Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 61Question →

An administrator needs to transfer 20 TB20\text{ TB} of data from an on-premises datacenter to Azure storage. The administrator wants to use physical shipping but does not want to purchase or prepare local hard drives, requiring Microsoft to provide the encrypted SSDs for the transfer. Which service should the administrator configure?

Show answer & explanation

Answer: Azure Data Box Disk

Answer

Azure Data Box Disk
The option selecting Azure Data Box Disk is correct because this service provides Microsoft-owned, pre-encrypted solid-state drives (SSDs) to the customer. This meets the requirement of physical shipping without needing the customer to buy or prepare their own hardware.

Step-by-Step Solution

1
Analyze the size of the dataset (20 TB20\text{ TB}) and physical shipping requirement.
The dataset size fits within the capacity limit of Azure Data Box Disk (up to 35 TB35\text{ TB} usable).
Understanding the scale helps filter out options like Data Box Heavy or standard online transfer if network bandwidth is constrained.
2
Evaluate the hardware ownership constraint.
The requirement states the administrator does not want to purchase or prepare local drives and needs Microsoft-supplied SSDs.
This rules out Azure Import/Export, which requires customer-owned drives prepared via the WAImportExport tool.
3
Select the Azure service that matches both capacity and hardware provision requirements.
Azure Data Box Disk is the only option that fulfills these constraints.
It offers Microsoft-owned, BitLocker-encrypted SSDs for convenient offline data transfer.

Key Concept

Distinguishing offline migration options based on hardware provisioning and data volume constraints.
Question 62Question →

An administrator is configuring a dynamic user group in a Microsoft Entra ID tenant. The group must automatically include all internal employees assigned to the Sales department. The group must exclude guest users and must not include any device objects. Which dynamic membership rule should the administrator use?

Show answer & explanation

Answer: (user.department -eq 'Sales') -and (user.userType -eq 'Member')

Answer

The dynamic membership rule containing '(user.department -eq 'Sales') -and (user.userType -eq 'Member')'
The rule using the format '(user.department -eq 'Sales') -and (user.userType -eq 'Member')' is correct because it uses valid Entra ID user attributes ('user.department' and 'user.userType'), correctly distinguishes internal employees ('Member') from guest users ('Guest'), and follows the required OData query syntax with hyphenated operators ('-eq' and '-and').

Step-by-Step Solution

1
Identify the target object type and the attributes required for the rule filter.
The group targets user objects. The required filters are the department (Sales) and the account type (internal employee, excluding guests).
Dynamic groups in Microsoft Entra ID must target either users or devices, and the filter conditions must map to valid object attributes.
2
Select the correct Entra ID user attributes for the filters.
The department is represented by 'user.department'. The internal vs. guest distinction is represented by 'user.userType', where 'Member' denotes internal employees and 'Guest' denotes external guests.
Using incorrect or non-existent attributes like 'userRole' will result in validation errors when saving the rule.
3
Apply the correct OData query syntax and structure.
Combine the attributes using the '-eq' and '-and' operators: '(user.department -eq 'Sales') -and (user.userType -eq 'Member')'.
Microsoft Entra ID dynamic group membership rules require OData v3.0 query syntax; using SQL-style operators or mixing user and device attributes is invalid.

Key Concept

Microsoft Entra ID dynamic group membership rules require valid OData properties and syntax, and cannot mix user and device objects.
Question 63Question →

A healthcare company, HealthPulse Diagnostics, uses the following Azure Management Group (MG) hierarchy to organize its subscriptions:

- Tenant Root Group
- HealthPulse-MG (Management Group)
- Clinical-MG (Management Group)
- SubscriptionA
- ResourceGroup1
- Research-MG (Management Group)
- SubscriptionB

The following settings are configured:

1. At HealthPulse-MG, an Azure Policy is assigned that denies the deployment of virtual machines unless they use the 'Standard_D2s_v3' SKU.
2. At Clinical-MG, an Azure Policy is assigned that denies the deployment of virtual machines unless they use the 'Standard_D4s_v3' SKU.
3. At SubscriptionA, User1 is assigned the Contributor role.

User1 attempts to deploy a new virtual machine using the 'Standard_D4s_v3' SKU into ResourceGroup1.

What is the outcome of the deployment attempt?

Show answer & explanation

Answer: The deployment fails because the Azure Policy assigned at HealthPulse-MG is inherited and must be satisfied, even though the VM complies with the policy at Clinical-MG.

Answer

The deployment fails because the Azure Policy assigned at HealthPulse-MG is inherited and must be satisfied, even though the VM complies with the policy at Clinical-MG.
The correct answer is that the deployment fails because Azure Policy assignments are cumulative and inherited down the Management Group hierarchy. A resource must comply with all applied policies. Since the VM SKU is 'Standard_D4s_v3', it violates the policy at HealthPulse-MG which restricts SKUs to 'Standard_D2s_v3'.

Step-by-Step Solution

1
Trace the inheritance of Azure Policies down the Management Group hierarchy.
ResourceGroup1 inherits the 'Standard_D2s_v3' SKU restriction policy from HealthPulse-MG and the 'Standard_D4s_v3' SKU restriction policy from Clinical-MG.
Azure Policy assignments at parent scopes are inherited by all child resources.
2
Determine the compliance requirements for the virtual machine.
The VM must satisfy all applied policies. Therefore, the VM must simultaneously meet both SKU restrictions, which is impossible.
Azure Policy evaluation is cumulative (logical AND).
3
Evaluate the User1 permissions against the deployment constraints.
Although User1 has the Contributor role on SubscriptionA, this role does not override policy compliance checks. The deployment is blocked.
RBAC defines who can perform actions, whereas Azure Policy defines resource properties. Both must be satisfied for a successful deployment.

Key Concept

Azure Policy inheritance and cumulative evaluation across Management Group hierarchies
Question 64Question →

For a new production deployment, an administrator configures the following Azure resource hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-AppStore`
- Resource Group: `RG-Services`
- App Service: `api-service-01`

A developer named DevUser1 is assigned the Reader role at the `Sub-AppStore` subscription level. DevUser1 is also assigned the Contributor role at the `RG-Services` resource group level.

Which of the following describes the effective permission of DevUser1 for `api-service-01`?

Show answer & explanation

Answer: Contributor permissions, because Azure RBAC roles are additive and the Contributor assignment at the resource group level applies.

Answer

Contributor permissions, because Azure RBAC roles are additive and the Contributor assignment at the resource group level applies.
The correct answer states that DevUser1 has Contributor permissions because Azure RBAC is additive. When a user is assigned multiple roles at different scopes, the effective permission is the sum of those permissions, so the Contributor role at the resource group scope grants full write access to the App Service, overriding the inherited read-only access from the subscription level.

Step-by-Step Solution

1
Determine the user's role assignment at the highest level of the scope hierarchy.
DevUser1 is assigned the Reader role at the subscription level, which inherits down to the resource group and the App Service.
This establishes the baseline inherited permissions.
2
Determine the user's role assignment at the lower levels of the scope hierarchy.
DevUser1 is assigned the Contributor role at the resource group level, which applies to the resource group and the App Service.
This identifies any additional permissions granted closer to the resource.
3
Combine the permissions using the additive rule of Azure RBAC.
Reader (inherited) + Contributor (explicit) = Contributor permissions on the App Service.
Azure RBAC evaluates the union of all role assignments applicable to the resource.

Key Concept

Azure RBAC role assignments are additive, meaning a user's effective permissions at a given scope are the union of all roles assigned at that scope and any inherited parent scopes.
Estimated Time:1m 0s
Question 65Question →

Your company has a Microsoft Entra ID tenant. The tenant contains an Administrative Unit named Sales-AU and a dynamic security group named Sales-Dynamic-Group. Sales-Dynamic-Group is a member of Sales-AU.

You assign a user named Admin1 the Groups Administrator role scoped to Sales-AU.

Admin1 attempts to perform the following tasks:
1. Modify the membership of an assigned security group named Sales-Manual-Group that is a member of Sales-AU.
2. Modify the dynamic membership rule of Sales-Dynamic-Group.

Which tasks can Admin1 successfully perform?

Show answer & explanation

Answer: Only task 1

Answer

Only task 1
The correct answer is the option stating that only task 1 can be performed. An administrator with the Groups Administrator role scoped to an Administrative Unit (AU) can manage the membership of standard assigned groups that are members of that AU. However, they cannot modify dynamic group rules. Modifying dynamic group rules requires directory-level (tenant-wide) Groups Administrator or Global Administrator privileges because dynamic rules are evaluated tenant-wide, and permitting an AU-scoped administrator to modify them would allow them to bypass the administrative boundary.

Step-by-Step Solution

1
Analyze the administrative role and scope assigned to the user.
Admin1 is assigned the Groups Administrator role scoped to the Sales-AU Administrative Unit.
This defines the security boundary and permissions of Admin1.
2
Evaluate the permissions required to modify the membership of the assigned security group.
Sales-Manual-Group is an assigned security group in Sales-AU. An Administrative Unit-scoped Groups Administrator is authorized to manage memberships of assigned groups within their unit.
Managing assigned groups within the scoped Administrative Unit is a core capability of the scoped Groups Administrator role.
3
Evaluate the permissions required to modify the dynamic group membership rules.
Sales-Dynamic-Group is a dynamic group. Modifying dynamic rules can potentially add any user in the entire tenant to the group if the rule query is adjusted. To prevent privilege escalation, dynamic group rule modifications are restricted to directory-level administrators.
Administrative Unit scoped roles do not permit editing dynamic group membership rules, even if the dynamic group is a member of the Administrative Unit.

Key Concept

Administrative Unit scope limits for group management and dynamic group rule modification constraints in Microsoft Entra ID
Question 66Question →

An administrator manages an Azure storage account named `storage1` that is configured to use Geo-Redundant Storage (GRS). Due to a severe regional outage in the primary region, the administrator decides to initiate a customer-managed failover for `storage1`. Which replication configuration will `storage1` have immediately after the failover completes?

Show answer & explanation

Answer: Locally Redundant Storage (LRS) in the secondary region

Answer

Locally Redundant Storage (LRS) in the secondary region.
When you initiate a failover for a Geo-Redundant Storage (GRS) account, the secondary region becomes the new primary region. During this process, the storage account is automatically converted to Locally Redundant Storage (LRS) in the new primary region. If you want to restore geo-redundancy, you must manually reconfigure the replication settings to GRS or RA-GRS after the failover completes.

Step-by-Step Solution

1
Analyze the starting replication configuration and the triggered event.
The storage account is configured as Geo-Redundant Storage (GRS) and a customer-managed failover is initiated due to a regional outage.
Determining the initial configuration is essential to predict the post-failover state of the storage account.
2
Determine the automatic replication state transition that occurs during failover.
During the failover process, the secondary region becomes the new primary region, and the replication type is downgraded to Locally Redundant Storage (LRS).
Azure automatically converts GRS and RA-GRS storage accounts to LRS in the target region to complete the failover.
3
Verify if manual intervention is required to restore high availability.
To restore geo-redundant replication, the administrator must manually reconfigure the storage account back to GRS or RA-GRS once the original region is available.
This confirms that the immediate post-failover state is non-redundant (LRS).

Key Concept

When a customer-managed failover is initiated for an Azure storage account configured with Geo-Redundant Storage (GRS), the secondary region becomes the new primary region, and the storage account's replication configuration is automatically converted to Locally Redundant Storage (LRS).
Question 67Question →

A company implements a governance strategy for its Azure resources. The environment includes a user account named Admin-User who is assigned the Global Administrator directory role in Microsoft Entra ID. No Azure Role-Based Access Control (RBAC) assignments have been made for Admin-User at any resource scope.

The resource hierarchy is structured as follows:
- Management Group: MG-Shared
- Subscription: Sub-Development
- Resource Group: RG-Web

Admin-User needs to assign the Virtual Machine Contributor role to a developer at the RG-Web scope.

Which configuration must be completed to enable Admin-User to assign this role?

Show answer & explanation

Answer: Elevate access in the Microsoft Entra properties to assign the User Access Administrator role at the root management group scope.

Answer

Elevate access in the Microsoft Entra properties to assign the User Access Administrator role at the root management group scope.
The correct option is correct because Microsoft Entra ID directory roles and Azure RBAC roles are separated. A Global Administrator has no default permissions on Azure subscriptions. To manage them, the administrator must elevate their access in Microsoft Entra properties, which temporarily assigns the User Access Administrator role at the root management group scope ('/'). This inherited role provides the authorization needed to make role assignments at any sub-scope, including the resource group level.

Step-by-Step Solution

1
Differentiate between Microsoft Entra ID directory roles and Azure RBAC roles.
Confirm that the Global Administrator directory role does not automatically grant access to subscriptions or resources within the Azure tenant.
Microsoft Entra ID and Azure Resource Manager run on separate identity and access control planes to ensure separation of duties.
2
Determine the mechanism to allow a Global Administrator to manage Azure subscription resources.
Identify that the administrator must toggle the 'Access management for Azure resources' option in the Microsoft Entra properties page.
This toggle explicitly authorizes the directory administrator to gain management access to the Azure resources.
3
Analyze the resulting role assignment and its inheritance scope.
The elevation assigns the User Access Administrator role at the root management group scope ('/'). This permission inherits down to all subscriptions, resource groups (including RG-Web), and resources in the tenant.
Once assigned at the root scope, the User Access Administrator role provides the necessary permissions to assign Azure RBAC roles (like Virtual Machine Contributor) at any level of the hierarchy.

Key Concept

Separation of planes between Microsoft Entra ID roles and Azure RBAC roles, and the process of elevating access to assign Azure RBAC roles.
Question 68Question →

A company has an Azure subscription containing a standard General Purpose v2 (GPv2) storage account named `storeprodwest2` in the West US 2 region. The storage account is configured with locally redundant storage (LRS) and contains a single blob container with 15 TB15\text{ TB} of data. A lifecycle management rule is currently active that transitions blobs older than 180180 days to the Archive tier, resulting in 4 TB4\text{ TB} of archived blobs. The company wants to migrate the storage account to zone-redundant storage (ZRS) with zero data loss and no downtime. You plan to request a live migration from Microsoft support. Which of the following actions must you perform before Microsoft can initiate the live migration?

Show answer & explanation

Answer: Disable or modify the lifecycle management policy, rehydrate all archived blobs to the Hot or Cool tier, and then submit the support request for live migration.

Answer

Disable or modify the lifecycle management policy, rehydrate all archived blobs to the Hot or Cool tier, and then submit the support request for live migration.
Live migration from LRS to ZRS is blocked if the storage account contains any blobs in the Archive tier. To resolve this, the administrator must first stop the lifecycle policy from archiving further blobs, rehydrate all existing archived blobs to Hot or Cool, and then submit the support request.

Step-by-Step Solution

1
Analyze the migration blocker.
The storage account contains 4 TB4\text{ TB} of archived blobs, which blocks live migration to ZRS.
Microsoft live migration from LRS to ZRS does not support accounts containing blobs in the Archive tier.
2
Disable or modify the lifecycle management policy.
The rule transitioning blobs to the Archive tier is disabled or paused.
This prevents rehydrated blobs from being automatically moved back to the Archive tier by the lifecycle engine before or during the migration.
3
Rehydrate the archived blobs.
All archived blobs are rehydrated to either the Hot or Cool tier.
Bringing the blobs back to an active online tier unblocks the live migration process.
4
Submit the support request.
The live migration request is successfully submitted and processed by Microsoft.
The account now meets the pre-requisites for live migration as all blobs reside in active tiers.

Key Concept

Replication live migration limitations and lifecycle management coordination
Question 69Question →

Your company has an Azure environment structured with the following resource hierarchy:

* Management Group: `MG-Retail`
* Subscription: `Sub-Retail-Prod`
* Resource Group: `RG-Store-Prod`
* Resource: Virtual Machine named `VM-Web-01`

A user named Admin1 is assigned the Microsoft Entra ID Global Administrator role, but currently has no explicit Azure RBAC role assignments. Admin1 needs to assign the Contributor role to a developer named User2 for the Virtual Machine `VM-Web-01`.

What must Admin1 do first to accomplish this?

Show answer & explanation

Answer: Configure the Access management for Azure resources setting in the Microsoft Entra admin center to grant Admin1 the User Access Administrator role at the root scope.

Answer

Configure the Access management for Azure resources setting in the Microsoft Entra admin center to grant the Global Administrator the User Access Administrator role at the root scope.
To manage Azure resource role assignments, a Microsoft Entra ID Global Administrator must first toggle the 'Access management for Azure resources' setting in the Microsoft Entra admin center. This action grants the administrator the built-in User Access Administrator role at the root scope (//), which inherits down the entire hierarchy, permitting them to manage RBAC role assignments at all management group, subscription, resource group, and resource levels.

Step-by-Step Solution

1
Elevate access for the Microsoft Entra ID Global Administrator in the Microsoft Entra admin center settings.
Admin1 is assigned the User Access Administrator role at the root scope (//).
By default, Microsoft Entra ID tenant administration roles do not inherit permissions to manage Azure subscription resources. Elevating access bridges the identity and resource authorization planes.
2
Access the Access Control (IAM) pane of the target virtual machine, resource group, or subscription.
Role assignment capability becomes active for the administrator due to root-level User Access Administrator permissions.
The User Access Administrator role permits role assignment actions at all child levels in the resource hierarchy.
3
Assign the Contributor role to User2 at the `VM-Web-01` resource scope.
User2 receives the Contributor role on the virtual machine resource.
This completes the requirement of granting User2 the Contributor role for the virtual machine.

Key Concept

Elevating access for a Microsoft Entra ID Global Administrator to assign Azure RBAC roles
Question 70Question →

Your organization needs to import 40 TB40\text{ TB} of on-premises data to an Azure Storage account. You have ordered an Azure Data Box device, and it has just been delivered to your datacenter. Which of the following shows the correct sequence of steps you must perform to configure the device, copy the data, and complete the import process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with cabling and configuring the IP address of the Data Box, followed by unlocking the device using credentials from the Azure portal. Next, the data is copied to the shares. Afterward, the prepare-to-ship verification is run, the device is shut down, and finally, it is shipped to the Azure datacenter where the upload progress is monitored.
The correct sequence follows the logical lifecycle of a physical Data Box deployment: first, network setup is required to reach the device management interface; second, security credentials from the Azure portal must be used to unlock the storage; third, the data is copied over the local network; fourth, a verification and locking process ('prepare to ship') must be executed before powering down; and finally, the device is shipped and the progress is tracked.

Step-by-Step Solution

1
Connect the Data Box to the local network and set its IP address.
Access to the Data Box local web user interface is established.
You must establish network connectivity first to manage the device.
2
Unlock the device using credentials retrieved from the Azure portal.
The device is unlocked and storage shares are made available.
The device is locked by default for security during shipping.
3
Copy data to the SMB or NFS shares on the Data Box.
All source files are transferred to the device storage.
This is the primary stage of transferring data onto the physical medium.
4
Execute the 'Prepare to ship' command and shut down the device.
Data integrity is validated, the device is locked, and it is safely powered down.
This verifies the transfer and secures the data before shipment.
5
Ship the device to the Azure datacenter and track its progress.
The physical device is shipped, the data is imported by Azure, and progress is monitored.
This initiates the final ingestion of the data into the target Azure Storage account.

Key Concept

Azure Data Box deployment and import workflow steps.
Question 71Question →

A logistics company, Zenith Freight Services, is migrating a multi-tier workload to the Sweden Central region. The deployment must adhere to the following strict requirements:

- The database layer (22 virtual machines) requires a VM-level compute uptime SLA of at least 99.99%99.99\%.
- The application layer (33 virtual machines) requires protection against localized hardware failures and updates within a single datacenter, while ensuring network latency between the instances is minimized.
- The web layer (22 existing standalone virtual machines: WebVM-Prod1 and WebVM-Prod2) must be integrated into a configuration that guarantees a 99.95%99.95\% compute SLA.

Which configuration strategy should the administrator implement to meet all requirements?

Show answer & explanation

Answer: Deploy the database VMs across multiple Availability Zones, deploy the application VMs in an Availability Set, and delete the existing web VMs, recreating them from their OS disks within a new Availability Set.

Answer

Deploy the database VMs across multiple Availability Zones, deploy the application VMs in an Availability Set, and delete the existing web VMs, recreating them from their OS disks within a new Availability Set.
Deploying the database VMs across multiple Availability Zones meets the 99.99%99.99\% SLA constraint. Placing the application VMs in an Availability Set ensures hardware redundancy (fault/update domains) while maintaining low latency. Deleting the existing web VMs and recreating them from their OS disks in a new Availability Set is the only valid method to transition running standalone VMs into an Availability Set to obtain the 99.95%99.95\% SLA.

Step-by-Step Solution

1
Analyze database high availability requirements.
Database VMs must be deployed across multiple Availability Zones to achieve the required 99.99%99.99\% compute SLA.
Azure offers a 99.99%99.99\% uptime SLA for VMs only when two or more instances are deployed across two or more Availability Zones in the same region.
2
Analyze application tier requirements.
Deploy the application VMs in an Availability Set within a single datacenter.
An Availability Set guarantees a 99.95%99.95\% SLA and distributes the VMs across multiple physical fault and update domains inside one datacenter, keeping inter-VM latency to a minimum.
3
Evaluate integration strategy for existing web VMs.
Plan to delete the existing web VMs and recreate them using their existing OS disks within a new Availability Set.
Azure does not support adding existing standalone VMs to an Availability Set. Recreation is required to change their high availability configuration.

Key Concept

High Availability Configuration and SLAs (Availability Sets vs. Availability Zones)
Question 72Question →

An organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:
* Management Group: MG-Root
* Azure Subscription: Sub-Ops
* Resource Group: RG-Prod-Shared
* Storage Account: sa-prod-logs (contains a blob container named `security-logs`)

The following settings and assignments are configured:
1. A user named User1 is assigned the Security Reader role in Microsoft Entra ID.
2. The tenant-level directory setting Access management for Azure resources is set to No.
3. User1 is assigned the User Access Administrator role at the Sub-Ops subscription scope.
4. User1 is assigned the Reader role at the RG-Prod-Shared scope.
5. A resource lock of type ReadOnly is applied directly to the sa-prod-logs storage account.

Which of the following describes the effective permissions of User1?

Show answer & explanation

Answer: User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container.

Answer

User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container.
The correct option is that User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container. User1 inherits the User Access Administrator role from the subscription level, which is additive and not overridden by the Reader assignment at the resource group level. Because User Access Administrator does not provide data plane permissions, User1 cannot write blobs to the storage container.

Step-by-Step Solution

1
Analyze the impact of User1's Microsoft Entra ID role and the directory setting.
Since the directory setting 'Access management for Azure resources' is set to 'No', User1's Global Administrator or Security Reader directory roles do not grant User Access Administrator rights on Azure subscription resources.
By default, Microsoft Entra ID administrator roles do not inherit permissions to Azure resources unless access management is explicitly enabled and elevated.
2
Determine the effective Azure RBAC permissions inherited by User1.
User1 has the User Access Administrator role at the subscription scope (Sub-Ops) and the Reader role at the resource group scope (RG-Prod-Shared). Under Azure RBAC, permissions are additive. The User Access Administrator role inherits down to all child scopes, giving User1 role management permissions at both RG-Prod-Shared and sa-prod-logs. The Reader role assignment does not override or deny these inherited permissions.
Azure RBAC roles do not deny permissions; they only add them. An explicit assignment at a lower scope (Reader) does not negate an inherited role from a higher scope (User Access Administrator).
3
Evaluate data plane access to the storage account sa-prod-logs.
Neither User Access Administrator (which only manages authorization) nor Reader (which reads resource configuration) grants data plane write permissions to upload blobs.
Control plane roles do not automatically grant data plane access (such as writing blobs to a container) without specific data plane roles like Storage Blob Data Contributor.
4
Synthesize the final effective permissions.
User1 can perform role assignments (like assigning the Reader role) at the resource group level but cannot upload blobs to the security-logs container.
This aligns with User1's effective control plane role (User Access Administrator) and lack of data plane roles.

Key Concept

Azure RBAC role inheritance, additive permissions, and the boundary between control plane roles and data plane access.
Estimated Time:3m 0s
Question 73Question →

An organization has 45 TB45\text{ TB} of data stored on an on-premises network-attached storage (NAS) system. The organization needs to migrate this data to an Azure Blob Storage account. The local network has a restricted outbound internet connection, providing only 10 Mbps10\text{ Mbps} of dedicated bandwidth for the migration. The migration must be completed within 30 days30\text{ days}. The organization's security policy strictly prohibits the shipment of customer-owned physical drives and requires that all data copied to temporary physical transport media be accessible directly via standard network protocols (SMB or NFS) without requiring staging hosts. Which migration solution should you recommend to meet these requirements?

Show answer & explanation

Answer: A single Azure Data Box device

Answer

A single Azure Data Box device
A single Azure Data Box device is the correct choice because the dataset size (45 TB45\text{ TB}) exceeds the 35 TB35\text{ TB} usable capacity limit of a single Azure Data Box Disk order. Additionally, Data Box supports direct copying over the local network via SMB and NFS protocols directly from the NAS, avoiding the need for staging hosts. Because the hardware is provided by Microsoft, it satisfies the security policy prohibiting customer-owned storage media. Finally, the restricted internet connection makes offline physical transfer the only feasible method within the 30 -day30\text{ -day} window.

Step-by-Step Solution

1
Calculate the network transfer time to determine if online migration is possible.
A 10 Mbps10\text{ Mbps} connection yields approximately 1.25 MB/s1.25\text{ MB/s}. Transferring 45 TB45\text{ TB} would take over 416 days416\text{ days}, which exceeds the 30 -day30\text{ -day} requirement.
To determine whether to use an online tool (like AzCopy) or an offline physical transfer service.
2
Filter the offline options based on security policies.
The Azure Import/Export service is eliminated because the organization's policy prohibits shipping customer-owned physical drives.
To ensure compliance with the organization's security and hardware ownership requirements.
3
Compare the remaining Microsoft-provided offline shipping solutions based on capacity and connectivity requirements.
Azure Data Box Disk is ruled out because it has a 35 TB35\text{ TB} usable capacity limit and requires staging hosts (no native NFS/SMB shares). Azure Data Box Heavy is ruled out because it is designed for datasets over 100 TB100\text{ TB}.
To identify the most cost-effective and technically compatible device that fits the 45 TB45\text{ TB} dataset and supports direct NFS/SMB access.

Key Concept

Selecting the appropriate Azure offline data transfer service (Azure Data Box, Data Box Disk, Data Box Heavy, or Azure Import/Export) based on network bandwidth, dataset size, security policies, and protocol compatibility.
Estimated Time:2m 0s
Question 74Question →

An administrator needs to configure temporary access to a blob container named invoices within an Azure Storage account named corpfinance2026. The configuration must satisfy the following security requirements:

- Prevent exposure of the storage account's primary and secondary access keys.
- Authenticate the client using a Microsoft Entra ID security principal.
- Limit the validity of the temporary access to exactly two hours.
- Enforce the use of the HTTPS protocol only.

Which two actions should the administrator perform to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Storage Blob Delegator role at the storage account level to the security principal generating the SAS.; Generate a User Delegation SAS token using the Microsoft Entra ID credentials of the authorized security principal.

Answer

Assign the Storage Blob Delegator role to the security principal generating the SAS at the storage account level, and generate a User Delegation SAS token using the Microsoft Entra ID credentials of the authorized security principal.
To secure access without exposing account access keys and to authenticate via Microsoft Entra ID, a User Delegation SAS should be generated. To generate a User Delegation SAS, the identity requesting the user delegation key must be assigned the Storage Blob Delegator role at the storage account scope.

Step-by-Step Solution

1
Identify the mechanism to prevent storage account key exposure.
Determine that a User Delegation SAS must be used, which is secured using Microsoft Entra ID credentials instead of storage account access keys.
User Delegation SAS relies on a user delegation key obtained via Microsoft Entra ID credentials, keeping access keys hidden.
2
Determine the RBAC roles required to generate the delegation key.
Select the Storage Blob Delegator role for the generating principal.
Generating a User Delegation SAS requires the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission, which is granted by the Storage Blob Delegator role.
3
Validate the expiration and protocol constraints.
Configure the SAS with a 2-hour duration and HTTPS-only protocol.
This satisfies the security requirements and fits within the 7-day maximum lifespan of a user delegation key.

Key Concept

User Delegation SAS and the required RBAC roles for generation.
Estimated Time:2m 0s
Question 75Question →

You have a General Purpose v2 (GPv2) storage account named `storagedata` in the East US region. The storage account is configured with Geo-Redundant Storage (GRS). A lifecycle management policy is active on the account, which automatically transitions block blobs in a container named `logs` to the Archive tier 30 days after they are created.

Due to a disaster in the primary region, you initiate a customer-managed failover for the storage account.

What is the state of the storage account replication and the archived blobs after the failover completes?

Show answer & explanation

Answer: The storage account replication changes to Locally Redundant Storage (LRS). The archived blobs remain in the Archive tier and must be rehydrated to an online tier before they can be read.

Answer

The storage account replication changes to Locally Redundant Storage (LRS). The archived blobs remain in the Archive tier and must be rehydrated to an online tier before they can be read.
When a customer-managed failover is initiated for a Geo-Redundant Storage (GRS) account, the secondary region becomes the new primary region, and the replication configuration changes to Locally Redundant Storage (LRS). Archived blobs are failed over successfully but remain in the Archive tier. They must be rehydrated to an online tier (Hot or Cool) before their data can be accessed.

Step-by-Step Solution

1
Identify the destination replication state after a customer-managed failover.
The storage account replication is converted to Locally Redundant Storage (LRS) in the new primary region.
Azure Storage failover converts Geo-Redundant Storage (GRS/RA-GRS) to locally redundant storage (LRS) in the secondary region, which becomes the new primary region.
2
Determine the status and access requirements of archived blobs during and after a failover.
Archived blobs remain in the Archive tier and are offline.
Failover does not automatically change the access tier of blobs or rehydrate them. They remain in the Archive tier and require rehydration to Hot or Cool to be accessed.

Key Concept

Storage Account Failover and Lifecycle Tier Behavior
Question 76Question →

An organization named Meridian Vanguard configures the following Azure Management Group (MG) hierarchy:

* Tenant Root Group
* Corporate-MG
* Production-MG
* App-Sub-01 (Subscription)
* Development-MG
* Dev-Sub-01 (Subscription)

An administrator named Alice needs to reorganize the environment by moving the subscription App-Sub-01 from Production-MG to Development-MG.

Alice has the following Azure role assignments:
* Owner role on the App-Sub-01 subscription
* Reader role on both Corporate-MG and Production-MG
* Contributor role on Development-MG

What is the outcome when Alice attempts to move the subscription?

Show answer & explanation

Answer: The move fails because Alice lacks the required write permissions on the source management group (Production-MG).

Answer

The move fails because Alice lacks the required write permissions on the source management group (Production-MG).
To move an Azure subscription to a new parent management group, an administrator must have write permissions at three distinct scopes: the subscription itself, the target management group, and the source management group. While Alice has Owner permissions on the subscription and Contributor permissions on the target (Development-MG), she only has Reader permissions on the source (Production-MG). Because the Reader role does not grant write permissions (specifically Microsoft.Management/managementGroups/subscriptions/write), the operation is blocked.

Step-by-Step Solution

1
Verify the permission requirements for moving a subscription within a management group hierarchy.
Moving a subscription requires write permissions (Microsoft.Management/managementGroups/subscriptions/write) on both the source and target management groups, as well as write permissions on the subscription itself.
Moving a subscription is an administrative change that modifies the child collections of both management groups and updates the subscription's parent metadata.
2
Evaluate Alice's permissions against the target management group (Development-MG) and the subscription (App-Sub-01).
Alice has Contributor permissions on the target MG (which includes write access) and Owner permissions on the subscription (which includes write access).
These roles satisfy the target-side and resource-side requirements of the move operation.
3
Evaluate Alice's permissions against the source management group (Production-MG).
Alice only has the Reader role on Production-MG, which does not grant write permissions.
Without write permissions on the source management group, Alice cannot authorize the removal of the subscription from that management group, causing the operation to fail.

Key Concept

Moving subscriptions between management groups requires write permissions at the source management group, the target management group, and on the subscription itself.
Estimated Time:2m 0s
Question 77Question →

An administrator is reviewing replication options for standard General Purpose v2 (GPv2) storage accounts in an Azure subscription.

Which of the following statements about Azure Storage replication options are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Locally-redundant storage (LRS) replicates data synchronously three times within a single physical location in the primary region.; Read-access geo-redundant storage (RA-GRS) provides read-only access to the data in the secondary region under normal operating conditions.

Answer

Locally-redundant storage (LRS) replicates data synchronously three times within a single physical location, and Read-access geo-redundant storage (RA-GRS) provides read-only access to the data in the secondary region under normal operating conditions.
Locally-redundant storage (LRS) is designed to replicate data synchronously three times within a single physical location in the primary region, providing cost-effective local redundancy. Read-access geo-redundant storage (RA-GRS) adds read-only access to the secondary region by exposing a secondary endpoint, enabling read capabilities without requiring a failover.

Step-by-Step Solution

1
Identify the replication mechanism of Locally-redundant storage (LRS).
LRS replicates three copies of the data synchronously within a single facility (data center) in the primary region.
This confirms the statement about LRS is correct.
2
Evaluate the read access capabilities of Geo-redundant storage (GRS) and Read-access geo-redundant storage (RA-GRS).
RA-GRS provides read access to the secondary region at all times, whereas GRS does not allow read access to the secondary region unless a failover is initiated.
This confirms the statement about RA-GRS is correct, and the statement about GRS is incorrect.
3
Verify the synchronization model of Zone-redundant storage (ZRS).
ZRS replicates data synchronously across three availability zones in the primary region.
This disproves the statement claiming ZRS replicates asynchronously.
4
Check the migration requirements for converting LRS to ZRS.
Converting LRS to ZRS cannot be configured as a simple update in the portal; it requires requesting a live migration or performing a manual data copy.
This disproves the statement claiming LRS to ZRS conversion can be done directly in the portal.

Key Concept

Azure Storage replication types, synchronization models, and migration paths.
Estimated Time:1m 0s
Question 78Question →

An administrator configures the network firewall for an Azure Storage account named storagedata1 that contains a blob container named container1 and an Azure file share named share1.

The firewall settings for storagedata1 are configured as follows:
- Public network access: Enabled from selected virtual networks and IP addresses
- Virtual networks: None
- Firewall (IP ranges): None
- Exceptions: "Allow Azure services on the trusted services list to access this storage account" is enabled

The administrator needs to support the following administrative tasks:
- Task 1: Backup share1 using Azure Backup.
- Task 2: Allow a developer named User1 to upload blobs to container1 using the Azure CLI from an on-premises computer with the public IP address 203.0.113.5. User1 is assigned the Owner role at the subscription level.
- Task 3: Allow an Azure Data Factory instance named ADF1 to copy data from container1. ADF1 has been assigned the Storage Blob Data Contributor role on storagedata1.

Which of the tasks will succeed under the current configuration without any further modifications?

Show answer & explanation

Answer: Task 1 only

Answer

Task 1 only
The task to backup the file share using Azure Backup succeeds because Azure Backup is a trusted Microsoft service that natively utilizes the firewall bypass exception for Azure Files backup. The other tasks fail because the network firewall blocks the user's public IP address (and Owner does not grant data-plane access), and Azure Data Factory requires a resource instance rule to bypass the firewall.

Step-by-Step Solution

1
Evaluate Task 1 (Azure Backup of Azure Files share1).
Task 1 succeeds.
Azure Backup is a trusted Microsoft service that can bypass the storage firewall to backup Azure File shares when the 'Allow trusted Microsoft services...' exception is enabled.
2
Evaluate Task 2 (User1 uploading blobs from public IP 203.0.113.5).
Task 2 fails.
The storage firewall is set to selected networks and does not have User1's public IP address listed in the firewall rules. Additionally, the Owner role is a control-plane role and does not grant data-plane access to blobs via Entra ID authentication.
3
Evaluate Task 3 (Azure Data Factory ADF1 copying data from container1).
Task 3 fails.
For Azure Data Factory to bypass the storage firewall over public endpoints, a resource instance rule matching the specific ADF instance must be configured. Enabling the general trusted Microsoft services exception alone is insufficient.

Key Concept

Azure Storage Account network security exceptions and resource instance rules.
Estimated Time:3m 0s
Question 79Question →

An administrator is configuring network security for an Azure storage account named `mystorage2026`. The storage account must allow traffic from `Subnet-A` of `VNet-A`, but block all other public internet traffic. Additionally, Azure Virtual Machine backup operations must continue to succeed.

Which two settings must be configured on the firewalls and virtual networks blade of the storage account to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Set the public network access to 'Enabled from selected virtual networks and IP addresses' and add Subnet-A of VNet-A; Select 'Allow trusted Microsoft services to access this storage account' as an exception

Answer

Configure the public network access to allow selected virtual networks and add the target subnet, and enable the bypass exception for trusted Microsoft services.
To limit access to a specific subnet while blocking general public traffic, the storage account firewall must be set to 'Enabled from selected virtual networks and IP addresses' and configured with the target subnet. Additionally, to allow Azure Backup to function, the 'Allow trusted Microsoft services to access this storage account' bypass option must be enabled.

Step-by-Step Solution

1
Configure the storage account firewall to restrict public access.
Changing the public network access setting from 'Enabled from all networks' to 'Enabled from selected virtual networks and IP addresses' blocks unauthorized public internet traffic.
This establishes the default deny rule for all traffic not originating from approved networks.
2
Associate the target virtual network and subnet with the storage account firewall.
Traffic originating from Subnet-A of VNet-A is allowed through the firewall.
This permits the required subnet to communicate with the storage account's public endpoint.
3
Enable the firewall bypass for trusted Microsoft services.
Azure Backup is permitted to bypass the firewall.
This ensures critical management and backup operations succeed despite the restricted network rule.

Key Concept

Azure Storage firewalls allow restricting public access to specific subnets while permitting trusted Microsoft services to bypass these restrictions.
Question 80Question →

An administrator is planning the deployment of two Azure virtual machines named VM-Web1 and VM-Web2 in the North Europe region. To meet high availability requirements, the administrator decides to deploy both virtual machines in a single Availability Set. Which of the following statements describe the features or configuration requirements of Azure Availability Sets? (Select two.)

Select all that apply

Show answer & explanation

Answer: Virtual machines are automatically distributed across multiple physical fault domains to protect against localized hardware failures.; Virtual machines are automatically distributed across multiple update domains to prevent simultaneous downtime during scheduled Azure platform updates.

Answer

The correct options are that virtual machines in an Availability Set are automatically distributed across physical fault domains to protect against hardware failures, and distributed across update domains to prevent simultaneous downtime during updates.
Availability Sets provide redundancy within a single datacenter. The option describing distribution across fault domains is correct because fault domains represent physical hardware racks that isolate hardware failures. The option describing distribution across update domains is correct because update domains ensure that only a portion of the VMs are rebooted at any given time during Azure host maintenance.

Step-by-Step Solution

1
Analyze the high availability capabilities of Azure Availability Sets.
Identify that Availability Sets protect virtual machines from localized hardware failures and platform updates within a single datacenter.
This establishes the scope of Availability Sets vs Availability Zones.
2
Determine how Availability Sets achieve localized redundancy.
Confirm that they automatically place VMs in separate fault domains (racks) and update domains (groups for platform updates).
This matches the core capabilities of Availability Sets.
3
Evaluate the configuration and deployment constraints of Availability Sets.
Understand that Availability Sets cannot span datacenters and VMs cannot be added post-creation.
This filters out invalid choices.

Key Concept

Azure Availability Sets provide redundancy within a single datacenter by distributing VMs across separate fault domains (racks) and update domains (logical groups for updates).
Estimated Time:1m 0s
PreviousPage 4 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin