All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

A company has a containerized data-validation application packaged as a Docker image. The application processes batch files exported from a database once per day, taking approximately 10 minutes to complete. The application must write its output directly to a shared directory that is accessible by other systems, and it must exit immediately after finishing. If the application terminates with an error code, it must attempt to rerun.

You need to deploy the application using Azure Container Instances (ACI).

Which configuration settings should you apply to the container group?

Set the restart policy to OnFailure and mount an Azure File share as a volume inside the container group.

Set the restart policy to Always and mount an Azure File share as a volume inside the container group.

Set the restart policy to OnFailure and configure the container to authenticate to the storage account using only the Subscription Owner RBAC role.

Set the restart policy to OnFailure and install the Azure File Sync agent inside the container to synchronize output files.

Show answer & explanation

Answer: Set the restart policy to OnFailure and mount an Azure File share as a volume inside the container group.

Answer

Set the restart policy to OnFailure and mount an Azure File share as a volume inside the container group.

The correct option specifies setting the restart policy to OnFailure, ensuring the container group only restarts if it terminates with a non-zero exit code. It also correctly specifies mounting an Azure File share as a volume, which provides a shared, persistent storage directory accessible by other systems.

Step-by-Step Solution

Determine the required restart behavior of the daily batch application.

The application runs once, exits upon success, and must restart only upon failure.

This requirement aligns with the OnFailure restart policy.

Determine the storage requirements for writing output to a shared directory accessible by other systems.

An Azure File share must be mounted as a volume.

ACI supports mounting Azure File shares directly to container groups to provide shared, persistent access.

Identify the authentication credentials needed to establish the volume mount.

The storage account name and access key must be provided in the container group definition.

Standard control-plane RBAC roles do not authorize direct SMB file share mounts inside ACI without access credentials.

Key Concept

Configuring ACI restart policies and persistent volume mounts.

Question 902Question →

An administrator needs to identify all virtual machines that were successfully deleted in an Azure subscription during the last 24 hours. The diagnostic data is sent to a Log Analytics workspace.

Which of the following Kusto Query Language (KQL) queries will successfully return the records? (Select two.)

Select all that apply

AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue =~ "Microsoft.Compute/virtualMachines/delete" and ActivityStatusValue =~ "Succeeded"

AzureActivity
| where TimeGenerated >= ago(1d)
| where OperationName == "Microsoft.Compute/virtualMachines/delete"
| where ActivityStatus == "Succeeded"

AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue = "Microsoft.Compute/virtualMachines/delete" and ActivityStatusValue = "Succeeded"

SELECT * FROM AzureActivity
WHERE TimeGenerated > ago(24h)
AND OperationNameValue == "Microsoft.Compute/virtualMachines/delete"

Show answer & explanation

Answer: AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue =~ "Microsoft.Compute/virtualMachines/delete" and ActivityStatusValue =~ "Succeeded"; AzureActivity
| where TimeGenerated >= ago(1d)
| where OperationName == "Microsoft.Compute/virtualMachines/delete"
| where ActivityStatus == "Succeeded"

Answer

The two correct queries start with the AzureActivity table name and use valid KQL filtering syntax, utilizing either the double equals (==) or the case-insensitive (=~) comparison operator along with the ago() function for time filtering.

The correct queries successfully retrieve the virtual machine deletion events by referencing the AzureActivity table, filtering by the last 24 hours using ago(24h) or ago(1d), and filtering for the delete operation and succeeded status using correct comparison operators (== or =~).

Step-by-Step Solution

Identify the target table and time constraint.

The target table is AzureActivity and the time range is the last 24 hours. The ago(24h) or ago(1d) functions must be used with the TimeGenerated column.

Log Analytics stores Azure subscription activity logs in the AzureActivity table, and time filters are typically applied to TimeGenerated.

Identify the deletion operation and status filter.

The operation for virtual machine deletion is 'Microsoft.Compute/virtualMachines/delete' and the successful status is 'Succeeded'.

Filtering for these specific values ensures only actual successful deletions are returned.

Validate comparison operators and structure.

Valid options must use tabular KQL flow (table name first, then pipes) and correct equality operators (== or =~). Single equals (=) or SQL SELECT statements are invalid.

KQL requires == or =~ for comparison in where clauses, and does not support SQL syntax.

Key Concept

Writing KQL queries on AzureActivity to filter resource events by time, operation, and status.

Question 903Question →

You need to recover individual files from a backup of an Azure virtual machine by using the File Recovery option in the Azure portal.

Which sequence of steps should you perform to mount the backup disks, retrieve the files, and clean up the connection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Select the recovery point, download the recovery script, and copy the password; run the script on the target machine and enter the copied password to mount the disks; copy the required files from the mounted virtual disks to your local destination; and select Unmount Disks in the Azure portal to close the recovery session.

The correct sequence begins by downloading the recovery script and copying the password from the Azure portal. Next, the script must be run locally to mount the backup disks as virtual drives. Once mounted, the files can be copied to the local machine. Finally, the disks must be unmounted in the portal to end the session.

Step-by-Step Solution

Select the recovery point, download the recovery script, and copy the password.

You obtain the executable script and the required authentication credentials.

You must have the script and the temporary password locally before mounting can occur.

Run the script on the target machine and enter the copied password to mount the disks.

The backup disks are mounted as local drives on the target machine.

This establishes a connection to the recovery point virtual disks over the network.

Copy the required files from the mounted virtual disks to your local destination.

The desired files are successfully restored to the target machine.

Files must be copied while the volumes are still mounted and accessible.

Select Unmount Disks in the Azure portal to close the recovery session.

The recovery session is closed, and the mounted drives are removed from the target machine.

This cleans up the resources and releases the lock on the backup recovery point.

Key Concept

Azure VM Item-Level Recovery (ILR) sequence

Question 904Question →

A company's Azure environment includes a resource group named `rg-analytics-prod`. The resource group contains an Azure Cosmos DB account named `cosmos-prod-db`.

An administrator performs the following tasks:
- Assigns a tag named `CostCenter: 4002` to `rg-analytics-prod`.
- Configures a `ReadOnly` lock named `rg-lock` on `rg-analytics-prod`.
- Configures a `CanNotDelete` lock named `db-lock` on `cosmos-prod-db`.

Which of the following describes the final governance state and administrative permissions for `cosmos-prod-db`?

The database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings.

The database account automatically inherits the CostCenter tag, and administrators can modify but not delete the database account.

The database account does not inherit the CostCenter tag, and administrators can modify the database account's settings because the ReadOnly lock applies only to the resource group itself.

The database account does not inherit the CostCenter tag, and subscription Owners can modify the database account because Owner permissions bypass resource locks.

Show answer & explanation

Answer: The database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings.

Answer

The database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings.

The correct option is that the database account does not inherit the CostCenter tag, and administrators cannot modify the database account's settings. Azure tags are not inherited from resource groups to resources. Additionally, resource locks inherit down the resource hierarchy. The ReadOnly lock applied to the resource group is inherited by the Cosmos DB account. Since a ReadOnly lock prevents all write and delete operations, administrators are blocked from modifying the settings of the Cosmos DB account, regardless of the local CanNotDelete lock.

Step-by-Step Solution

Evaluate tag inheritance.

The Cosmos DB account does not receive the `CostCenter: 4002` tag.

Tags applied to a resource group do not automatically inherit to the resources inside it.

Evaluate resource lock inheritance.

The Cosmos DB account inherits the `ReadOnly` lock from the resource group.

Resource locks applied at a parent scope (like a resource group) are inherited by all child resources.

Combine the effects of the locks.

The Cosmos DB account is blocked from deletion and modification.

A `ReadOnly` lock prevents both deletion and configuration modifications. Although the Cosmos DB account has a local `CanNotDelete` lock, the inherited `ReadOnly` lock is more restrictive and takes precedence, preventing any modifications.

Key Concept

Resource lock inheritance and tag non-inheritance in Azure

Estimated Time:1m 30s

Question 905Question →

An enterprise architecture team is deploying a new workload in Azure. Within a virtual network named `vnet-hr-payroll` ( $10.200.0.0/22$ ), you must create two subnets to meet the following requirements:

* A subnet named `AzureBastionSubnet` to support the deployment of an Azure Bastion host.
* A subnet named `snet-payroll-vms` to host exactly $60$ virtual machines that require private IP addresses.

You need to minimize the number of IP addresses allocated to each subnet while meeting the technical requirements.

Which subnet prefixes should you assign to meet the requirements?

`snet-payroll-vms` with

/26

; `AzureBastionSubnet` with

/26

`snet-payroll-vms` with

/25

; `AzureBastionSubnet` with

/29

`snet-payroll-vms` with

/25

; `AzureBastionSubnet` with

/26

`snet-payroll-vms` with

/26

; `AzureBastionSubnet` with

/27

Show answer & explanation

Answer: `snet-payroll-vms` with $/25$ ; `AzureBastionSubnet` with $/26$

Answer

The subnet `snet-payroll-vms` should use a

/25

prefix, and the subnet `AzureBastionSubnet` should use a

/26

prefix.

The correct configuration uses a

/25

subnet prefix for `snet-payroll-vms` and a

/26

subnet prefix for `AzureBastionSubnet`. This minimizes allocated addresses: the virtual machine subnet requires at least

65

IPs (

60

for hosts +

5

reserved by Azure), which is accommodated by the

128

IPs of a

/25

block (whereas a

/26

block only offers

64

total IPs and

59

usable IPs). Azure Bastion requires a minimum prefix of

/26

to successfully deploy.

Step-by-Step Solution

Calculate the total number of IP addresses required for the virtual machines subnet.

60 \text{ VMs} + 5 \text{ Azure reserved IPs} = 65 \text{ IP addresses}

Azure reserves the first four IP addresses and the last IP address in each subnet for system use.

Determine the smallest subnet size (CIDR) that can host the required IP addresses for the virtual machines.

/25

subnet prefix

/26

prefix provides

2^6 = 64

total IPs (only

59

usable), which is insufficient. A

/25

prefix provides

2^7 = 128

total IPs (with

123

usable), which satisfies the requirement of at least

65

IPs.

Determine the minimum subnet size requirement for the Azure Bastion subnet.

/26

subnet prefix

Azure Bastion requires the subnet to be named exactly `AzureBastionSubnet` and must have a prefix size of

/26

or larger.

Key Concept

Azure Virtual Network subnet sizing constraints, including the 5 reserved IP addresses per subnet and specific service requirements like Azure Bastion.

Estimated Time:1m 30s

Question 906Question →

An administrator is configuring log monitoring for an Azure virtual machine named VM1. VM1 sends its performance logs to a Log Analytics workspace named Workspace1. The workspace is configured to use the 'Use resource or workspace permissions' access mode. A user named User1 is assigned only the Reader role for VM1. User1 has no roles assigned for Workspace1 or its resource group. User1 needs to run a query to analyze the average CPU utilization of VM1 over the last 24 hours, aggregated in 1-hour intervals. Which action should the administrator instruct User1 to perform?

Open the Logs blade of VM1 in the Azure portal, and run the query: Perf | where TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)

Open the Logs blade of Workspace1 in the Azure portal, and run the query: Perf | where Computer == 'VM1' and TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)

Open the Logs blade of VM1 in the Azure portal, and run the query: workspace('Workspace1').Perf | where TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)

Open the Logs blade of VM1 in the Azure portal, and run the query: AzureActivity | where TimeGenerated > ago(24h) and OperationNameValue == 'Microsoft.Compute/virtualMachines/read' | summarize Count = count() by bin(TimeGenerated, 1h)

Show answer & explanation

Answer: Open the Logs blade of VM1 in the Azure portal, and run the query: Perf | where TimeGenerated > ago(24h) and CounterName == '% Processor Time' | summarize AvgCPU = avg(CounterValue) by bin(TimeGenerated, 1h)

Answer

Open the Logs blade of VM1 in the Azure portal and query the Perf table using the correct KQL aggregation syntax.

The correct option instructs User1 to query from the VM1 Logs blade, which leverages resource-context access. Since User1 has Reader rights on VM1 and the workspace allows resource-context queries, User1 can query VM1 logs. The KQL query correctly retrieves performance metrics, filters for CPU percentage, and aggregates data in 1-hour intervals.

Step-by-Step Solution

Determine the access context based on permissions.

Resource-context

User1 has Reader permissions on VM1 but no permissions on Workspace1. Since 'Use resource or workspace permissions' is enabled, User1 can query VM1's logs but only when scoped to VM1 (resource-context).

Select the portal entry point.

VM1 Logs blade

Opening Logs from VM1 automatically scopes the query to VM1's logs. Accessing from Workspace1 requires workspace-level permissions, which User1 lacks.

Construct the KQL query on the correct table.

Perf table query with binning

Performance metrics are sent to the Perf table. The query must filter by CounterName == '% Processor Time' and aggregate CounterValue using avg() by bin(TimeGenerated, 1h) to produce hourly averages.

Key Concept

Resource-context vs. Workspace-context access modes and KQL Performance table schema

Question 907Question →

An administrator plans to deploy a public load balancer named LB1 in an Azure subscription. The subscription contains a virtual network named VNet1. VNet1 contains the following virtual machines:
- VM1: A standalone virtual machine
- VM2: A virtual machine deployed in Availability Zone 1
- VM3: A virtual machine deployed in Availability Zone 2

The administrator needs to configure LB1 to distribute inbound traffic across VM1, VM2, and VM3 by using a new public IP address named PublicIP1.

Which combination of SKUs for LB1 and PublicIP1 must the administrator use?

Basic SKU for LB1 and Basic SKU for PublicIP1

Standard SKU for LB1 and Standard SKU for PublicIP1

Standard SKU for LB1 and Basic SKU for PublicIP1

Basic SKU for LB1 and Standard SKU for PublicIP1

Show answer & explanation

Answer: Standard SKU for LB1 and Standard SKU for PublicIP1

Answer

Standard SKU for LB1 and Standard SKU for PublicIP1

The correct configuration is to use the Standard SKU for both the load balancer and the public IP address. A Standard SKU load balancer is required because the backend pool contains virtual machines that are standalone and deployed across different availability zones (Basic SKU load balancers only support backend pools limited to a single availability set or virtual machine scale set). Additionally, Azure requires that the load balancer SKU matches the SKU of its associated frontend public IP address, meaning a Standard SKU public IP address must be used with the Standard SKU load balancer.

Step-by-Step Solution

Analyze the backend pool virtual machine topology requirements.

The target backend pool contains a standalone VM (VM1) and zonal VMs in different availability zones (VM2 in Zone 1, VM3 in Zone 2).

Understanding backend pool constraints is critical because Basic SKU load balancers only support VMs within a single availability set or scale set, whereas Standard SKU load balancers support any VMs within the same virtual network.

Select the appropriate load balancer SKU based on backend pool support.

A Standard SKU load balancer (LB1) is selected.

Since the VMs are a mix of standalone and zonal deployments across different zones, a Basic SKU load balancer cannot be used.

Determine the required public IP address SKU for the load balancer's frontend configuration.

A Standard SKU public IP address (PublicIP1) must be used.

Azure enforces SKU matching between public load balancers and their frontend public IP configurations. Standard SKU load balancers require Standard SKU public IP addresses.

Key Concept

Azure Load Balancer SKU feature and configuration compatibility

Question 908Question →

A cloud engineer needs to configure a single Azure Application Gateway v2 with one public frontend IP address to host two secure websites: `partners.contoso.com` and `customers.contoso.com`. Both websites must be accessible over HTTPS on port 443. Traffic to `partners.contoso.com/orders/*` must be routed to a backend pool named `PartnerOrdersPool`, while all other traffic for both websites must be routed to `DefaultWebPool`. Which configuration should the administrator implement?

Configure a multi-site listener for each domain on port 443. Associate the listener for partners.contoso.com with a routing rule that uses a path map to route /orders/* traffic to PartnerOrdersPool and default traffic to DefaultWebPool. Associate the listener for customers.contoso.com with a routing rule that sends all traffic directly to DefaultWebPool.

Configure a basic listener for each domain on port 443. Associate both listeners with a routing rule that routes all traffic to DefaultWebPool. Create a Private DNS Zone named contoso.com and link it to the virtual network to handle name resolution.

Configure a basic listener on port 443. Associate it with a routing rule that directs traffic to DefaultWebPool. Configure a Network Security Group on the Application Gateway subnet with an inbound rule allowing port 443 at priority 4000 and an inbound deny rule at priority 1000.

Configure a multi-site listener on port 443 using a wildcard host header *.contoso.com. Associate it with a routing rule that uses a path map. Configure a user-defined route on the Application Gateway subnet with a next hop type of Virtual Network Gateway to route traffic to the backend pools.

Show answer & explanation

Answer: Configure a multi-site listener for each domain on port 443. Associate the listener for partners.contoso.com with a routing rule that uses a path map to route /orders/* traffic to PartnerOrdersPool and default traffic to DefaultWebPool. Associate the listener for customers.contoso.com with a routing rule that sends all traffic directly to DefaultWebPool.

Answer

To host multiple websites on the same port and frontend IP address of an Azure Application Gateway, multi-site listeners must be configured with unique hostnames. The listener for the domain requiring path-based routing is associated with a routing rule that uses a path map to direct specific URLs to one backend pool and all other traffic to the default pool. The listener for the other domain, which requires no path-specific routing, is associated with a standard basic routing rule pointing to the default pool.

Step-by-Step Solution

Determine the listener type required for hosting multiple domains on the same IP and port.

Identify that multi-site listeners must be used, specifying the host headers partners.contoso.com and customers.contoso.com respectively.

Basic listeners do not support host headers and cannot share the same IP and port combination.

Configure routing rules based on path requirements.

Associate the partners.contoso.com listener with a path-based routing rule, mapping /orders/* to PartnerOrdersPool and the default path to DefaultWebPool. Associate the customers.contoso.com listener with a basic routing rule routing to DefaultWebPool.

One domain requires path-specific redirection, while the other maps all inbound requests directly to the default backend pool.

Ensure that surrounding network routing and security group rules do not interfere with Application Gateway operations.

Avoid placing UDRs on the gateway subnet targeting backend pools, and ensure NSG priorities allow port 443 and gateway communication.

Application Gateway handles backend distribution internally, and wrong NSG priorities or UDR routes will block or misroute the traffic.

Key Concept

Configuring Multi-site Listeners and Path-based Routing Rules on Azure Application Gateway

Estimated Time:2m 30s

Question 909Question →

You have an Azure Key Vault named KV1. You need to ensure that all secret read and write audit events in KV1 are collected and stored in a Log Analytics workspace named Workspace1. What configuration should you create on KV1?

Configure a diagnostic setting on KV1 that enables the AuditEvent log category and specifies Workspace1 as the destination.

Configure a diagnostic setting on KV1 that enables only the AllMetrics category and specifies Workspace1 as the destination.

Configure the Azure Activity log for the subscription to export events directly to Workspace1.

Assign the Storage Blob Data Reader Role for Workspace1 to KV1.

Show answer & explanation

Answer: Configure a diagnostic setting on KV1 that enables the AuditEvent log category and specifies Workspace1 as the destination.

Answer

Configure a diagnostic setting on KV1 that enables the AuditEvent log category and specifies Workspace1 as the destination.

To collect and store audit data from data-plane transactions inside an Azure resource like Key Vault, you must configure a diagnostic setting on the resource itself. Enabling the AuditEvent log category and choosing Workspace1 as the target Log Analytics workspace satisfies all the requirements.

Step-by-Step Solution

Determine the event source type.

Secret read and write events represent data-plane operations inside the Key Vault resource, which fall under Key Vault resource logs (specifically the AuditEvent category).

Identifying the event type determines whether you need to target subscription-level logs (Activity Log) or resource-level logs (Diagnostic Settings).

Select the correct Azure Monitor mechanism for resource logs.

Resource diagnostic settings are used to route logs to destinations.

Diagnostic settings must be configured on the individual resource generating the logs to define which logs and metrics are exported.

Select the required log category and destination workspace.

The setting must specify the AuditEvent category and route it to the target Log Analytics workspace.

This directly fulfills the requirement of sending the audit logs to the specified workspace.

Key Concept

Azure Monitor Diagnostic Settings allow resource logs and metrics to be collected and routed to destinations like Log Analytics workspaces.

Estimated Time:45s

Question 910Question →

A company plans to deploy containerized APIs to Azure App Service. The hosting environment has the following requirements:

- Enable auto-scaling to dynamically scale out up to 5 instances during peak traffic.
- Configure up to 2 staging slots for testing updates before swapping to production.
- Perform automated backups of the application and configuration data twice per day.

Which App Service plan pricing tier is the most cost-effective tier that meets these requirements?

P1v3

Show answer & explanation

Answer: S1

Answer

The Standard (S1) pricing tier supports auto-scaling (up to 10 instances), up to 5 deployment slots, and up to 10 automated backups per day. This makes it the most cost-effective tier that satisfies all requirements of the scenario.

Step-by-Step Solution

Analyze the scaling requirements.

Auto-scaling is required, which rules out the Free (F1) and Basic (B1) tiers since B1 only supports manual scaling.

Free and Basic tiers do not support auto-scaling capabilities.

Analyze the deployment slots requirement.

At least 2 staging slots are needed. This rules out the Free (F1) and Basic (B1) tiers, which do not support deployment slots.

Standard (S1) supports up to 5 slots, and Premium (P1v3) supports up to 20 slots.

Analyze the backup requirements.

Automated backups twice per day are required. Standard (S1) supports up to 10 backups per day, and Premium (P1v3) supports up to 50 backups per day.

Free and Basic tiers do not support automated backups.

Identify the most cost-effective tier that meets all criteria.

The Standard (S1) tier meets all criteria and is cheaper than the Premium (P1v3) tier.

Comparing costs, Standard is positioned below Premium and satisfies the customer's constraints.

Key Concept

Selecting the appropriate App Service Plan pricing tier based on application features like deployment slots, scaling, and backups.

Question 911Question →

An administrator manages an Azure subscription that contains a resource group named `rg-network-core`. Inside `rg-network-core`, there is a Virtual Network named `vnet-prod` and a Network Security Group (NSG) named `nsg-prod`. The administrator applies a `CanNotDelete` lock directly to `vnet-prod`, but does not apply any locks to `rg-network-core` or `nsg-prod`.

Evaluate the following statement: The administrator can delete `rg-network-core` without first removing the lock from `vnet-prod`.

True

False

Show answer & explanation

Answer: False

Answer

False

The statement is false because deleting a resource group requires deleting all resources nested inside it. If any resource inside the group has a CanNotDelete lock, the deletion of the resource group will be blocked.

Step-by-Step Solution

Analyze the action being performed and the target resource.

The administrator attempts to delete the resource group `rg-network-core`.

Deleting a resource group recursively deletes all resources contained within that group.

Check the locks applied to the resource group and its child resources.

No locks are applied to `rg-network-core`. However, a `CanNotDelete` lock is applied directly to the child resource `vnet-prod`.

We must evaluate if any child resource deletions are blocked by resource locks.

Determine the outcome of the deletion request.

The deletion of `rg-network-core` fails because the deletion of its child resource `vnet-prod` is blocked by the active `CanNotDelete` lock.

Azure Resource Manager enforces resource locks at all levels, and a locked child resource blocks the deletion of its parent resource group.

Key Concept

Resource locks prevent deletion of resources, and a lock on a child resource blocks the deletion of the parent resource group.

Estimated Time:1m 0s

Question 912Question →

An administrator is configuring routing and security for a hub-and-spoke virtual network topology in Microsoft Azure. The topology contains the following networks and subnets:

- A hub virtual network named `VNet-Hub` ( $10.10.0.0/16$ ) containing an Azure Firewall on the subnet `AzureFirewallSubnet`. The firewall has a private IP address of $10.10.1.4$ .
- A spoke virtual network named `VNet-Spoke1` ( $10.20.0.0/16$ ) containing a subnet named `Subnet-Web` ( $10.20.1.0/24$ ).
- A spoke virtual network named `VNet-Spoke2` ( $10.30.0.0/16$ ) containing a subnet named `Subnet-DB` ( $10.30.1.0/24$ ).

Virtual network peering is configured between `VNet-Hub` and `VNet-Spoke1`, and between `VNet-Hub` and `VNet-Spoke2`. Gateway transit is disabled.

You need to meet the following requirements:
1. All traffic from `Subnet-Web` to `Subnet-DB` must be routed through the Azure Firewall and allowed.
2. All outbound HTTPS traffic from `Subnet-Web` to the external partner API endpoint at the fully qualified domain name (FQDN) `api.partner.com` must be allowed.
3. All other traffic must be blocked.

Which two configurations should you perform? (Select two.)

Select all that apply

Associate a route table to `Subnet-Web` that contains a route with the address prefix

10.30.0.0/16

, a next hop type of `Virtual appliance`, and a next hop address of

10.10.1.4

Create an Application Rule in the Azure Firewall policy that allows HTTPS traffic from

10.20.1.0/24

to the FQDN `api.partner.com` on port 443.

Associate a route table to `Subnet-Web` that contains a route with the address prefix

10.30.0.0/16

, a next hop type of `Virtual network gateway`, and a next hop address of

10.10.1.4

Configure the virtual network peering connection between `VNet-Spoke1` and `VNet-Hub` to use remote gateways to route traffic transitively to `VNet-Spoke2`.

Create an outbound security rule in the Network Security Group (NSG) associated with `Subnet-Web` with a priority of 100 to redirect outbound traffic to the firewall.

Show answer & explanation

Answer: Associate a route table to `Subnet-Web` that contains a route with the address prefix $10.30.0.0/16$ , a next hop type of `Virtual appliance`, and a next hop address of $10.10.1.4$ .; Create an Application Rule in the Azure Firewall policy that allows HTTPS traffic from $10.20.1.0/24$ to the FQDN `api.partner.com` on port 443.

Answer

Associate a route table to the web subnet with a route for the database subnet pointing to the firewall as a virtual appliance, and create an Application Rule to allow HTTPS traffic to the target FQDN.

To route traffic from the web subnet to the database subnet through the firewall, you must associate a route table with the web subnet containing a user-defined route for the database subnet destination (

10.30.0.0/16

), specifying a next hop type of Virtual appliance and the firewall's private IP (

10.10.1.4

). Additionally, to permit outbound HTTPS traffic to the domain name `api.partner.com`, you must configure an Application Rule in the Azure Firewall policy that targets the FQDN over port 443.

Step-by-Step Solution

Analyze spoke-to-spoke routing requirements.

Confirm that virtual network peering is non-transitive by default, meaning traffic between spoke networks cannot communicate via the hub firewall without a custom route.

Determines that a User-Defined Route (UDR) must be added to route database-bound traffic to the firewall.

Configure the user-defined route in the route table associated with the web subnet.

Define a route targeting the database IP range (

10.30.0.0/16

) with the next hop type set to 'Virtual appliance' and the next hop IP address set to the firewall's private IP (

10.10.1.4

Allows traffic to leave the spoke and be successfully forwarded to the firewall instance for inspection.

Configure outbound FQDN filtering rules on the firewall.

Identify that the destination is a domain name (FQDN) over HTTPS, which requires an Application Rule rather than a Network Rule.

Selects the correct rule type to permit HTTPS traffic to the partner API domain.

Key Concept

Azure Firewall routing and rule configuration in a hub-and-spoke topology

Question 913Question →

An administrator needs to recover a backed-up Azure virtual machine. The administrator wants to restore the virtual machine's disks to a storage account as virtual hard disk (VHD) templates to perform custom configuration before recreating the virtual machine. Which restore option should the administrator select in the Recovery Services vault?

Restore disks

Create new

Replace existing

File recovery

Show answer & explanation

Answer: Restore disks

Answer

Restore disks

Selecting the 'Restore disks' option recovers the virtual machine's disks to a specified storage account as VHD files. This provides the flexibility to customize the configuration or use the restored VHDs as templates to create the virtual machine manually or via a template deployment.

Step-by-Step Solution

Navigate to the Recovery Services vault containing the backup of the virtual machine.

Access to the backup items and recovery points.

Allows you to select the virtual machine backup item that needs to be restored.

Select the backup item, click Restore VM, and select the desired recovery point.

The restore configuration options become available.

Initiates the restore process for the specific backup version.

Choose Restore disks, select the target storage account, and initiate the restore.

The disks are restored as VHD templates in the specified storage account.

Meets the requirement of exporting the disks to a storage account for custom configuration before VM creation.

Key Concept

Azure Virtual Machine Restore Options

Question 914Question →

An administrator is configuring diagnostic settings for an Azure Firewall named FW1 to stream resource logs for security analysis and long-term retention. Which of the following destinations can be specified directly as targets in the diagnostic settings of FW1? (Select two.)

Select all that apply

A Log Analytics workspace

An Azure Storage account

An Azure Recovery Services vault

A Network Security Group flow log configuration

Show answer & explanation

Answer: A Log Analytics workspace; An Azure Storage account

Answer

A Log Analytics workspace and an Azure Storage account

Azure Monitor diagnostic settings support sending platform logs and metrics to a Log Analytics workspace, an Azure Storage account, an Azure Event Hub, or Azure Monitor partner integrations. Therefore, specifying a Log Analytics workspace and a storage account is the correct configuration.

Step-by-Step Solution

Identify the purpose of diagnostic settings

Diagnostic settings are used to route resource logs and metrics to supported external destinations.

This establishes the scope of available targets.

Evaluate the supported target destinations for Azure Monitor diagnostic settings

Supported destinations include Log Analytics workspaces, Azure Storage accounts, Event Hubs, and partner integration solutions.

This allows filtering of the provided options.

Select the matching correct options and eliminate unsupported resources

Log Analytics workspace and Storage account are supported. Recovery Services vaults and Network Security Group flow logs are not diagnostic targets.

This determines the final correct answers.

Key Concept

Supported destinations for Azure Monitor diagnostic settings

Question 915Question →

An administrator is configuring network security for a two-tier application in an Azure subscription. The subscription contains a virtual network named `VNet1` with two subnets: `Subnet-Web` (address space $10.10.1.0/24$ ) and `Subnet-DB` (address space $10.10.2.0/24$ ).

A virtual machine named `VM-Web1` is deployed in `Subnet-Web` and associated with an Application Security Group named `ASG-Web`.
A virtual machine named `VM-DB1` is deployed in `Subnet-DB` and associated with an Application Security Group named `ASG-DB`.

A Network Security Group named `NSG-Web` is associated with `Subnet-Web` and contains the following custom inbound rule:
- Name: `DenyInternetInbound`, Priority: $1500$ , Source: `Internet`, Destination: `Any`, Port: `*`, Protocol: `Any`, Action: Deny

A Network Security Group named `NSG-DB` is associated with `Subnet-DB` and contains the following custom inbound rule:
- Name: `DenyVNetInbound`, Priority: $2000$ , Source: `VirtualNetwork`, Destination: `Any`, Port: `*`, Protocol: `Any`, Action: Deny

No Network Security Groups are associated with the virtual machine network interfaces.

You must configure the NSGs to meet the following requirements:
1. Allow HTTPS traffic (port $443$ ) from the Internet to `VM-Web1` only.
2. Allow PostgreSQL traffic (port $5432$ ) from `VM-Web1` to `VM-DB1` only.
3. Minimize the number of rules and adhere to the principle of least privilege.

Which two security rules should you create to meet the requirements?

Select all that apply

In `NSG-Web`, create an inbound rule with Priority

100

, Source: `Internet`, Destination: `ASG-Web`, Port:

443

, Action: Allow.

In `NSG-DB`, create an inbound rule with Priority

500

, Source: `ASG-Web`, Destination: `ASG-DB`, Port:

5432

, Action: Allow.

In `NSG-Web`, create an inbound rule with Priority

1800

, Source: `Internet`, Destination: `ASG-Web`, Port:

443

, Action: Allow.

In `NSG-DB`, create an inbound rule with Priority

2200

, Source: `ASG-Web`, Destination: `ASG-DB`, Port:

5432

, Action: Allow.

Show answer & explanation

Answer: In `NSG-Web`, create an inbound rule with Priority $100$ , Source: `Internet`, Destination: `ASG-Web`, Port: $443$ , Action: Allow.; In `NSG-DB`, create an inbound rule with Priority $500$ , Source: `ASG-Web`, Destination: `ASG-DB`, Port: $5432$ , Action: Allow.

Answer

To meet the requirements, you must create an inbound rule in `NSG-Web` to allow HTTPS traffic to `ASG-Web` on port

443

with a priority value lower than

1500

(such as

100

), and create an inbound rule in `NSG-DB` to allow PostgreSQL traffic from `ASG-Web` to `ASG-DB` on port

5432

with a priority value lower than

2000

(such as

500

To allow inbound HTTPS traffic from the Internet to `VM-Web1` (associated with `ASG-Web`), you must add a rule in `NSG-Web` with a priority lower than

1500

(e.g.,

100

) because the existing deny rule is at priority

1500

. Similarly, to allow inbound PostgreSQL traffic on port

5432

from `VM-Web1` (`ASG-Web`) to `VM-DB1` (`ASG-DB`), you must add a rule in `NSG-DB` with a priority lower than

2000

(e.g.,

500

) because the existing VNet deny rule is at priority

2000

Step-by-Step Solution

Analyze the traffic requirements and existing NSG rules for the web tier.

The web tier (`VM-Web1` in `Subnet-Web`) needs to receive inbound HTTPS traffic (port

443

) from the Internet. The existing `NSG-Web` has a custom deny rule with priority

1500

that blocks all inbound internet traffic.

To allow the required HTTPS traffic, a new allow rule must be created with a priority number less than

1500

Analyze the traffic requirements and existing NSG rules for the database tier.

The database tier (`VM-DB1` in `Subnet-DB`) needs to receive PostgreSQL traffic (port

5432

) from `VM-Web1`. The existing `NSG-DB` has a custom deny rule with priority

2000

that blocks all inbound VNet traffic.

To allow the PostgreSQL traffic, a new allow rule must be created with a priority number less than

2000

Determine the correct source and destination security tags for least privilege.

For the web tier, the destination should be limited to the `ASG-Web` group. For the database tier, the source should be `ASG-Web` and the destination should be `ASG-DB`.

Using Application Security Groups (ASGs) ensures that the rules apply specifically to the designated VMs rather than the entire subnet, fulfilling the least privilege requirement.

Key Concept

Application Security Groups (ASGs) allow you to configure network security as a natural extension of an application's structure, grouping virtual machines and defining network security policies based on those groups. Network Security Group (NSG) rules are evaluated by priority, where lower numbers have higher precedence and are processed first. To override a deny rule, the allow rule must have a lower priority number.

Question 916Question →

You plan to configure an Azure Application Gateway v2 to support end-to-end TLS encryption for a backend pool of web servers. The backend servers use self-signed certificates for their TLS configurations. You have already created the Application Gateway, the frontend public IP address, and the backend pool.

You need to complete the end-to-end TLS configuration so that the Application Gateway can securely receive traffic from clients and securely transmit it to the backend pool.

Which sequence of actions should you perform? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Export the public certificate (.cer) from the backend web servers, then create Backend Settings using the HTTPS protocol and upload the exported backend certificate, then create a custom HTTPS health probe and associate it with the HTTPS Backend Settings, then create an HTTPS listener and associate it with the frontend SSL certificate, and finally create a request routing rule that binds the HTTPS listener, the Backend Settings, and the backend pool.

The correct sequence starts by exporting the backend certificate so that it can be uploaded during the creation of the HTTPS Backend Settings to establish trust. Once the Backend Settings are created, a custom HTTPS health probe is associated with them. The HTTPS listener is then created to receive client-side TLS connections. Finally, the routing rule binds the listener, the Backend Settings, and the backend pool together.

Step-by-Step Solution

Export the public certificate from the backend servers.

You obtain the public key (.cer) file for the self-signed certificate used by the backend.

Azure Application Gateway v2 requires the public certificate of self-signed backends to be uploaded to establish backend trust.

Create the Backend Settings and upload the certificate.

Backend Settings are created with the HTTPS protocol on port 443, with the exported certificate configured as a Trusted Root Certificate.

This establishes trust between the Application Gateway and the backend pool servers.

Create and associate a custom HTTPS health probe.

A health probe is created using the HTTPS protocol and is linked to the newly created Backend Settings.

The gateway must use HTTPS to perform health probes to match the secure backend configuration.

Create an HTTPS listener.

A listener is configured with the frontend public IP, port 443, and the frontend SSL certificate.

This enables the Application Gateway to receive encrypted HTTPS traffic from public clients.

Create a request routing rule.

A routing rule is created that maps the HTTPS listener to the backend pool using the HTTPS Backend Settings.

The routing rule ties all the components together, defining the logical traffic flow.

Key Concept

Configuring end-to-end TLS on Azure Application Gateway v2 requires establishing trust by uploading the backend's public certificate to the Backend Settings, setting up a custom HTTPS health probe, configuring an HTTPS listener with a frontend certificate, and linking them via a routing rule.

Question 917Question →

You are deploying a multi-container group in Azure Container Instances (ACI) that includes a web application container and a log-forwarding sidecar container. The web application container must run continuously to handle user requests, and the sidecar container must also run continuously to read log files generated by the web application. Which of the following configuration settings must you apply to meet these requirements? (Select TWO)

Select all that apply

Set the restart policy of the container group to Always.

Define a shared volume and mount it to both containers.

Set the restart policy of the container group to Never.

Set the restart policy of the container group to OnFailure.

Assign a separate public IP address to each container in the container group.

Show answer & explanation

Answer: Set the restart policy of the container group to Always.; Define a shared volume and mount it to both containers.

Answer

Configure the container group restart policy to Always and mount a shared volume to both containers.

To support a multi-container scenario where both the web application and logging sidecar run continuously and share log files, you must configure the restart policy of the container group to Always and define a shared volume mounted to both containers. The Always policy ensures that if either container stops, it is automatically restarted. A shared volume allows the log-forwarding sidecar to access the directory where the web application writes its log files.

Step-by-Step Solution

Determine the required restart policy for continuous execution.

Identify that the restart policy must be set to Always.

Since both workloads (the web application and the log-forwarding sidecar) are expected to run continuously, setting the policy to Always ensures that ACI automatically restarts either container if it terminates.

Determine the mechanism for sharing files between containers in the same container group.

Define a shared volume (such as emptyDir) and mount it to both containers.

Containers in the same group share storage volumes. Mounting a shared volume allows the log-forwarding container to access the logs written by the web application container.

Evaluate and eliminate incorrect configuration options.

Eliminate restart policies of Never or OnFailure, and eliminate configurations that attempt to separate network spaces between containers in the same group.

Never and OnFailure do not guarantee that continuously running containers are restarted upon normal termination or exit. In addition, all containers in a container group share a single IP address and network namespace.

Key Concept

Azure Container Instances (ACI) multi-container groups share lifecycle, network, and storage. The restart policy is defined at the group level, and a shared volume is required to share files between containers in the group.

Question 918Question →

An Azure environment contains a hub virtual network named `VNet-Hub` ( $10.100.0.0/16$ ) and a spoke virtual network named `VNet-Spoke` ( $10.200.0.0/16$ ). The virtual networks are connected using virtual network peering.

`VNet-Hub` contains a network virtual appliance (NVA) named `NVA-FW` with a private IP address of $10.100.1.4$ .
`VNet-Spoke` contains two subnets:
- `WebSubnet` ( $10.200.1.0/24$ )
- `DbSubnet` ( $10.200.2.0/24$ )

A route table named `RT-Spoke` is associated with `WebSubnet`. The route table contains the following custom routes:

Route Name	Destination Prefix	Next Hop Type	Next Hop IP Address
Route-to-DB	$10.200.2.0/24$	Virtual appliance	$10.100.1.4$
Route-to-VNet	$10.200.0.0/16$	Virtual network	N/A

A virtual machine named `VM-Web` in `WebSubnet` ( $10.200.1.10$ ) attempts to establish a connection to a database server in `DbSubnet` ( $10.200.2.20$ ).

Which route is selected from `RT-Spoke`, and what configuration is required on `NVA-FW` to allow the traffic to reach the database server?

Route-to-DB is selected; IP forwarding must be enabled on the network interface of `NVA-FW`.

Route-to-VNet is selected; gateway transit must be enabled on the virtual network peering.

Route-to-DB is selected; the next hop type of Route-to-DB must be changed to Virtual network gateway.

The default system route for the subnet is selected; no additional configuration is required.

Show answer & explanation

Answer: Route-to-DB is selected; IP forwarding must be enabled on the network interface of `NVA-FW`.

Answer

Route-to-DB is selected; IP forwarding must be enabled on the network interface of `NVA-FW`.

The correct answer states that Route-to-DB is selected and IP forwarding must be enabled on the network interface of `NVA-FW`. This is correct because Route-to-DB (

10.200.2.0/24

) has the longest prefix match for the destination IP (

10.200.2.20

) compared to Route-to-VNet (

10.200.0.0/16

). Additionally, because the traffic is directed through a Network Virtual Appliance (NVA) that needs to forward packets to another destination, IP forwarding must be enabled on the NVA's NIC in Azure to prevent the platform from dropping the packets.

Step-by-Step Solution

Determine the destination IP address of the network traffic.

The destination IP address is

10.200.2.20

, which belongs to the `DbSubnet` (

10.200.2.0/24

Azure routing evaluates the target destination IP against the prefixes configured in the route table associated with the source subnet.

Apply the Longest Prefix Match (LPM) algorithm.

Prefixes

10.200.2.0/24

(length 24) and

10.200.0.0/16

(length 16) match the destination. The /24 prefix is the longest match.

When multiple routes match the destination, Azure prioritizes the route with the most specific prefix (the longest mask).

Compare custom UDR precedence against default system routes.

Route-to-DB is a user-defined route (UDR) matching the prefix

10.200.2.0/24

. It overrides the default system route for the virtual network.

When UDRs and system routes have the exact same prefix length, the UDR takes precedence and is selected.

Configure the virtual appliance network interface.

IP forwarding must be enabled on the virtual machine's network interface (NIC) in Azure.

By default, Azure VMs drop packets that are not addressed to their own IP. Because the NVA acts as a router forwarding packets to

10.200.2.20

, IP forwarding must be enabled to bypass this check.

Key Concept

Azure Route Selection Rules (Longest Prefix Match, UDR Precedence, and NVA IP Forwarding)

Question 919Question →

A company is migrating a dataset from an on-premises file share to an Azure storage account named stcopydestination. You have been tasked with performing the migration. The security team has configured stcopydestination to reject all shared key authentication requests. You authenticate to Azure via the command line using azcopy login. When you run the command to copy the files to a blob container, you receive an error indicating that the request is not authorized. Your user account currently has the Owner role for the subscription. How should you resolve the authorization issue?

Grant the Storage Blob Data Contributor role to your user account.

Grant the Reader role to your user account at the storage account level.

Generate an account-level Shared Access Signature (SAS) token with a short expiration period and append it to the destination container URL.

Enable the exception for trusted Microsoft services in the storage account firewalls and virtual networks settings.

Show answer & explanation

Answer: Grant the Storage Blob Data Contributor role to your user account.

Answer

Grant the Storage Blob Data Contributor role to your user account.

The correct answer is to grant the Storage Blob Data Contributor role to your user account. When a storage account is configured to reject shared key authentication, access via account keys and standard SAS tokens is disabled. Data operations must be authorized using Microsoft Entra ID. Because the subscription Owner role only provides control-plane access, it does not grant permissions to write blob data when using Entra ID. Therefore, the Storage Blob Data Contributor role must be explicitly assigned to the user's account to allow the AzCopy upload operation.

Step-by-Step Solution

Identify the authentication requirement imposed by the security configuration.

Since stcopydestination rejects shared key authentication, standard access keys and account/service SAS tokens cannot be used. The copy operation must rely on Microsoft Entra ID authorization.

Disabling shared key access enforces Entra ID-based authentication for all data plane operations.

Evaluate the current permissions of the user account.

The user has the Owner role for the subscription, which provides full control-plane administrative access but does not grant data-plane access when using Entra ID authorization.

Azure RBAC separates control-plane roles (like Owner and Contributor) from data-plane roles (like Storage Blob Data Contributor).

Determine the required role for data-plane write access.

Assign the Storage Blob Data Contributor role to the user account.

This role provides the necessary data-plane permissions to read, write, and delete Azure Storage blobs via Entra ID authorization.

Key Concept

Azure Storage separates control plane and data plane RBAC roles, and disabling Shared Key access requires the use of Microsoft Entra ID roles (such as Storage Blob Data Contributor) for data operations.

Question 920Question →

You are deploying a public Azure Load Balancer named LB1 to distribute HTTPS traffic to an application hosted on two virtual machines named VM1 and VM2. VM1 is located in Availability Zone 1, and VM2 is located in Availability Zone 2.

You need to configure LB1 to meet these requirements.

Which two of the following configuration steps should you perform? (Select two.)

Select all that apply

Deploy LB1 using the Standard SKU and configure a zone-redundant frontend public IP address.

Create a health probe that monitors TCP port 443 or HTTP/HTTPS status on the backend virtual machines.

Deploy LB1 using the Basic SKU and associate it with a zone-redundant public IP address.

Create a health probe using TCP port 0 to automatically detect and monitor all active TCP ports on the backend virtual machines.

Show answer & explanation

Answer: Deploy LB1 using the Standard SKU and configure a zone-redundant frontend public IP address.; Create a health probe that monitors TCP port 443 or HTTP/HTTPS status on the backend virtual machines.

Answer

Deploy the Load Balancer using the Standard SKU with a zone-redundant frontend public IP address, and configure a health probe to monitor TCP port 443 or HTTP/HTTPS status.

Deploying a Standard SKU load balancer with a zone-redundant frontend public IP address is required because the backend virtual machines reside in different Availability Zones. Additionally, configuring a health probe to monitor TCP port 443 or HTTP/HTTPS status is necessary to detect the availability of the application and ensure traffic is only sent to healthy backend instances.

Step-by-Step Solution

Determine SKU requirements for Availability Zones.

Identify that because VM1 and VM2 are in different Availability Zones, a Standard SKU Azure Load Balancer is required.

Basic SKU Load Balancers do not support Availability Zones.

Select the correct frontend IP configuration.

Choose a Standard SKU zone-redundant public IP address.

Standard SKU public IPs match the Standard Load Balancer SKU and support zone-redundancy.

Configure the health probe.

Define a health probe targeting a specific port (such as TCP port 443) and protocol suitable for HTTPS traffic.

A health probe is required to determine the status of backend instances, and it must target a specific port rather than a wildcard or port 0.

Key Concept

Standard Azure Load Balancer configuration requirements for Availability Zones and health probes.

PreviousPage 46 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept