All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

You plan to deploy an Azure Firewall instance. You need to create a dedicated subnet for the firewall within an existing VNet. Which two configuration requirements must be met for this subnet? (Select two.)

Select all that apply

The subnet must be named AzureFirewallSubnet.

The subnet address prefix must be

/26

or larger.

The subnet must be named AzureFirewallSubnet_FW.

The subnet address prefix must be

/29

or larger.

The subnet must have a Network Security Group (NSG) associated with it to control inbound traffic.

Show answer & explanation

Answer: The subnet must be named AzureFirewallSubnet.; The subnet address prefix must be $/26$ or larger.

Answer

The dedicated subnet hosting Azure Firewall must be named exactly 'AzureFirewallSubnet' and must have an address prefix of

/26

or larger.

For a successful Azure Firewall deployment, the firewall subnet must be named exactly 'AzureFirewallSubnet' and have an IP address range of

/26

or larger to accommodate firewall scaling and management.

Step-by-Step Solution

Identify the naming requirement for the Azure Firewall subnet.

The subnet name must be exactly 'AzureFirewallSubnet'.

Azure Firewall looks for this specific subnet name during deployment.

Determine the minimum subnet size (CIDR block) required for the firewall.

The subnet prefix size must be

/26

or larger.

This provides sufficient IP addresses for scaling and maintenance operations.

Verify if external security groups like NSGs are allowed on this subnet.

No NSG should be associated with the 'AzureFirewallSubnet'.

NSGs can disrupt stateful packet inspection and lead to routing issues.

Key Concept

Azure Firewall Subnet Requirements

Question 782Question →

An administrator is configuring a hub-and-spoke network topology in Azure. The environment contains the following resources:

* A hub virtual network named VNet-Hub ( $10.100.0.0/16$ ) that contains a subnet named Subnet-Hub where a virtual machine named VM-Hub is deployed. VNet-Hub also contains an active virtual network gateway.
* A spoke virtual network named VNet-Spoke1 ( $10.101.0.0/16$ ) that contains a subnet named Subnet-Spoke1 where a virtual machine named VM-Spoke1 is deployed.
* A spoke virtual network named VNet-Spoke2 ( $10.102.0.0/16$ ) that contains a subnet named Subnet-Spoke2 where a virtual machine named VM-Spoke2 is deployed.

Virtual network peering is configured between VNet-Hub and VNet-Spoke1, and between VNet-Hub and VNet-Spoke2.

You need to configure the network to meet the following requirements:
1. VM-Spoke1 must be able to communicate with on-premises networks using the virtual network gateway in VNet-Hub.
2. VM-Spoke1 must be able to communicate directly with VM-Spoke2.
3. VM-Spoke2 must not be able to use the virtual network gateway in VNet-Hub.

Which three configurations should you implement? (Select THREE.)

Select all that apply

Configure a direct virtual network peering connection between VNet-Spoke1 and VNet-Spoke2.

On the peering connection from VNet-Hub to VNet-Spoke1, select the option to allow gateway transit.

On the peering connection from VNet-Spoke1 to VNet-Hub, select the option to use remote gateways.

On the peering connection from VNet-Spoke2 to VNet-Hub, select the option to use remote gateways.

On the peering connection from VNet-Hub to VNet-Spoke1, select the option to allow forwarded traffic.

Configure no additional connections, as virtual network peering automatically routes traffic transitively through VNet-Hub.

Show answer & explanation

Answer: Configure a direct virtual network peering connection between VNet-Spoke1 and VNet-Spoke2.; On the peering connection from VNet-Hub to VNet-Spoke1, select the option to allow gateway transit.; On the peering connection from VNet-Spoke1 to VNet-Hub, select the option to use remote gateways.

Answer

To meet the requirements, you must configure a direct virtual network peering connection between VNet-Spoke1 and VNet-Spoke2, select 'Allow gateway transit' on the peering from VNet-Hub to VNet-Spoke1, and select 'Use remote gateways' on the peering from VNet-Spoke1 to VNet-Hub.

To satisfy the requirements, direct spoke-to-spoke communication must be established using a direct peering connection, as peering is non-transitive. Additionally, using VNet-Hub's gateway from VNet-Spoke1 requires enabling gateway transit on the hub-side peering and enabling remote gateways on the spoke-side peering. To prevent VNet-Spoke2 from using the gateway, the remote gateway setting must remain disabled on its peering connection.

Step-by-Step Solution

Address the communication requirement between VM-Spoke1 and VM-Spoke2.

Configure a direct virtual network peering connection between VNet-Spoke1 and VNet-Spoke2.

Because virtual network peering is non-transitive by default, VM-Spoke1 cannot communicate with VM-Spoke2 through VNet-Hub. A direct peering is required.

Allow VNet-Spoke1 to use VNet-Hub's gateway.

On the peering connection from VNet-Hub to VNet-Spoke1, select the option to allow gateway transit.

This configuration permits the virtual network gateway in the hub network to share its transit capability with the peered spoke network.

Enable the transit routing from VNet-Spoke1's side.

On the peering connection from VNet-Spoke1 to VNet-Hub, select the option to use remote gateways.

This configures VNet-Spoke1 to route on-premises bound traffic to the virtual network gateway in VNet-Hub.

Ensure VNet-Spoke2 cannot use VNet-Hub's gateway.

Do not select the option to use remote gateways on the peering connection from VNet-Spoke2 to VNet-Hub.

Leaving this setting disabled prevents VM-Spoke2 from sending transit traffic through the hub's virtual network gateway.

Key Concept

Virtual network peering transitivity and gateway transit configuration.

Question 783Question →

Your company has an Azure subscription containing two peered virtual networks: `VNet1` ( $10.10.0.0/16$ ) and `VNet2` ( $10.20.0.0/16$ ). `VNet1` contains a subnet named `Subnet-Web` ( $10.10.1.0/24$ ) and a subnet named `Subnet-Sec` ( $10.10.10.0/24$ ). A Network Virtual Appliance (NVA) with the private IP address $10.10.10.4$ is deployed in `Subnet-Sec` and has IP forwarding enabled on its network interface. `VNet2` contains two subnets named `Subnet-App` ( $10.20.1.0/24$ ) and `Subnet-DB` ( $10.20.2.0/24$ ). You associate a user-defined route table named `RT-Web` with `Subnet-Web`. You must ensure that traffic from `Subnet-Web` destined for the database servers in `Subnet-DB` is routed through the NVA for security inspection, while traffic destined for the application servers in `Subnet-App` continues to use the direct peering connection. Which route should you add to `RT-Web`?

Address prefix:

10.20.2.0/24

, Next hop type: Virtual appliance, Next hop IP address:

10.10.10.4

Address prefix:

10.20.0.0/16

, Next hop type: Virtual appliance, Next hop IP address:

10.10.10.4

Address prefix:

10.20.2.0/24

, Next hop type: Virtual network gateway, Next hop IP address:

10.10.10.4

Address prefix:

10.20.2.0/24

, Next hop type: Virtual network

Show answer & explanation

Answer: Address prefix: $10.20.2.0/24$ , Next hop type: Virtual appliance, Next hop IP address: $10.10.10.4$

Answer

Address prefix:

10.20.2.0/24

, Next hop type: Virtual appliance, Next hop IP address:

10.10.10.4

The correct configuration uses the address prefix

10.20.2.0/24

to match only the database subnet traffic. By specifying the next hop type as 'Virtual appliance' and the next hop IP address as

10.10.10.4

, traffic to the database subnet is redirected to the NVA. Traffic destined for the application subnet (

10.20.1.0/24

) does not match this prefix and instead falls back to the default peered virtual network system route (

10.20.0.0/16

), fulfilling all requirements.

Step-by-Step Solution

Identify the target destination subnet and its IP range.

The target destination for the security inspection is `Subnet-DB` which has the prefix

10.20.2.0/24

We need to ensure that only traffic destined for this specific subnet is routed to the NVA.

Determine the required route prefix to satisfy the routing requirements.

Using a prefix of

10.20.2.0/24

targets only `Subnet-DB`. Using a prefix of

10.20.0.0/16

would also route `Subnet-App` (

10.20.1.0/24

) traffic through the NVA, which violates the requirement to use the direct peering connection.

Azure routing uses the Longest Prefix Match (LPM) rule. If we define a route for

10.20.2.0/24

, it is a more specific match than the system route for VNet peering (

10.20.0.0/16

) and will override it for `Subnet-DB` traffic. `Subnet-App` traffic will still match the system route.

Select the correct next hop type and next hop IP address.

The next hop type must be 'Virtual appliance', and the next hop IP address must be the private IP of the NVA, which is

10.10.10.4

An NVA is a custom virtual machine that acts as a router/firewall. Traffic must be directed to its specific interface IP address using the 'Virtual appliance' type.

Key Concept

Azure User-Defined Routes (UDR) override system routes when a user-defined route has a matching or more specific prefix (Longest Prefix Match). For routing traffic through a Network Virtual Appliance (NVA), the next hop type must be 'Virtual appliance' and the next hop IP address must match the NVA's interface IP.

Question 784Question →

An organization plans to deploy a public Azure Load Balancer named $LB1$ to distribute HTTPS traffic across three virtual machines: $VM1$ , $VM2$ , and $VM3$ . The virtual machines are configured as follows:

* $VM1$ and $VM2$ are member instances of an Availability Set named $AS1$ .
* $VM3$ is a standalone virtual machine.
* $VM1$ has a public IP address named $IP1$ that uses the Basic SKU.

You plan to configure $LB1$ using the Standard SKU. Which two actions must you perform to ensure that all three virtual machines can be successfully configured in the backend pool of $LB1$ and receive load-balanced traffic?

Select all that apply

Disassociate the Basic SKU public IP address from

VM1

or upgrade it to a Standard SKU public IP address.

Associate a Network Security Group (NSG) with the subnet of the virtual machines and create an inbound rule to allow the load-balanced traffic.

Re-create

VM3

within the same Availability Set as

VM1

and

VM2

Configure the frontend IP of the load balancer to use a dynamic Standard SKU public IP address.

Show answer & explanation

Answer: Disassociate the Basic SKU public IP address from $VM1$ or upgrade it to a Standard SKU public IP address.; Associate a Network Security Group (NSG) with the subnet of the virtual machines and create an inbound rule to allow the load-balanced traffic.

Answer

The administrator must disassociate the Basic SKU public IP address from the virtual machine or upgrade it to a Standard SKU public IP address, and associate a Network Security Group (NSG) with the subnet of the virtual machines to allow inbound traffic.

To use a Standard Load Balancer, all public IP addresses on the network interfaces of VMs in the backend pool must also be of the Standard SKU, or be disassociated. In addition, Standard SKU resources are secure by default, meaning inbound flows are blocked unless explicitly allowed by a Network Security Group (NSG) associated with the subnet or network interface.

Step-by-Step Solution

Analyze backend pool requirements for Standard SKU Load Balancers.

Standard SKU load balancers allow a mix of standalone VMs and VMs in availability sets, meaning VM3 does not need to be re-created in the availability set.

To verify if VM3 needs to be modified to match the availability set configuration of VM1 and VM2.

Inspect public IP SKU compatibility on the backend network interfaces.

VM1 has a Basic SKU public IP. Standard Load Balancer backend pool members cannot have Basic SKU public IPs associated with their NICs.

To identify SKU mismatches on backend pool members that would block the deployment.

Remediate the SKU mismatch on the backend network interface.

Disassociate the Basic SKU IP from VM1 or upgrade it to Standard SKU.

To satisfy the SKU uniformity requirement of the Standard Load Balancer.

Determine the default security behavior of the Standard SKU Load Balancer.

Standard SKU resources are secure by default. Traffic is blocked without an explicit permit rule.

To ensure traffic can flow to the backend virtual machines once they are added to the pool.

Configure a Network Security Group (NSG) to allow inbound traffic.

Associate an NSG with the subnet and add an inbound security rule allowing the load-balanced traffic.

To permit inbound flow through the Standard Load Balancer to the backend VMs.

Key Concept

Standard SKU Load Balancer configuration requirements, backend pool SKU alignment, and secure-by-default architecture.

Estimated Time:3m 0s

Question 785Question →

A cloud architect is designing a high-availability solution for an application running on three standalone Azure virtual machines. The virtual machines are named VM-App1, VM-App2, and VM-App3, and they are deployed in the East US region. These virtual machines are not associated with any Availability Sets or Virtual Machine Scale Sets. You need to configure a public-facing Azure Load Balancer to distribute inbound traffic across these three virtual machines.

Which two configuration choices must you make to ensure the load balancer functions correctly? (Select two.)

Select all that apply

Deploy the load balancer as a Standard SKU load balancer.

Associate a Standard SKU public IP address with the frontend IP configuration.

Deploy the load balancer as a Basic SKU load balancer.

Associate a Basic SKU public IP address with the frontend IP configuration.

Associate a Basic SKU public IP address directly with each backend virtual machine's network interface.

Show answer & explanation

Answer: Deploy the load balancer as a Standard SKU load balancer.; Associate a Standard SKU public IP address with the frontend IP configuration.

Answer

Deploy the load balancer as a Standard SKU load balancer, and associate a Standard SKU public IP address with the frontend IP configuration.

Deploying the load balancer as a Standard SKU and associating a Standard SKU public IP address with the frontend IP configuration is correct. Standard Load Balancers support backend pools consisting of standalone virtual machines in a virtual network, whereas Basic Load Balancers require virtual machines to be part of the same Availability Set or Virtual Machine Scale Set. Additionally, Standard Load Balancers require Standard SKU public IP addresses for their frontend configurations; mixing Standard Load Balancers with Basic SKU public IP addresses is not supported.

Step-by-Step Solution

Analyze the backend pool resource requirements.

The target virtual machines are standalone and not part of an Availability Set or Virtual Machine Scale Set.

This constraint dictates the SKU of the load balancer, as Basic Load Balancers do not support backend pools containing standalone virtual machines.

Select the correct Load Balancer SKU.

Standard SKU Load Balancer is selected.

Only the Standard SKU Load Balancer can distribute traffic to standalone virtual machines across a virtual network.

Determine the public IP address SKU requirement for the frontend configuration.

Standard SKU public IP address is selected.

Standard Load Balancers require that all associated IP resources, including the frontend IP configurations, use the Standard SKU.

Key Concept

Azure Load Balancer SKU features and IP compatibility constraints require matching SKUs (Standard Load Balancer with Standard Public IP) and define which backend pool member types (such as standalone VMs) are supported.

Question 786Question →

An administrator is configuring security rules for a virtual network named `VNet1` in an Azure subscription. `VNet1` contains two subnets: `Subnet-Web` ( $10.0.1.0/24$ ) and `Subnet-App` ( $10.0.2.0/24$ ).

The following virtual machines are deployed:
- `VM-Web1` in `Subnet-Web`
- `VM-App1` and `VM-App2` in `Subnet-App`

An Application Security Group (ASG) named `ASG-App` is created, and the network interface of `VM-App1` (`nic-app1`) is associated with `ASG-App`.

A Network Security Group (NSG) named `NSG-SubnetApp` is associated with `Subnet-App` and contains the following inbound rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
150	`VirtualNetwork`	`*`	`ASG-App`	443	TCP	Allow
200	`*`	`*`	`*`	`*`	`*`	Deny

Another NSG named `NSG-NICApp2` is associated with the network interface of `VM-App2` (`nic-app2`) and contains the following inbound rule:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
110	`10.0.1.0/24`	`*`	`*`	443	TCP	Deny

Currently, HTTPS traffic from `VM-Web1` can reach `VM-App1` on port 443, but cannot reach `VM-App2` on port 443.

Which two actions should you perform to allow HTTPS traffic on port 443 from `VM-Web1` to `VM-App2`?

Select all that apply

Associate `nic-app2` with `ASG-App`.

In `NSG-NICApp2`, add an inbound security rule with a priority of 100 that allows TCP traffic on port 443 from `10.0.1.0/24` to any destination.

In `NSG-NICApp2`, add an inbound security rule with a priority of 120 that allows TCP traffic on port 443 from `10.0.1.0/24` to any destination.

In `NSG-SubnetApp`, change the priority of the rule with priority 150 to 250.

Associate `nic-app1` with `NSG-NICApp2`.

Show answer & explanation

Answer: Associate `nic-app2` with `ASG-App`.; In `NSG-NICApp2`, add an inbound security rule with a priority of 100 that allows TCP traffic on port 443 from `10.0.1.0/24` to any destination.

Answer

Associate the network interface of the target virtual machine with the Application Security Group, and add an inbound security rule to the network interface's security group with a priority of 100 that allows TCP traffic on port 443 from the source subnet to any destination.

To allow HTTPS traffic to the target virtual machine, traffic must pass both the subnet-level NSG and the network interface (NIC)-level NSG. First, the subnet NSG has an inbound rule that allows HTTPS traffic from the virtual network to the Application Security Group (ASG). Associating the target virtual machine's network interface with this ASG allows the traffic to pass the subnet NSG instead of being blocked by the lower-priority catch-all deny rule. Second, the NIC-level NSG has a rule that explicitly denies port 443 traffic from the source subnet. To permit the traffic, a new inbound rule must be created on this NIC-level NSG with a priority value lower than 110 (such as 100) to override the existing deny rule, as rules with lower priority numbers have higher precedence in Azure NSGs.

Step-by-Step Solution

Evaluate the subnet-level security rules to identify why traffic is blocked at the subnet boundary.

The subnet-level NSG has a rule at priority 150 allowing port 443 traffic specifically to the Application Security Group (ASG), followed by a deny-all rule at priority 200. Since the target network interface is not associated with the ASG, its traffic is blocked by the priority 200 rule.

Understanding which subnet-level rule is blocking or allowing the traffic is the first step in resolving the connectivity issue.

Associate the target network interface with the Application Security Group.

Traffic destined for the target virtual machine now matches the priority 150 allow rule in the subnet-level NSG and passes the subnet boundary.

This allows the traffic to bypass the subnet-level deny-all rule.

Evaluate the network interface (NIC)-level security rules for the target virtual machine.

The NIC-level NSG contains a rule at priority 110 that explicitly denies port 443 traffic from the source subnet.

Even though traffic passes the subnet-level NSG, it is still blocked at the NIC boundary.

Add a higher-precedence allow rule to the NIC-level NSG.

Creating an allow rule for port 443 traffic with a priority of 100 overrides the deny rule at priority 110.

In Azure NSGs, rules with lower priority numbers have higher precedence. A priority 100 rule is evaluated before priority 110, allowing the connection to succeed.

Key Concept

Azure NSG rule evaluation logic requires that traffic must be allowed at both the subnet level and the network interface (NIC) level. Within an NSG, rules are processed in priority order (lowest number first) until a match is found.

Question 787Question →

An administrator is configuring network security for a multi-tier application in an Azure subscription. The environment contains a virtual network named `VNet1` ( $10.1.0.0/16$ ) with two subnets: `Subnet-Web` ( $10.1.1.0/24$ ) and `Subnet-App` ( $10.1.2.0/24$ ).

- `Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Subnet-Web`.
- `Subnet-Web` contains a virtual machine named `VM-Web`. The network interface of `VM-Web` is associated with an Application Security Group (ASG) named `ASG-Web-Servers` and an NSG named `NSG-NIC-Web`.
- `Subnet-App` is associated with an NSG named `NSG-Subnet-App` that contains only default rules.
- `Subnet-App` contains a virtual machine named `VM-App` ( $10.1.2.4$ ). The network interface of `VM-App` is associated with an ASG named `ASG-App-Servers`.

The inbound security rules for the NSGs are configured as follows:

NSG-Subnet-Web Inbound Rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
110	10.1.2.0/24	*	*	443	TCP	Allow
140	ASG-App-Servers	*	ASG-Web-Servers	443	TCP	Deny

NSG-NIC-Web Inbound Rules:

Priority	Source	Source Port	Destination	Destination Port	Protocol	Action
120	ASG-App-Servers	*	ASG-Web-Servers	443	TCP	Deny
150	10.1.2.0/24	*	*	443	TCP	Allow

A user attempts to establish an HTTPS connection from `VM-App` to `VM-Web`.

What is the result of the connection attempt?

The connection is blocked at the network interface level (NSG-NIC-Web) because the rule with priority 120 takes precedence over the rule with priority 150.

The connection is blocked at the subnet level (NSG-Subnet-Web) because the rule with priority 140 takes precedence over the rule with priority 110.

The connection is blocked at the subnet level (NSG-Subnet-Web) because security rules referencing Application Security Groups (ASGs) always override IP address range rules.

The connection is allowed because the rule with priority 110 at the subnet level and the rule with priority 150 at the network interface level both allow the traffic.

Show answer & explanation

Answer: The connection is blocked at the network interface level (NSG-NIC-Web) because the rule with priority 120 takes precedence over the rule with priority 150.

Answer

The connection is blocked at the network interface level (NSG-NIC-Web) because the rule with priority 120 takes precedence over the rule with priority 150.

For inbound traffic, Azure processes the subnet-level NSG rules first, followed by the network interface (NIC)-level NSG rules. At the subnet level, the rule with priority 110 (Allow) takes precedence over the rule with priority 140 (Deny) because lower priority numbers have higher precedence. Thus, the traffic is allowed through the subnet. At the NIC level, the rule with priority 120 (Deny) takes precedence over the rule with priority 150 (Allow). Since the source VM-App is associated with the Application Security Group ASG-App-Servers, the rule with priority 120 blocks the connection at the NIC level. Because both levels must allow the traffic, the connection is blocked at the NIC level.

Step-by-Step Solution

Evaluate the inbound traffic at the subnet level using NSG-Subnet-Web rules.

Traffic is allowed through the subnet.

The incoming packet has a source IP of 10.1.2.4 (which matches 10.1.2.0/24) and is destined for VM-Web on port 443. NSG-Subnet-Web has two matching rules: priority 110 (Allow) and priority 140 (Deny). Since 110 is a lower number, it has higher precedence and the traffic is allowed at the subnet level.

Evaluate the inbound traffic at the network interface (NIC) level using NSG-NIC-Web rules.

Traffic is blocked at the NIC level.

NSG-NIC-Web has two matching rules: priority 120 (Deny) and priority 150 (Allow). The source VM-App is associated with the Application Security Group ASG-App-Servers, which matches the priority 120 rule. Since 120 is lower than 150, the Deny rule takes precedence and blocks the traffic.

Determine the final connection outcome.

The connection attempt fails.

For inbound traffic to be successfully established, the network traffic must be allowed by both the subnet-level NSG and the network interface-level NSG. Because the traffic was blocked at the NIC level, the connection attempt is denied.

Key Concept

Inbound NSG rule processing order and priority evaluation.

Question 788Question →

An administrator is configuring a public Azure Load Balancer using the Standard SKU. The load balancer will distribute traffic to virtual machines. Which two of the following resources can be associated with this Standard Load Balancer? (Select two.)

Select all that apply

A frontend public IP address configured with the Standard SKU.

Backend virtual machines deployed across multiple Availability Zones in the same virtual network.

A frontend public IP address configured with the Basic SKU.

Backend virtual machines that have Basic SKU public IP addresses assigned to their network interfaces.

Show answer & explanation

Answer: A frontend public IP address configured with the Standard SKU.; Backend virtual machines deployed across multiple Availability Zones in the same virtual network.

Answer

A frontend public IP address configured with the Standard SKU, and backend virtual machines deployed across multiple Availability Zones in the same virtual network.

Standard Load Balancers require a frontend public IP address configured with the Standard SKU to ensure SKU consistency. Additionally, they support high availability by allowing backend pool virtual machines to be distributed across multiple Availability Zones within the same virtual network.

Step-by-Step Solution

Determine the SKU requirements for the frontend IP address of a Standard Load Balancer.

The frontend public IP address must also use the Standard SKU, as SKU mixing between the Load Balancer and its frontend IP is not supported.

Azure enforces SKU consistency for load balancers and their associated public IP resources.

Determine backend pool compatibility across zones and SKU constraints for the virtual machines.

Standard Load Balancers support virtual machines spanning multiple Availability Zones, but all associated resources (such as public IPs on VM NICs) must be of the Standard SKU.

Standard Load Balancers support high-availability zone designs, but do not allow association with Basic SKU network resources.

Key Concept

Azure Load Balancer SKU compatibility and configuration constraints

Question 789Question →

An organization uses Azure Firewall to secure traffic. The firewall has DNAT rules, network rules, and application rules configured. When processing a connection request, which of these rule types is evaluated first by the firewall?

DNAT rules

Network rules

Application rules

The rule with the lowest priority number, regardless of its rule type

Show answer & explanation

Answer: DNAT rules

Answer

DNAT rules are evaluated first by the firewall.

The correct option is DNAT rules. Azure Firewall rule processing follows a fixed hierarchy: DNAT rules are evaluated first. If a match is found, the firewall translates the destination IP address and port and creates an implicit network rule to allow the translated traffic. Network rules are evaluated second, and application rules are evaluated last.

Step-by-Step Solution

Analyze the rule type hierarchy of Azure Firewall.

The built-in evaluation order for Azure Firewall is DNAT rules first, then network rules, and finally application rules.

This static order is hardcoded into the firewall's processing engine to ensure security logic is applied consistently.

Determine if collection priority overrides the rule type hierarchy.

Collection priority determines evaluation order within the same type of rules, but cannot override the global rule type sequence.

Therefore, even a network rule with a high priority will be evaluated after all DNAT rules.

Key Concept

Azure Firewall rule processing logic and evaluation order

Question 790Question →

An administrator is configuring a hub-and-spoke network topology in Microsoft Azure. The hub virtual network (VNet-Hub) contains an Azure Firewall deployed with the private IP address $10.0.1.4$ . Two spoke virtual networks, VNet-Spoke1 (containing Subnet-App with address space $10.1.1.0/24$ ) and VNet-Spoke2 (containing Subnet-DB with address space $10.2.1.0/24$ ), are peered with VNet-Hub.

The administrator associates a route table with Subnet-App containing a route for destination $10.2.1.0/24$ with a next hop type of Virtual appliance and a next hop address of $10.0.1.4$ . In the Azure Firewall, a Network Rule is configured to allow TCP traffic on port $1433$ from $10.1.1.0/24$ to $10.2.1.0/24$ .

A virtual machine in Subnet-App ( $10.1.1.4$ ) attempts to establish a SQL database connection to a database server in Subnet-DB ( $10.2.1.4$ ). The connection fails, even though no Network Security Groups (NSGs) are blocking the traffic and the database server is configured to accept connections.

Which of the following is the most likely cause of this connection failure?

The route table associated with Subnet-DB does not contain a user-defined route for

10.1.1.0/24

with the next hop pointing to the Azure Firewall, resulting in asymmetric routing where the firewall drops the stateful TCP connection.

Virtual network peering between VNet-Spoke1 and VNet-Spoke2 must be established directly, as transit routing through a hub virtual network is not supported for peered networks without configuring Virtual Network Gateways and Gateway Transit.

The route table associated with Subnet-App has an incorrect next hop type of Virtual network gateway instead of Virtual appliance for the destination

10.2.1.0/24

The default outbound security rule in the Network Security Group (NSG) associated with Subnet-App has a higher priority than the route table rules, preventing traffic from reaching the firewall.

Show answer & explanation

Answer: The route table associated with Subnet-DB does not contain a user-defined route for $10.1.1.0/24$ with the next hop pointing to the Azure Firewall, resulting in asymmetric routing where the firewall drops the stateful TCP connection.

Answer

The connection failure occurs because the route table on the database subnet (Subnet-DB) is missing a route back to the application subnet (Subnet-App) via the Azure Firewall's private IP, leading to asymmetric routing where the firewall drops the connection due to state mismatch.

For stateful firewalls like Azure Firewall to work correctly, routing must be symmetric. When the source VM sends traffic, it is routed to the firewall due to the UDR on Subnet-App. However, when the database server responds, the lack of a corresponding UDR on Subnet-DB causes the return traffic to bypass the firewall and go directly to Subnet-App. The firewall drops the connection because it cannot complete the stateful TCP handshake tracking.

Step-by-Step Solution

Trace the outbound traffic path from the source VM (

10.1.1.4

) in Subnet-App to the destination database server (

10.2.1.4

) in Subnet-DB.

Traffic destined for

10.2.1.0/24

matches the User-Defined Route (UDR) on Subnet-App and is successfully forwarded to the Azure Firewall (

10.0.1.4

) as its next hop.

To ensure traffic is inspected by the firewall, a UDR must intercept the default system route and redirect it to the firewall's private IP.

Evaluate the firewall rule matching for the outbound connection.

The outbound TCP port

1433

traffic from

10.1.1.0/24

10.2.1.0/24

matches the configured Network Rule and is permitted to pass through the firewall to the destination.

Azure Firewall rules are evaluated in order; matching an allow network rule permits the traffic to continue to its destination.

Trace the return path of the response traffic from the database server (

10.2.1.4

) back to the source VM (

10.1.1.4

Since there is no UDR configured on Subnet-DB directing

10.1.1.0/24

traffic back to the firewall, the response traffic follows the default system route (VNet Peering) directly to Subnet-App, bypassing the hub firewall.

Azure system routes automatically route peered virtual networks directly unless overridden by a custom route table.

Determine the state tracking outcome at the Azure Firewall.

The firewall receives the initial SYN packet and subsequent ACK packet from the source VM, but never sees the intermediate SYN-ACK packet from the database server. Because Azure Firewall is stateful, it detects this asymmetric routing and drops the connection.

Stateful firewalls require symmetric routing (both request and response paths flowing through the firewall) to maintain TCP state tables and validate connection integrity.

Key Concept

Stateful packet inspection and routing symmetry in Azure Firewall

Question 791Question →

You are deploying different containerized workloads to Azure Container Instances (ACI). You need to configure the appropriate restart policy for each workload. Match each workload scenario to its corresponding container group restart policy.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The API gateway matches the Always restart policy; the nightly batch job matches the OnFailure restart policy; the database schema migration matches the Never restart policy.

Matching the API gateway to Always ensures continuous uptime. Matching the batch job to OnFailure ensures retries only occur when errors happen. Matching the database migration to Never prevents unintended reruns.

Step-by-Step Solution

Analyze the lifecycle requirements of the API gateway workload.

The API gateway must run indefinitely and handle continuous traffic, meaning it should always be restarted upon termination.

Web services require the Always restart policy.

Analyze the nightly batch job workload.

The batch job runs to completion. It should stop on success but restart if a failure occurs.

This behavior aligns with the OnFailure restart policy.

Analyze the database schema migration workload.

The migration script must run exactly once and must not rerun on failure.

To avoid corruption from duplicate attempts, the Never restart policy is required.

Key Concept

Azure Container Instances restart policies determine the container lifecycle behavior based on exit conditions.

Estimated Time:1m 30s

Question 792Question →

An administrator is configuring access to an Azure Storage account named auditstore77 that contains a blob container named archives. A group of external auditors named AuditTeam must be able to navigate the Azure portal to find the storage account and download the blobs within the container. The auditors will authenticate using Microsoft Entra ID. You need to assign Azure Role-Based Access Control (RBAC) roles to AuditTeam to meet the requirements using the principle of least privilege. Which two roles should you assign? (Select two.)

Select all that apply

Storage Blob Data Reader

Reader

Storage Account Contributor

Storage Blob Data Owner

Show answer & explanation

Answer: Storage Blob Data Reader; Reader

Answer

Assign the Reader and Storage Blob Data Reader roles to the AuditTeam group.

To fulfill the requirements with least privilege, two roles are needed: one for the control plane to navigate the Azure portal and one for the data plane to access the blobs. The Reader role allows the AuditTeam to view the storage account in the portal without modifying it. The Storage Blob Data Reader role provides the necessary read-only permissions to download blobs from the container using Microsoft Entra ID authentication.

Step-by-Step Solution

Identify the data plane access requirement.

The AuditTeam needs to download blobs. This requires read permissions to the data within the blob container.

Data plane access is managed separately from control plane operations using specific data roles.

Select the appropriate data plane role.

The Storage Blob Data Reader role is selected.

This role provides read-only access to blob containers and data, adhering to the principle of least privilege.

Identify the portal navigation requirement.

The AuditTeam needs to locate the storage account using the Azure portal.

Without a control plane role, users cannot see the storage account resource in the portal interface even if they have data plane permissions.

Select the appropriate control plane role.

The Reader role is selected.

The Reader role allows users to view resources in the portal without granting modification rights, satisfying the portal navigation requirement with least privilege.

Key Concept

Separation of control plane and data plane RBAC roles for Azure Storage authentication with Microsoft Entra ID.

Question 793Question →

NovaByte Research has an Azure subscription named sub-novabyte-core. You are configuring customer-managed keys (CMK) for an Azure Storage account named sanovabytearchive. You create a user-assigned managed identity named uami-storage-enc to be used for Key Vault access. The Azure Key Vault named kv-novabyte-secure is configured to use Azure role-based access control (Azure RBAC) for authorization. Which of the following actions must you perform to successfully configure the storage account to use customer-managed keys from the key vault? (Select two)

Select all that apply

Enable purge protection on kv-novabyte-secure.

Assign the Key Vault Crypto Service Encryption User role for kv-novabyte-secure to uami-storage-enc.

Assign the Reader role for kv-novabyte-secure to uami-storage-enc.

Disable the 'Allow trusted Microsoft services to bypass this firewall' setting on kv-novabyte-secure.

Show answer & explanation

Answer: Enable purge protection on kv-novabyte-secure.; Assign the Key Vault Crypto Service Encryption User role for kv-novabyte-secure to uami-storage-enc.

Answer

Enable purge protection on the key vault and assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity.

To successfully configure customer-managed keys (CMK) for a storage account using Azure RBAC, two main requirements must be met: the Key Vault must have purge protection enabled to protect the encryption keys from accidental deletion, and the managed identity assigned to the storage account must be granted the Key Vault Crypto Service Encryption User role to allow it to perform data-plane encryption and decryption operations.

Step-by-Step Solution

Enable purge protection on kv-novabyte-secure.

Purge protection is enabled, satisfying the Azure Storage requirement that keys cannot be permanently deleted immediately.

Azure Storage requires both soft-delete (enabled by default) and purge protection to be active on the key vault to guard against accidental deletion of the encryption key.

Assign the Key Vault Crypto Service Encryption User role to uami-storage-enc.

The identity is granted data-plane access to read, wrap, and unwrap keys within the key vault.

Since the key vault is configured to use Azure RBAC for authorization, data-plane access for cryptographic operations must be explicitly granted via RBAC roles rather than Key Vault access policies.

Key Concept

Configuring Azure Storage encryption with customer-managed keys requires Key Vault protection settings (soft-delete and purge protection) and appropriate data-plane permissions (using Azure RBAC or Key Vault access policies) for the storage account's managed identity.

Question 794Question →

Your company has an Azure Virtual Machine Scale Set named vmss-processing. The scale set is configured with autoscale rules and currently runs five instances. One of the instances, vmss-processing_3, is currently running a critical, long-running database validation task that must not be interrupted. The remaining instances are idle. You expect a scale-in event to be triggered shortly due to low overall CPU utilization. You need to prevent vmss-processing_3 from being terminated during the scale-in event, without affecting the scaling behavior of the other instances. What should you do?

From the scale set instances blade, select vmss-processing_3 and enable instance protection.

Change the scale-in policy of the vmss-processing scale set to NewestVM.

Change the upgrade policy of the vmss-processing scale set to Manual.

Configure a Resource Lock of type CanNotDelete on the resource group containing vmss-processing.

Show answer & explanation

Answer: From the scale set instances blade, select vmss-processing_3 and enable instance protection.

Answer

From the scale set instances blade, select vmss-processing_3 and enable instance protection.

Enabling instance protection on a specific scale set instance ensures that the autoscale engine will not select it for termination during a scale-in event. Other, unprotected instances remain subject to normal scale-in actions, ensuring correct overall scaling behavior without interrupting the critical task running on the protected instance.

Step-by-Step Solution

Identify the instance performing the critical task, which is vmss-processing_3.

Target instance identified.

We must selectively protect only this instance from being terminated.

Apply instance protection to the target instance.

The instance vmss-processing_3 is excluded from scale-in selection.

Instance protection is designed to prevent the autoscale engine from terminating specific instances while keeping normal autoscale functions active for the rest of the scale set.

Key Concept

Instance Protection in Azure Virtual Machine Scale Sets allows administrators to protect specific virtual machine instances from being terminated during autoscale scale-in events.

Question 795Question →

Your organization manages its Azure environment with the following hierarchy:

* Management Group: `MG-Corporate`
* Subscription: `Sub-Production`
* Resource Group: `RG-DataStorage` (contains multiple Azure Storage accounts)

A security group named `Data-Auditors` needs to inspect the configuration settings of the storage accounts within `RG-DataStorage` to verify compliance. The auditors must not have access to read, write, or delete the actual blob data stored inside these storage accounts, nor should they be able to modify the configurations of the storage accounts. To apply the principle of least privilege, which role assignment should you configure?

Assign the Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.

Assign the Storage Blob Data Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.

Assign the Global Reader directory role in Microsoft Entra ID to the Data-Auditors group.

Assign the Reader role to the Data-Auditors group at the scope of the MG-Corporate management group.

Show answer & explanation

Answer: Assign the Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.

Answer

Assign the Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.

Assigning the Reader role at the resource group scope (RG-DataStorage) provides read-only access to the control plane configurations of all resources within that resource group. Because the Reader role does not grant data-plane operations, the members of the security group cannot access the actual blob data inside the storage accounts. This configuration satisfies the requirements of configuration auditing and the principle of least privilege.

Step-by-Step Solution

Analyze the access requirements for the Data-Auditors group.

The group requires read-only access to configuration settings (control plane) but must not access actual data (data plane) or modify any resources.

This establishes the minimum permissions needed under the principle of least privilege.

Determine the appropriate scope for the assignment.

The scope should be limited to the RG-DataStorage resource group, rather than the entire management group (MG-Corporate), to prevent unnecessary access to other resources.

Restricting the scope ensures permissions do not inherit down to other unrelated resources.

Select the Azure RBAC role that separates control plane from data plane access.

The Reader role allows viewing resource configurations on the control plane but does not grant data-plane access (unlike Storage Blob Data Reader) or tenant-level admin permissions.

Matching the role to the control plane fulfills the least privilege compliance auditing requirement.

Key Concept

Azure RBAC scopes, control plane versus data plane access, and role inheritance.

Estimated Time:1m 30s

Question 796Question →

An administrator configures a route table named `RT-Prod` and associates it with `Subnet-1` ( $10.1.1.0/24$ ) in `VNet-1` ( $10.1.0.0/16$ ). `VNet-1` is peered with `VNet-2` ( $10.2.0.0/16$ ).

The route table `RT-Prod` contains the following two user-defined routes:
* Route1: Destination prefix $10.2.0.0/16$ , Next hop type: Virtual appliance, Next hop IP address: $10.1.1.4$
* Route2: Destination prefix $10.2.2.0/24$ , Next hop type: Virtual Network Gateway

A virtual machine in `Subnet-1` sends a packet to a destination IP address of $10.2.2.50$ in `VNet-2`.

Which next hop will the traffic use to reach the destination?

The virtual network gateway

The virtual appliance at 10.1.1.4

The virtual network peering connection

The virtual network local routing

Show answer & explanation

Answer: The virtual network gateway

Answer

The traffic will use the virtual network gateway.

The correct answer is the virtual network gateway because Azure's routing engine uses the Longest Prefix Match (LPM) algorithm. The destination IP address

10.2.2.50

matches Route2 (

10.2.2.0/24

) with a 24-bit match, which is more specific than the 16-bit match of Route1 (

10.2.0.0/16

) and the VNet Peering system route (

10.2.0.0/16

). Therefore, Route2 is selected, and its next hop is the virtual network gateway.

Step-by-Step Solution

Identify all matching routes for the destination IP address

10.2.2.50

The matching routes are: the system peering route (

10.2.0.0/16

), Route1 (

10.2.0.0/16

pointing to

10.1.1.4

), and Route2 (

10.2.2.0/24

pointing to the Virtual Network Gateway).

Before choosing a route, Azure evaluates all candidate routes in the routing table (both system and user-defined) that match the destination IP address.

Apply the Longest Prefix Match (LPM) rule to select the most specific route prefix.

The prefix

10.2.2.0/24

has a longer match (24 bits) than

10.2.0.0/16

(16 bits).

Azure's routing decision engine always prioritizes the most specific route prefix (the one with the largest subnet mask length) regardless of whether it is a system route or a UDR.

Identify the next hop type associated with the winning route.

The winning route is Route2, which has a next hop type of Virtual Network Gateway.

Since Route2 has the longest prefix match, its defined next hop is used to route the traffic.

Key Concept

Azure routes traffic based on the Longest Prefix Match (LPM) algorithm across all system and user-defined routes. Only when prefixes are identical does the route source priority (UDR > BGP > System) resolve the conflict.

Question 797Question →

An Azure subscription contains a virtual network named $vnet-manufacturing$ that has an address space of $10.80.0.0/21$ . You are configuring the subnets for this virtual network to support hybrid connectivity and a new application workload. The configuration must meet the following requirements:
- Create a subnet named $GatewaySubnet$ to support a VPN gateway.
- Create a subnet named $snet-app$ to host 28 virtual machines.
- Minimize the address space allocated to each subnet.

Which two subnets should you create to meet the requirements? Select two.

Select all that apply

GatewaySubnet

with the address range

10.80.0.0/29

GatewaySubnet

with the address range

10.80.0.0/30

snet-app

with the address range

10.80.1.0/26

snet-app

with the address range

10.80.1.0/27

snet-app

with the address range

10.80.1.0/28

Show answer & explanation

Answer: $GatewaySubnet$ with the address range $10.80.0.0/29$ ; $snet-app$ with the address range $10.80.1.0/26$

Answer

The correct subnets to create are GatewaySubnet with the address range 10.80.0.0/29 and snet-app with the address range 10.80.1.0/26.

The GatewaySubnet must be at least /29 to support Azure VPN Gateway. A /29 subnet is the smallest valid subnet size that meets this requirement. For the snet-app subnet, hosting 28 virtual machines requires a total of 33 IP addresses (

28 + 5 = 33

) due to the 5 IP addresses reserved by Azure in each subnet. A /27 subnet provides 32 addresses (27 usable), which is not enough. A /26 subnet provides 64 addresses (59 usable), which is the smallest subnet size that can support the workload.

Step-by-Step Solution

Determine the minimum size of the GatewaySubnet.

The GatewaySubnet must be configured with a prefix length of /29 or larger.

Azure VPN Gateway requires a dedicated subnet named GatewaySubnet, and Azure mandates a minimum size of /29 for this subnet. Therefore, a /29 subnet represents the smallest allocation.

Calculate the minimum subnet size for snet-app to host 28 virtual machines.

A subnet with a /26 prefix length is required.

Azure reserves 5 IP addresses in every subnet (the first four and the last one). To host 28 virtual machines, the subnet must have a total capacity of at least 33 IP addresses (

28 + 5 = 33

). A /27 subnet provides only 32 IP addresses (27 usable), whereas a /26 subnet provides 64 IP addresses (59 usable).

Key Concept

Azure subnet sizing and IP address reservation rules, including the minimum size requirement for a GatewaySubnet and the 5 reserved IP addresses per subnet.

Question 798Question →

An administrator is configuring a new public Azure Load Balancer named `LB1` using the Standard SKU. The administrator plans to associate an existing public IP address named `PubIP1` with the frontend IP configuration of `LB1`. `PubIP1` is currently configured with the Basic SKU. Which of the following describes the outcome when the administrator attempts to save this configuration?

The configuration fails because a Standard SKU load balancer can only be associated with a Standard SKU public IP address.

The configuration succeeds, but Azure automatically upgrades the public IP address to the Standard SKU.

The configuration succeeds, but the load balancer operates in a backward-compatibility mode with Basic SKU features.

The configuration fails because Basic SKU public IP addresses are only supported for internal load balancers.

Show answer & explanation

Answer: The configuration fails because a Standard SKU load balancer can only be associated with a Standard SKU public IP address.

Answer

The configuration fails because a Standard SKU load balancer can only be associated with a Standard SKU public IP address.

The configuration fails because Azure enforces strict SKU consistency between the Load Balancer and its frontend IP configuration. A Standard SKU Load Balancer must use a Standard SKU Public IP address, and a Basic SKU Load Balancer must use a Basic SKU Public IP address.

Step-by-Step Solution

Identify the SKU of the Load Balancer and the SKU of the Public IP address being associated.

The Load Balancer is Standard SKU, and the Public IP address is Basic SKU.

This establishes the parameters for the SKU compatibility check.

Apply Azure's SKU matching rule for Load Balancers and public IP configurations.

Standard SKU Load Balancer requires Standard SKU Public IP. Basic SKU Load Balancer requires Basic SKU Public IP.

Azure enforces strict SKU matching between the Load Balancer resource and its frontend IP configurations.

Determine the deployment outcome based on the SKU mismatch.

The deployment or configuration update fails due to a SKU validation error.

Since the SKUs do not match, the configuration cannot be saved.

Key Concept

Azure Load Balancer and Public IP SKU compatibility requirements

Question 799Question →

To meet security compliance requirements, an organization decides to inspect all traffic moving between application tiers within a single virtual network. The deployment consists of a virtual network named `VNet-SecureHub` ( $192.168.0.0/16$ ) with three subnets:
* `Subnet-App` ( $192.168.1.0/24$ )
* `Subnet-Appliance` ( $192.168.2.0/24$ )
* `Subnet-Data` ( $192.168.3.0/24$ )

A firewall virtual machine named `FW1` is deployed in `Subnet-Appliance` and is assigned the private IP address $192.168.2.4$ .
You need to ensure that all traffic sent from `Subnet-App` to `Subnet-Data` is routed through `FW1` for inspection.
Which two configuration steps should you perform? (Select two.)

Select all that apply

In a route table associated with Subnet-App, configure a route for destination

192.168.3.0/24

with the next hop type set to Virtual appliance and the next hop IP address set to

192.168.2.4

Enable IP forwarding on the network interface (NIC) of FW1.

In a route table associated with Subnet-App, configure a route for destination

192.168.3.0/24

with the next hop type set to Virtual Network Gateway.

In a route table associated with Subnet-Appliance, configure a route for destination

192.168.3.0/24

with the next hop type set to Virtual appliance and the next hop IP address set to

192.168.2.4

Show answer & explanation

Answer: In a route table associated with Subnet-App, configure a route for destination $192.168.3.0/24$ with the next hop type set to Virtual appliance and the next hop IP address set to $192.168.2.4$ .; Enable IP forwarding on the network interface (NIC) of FW1.

Answer

Configure a user-defined route in a route table associated with the application subnet pointing to the firewall's IP address as a Virtual appliance, and enable IP forwarding on the firewall's network interface.

Routing traffic through an NVA requires overriding system routes by associating a route table with the source subnet. The route must specify the destination IP prefix, use Virtual appliance as the next hop type, and specify the NVA's IP address. Additionally, the NVA's network interface must have IP forwarding enabled so that Azure does not drop packets destined for other IP addresses.

Step-by-Step Solution

Define a route table and add a route targeting the data subnet.

A route table is created with a route for destination

192.168.3.0/24

, next hop type set to Virtual appliance, and next hop IP address set to

192.168.2.4

Azure system routes route traffic directly between subnets within the same VNet by default. A user-defined route (UDR) is required to override this behavior and force traffic through the firewall.

Associate the route table with the application subnet.

The route table is associated with Subnet-App.

A route table only applies to network traffic originating from resources within a subnet once the route table is explicitly associated with that subnet.

Enable IP forwarding on the network interface (NIC) of FW1.

The network interface of FW1 is configured to allow traffic not destined for its own IP address.

By default, Azure drops traffic sent to a virtual machine if the destination IP address does not match the VM's interface IP. Enabling IP forwarding permits the firewall VM to receive and forward transit traffic.

Key Concept

Routing subnet traffic through a Network Virtual Appliance (NVA) requires creating a User-Defined Route (UDR) with the Virtual appliance next hop type, associating it with the source subnet, and enabling IP forwarding on the NVA's network interface.

Question 800Question →

Your company has an Azure subscription that contains a resource group named rg-finance. Within rg-finance, there is an Azure Storage account named stfinrecords that hosts a blob container named historical-data. A financial analyst named Taylor needs to read the blobs in the historical-data container. You must configure access to meet the following requirements:
- Taylor must authenticate by using Microsoft Entra ID.
- Taylor must be prevented from modifying any data or storage account configurations.
- The solution must follow the principle of least privilege.
Which role should you assign to Taylor?

Reader assigned at the stfinrecords storage account level

Storage Account Contributor assigned at the stfinrecords storage account level

Storage Blob Data Reader assigned at the historical-data container level

User Administrator assigned in Microsoft Entra ID

Show answer & explanation

Answer: Storage Blob Data Reader assigned at the historical-data container level

Answer

Storage Blob Data Reader assigned at the historical-data container level

Assigning the Storage Blob Data Reader role at the container level is correct because it grants read-only data plane access to the specific container using Microsoft Entra ID credentials. It ensures the user can read the blobs without granting control plane management permissions or key access, satisfying the principle of least privilege.

Step-by-Step Solution

Identify the authentication mechanism required for data access.

Microsoft Entra ID authentication is specified, meaning Azure RBAC roles governing the data plane must be used.

Traditional control plane roles (like Owner or Reader) do not automatically grant data plane permissions when authenticating with Entra ID.

Select the correct role that offers read-only access to the blobs.

The Storage Blob Data Reader role is identified as the standard role for reading blob content.

This role grants data-level read permissions while preventing any write or delete actions on the blobs.

Scope the role assignment to enforce the principle of least privilege.

Assign the role at the scope of the historical-data container rather than the storage account or resource group.

This limits Taylor's access to only the specific container required for the task, preventing access to other containers or storage resources.

Key Concept

Azure RBAC Control Plane versus Data Plane Roles for Storage

Estimated Time:1m 30s

PreviousPage 40 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept