the migration constraint for converting LRS to ZRS.
Direct configuration change in the portal is not supported; a live migration request or manual migration is required.
Azure does not allow standard replication setting updates to switch between LRS and ZRS directly.
2
Check the prerequisites for requesting a live migration from LRS to ZRS.
The storage account must not contain any blobs in the Archive tier.
Archived blobs block the live migration process and will cause the migration request to fail.
3
Determine the necessary first step to satisfy the live migration requirements without manual data copy.
Rehydrate all existing archived blobs to Hot or Cool tier, then request the live migration.
This avoids manual data copying (minimizing downtime and effort) while satisfying the Archive tier restriction.

Key Concept

Prerequisites and migration paths for converting Azure Storage replication from LRS to ZRS when archived blobs are present.
Question 49Question →

An organization has an Azure subscription named Sub1 that contains two resource groups named RG-Admin and RG-Finance. A user named User1 is currently assigned the Owner role at the Sub1 scope. You need to prevent User1 from modifying resources in RG-Finance, while allowing them to manage resources in RG-Admin. The solution must minimize administrative effort and follow the principle of least privilege. Which two actions should you perform? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Remove the Owner role assignment for User1 at the Sub1 scope.; Assign the Contributor role to User1 at the RG-Admin scope.

Answer

Remove the Owner role assignment for User1 at the Sub1 scope, and assign the Contributor role to User1 at the RG-Admin scope.
To satisfy the requirements, you must first remove the Owner role assignment at the subscription scope. Because Azure RBAC roles are additive, inherited permissions cannot be overridden or denied by assigning a less permissive role at a lower scope. Once the inherited role is removed, assigning the Contributor role at the RG-Admin scope allows the user to manage resources in that resource group without having access to RG-Finance, thereby adhering to the principle of least privilege.

Step-by-Step Solution

1
Analyze the current role assignments and inherited permissions.
User1 currently inherits Owner permissions on both RG-Admin and RG-Finance from the assignment at the Sub1 subscription scope.
Understanding scope hierarchy and inheritance is necessary to identify how permissions are being applied.
2
Remove the subscription-level Owner assignment.
User1 no longer inherits Owner permissions to any resources within Sub1.
Since Azure RBAC permissions are additive, inherited permissions cannot be blocked or denied at a lower scope. The assignment at the parent scope must be removed.
3
Apply target permissions using the principle of least privilege.
User1 is assigned the Contributor role at the RG-Admin scope, which allows them to manage resources in RG-Admin without accessing RG-Finance.
Assigning the Contributor role at the resource group scope provides management capabilities restricted to that specific scope, fulfilling the requirement.

Key Concept

Azure RBAC role assignments are additive, and inherited permissions cannot be restricted or blocked at a lower scope level.
Question 50Question →

Your organization has an Azure tenant with the following resource hierarchy:
- Management Group: `MG-Enterprise`
- Subscription: `Sub-Finance-Prod`
- Resource Group: `RG-Finance-App`
- Key Vault: `kv-finance-prod`

You need to delegate permissions to a user named User1 to meet the following security requirements:
- User1 must be able to delegate role assignments to other administrators for resources within `RG-Finance-App` only.
- User1 must be able to view all resources and their configurations within `Sub-Finance-Prod`, but must not be able to create, modify, or delete any resources or configurations within the subscription.
- User1 must not be able to manage role assignments for resources outside of `RG-Finance-App`.

Which two role assignments should you configure to meet the requirements while adhering to the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Assign the Reader role to User1 at the Sub-Finance-Prod subscription scope.; Assign the User Access Administrator role to User1 at the RG-Finance-App resource group scope.

Answer

Assign the Reader role to User1 at the Sub-Finance-Prod subscription scope, and assign the User Access Administrator role to User1 at the RG-Finance-App resource group scope.
Assigning the Reader role at the subscription scope allows the user to view all resources and configurations within that subscription, which inherits down to the resource group level. Assigning the User Access Administrator role at the resource group scope allows the user to manage role assignments only within that specific resource group, without granting them permissions to modify resources themselves or manage access at higher scopes. This combination satisfies all security requirements under the principle of least privilege.

Step-by-Step Solution

1
Analyze the read-only requirement across the entire subscription.
Determined that the Reader role must be assigned at the subscription scope so that read access inherits down to all child resource groups and resources.
This satisfies the requirement to view all resources and configurations within the subscription without granting write access.
2
Analyze the access delegation requirement for the specific resource group.
Determined that the User Access Administrator role allows a user to manage role assignments (write/delete RBAC assignments) without granting data plane or control plane modification rights on the resources.
This isolates role management capabilities to the target resource group scope only, satisfying the scope boundary.
3
Verify the principle of least privilege is maintained.
Confirmed that combining Reader at the subscription scope and User Access Administrator at the resource group scope prevents the user from altering resources anywhere, while restricting role assignment management exclusively to the resource group.
Assigning roles at higher scopes (like management group) or using broader roles (like Owner or Global Administrator) would violate least privilege constraints.

Key Concept

Azure RBAC Scope Inheritance and Role Separation
Estimated Time:2m 0s
Question 51Question →

An administrator is configuring a new dynamic membership group in Microsoft Entra ID to automatically assign licenses to all employees in the Sales department. Which dynamic membership rule should the administrator use to target these users?

Show answer & explanation

Answer: (user.department -eq 'Sales')

Answer

(user.department -eq 'Sales')
The correct rule is (user.department -eq 'Sales'). This rule correctly references the user object, queries the department attribute, utilizes the equality operator (-eq), and encloses the string value in single quotes as required by Microsoft Entra ID dynamic membership rule syntax.

Step-by-Step Solution

1
Identify the target object type.
The target objects are employees (users), which means the rule must query user attributes starting with 'user.' rather than device attributes starting with 'device.'.
We want to group users, not devices.
2
Identify the target attribute and operator.
The target attribute is 'department', and we need an exact match for 'Sales', which requires the '-eq' (equals) operator.
The '-ne' operator means 'not equal' and would exclude the target group.
3
Apply correct OData syntax formatting.
String values in dynamic membership rules must be enclosed in single or double quotes, resulting in the rule: (user.department -eq 'Sales').
Omitting quotes around string literals causes validation and evaluation errors.

Key Concept

Microsoft Entra ID dynamic group membership rules allow automatic management of group members based on user or device attributes using OData query syntax.
Estimated Time:45s
Question 52Question →

An organization utilizes Microsoft Entra Connect to synchronize user accounts from an on-premises Active Directory Domain Services (AD DS) domain to a cloud-based Microsoft Entra ID tenant. An administrator attempts to add a synchronized user named User-Alpha (whose current department is Marketing) to a dynamic group named Group-Sales (configured with the membership rule `(user.department -eq "Sales")`) by changing User-Alpha's department attribute to Sales directly in the Microsoft Entra admin center.

Is it true that this action successfully updates User-Alpha's department attribute in Microsoft Entra ID and adds them to the dynamic group?

Show answer & explanation

Answer: False

Answer

It is false that the action successfully updates User-Alpha's department attribute in Microsoft Entra ID and adds them to the dynamic group.
The correct answer is False because the user account is synchronized from an on-premises directory, meaning its department attribute cannot be changed in the cloud via the Microsoft Entra admin center. Since the attribute remains unchanged, the user does not satisfy the dynamic group membership rule.

Step-by-Step Solution

1
Determine the source of authority for the user object.
User-Alpha is synchronized from an on-premises Active Directory Domain Services domain using Microsoft Entra Connect, making the on-premises domain the source of authority.
The source of authority determines where user attributes can be modified.
2
Evaluate the write permissions for synchronized attributes.
Synchronized attributes (such as department) are write-protected and read-only within Microsoft Entra ID; they cannot be updated directly in the Microsoft Entra admin center.
Azure Active Directory Connect maintains a unidirectional synchronization flow for these core user attributes from on-premises to cloud.
3
Assess the outcome of the administrator's action.
The attempt to edit the attribute in the Microsoft Entra admin center fails, User-Alpha's department remains Marketing, and they are not added to the Group-Sales dynamic group.
Dynamic membership rules evaluate the actual values stored in Microsoft Entra ID, which remain unchanged.

Key Concept

Source of authority for synchronized identities and its impact on Microsoft Entra ID dynamic groups.
Estimated Time:1m 30s
Question 53Question →

You plan to configure a new Microsoft Entra ID group that will automatically include all user accounts where the department attribute is set to Sales. Which two settings must you configure to meet this requirement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Set the Membership type to Dynamic User.; Add a dynamic membership rule with the query: (user.department -eq "Sales").

Answer

To configure a group that dynamically includes users based on their department, you must set the membership type to Dynamic User and construct a query targeting the user's department attribute, specifically using the syntax: (user.department -eq "Sales").
Configuring a dynamic membership rule for user accounts requires setting the membership type of the group to Dynamic User. To filter by the user's department, you must use the user.department attribute in the query syntax. Therefore, setting the membership type to Dynamic User and adding the query matching user.department to Sales are the correct configurations.

Step-by-Step Solution

1
Set the group's membership type to Dynamic User.
The group is configured to dynamically evaluate user objects rather than device objects or static assignments.
The requirement is to automatically include user accounts based on a user attribute.
2
Create a dynamic membership query using the user.department attribute.
The query (user.department -eq "Sales") is added.
This query evaluates each user's department attribute and adds them to the group if it matches Sales.

Key Concept

Configuring dynamic user membership groups based on user attributes in Microsoft Entra ID
Question 54Question →

Aether Health System uses Azure Management Groups to govern their subscriptions. The hierarchy and governance configurations are structured as follows:

* Tenant Root Group
* Aether-Core-MG (Management Group)
* Clinical-Prod-MG (Management Group)
* Subscription A
* Research-Dev-MG (Management Group)
* Subscription B
* Lab-RG (Resource Group)

The following configurations are applied:
* Azure Policy: A policy restricting allowed resource locations to `East US` (Effect: Deny) is assigned to Aether-Core-MG. A policy restricting allowed resource locations to `East US 2` (Effect: Deny) is assigned to Research-Dev-MG.
* Role Assignments: User1 is assigned the Contributor role at Aether-Core-MG. User2 is assigned the Owner role at Clinical-Prod-MG and the Reader role at Research-Dev-MG.
* Locks: A `CanNotDelete` resource lock is applied directly to Lab-RG.

Which of the following statements regarding governance, resource actions, and subscription movement are correct? (Select TWO)

Select all that apply

Show answer & explanation

Answer: A virtual machine deployment in Subscription B in the East US 2 region will fail because Azure Policy assignments are cumulative, requiring compliance with both the East US and East US 2 restrictions.; User2 cannot move Subscription B to Clinical-Prod-MG unless they are also granted write permissions on the source management group (Research-Dev-MG) or directly on Subscription B.

Answer

A virtual machine deployment in Subscription B in the East US 2 region will fail due to cumulative policy inheritance, and User2 cannot move Subscription B without write permissions on the source management group.
Azure Policy is evaluated cumulatively down the hierarchy, meaning a child scope must satisfy both parent and child policy constraints simultaneously. This restricts Subscription B from deploying resources to either region because they are mutually exclusive. Additionally, moving a subscription requires write access at both the source and target management groups, meaning the user must be granted write access at the source group since they currently only possess Reader permissions there.

Step-by-Step Solution

1
Analyze Azure Policy inheritance down the management group hierarchy.
Effective allowed locations for Subscription B must satisfy both the East US restriction from the parent and the East US 2 restriction from the child.
Azure Policy uses a cumulative evaluation model; child policies do not override parent policies.
2
Evaluate the permissions required for moving a subscription.
Moving Subscription B requires write permissions at the target management group (Clinical-Prod-MG), the source management group (Research-Dev-MG), and the subscription itself.
Since User2 only has Reader access on the source group, they lack the necessary write permissions to execute the subscription move.
3
Evaluate the interaction of RBAC roles and resource locks.
User1 cannot delete resources in Lab-RG despite having the inherited Contributor role.
Resource locks of type CanNotDelete prevent deletion by all users, including those with Contributor or Owner permissions, until the lock is removed.

Key Concept

Azure Management Groups facilitate hierarchical governance where Policies and RBAC roles inherit downward cumulatively, while subscription moves require write permissions at both the source and destination scopes.
Question 55Question →

A multinational logistics company, GlobalRoute Logistics, organizes its Azure resources using a Management Group hierarchy structured as follows:

* Tenant Root Group
* Global-Root-MG
* Core-Services-MG
* Subscription: Core-Prod-Sub
* Resource Group: Prod-Shared-RG (has a `ReadOnly` Resource Lock applied)
* Subscription: Core-Shared-Sub
* Logistics-Operations-MG
* Subscription: Fleet-Ops-Sub
* Resource Group: Ops-Data-RG

The following configurations are applied across the hierarchy:

1. An Azure Policy definition is assigned at Global-Root-MG that restricts allowed resource types to `Microsoft.Storage/storageAccounts` and `Microsoft.Network/virtualNetworks` using the `Deny` effect. No exclusions are configured.
2. User1 is assigned the Contributor role at the Logistics-Operations-MG level, and the Reader role at the Fleet-Ops-Sub level.
3. User2 is assigned the Contributor role at the Core-Services-MG level.

Which two of the following statements are correct regarding the permissions, policy compliance, and resource locks within this management group hierarchy? Select two.

Select all that apply

Show answer & explanation

Answer: User1 can successfully create a new Storage Account within the Ops-Data-RG resource group.; User2 is prevented from creating a Storage Account in the Prod-Shared-RG resource group because the ReadOnly resource lock applied at the resource group level is inherited and blocks all write operations.

Answer

User1 can successfully create a new Storage Account within the Ops-Data-RG resource group, and User2 is prevented from creating a Storage Account in the Prod-Shared-RG resource group because the ReadOnly resource lock applied at the resource group level is inherited and blocks all write operations.
The correct statements are that User1 can successfully create a new Storage Account within the Ops-Data-RG resource group, and User2 is prevented from creating a Storage Account in the Prod-Shared-RG resource group because the ReadOnly resource lock applied at the resource group level is inherited and blocks all write operations. User1's Contributor permissions are inherited from the parent management group and are additive; they are not restricted by the Reader assignment at the subscription level, and creating a Storage Account complies with the policy. User2 cannot write to Prod-Shared-RG because the ReadOnly lock applied at the resource group level inherits to all resources and blocks write actions like resource creation.

Step-by-Step Solution

1
Analyze User1's permissions in the Ops-Data-RG resource group.
User1 has the Contributor role inherited from Logistics-Operations-MG. Even though User1 has the Reader role assigned at the Fleet-Ops-Sub level, Azure RBAC roles are additive, meaning the Reader role does not restrict the Contributor role permissions. Thus, User1 has Contributor permissions in Ops-Data-RG.
To determine the effective RBAC permissions of a user across a management group and subscription hierarchy.
2
Evaluate the Azure Policy effect on User1's and User2's deployment actions.
The Azure Policy at Global-Root-MG restricts allowed resource types to storage accounts and virtual networks. Because Ops-Data-RG is a descendant of Global-Root-MG, this policy applies. Creating a Storage Account is allowed by the policy, so User1's request succeeds. However, creating a Virtual Machine is denied, so User2's attempt to create a Virtual Machine in Core-Shared-Sub fails, overriding User2's Contributor permissions.
To verify if the proposed resource creation complies with the inherited Azure Policy definitions.
3
Evaluate the impact of the Resource Lock on User2's permissions in Prod-Shared-RG.
Prod-Shared-RG has a ReadOnly resource lock. This lock inherits to all resources and scopes within that resource group. It blocks all write operations, including creating a new Storage Account, even for a user with the Contributor role. Therefore, User2 cannot create a Storage Account in Prod-Shared-RG.
To assess how resource locks inherit and restrict administrative actions within resource groups.

Key Concept

Understanding Azure Management Group hierarchies, Azure RBAC inheritance, Azure Policy inheritance, and Resource Lock inheritance rules.
Question 56Question →

An organization needs to import 75 TB75\text{ TB} of unstructured data from an on-premises network-isolated Linux server cluster to Azure Block Blob storage. The local cluster has no outbound internet connectivity, and the organization wants to minimize administrative overhead and hardware management during the transfer. Which of the following actions must the administrator perform to successfully complete this import process? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Order a single Azure Data Box device and copy the data using the NFS protocol.; From the local web UI of the Data Box, configure the client IP addresses of the Linux servers under the NFS client access settings.

Answer

To successfully import the data, the administrator must order a single Azure Data Box device and copy the data using the NFS protocol, and configure the client IP addresses of the Linux servers under the NFS client access settings in the local web UI of the Data Box.
A single Azure Data Box device provides up to 80 TB80\text{ TB} of usable capacity, which accommodates the 75 TB75\text{ TB} dataset. Because the source system is a Linux cluster and the environment is network-isolated, utilizing the Data Box's native NFS share support is the most efficient method to copy data without extra infrastructure. To enable this, the administrator must configure the NFS client access settings in the Data Box's local web UI by adding the IP addresses of the Linux servers.

Step-by-Step Solution

1
Determine the optimal transfer service based on constraints.
Since the dataset is 75 TB75\text{ TB} and there is no outbound network connectivity, online tools are ruled out. Data Box Disk is limited to 35 TB35\text{ TB} usable capacity, making Azure Data Box (with 80 TB80\text{ TB} usable capacity) the correct choice. Using Data Box also eliminates the need to purchase and format custom drives as required by the Import/Export service.
Properly aligning capacity limits and hardware constraints avoids multi-device ordering overhead and protocol mismatches.
2
Connect the Data Box to the local network and configure access.
Connect the device and configure its network parameters. Access the local web UI of the Data Box to unlock it with the key provided in the Azure Portal.
The device must be unlocked locally using Azure credentials before it can expose shares for copying.
3
Configure NFS client access on the Data Box.
Navigate to the NFS share settings in the local web UI and add the IP addresses of the source Linux servers. Mount the shares on the Linux servers and copy the data directly.
By default, NFS access is blocked until client IPs are explicitly permitted in the local configuration of the Data Box.

Key Concept

Selecting and configuring the appropriate Azure offline data transfer service (Azure Data Box vs. Data Box Disk or Import/Export) based on capacity, OS compatibility, and protocol requirements.
Estimated Time:2m 30s
Question 57Question →

An administrator needs to migrate 120 TB120\text{ TB} of archived virtual machine disk (VHD) files from an on-premises Windows Server 2022 failover cluster to an Azure Storage account. Due to strict corporate security policies, the data cannot be transmitted over the WAN network (Internet or VPN), and the use of Azure-owned physical appliances on-premises is prohibited. The target storage account is protected by a firewall that restricts network access to authorized virtual networks. Which of the following actions are required to configure the Azure Import/Export service and successfully prepare the drives? (Select THREE.)

Select all that apply

Show answer & explanation

Answer: Format the customer-provided SATA hard drives as NTFS and run the WAImportExport tool on a Windows client to copy the VHD files and encrypt the drives.; Create an import job in the Azure portal and upload the journal (.jrn) files generated during drive preparation.; Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.

Answer

To perform the migration, you must format the drives as NTFS and use the WAImportExport tool to copy the VHDs and encrypt the drives, create an import job in the Azure portal and upload the resulting journal (.jrn) files, and enable the 'Allow trusted Microsoft services' bypass in the destination storage account firewall.
The correct options identify the mandatory steps for importing data via the Azure Import/Export service. First, customer-provided SATA drives must be formatted as NTFS, and the WAImportExport tool must copy the VHD data and encrypt the drives. Second, the generated journal (.jrn) files must be uploaded during the creation of the import job in the Azure portal to provide Microsoft with the BitLocker keys. Finally, since the destination storage account has a firewall enabled, the administrator must configure the storage account to allow trusted Microsoft services, permitting the Import/Export service to write the data from the decrypted drives.

Step-by-Step Solution

1
Analyze constraints to select the correct migration method.
Since Azure-owned hardware (like Data Box) is prohibited on-premises and network-based ingestion is disallowed, the Azure Import/Export service must be used with customer-provided hard drives.
This complies with both the prohibition of vendor hardware and the network isolation constraint.
2
Prepare the physical storage drives.
Format the customer-owned SATA drives as NTFS and run the WAImportExport tool on a Windows client to copy the VHD data, encrypt the drives via BitLocker, and output journal (.jrn) files.
NTFS is the required filesystem for Azure Import/Export, and the tool prepares the drives and gathers encryption keys.
3
Configure the import job metadata.
Create the import job in the Azure portal and upload the generated journal (.jrn) files containing the BitLocker keys.
The journal files are necessary for Azure to decrypt the physical disks once they are delivered to the Azure datacenter.
4
Configure destination storage network security.
Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account firewall.
The Import/Export service runs as a trusted Microsoft service and requires this bypass to write data through the storage account firewall.

Key Concept

Preparing and configuring offline data migration using the Azure Import/Export service under network and physical hardware constraints.
Question 58Question →

An administrator needs to change the configuration of an existing Azure Storage account from locally-redundant storage (LRS) to geo-redundant storage (GRS). Which of the following describes the correct process for performing this configuration change?

Show answer & explanation

Answer: Update the replication setting directly in the configuration settings of the existing storage account.

Answer

Update the replication setting directly in the configuration settings of the existing storage account.
Changing a storage account's replication configuration from locally-redundant storage (LRS) to geo-redundant storage (GRS) is a supported in-place operation that can be executed directly within the Azure portal, PowerShell, or Azure CLI without any data loss or downtime.

Step-by-Step Solution

1
Identify the source and target replication configurations.
Source is locally-redundant storage (LRS) and target is geo-redundant storage (GRS).
To determine the supported conversion path and whether an in-place upgrade is allowed.
2
Evaluate the transition path requirements for LRS to GRS.
LRS to GRS is a direct, supported, in-place transition that does not require data replication or manual migration.
To eliminate options suggesting manual data copy or account creation.
3
Select the correct administrative mechanism to perform the change.
The change is a control-plane setting modified directly in the storage account configuration.
To rule out data-plane actions (like SAS tokens or Storage Blob Data Owner roles) and confirm the portal update is the correct method.

Key Concept

Azure Storage replication conversion paths
Question 59Question →

An administrator is preparing to transfer 8 TB8\text{ TB} of local data to an Azure storage account using the Azure Import/Export service. The administrator has successfully run the `WAImportExport` tool to prepare two external hard drives, resulting in two separate journal files: `drive1.jrn` and `drive2.jrn`.

Which of the following actions should the administrator perform in the Azure portal to initiate the import process?

Show answer & explanation

Answer: Create a single import job and upload both drive1.jrn and drive2.jrn during the job creation process.

Answer

Create a single import job and upload both drive1.jrn and drive2.jrn during the job creation process.
The Azure Import/Export service allows administrators to combine up to 1010 physical drives in a single import job. During the creation of the job in the Azure portal, the administrator must upload the individual journal (.jrn) files generated by the `WAImportExport` tool for each prepared drive. This links the encrypted drives to the import workflow.

Step-by-Step Solution

1
Upload all generated journal (.jrn) files during the creation of the import job in the Azure portal.
The portal reads the drive properties, BitLocker keys, and destination folders for both prepared hard drives.
This registers the metadata of all physical drives associated with the data import operation.
2
Complete the import job configuration by specifying return carrier details and generating the shipping address.
The import job is created, and the shipping address for the target Azure datacenter is provided.
This allows the administrator to print the shipping label and send the physical drives to Microsoft.

Key Concept

Azure Import/Export Journal File Handling
Question 60Question →

A healthcare provider, MedPulse Dynamics, organizes its subscriptions using the following Management Group hierarchy:
- Tenant Root Group
- Clinical-MG
- Subscription 1 (Clinical Apps)
- Resource Group A
- Billing-MG
- Subscription 2 (Billing Portal)

An administrator assigns the Reader role to a user at the Clinical-MG level. What is the user's access level to Resource Group A?

Show answer & explanation

Answer: The user has Reader access to Resource Group A because the role is inherited down the hierarchy.

Answer

The user has Reader access to Resource Group A because the role is inherited down the hierarchy.
The correct answer is correct because Azure RBAC role assignments inherit down the resource hierarchy. Since the Reader role is assigned at the Clinical-MG level, any child resources—including Subscription 1 and Resource Group A—will inherit this assignment, granting the user Reader access.

Step-by-Step Solution

1
Identify the scope of the RBAC role assignment.
The Reader role is assigned at the Clinical-MG management group scope.
This determines the root point from which permissions start inheriting.
2
Trace the hierarchy path from the assignment scope to the target resource.
Resource Group A is nested inside Subscription 1, which is a direct child of Clinical-MG.
Permissions flow down the tree to all children in the branch.
3
Determine the effective permission on Resource Group A.
The Reader permission inherits down to Subscription 1 and then to Resource Group A.
Azure RBAC assignments flow down through Management Groups to subscriptions, resource groups, and individual resources without requiring manual activation or being blocked by standard locks.

Key Concept

Azure RBAC inheritance flows down the Management Group hierarchy to child subscriptions and resources, and cannot be blocked by user-defined deny assignments or resource locks.
PreviousPage 3 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin