All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

Your company has an Azure environment containing three virtual networks:
- `VNet-Hub` ( $172.30.0.0/16$ ): Contains an Azure Firewall with a private IP address of $172.30.0.4$ in a subnet named `AzureFirewallSubnet`.
- `VNet-Prod` ( $10.100.0.0/16$ ): Contains `VM-Prod` deployed in `ProdSubnet` ( $10.100.1.0/24$ ).
- `VNet-Dev` ( $10.200.0.0/16$ ): Contains `VM-Dev` deployed in `DevSubnet` ( $10.200.1.0/24$ ).

Bidirectional peering connections are established between `VNet-Hub` and `VNet-Prod`, and between `VNet-Hub` and `VNet-Dev`.

To comply with security policies, all traffic between `VNet-Prod` and `VNet-Dev` must transit through the Azure Firewall in `VNet-Hub`.

You associate a route table with `ProdSubnet` that contains a route for address prefix $10.200.0.0/16$ with a next hop of $172.30.0.4$ (Virtual appliance).
You associate a route table with `DevSubnet` that contains a route for address prefix $10.100.0.0/16$ with a next hop of $172.30.0.4$ (Virtual appliance).

Azure Firewall rules are configured to permit all traffic between the two spoke networks.
However, `VM-Prod` and `VM-Dev` are unable to communicate.

Which peering configuration must you enable on the virtual network peering connections to allow communication between the virtual networks?

Enable 'Allow forwarded traffic' on the virtual network peering connections.

Enable 'Use remote gateways' on the peering connections in the spoke virtual networks.

Enable 'Allow gateway transit' on the peering connections in the hub virtual network.

Configure a User-Defined Route in the hub virtual network pointing to the spoke virtual networks using a next hop type of Virtual Network Gateway.

Show answer & explanation

Answer: Enable 'Allow forwarded traffic' on the virtual network peering connections.

Answer

Enable 'Allow forwarded traffic' on the virtual network peering connections.

The correct option is enabling 'Allow forwarded traffic' on the peering connections. When traffic is routed between spoke virtual networks through a central hub containing a network virtual appliance (NVA) or Azure Firewall, the packets carry source and destination IP addresses that do not belong to the hub virtual network. For the hub to accept and forward this traffic, and for the spokes to accept it from the hub, the 'Allow forwarded traffic' setting (or 'Traffic forwarded from remote virtual network') must be enabled on the peering connections.

Step-by-Step Solution

Analyze the traffic path from VM-Prod to VM-Dev.

Traffic destined for

10.200.0.0/16

is sent to the Azure Firewall (

172.30.0.4

) in VNet-Hub via the User-Defined Route on ProdSubnet.

This identifies the entry point into the hub virtual network.

Analyze how the packet is processed by the hub and forwarded to the destination.

The Azure Firewall forwards the packet to VM-Dev (

10.200.1.4

) in VNet-Dev via the peering link.

The packet now carries a source IP of VM-Prod (

10.100.1.4

) which is outside the address space of VNet-Hub.

Determine why the traffic is dropped at the peering boundary.

Because the source IP is from VNet-Prod and not VNet-Hub, the traffic is classified as forwarded traffic. If 'Allow forwarded traffic' is not enabled on the peering connections, Azure drops this traffic.

Enabling 'Allow forwarded traffic' allows virtual networks to receive and forward transit traffic that did not originate within their own address spaces.

Key Concept

Virtual Network Peering Transit and Forwarded Traffic

Question 662Question →

You have two Azure virtual networks named VNet1 and VNet2. VNet1 is configured with the address space $10.1.0.0/16$ , and VNet2 is configured with the address space $10.1.100.0/24$ . Is the statement true or false that you can configure virtual network peering between VNet1 and VNet2?

True

False

Show answer & explanation

Answer: False

Answer

False

Virtual network peering cannot be established between virtual networks with overlapping IP address spaces. Because

10.1.100.0/24

overlaps with

10.1.0.0/16

, Azure will block the creation of the peering connection.

Step-by-Step Solution

Analyze the IP address spaces of both virtual networks.

VNet1 uses

10.1.0.0/16

(IP range

10.1.0.0

10.1.255.255

). VNet2 uses

10.1.100.0/24

(IP range

10.1.100.0

10.1.100.255

To determine if virtual network peering can be established, you must check for overlapping IP address spaces.

Compare the IP ranges to check for overlap.

The range of VNet2 (

10.1.100.0/24

) is completely inside the range of VNet1 (

10.1.0.0/16

). Therefore, the address spaces overlap.

Azure prevents virtual network peering creation if there is any overlap in the address spaces of the participating networks.

Evaluate the statement based on Azure peering requirements.

Peering cannot be configured. The statement is False.

Since the address spaces overlap, the configuration will fail.

Key Concept

Azure Virtual Network Peering requires non-overlapping IP address spaces.

Estimated Time:45s

Question 663Question →

An administrator manages an Azure subscription named Sub-Core that contains two resource groups named RG-Shared and RG-Secure.

The administrator must implement Azure Policy to enforce the following governance requirements:
1. All resources created within the subscription must include a tag named CostCenter. If the tag is missing, the resource deployment must be blocked.
2. Virtual machines deployed in RG-Secure must only use the Standard_D2s_v3 size. Virtual machines in RG-Shared must be allowed to use any size.

To meet the governance requirements with the minimum number of policy assignments, which two actions should the administrator perform?

Select all that apply

Assign the "Require a tag on resources" policy definition at the Sub-Core subscription scope.

Assign the "Allowed virtual machine size SKUs" policy definition at the RG-Secure resource group scope.

Assign a policy initiative containing both policy definitions at the Sub-Core subscription scope, and add RG-Shared to the excluded scopes list.

Assign a policy initiative containing both policy definitions at the Sub-Core subscription scope, and configure the VM SKU policy parameter to apply only to RG-Secure.

Show answer & explanation

Answer: Assign the "Require a tag on resources" policy definition at the Sub-Core subscription scope.; Assign the "Allowed virtual machine size SKUs" policy definition at the RG-Secure resource group scope.

Answer

Assigning the tag requirement policy at the subscription scope and the virtual machine size policy at the specific resource group scope.

To meet the governance requirements with the minimum number of assignments, the policy definitions must be assigned at their respective scopes. Assigning the tag enforcement policy at the subscription level ensures that all resources inside both resource groups are evaluated. Assigning the virtual machine size restriction policy at the resource group level ensures it only affects the specific resource group, while allowing other resource groups to remain unrestricted.

Step-by-Step Solution

Identify the scopes of the governance requirements.

The tag requirement applies subscription-wide (Sub-Core), whereas the VM size restriction applies only to a specific resource group (RG-Secure).

Determining the correct scopes is necessary to minimize assignments and avoid unintended policy inheritance.

Evaluate the use of a policy initiative with exclusions.

Using an initiative with an exclusion for RG-Shared would fail to enforce the tag requirement on resources in RG-Shared.

Exclusion scopes remove the entire assignment (and thus all policies in the initiative) from the excluded scope.

Select the appropriate assignment scope for each individual policy.

Assigning the tag policy at the subscription level and the VM SKU policy at the RG-Secure level meets all criteria with exactly two assignments.

This configuration correctly scopes each policy without requiring exemptions or compromising the tag enforcement policy.

Key Concept

Azure Policy Assignment Scopes and Exclusions

Estimated Time:1m 30s

Question 664Question →

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains two subnets: `SubnetA` ( $10.0.1.0/24$ ) and `SubnetB` ( $10.0.2.0/24$ ).

The virtual machines are configured as follows:
* `VM1` is in `SubnetA` and has a network interface named `NIC1`. `NIC1` is associated with an Application Security Group named `ASG-Web`.
* `VM2` is in `SubnetB` and has a network interface named `NIC2`. `NIC2` is associated with an Application Security Group named `ASG-DB`.
* `VM3` is in `SubnetB` and has a network interface named `NIC3`. `NIC3` is not associated with any Application Security Group.

The Network Security Groups (NSGs) are configured as follows:
* `NSG-SubnetA` is associated with `SubnetA`.
* `NSG-NIC1` is associated with `NIC1`.
* `NSG-NIC2` is associated with `NIC2`.
* `SubnetB` and `NIC3` have no associated NSGs.

The NSGs contain the following custom rules:

NSG-SubnetA Outbound Rules:

Priority	Source	Destination	Port	Protocol	Action
$120$	`ASG-Web`	`ASG-DB`	$1433$	TCP	Allow
$150$	Any	Any	$1433$	TCP	Deny

NSG-NIC1 Outbound Rules:

Priority	Source	Destination	Port	Protocol	Action
$100$	Any	$10.0.2.0/24$	$1433$	TCP	Allow

NSG-NIC2 Inbound Rules:

Priority	Source	Destination	Port	Protocol	Action
$110$	$10.0.1.0/24$	Any	$1433$	TCP	Deny
$130$	`ASG-Web`	`ASG-DB`	$1433$	TCP	Allow

Which of the following statements correctly describe the connectivity when `VM1` attempts to establish a TCP connection to `VM2` and `VM3` on port $1433$ ? (Select TWO.)

Select all that apply

Traffic from `VM1` to `VM2` is blocked inbound by the Network Security Group on `VM2`'s network interface because the Deny rule with priority

110

is evaluated before the Allow rule with priority

130

Traffic from `VM1` to `VM3` is blocked outbound by the Network Security Group on `SubnetA` because it does not match the Allow rule with priority

120

and matches the Deny rule with priority

150

Traffic from `VM1` to `VM2` is allowed because the Allow rule with priority

130

takes precedence because it specifies a more granular Application Security Group (ASG) mapping than the subnet prefix in the rule with priority

110

Traffic from `VM1` to `VM3` is allowed because `VM3` has no Network Security Group associated with its subnet or network interface, bypassing the outbound restrictions of `SubnetA`.

Show answer & explanation

Answer: Traffic from `VM1` to `VM2` is blocked inbound by the Network Security Group on `VM2`'s network interface because the Deny rule with priority $110$ is evaluated before the Allow rule with priority $130$ .; Traffic from `VM1` to `VM3` is blocked outbound by the Network Security Group on `SubnetA` because it does not match the Allow rule with priority $120$ and matches the Deny rule with priority $150$ .

Answer

Traffic from VM1 to VM2 is blocked inbound by the Network Security Group on VM2's network interface because the Deny rule with priority 110 is evaluated before the Allow rule with priority 130. Traffic from VM1 to VM3 is blocked outbound by the Network Security Group on SubnetA because it does not match the Allow rule with priority 120 and is blocked by the Deny rule with priority 150.

The correct statements recognize that NSG rules are evaluated in a specific order: priority numbers are processed sequentially from lowest to highest, and both NIC and Subnet NSGs must allow traffic. Traffic from VM1 to VM2 passes outbound checks but is blocked inbound at VM2's NIC because the Deny rule (priority 110) is evaluated before the Allow rule (priority 130). Traffic from VM1 to VM3 is blocked outbound at SubnetA because VM3 is not part of ASG-DB, meaning the traffic misses the priority 120 Allow rule and matches the priority 150 Deny rule.

Step-by-Step Solution

Evaluate outbound traffic from VM1 to VM2.

NIC-level NSG (NSG-NIC1) allows it via priority 100 rule (destination 10.0.2.0/24). Subnet-level NSG (NSG-SubnetA) allows it via priority 120 rule (source ASG-Web to destination ASG-DB). Outbound traffic successfully leaves SubnetA.

For outbound traffic, the NIC NSG is evaluated first, followed by the Subnet NSG.

Evaluate inbound traffic to VM2.

SubnetB has no NSG. NIC-level NSG (NSG-NIC2) contains two rules matching VM1 (IP 10.0.1.4, member of ASG-Web). The priority 110 rule (Deny from 10.0.1.0/24) takes precedence over the priority 130 rule (Allow from ASG-Web) due to its lower priority number. The traffic is blocked inbound.

NSG rules are processed in priority order (lowest number first), and inbound traffic requires both subnet-level and NIC-level NSGs to allow it (if present).

Evaluate outbound traffic from VM1 to VM3.

NIC-level NSG (NSG-NIC1) allows it (priority 100). Subnet-level NSG (NSG-SubnetA) does not match the priority 120 rule because VM3 is not associated with ASG-DB. The traffic matches the priority 150 rule (Deny) and is blocked outbound.

Since VM3 is not a member of ASG-DB, it fails the destination criteria of the priority 120 rule, falling back to the generic Deny rule at priority 150.

Key Concept

NSG rule evaluation order, ASG membership application, and subnet-level vs. NIC-level NSG enforcement flow.

Question 665Question →

You host a web application on an Azure App Service web app named WebApp1 that runs on a Basic B1 App Service plan. You deploy a continuous background processing task to WebApp1 using Azure WebJobs. You observe that the WebJob stops executing shortly after you close your browser or when there is no active traffic to the web app. What should you do to ensure that the WebJob runs continuously without interruption?

Configure a custom autoscale rule on the Basic B1 App Service plan to maintain a minimum of two instances.

Enable the Always On setting in the configuration settings of the current Basic B1 App Service plan.

Upgrade the App Service plan to the Standard S1 tier and enable the Always On setting.

Configure a triggered WebJob with a CRON expression to run the background task every hour.

Show answer & explanation

Answer: Upgrade the App Service plan to the Standard S1 tier and enable the Always On setting.

Answer

Upgrade the App Service plan to the Standard S1 tier and enable the Always On setting.

Upgrading the App Service plan to the Standard S1 tier allows you to enable the Always On setting. The Always On setting keeps the web app loaded in memory even when there is no active HTTP traffic, which is a prerequisite for continuous WebJobs to run properly.

Step-by-Step Solution

Analyze the behavior of continuous WebJobs under idle conditions.

Determine that the WebJob stops because the App Service unloads the application from memory when there is no active traffic.

Continuous WebJobs require the Always On setting to keep the application host process active.

Check the capability of the Basic B1 App Service plan regarding the Always On setting.

Identify that Always On is only supported on Standard or Premium tiers, and is unavailable in the Basic tier.

To use Always On, the hosting App Service plan must be scaled up to at least Standard S1.

Upgrade the App Service plan and configure the setting.

Upgrade to the Standard S1 tier and enable Always On under the Configuration settings of the Web App.

This keeps the web app loaded in memory indefinitely, allowing the continuous WebJob to run without interruption.

Key Concept

Enabling Always On for continuous WebJobs and App Service plan tier limits

Question 666Question →

You have three virtual networks in the East US region: VNet1 ( $10.1.0.0/16$ ), VNet2 ( $10.2.0.0/16$ ), and VNet3 ( $10.3.0.0/16$ ). Virtual machines are deployed in the subnets of all three virtual networks. You configure a virtual network peering between VNet1 and VNet2, and another virtual network peering between VNet2 and VNet3. No virtual network gateways or network virtual appliances (NVAs) are deployed in any of the virtual networks.

Which of the following statements about the connectivity and configuration options in this setup are correct? (Select two.)

Select all that apply

Virtual machines in VNet1 cannot communicate with virtual machines in VNet3 because virtual network peering is non-transitive.

To allow virtual machines in VNet1 to initiate communication with virtual machines in VNet2, 'Allow virtual network access' must be enabled on the peering link.

Virtual machines in VNet1 can route traffic to VNet3 through VNet2 if 'Allow forwarded traffic' is enabled on the peering from VNet2 to VNet3.

You can configure 'Allow gateway transit' on VNet2 and 'Use remote gateways' on VNet1 and VNet3 to route traffic between VNet1 and VNet3 without deploying a Virtual Network Gateway.

Show answer & explanation

Answer: Virtual machines in VNet1 cannot communicate with virtual machines in VNet3 because virtual network peering is non-transitive.; To allow virtual machines in VNet1 to initiate communication with virtual machines in VNet2, 'Allow virtual network access' must be enabled on the peering link.

Answer

Virtual network peering is non-transitive, preventing communication between VNet1 and VNet3, and enabling communication between VNet1 and VNet2 requires setting 'Allow virtual network access' to enabled on the peering link.

Virtual network peering is non-transitive, meaning that traffic cannot flow from VNet1 through VNet2 to VNet3 without a router or gateway in place. Therefore, virtual machines in VNet1 cannot communicate with virtual machines in VNet3. Additionally, for virtual machines in peered networks like VNet1 and VNet2 to communicate, the 'Allow virtual network access' option must be enabled on the peering link.

Step-by-Step Solution

Analyze the network topology and identify peering relationships.

VNet1 is peered to VNet2, and VNet2 is peered to VNet3. There is no direct peering between VNet1 and VNet3.

To determine direct and indirect connectivity paths in the virtual network layout.

Evaluate the transit capabilities of Azure virtual network peering.

Since peering is non-transitive, traffic cannot flow from VNet1 through VNet2 to VNet3 without a gateway or network virtual appliance (NVA) configured for transit.

To verify if VMs in VNet1 can communicate with VMs in VNet3 under default configuration.

Verify basic configuration requirements for VNet1 to VNet2 communication.

The 'Allow virtual network access' setting must be enabled on the peering link to permit VM-to-VM communication across the peered networks.

To identify the necessary configuration parameters for direct communication between peered virtual networks.

Key Concept

Azure Virtual Network Peering is non-transitive by default, and enabling communication between peered virtual networks requires the 'Allow virtual network access' setting.

Estimated Time:1m 0s

Question 667Question →

A company needs to grant a partner application temporary read-only access to a specific queue named incoming-orders in an Azure Storage account. The access configuration must meet the following security requirements:
- The partner application must only be able to read messages from the incoming-orders queue.
- Access must be restricted to the partner's IP address range of 198.51.100.0/24.
- The access credentials must automatically expire after 24 hours.
- Access to all other queues, blob containers, and tables in the storage account must be prevented.
- The connection protocol must be restricted to HTTPS.
Which configuration should you use to meet these requirements with the least privilege?

Generate an Account SAS for the Queue service, specifying the read permission, HTTPS only, and no expiration time.

Assign the partner application's service principal the Storage Queue Data Reader role at the storage account scope and generate a User Delegation SAS.

Generate a Service SAS for the incoming-orders queue, specifying the read permission, the IP address range 198.51.100.0/24, HTTPS only, and a 24-hour expiration.

Generate a Service SAS for the queue, disable the storage account firewall bypass for trusted Microsoft services, and allow public access from any network.

Show answer & explanation

Answer: Generate a Service SAS for the incoming-orders queue, specifying the read permission, the IP address range 198.51.100.0/24, HTTPS only, and a 24-hour expiration.

Answer

Generate a Service SAS for the incoming-orders queue, specifying the read permission, the IP address range 198.51.100.0/24, HTTPS only, and a 24-hour expiration.

Generating a Service SAS for the queue is the correct approach because it delegates access to a specific resource (the incoming-orders queue) rather than all queues in the storage account. It natively supports all requested security constraints, including the read-only permission, client IP address range restriction (198.51.100.0/24), HTTPS-only protocol, and a 24-hour expiration duration.

Step-by-Step Solution

Determine the required Shared Access Signature (SAS) type based on the resource scope.

Since access is needed for a single queue ('incoming-orders') rather than all queues in the storage account, a Service SAS must be used instead of an Account SAS to adhere to the principle of least privilege.

A Service SAS targets a specific resource (such as a single container, blob, queue, or table), whereas an Account SAS delegates access at the service level (e.g., all queues or blobs).

Evaluate identity and authentication type requirements.

A User Delegation SAS is ruled out because it is only supported for Blob storage and Azure Data Lake Storage Gen2, not for Queue storage.

User Delegation SAS requires Microsoft Entra ID credentials and is structurally limited to Blob service resources.

Apply the requested security constraints to the Service SAS configuration.

Configure the Service SAS with read permissions, HTTPS-only protocol, the client IP range '198.51.100.0/24', and a validity duration of 24 hours.

This enforces the required network, protocol, and temporal constraints directly on the token.

Key Concept

Selecting the least-privilege SAS type (Service SAS vs. Account SAS) and applying security constraints (IP range, HTTPS, expiration) for non-blob storage resources.

Estimated Time:1m 30s

Question 668Question →

Your company has an Azure environment with three virtual networks: `VNet-Hub` ( $172.16.0.0/16$ ), `VNet-SpokeA` ( $172.17.0.0/16$ ), and `VNet-SpokeB` ( $172.18.0.0/16$ ). Both spoke virtual networks are peered directly with `VNet-Hub`.

In `VNet-Hub`, a Network Virtual Appliance (NVA) named `NVA-1` is deployed in a subnet named `Subnet-DMZ` ( $172.16.1.0/24$ ). The NVA has a private IP address of $172.16.1.4$ assigned to its network interface `nic1`.

You need to ensure that all network traffic originating from `Subnet-App` ( $172.17.1.0/24$ ) in `VNet-SpokeA` and destined for `Subnet-DB` ( $172.18.1.0/24$ ) in `VNet-SpokeB` is routed through `NVA-1`.

Which two actions should you perform? (Each correct answer presents part of the solution.)

Select all that apply

Enable IP forwarding on the network interface `nic1` of `NVA-1`.

Associate a custom route table with `Subnet-App` and add a route with the destination prefix

172.18.1.0/24

, a next hop type of Virtual appliance, and a next hop IP address of

172.16.1.4

Associate a custom route table with `Subnet-App` and add a route with the destination prefix

172.18.1.0/24

, a next hop type of Virtual network gateway, and a next hop IP address of

172.16.1.4

Enable gateway transit on the virtual network peering connection between `VNet-Hub` and `VNet-SpokeA`.

Associate a custom route table with `Subnet-DMZ` and add a route with the destination prefix

172.18.1.0/24

, a next hop type of Virtual appliance, and a next hop IP address of

172.16.1.4

Show answer & explanation

Answer: Enable IP forwarding on the network interface `nic1` of `NVA-1`.; Associate a custom route table with `Subnet-App` and add a route with the destination prefix $172.18.1.0/24$ , a next hop type of Virtual appliance, and a next hop IP address of $172.16.1.4$ .

Answer

To route traffic from the application subnet to the database subnet through the network virtual appliance, you must enable IP forwarding on the network interface of the appliance, and associate a route table with the application subnet that contains a route to the database subnet with a next hop type of Virtual appliance and the IP address of the appliance.

To route traffic through a Network Virtual Appliance (NVA), two conditions must be met: first, the NVA's network interface must be configured to allow IP forwarding, otherwise it will discard packets not addressed to its own MAC/IP address. Second, a route table must be associated with the source subnet containing a user-defined route that specifies the destination subnet, the next hop type of 'Virtual appliance', and the NVA's private IP address.

Step-by-Step Solution

Enable IP forwarding on the network interface.

IP forwarding is enabled on the network interface of the appliance.

By default, Azure virtual machine network interfaces drop traffic that is not destined for their own IP address. Enabling IP forwarding allows the network interface to forward traffic destined for other IP addresses.

Create a route table and configure the user-defined route.

A route is added with destination prefix

172.18.1.0/24

, next hop type 'Virtual appliance', and next hop IP address

172.16.1.4

This route overrides the default system routing and directs the outbound traffic from the source subnet to the firewall appliance.

Associate the route table with the source subnet.

The route table is associated with the application subnet.

UDRs must be applied to the subnet containing the source resources so that outbound traffic originating from those resources matches the route table rules.

Key Concept

Configuring custom routing through a Network Virtual Appliance (NVA) in Azure requires both a User-Defined Route (UDR) pointing to the NVA's IP address with a next hop type of 'Virtual appliance' and enabling IP forwarding on the NVA's network interface.

Estimated Time:2m 0s

Question 669Question →

You are managing a web application hosted on an Azure virtual machine named VM-AdminPortal in the West US 3 region. This virtual machine is currently configured as a backend pool member of an active Standard Load Balancer named lb-webportal. VM-AdminPortal connects to the virtual network using a single network interface named nic-admin.

To perform direct administrative tasks, you need to assign a public IP address directly to VM-AdminPortal while keeping the virtual machine in the backend pool of lb-webportal.

Which of the following configuration steps must you perform to meet these requirements? (Select TWO.)

Select all that apply

Create a public IP address that uses the Standard SKU with Static allocation.

Associate the public IP address with the primary IP configuration of nic-admin.

Create a public IP address that uses the Basic SKU with Dynamic allocation.

Create a public IP address that uses the Standard SKU with Dynamic allocation.

Show answer & explanation

Answer: Create a public IP address that uses the Standard SKU with Static allocation.; Associate the public IP address with the primary IP configuration of nic-admin.

Answer

To configure direct external access to the virtual machine while it is in the backend pool of a Standard Load Balancer, you must create a public IP address using the Standard SKU with Static allocation, and associate this public IP address with the primary IP configuration of the virtual machine's network interface.

To associate a public IP address with a virtual machine that belongs to a Standard Load Balancer's backend pool, the public IP must use the Standard SKU. Standard SKU public IP addresses only support Static allocation. Additionally, public IP addresses in Azure must be associated with an IP configuration of a network interface, rather than the interface itself.

Step-by-Step Solution

Determine the SKU requirement for the public IP address.

Since the virtual machine is in the backend pool of a Standard Load Balancer, a Standard SKU public IP is required.

Azure does not support mixing Basic SKU public IP addresses with resources associated with a Standard Load Balancer.

Determine the allocation method for the Standard SKU public IP.

The public IP must be configured with Static allocation.

Standard SKU public IP addresses in Azure do not support the Dynamic allocation method.

Associate the public IP address with the virtual machine's network interface.

The public IP is associated with the primary IP configuration of nic-admin.

Public IP addresses cannot be associated directly to the NIC resource; they must be bound to an IP configuration.

Key Concept

Configuring Public IP addresses for virtual machines associated with a Standard Load Balancer.

Estimated Time:2m 0s

Question 670Question →

An administrator is configuring network security for an Azure virtual network named `VNet1`. `VNet1` contains a subnet named `Subnet1`.

The subnet contains two virtual machines: `VM-Web` and `VM-DB`.
- `VM-Web` is associated with an Application Security Group (ASG) named `ASG-Web`.
- `VM-DB` is associated with an ASG named `ASG-DB`.

A Network Security Group (NSG) named `NSG-Subnet` is associated with `Subnet1`.
An NSG named `NSG-NIC-DB` is associated with the network interface of `VM-DB`.

The inbound rules for `NSG-Subnet` are configured as shown in the following table:

Priority	Source	Port	Destination	Port	Protocol	Action
$100$	Internet	Any	`ASG-Web`	$443$	TCP	Allow
$200$	Any	Any	Any	Any	Any	Deny

The inbound rules for `NSG-NIC-DB` are configured as shown in the following table:

Priority	Source	Port	Destination	Port	Protocol	Action
$150$	Any	Any	`ASG-DB`	$1433$	TCP	Deny
$250$	`ASG-Web`	Any	`ASG-DB`	$1433$	TCP	Allow

Currently, SQL database traffic from `VM-Web` to `VM-DB` is blocked.

Which two configuration changes should you perform to allow SQL traffic from `VM-Web` to `VM-DB`? (Select two.)

Select all that apply

In `NSG-Subnet`, add an inbound rule with priority

150

that allows TCP port

1433

from source `ASG-Web` to destination `ASG-DB`.

In `NSG-NIC-DB`, change the priority of the rule that allows TCP port

1433

120

In `NSG-NIC-DB`, change the priority of the rule that allows TCP port

1433

300

In `NSG-Subnet`, change the priority of the rule with priority

200

50

Show answer & explanation

Answer: In `NSG-Subnet`, add an inbound rule with priority $150$ that allows TCP port $1433$ from source `ASG-Web` to destination `ASG-DB`.; In `NSG-NIC-DB`, change the priority of the rule that allows TCP port $1433$ to $120$ .

Answer

To allow SQL traffic, you must add an inbound rule in `NSG-Subnet` with priority

150

that allows TCP port

1433

from source `ASG-Web` to destination `ASG-DB`, and in `NSG-NIC-DB`, change the priority of the rule that allows TCP port

1433

120

To allow SQL traffic from the web server to the database server, two configuration adjustments are required because inbound traffic is evaluated by both the subnet-level Network Security Group (NSG) and the network interface-level (NIC) NSG. At the subnet level, the custom Deny rule at priority

200

blocks all traffic. To bypass this, an Allow rule for port

1433

with a higher priority (such as

150

) must be added. At the NIC level, the Allow rule for port

1433

has a priority of

250

, which has lower precedence than the Deny rule at priority

150

. Changing the Allow rule's priority to a lower number (such as

120

) ensures it is evaluated first, allowing the SQL traffic.

Step-by-Step Solution

Analyze the subnet-level NSG (`NSG-Subnet`) inbound traffic evaluation.

The subnet-level NSG has a custom rule at priority

200

that denies all inbound traffic. Since this has a lower number than the default `AllowVnetInbound` rule (priority

65000

), the SQL traffic from `VM-Web` to `VM-DB` is blocked at the subnet level.

Azure NSGs evaluate rules in order of priority (lowest number first). A custom deny-all rule with priority

200

overrides the default VNet-internal allow rules.

Determine the required rule addition for `NSG-Subnet`.

Add an inbound rule to `NSG-Subnet` with priority

150

that allows TCP port

1433

from `ASG-Web` to `ASG-DB`.

Creating an allow rule with a priority number lower than

200

ensures that SQL traffic matches this rule and is allowed before reaching the Deny All rule.

Analyze the NIC-level NSG (`NSG-NIC-DB`) inbound traffic evaluation.

At the NIC level, the deny rule on port

1433

(priority

150

) is evaluated before the allow rule (priority

250

). This causes the SQL traffic to be blocked at the network interface.

The rule with priority

150

takes precedence over the rule with priority

250

because it has a lower priority number.

Determine the required modification for `NSG-NIC-DB`.

Change the priority of the allow rule to a value lower than

150

(such as

120

This reorders the evaluation so the SQL traffic matches the Allow rule first.

Key Concept

Azure NSG rules are evaluated sequentially by priority number, where lower numbers have higher precedence. Inbound traffic to a VM must be allowed by both the subnet-level NSG and the NIC-level NSG.

Estimated Time:1m 30s

Question 671Question →

Your company has an Azure subscription containing a resource group named `rg-network-prod`. You are designing a virtual network named `vnet-shared-hub` within this resource group. The virtual network is allocated the address space $10.10.0.0/22$ .

You must configure the virtual network to support the following infrastructure requirements:
- A subnet named `GatewaySubnet` to enable a VPN gateway connection to your on-premises datacenter.
- A subnet named `AzureBastionSubnet` to allow secure administrative access to your resources.
- A subnet named `subnet-compute` to host a workload of 60 virtual machines.

You need to select a subnet configuration that supports all requirements, avoids overlapping address ranges, fits within the virtual network address space, and minimizes IP address waste.

Which subnet configuration should you use?

GatewaySubnet:

10.10.0.0/29

; AzureBastionSubnet:

10.10.0.32/27

; subnet-compute:

10.10.0.64/25

GatewaySubnet:

10.10.0.0/29

; AzureBastionSubnet:

10.10.0.64/26

; subnet-compute:

10.10.0.128/26

GatewaySubnet:

10.10.0.0/29

; AzureBastionSubnet:

10.10.0.64/26

; subnet-compute:

10.10.0.128/25

GatewaySubnet:

10.10.0.0/30

; AzureBastionSubnet:

10.10.0.64/26

; subnet-compute:

10.10.0.128/25

Show answer & explanation

Answer: GatewaySubnet: $10.10.0.0/29$ ; AzureBastionSubnet: $10.10.0.64/26$ ; subnet-compute: $10.10.0.128/25$

Answer

The subnet configuration with GatewaySubnet as

10.10.0.0/29

, AzureBastionSubnet as

10.10.0.64/26

, and subnet-compute as

10.10.0.128/25

The correct subnet configuration allocates a

/29

prefix for GatewaySubnet (satisfying the minimum size requirement), a

/26

prefix for AzureBastionSubnet (satisfying the minimum size requirement), and a

/25

prefix for subnet-compute. A

/25

prefix is the smallest subnet size that can host 60 virtual machines because a

/26

subnet only provides

64 - 5 = 59

usable IP addresses due to Azure reserving the first 4 and the last 1 IP addresses in every subnet. All subnets are non-overlapping and reside within the parent

10.10.0.0/22

address space.

Step-by-Step Solution

Analyze the size requirement for AzureBastionSubnet.

The subnet must have a prefix of

/26

or larger.

Azure Bastion requires a minimum subnet size of

/26

to function properly.

Analyze the size requirement for GatewaySubnet.

The subnet must have a prefix of

/29

or larger.

Azure Virtual Network Gateway requires a GatewaySubnet with a minimum prefix of

/29

Calculate the required size for subnet-compute.

/25

subnet is required.

To support 60 virtual machines, the subnet must have at least 60 usable IP addresses. A

/26

subnet contains 64 total IP addresses. Since Azure reserves 5 IP addresses in every subnet (first 4 and last 1), the usable IP addresses in a

/26

subnet is

64 - 5 = 59

, which is insufficient. A

/25

subnet provides

128 - 5 = 123

usable IP addresses, which supports the 60 VMs.

Verify that all subnets fit within the virtual network address space without overlapping.

The configuration uses

10.10.0.0/29

10.10.0.64/26

, and

10.10.0.128/25

, which are completely non-overlapping and fit within the parent

10.10.0.0/22

range.

Ensures the address allocation is valid and deployable.

Key Concept

Subnet planning and sizing constraints including minimum prefixes for GatewaySubnet and AzureBastionSubnet, and Azure reserved IP addresses.

Question 672Question →

An administrator manages an Azure virtual network named `vnet-corp-infra` with the address space $172.20.0.0/20$ . The administrator creates a subnet named `subnet-shared-services` with the address range $172.20.15.0/29$ . The administrator states that a maximum of three virtual machine instances can be simultaneously assigned private IP addresses in `subnet-shared-services`. Is this statement true?

True

False

Show answer & explanation

Answer: True

Answer

The statement is true.

The statement is correct because Azure virtual networks reserve five IP addresses from every subnet range. In a

/29

subnet (

8

total IPs), subtracting the

5

reserved IPs leaves exactly

3

IP addresses available for virtual machines.

Step-by-Step Solution

Calculate the total number of IP addresses within a

/29

subnet prefix.

/29

subnet contains

2^{32-29} = 8

total IP addresses.

The prefix length of 29 leaves 3 host bits (

32 - 29 = 3

), which allows for

2^3 = 8

total addresses.

Identify the number of IP addresses reserved by Azure in each subnet.

Azure reserves exactly five IP addresses per subnet.

Azure reserves the first four IP addresses (network address, default gateway, two DNS addresses) and the last IP address (broadcast address) of the subnet range.

Determine the usable IP addresses for virtual machines.

There are

8 - 5 = 3

usable IP addresses.

Subtracting the five reserved IP addresses from the total eight addresses leaves exactly three usable IP addresses.

Key Concept

Azure Subnet IP Reservations

Question 673Question →

Helios Logistics has an Azure subscription named sub-helios-prod containing a resource group named rg-helios-storage. The resource group contains an Azure Storage account named saheliosdata and an Azure Key Vault named kvhelioskeys.

To meet regulatory compliance, you must configure saheliosdata to use customer-managed keys (CMK) stored in kvhelioskeys for double encryption of data at rest. You apply the following configurations:
- kvhelioskeys has soft-delete and purge protection enabled.
- kvhelioskeys is configured to use the Azure role-based access control (Azure RBAC) permission model.
- kvhelioskeys has its firewall enabled, restricting access to select networks, and has 'Allow trusted Microsoft services to bypass this firewall' set to Yes.
- saheliosdata is configured to use a system-assigned managed identity.
- You assign the Key Vault Contributor role to the storage account's managed identity at the key vault scope.

When you attempt to enable customer-managed keys on saheliosdata using a key from kvhelioskeys, the operation fails.

What is the primary reason for this configuration failure?

The Key Vault Contributor role only grants control plane access to manage the key vault itself, but does not grant the data plane permissions required to wrap and unwrap encryption keys.

The Storage Account's firewall is blocking the Key Vault from communicating, as the 'Allow trusted Microsoft services' bypass must be disabled to enforce private endpoint security.

The Key Vault Contributor role is assigned at the key vault scope, but Key Vault roles must be assigned at the subscription scope to allow cross-resource access by the Storage service.

The Key Vault's firewall is blocking the Storage Account because the system-assigned managed identity is not recognized as a trusted Microsoft service for Key Vault bypass.

Show answer & explanation

Answer: The Key Vault Contributor role only grants control plane access to manage the key vault itself, but does not grant the data plane permissions required to wrap and unwrap encryption keys.

Answer

The Key Vault Contributor role only grants control-plane access to manage the key vault itself, but does not grant the data-plane permissions required to wrap and unwrap encryption keys.

The correct answer states that the Key Vault Contributor role only grants control plane access. When Azure Key Vault is configured with the Azure RBAC permission model, control plane roles like Key Vault Contributor do not inherit data plane permissions. The storage account requires data plane permissions (specifically, wrap key and unwrap key) to use a customer-managed key for encryption, which are provided by the Key Vault Crypto Service Encryption User role.

Step-by-Step Solution

Analyze the role assigned to the storage account's managed identity.

The identity is assigned Key Vault Contributor.

To determine if the assigned permissions match the requirements of the encryption workflow.

Differentiate between Key Vault control plane and data plane roles.

Key Vault Contributor is a control plane role and cannot perform cryptographic operations on keys. Key Vault Crypto Service Encryption User is a data plane role designed for key wrapping/unwrapping.

Azure Storage needs data plane access to perform wrap and unwrap key actions for customer-managed key encryption.

Identify the cause of the failure based on the mismatch.

The configuration fails because the storage account has control plane permissions but lacks data plane permissions.

This explains the access denied error during key configuration.

Key Concept

Azure Key Vault separates control plane access (managing the Key Vault resource) from data plane access (performing cryptographic operations on keys). For Azure Storage customer-managed keys (CMK) using Azure RBAC, the storage account's managed identity must be granted a data plane role such as Key Vault Crypto Service Encryption User.

Estimated Time:1m 30s

Question 674Question →

An administrator manages an Azure Virtual Machine Scale Set named `vmss-compute` that uses Uniform orchestration. The scale set currently has 8 instances, and its upgrade policy is set to Manual. The administrator needs to update the scale set to use a new version of a custom virtual machine image. The update must meet the following requirements:
- The instances must be updated automatically in batches.
- The application must maintain service availability during the update process.
- The update process must pause if an instance fails to return to a healthy state after being updated.
Which upgrade policy should the administrator configure?

Manual

Automatic

Rolling

Scheduled

Show answer & explanation

Answer: Rolling

Answer

The Rolling upgrade policy should be configured because it automatically updates scale set instances in batches, maintains service availability, and pauses the update if an instance fails to return to a healthy state.

The correct answer is the Rolling upgrade policy. When configured, Azure updates the virtual machine scale set instances in batches. It monitors the health of the instances and will pause the rollout if an instance fails to return to a healthy state, minimizing service disruption.

Step-by-Step Solution

Identify the requirement for batch-based, automatic virtual machine updates that maintain high availability.

Determine that updating all instances at once is unacceptable, eliminating the Automatic upgrade policy.

Maintaining service availability requires a staggered rollout rather than updating all instances simultaneously.

Analyze the requirement to pause the update process if an instance fails to become healthy.

Identify that the upgrade policy must support health-check integration.

Health monitoring is a key feature of the Rolling upgrade policy to prevent bad updates from taking down the entire scale set.

Select the policy that matches all criteria.

Choose the Rolling upgrade policy.

Only the Rolling upgrade policy automatically updates instances in batches while using health checks to pause the rollout if an updated instance fails.

Key Concept

Virtual Machine Scale Set (VMSS) Upgrade Policies

Question 675Question →

An administrator configures a Network Security Group (NSG) with the following inbound security rules:

Rule Name	Priority	Destination	Port	Action
Rule1	150	ASG-Web	80	Deny
Rule2	250	ASG-Web	80	Allow

Which two statements correctly describe how inbound HTTP traffic (port 80) to the virtual machines associated with ASG-Web is processed? (Select two.)

Select all that apply

Inbound HTTP traffic is denied because the rule with the lower priority number is processed first.

The rule allowing HTTP traffic is not applied because a matching rule with a higher precedence has already processed the traffic.

Inbound HTTP traffic is allowed because the rule with the higher priority number has precedence.

The rule with priority 250 is evaluated before the rule with priority 150 because rules are evaluated in descending order.

Show answer & explanation

Answer: Inbound HTTP traffic is denied because the rule with the lower priority number is processed first.; The rule allowing HTTP traffic is not applied because a matching rule with a higher precedence has already processed the traffic.

Answer

Inbound HTTP traffic is denied because the rule with the lower priority number (Rule1, priority 150) is processed first, and the rule with the higher priority number (Rule2, priority 250) is not applied because processing stops after the first match.

In Azure Network Security Groups, rules are processed in ascending order of their priority numbers, meaning a lower priority number has higher precedence. Since the rule denying HTTP traffic has a priority of 150, it is evaluated and applied before the rule allowing it (priority 250). Once a match is found, further rule evaluation stops, which prevents the second rule from being applied.

Step-by-Step Solution

Identify the priority numbers of the rules targeting the incoming traffic.

Rule1 has a priority of 150, and Rule2 has a priority of 250.

Azure NSGs process rules in order of priority, starting with the lowest number.

Determine which rule is evaluated first based on the priority numbers.

Rule1 (priority 150) is evaluated first because 150 is less than 250.

Lower priority numbers represent higher precedence in Azure security rule evaluation.

Apply the action of the first matching rule and stop further rule evaluation.

The traffic matches Rule1 and is denied. Rule2 is not evaluated.

Once a rule matches the traffic, NSG rule processing terminates immediately.

Key Concept

NSG rule priority evaluation order

Question 676Question →

An administrator is deploying a new virtual machine named VM1 to host a database. The database workload requires high-performance storage with low latency. The administrator deploys VM1 using the Standard_D2_v3 size. When attempting to attach a Premium SSD managed disk as a data disk to VM1, the administrator finds that Premium SSD is not available. What should the administrator do to enable Premium SSD support for VM1?

Resize VM1 to Standard_D2s_v3.

Convert the OS disk of VM1 from Standard SSD to Premium SSD.

Move VM1 to a different Availability Zone within the same region.

Redeploy VM1 using a Recovery Services Vault restore operation.

Show answer & explanation

Answer: Resize VM1 to Standard_D2s_v3.

Answer

Resize VM1 to Standard_D2s_v3.

Resizing the virtual machine to Standard_D2s_v3 is correct because only Azure virtual machine sizes with the 's' suffix support Premium SSDs and Ultra Disks. The Standard_D2_v3 size does not support premium storage tiers.

Step-by-Step Solution

Identify the storage capabilities of the current virtual machine size Standard_D2_v3.

The Standard_D2_v3 size does not support premium storage (Premium SSD or Ultra Disk).

Azure VM sizes require the 's' suffix (e.g., Standard_D2s_v3) to support premium storage.

Select a compatible virtual machine size that supports premium storage.

Standard_D2s_v3 is identified as the premium-storage-capable equivalent size.

This size has the same CPU and memory specifications but includes premium storage support.

Resize the virtual machine VM1 to Standard_D2s_v3.

VM1 is resized, restarted, and can now successfully attach Premium SSD data disks.

Resizing updates the VM properties to allow premium disk attachments.

Key Concept

Azure virtual machine sizing and premium storage support

Question 677Question →

A company deploys a virtual network named `ProductionVNet` ( $172.16.0.0/16$ ). The virtual network has two subnets named `FrontendSubnet` ( $172.16.1.0/24$ ) and `SecuritySubnet` ( $172.16.2.0/24$ ). A firewall virtual machine is deployed as a Network Virtual Appliance (NVA) in `SecuritySubnet` with the private IP address $172.16.2.4$ . By default, system routes allow direct traffic from `FrontendSubnet` to the internet. You want to modify the routing so that all outbound traffic from `FrontendSubnet` destined for the internet is inspected by the NVA. You generate a route table and configure a route with the address prefix $0.0.0.0/0$ to redirect the traffic. Which next hop type must you specify for this route?

Virtual appliance

Virtual network gateway

Virtual network

Internet

Show answer & explanation

Answer: Virtual appliance

Answer

Virtual appliance

To route traffic through a custom firewall virtual machine or third-party Network Virtual Appliance, you must set the next hop type to 'Virtual appliance' and provide the target private IP address.

Step-by-Step Solution

Determine the type of target resource receiving the redirected traffic.

The target is a third-party firewall virtual machine acting as a Network Virtual Appliance (NVA).

Choosing the correct next hop type depends on the destination resource type.

Select the appropriate next hop type for an NVA in the route table.

The next hop type must be set to 'Virtual appliance' and the private IP address of the appliance must be provided.

Azure route tables use the 'Virtual appliance' designation to route traffic to NVA IP addresses.

Key Concept

Configuring user-defined routes to redirect traffic through a Network Virtual Appliance (NVA).

Question 678Question →

An administrator is deploying a containerized analytics application to Azure Container Instances (ACI). The application consists of a single container that must run a batch-processing script daily.

The deployment must meet the following requirements:
- The container must access an Azure SQL database over a private endpoint located in a subnet named SQLSubnet within a virtual network named VNet1.
- The container must retrieve database credentials securely from Azure Key Vault without storing them in the container image or deployment configuration files.
- The container must terminate and stop consuming compute resources once the script completes successfully, but must restart if the script fails.

You create a new subnet named AppSubnet in VNet1 for the container group.

Which configuration settings should you apply to the container group and AppSubnet?

Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to OnFailure, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.

Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to Always, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.

Delegate AppSubnet to Microsoft.Web/serverFarms, set the container group restart policy to OnFailure, and store the database credentials as standard environment variables in the container group deployment files.

Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to Never, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.

Show answer & explanation

Answer: Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to OnFailure, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.

Answer

Delegating AppSubnet to Microsoft.ContainerInstance/containerGroups is required for Azure Container Instances virtual network integration. Using a restart policy of OnFailure meets the requirement that the container terminates upon successful script execution but restarts if it fails. Assigning a system-assigned managed identity allows secure access to Key Vault without hardcoding secrets in configuration files.

Step-by-Step Solution

Determine the required subnet delegation for Azure Container Instances (ACI).

The subnet must be delegated to Microsoft.ContainerInstance/containerGroups.

ACI VNet integration requires a subnet dedicated and delegated specifically to ACI container groups.

Select the correct restart policy based on the execution requirements.

The restart policy must be set to OnFailure.

The container needs to run to completion and stop on success (ruling out Always) but must retry if it fails (ruling out Never).

Identify the secure authentication method to retrieve Key Vault secrets.

Assign a system-assigned managed identity to the container group and grant it permissions on the Key Vault.

This allows the application within the container to acquire an Microsoft Entra ID token and securely access Key Vault without storing credentials in the image or deployment files.

Key Concept

Azure Container Instances VNet integration, restart policies, and managed identity configuration.

Question 679Question →

You manage the following Azure resource hierarchy:

* A management group named `MG-Production`
* A subscription named `Sub-App` that is a child of `MG-Production`
* Two resource groups in `Sub-App` named `RG-Web` and `RG-Data`

You assign an Azure Policy definition named `Allow-SKUs` (which uses a `Deny` effect to restrict VM SKUs to `Standard_D2s_v5` or `Standard_D4s_v5`) to `MG-Production`. You configure the assignment with an exclusion for `RG-Data`.

You also assign an Azure Policy initiative named `Audit-Compliance` (which contains a policy definition that audits resources missing the `Project` tag using the `Audit` effect) to `Sub-App`.

You attempt to deploy the following virtual machines:

* `VM1`: A `Standard_D8s_v5` VM without the `Project` tag in `RG-Web`
* `VM2`: A `Standard_D8s_v5` VM without the `Project` tag in `RG-Data`

What is the outcome of these deployment attempts?

VM1 deployment is blocked by the policy definition. VM2 is deployed successfully but marked as non-compliant.

Both VM1 and VM2 deployments are blocked by the policy definition.

VM1 is deployed successfully but marked as non-compliant. VM2 deployment is blocked by the policy initiative.

Both VM1 and VM2 are deployed successfully, and both are marked as non-compliant.

Show answer & explanation

Answer: VM1 deployment is blocked by the policy definition. VM2 is deployed successfully but marked as non-compliant.

Answer

VM1 deployment is blocked by the policy definition. VM2 is deployed successfully but marked as non-compliant.

The correct answer is correct because VM1 is deployed in RG-Web, which inherits the Allow-SKUs policy assignment from MG-Production. Since the VM SKU (Standard_D8s_v5) is not allowed and the policy uses a Deny effect, the deployment is blocked. VM2 is deployed in RG-Data, which is explicitly excluded from the Allow-SKUs policy assignment, so its deployment is not blocked by the SKU restriction. However, VM2 is subject to the Audit-Compliance initiative assigned to Sub-App. Because the initiative uses the Audit effect for missing tags and VM2 does not have the Project tag, the deployment succeeds but the resource is marked as non-compliant.

Step-by-Step Solution

Evaluate policy inheritance and exclusions for VM1

VM1 is deployed in RG-Web under Sub-App. It inherits the Allow-SKUs policy assignment from MG-Production. Since the VM SKU (Standard_D8s_v5) is not allowed by this policy and its effect is Deny, the deployment is blocked.

Ensure that standard inheritance applies to RG-Web as there are no exclusions configured for it.

Evaluate policy inheritance and exclusions for VM2

VM2 is deployed in RG-Data under Sub-App. Since RG-Data is explicitly excluded from the Allow-SKUs policy assignment, VM2 is not blocked by the SKU restriction.

Identify child-level scope exclusions which override higher-level policy assignments.

Evaluate the initiative effect on VM2

VM2 is subject to the Audit-Compliance initiative assigned to Sub-App. It lacks the Project tag. Because the initiative's policy definition uses the Audit effect, VM2 is deployed successfully but marked as non-compliant.

Distinguish between Deny (active blocking) and Audit (passive monitoring and logging of non-compliance) policy effects.

Key Concept

Azure Policy scope assignment, inheritance, exclusions, and evaluation effects

Estimated Time:1m 30s

Question 680Question →

An administrator needs to configure permissions within the following Azure resource structure:
* Management Group: Tenant-Corporate-MG
* Subscription: Operations-Prod-Sub
* Resource Group: Ops-Data-RG
* Storage Account: opsdatafiles

A cloud engineer named Sam is a member of the Microsoft Entra ID Global Administrator role. Sam requires access to upload and read blobs within the containers of the opsdatafiles storage account using Microsoft Entra ID authentication. To comply with security policies, Sam must not be allowed to modify the configuration of the storage account itself, delete the storage account, or modify permissions for other users.

Which configuration represents the most secure method to grant Sam the required access while adhering to the principle of least privilege?

Enable the 'Access management for Azure resources' setting in the Microsoft Entra ID tenant properties for Sam's account.

Assign Sam the Storage Blob Data Contributor role scoped to the opsdatafiles storage account.

Assign Sam the Contributor role scoped to the Ops-Data-RG resource group.

Assign Sam the Storage Blob Data Contributor role scoped to the Tenant-Corporate-MG management group.

Show answer & explanation

Answer: Assign Sam the Storage Blob Data Contributor role scoped to the opsdatafiles storage account.

Answer

Assign Sam the Storage Blob Data Contributor role scoped to the opsdatafiles storage account.

Assigning the Storage Blob Data Contributor role scoped directly to the opsdatafiles storage account allows Sam to read, write, and delete blob data using Microsoft Entra ID authentication. Because it is scoped to the storage account rather than a higher level, and because the Storage Blob Data Contributor role does not grant management permissions over the storage account itself or role assignments, this fulfills all requirements under the principle of least privilege.

Step-by-Step Solution

Differentiate between Microsoft Entra ID roles and Azure RBAC roles.

Recognize that Global Administrator is a Microsoft Entra ID directory role, which does not automatically grant access to Azure subscription data resources without explicit RBAC assignments.

This establishes that additional action is needed despite Sam holding directory-level Global Administrator status.

Distinguish between Azure RBAC control plane and data plane roles.

Identify that the Storage Blob Data Contributor role is required for data plane operations (reading/writing blobs), whereas the Contributor role only manages control plane operations (infrastructure settings).

This ensures Sam has the correct functional access to perform the required tasks without holding excessive management permissions.

Select the correct target scope to enforce the principle of least privilege.

Determine that scoping the role assignment directly to the opsdatafiles storage account resource is more secure than scoping it at the resource group, subscription, or management group levels.

This limits Sam's access exclusively to the target storage account and prevents inheritance from granting access to other resources.

Key Concept

Applying Azure RBAC roles at the appropriate scope to separate control plane and data plane access under the principle of least privilege.

Estimated Time:1m 30s

PreviousPage 34 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept