All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An IT department implements a security policy that disables shared key access for all Azure Storage accounts. To upload log files to a blob container named `application-logs` in a storage account named `stdata2026`, an administrator runs the `azcopy login` command and authenticates using their Microsoft Entra ID credentials. The administrator is a member of a group assigned the Contributor role for the storage account. When attempting to run the copy command, the administrator receives a HTTP 403 error. Which role must be assigned to the administrator to resolve the issue?

Storage Account Contributor

Storage Blob Data Reader

Storage Blob Data Contributor

A Shared Access Signature (SAS) token with write permissions

Show answer & explanation

Answer: Storage Blob Data Contributor

Answer

Storage Blob Data Contributor

The correct answer is the Storage Blob Data Contributor role. When shared key access is disabled on a storage account, authorization via access keys or SAS tokens is blocked. The administrator must authenticate using Microsoft Entra ID. The Contributor role only grants control plane management capabilities. To write blobs, the administrator must be assigned a data-plane role such as Storage Blob Data Contributor.

Step-by-Step Solution

Analyze the authentication context and constraints.

Shared key access is disabled on the storage account, preventing the use of standard SAS tokens or access keys. Microsoft Entra ID authentication via 'azcopy login' is used.

Security policies enforce identity-based access over shared keys.

Evaluate the current role assignment.

The Contributor role only provides Azure Resource Manager control plane permissions.

Control plane roles do not grant data plane access to blob content.

Determine the required data plane permissions for writing logs.

The Storage Blob Data Contributor role must be assigned to grant read and write access to the blob container.

This role enables the administrator to execute the AzCopy upload command successfully under the Entra ID security context.

Key Concept

Azure RBAC distinction between control plane (Contributor) and data plane (Storage Blob Data Contributor) roles when shared key access is disabled.

Estimated Time:1m 30s

Question 842Question →

An administrator needs to configure secure remote access to virtual machines in an Azure virtual network named VNet1 using Azure Bastion. What is the correct sequence of steps to configure and connect using Azure Bastion?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure and use Azure Bastion, you must first create the AzureBastionSubnet (/26 or larger), provision a Standard SKU public IP with static allocation, deploy the Azure Bastion host, and then connect to the virtual machine using the Bastion option.

The correct sequence begins with the infrastructure prerequisites: creating the 'AzureBastionSubnet' with a /26 or larger prefix, creating a Standard SKU public IP address, deploying the Bastion host linked to these resources, and finally establishing a secure connection to a virtual machine in the network.

Step-by-Step Solution

Configure the AzureBastionSubnet subnet

A dedicated subnet named AzureBastionSubnet with a prefix of /26 or larger is added to VNet1.

This is a prerequisite for routing Bastion traffic.

Create the Public IP address

A static Standard SKU public IP address is created in the subscription.

Azure Bastion does not support Basic SKU public IP addresses.

Deploy the Bastion host

The Azure Bastion host is deployed and linked to the subnet and public IP.

This completes the backend service provisioning.

Establish VM connection

A secure session is established to the virtual machine directly through the browser.

This allows remote administration without exposing public IP addresses on the target VMs.

Key Concept

Azure Bastion requires a dedicated subnet named AzureBastionSubnet with at least a /26 prefix and a Standard SKU public IP address before the host can be deployed.

Estimated Time:45s

Question 843Question →

An administrator is managing an Azure virtual machine named VM1 in the East US region. VM1 is currently configured with the Standard_D2s_v3 size and uses a Premium SSD disk for its operating system. To reduce monthly running costs, you attempt to resize VM1 to the Standard_D2_v3 size. The resize operation fails. What is the cause of this failure?

The Standard_D2_v3 size does not support Premium SSD storage.

VM1 must be added to an Availability Set before it can be resized to a size in a different performance tier.

The Recovery Services Vault configured to back up VM1 is located in a different Azure region, which blocks hardware configuration updates.

The administrator lacks data-plane permissions, such as the Storage Blob Data Reader role, on the storage account hosting the virtual machine's OS disk.

Show answer & explanation

Answer: The Standard_D2_v3 size does not support Premium SSD storage.

Answer

The Standard_D2_v3 size does not support Premium SSD storage.

The correct answer is correct because Azure virtual machine sizes without the 's' suffix (such as Standard_D2_v3) do not support Premium SSD storage. If a virtual machine currently has a Premium SSD disk attached, attempting to resize it to a size that only supports Standard storage will fail. To resolve this, you must change the disk type to Standard SSD or Standard HDD before resizing.

Step-by-Step Solution

Analyze the source VM size and disk type

The source VM is Standard_D2s_v3 (which supports Premium storage) and has a Premium SSD OS disk.

To understand the storage requirements of the current virtual machine configuration.

Analyze the target VM size capability

The target VM size is Standard_D2_v3. The lack of the 's' suffix indicates that this size does not support Premium SSD storage.

To determine if the target VM size meets the hardware and storage requirements of the existing virtual machine.

Determine the cause of the failure

Because the virtual machine has an active Premium SSD disk attached and the target size does not support Premium storage, Azure blocks the resize operation.

To identify the technical limitation causing the resize operation to fail.

Key Concept

Virtual Machine Resizing and Storage Compatibility

Question 844Question →

An administrator deploys a new shipping application. The deployment includes a resource group named rg-shipping-prod that contains an Azure App Service web app and an Azure SQL database. The administrator applies a tag named CostCenter: Shipping and a CanNotDelete resource lock directly to rg-shipping-prod. Which of the following describes the resource governance status of the Azure SQL database?

The database inherits both the CanNotDelete resource lock and the CostCenter: Shipping tag.

The database inherits the CostCenter: Shipping tag, but the CanNotDelete resource lock only applies to the resource group level and does not block the deletion of the database.

The database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag.

The database inherits the CanNotDelete resource lock, which prevents authorized users from modifying the configuration of the database or reading its connection strings.

Show answer & explanation

Answer: The database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag.

Answer

The database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag.

The correct option is that the database inherits the CanNotDelete resource lock, preventing its deletion, but does not inherit the CostCenter: Shipping tag. This is because Resource Manager locks are inherited by all resources within the resource group scope, while resource group tags are not automatically inherited by child resources.

Step-by-Step Solution

Evaluate the inheritance behavior of Azure Resource Locks.

Resource locks applied at the resource group scope are inherited by all child resources. Therefore, the Azure SQL database inherits the CanNotDelete lock, which prevents it from being deleted.

Azure Resource Manager (ARM) propagates locks downward from subscriptions and resource groups to child resources.

Evaluate the inheritance behavior of Azure Tags.

Tags applied to a resource group are not inherited by the resources contained within it. The database does not inherit the CostCenter: Shipping tag.

Azure does not support automatic tag inheritance from resource groups to individual resources; tag policy or manual assignment must be used instead.

Determine the impact of the CanNotDelete lock type.

The CanNotDelete lock allows authorized users to read and modify the resource, but blocks deletion.

Unlike a ReadOnly lock, a CanNotDelete lock allows control plane modifications like configuration updates.

Key Concept

Azure resource locks are inherited by child resources, whereas Azure tags applied to a resource group are not automatically inherited by its resources.

Estimated Time:1m 30s

Question 845Question →

An administrator needs to synchronize a local directory named C:\Logs to a blob container named applogs in an Azure storage account. Shared key access is disabled on the storage account. The storage account firewall is configured to allow access only from selected networks, and the administrator's workstation public IP address is allowed. The synchronization must meet the following requirements:
- Only files with the .log extension must be synchronized.
- Any files in the destination container that do not exist in the source directory must be deleted automatically.

Which two actions or parameters should the administrator use? (Select two.)

Select all that apply

Include the --include-pattern "*.log" parameter in the azcopy sync command.

Include the --delete-destination "true" parameter in the azcopy sync command.

Assign the Owner role to the administrator's Microsoft Entra ID account at the storage account level.

Authenticate by appending a Shared Access Signature (SAS) token with a 365-day expiration window to the destination URL.

Configure the storage account firewall to disable the 'Allow trusted Microsoft services to access this storage account' setting.

Show answer & explanation

Answer: Include the --include-pattern "*.log" parameter in the azcopy sync command.; Include the --delete-destination "true" parameter in the azcopy sync command.

Answer

Include the --include-pattern "*.log" and --delete-destination "true" parameters in the azcopy sync command.

To synchronize the directory while filtering by extension and deleting orphaned files at the destination, the command must use the --include-pattern "*.log" flag to isolate log files, and the --delete-destination "true" flag to remove non-existent files. Because shared key access is disabled, the administrator must authenticate using Microsoft Entra ID.

Step-by-Step Solution

Identify the required file filtering parameter.

Use the --include-pattern "*.log" parameter to restrict the synchronization to files with the .log extension.

The requirement specifies that only .log files should be synchronized.

Identify the required deletion parameter.

Use the --delete-destination "true" parameter.

This automatically removes files from the destination that are not present in the source directory, without prompting the user.

Verify authentication requirements under disabled shared key access.

Use Microsoft Entra ID authentication (via azcopy login) with the Storage Blob Data Contributor role.

Since shared key access is disabled, access keys and standard SAS tokens cannot be used.

Key Concept

Synchronizing files to Azure Blob Storage using AzCopy with file filters, destination cleanup, and Microsoft Entra ID authorization.

Question 846Question →

An administrator wants to review write operations on virtual machines within an Azure subscription. They open the Log Analytics query editor to search the `AzureActivity` table. The query must filter for logs where `OperationNameValue` is equal to `'Microsoft.Compute/virtualMachines/write'` and restrict the output to exactly $5$ records.

Which of the following queries use valid Kusto Query Language (KQL) syntax to achieve this goal? (Choose two.)

Select all that apply

AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" | limit 5

AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" | take 5

AzureActivity | where OperationNameValue = "Microsoft.Compute/virtualMachines/write" | limit 5

SELECT * FROM AzureActivity WHERE OperationNameValue = 'Microsoft.Compute/virtualMachines/write' LIMIT 5

Show answer & explanation

Answer: AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" | limit 5; AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" | take 5

Answer

The correct queries start with the 'AzureActivity' table, filter the logs using the 'where' operator with double equals '==', and limit the records using either 'limit 5' or 'take 5'.

The correct queries begin with the data source 'AzureActivity', apply a pipeline using the pipe character '|', use the 'where' operator with the equality operator '==', and use either 'limit 5' or 'take 5'. In KQL, 'limit' and 'take' are synonyms and perform the same action of limiting the result set.

Step-by-Step Solution

Identify the target table and initial retrieval syntax.

The query starts with the table name 'AzureActivity'.

KQL queries begin with the data source (table name) to start the pipeline.

Apply the comparison filter using the correct operator.

Use '| where OperationNameValue == "Microsoft.Compute/virtualMachines/write"'.

The 'where' operator is used for filtering, and KQL requires a double equals sign '==' for evaluation of equality.

Select the correct operator to restrict the number of returned records.

Use '| limit 5' or '| take 5'.

In KQL, 'limit' and 'take' are equivalent operators that restrict the query results to the specified number of rows.

Key Concept

Basic KQL query structure, comparison operators, and row-limiting operators.

Estimated Time:45s

Question 847Question →

You plan to deploy a containerized application to Azure Container Instances (ACI). The application consists of a single container that processes incoming image files from an Azure storage account and then terminates. If the processing fails, the container must attempt to restart. If it succeeds, the container must not run again. The ACI deployment must be integrated into an Azure Virtual Network named VNet1. Which of the following configuration options should you select? (Select TWO).

Select all that apply

Set the restart policy of the container group to OnFailure.

Deploy the container group into a subnet delegated to Microsoft.ContainerInstance/containerGroups.

Set the restart policy of the container group to Always.

Set the restart policy of the container group to Never.

Show answer & explanation

Answer: Set the restart policy of the container group to OnFailure.; Deploy the container group into a subnet delegated to Microsoft.ContainerInstance/containerGroups.

Answer

To meet the requirements, configure the container group with a restart policy of OnFailure and deploy it to a subnet delegated to Microsoft.ContainerInstance/containerGroups.

The correct configurations are setting the restart policy of the container group to OnFailure and deploying the container group into a subnet delegated to Microsoft.ContainerInstance/containerGroups. The OnFailure restart policy guarantees that the container will attempt to restart if the execution fails (non-zero exit code), but will remain stopped upon successful execution (zero exit code). Additionally, integrating ACI with a virtual network requires deploying the container group into a subnet delegated to the Microsoft.ContainerInstance/containerGroups service.

Step-by-Step Solution

Analyze the workload's lifecycle requirements.

The container executes a task and terminates. It must restart on failure but must not restart on success. This behavior corresponds to the OnFailure restart policy.

Choosing the correct restart policy prevents infinite execution loops for run-to-completion workloads.

Determine the virtual network integration requirements for ACI.

To deploy ACI into an existing virtual network, a subnet must be delegated to the Microsoft.ContainerInstance/containerGroups resource provider.

Subnet delegation is a prerequisite for ACI to provision network interfaces in your virtual network.

Key Concept

Configuring ACI restart policies (Always, Never, OnFailure) and virtual network integration via subnet delegation.

Question 848Question →

An administrator needs to upload files from an on-premises workstation to an Azure Storage account named stdata2026 using Azure Storage Explorer. The storage account has its firewall configured to restrict access to 'Selected networks'. The administrator's workstation public IP address has been added to the allowed IP ranges of the storage account. The administrator is assigned the Contributor role at the storage account scope. When attempting to upload blobs using Microsoft Entra ID authentication in Storage Explorer, the administrator receives an authorization error.

Which action should the administrator take to resolve this error?

Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.

Enable the 'Allow trusted Microsoft services to access this storage account' setting in the firewall configuration.

Create and connect using a Shared Access Signature (SAS) token that has its expiration date set to two years in the future.

Ensure that the administrator is assigned the Reader role at the subscription level.

Show answer & explanation

Answer: Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.

Answer

Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.

The administrator is attempting to access the storage account's data plane (uploading blobs) using Microsoft Entra ID authentication. Although they have the Contributor role at the storage account scope, this control-plane role does not grant data-plane read/write permissions for blobs. To resolve the authorization error, they must be assigned a data-plane role such as Storage Blob Data Contributor.

Step-by-Step Solution

Identify the authentication method being used by the client.

The client is using Microsoft Entra ID authentication, which evaluates data-plane operations using Role-Based Access Control (RBAC).

Microsoft Entra ID authentication bypasses traditional storage account keys and relies entirely on Azure RBAC for authorizing read and write operations on container data.

Analyze the current role assignment of the administrator.

The administrator has the Contributor role, which is a control-plane role.

Control-plane roles (like Owner and Contributor) allow management of the storage account settings but do not grant data-plane access (reading/writing blobs) by default when using Entra ID authentication.

Assign the appropriate data-plane RBAC role.

Assign the Storage Blob Data Contributor role to the user's account.

The Storage Blob Data Contributor role provides read, write, and delete permissions to Azure Storage blob containers and data, which resolves the authorization error.

Key Concept

Data plane vs. control plane authorization in Azure Storage

Question 849Question →

A company has a single web application hosted on Azure Virtual Machines. You are configuring an Azure Application Gateway to distribute traffic. You need to ensure that requests for the URL path `/videos/*` are directed to a pool of VMs optimized for video streaming, while all other requests are directed to a default pool of web servers. Which type of routing rule should you configure on the Application Gateway?

Basic routing rule

Session affinity routing rule

Path-based routing rule

Round-robin routing rule

Show answer & explanation

Answer: Path-based routing rule

Answer

Path-based routing rule

A path-based routing rule allows you to create a URL path map. This map defines rules that associate specific path patterns, like `/videos/*`, with designated backend pools. Any request that does not match the specified paths is routed to the default backend pool, which satisfies the requirements of the scenario.

Step-by-Step Solution

Analyze the traffic routing requirements.

Traffic must be directed to different backend pools based on the request URL path (specifically `/videos/*`).

Understanding the condition for routing is the first step to selecting the correct rule type.

Compare the available Application Gateway routing rule options in Azure.

Basic routing rules route all traffic to a single backend pool. Path-based routing rules use URL path maps to route requests to different backend pools based on the path.

This determines which rule type supports path-based conditions.

Select the rule type that matches the requirement.

A path-based routing rule is required to inspect the URL path and forward traffic to the video-optimized backend pool.

Only a path-based routing rule matches the requirement to inspect and route traffic based on URL paths.

Key Concept

Azure Application Gateway routing rules decide how to route traffic from the listener to backend pools. A basic rule routes all traffic unconditionally, whereas a path-based rule uses a URL path map to route traffic to specific backend pools based on the URL path in the request.

Estimated Time:45s

Question 850Question →

You have an Azure subscription containing a Log Analytics workspace named Workspace1 and a virtual machine named VM1. VM1 sends its diagnostic logs to Workspace1. You need to allow a developer to query the logs of VM1. The developer must not be able to view logs for any other resources in Workspace1. Which action should you perform?

Assign the Reader role on VM1 to the developer.

Assign the Log Analytics Reader role on Workspace1 to the developer and apply a ReadOnly resource lock to Workspace1.

Assign the Log Analytics Reader role on the resource group containing Workspace1 to the developer, and create an Azure RBAC deny assignment for other resources.

Assign the Log Analytics Reader role on Workspace1 to the developer and configure the workspace Access Control Mode to Require workspace permissions.

Show answer & explanation

Answer: Assign the Reader role on VM1 to the developer.

Answer

Assign the Reader role on VM1 to the developer.

Assigning the Reader role on VM1 grants the developer resource-context log access. When the workspace is set to its default access mode, permissions on the resources themselves govern log access. This allows the developer to query VM1's logs from the VM blade or directly via resource-context query interfaces without granting visibility into other resources' logs in the workspace.

Step-by-Step Solution

Determine the required level of access control for the developer's request.

The developer needs access to VM1 logs only, without visibility into other logs in Workspace1.

This requires resource-context log access where log visibility is governed by permissions on the resources themselves.

Evaluate the default Log Analytics workspace access mode setting.

The default setting is 'Use resource or workspace permissions' (resource-context).

This setting allows users with read access to a specific resource to query logs for that resource.

Assign the appropriate RBAC role to target resource VM1.

Assigning the Reader role on VM1 grants the developer resource-context permissions.

This ensures the developer can access VM1's logs via resource-context without having workspace-level permissions that would expose other resources.

Key Concept

Log Analytics Workspace Access Control (Resource-context vs Workspace-context)

Estimated Time:1m 30s

Question 851Question →

An administrator is configuring outbound traffic filtering in a hub-and-spoke virtual network topology in Microsoft Azure. The hub virtual network (`VNet-Hub`) contains an Azure Firewall instance deployed in `AzureFirewallSubnet` with a private IP address of $10.10.1.4$ and a public IP address of $20.50.100.10$ . The spoke virtual network (`VNet-Spoke`) contains `Subnet-App` ( $10.20.1.0/24$ ) hosting a virtual machine named `VM-App` ( $10.20.1.5$ ). `VNet-Hub` and `VNet-Spoke` are peered.

The administrator configures a route table named `RT-Spoke` associated with `Subnet-App` with a default route ( $0.0.0.0/0$ ) pointing to $10.10.1.4$ as a Virtual Appliance next hop.

To restrict `VM-App` outbound access, the administrator configures the following Azure Firewall rules:
- Network Rule Collection (`Net-RC`): Priority $200$ , Action: Allow, Source: $10.20.1.0/24$ , Protocol: TCP, Destination Port: $443$ , Destination IP: $*$
- Application Rule Collection (`App-RC`): Priority $300$ , Action: Allow, Source: $10.20.1.5$ , Protocol: HTTPS, Target FQDN: `api.partner.com`

During testing, the administrator observes that `VM-App` can successfully access any external HTTPS website, such as `https://www.microsoft.com`, which violates the security policy.

Which of the following actions should the administrator perform to ensure that `VM-App` can only access `https://api.partner.com`?

Change the priority of the Network Rule Collection (Net-RC) to

400

Remove the rule from the Network Rule Collection (Net-RC).

Change the next hop type of the route in the RT-Spoke route table to Virtual Network Gateway.

Modify the route in the RT-Spoke route table to use the public IP address

20.50.100.10

as the next hop IP address.

Show answer & explanation

Answer: Remove the rule from the Network Rule Collection (Net-RC).

Answer

The administrator should remove the rule from the Network Rule Collection (Net-RC).

The correct action is to remove the rule from the Network Rule Collection (Net-RC). Azure Firewall processes Network rules before Application rules. If a Network rule matches and allows traffic, the Application rules are never evaluated. Since the current Network rule allows all TCP port

443

traffic to any destination, it matches all HTTPS requests and permits them, bypassing the FQDN filtering in the Application rules. Removing this rule allows the HTTPS traffic to be evaluated by the Application rules, which correctly restricts access to the specified partner API.

Step-by-Step Solution

Identify the order in which Azure Firewall processes rule collections.

Azure Firewall processes rules in the following order: DNAT rules, Network rules, and then Application rules.

Understanding the evaluation sequence is essential to trace how a packet matches firewall rules.

Determine which rule matches the outbound HTTPS traffic first.

The Network Rule Collection (Net-RC) has a rule allowing all TCP port

443

traffic to any destination (

*

). Since HTTPS uses TCP port

443

, this network rule matches the traffic first.

Network rules are evaluated before Application rules. If a match is found in the network rules and the action is Allow, the traffic is permitted immediately.

Analyze why the Application Rule Collection (App-RC) is not enforcing the FQDN restriction.

Because the Network rule allowed the TCP port

443

traffic, the Application rules are bypassed entirely.

Azure Firewall stops rule processing once an Allow match is found in the Network rules, preventing downstream Application rules from being evaluated.

Formulate the correct modification to enforce the security policy.

Removing the rule from the Network Rule Collection (Net-RC) forces the firewall to evaluate the Application rules, where the request to `api.partner.com` will match the allow rule and all other HTTPS requests will be denied.

Traffic must fail to match any Network rules in order to reach the Application rules evaluation phase.

Key Concept

Azure Firewall rule processing order (Network rules are processed before Application rules, and matching network rules bypass application rules)

Question 852Question →

An organization has three virtual networks (VNets) in the Northern Europe region:

* VNet-Hub ( $10.200.0.0/16$ ): Contains a Virtual Network Gateway deployed in GatewaySubnet, and a Network Virtual Appliance (NVA) named NVA-1 ( $10.200.1.4$ ) deployed in Subnet-Hub. NVA-1 has IP forwarding enabled in the operating system.
* VNet-App ( $10.210.0.0/16$ ): Contains a virtual machine named VM-App deployed in Subnet-App.
* VNet-DB ( $10.220.0.0/16$ ): Contains a virtual machine named VM-DB deployed in Subnet-DB.

The virtual network peering connections are configured as follows:

* Peering-Hub-To-App (from VNet-Hub to VNet-App): 'Allow gateway transit' is enabled, and 'Allow forwarded traffic' is disabled.
* Peering-App-To-Hub (from VNet-App to VNet-Hub): 'Use remote gateways' is enabled, and 'Allow forwarded traffic' is disabled.
* Peering-Hub-To-DB (from VNet-Hub to VNet-DB): 'Allow gateway transit' is disabled, and 'Allow forwarded traffic' is enabled.
* Peering-DB-To-Hub (from VNet-DB to VNet-Hub): 'Use remote gateways' is disabled, and 'Allow forwarded traffic' is enabled.

You associate the following User-Defined Routes (UDRs):

* Table-App (associated with Subnet-App): A route for destination ` $10.220.0.0/16$ ` with next hop type Virtual Appliance and next hop IP address ` $10.200.1.4$ `.
* Table-DB (associated with Subnet-DB): A route for destination ` $10.210.0.0/16$ ` with next hop type Virtual Appliance and next hop IP address ` $10.200.1.4$ `.

You verify that VM-App can connect to on-premises networks through the gateway in VNet-Hub, but VM-App and VM-DB cannot communicate with each other.

Which configuration change should you implement to allow VM-App and VM-DB to establish communication?

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.

Enable 'Allow gateway transit' on the peering connection from VNet-Hub to VNet-DB.

Enable 'Use remote gateways' on the peering connection from VNet-DB to VNet-Hub.

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-DB.

Show answer & explanation

Answer: Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.

Answer

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.

The correct answer is to enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App. By default, peered virtual networks only accept traffic that originates from the address space of the peered network. Because traffic between the spokes is routed through an NVA in the hub, the packets entering VNet-App have a source IP from VNet-DB, which is outside the VNet-Hub address space. This makes it 'forwarded traffic'. Since 'Allow forwarded traffic' is disabled on the peering between VNet-Hub and VNet-App, these packets are dropped. Enabling this setting allows the forwarded traffic to reach its destination.

Step-by-Step Solution

Analyze the network path for spoke-to-spoke traffic.

Traffic from VM-App (

10.210.0.0/16

) destined for VM-DB (

10.220.0.0/16

) is routed to the NVA (

10.200.1.4

) in VNet-Hub, which then forwards the traffic to VNet-DB.

This establishes that the traffic from VNet-App is received by VNet-Hub, and the NVA attempts to forward it to VNet-DB. Similarly, return traffic from VM-DB is routed to the NVA in VNet-Hub, which then attempts to forward it to VNet-App.

Determine the type of traffic entering VNet-App from VNet-Hub.

Since the source IP of the return traffic (

10.220.x.y

) does not belong to VNet-Hub (

10.200.0.0/16

), it is treated as forwarded traffic when it transits the peering from VNet-Hub to VNet-App.

To identify which configuration setting is blocking the traffic flow.

Inspect the 'Allow forwarded traffic' settings on the peering connections.

The peering between VNet-Hub and VNet-DB already has 'Allow forwarded traffic' enabled. However, the peering between VNet-Hub and VNet-App has 'Allow forwarded traffic' disabled.

Because 'Allow forwarded traffic' is disabled on the VNet-Hub to VNet-App peering, any packets forwarded by the NVA that originate from VNet-DB are dropped at the entrance to VNet-App.

Select the correct configuration change to enable traffic flow.

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.

This allows the forwarded packets from the NVA (originating from VNet-DB) to successfully reach VNet-App, completing the bidirectional communication channel.

Key Concept

Virtual Network Peering Forwarded Traffic

Question 853Question →

You plan to configure a public Azure Load Balancer named LB1 to load balance inbound traffic to two virtual machines named VM1 and VM2. The virtual machines are currently configured as follows:

* VM1 has a network interface associated with a Basic SKU public IP address.
* VM2 has a network interface with no public IP address.

You need to deploy LB1 as a Standard SKU load balancer.

Which of the following two actions must you perform? (Select two.)

Select all that apply

Configure the frontend IP configuration of LB1 using a Standard SKU public IP address.

Disassociate the Basic SKU public IP address from VM1's network interface.

Configure the frontend IP configuration of LB1 using a Basic SKU public IP address.

Associate a Basic SKU public IP address to VM2's network interface.

Show answer & explanation

Answer: Configure the frontend IP configuration of LB1 using a Standard SKU public IP address.; Disassociate the Basic SKU public IP address from VM1's network interface.

Answer

To successfully deploy the Standard SKU public Load Balancer and load balance traffic to the virtual machines, you must configure the frontend IP configuration of the load balancer using a Standard SKU public IP address and disassociate the Basic SKU public IP address from the network interface of the first virtual machine.

The correct configurations involve using a Standard SKU public IP address for the frontend of the Standard Load Balancer and disassociating the Basic SKU public IP from the first virtual machine. Standard SKU Load Balancers require Standard SKU public IP addresses for their frontend configurations. Furthermore, all virtual machines in the backend pool of a Standard Load Balancer must either use Standard SKU public IP addresses or have no public IP address on their network interfaces.

Step-by-Step Solution

Identify the Load Balancer SKU and its frontend requirements.

The load balancer is a Standard SKU public load balancer, which requires a Standard SKU public IP address for its frontend configuration.

Azure Load Balancer SKUs and public IP SKUs must match; a Standard Load Balancer cannot use a Basic SKU public IP.

Analyze the backend pool VM configurations for public IP compatibility.

VM1 has a Basic SKU public IP, which is incompatible with a Standard SKU Load Balancer's backend pool. VM2 has no public IP, which is compatible.

Standard SKU Load Balancer backend pool members cannot have Basic SKU public IPs associated with their NICs.

Determine the necessary actions to achieve compatibility.

Configure the frontend of the load balancer with a Standard SKU public IP and remove the Basic SKU public IP from the first virtual machine.

These configurations satisfy the SKU alignment requirements for both the frontend and the backend pool.

Key Concept

Azure Load Balancer SKU compatibility requires that the Load Balancer SKU, frontend IP SKU, and backend VM public IP SKUs all align (specifically, Standard SKU Load Balancers require Standard SKU public IPs and are incompatible with Basic SKU public IPs on backend virtual machines).

Question 854Question →

You have an Azure subscription. You deploy the Azure Monitor agent to $20$ virtual machines that run Windows Server. All performance counters are collected and sent to a Log Analytics workspace named Workspace1.

Workspace1 is configured with the default data retention period of $30$ days.

You need to analyze the average CPU utilization for the virtual machines over the last $45$ days. The results must show only computers with an average CPU utilization greater than $90\%$ and be sorted from the highest utilization to the lowest.

Which action and query should you select to meet these requirements?

Change the data retention of Workspace1 to

45

days, and run the following query:

kql
Perf
| where TimeGenerated > ago(45d) and ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| where AvgCPU > 90
| summarize AvgCPU = avg(CounterValue) by Computer
| sort by AvgCPU desc

Change the data retention of Workspace1 to

45

days, and run the following query:

kql
Perf
| where TimeGenerated > ago(45d)
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue) by Computer
| where AvgCPU > 90
| sort by AvgCPU desc

Keep the default data retention of Workspace1, and run the following query:

kql
Perf
| where TimeGenerated > ago(45d)
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue) by Computer
| where AvgCPU > 90
| sort by AvgCPU desc

Change the data retention of Workspace1 to

45

days, and run the following query:

kql
Perf
| where TimeGenerated > ago(45d)
| where ObjectName = "Processor" and CounterName = "% Processor Time" and InstanceName = "_Total"
| summarize AvgCPU = avg(CounterValue) by Computer
| where AvgCPU > 90
| order by AvgCPU desc

Show answer & explanation

Answer: Change the data retention of Workspace1 to $45$ days, and run the following query:

kql
Perf
| where TimeGenerated > ago(45d)
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue) by Computer
| where AvgCPU > 90
| sort by AvgCPU desc

Answer

Change the data retention of Workspace1 to

45

days, and use the query that places the aggregation filter after the summarize operator and uses double equals for comparisons.

The correct answer combines increasing the data retention to

45

days with a syntactically correct KQL query. The query uses double equals (`==`) for comparisons, correctly aggregates the CPU counters by computer, and applies the `AvgCPU` threshold filter after the column has been created by the `summarize` operator.

Step-by-Step Solution

Evaluate workspace retention constraints.

Since the default retention is

30

days, performance metrics from

31

45

days ago would be permanently deleted. Changing the retention of Workspace1 to

45

days ensures the historical logs are stored.

You cannot query log data that has already been purged due to retention policies.

Filter source events in KQL.

Filter by `TimeGenerated > ago(45d)` and identify the CPU utilization counters using `ObjectName == "Processor"`, `CounterName == "% Processor Time"`, and `InstanceName == "_Total"`.

Filtering should occur early in the query sequence to reduce the dataset size for subsequent operations.

Aggregate performance counters using summarize.

Construct the operator: `| summarize AvgCPU = avg(CounterValue) by Computer`.

This aggregates the counter values by the host computer name and defines the calculated column `AvgCPU`.

Filter and sort the aggregated results.

Apply `| where AvgCPU > 90` followed by `| sort by AvgCPU desc`.

You can only filter and sort by `AvgCPU` after the variable is defined in the pipeline sequence. KQL queries compile and execute sequentially.

Key Concept

Log Analytics workspace data retention limitations and formulating syntactically correct KQL queries utilizing proper operator order and comparison operators.

Estimated Time:3m 0s

Question 855Question →

An administrator needs to migrate the DNS resolution of an active public domain named `contoso.com` from an external DNS hosting provider to Azure DNS. The migration must occur with zero downtime for users accessing the domain's web services.

Which sequence of steps should the administrator perform to complete the migration successfully?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Create the public DNS zone in Azure DNS, recreate all resource records, update the name server delegation at the registrar to Azure DNS name servers, wait for the TTL of the original NS records to expire, and finally delete the DNS zone on the external provider.

The correct order follows a zero-downtime migration strategy: first, instantiate the public DNS zone in Azure DNS; second, populate it with all necessary resource records to ensure that the zone is ready to handle queries; third, point the domain registrar's NS records to the new Azure DNS name servers to redirect traffic; fourth, wait for the duration of the original NS TTL to expire so that no cached queries continue to hit the old servers; and fifth, safely decommission the old DNS provider zone once all traffic has moved.

Step-by-Step Solution

Create the `contoso.com` zone in Azure DNS.

The zone is initialized in Azure, and four unique name servers are allocated.

You cannot populate resource records or point the registrar delegation to Azure DNS without first having the zone resource created.

Add the duplicate resource records (A, MX, etc.) to the new Azure DNS zone.

Azure DNS name servers are fully prepared to resolve queries for the domain.

To ensure zero downtime, the zone must be ready to resolve requests before any traffic is routed to it. Shifting delegation to empty name servers will cause immediate lookup failures.

Update the domain registrar delegation with the new name servers.

Traffic begins transitioning from the old DNS servers to the new Azure DNS servers.

This initiates the migration of active queries to the new host. Due to DNS caching, some resolvers will immediately query Azure, while others will continue querying the old host until caches expire.

Wait for the TTL of the old NS records to expire.

All recursive DNS resolvers globally clear their cache of the old delegation records and begin querying Azure DNS exclusively.

If the old DNS servers are shut down before cache expiration, queries directed to the cached servers will fail, causing localized downtime.

Delete the zone from the external provider.

The migration is successfully completed with no active dependencies remaining on the previous host.

Once the cached TTL has expired, no queries will reach the old provider, allowing it to be safely decommissioned.

Key Concept

Azure DNS Public Zone migration and delegation flow to prevent downtime.

Question 856Question →

An administrator is configuring network security for an application in an Azure subscription. The environment contains the following resources:

* A virtual network named `VNet1` with two subnets: `Subnet-Web` ( $10.1.0.0/24$ ) and `Subnet-App` ( $10.2.0.0/24$ ).
* A virtual machine named `VM1` in `Subnet-Web` that is associated with an Application Security Group (ASG) named `ASG-Web`.
* A virtual machine named `VM2` in `Subnet-App` that is associated with an ASG named `ASG-App` and has the IP address $10.2.0.4$ .
* A Network Security Group (NSG) named `NSG-Subnet` associated with `Subnet-Web`.
* An NSG named `NSG-NIC` associated with the network interface of `VM1`.

`NSG-Subnet` contains the following outbound security rules:
* Priority 150: Deny outbound traffic from `Subnet-Web` to `Subnet-App` on any port, with any protocol.
* Priority 250: Allow outbound traffic from `ASG-Web` to `ASG-App` on TCP port 8080.

`NSG-NIC` contains the following outbound security rules:
* Priority 100: Allow outbound traffic from `ASG-Web` to `ASG-App` on TCP port 8080.

Currently, `VM1` cannot establish a connection to `VM2` on TCP port 8080.

Which of the following modifications resolves the connectivity issue while maintaining the principle of least privilege?

Change the priority of the Allow rule in `NSG-Subnet` to 120.

Change the priority of the Allow rule in `NSG-Subnet` to 300.

Change the priority of the Allow rule in `NSG-NIC` to 90.

Remove the Deny rule with priority 150 from `NSG-Subnet`.

Show answer & explanation

Answer: Change the priority of the Allow rule in `NSG-Subnet` to 120.

Answer

Change the priority of the Allow rule in `NSG-Subnet` to 120.

The correct answer is to change the priority of the Allow rule in the subnet-level NSG (`NSG-Subnet`) to 120. When `VM1` initiates outbound traffic, the NIC-level NSG (`NSG-NIC`) evaluates it first, matching rule 100 and allowing it. The traffic then reaches the subnet-level NSG (`NSG-Subnet`). Here, the traffic matches both the Deny rule (Priority 150) and the Allow rule (Priority 250). Since rules with lower priority numbers have higher precedence, the Deny rule is applied and the traffic is blocked. Setting the Allow rule's priority to 120 ensures that it is evaluated and applied before the Deny rule at priority 150, thereby allowing the port 8080 connection. Because the Deny rule remains at priority 150, all other outbound traffic from the web subnet to the app subnet on other ports is still blocked, preserving the principle of least privilege.

Step-by-Step Solution

Analyze the outbound traffic flow and NSG evaluation order.

For outbound traffic originating from `VM1`, Azure first evaluates the network interface-level NSG (`NSG-NIC`) and then evaluates the subnet-level NSG (`NSG-Subnet`).

Understanding the sequential flow of NSG rules is required to locate which NSG contains the blocking rule.

Evaluate the rules in `NSG-NIC`.

The traffic matches the rule with Priority 100: Allow outbound traffic from `ASG-Web` to `ASG-App` on TCP port 8080. The traffic is allowed at the network interface level.

This confirms that the network interface-level NSG is not the source of the blocked connection.

Evaluate the rules in `NSG-Subnet`.

The traffic matches both Priority 150 (Deny all outbound from `Subnet-Web` to `Subnet-App`) and Priority 250 (Allow outbound from `ASG-Web` to `ASG-App` on TCP port 8080). Since 150 is a lower priority number than 250, the Deny rule takes precedence, blocking the traffic.

This identifies the subnet-level NSG as the location of the block and shows that the priority of the Allow rule must be lowered below 150 to override the Deny rule.

Select the option that allows port 8080 traffic while maintaining least privilege.

Changing the Allow rule's priority in `NSG-Subnet` to 120 (which is less than 150) allows TCP port 8080 traffic to pass first. Other traffic is still blocked by the Deny rule at priority 150.

This resolves the connectivity issue while preserving the security restrictions on other ports.

Key Concept

Azure NSG outbound traffic processing order and rule priority evaluation

Estimated Time:2m 0s

Question 857Question →

Your company has an Azure subscription containing a resource group named rg-ops. Inside rg-ops, you have an Azure Storage account named stopslogs that contains a blob container named system-logs. You need to configure access for a Microsoft Entra ID group named OpsEngineers. The members of OpsEngineers must be able to read, write, and delete blobs inside the system-logs container, and use the Azure portal to navigate to the stopslogs storage account to view the containers. The solution must use Microsoft Entra ID credentials and follow the principle of least privilege. Which of the following role assignments should you configure? (Select two.)

Select all that apply

Assign the Storage Blob Data Contributor role to OpsEngineers scoped to the system-logs container.

Assign the Reader role to OpsEngineers scoped to the stopslogs storage account.

Assign the Contributor role to OpsEngineers scoped to the stopslogs storage account.

Assign the Storage Blob Data Reader role to OpsEngineers scoped to the system-logs container.

Show answer & explanation

Answer: Assign the Storage Blob Data Contributor role to OpsEngineers scoped to the system-logs container.; Assign the Reader role to OpsEngineers scoped to the stopslogs storage account.

Answer

Assign the Storage Blob Data Contributor role scoped to the system-logs container, and assign the Reader role scoped to the stopslogs storage account.

To satisfy the requirements using the principle of least privilege, two roles are needed: a data-plane role and a control-plane role. Assigning the Storage Blob Data Contributor role scoped to the system-logs container provides the necessary read, write, and delete permissions for the blob data. Assigning the Reader role scoped to the stopslogs storage account provides the control-plane permissions required to navigate the Azure portal and view the storage account and its containers without granting excessive administrative permissions or access keys.

Step-by-Step Solution

Identify the data-plane access requirement.

Members must read, write, and delete blobs, which requires the Storage Blob Data Contributor role.

Microsoft Entra ID authentication for blob access relies on specific data-plane roles like Storage Blob Data Contributor.

Identify the control-plane access requirement for portal navigation.

Members must find the storage account in the Azure portal, which requires the Reader role scoped to the storage account.

Data-plane roles do not grant control-plane visibility in the Azure portal, so the Reader role is necessary for navigation under the principle of least privilege.

Key Concept

Azure RBAC separates control-plane management from data-plane access for Azure Storage.

Question 858Question →

An administrator needs to automate a nightly upload of backup files from an on-premises server to an Azure Storage account named `stbackup2026`. The storage account has shared key access disabled to comply with company security policies. You plan to use AzCopy with a Microsoft Entra ID service principal to perform the transfer.

Which sequence of steps should the administrator perform to configure and run the daily upload process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Create a service principal, assign the Storage Blob Data Contributor role to it, run azcopy login using the service principal, and then run azcopy copy to upload the files.

The correct sequence is to create the service principal first, assign the required role (Storage Blob Data Contributor) to the service principal, log in to the AzCopy session using the service principal credentials, and finally execute the copy command.

Step-by-Step Solution

Create the Microsoft Entra ID service principal

An identity is created that can be authenticated by AzCopy.

AzCopy requires an identity to log in when shared key access is disabled.

Assign the Storage Blob Data Contributor role to the service principal

The service principal is authorized to write to the destination blob storage container.

Without the Storage Blob Data Contributor role, the service principal cannot write data to the container.

Run the azcopy login command using the service principal credentials

The terminal session is authenticated with Azure.

The CLI session must be authenticated before it can execute commands against the storage account.

Run the azcopy copy command

The backup files are copied from the on-premises server to the Azure blob container.

This initiates the actual data movement using the authenticated and authorized service principal.

Key Concept

Configuring secure data movement with AzCopy using Microsoft Entra ID authentication and role-based access control (RBAC)

Estimated Time:2m 0s

Question 859Question →

You plan to deploy an Azure virtual machine named VM1 in the East US region.

VM1 must meet the following requirements:
- Use an Ephemeral OS disk to minimize read/write latency and eliminate OS disk storage costs.
- Provide protection against datacenter-wide failures within the region.
- Be backed up daily using Azure Backup.

Which two settings or actions should you configure to meet the requirements? Select two.

Select all that apply

Configure the Availability options to use Availability Zones.

Configure the Availability options to use an Availability Set.

Select a virtual machine size that has a temporary disk or cache size larger than the OS image.

Deploy a Recovery Services Vault in the West US region to back up VM1.

Show answer & explanation

Answer: Configure the Availability options to use Availability Zones.; Select a virtual machine size that has a temporary disk or cache size larger than the OS image.

Answer

To meet the requirements, you must configure Availability Zones for high availability and select a VM size with a temporary disk or cache size larger than the OS image for the Ephemeral OS disk.

To satisfy the high availability requirement, the virtual machine must be placed in Availability Zones. This ensures protection against datacenter-wide outages. To support an Ephemeral OS disk, the virtual machine size must have a temporary disk or cache capacity that is equal to or larger than the size of the OS disk image.

Step-by-Step Solution

Evaluate the high availability requirement.

Determine that Availability Zones must be selected to protect against datacenter-wide failures, whereas Availability Sets only protect against localized hardware failures.

Availability Zones distribute VMs across physically separate datacenters within a region, providing redundancy against facility-level outages.

Evaluate the Ephemeral OS disk requirement.

Determine that a VM size with a cache or temporary disk size greater than the OS image is required.

Ephemeral OS disks are constructed on the local VM node's caching or temporary storage, so the VM size must support Premium storage and have sufficient local capacity.

Evaluate the backup requirement.

Identify that the Recovery Services Vault must reside in the same region (East US) as VM1.

Azure Backup does not support backing up virtual machines to a Recovery Services Vault located in a different geographical region.

Key Concept

Configuring Azure Virtual Machine settings for high availability, local storage requirements (Ephemeral OS disks), and regional alignment for backups.

Question 860Question →

An administrator manages an Azure subscription. The administrator applies a tag named `CostCenter: Operations` and a `CanNotDelete` lock to a resource group named `rg-ops-prod`. The resource group contains an Azure Virtual Machine named `vm-ops-web`.

Consider the following statement: 'Because the tag and lock are applied at the resource group level, `vm-ops-web` inherits the `CanNotDelete` lock—preventing its deletion—but does not inherit the `CostCenter: Operations` tag.'

Is this statement true or false?

True

False

Show answer & explanation

Answer: True

Answer

True

The statement is correct because resource locks in Azure are inherited from parent scopes to child resources, while tags are not inherited automatically.

Step-by-Step Solution

Evaluate lock inheritance for the virtual machine.

Locks applied at the resource group scope are inherited by all child resources. The virtual machine inherits the CanNotDelete lock.

To verify if the VM is protected from deletion by the resource group's lock.

Evaluate tag inheritance for the virtual machine.

Tags applied to a resource group do not inherit down to individual resources.

To determine if the VM automatically receives the tag applied to the resource group.

Assess the truth value of the combined statement.

Since the VM inherits the lock but does not inherit the tag, the statement is true.

To formulate the final answer based on the evaluated outcomes.

Key Concept

Azure resource locks are inherited by child resources from their parent scopes, whereas Azure tags applied to resource groups are not inherited by individual resources within those groups.

PreviousPage 43 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept