Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 761Question →

You have a public load balancer named LB1 that uses the Basic SKU. LB1 distributes traffic to virtual machines in an Availability Set. You need to upgrade the load balancer to the Standard SKU to support Availability Zones. Which change must you make to the existing configuration before you can associate the backend virtual machines with the upgraded Standard SKU load balancer?

Show answer & explanation

Answer: Upgrade or replace the frontend public IP address with a Standard SKU public IP address.

Answer

Upgrade or replace the frontend public IP address with a Standard SKU public IP address.
A Standard SKU load balancer requires a Standard SKU public IP address for its frontend IP configuration. Basic SKU public IP addresses are not compatible with Standard SKU load balancers.

Step-by-Step Solution

1
Identify that a Standard SKU Load Balancer requires Standard SKU resources for its frontend and backend configurations.
Basic SKU frontend public IPs cannot be bound to Standard SKU Load Balancers.
Azure enforces SKU matching between the Load Balancer and its frontend public IP configuration.
2
Select the correct migration path for the frontend IP resource.
Upgrade the existing public IP SKU or provision a new Standard SKU public IP.
This satisfies the frontend SKU requirement of the Standard SKU Load Balancer.

Key Concept

Load Balancer SKU compatibility
Estimated Time:1m 30s
Question 762Question →

An administrator is configuring load balancing for a web application in an Azure subscription. The environment contains the following resources:
- A virtual network named VNet1 that has a single subnet named Subnet1.
- A virtual machine named VM1 deployed in Availability Zone 1. VM1 has a network interface named NIC1 connected to Subnet1. NIC1 has a Basic SKU public IP address named VM1-PIP assigned to its IP configuration.
- A virtual machine named VM2 deployed in Availability Zone 1. VM2 has a network interface named NIC2 connected to Subnet1 with no public IP address.
- A virtual machine named VM3 deployed in Availability Zone 2. VM3 has a network interface named NIC3 connected to Subnet1 with no public IP address.

You deploy a public Azure Load Balancer named LB1 using the Standard SKU. You associate LB1 with a Standard SKU public IP address named LB-PIP.

When you attempt to add VM1, VM2, and VM3 to the backend pool of LB1, the configuration fails with a SKU mismatch error.

Which action should you perform to successfully add all three virtual machines to the backend pool of LB1?

Show answer & explanation

Answer: Dissociate the Basic SKU public IP address from the network interface of VM1, or upgrade it to a Standard SKU public IP address.

Answer

Dissociate the Basic SKU public IP address from the network interface of VM1, or upgrade it to a Standard SKU public IP address.
The correct action is to dissociate the Basic SKU public IP address from the network interface of the virtual machine or upgrade it to a Standard SKU public IP address. Azure Standard Load Balancer backend pool members cannot have any Basic SKU public IPs associated with their network interfaces. All public IP addresses on network interfaces in the backend pool of a Standard Load Balancer must be of the Standard SKU.

Step-by-Step Solution

1
Identify the SKU of the load balancer and its backend pool requirements.
The Standard SKU load balancer is deployed, which requires all backend network interfaces to use Standard SKU resources (or no public IP) and supports cross-zone backend configurations.
Understanding Standard SKU requirements is necessary to locate the source of the deployment failure.
2
Analyze the IP configurations of the virtual machines in the backend pool.
VM1 has a Basic SKU public IP (VM1-PIP) assigned to its NIC, whereas VM2 and VM3 do not have public IPs.
A Basic SKU public IP directly assigned to a network interface in a Standard Load Balancer's backend pool causes a SKU mismatch error.
3
Determine the resolution for the SKU mismatch.
Dissociate VM1-PIP from VM1's NIC or upgrade VM1-PIP to the Standard SKU.
Eliminating the Basic SKU dependency on the network interface enables the VM to be successfully added to the Standard Load Balancer backend pool.

Key Concept

Standard Load Balancer backend pool member SKU compatibility constraints
Estimated Time:3m 0s
Question 763Question →

Your company has an Azure subscription containing a storage account named storagedata2026. The storage account contains a blob container named receipts.

You need to grant a Microsoft Entra ID group named SalesGroup the ability to read the blobs in the receipts container by using the Azure portal. The solution must use Microsoft Entra ID credentials for authentication and must follow the principle of least privilege.

Which two role assignments are required to achieve this goal? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Storage Blob Data Reader role to SalesGroup scoped to the receipts container.; Assign the Reader role to SalesGroup scoped to the storagedata2026 storage account.

Answer

Assigning the Storage Blob Data Reader role to SalesGroup scoped to the receipts container and the Reader role to SalesGroup scoped to the storagedata2026 storage account.
To access the blobs in the container via the Azure portal using Microsoft Entra ID authentication, two roles are required. First, the group requires a data plane role, specifically Storage Blob Data Reader, which must be scoped to the receipts container to comply with the principle of least privilege. Second, to navigate the Azure portal interface to locate the storage account and container, the group requires the control plane Reader role scoped to the storage account.

Step-by-Step Solution

1
Determine data plane role requirement.
The Storage Blob Data Reader role is identified as the least privileged built-in role to read blobs inside the container.
Data plane access is required to read blobs when using Microsoft Entra ID authentication.
2
Determine control plane role requirement for portal navigation.
The Reader role scoped to the storage account is selected to provide portal visibility.
Without control plane access, users cannot navigate the Azure portal interface to locate the storage account and container.
3
Verify scope alignment with least privilege.
The data plane role is scoped to the specific container ('receipts') and the control plane role is scoped to the storage account ('storagedata2026').
This limits the permissions to only what is necessary, satisfying the least privilege constraint.

Key Concept

To access storage account blob data using Microsoft Entra ID in the Azure portal, a user requires a data plane role (e.g., Storage Blob Data Reader) for data access and a control plane role (e.g., Reader) at the storage account scope (or higher) to navigate the portal interface.
Question 764Question →

An organization organizes its cloud resources using the following Azure hierarchy:
* Management Group: MG-Corporate
* Subscription: Sub-FinApp
* Resource Group: RG-BillingData

A developer named Casey must be able to deploy and manage virtual machines and storage accounts within RG-BillingData. Additionally, Casey requires the ability to read, write, and delete blobs inside the storage accounts in RG-BillingData. Casey must not have permissions to assign RBAC roles to other users or manage resource locks.

Which role assignment configuration meets these requirements while adhering to the principle of least privilege?

Show answer & explanation

Answer: Assign the Contributor role and the Storage Blob Data Contributor role to Casey at the RG-BillingData scope.

Answer

Assign the Contributor role and the Storage Blob Data Contributor role to Casey at the RG-BillingData scope.
The correct configuration is to assign both the Contributor role and the Storage Blob Data Contributor role to the developer at the resource group scope. The Contributor role provides control plane access to manage the lifecycle of virtual machines and storage accounts, but lacks data plane permissions to read or write blobs. Adding the Storage Blob Data Contributor role provides the required blob-level data access. Neither role allows managing role assignments or locks, preserving the principle of least privilege.

Step-by-Step Solution

1
Analyze the control plane requirements.
Casey needs to deploy and manage virtual machines and storage accounts. The built-in Contributor role at the resource group scope (RG-BillingData) provides these capabilities without granting role assignment or lock management permissions.
Contributor allows full management of resources but does not allow authorization actions like assigning roles.
2
Analyze the data plane requirements.
Casey needs to read, write, and delete blobs inside the storage accounts. Since control plane roles like Contributor do not grant data plane access to blobs, a data plane role such as Storage Blob Data Contributor must be assigned.
Azure separation of concerns requires distinct roles for control plane (Contributor) and data plane (Storage Blob Data Contributor).
3
Evaluate role inheritance and scope restriction.
Assigning Contributor at the subscription scope and Reader at the resource group scope does not restrict access because RBAC permissions are inherited and additive; they cannot be restricted by a lower-level assignment.
Azure RBAC does not support explicit deny assignments through standard role assignments.
4
Distinguish between Azure RBAC and Microsoft Entra ID roles.
Global Administrator is a Microsoft Entra ID role that cannot be scoped to a resource group and is inappropriate for resource-level management.
Microsoft Entra ID roles manage directory tenant-level identity objects, whereas Azure RBAC roles manage Azure resources.

Key Concept

Azure RBAC separation of control plane and data plane permissions, role inheritance, and the distinction between Entra ID and RBAC roles.
Question 765Question →

You need to route all outbound internet traffic from a subnet named Subnet1 through an Azure Firewall deployed in the same virtual network. You create a new route table and associate it with Subnet1. You add a route for the destination 0.0.0.0/00.0.0.0/0. Which next hop type must you select to ensure the traffic is routed through the Azure Firewall?

Show answer & explanation

Answer: Virtual appliance

Answer

Virtual appliance
To route subnet traffic through an Azure Firewall, you must create a route table, associate it with the subnet, and add a route for destination 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual appliance. You must also specify the private IP address of the Azure Firewall as the next hop address.

Step-by-Step Solution

1
Determine the device type of Azure Firewall.
Azure Firewall is a security virtual appliance running inside the virtual network.
Knowing that it acts as a virtual appliance dictates the routing configuration required in the User-Defined Route (UDR).
2
Select the correct next hop type for the route table rule.
Select Virtual appliance as the next hop type.
This tells the route table to send traffic matching the destination prefix (in this case, all internet traffic at 0.0.0.0/00.0.0.0/0) to a virtual appliance's IP address instead of using default system routing.
3
Provide the next hop address.
Enter the private IP address of the Azure Firewall.
This ensures that the traffic is delivered directly to the firewall's internal interface for inspection and filtering.

Key Concept

Azure Firewall routing with User-Defined Routes (UDR)
Question 766Question →

An Azure environment contains the following resources:
- A virtual network named `VNet1` with two subnets: `Subnet-Web` (10.0.1.0/2410.0.1.0/24) and `Subnet-DB` (10.0.2.0/2410.0.2.0/24).
- A virtual machine named `VM-Web1` in `Subnet-Web` with its network interface associated with an Application Security Group (ASG) named `ASG-Web`.
- A virtual machine named `VM-DB1` in `Subnet-DB` with its network interface associated with an ASG named `ASG-DB`.
- `Subnet-DB` is associated with a Network Security Group (NSG) named `NSG-Subnet`.
- The network interface of `VM-DB1` is associated with an NSG named `NSG-NIC`.

The NSGs contain the following custom inbound security rules:

### NSG-Subnet
PrioritySourceDestinationPortProtocolAction
20010.0.1.0/24AnyAnyAnyDeny
### NSG-NIC
PrioritySourceDestinationPortProtocolAction
300VirtualNetworkAnyAnyAnyDeny

You need to allow database traffic from `VM-Web1` to `VM-DB1` on TCP port 1433. All other traffic from `Subnet-Web` to `Subnet-DB` must remain blocked.

Which two security rules should you create to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In `NSG-Subnet`, create an inbound rule with Priority 150, Source: `ASG-Web`, Destination: `ASG-DB`, Port: 1433, Protocol: TCP, Action: Allow.; In `NSG-NIC`, create an inbound rule with Priority 250, Source: `ASG-Web`, Destination: `ASG-DB`, Port: 1433, Protocol: TCP, Action: Allow.

Answer

In NSG-Subnet, create an inbound rule with Priority 150, Source: ASG-Web, Destination: ASG-DB, Port: 1433, Protocol: TCP, Action: Allow; and in NSG-NIC, create an inbound rule with Priority 250, Source: ASG-Web, Destination: ASG-DB, Port: 1433, Protocol: TCP, Action: Allow.
To establish connectivity, the traffic must be allowed by both the subnet-level NSG (NSG-Subnet) and the NIC-level NSG (NSG-NIC). In Azure, NSG rules are processed in priority order where lower numbers have higher precedence. To bypass the deny rule in NSG-Subnet (priority 200), the allow rule must have a priority number lower than 200 (such as 150). To bypass the deny rule in NSG-NIC (priority 300), the allow rule must have a priority number lower than 300 (such as 250). Since both VMs are associated with ASGs in the same virtual network, using ASG-Web and ASG-DB as source and destination is fully supported.

Step-by-Step Solution

1
Analyze the subnet-level NSG configuration (`NSG-Subnet`).
The existing deny rule at priority 200 blocks traffic from 10.0.1.0/2410.0.1.0/24 (which includes `VM-Web1`). To allow the database traffic, a rule allowing traffic from `ASG-Web` to `ASG-DB` on TCP port 1433 must be created with a priority number lower than 200 (such as 150) so that it is processed first.
Azure NSG rules are processed in priority order (lower numbers have higher precedence).
2
Analyze the NIC-level NSG configuration (`NSG-NIC`).
The existing deny rule at priority 300 blocks all VirtualNetwork traffic. To allow the database traffic to reach `VM-DB1`, an allow rule must be created in `NSG-NIC` with a priority number lower than 300 (such as 250) so that it is processed first.
Both subnet-level and NIC-level NSGs must allow the traffic for the connection to succeed.

Key Concept

Azure Network Security Groups evaluate rules sequentially based on priority (lower numbers are processed first). Inbound traffic must be permitted by both the subnet-level NSG and the network interface (NIC) level NSG to reach a virtual machine.
Question 767Question →

An administrator is configuring a custom subdomain named `sales.contoso.com` for an Azure App Service web app named `app1`. The web app currently runs on a Basic B1 App Service plan.

The administrator has already created a CNAME record in the DNS zone that points `sales` to `app1.azurewebsites.net`.

The administrator needs to secure the custom domain using a free Azure App Service Managed Certificate.

Which two actions should the administrator perform? (Choose two.)

Select all that apply

Show answer & explanation

Answer: In the Azure portal, add the custom domain `sales.contoso.com` to `app1`.; In the Azure portal, generate and bind an App Service Managed Certificate for `sales.contoso.com`.

Answer

To complete the configuration, the administrator must add the custom domain to the web app in the Azure portal, and then generate and bind the free App Service Managed Certificate to the custom domain.
To secure a custom domain using a free App Service Managed Certificate, the custom domain must first be added to the web app. Once added, a managed certificate can be generated and bound to that custom domain. Both of these actions are supported on the Basic B1 tier.

Step-by-Step Solution

1
Add the custom domain to the App Service web app.
The domain is successfully mapped to the web app.
Azure App Service requires the domain to be mapped to the resource before a managed certificate can be issued and bound to it.
2
Generate and bind the App Service Managed Certificate.
A free SSL certificate is created and bound to the custom domain using SNI SSL.
This secures the custom domain with SSL/TLS without requiring a third-party certificate.

Key Concept

Configuring custom domains and securing them with App Service Managed Certificates on supported App Service Plan pricing tiers.
Question 768Question →

An administrator configures virtual networking in an Azure subscription. A virtual network named `VNet-Corp` contains two subnets: `Subnet-Web` (10.10.1.0/2410.10.1.0/24) and `Subnet-DB` (10.10.2.0/2410.10.2.0/24). A virtual machine named `VM-Web1` is deployed in `Subnet-Web` and has its network interface associated with an Application Security Group (ASG) named `ASG-Web`. A virtual machine named `VM-DB1` is deployed in `Subnet-DB` and has its network interface associated with an ASG named `ASG-DB`.

The subnets and network interfaces are configured with the following Network Security Groups (NSGs):

* `NSG-SubnetDB` is associated with `Subnet-DB` and contains the following inbound rule:
* Priority: 120120, Source: `ASG-Web`, Port: 14331433, Destination: Any, Action: Allow
* `NSG-NicDB` is associated with the network interface of `VM-DB1` and contains the following inbound rules:
* Priority: 110110, Source: `ASG-Web`, Port: 14331433, Destination: Any, Action: Deny
* Priority: 130130, Source: Any, Port: 14331433, Destination: Any, Action: Allow

When `VM-Web1` attempts to establish a database connection to `VM-DB1` on TCP port 14331433, what is the outcome of the traffic flow?

Show answer & explanation

Answer: The connection is blocked by the network security group associated with the network interface (NIC) of VM-DB1.

Answer

The connection is blocked by the network security group associated with the network interface (NIC) of VM-DB1.
For inbound network traffic to a virtual machine, Azure evaluates Network Security Groups (NSGs) in a specific order: first, the NSG associated with the subnet is evaluated, and then the NSG associated with the network interface (NIC) is evaluated. The traffic must be allowed by both NSGs to reach the VM. Here, the subnet-level NSG (NSG-SubnetDB) has a rule with priority 120 that allows traffic on port 1433 from ASG-Web, so it passes this stage. However, at the NIC-level NSG (NSG-NicDB), the rule with priority 110 denies traffic on port 1433 from ASG-Web. Because priority 110 is lower than priority 130, the Deny rule takes precedence, and the traffic is blocked at the network interface of VM-DB1.

Step-by-Step Solution

1
Evaluate the subnet-level network security group (NSG) for inbound traffic to the destination subnet.
The traffic originating from VM-Web1 (associated with ASG-Web) destined for VM-DB1 on TCP port 1433 matches the inbound rule in NSG-SubnetDB (Priority 120, Action: Allow). The traffic is allowed through the subnet boundary.
Inbound traffic must first pass through the subnet-level NSG associated with the destination subnet.
2
Evaluate the NIC-level network security group (NSG) for inbound traffic reaching the destination network interface.
The traffic matches two inbound rules in NSG-NicDB: Priority 110 (Action: Deny) and Priority 130 (Action: Allow). Since 110 is a lower number than 130, it has higher precedence. The traffic is denied.
After passing the subnet-level NSG, inbound traffic must pass through the NIC-level NSG associated with the destination network interface.
3
Combine the evaluations to determine the final traffic outcome.
The traffic is allowed by the subnet NSG but blocked by the NIC NSG, resulting in a blocked connection.
For inbound traffic to succeed, it must be allowed by both the subnet-level NSG and the NIC-level NSG.

Key Concept

Inbound traffic evaluation order and rule priority in Azure Network Security Groups (NSGs)
Estimated Time:1m 30s
Question 769Question →

You are configuring a public Azure Load Balancer. You have provisioned a public IP address named IP-Front that uses the Basic SKU. You plan to distribute traffic to virtual machines.

Which two configurations must you select to ensure compatibility with IP-Front?

Select all that apply

Show answer & explanation

Answer: A Basic SKU Load Balancer; Virtual machines deployed within a single Availability Set

Answer

To ensure compatibility with a Basic SKU public IP address, you must configure a Basic SKU Load Balancer and ensure the backend virtual machines are deployed within a single Availability Set.
The correct options are a Basic SKU Load Balancer and virtual machines deployed within a single Availability Set. Azure requires the Load Balancer SKU to match the Public IP SKU. A Basic SKU Public IP can only be associated with a Basic SKU Load Balancer. Additionally, the backend pool of a Basic SKU Load Balancer is restricted to virtual machines that reside within the same Availability Set or Virtual Machine Scale Set.

Step-by-Step Solution

1
Identify the IP address SKU and its compatibility constraints.
The public IP address uses the Basic SKU. Azure requires that the public IP address SKU matches the Load Balancer SKU. Therefore, a Basic SKU Load Balancer must be selected.
Standard Load Balancers require Standard Public IPs, while Basic Load Balancers require Basic Public IPs.
2
Determine the backend pool configuration constraints for the selected Load Balancer SKU.
The Basic SKU Load Balancer limits the backend pool to virtual machines residing in a single Availability Set or Virtual Machine Scale Set.
Basic Load Balancers do not support cross-availability zone or cross-virtual network backend pools, which are capabilities reserved for the Standard SKU Load Balancer.

Key Concept

Azure Load Balancer SKU selection and backend pool constraints
Question 770Question →

You are planning to deploy a new Azure virtual machine named VM1 to host a critical application in the East US region.

You need to configure VM1 to meet the following requirements:
- Provide protection against a single datacenter outage within the region.
- Support automated backups of VM1 to a Recovery Services Vault named RSV1.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM1 in an Availability Zone.; Deploy RSV1 in the East US region.

Answer

Deploy VM1 in an Availability Zone, and deploy RSV1 in the East US region.
To satisfy the requirement of protecting the application from a single datacenter outage, VM1 must be deployed across Availability Zones. Availability Zones are physically separate locations within an Azure region. Additionally, to back up VM1 to RSV1, the vault must be created in the same region as the virtual machine (East US).

Step-by-Step Solution

1
Select the appropriate high availability option for VM1.
VM1 is deployed in an Availability Zone within the East US region.
Availability Zones provide datacenter-level redundancy by placing the VM in a physically isolated facility within the region.
2
Determine the required region for RSV1 to enable backup.
RSV1 is deployed in the East US region.
Azure Backup mandates that the Recovery Services Vault must be in the same region as the virtual machine it protects.

Key Concept

Configuring virtual machine high availability and backup region alignment.
Question 771Question →

An administrator is configuring an Azure Virtual Machine Scale Set (VMSS) named `vmss-web` to support automatic operating system (OS) image upgrades. The scale set currently uses a custom image from an Azure Compute Gallery and is configured with a manual upgrade policy.

Which sequence of actions should the administrator perform to configure and apply automatic OS image upgrades to the existing instances?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To enable and apply automatic OS image upgrades to existing instances of a VMSS, the administrator must first associate an Application Health Extension or health probe, set the upgrade policy mode to Rolling, enable the automatic OS image upgrade property, and finally manually upgrade the existing instances to the latest model.
The correct sequence starts with establishing health monitoring (via probe or extension) since it is a prerequisite for enabling automatic upgrades. The upgrade policy mode must then be changed to Rolling, followed by enabling the automatic OS upgrade property. Finally, because the VMSS was using a manual upgrade policy, the existing instances must be manually updated to the latest model to apply the new settings.

Step-by-Step Solution

1
Configure application health monitoring by adding an Application Health Extension or linking an Azure Load Balancer health probe.
Azure has a mechanism to monitor the health of the application running on the scale set instances.
Automatic OS image upgrades require health monitoring to safely roll out updates without causing downtime.
2
Modify the upgrade policy of the scale set from Manual to Rolling.
The scale set is configured to roll out updates in batches.
Automatic OS upgrades are only supported when the upgrade policy mode is set to Rolling.
3
Set the enableAutomaticOSUpgrade property to true in the VMSS configuration properties.
The automatic OS upgrade feature is enabled in the scale set model.
This property instructs Azure to automatically apply new OS image versions published to the Azure Compute Gallery.
4
Perform a manual upgrade on the existing VMSS instances to bring them to the latest scale set model.
All existing instances are updated to the latest model configuration.
Since the VMSS used a manual upgrade policy, existing instances do not automatically pull model changes. They must be manually upgraded once to apply the new policy configuration.

Key Concept

Enabling automatic OS image upgrades on a VMSS requires configuring health monitoring (probe or extension), setting the upgrade policy to Rolling, enabling the automatic upgrade property, and manually upgrading existing instances to apply the new model configuration.
Question 772Question →

An administrator is designing a hybrid networking architecture to connect an on-premises datacenter to Azure using an ExpressRoute connection. The Azure environment consists of a hub virtual network (`VNet-Hub` with address space 10.100.0.0/1610.100.0.0/16) and a peered spoke virtual network (`VNet-Spoke` with address space 10.105.0.0/1610.105.0.0/16).

You plan to deploy an Azure Kubernetes Service (AKS) cluster into a subnet named `AKS-Subnet` (10.105.4.0/2210.105.4.0/22) within `VNet-Spoke`. The cluster will host standard microservices and a specialized high-performance GPU-intensive workload.

You must configure the cluster to meet the following requirements:
* Pods must be allocated IP addresses from a private network range that does not consume IP addresses from the `VNet-Spoke` address space.
* The Kubernetes API server must be accessible only via a private IP address within the virtual network.
* The specialized GPU-intensive workload must run on a dedicated node pool named `gpu-pool`, and no standard microservice pods may be scheduled on the GPU nodes.

Which of the following configurations should you implement to meet the requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy the AKS cluster as a private cluster and use the Azure CNI Overlay network plugin.; Apply a taint with the value sku=gpu:NoSchedule to the gpu-pool node pool.

Answer

To configure the cluster according to the requirements, you should deploy the AKS cluster as a private cluster using the Azure CNI Overlay network plugin, and apply a taint with the value sku=gpu:NoSchedule to the dedicated gpu-pool node pool.
To satisfy the networking requirements, deploying the AKS cluster as a private cluster ensures that the Kubernetes API server is accessible only via a private endpoint in the virtual network. Utilizing the Azure CNI Overlay network plugin allows pods to be assigned IP addresses from a private CIDR range that is completely separate from the virtual network's IP address space, preventing the depletion of virtual network IPs while maintaining direct pod-to-pod routing. To meet the workload isolation requirement, applying a taint with the value sku=gpu:NoSchedule to the gpu-pool node pool prevents the Kubernetes scheduler from placing any pods on these nodes unless they have a matching toleration. Standard microservice pods without the toleration will not be scheduled on the GPU nodes.

Step-by-Step Solution

1
Select the appropriate networking model for IP conservation and security.
Deploy the cluster as a private cluster using the Azure CNI Overlay network plugin.
Private cluster mode assigns a private IP to the API server. Azure CNI Overlay assigns pods IP addresses from a private CIDR block separate from the virtual network, preventing virtual network IP exhaustion.
2
Isolate the GPU node pool to prevent regular workloads from running on it.
Configure the gpu-pool node pool with the taint sku=gpu:NoSchedule.
Taints prevent pods from scheduling on nodes unless the pods have a matching toleration. This guarantees the node pool is dedicated only to the GPU workload.

Key Concept

Configuring AKS network models (Azure CNI Overlay and Private Cluster) and node pool scheduling constraints (taints and tolerations).
Estimated Time:2m 0s
Question 773Question →

Solaris Energy Partners has an Azure subscription named sub-solaris-dev. The subscription contains an Azure Key Vault named kv-solaris-dev and a Storage account named sasolarisdev. The Key Vault has soft-delete enabled, purge protection disabled, and uses the Azure role-based access control (Azure RBAC) permission model.

You associate a user-assigned managed identity named uami-solaris-storage with sasolarisdev.

You need to configure sasolarisdev to use a customer-managed key stored in kv-solaris-dev by using uami-solaris-storage. The solution must follow the principle of least privilege.

Which configuration steps should you perform?

Show answer & explanation

Answer: Enable purge protection on kv-solaris-dev, and assign the Key Vault Crypto Service Encryption User role to uami-solaris-storage on kv-solaris-dev.

Answer

Enable purge protection on the Key Vault, and assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity on the Key Vault.
To successfully configure customer-managed keys (CMK) for an Azure Storage account, two primary security configurations must be met: the Key Vault must have both soft-delete and purge protection enabled, and the managed identity assigned to the storage account must have sufficient data plane permissions on the Key Vault. The Key Vault Crypto Service Encryption User role is the minimum built-in Azure RBAC role that provides the required data plane permissions (wrap, unwrap, and get key) for storage account encryption, conforming to the principle of least privilege.

Step-by-Step Solution

1
Check Key Vault data protection features.
Determine that purge protection must be enabled on kv-solaris-dev.
Azure Storage encryption with customer-managed keys requires both soft-delete and purge protection to be enabled on the Key Vault to prevent data loss due to accidental key deletion.
2
Identify the authentication identity used by the Storage account.
Identify the user-assigned managed identity, uami-solaris-storage, associated with the storage account.
The storage account uses this identity to authenticate and request key operations from the Key Vault.
3
Assign the least-privileged role on the Key Vault.
Assign the Key Vault Crypto Service Encryption User role to the managed identity.
For Key Vaults using Azure RBAC, this built-in role provides the necessary data plane permissions to perform key operations without granting administrative control plane access.

Key Concept

Key Vault requirements and Azure RBAC data plane permissions for Azure Storage Customer-Managed Keys (CMK) configuration.
Question 774Question →

An administrator manages an Azure subscription. A resource group named `rg-analytics-prod` has a tag named `CostCenter: Finance` and a `ReadOnly` resource lock. Inside `rg-analytics-prod`, there is an Azure Storage account named `sa-analytics`.

The administrator needs to perform the following actions:
1. Verify the tags currently applied to the `sa-analytics` storage account.
2. Modify the configuration of `sa-analytics` to enable public network access.

Which of the following describes the outcome of these actions?

Show answer & explanation

Answer: The storage account does not inherit the tag, and the configuration modification is blocked.

Answer

The storage account does not inherit the tag, and the configuration modification is blocked.
The correct answer is correct because Azure tags applied to a resource group are not inherited by resources within that group. Meanwhile, resource locks are inherited by all child resources, and a ReadOnly lock blocks write and update operations, including changing the configuration of a storage account.

Step-by-Step Solution

1
Analyze the tag inheritance behavior for the storage account.
The storage account does not automatically inherit the 'CostCenter: Finance' tag applied to its parent resource group.
Azure Resource Manager does not automatically propagate tags from a resource group to the resources inside it.
2
Analyze the lock inheritance behavior and its impact on the configuration modification.
The storage account inherits the 'ReadOnly' lock, and the attempt to enable public network access is blocked.
Resource locks are inherited by child resources, and a 'ReadOnly' lock prevents any updates or modifications to the resource configuration.

Key Concept

Resource lock and tag inheritance behavior in Azure Resource Manager
Estimated Time:1m 15s
Question 775Question →

You are designing a new Azure virtual network named `vnet-finance-prod` with an address space of 10.200.0.0/2210.200.0.0/22. You need to create a subnet named `snet-app` that must support at least 60 concurrent virtual machine instances. What is the smallest subnet size, represented by the largest CIDR prefix length, that you can assign to `snet-app` to satisfy this requirement?

Show answer & explanation

Answer: /25

Answer

The correct subnet size prefix is /25.
The correct prefix is /25 because a /25 subnet provides 128 total IP addresses. Subtracting the 5 IP addresses reserved by Azure yields 123 usable IP addresses, which is the smallest standard prefix that can accommodate the required 60 hosts.

Step-by-Step Solution

1
Determine the required number of IP addresses including Azure's reserved addresses.
Azure reserves 5 IP addresses in every subnet: the first four (network address, default gateway, DNS, and one reserved for future use) and the last one (broadcast address). Therefore, the subnet must support at least 60+5=6560 + 5 = 65 total IP addresses.
To ensure there are enough usable IP addresses for the virtual machines, Azure's management reservations must be added to the requested host count.
2
Find the smallest subnet block (power of 2) that can contain the required total IP addresses.
The powers of 2 are: 3232 (for /27), 6464 (for /26), and 128128 (for /25). Since 65 is greater than 64, the next block size is 128.
IP subnets are allocated in powers of 2, so the block size must be at least 65.
3
Convert the block size to the corresponding CIDR prefix length.
A block size of 128 corresponds to a /25 CIDR prefix (32−log⁡2(128)=2532 - \log_2(128) = 25).
The prefix length determines the mask size, where a larger prefix represents a smaller block size.

Key Concept

Azure virtual networks reserve 5 IP addresses per subnet, which must be factored into subnet sizing calculations.
Estimated Time:1m 30s
Question 776Question →

An organization plans to host a public web application on two virtual machines named VM1 and VM2 in a single virtual network. VM1 is located in Availability Zone 1, and VM2 is located in Availability Zone 2. Both virtual machines require dedicated public IP addresses on their network interfaces to support direct administrative connections. You need to configure a public Azure Load Balancer to distribute incoming traffic to VM1 and VM2. Which configuration should you use for the load balancer and the virtual machine public IP addresses?

Show answer & explanation

Answer: A Standard SKU load balancer, and Standard SKU public IP addresses for the virtual machines.

Answer

A Standard SKU load balancer, and Standard SKU public IP addresses for the virtual machines.
The correct configuration uses a Standard SKU load balancer paired with Standard SKU public IP addresses for the virtual machines. Standard SKU is necessary for the load balancer because the backend VMs are distributed across multiple Availability Zones, which Basic Load Balancers do not support. Standard SKU is also required for the virtual machines' public IP addresses because Standard Load Balancers do not allow backend pool members to have Basic SKU public IP addresses associated with their network interfaces.

Step-by-Step Solution

1
Analyze the virtual machine deployment locations and determine the load balancer SKU requirement.
Since VM1 is in Availability Zone 1 and VM2 is in Availability Zone 2, a Standard SKU Load Balancer is required because the Basic SKU Load Balancer does not support backend pools containing VMs in different Availability Zones.
Basic Load Balancer backend pools are limited to virtual machines in a single availability set or a single virtual machine, whereas Standard Load Balancer supports zone-redundant configurations and zonal VMs.
2
Evaluate the virtual machine network interface public IP address requirements.
The virtual machines require dedicated public IP addresses. When using a Standard Load Balancer, all public IP configurations associated with backend pool members must match the load balancer's SKU.
Azure enforces SKU consistency across resources within a Standard Load Balancer's backend pool. Combining a Standard Load Balancer with Basic SKU public IPs on backend NICs is not allowed.
3
Combine SKU compatibility rules to identify the correct resource configuration.
Select the configuration that pairs a Standard SKU load balancer with Standard SKU public IPs for the virtual machines.
This configuration satisfies both the zone-span requirement and the SKU alignment constraint.

Key Concept

Azure Load Balancer SKU selection and backend pool resource SKU compatibility constraints
Estimated Time:2m 0s
Question 777Question →

Your company has an Azure environment with a virtual network named `VNet-Corp` (10.150.0.0/1610.150.0.0/16). `VNet-Corp` contains three subnets:

* `Subnet-Web` (10.150.1.0/2410.150.1.0/24)
* `Subnet-DMZ` (10.150.2.0/2410.150.2.0/24)
* `Subnet-DB` (10.150.3.0/2410.150.3.0/24)

A virtual machine named `NVA1` is deployed in `Subnet-DMZ` to act as a firewall. `NVA1` has a single network interface with the private IP address 10.150.2.1010.150.2.10. You must ensure that all traffic from `Subnet-Web` destined for `Subnet-DB` is routed through `NVA1` for security inspection, while ensuring other subnet traffic is unaffected by this custom routing configuration.

Which of the following actions should you perform? (Select TWO choices.)

Select all that apply

Show answer & explanation

Answer: Configure a route table with a route for destination 10.150.3.0/2410.150.3.0/24, setting the next hop type to Virtual appliance and the next hop IP address to 10.150.2.1010.150.2.10, and associate this route table with `Subnet-Web`.; Enable IP forwarding on the network interface attached to the `NVA1` virtual machine.

Answer

Configure a route table with a route for destination 10.150.3.0/2410.150.3.0/24, setting the next hop type to Virtual appliance and the next hop IP address to 10.150.2.1010.150.2.10, and associate this route table with `Subnet-Web`. Additionally, enable IP forwarding on the network interface attached to the `NVA1` virtual machine.
To successfully route traffic from the Web subnet to the database subnet through the firewall virtual machine, you must create a user-defined route table with a route pointing to the database subnet prefix (10.150.3.0/2410.150.3.0/24) with a next hop type of Virtual appliance and the private IP address of the firewall (10.150.2.1010.150.2.10). This route table must then be associated with the source subnet (`Subnet-Web`). Additionally, you must enable IP forwarding on the network interface of the firewall VM in Azure to prevent Azure from discarding packets not destined directly for the firewall's IP address.

Step-by-Step Solution

1
Define a custom routing rule for traffic going to the database subnet.
A route table is created containing a route for 10.150.3.0/2410.150.3.0/24 with the next hop type set to Virtual appliance and the next hop IP address set to 10.150.2.1010.150.2.10.
This configuration overrides the default system route (10.150.0.0/1610.150.0.0/16 -> Virtual Network) for traffic destined to the database subnet by using the Longest Prefix Match (LPM) rule, ensuring it is redirected to the firewall's IP address.
2
Associate the route table with the source subnet.
The route table is associated with `Subnet-Web`.
Routing decisions are applied to outbound traffic leaving a subnet; therefore, the route table must be associated with the subnet hosting the source resources.
3
Configure the network interface of the firewall virtual machine to allow transit traffic.
IP forwarding is enabled on the network interface of `NVA1`.
By default, Azure network interfaces drop packets that do not match the interface's IP address. Enabling IP forwarding allows the interface to receive and forward transit network traffic.

Key Concept

User-Defined Routes (UDRs) allow administrators to override default system routing tables. To route traffic through a Network Virtual Appliance (NVA), you must specify a next hop type of Virtual appliance, provide the NVA's local IP address, associate the route table with the originating subnet, and enable IP forwarding on the NVA's network interface.
Question 778Question →

Your department uses a multi-tier Azure resource layout to manage corporate workloads. The layout contains the following hierarchy:

* Management Group: MG-Corp-Prod
* Subscription: Sub-AppServices
* Resource Group: RG-WebApps
* Virtual Machines: vm-frontend-01, vm-frontend-02

You are tasked with assigning permissions to a security group named App-Operators. The members of App-Operators must be able to perform the following tasks:

1. Start, stop, and restart the virtual machines in RG-WebApps.
2. View monitoring metrics and activity logs for all resources in the Sub-AppServices subscription.

You need to assign the appropriate built-in Azure roles to App-Operators. The solution must follow the principle of least privilege.

Which two role assignments should you configure? (Select two.)

Select all that apply

Show answer & explanation

Answer: Virtual Machine Contributor at the scope of the RG-WebApps resource group; Monitoring Reader at the scope of the Sub-AppServices subscription

Answer

Assign the Virtual Machine Contributor role at the scope of the RG-WebApps resource group and the Monitoring Reader role at the scope of the Sub-AppServices subscription.
To satisfy the VM power management requirement with least privilege, the security group should be assigned the Virtual Machine Contributor role at the scope of the RG-WebApps resource group. To satisfy the monitoring visibility requirement across the entire subscription, the security group should be assigned the Monitoring Reader role at the scope of the Sub-AppServices subscription. Both assignments target the narrowest necessary role and scope.

Step-by-Step Solution

1
Identify the minimum required role and scope for the first requirement (manage VM power states).
The Virtual Machine Contributor role allows managing VM power states (start, stop, restart) without full resource control. The scope must be limited to the RG-WebApps resource group to enforce least privilege.
Assigning roles at lower scopes prevents accidental access or configuration changes in other resource groups.
2
Identify the minimum required role and scope for the second requirement (view monitoring metrics and logs).
The Monitoring Reader role allows reading all monitoring data (metrics and logs). The scope must be the Sub-AppServices subscription because the metrics and logs must be viewed for all resources within the subscription.
Assigning permissions at the subscription level allows inheritance to apply the Monitoring Reader role to all current and future resource groups within that subscription.

Key Concept

Azure Role-Based Access Control (RBAC) scopes, built-in roles, and inheritance logic.
Estimated Time:1m 30s
Question 779Question →

An Azure Storage account named saexports hosts a blob container named monthly-reports. A data analyst named Maria plans to use the AzCopy command-line utility to download files from the container by authenticating via Microsoft Entra ID. You need to identify the minimum Azure role-based access control (Azure RBAC) configuration that allows Maria to download the blobs. Which role assignment should you configure for Maria?

Show answer & explanation

Answer: Configure an Azure RBAC assignment for the Storage Blob Data Reader role, scoped to the container, for Maria.

Answer

Configure an Azure RBAC assignment for the Storage Blob Data Reader role, scoped to the container, for Maria.
The correct configuration is assigning the Storage Blob Data Reader role scoped to the container. This grants Maria data plane read access to the blobs inside the monthly-reports container using Microsoft Entra ID credentials without granting unnecessary write or control plane permissions.

Step-by-Step Solution

1
Determine the access plane required for the operation.
Maria needs to read blob data, which requires data plane access rather than control plane access.
Control plane roles like Reader or Storage Account Contributor manage the storage account resource itself but do not grant data plane access to read blob content when authenticating via Microsoft Entra ID.
2
Identify the least-privileged role that satisfies the data plane read requirement.
The Storage Blob Data Reader role is the least privileged built-in role that allows read-only access to blob data.
Other data plane roles like Storage Blob Data Contributor or Storage Blob Data Owner grant write or delete access, which violates the principle of least privilege.
3
Determine the correct scope for the role assignment.
Assign the role at the container scope (monthly-reports).
Scoping the assignment to the specific container restricts access only to the necessary files, adhering to the principle of least privilege.

Key Concept

Assigning least-privilege Azure RBAC data plane roles for blob storage authentication via Microsoft Entra ID.
Estimated Time:1m 30s
Question 780Question →

An administrator is deploying a public Azure Load Balancer using the Standard SKU. The administrator needs to configure the frontend IP configuration for the load balancer. Which Public IP address SKU must the administrator select to support this configuration?

Show answer & explanation

Answer: Standard SKU only

Answer

Standard SKU only
Standard Azure Load Balancers require Standard SKU Public IP addresses for their frontend IP configurations. Azure does not support mixing SKUs (e.g., using a Basic SKU Public IP with a Standard SKU Load Balancer).

Step-by-Step Solution

1
Identify the SKU of the load balancer being deployed.
The load balancer uses the Standard SKU.
The load balancer SKU determines the supported SKUs for associated resources like frontend IP configurations and backend pools.
2
Determine the SKU compatibility requirements for the frontend public IP address.
Standard Load Balancers require Standard SKU Public IP addresses.
Azure enforces SKU matching between the Load Balancer and the Public IP resource to ensure consistent performance, SLA, and feature availability.

Key Concept

Azure Load Balancer and Public IP SKU compatibility requirements
PreviousPage 39 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin