All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An organization has a Microsoft Entra ID tenant. The tenant contains an administrative unit named NorthAmerica-AU. The NorthAmerica-AU administrative unit contains a security group named NA-Sales-Dynamic. The membership type of NA-Sales-Dynamic is Dynamic User, configured with the following rule:

(user.department -eq "Sales") -and (user.country -eq "United States")

An administrator named Admin1 is assigned the Groups Administrator role scoped to the NorthAmerica-AU administrative unit. Admin1 is tasked with updating the membership rule of NA-Sales-Dynamic to also include sales users from Canada. When Admin1 attempts to update and save the dynamic rule, the operation fails with an authorization error.

Which of the following is the reason why Admin1 is unable to modify the membership rule of the group?

Admin1 is assigned the Groups Administrator role at the administrative unit scope, but modifying dynamic group membership rules requires tenant-level administrator privileges.

The dynamic membership rule query syntax is invalid because Microsoft Entra ID does not support nested logical operations.

Admin1 must be assigned the User Administrator role scoped to NorthAmerica-AU to manage dynamic groups containing user accounts.

Admin1 must be assigned the Owner role on the Azure subscription associated with the tenant to modify directory-level dynamic configurations.

Show answer & explanation

Answer: Admin1 is assigned the Groups Administrator role at the administrative unit scope, but modifying dynamic group membership rules requires tenant-level administrator privileges.

Answer

Admin1 is assigned the Groups Administrator role at the administrative unit scope, but modifying dynamic group membership rules requires tenant-level administrator privileges.

Modifying dynamic group membership rules requires tenant-level administrative privileges (such as a tenant-scoped Groups Administrator or Global Administrator) because the rule evaluation engine runs tenant-wide and can affect users outside the administrative unit. A role scoped to an administrative unit does not grant permissions to edit dynamic rules.

Step-by-Step Solution

Analyze the current role assignment of the administrator.

Admin1 holds the Groups Administrator role scoped specifically to the NorthAmerica-AU administrative unit.

This establishes the scope boundary of the administrator's permissions.

Identify the operation being performed.

Admin1 is trying to update a dynamic membership rule for a dynamic user security group.

Dynamic groups evaluate their queries across all objects in the tenant to determine membership.

Compare the operation requirements with the scope of the administrative unit role.

Because dynamic group rules evaluate tenant-wide, modifying their configuration is restricted to tenant-level roles (such as tenant-scoped Groups Administrator or Global Administrator).

An administrative unit-scoped role assignment is insufficient to perform changes that have tenant-wide evaluation scope.

Key Concept

Microsoft Entra ID role scoping and dynamic group management constraints

Question 82Question →

Your company has an Azure environment with the following hierarchy:

* Management Group: MG-Compliance
* Subscription: Sub-Audit
* Resource Group: RG-Security
* Key Vault: kv-secrets

User1 is assigned the Contributor role at the MG-Compliance scope.
User2 is assigned the Reader role at the Sub-Audit scope.

Which two statements correctly describe the inherited permissions of User1 and User2 on kv-secrets? (Select two.)

Select all that apply

User1 inherits Contributor permissions on kv-secrets because role assignments at a parent management group scope inherit down to all child scopes.

User2 inherits Reader permissions on kv-secrets because role assignments at the subscription scope inherit down to all child resource groups and resources.

User1 has no permissions on kv-secrets because role assignments at the management group level do not inherit to resources inside a resource group.

User2 is automatically granted Owner permissions on kv-secrets if User2 is also a Global Administrator in Microsoft Entra ID.

Show answer & explanation

Answer: User1 inherits Contributor permissions on kv-secrets because role assignments at a parent management group scope inherit down to all child scopes.; User2 inherits Reader permissions on kv-secrets because role assignments at the subscription scope inherit down to all child resource groups and resources.

Answer

User1 inherits Contributor permissions on kv-secrets due to downward inheritance from the management group scope, and User2 inherits Reader permissions on kv-secrets due to inheritance from the subscription scope.

The correct statements are that the Contributor role assigned to the first user at the management group scope inherits all the way down to the Key Vault, and the Reader role assigned to the second user at the subscription scope also inherits down to the Key Vault. This is because Azure RBAC uses a strict hierarchical inheritance model where permissions propagate downward from parent scopes to child resources.

Step-by-Step Solution

Analyze the resource hierarchy and the scope of each role assignment.

User1 has Contributor assigned at the MG-Compliance management group level. User2 has Reader assigned at the Sub-Audit subscription level. The Key Vault kv-secrets resides within resource group RG-Security, which is inside Sub-Audit, which is inside MG-Compliance.

Understanding the containment relationship in the Azure resource hierarchy is essential for evaluating RBAC inheritance.

Apply Azure RBAC inheritance rules downward through the scope hierarchy.

The Contributor role assigned at the management group scope inherits down to the subscription, resource group, and finally the Key Vault resource. The Reader role assigned at the subscription scope inherits down to the resource group and the Key Vault resource.

Azure RBAC roles are inherited by child resources from their parent scopes, unless blocked or overridden by more specific roles or Deny assignments.

Determine the effective permissions for User1 and User2 on kv-secrets and rule out incorrect directory-level assumptions.

User1 holds effective Contributor permissions, and User2 holds effective Reader permissions. Entra ID Global Administrator roles do not automatically elevate permissions to Azure resources.

Inherited permissions are applied additively. Microsoft Entra ID directory administration roles do not directly grant data plane or control plane permissions on subscriptions without explicit assignment or directory settings configuration.

Key Concept

Azure RBAC inheritance and scope hierarchy

Question 83Question →

Your company has a Microsoft Entra ID tenant that contains the following resources:

* User1: A cloud-only user account.
* User2: A user account synchronized from an on-premises Active Directory Domain Services (AD DS) domain.
* Group1: A security group with the `isAssignableToRole` property set to `true`.
* Group2: A dynamic security group with the membership rule: `(user.department -eq "Sales") -and (user.userType -eq "Member")`.
* AU1: An Administrative Unit. User1, User2, and Group1 are members of AU1.

The following administrative roles are assigned:

* Admin1: Assigned the User Administrator role scoped to AU1.
* Admin2: Assigned the Groups Administrator role scoped to AU1.

Which two statements are correct? Select two.

Select all that apply

User2 is automatically added to Group2 when User2's department attribute is synchronized to Microsoft Entra ID as 'Sales' and its UserType is 'Member'.

Admin1 can reset the password of User1, but cannot reset the password of User2.

Admin2 can add User1 as a member of Group1.

Admin2 can change the membership type of Group1 to Dynamic User.

Show answer & explanation

Answer: User2 is automatically added to Group2 when User2's department attribute is synchronized to Microsoft Entra ID as 'Sales' and its UserType is 'Member'.; Admin1 can reset the password of User1, but cannot reset the password of User2.

Answer

User2 is automatically added to Group2 when its department and UserType attributes are synchronized to Microsoft Entra ID, and Admin1 can reset the password of User1 but not User2.

The correct statements are that the synchronized user will be automatically added to the dynamic group once their synchronized attributes match the OData rule, and that the Administrative Unit-scoped User Administrator can reset the password of the cloud-only user but not the synchronized user. Dynamic groups evaluate all tenant users, including synchronized ones. Password administration for synchronized users cannot be performed by delegated cloud administrators since the source of authority is on-premises.

Step-by-Step Solution

Evaluate Group1 properties and the role required to modify it.

Group1 has isAssignableToRole set to true, making it a role-assignable group. Only Global Administrators, Privileged Role Administrators, or group owners can modify its membership or settings.

This determines if Admin2 can manage Group1's membership or membership type.

Evaluate the password reset permissions for Admin1.

Admin1 is a User Administrator scoped to AU1. User1 is a cloud-only user in AU1 and can be managed. User2 is a synchronized user whose password authority is managed on-premises, meaning Admin1 cannot reset User2's password in Entra ID.

This verifies whether Admin1 can reset passwords for the specified users.

Evaluate dynamic group evaluation for Group2.

Group2 is a tenant-wide dynamic group. Any user in the tenant, whether cloud-only or synchronized, will be added if they match the rule (department is 'Sales' and userType is 'Member').

This determines if User2 will be added to Group2.

Key Concept

Delegated administration using Administrative Units and security constraints on role-assignable groups.

Question 84Question →

An organization requires a new Microsoft Entra ID group to support automatic membership updates whenever a user's office location or job title attribute is modified.

Which membership type should be selected during group creation to meet this requirement?

Assigned

Dynamic User

Dynamic Device

Administrative Unit

Show answer & explanation

Answer: Dynamic User

Answer

Dynamic User

Selecting the Dynamic User membership type allows the administrator to define rules based on user attributes (such as office location or job title) to automatically add or remove users from the group.

Step-by-Step Solution

Analyze the requirement for automatic membership updates based on user attributes.

Determine that manual group assignment is not suitable and that a rule-based membership type is needed.

Manually assigning members does not scale and cannot react automatically to changes in user profile attributes.

Compare the rule-based membership options (Dynamic User and Dynamic Device) against the attribute requirements.

Identify that the requirements specify user attributes (office location and job title), which dictates using the Dynamic User membership type.

Dynamic Device groups evaluate device attributes, whereas Dynamic User groups evaluate user attributes to determine group membership.

Key Concept

Microsoft Entra ID group membership types

Question 85Question →

An organization's Azure environment is structured with the following resource hierarchy:
- Management Group: `MG-Corporate`
- Subscription: `Sub-Corp-Prod`
- Resource Group: `RG-Analytics`
- Storage Account: `saanalytics`
- Key Vault: `kv-analytics`

A user named `User1` is assigned the Microsoft Entra ID `Global Administrator` role. `User1` is also assigned the following Azure role-based access control (RBAC) roles:
- The `Reader` role at the `MG-Corporate` management group scope.
- The `Storage Blob Data Reader` role at the `RG-Analytics` resource group scope.

`User1` does not elevate access in the Microsoft Entra admin center, and no other changes are made to the directory.

Which two actions can `User1` perform on the resources within the `RG-Analytics` resource group? (Select two.)

Select all that apply

Download files from a blob container inside the storage account `saanalytics`

View the configuration properties of the Key Vault `kv-analytics` in the Azure portal

Assign the Contributor role to another user for the Key Vault `kv-analytics`

Retrieve the secrets stored inside the Key Vault `kv-analytics`

Show answer & explanation

Answer: Download files from a blob container inside the storage account `saanalytics`; View the configuration properties of the Key Vault `kv-analytics` in the Azure portal

Answer

The user can download files from a data container inside the storage account and view the configuration properties of the Key Vault in the Azure portal.

The user can perform the action to download files from a blob container inside the storage account because they are assigned the Storage Blob Data Reader role at the resource group level, which inherits down to the storage account and provides data plane read access. Additionally, the user can view the configuration properties of the Key Vault because they are assigned the Reader role at the management group level, which inherits down to the Key Vault and grants control plane read access.

Step-by-Step Solution

Determine control plane permissions from the management group assignment.

The user has Reader access inherited from the management group level down to the resource group and its child resources.

Azure RBAC assignments at higher scopes (such as management groups) are inherited down to all child scopes (subscriptions, resource groups, and resources).

Determine data plane permissions from the resource group assignment.

The user has Storage Blob Data Reader access inherited down to the storage account.

Assigning Storage Blob Data Reader at the resource group scope allows the user to read blobs from any storage account within that resource group due to inheritance.

Evaluate the effect of the Global Administrator role.

No subscription resource permissions are granted automatically by the Global Administrator role.

Microsoft Entra ID roles (such as Global Administrator) and Azure RBAC roles are separate. A Global Administrator must explicitly elevate their access to gain the User Access Administrator role at the root scope before managing subscription resources.

Compare the evaluated permissions against the proposed actions.

Viewing Key Vault configuration is allowed by Reader. Downloading blobs is allowed by Storage Blob Data Reader. Retrieving Key Vault secrets is blocked because Reader does not grant Key Vault data plane access. Managing role assignments is blocked because Global Administrator lacks resource permissions without elevation.

Aligning inherited permissions with each action reveals that only configuration viewing and blob downloading are permitted.

Key Concept

Azure RBAC inheritance and the boundary between Microsoft Entra ID administrator roles and Azure RBAC roles.

Estimated Time:2m 0s

Question 86Question →

You manage a standard General Purpose v2 (GPv2) storage account named `storagedata2026` in the East US region. The storage account currently uses Locally Redundant Storage (LRS).

You need to configure the storage account to meet the following requirements:
- Replicate the blobs to a secondary paired region.
- Automatically transition blobs to the Archive access tier 180 days after creation.

Which of the following configurations should you perform to meet these requirements? (Select TWO.)

Select all that apply

Change the replication setting of the storage account from Locally Redundant Storage (LRS) to Geo-redundant storage (GRS) directly from the configuration blade in the Azure portal.

Create a lifecycle management rule that targets base blobs and transitions them to the Archive tier 180 days after creation.

Change the replication setting of the storage account from Locally Redundant Storage (LRS) to Geo-zone-redundant storage (GZRS) directly from the configuration blade in the Azure portal.

Assign the Azure Role-Based Access Control (RBAC) Reader role at the storage account scope to grant the administrator access to read and download the blob contents.

Show answer & explanation

Answer: Change the replication setting of the storage account from Locally Redundant Storage (LRS) to Geo-redundant storage (GRS) directly from the configuration blade in the Azure portal.; Create a lifecycle management rule that targets base blobs and transitions them to the Archive tier 180 days after creation.

Answer

To meet the requirements, you should change the replication setting of the storage account from Locally Redundant Storage (LRS) to Geo-redundant storage (GRS) directly in the Azure portal, and create a lifecycle management rule that targets base blobs to transition them to the Archive tier 180 days after creation.

The correct options involve configuring replication by directly switching from Locally Redundant Storage (LRS) to Geo-redundant storage (GRS), which is a supported path in Azure, and defining a lifecycle management rule targeting base blobs to transition them to the Archive tier after 180 days.

Step-by-Step Solution

Configure storage replication.

Change the replication setting from Locally Redundant Storage (LRS) to Geo-redundant storage (GRS) in the storage account configuration blade.

This replicates data to the secondary paired region and is a supported direct conversion path.

Create a lifecycle management policy.

Add a rule in the Lifecycle Management blade of the storage account, targeting base blobs, with the action to transition to Archive tier after 180 days.

This automates the transition of blobs to the Archive tier to minimize storage costs after 180 days of creation.

Key Concept

Azure Blob storage lifecycle management rules and replication conversion paths

Question 87Question →

An organization manages an Azure tenant with the following resource hierarchy:
- Management Group: `MG-Healthcare`
- Subscription: `Sub-Clinical-Data`
- Resource Group: `RG-Patients`
- Storage Account: `sapatientrecords2026`
- Resource Group: `RG-Shared-Services`
- Virtual Machine: `VM-Gateway`

A user named `User-Auditor` is assigned the Global Administrator directory role in Microsoft Entra ID. No access elevation has been performed for this account. Additionally, `User-Auditor` is assigned the following Azure RBAC roles:
- The Reader role at the `MG-Healthcare` management group scope.
- The Virtual Machine Contributor role at the `RG-Shared-Services` resource group scope.

Which two of the following actions can `User-Auditor` perform? (Select two.)

Select all that apply

View the configuration settings and properties of the sapatientrecords2026 storage account.

Restart the VM-Gateway virtual machine.

Assign the Reader role to another user at the Sub-Clinical-Data subscription level.

Read blob data stored in containers within the sapatientrecords2026 storage account.

Show answer & explanation

Answer: View the configuration settings and properties of the sapatientrecords2026 storage account.; Restart the VM-Gateway virtual machine.

Answer

The user can view the configuration properties of the storage account (due to the Reader role inherited from the management group) and restart the virtual machine (due to the Virtual Machine Contributor role assigned at the resource group).

Viewing the configuration properties of the storage account and restarting the virtual machine are possible because of role inheritance. The Reader role at the management group level inherits down to the storage account, allowing control-plane read access. The Virtual Machine Contributor role at the resource group level inherits down to the virtual machine, allowing actions such as restarting the VM.

Step-by-Step Solution

Analyze the management group Reader role scope.

The Reader role is assigned at MG-Healthcare. Due to inheritance, this grants read-only access to all resources in Sub-Clinical-Data, RG-Patients (including the storage account), and RG-Shared-Services (including the VM).

Azure RBAC assignments at a higher scope inherit down to all child scopes.

Analyze the resource group Virtual Machine Contributor role scope.

The Virtual Machine Contributor role is assigned at RG-Shared-Services. It inherits to VM-Gateway and permits VM management actions, such as restarting the VM.

Azure RBAC assignments inherit from the resource group level to resources within that group.

Evaluate the Global Administrator role capabilities.

The Global Administrator role is a directory role and does not grant permissions to Azure resources without access elevation.

Microsoft Entra ID and Azure RBAC have distinct authorization planes.

Evaluate data plane access to the storage account.

The Reader role only grants control plane access. It does not allow reading the actual blob contents inside the storage account.

Azure storage separates control plane operations from data plane operations.

Key Concept

Azure RBAC roles are applied at a specific scope (Management Group, Subscription, Resource Group, or Resource) and inherit down the hierarchy. Additionally, Microsoft Entra ID roles are separated from Azure RBAC resource roles, and control plane permissions do not grant data plane access by default.

Question 88Question →

An administrator is configuring a client application to read data from the secondary region of an Azure Storage account named `mediafiles` during a read-only test. The storage account replication is configured as Read-Access Geo-Redundant Storage (RA-GRS).

Which endpoint should the application use to directly access the blob storage service in the secondary region?

mediafiles-secondary.blob.core.windows.net

mediafiles.blob.core.windows.net/secondary

mediafiles.secondary.blob.core.windows.net

mediafiles-secondary.secondary.blob.core.windows.net

Show answer & explanation

Answer: mediafiles-secondary.blob.core.windows.net

Answer

mediafiles-secondary.blob.core.windows.net

The correct endpoint format for accessing the secondary region of an RA-GRS storage account is constructed by appending '-secondary' to the storage account name (e.g., 'mediafiles-secondary.blob.core.windows.net'). This allows applications to read blob data directly from the secondary replica.

Step-by-Step Solution

Identify the replication configuration of the storage account.

The storage account 'mediafiles' is configured with Read-Access Geo-Redundant Storage (RA-GRS), which provides read-only access to the secondary region.

Understanding the replication type confirms that a dedicated secondary endpoint is available for read access.

Determine the naming convention Azure uses for secondary endpoints.

Azure constructs the secondary endpoint by appending '-secondary' directly to the storage account name.

This convention differentiates the secondary read-only service endpoint from the primary service endpoint.

Construct the full blob service URL using the convention.

The primary endpoint is 'mediafiles.blob.core.windows.net', so the secondary endpoint is 'mediafiles-secondary.blob.core.windows.net'.

This provides client applications with the correct URI to send GET requests to the secondary region.

Key Concept

Read-access geo-redundant storage (RA-GRS) secondary endpoint structure

Question 89Question →

An administrator restricts network access to an Azure Storage account named `sareports` by enabling access only from selected virtual networks. Following this change, Azure Backup jobs for the storage account's file shares fail with network connection errors. Which setting must the administrator configure on the storage account firewall to allow the backup operations to succeed?

Enable the exception that allows trusted Microsoft services to access the storage account.

Assign the Storage Blob Data Contributor role to the Azure Backup service instance.

Add the public IP addresses of the regional Azure Backup service to the storage firewall allowed ranges.

Disable public network access entirely and configure a private endpoint for the Azure Backup service.

Show answer & explanation

Answer: Enable the exception that allows trusted Microsoft services to access the storage account.

Answer

Enable the exception that allows trusted Microsoft services to access the storage account.

The correct setting is to enable the exception that allows trusted Microsoft services to access the storage account. When a storage account firewall is configured to restrict access to selected virtual networks, it blocks traffic from outside those networks, including other Azure services. The 'Allow trusted Microsoft services' checkbox acts as a secure bypass, enabling services like Azure Backup to interact with the storage account.

Step-by-Step Solution

Analyze the cause of the backup failure.

The failure occurs because restricting the storage account network access blocks all external traffic, including internal Azure services.

Firewalls block all communication by default when set to allow access only from selected virtual networks.

Apply the correct firewall bypass settings.

Enabling the 'Allow trusted Microsoft services' setting allows Azure Backup to reach the storage account.

This built-in exception allows Microsoft services to securely bypass network restrictions for administrative and operational tasks.

Key Concept

Azure Storage Firewall Exceptions

Estimated Time:45s

Question 90Question →

An administrator needs to create a new Microsoft Entra ID group that will be assigned directly to the built-in Helpdesk Administrator role. Which of the following settings must be configured during the creation of this group? (Select TWO.)

Select all that apply

Set the 'Microsoft Entra roles can be assigned to the group' property to Yes.

Set the Membership type to Assigned.

Set the Membership type to Dynamic User.

Assign an Azure RBAC Owner role to the group at the subscription level to authorize directory role assignment.

Assign the group to an Administrative Unit to grant the group members access to manage Azure virtual machines.

Show answer & explanation

Answer: Set the 'Microsoft Entra roles can be assigned to the group' property to Yes.; Set the Membership type to Assigned.

Answer

To assign a Microsoft Entra ID role directly to a group, the group must have its 'Microsoft Entra roles can be assigned to the group' property set to 'Yes' at the time of creation, and its membership type must be set to 'Assigned'.

The correct configurations are setting 'Microsoft Entra roles can be assigned to the group' to Yes and configuring the membership type to Assigned. Security groups that can be assigned directly to Microsoft Entra ID roles must have the role-assignable setting enabled during group creation (as this cannot be enabled post-creation) and must have their membership statically managed via the Assigned membership type.

Step-by-Step Solution

Identify the type of group and setting required for assigning built-in Microsoft Entra ID roles.

A security group must be created with the 'Microsoft Entra roles can be assigned to the group' property set to Yes.

This property enables the group to be assigned directly to directory-level administrative roles.

Determine the membership type requirements for role-assignable groups.

The membership type must be set to Assigned.

Microsoft Entra ID does not support dynamic groups (Dynamic User or Dynamic Device) for role-assignable groups to ensure access control stability and prevent unauthorized privilege escalation.

Key Concept

Role-assignable groups in Microsoft Entra ID must have the 'isAssignableToRole' property enabled at creation and must use the 'Assigned' membership type.

Question 91Question →

You manage an Azure Storage account named sa-prod-data that contains business-critical blob containers. You need to configure network security for sa-prod-data to meet the following requirements:
- Only virtual machines deployed in a subnet named Subnet-App within a virtual network named VNet-Core must be allowed network access to the storage account.
- Azure Backup must be able to back up the blob containers in the storage account.
- All other public internet access to the storage account must be blocked.

Which two configurations must you apply? (Select TWO).

Select all that apply

Enable the Microsoft.Storage service endpoint on Subnet-App and add a virtual network rule for Subnet-App in the network settings of sa-prod-data.

Configure the firewalls and virtual networks settings of sa-prod-data to allow access from selected networks and enable the exception for trusted Microsoft services.

Assign the Storage Blob Data Contributor role to the Subnet-App Network Security Group (NSG) and allow outbound traffic to sa-prod-data.

Disable the exception to allow trusted Microsoft services and add the public IP addresses of the Azure Backup service endpoints to the firewall rules of sa-prod-data.

Show answer & explanation

Answer: Enable the Microsoft.Storage service endpoint on Subnet-App and add a virtual network rule for Subnet-App in the network settings of sa-prod-data.; Configure the firewalls and virtual networks settings of sa-prod-data to allow access from selected networks and enable the exception for trusted Microsoft services.

Answer

Enable the Microsoft.Storage service endpoint on the subnet, add a corresponding virtual network rule to the storage account firewall, and configure the storage account to restrict public access to selected networks while allowing the trusted Microsoft services bypass exception.

To secure the storage account, you must restrict public access by setting the firewall to allow access only from selected networks. To permit the virtual machines on the specific subnet, you must enable the Microsoft.Storage service endpoint on that subnet and add a virtual network rule targeting it in the storage account firewall. Additionally, because Azure Backup is an external trusted Microsoft service that operates outside the virtual network, you must check the box to allow trusted Microsoft services to bypass the firewall so that backups can succeed.

Step-by-Step Solution

Enable the Microsoft.Storage service endpoint on Subnet-App within VNet-Core.

This configures the virtual network subnet to route all traffic bound for Azure Storage through the Microsoft backbone network rather than the public internet.

Azure Storage firewall virtual network rules require the source subnet to have the Microsoft.Storage service endpoint enabled.

Add a virtual network rule for Subnet-App in the firewalls and virtual networks settings of the storage account sa-prod-data.

The storage account firewall is configured to recognize and allow network traffic originating from Subnet-App.

This establishes the network-level boundary that permits traffic from the authorized subnet.

Configure the storage account firewall default action to 'Enabled from selected virtual networks and IP addresses' and enable the exception for trusted Microsoft services.

All public internet access is blocked except for traffic from Subnet-App and connections from Azure Backup.

This blocks unauthorized public access while allowing Azure Backup (a trusted service) to bypass the firewall and perform its backup tasks.

Key Concept

Configuring Azure Storage firewalls, enabling virtual network service endpoints, and configuring the trusted Microsoft services bypass exception to secure access.

Estimated Time:2m 0s

Question 92Question →

In Microsoft Entra ID, you configure a new dynamic group. Statement: A single dynamic group can contain a dynamic membership rule that evaluates both user attributes and device attributes to include both users and devices in the same group. Is this statement true?

True

False

Show answer & explanation

Answer: False

Answer

The statement is false because a dynamic group in Microsoft Entra ID can only contain either user objects or device objects, not both.

The correct answer is false because Microsoft Entra ID requires you to choose a specific membership type (Dynamic User or Dynamic Device) when configuring dynamic membership. This selection limits the membership rule to evaluating only attributes of that specific object type (users or devices), preventing a single dynamic group from containing both types of objects.

Step-by-Step Solution

Identify the membership types available for Microsoft Entra ID groups.

Groups can be configured as Assigned, Dynamic User, or Dynamic Device.

This establishes the core limitation of dynamic group types in Microsoft Entra ID.

Determine if a single dynamic group can evaluate both user and device attributes simultaneously.

A group configured as Dynamic User can only query user attributes, and a group configured as Dynamic Device can only query device attributes.

Entra ID does not support hybrid dynamic groups containing both user and device objects.

Key Concept

Microsoft Entra ID Dynamic Group Membership Types

Estimated Time:45s

Question 93Question →

Your company has a Microsoft Customer Agreement (MCA) billing account. The account includes a billing profile named BP-Finance. A subscription named Sub-Finance is linked to BP-Finance. You configure a budget for the BP-Finance billing profile scope to monitor monthly expenditures. You need to automate the deallocation of non-production virtual machines in Sub-Finance when the budget exceeds $80\%$ .

Is the following statement true or false?

You can configure an Azure Monitor action group directly on the BP-Finance billing profile budget to execute the deallocation runbook.

True

False

Show answer & explanation

Answer: False

Answer

False

The correct answer is False because budgets configured at billing scopes (Billing Accounts, Billing Profiles, and Invoice Sections) do not support Azure Monitor action groups. Action groups, which are required to run automated runbooks or webhooks, can only be attached to budgets created at subscription or resource group scopes.

Step-by-Step Solution

Analyze the budget scope requested in the scenario.

The budget is configured at the billing profile scope (BP-Finance), which is a billing scope rather than a resource scope.

Billing scopes are used for invoicing and billing management, whereas subscriptions and resource groups are resource deployment scopes.

Evaluate the capabilities of budgets at billing scopes.

Budgets at billing scopes (Billing Account, Billing Profile, Invoice Section) only support email-based notifications.

Azure Monitor action groups require a resource-level context (like a subscription or resource group) to execute actions like Runbooks, Logic Apps, or Webhooks, which is not available directly at billing scopes.

Determine the truth value of the statement.

The statement is false because you cannot directly associate an Azure Monitor action group with a billing profile budget.

To achieve automated remediation, the budget would need to be created at the subscription or resource group scope, or an external automation process must poll the billing profile budget alerts.

Key Concept

Azure Cost Management budget scopes and action group support limitations

Estimated Time:1m 30s

Question 94Question →

ValoTech Solutions is planning to deploy a multi-tier application in the UK South region. The architecture has the following requirements:
- The web tier consists of two virtual machines: VM-Web1 and VM-Web2. This tier must be protected against datacenter-wide failures and requires a virtual machine uptime SLA of $99.99\%$ .
- The database tier consists of two virtual machines: VM-DB1 and VM-DB2. This tier must be protected from localized hardware failures within a single datacenter while maintaining the lowest possible network latency between the two database instances.
- You must minimize overall deployment cost and complexity.

Which two actions should you perform to meet the high availability and SLA requirements? (Select two.)

Select all that apply

Deploy VM-Web1 in Availability Zone 1 and VM-Web2 in Availability Zone 2.

Deploy VM-DB1 and VM-DB2 in a single Availability Set.

Deploy VM-Web1 and VM-Web2 in a single Availability Set.

Create a single Availability Set that spans across Availability Zone 1 and Availability Zone 2, and deploy VM-Web1 and VM-Web2 to it.

Deploy VM-DB1 in Availability Zone 1 and VM-DB2 in Availability Zone 2, and associate both VMs with a Proximity Placement Group.

Show answer & explanation

Answer: Deploy VM-Web1 in Availability Zone 1 and VM-Web2 in Availability Zone 2.; Deploy VM-DB1 and VM-DB2 in a single Availability Set.

Answer

Deploying the web tier VMs across different Availability Zones (Availability Zone 1 and Availability Zone 2) and deploying the database VMs in a single Availability Set.

To meet the

99.99\%

SLA and protect against datacenter-wide failures, the web tier VMs (VM-Web1 and VM-Web2) must be deployed across two or more Availability Zones in the same region. To protect the database tier VMs (VM-DB1 and VM-DB2) from localized hardware failures while ensuring the lowest possible latency, they should be deployed in a single Availability Set within the same datacenter/zone, which leverages fault and update domains without introducing cross-zone network latency.

Step-by-Step Solution

Analyze the web tier requirements for high availability and SLA.

The web tier requires protection against datacenter-wide failures and a

99.99\%

uptime SLA.

Azure offers a

99.99\%

SLA for VMs only when two or more instances are deployed across two or more Availability Zones in the same region.

Determine the deployment strategy for the web tier VMs.

VM-Web1 should be deployed in Availability Zone 1 and VM-Web2 in Availability Zone 2.

This configuration ensures zone redundancy and satisfies the

99.99\%

SLA requirement.

Analyze the database tier requirements for high availability and latency.

The database tier requires protection from localized hardware failures (racks, power, network switches) while maintaining the lowest possible network latency.

Deploying VMs across different zones increases latency because of the physical distance between datacenters. Deploying them within the same datacenter/zone avoids cross-zone latency.

Determine the deployment strategy for the database tier VMs.

Deploy VM-DB1 and VM-DB2 in a single Availability Set.

An Availability Set distributes the VMs across multiple fault domains and update domains within a single datacenter/zone, protecting against hardware failures while keeping them close to ensure minimal network latency.

Key Concept

Azure Virtual Machine High Availability options including Availability Zones (offering

99.99\%

SLA and datacenter-wide fault tolerance) and Availability Sets (offering

99.95\%

SLA and localized rack-level fault tolerance).

Question 95Question →

NovaSpace Aerospace uses Azure Management Groups to govern its subscription environment. The hierarchy and access controls are configured as follows:

* Tenant Root Group
* Engineering MG
* Aviation-Prod Subscription
* RG-Aviation (Resource Group)
* Space-Prod Subscription
* Research MG
* R&D-Test Subscription

The environment has the following configurations:
* User1 is assigned the Reader role at the Tenant Root Group.
* User2 is assigned the Contributor role at the Engineering MG.
* An Azure Policy definition that restricts allowed virtual machine SKUs is assigned at the Engineering MG.
* A CanNotDelete resource lock is applied to the RG-Aviation resource group.

An administrator moves the Aviation-Prod Subscription from the Engineering MG to the Research MG.

Which two statements describe the results of this administrative action?

Select all that apply

User2 no longer has the Contributor role for resources in the Aviation-Prod Subscription.

The virtual machine SKU restriction policy assigned at the Engineering MG stops applying to the Aviation-Prod Subscription.

User1 loses the Reader role for resources in the Aviation-Prod Subscription.

The CanNotDelete resource lock on the RG-Aviation resource group is automatically removed.

The virtual machine SKU restriction policy continues to block non-compliant virtual machines in the Aviation-Prod Subscription.

Show answer & explanation

Answer: User2 no longer has the Contributor role for resources in the Aviation-Prod Subscription.; The virtual machine SKU restriction policy assigned at the Engineering MG stops applying to the Aviation-Prod Subscription.

Answer

The correct answers state that User2 no longer has the Contributor role for resources in the Aviation-Prod Subscription, and the virtual machine SKU restriction policy assigned at the Engineering MG stops applying to the Aviation-Prod Subscription.

When a subscription is moved between management groups, it inherits the policy and access control (RBAC) designs of its new parent management group and loses those of its former parent. Since User2's Contributor permission and the virtual machine SKU restriction policy were inherited from the Engineering Management Group, moving the subscription to the Research Management Group removes both. Direct configurations on the subscription or its child resources (such as resource locks on resource groups) and inheritance from higher levels that remain in the hierarchy path (like the Tenant Root Group) are unaffected.

Step-by-Step Solution

Determine the impact of the subscription move on inherited RBAC roles.

User1's role is inherited from the Tenant Root Group, which remains a parent, so it persists. User2's role is inherited from the Engineering MG, which is no longer a parent, so it is removed.

To identify which permissions are lost or retained based on management group scope boundaries.

Determine the impact of the subscription move on inherited Azure Policy assignments.

The policy restricting virtual machine SKUs was assigned at the Engineering MG. Since the subscription is moved to the Research MG, it stops inheriting the policy.

To determine which policies apply dynamically at the subscription's new location in the hierarchy.

Determine the impact of the subscription move on resource locks inside the subscription.

The CanNotDelete lock is applied directly to the RG-Aviation resource group and is not inherited from a management group, so it remains intact.

To verify whether resources inside the subscription maintain their local settings after a parent migration.

Key Concept

Azure Management Groups hierarchy governs policy and RBAC inheritance; moving a subscription changes its inherited configurations but preserves direct resources configurations such as resource locks.

Question 96Question →

A healthcare startup, CarePulse, plans to deploy two virtual machines named VM-App1 and VM-App2 to run a clinical application in the West US 3 region. The application requires protection against datacenter-wide failures with the highest possible service level agreement (SLA) for virtual machine uptime. Which high availability option should you select to meet this requirement?

Availability Sets

Availability Zones

A single Availability Set configured to span three separate Availability Zones

A Proximity Placement Group

Show answer & explanation

Answer: Availability Zones

Answer

Availability Zones

Deploying virtual machines across Availability Zones protects workloads against entire datacenter outages by placing the resources in physically separate facilities within the region, which also yields the highest VM uptime SLA.

Step-by-Step Solution

Analyze the core high availability requirement.

The application requires protection against datacenter-wide failures with the highest VM uptime SLA.

Understanding the failure domain requirements helps determine the appropriate high availability technology in Azure.

Compare Availability Zones and Availability Sets.

Availability Zones place VMs in physically separate datacenters within a region, protecting against datacenter-wide outages. Availability Sets only protect against hardware and maintenance failures within a single datacenter.

Evaluating how each option manages failure domains ensures that the solution meets the requirement.

Select the correct deployment option.

Availability Zones are selected as they meet the protection scope and offer the highest VM uptime SLA.

Deploying the VMs across separate Availability Zones satisfies the design requirements.

Key Concept

Azure Virtual Machine High Availability options including Availability Sets and Availability Zones.

Question 97Question →

Your company has an on-premises datacenter with a slow internet connection. You need to import $12\text{ TB}$ of data from a local Windows file server to an Azure storage account named `mystorageacct`. You decide to use the Azure Import/Export service. You attach three empty, supported $4\text{ TB}$ SATA hard drives to a local system and plan to use the WAImportExport tool to prepare the drives. Which of the following is a requirement to successfully complete the drive preparation and create the import job?

You must run the WAImportExport tool to copy the data and encrypt the drives using BitLocker, then upload the resulting journal (.jrn) files when creating the import job in the Azure portal.

You must temporarily disable the firewall on mystorageacct so the WAImportExport tool can establish a secure HTTPS connection and stream the copy metadata to the storage account during preparation.

You must assign the Microsoft Entra ID role of Storage Blob Data Reader to the WAImportExport tool service principal to authorize the local BitLocker encryption process.

You must generate a Shared Access Signature (SAS) token with an expiration window of at least one year and save it to the root of each drive to allow the Azure datacenter to decrypt the drives.

Show answer & explanation

Answer: You must run the WAImportExport tool to copy the data and encrypt the drives using BitLocker, then upload the resulting journal (.jrn) files when creating the import job in the Azure portal.

Answer

You must run the WAImportExport tool to copy the data and encrypt the drives using BitLocker, then upload the resulting journal (.jrn) files when creating the import job in the Azure portal.

The correct answer is the option requiring the WAImportExport tool to copy the data, encrypt the drives using BitLocker, and upload the resulting journal (.jrn) files. During the preparation phase of the Azure Import/Export service, the WAImportExport tool performs local copy operations, secures the drives with BitLocker encryption, and produces journal files that link the drive identifier to its specific BitLocker key. These journal files must be uploaded to the Azure portal during job creation so the datacenter can safely unlock the drives and ingest the data.

Step-by-Step Solution

Run the WAImportExport tool on the local system.

The data is copied to the SATA drives, the drives are encrypted with BitLocker, and a journal (.jrn) file is generated for each drive.

The WAImportExport tool prepares the physical media by copying files and securing them using BitLocker, producing journal files containing encryption and drive details.

Create an import job in the Azure portal and upload the journal (.jrn) files.

The import job is created in Azure with the correct drive mapping and BitLocker keys.

Azure requires the journal files to map the drives to the import job and to decrypt the drive contents once they arrive at the Azure datacenter.

Ship the physical drives to the designated Azure datacenter.

Azure staff attach the drives and import the data into the storage account.

The physical transport bypasses network limitations to move the data securely.

Key Concept

Azure Import/Export Drive Preparation and Job Creation Flow

Question 98Question →

A compliance officer needs to inspect resource configurations. An administrator configures the following Azure resource hierarchy:

* Management Group: MG-Enterprise
* Subscription: Sub-Billing
* Resource Group: RG-Finance
* Virtual Machine: VM-Ledger

You assign the compliance officer the Reader role at the Sub-Billing subscription scope.

Which of the following describes the access the compliance officer has to VM-Ledger?

The officer has Reader permissions on VM-Ledger only if the virtual machine is added to an Administrative Unit scope where the officer has the Reader role.

The officer has no access to VM-Ledger because subscription-level role assignments do not inherit to resources within a resource group.

The officer has Reader permissions on VM-Ledger because role assignments inherit down the resource hierarchy from the subscription level.

The officer has Reader permissions on VM-Ledger only if they are also assigned a directory-level administrator role in Microsoft Entra ID.

Show answer & explanation

Answer: The officer has Reader permissions on VM-Ledger because role assignments inherit down the resource hierarchy from the subscription level.

Answer

The officer has Reader permissions on VM-Ledger because role assignments inherit down the resource hierarchy from the subscription level.

The correct answer is correct because Azure RBAC role assignments are inherited down the resource hierarchy. Since the compliance officer is assigned the Reader role at the subscription level, those permissions flow down to all resource groups and resources under that subscription, including the virtual machine in the finance resource group.

Step-by-Step Solution

Identify the scope of the role assignment.

The Reader role is assigned to the user at the Subscription level (Sub-Billing).

Permissions in Azure RBAC are defined by the role and the scope at which it is applied.

Determine the resource inheritance chain.

The target resource (VM-Ledger) is inside the resource group (RG-Finance), which is under the subscription (Sub-Billing).

This establishes that the target resource is a descendant of the scope where the role is assigned.

Apply Azure RBAC inheritance rules.

The Reader role inherits down from the subscription to the resource group, and finally to the virtual machine.

Azure RBAC rules state that any permissions granted at a parent scope are inherited by child scopes and resources.

Key Concept

Azure RBAC Role Inheritance and Scopes

Question 99Question →

An administrator is configuring storage replication and blob lifecycle management policies for several standard General Purpose v2 (GPv2) storage accounts in an Azure subscription.

Which two of the following statements correctly describe the behavior or requirements of these configurations? (Select two.)

Select all that apply

A live migration from Locally Redundant Storage (LRS) to Zone-Redundant Storage (ZRS) cannot begin if the storage account contains any blobs currently in the Archive tier.

A lifecycle policy rule designed to transition base blobs to the Archive tier will fail to transition a blob if the blob has associated snapshots that are not also transitioned to the Archive tier.

Changing the replication setting of a storage account from Locally Redundant Storage (LRS) to Geo-Redundant Storage (GRS) automatically creates a new storage account with a unique name, requiring all client application connection strings to be updated.

After a customer-managed failover of a Geo-Redundant Storage (GRS) account to the secondary region, the replication configuration automatically remains GRS, and data replication to the original primary region resumes immediately.

To execute a lifecycle policy rule that deletes blobs, you must assign the Storage Blob Data Owner Role-Based Access Control (RBAC) role to the storage account's system-assigned managed identity.

Show answer & explanation

Answer: A live migration from Locally Redundant Storage (LRS) to Zone-Redundant Storage (ZRS) cannot begin if the storage account contains any blobs currently in the Archive tier.; A lifecycle policy rule designed to transition base blobs to the Archive tier will fail to transition a blob if the blob has associated snapshots that are not also transitioned to the Archive tier.

Answer

A live migration from Locally Redundant Storage (LRS) to Zone-Redundant Storage (ZRS) cannot begin if the storage account contains any blobs currently in the Archive tier, and a lifecycle policy rule designed to transition base blobs to the Archive tier will fail to transition a blob if the blob has associated snapshots that are not also transitioned to the Archive tier.

The statement about LRS to ZRS live migration is correct because Azure prohibits ZRS migration while blobs remain in the Archive tier. The statement about lifecycle policy rules is correct because a base blob cannot be transitioned to the Archive tier if its associated snapshots are in Hot or Cool; both the base blob and its snapshots must be transitioned together using the rule actions.

Step-by-Step Solution

Evaluate ZRS migration prerequisites.

Identify that the presence of archived blobs blocks live migration from LRS to ZRS until they are rehydrated.

Azure requires all data to be in an online tier (Hot or Cool) to perform the live replication migration to ZRS.

Examine lifecycle management rule mechanics with snapshots.

Recognize that a base blob cannot be archived while its snapshots remain in an online tier.

Azure Storage policy enforcement requires consistency between base blobs and snapshots when moving to the offline Archive tier.

Analyze the impact of modifying replication configuration.

Determine that updating LRS to GRS changes replication in-place without generating a new storage account or changing primary connection strings.

Azure handles replication transitions at the service level, preserving existing endpoints.

Review failover behavior.

Verify that a geo-failover converts the replication type to LRS in the secondary region.

Re-protecting the account to configure geo-redundancy back to the primary region is a manual post-failover administrative step.

Evaluate lifecycle policy execution permissions.

Confirm that lifecycle rules run natively without requiring RBAC roles or managed identities.

Lifecycle management is a native control-plane feature that executes actions internally.

Key Concept

Azure Storage replication transition paths, failover mechanics, and lifecycle management policy rules concerning the Archive tier.

Question 100Question →

An administrator manages a Microsoft Entra ID tenant that contains an administrative unit named Sales-AU. A dynamic user group named Sales-Dynamic-Group is a member of Sales-AU. A user named Admin1 is assigned the Groups Administrator role scoped to the Sales-AU administrative unit. Admin1 attempts to modify the query of the dynamic membership rule for Sales-Dynamic-Group. What is the outcome of Admin1's attempt to modify the rule?

The update will succeed because the Groups Administrator role scoped to the administrative unit provides full management capabilities for all groups within that administrative unit.

The operation will fail because modifying dynamic rules requires a subscription-level Azure RBAC role such as Owner or Contributor.

The update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope.

The update will fail because only users with the User Administrator role scoped to the administrative unit are permitted to manage dynamic user group rules.

Show answer & explanation

Answer: The update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope.

Answer

The update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope.

The correct option states that the update will fail because dynamic membership rules can only be modified by administrators with group management roles assigned at the tenant scope. In Microsoft Entra ID, administrative unit scope delegation does not extend to managing dynamic groups, even if the dynamic groups are members of the administrative unit. Dynamic group membership rules require tenant-wide privileges to modify.

Step-by-Step Solution

Analyze the current administrative role assignment and scope.

Admin1 has the Groups Administrator role scoped to the Sales-AU administrative unit.

To determine if the user has the required permissions to perform the operation on the group.

Identify the type of group being modified.

The target group, Sales-Dynamic-Group, is a dynamic user group.

Microsoft Entra ID enforces different administrative boundaries and delegation rules for assigned groups versus dynamic groups.

Apply the administrative unit scope rules for dynamic group management.

Modifying dynamic membership rules is a tenant-level operation. Roles scoped to an administrative unit cannot modify dynamic groups.

Because dynamic rules are evaluated tenant-wide, Microsoft Entra ID prevents administrative unit scoped administrators from creating or modifying them to maintain security boundaries.

Determine the necessary administrative level and role for resolution.

Admin1 requires the Groups Administrator (or Global Administrator) role assigned at the tenant (directory) scope.

This directory-level permission is the minimum privilege required to modify dynamic membership rules.

Key Concept

Delegating group management with administrative units and directory roles

Estimated Time:2m 0s

PreviousPage 5 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept