Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 981Question →

You are configuring an Azure Monitor action group to trigger a custom webhook endpoint. The endpoint is secured by Microsoft Entra ID. You register a Microsoft Entra application named App1 in your tenant to represent the webhook receiver API. In the action group Webhook configuration, you select the option to 'Use Azure AD authentication'. To enable the action group to successfully authenticate and obtain an OAuth token for the webhook, which identifier must you input in the Object ID field of the Webhook configuration?

Show answer & explanation

Answer: The Object ID of the service principal representing App1 in the tenant

Answer

The Object ID of the service principal representing App1 in the tenant
The correct answer is the Object ID of the service principal representing the application in the tenant. When configuring Microsoft Entra ID authentication for a Webhook action, Azure Monitor requests a token for the audience identified by the Service Principal Object ID (Enterprise Application object ID), not the Application Registration object ID.

Step-by-Step Solution

1
Identify the authentication mechanism required for the secured webhook.
The webhook is secured by Microsoft Entra ID, meaning Azure Monitor must obtain an access token to call the endpoint.
Securing webhooks prevents unauthorized triggers by requiring a valid Bearer token.
2
Determine the resource identifiers needed by Azure Monitor.
Azure Monitor needs the Tenant ID where the app is registered and the Object ID of the Service Principal.
Microsoft Entra ID requires the service principal's object ID (representing the instantiated enterprise application in the tenant) to issue the correct token audience.
3
Distinguish between the App Registration Object ID and the Service Principal Object ID.
The Object ID of the Service Principal (found under Enterprise Applications) is used, not the Object ID of the Application Registration.
The service principal is the local runtime instantiation that holds permissions and authentication configuration, while the application registration is the global blueprint.

Key Concept

Azure Monitor Action Group Webhook authentication requires the Service Principal Object ID rather than the App Registration Object ID.
Question 982Question →

You are preparing to implement a public load balancer named LB1 using the Standard SKU. Your environment includes two virtual machines, VM1 and VM2, located in the same virtual network. The network interface of VM1 is currently assigned a Basic SKU public IP address, while the network interface of VM2 has no public IP address. You must configure the environment to allow both VM1 and VM2 to be members of the backend pool for LB1. Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the frontend of LB1 with a Standard SKU public IP address.; Remove the Basic SKU public IP address from the network interface of VM1.

Answer

Configure the frontend of LB1 with a Standard SKU public IP address, and remove the Basic SKU public IP address from the network interface of VM1.
A Standard SKU Azure Load Balancer requires all associated public IP addresses to be of the Standard SKU. This applies to the frontend IP configuration of the load balancer itself. Additionally, any virtual machine in the backend pool of a Standard Load Balancer must either have no public IP address or use a Standard SKU public IP address on its network interface. Therefore, you must configure the frontend of the load balancer with a Standard SKU public IP, and you must remove the incompatible Basic SKU public IP from the network interface of the first virtual machine.

Step-by-Step Solution

1
Analyze the SKU of the load balancer and its frontend IP requirements.
Since LB1 is a Standard SKU load balancer, its frontend IP configuration must also use a Standard SKU public IP address.
Standard SKU load balancers only support Standard SKU public IP addresses.
2
Analyze the network configuration of the backend virtual machines for SKU compatibility.
VM1 has a Basic SKU public IP address, which is incompatible with a Standard SKU load balancer's backend pool. VM2 has no public IP, which is fully supported.
All resources in the backend pool of a Standard SKU load balancer must either have no public IP address or use Standard SKU public IP addresses. Basic and Standard SKUs cannot be mixed on the same network interface.
3
Identify the required remediation steps.
Create a Standard SKU public IP for the frontend of LB1, and dissociate the Basic SKU public IP from the network interface of VM1.
These steps resolve both SKU conflicts, allowing VM1 and VM2 to be successfully added to the backend pool of LB1.

Key Concept

Azure Load Balancer SKU compatibility and frontend/backend IP configurations
Question 983Question →

Your company has an Azure virtual network named `VNet1` that contains an Azure Bastion host deployed in a subnet named `AzureBastionSubnet`. To secure the environment, you associate a Network Security Group (NSG) named `NSG-Bastion` with `AzureBastionSubnet`. You add a custom outbound security rule to `NSG-Bastion` with a priority of 950 that denies all outbound traffic to the Internet (Destination: `Internet`, Action: `Deny`). After applying the NSG, administrators report that they can no longer connect to virtual machines in `VNet1` using Azure Bastion. You need to resolve the connectivity issue while maintaining the block on general outbound Internet traffic. Which outbound rule should you add to `NSG-Bastion`?

Show answer & explanation

Answer: An outbound rule with a priority of 900 that allows TCP port 443 traffic to the AzureCloud service tag

Answer

Add an outbound security rule to `NSG-Bastion` with a priority of 900 that allows TCP port 443 traffic to the `AzureCloud` service tag.
The correct option is correct because Azure Bastion needs to communicate with the Azure public endpoints (such as Azure Storage and Azure Active Directory) via port 443. The AzureCloud service tag represents these endpoints. Because a custom rule with a priority of 950 blocks all outbound Internet traffic, we must place an allow rule with a higher priority (lower number, e.g., 900) to permit the necessary control plane traffic.

Step-by-Step Solution

1
Identify the outbound dependencies of Azure Bastion.
Azure Bastion requires outbound connectivity to the Azure public endpoints (AzureCloud service tag) on port 443 for management, logging, and diagnostics.
Azure Bastion hosts must communicate with the Azure control plane to function properly.
2
Analyze the impact of the custom deny rule on the dependencies.
The custom outbound rule denying all traffic to the Internet (priority 950) blocks public Azure endpoints since they are a subset of the Internet IP address ranges.
Without a higher priority rule, control plane traffic to AzureCloud is blocked, causing Azure Bastion sessions to fail.
3
Determine the correct rule configuration to bypass the block.
Add an outbound rule allowing traffic to AzureCloud on port 443 with a priority number lower than 950 (such as 900).
NSG rules are processed in increasing order of priority number. A rule with a lower number takes precedence over a rule with a higher number.

Key Concept

Azure Bastion relies on outbound connectivity to the Azure control plane (AzureCloud service tag) on TCP port 443. Custom NSG rules blocking Internet access will prevent Azure Bastion from working unless an explicit allow rule is placed with a higher priority (lower number) than the block rule.
Question 984Question →

An administrator configures network security for a virtual machine named `VM1` in an Azure subscription. `VM1` is connected to a subnet named `SubnetA`. The network interface of `VM1` is associated with an Application Security Group (ASG) named `ASG-Web` and has an associated Network Security Group (NSG) named `NSG-NIC`. `SubnetA` has an associated NSG named `NSG-Subnet`.

`NSG-Subnet` contains the following inbound security rules:
* Priority 100: Allow inbound TCP traffic on port 80 from Any to `ASG-Web`
* Priority 200: Deny inbound TCP traffic on port 80 from Any to Any

`NSG-NIC` contains the following inbound security rules:
* Priority 150: Deny inbound TCP traffic on port 80 from Any to Any
* Priority 250: Allow inbound TCP traffic on port 80 from Any to `ASG-Web`

A user attempts to connect to `VM1` on port 80 from the internet.
What is the result of the connection attempt?

Show answer & explanation

Answer: The connection is denied because the network interface-level NSG processes the deny rule with priority 150 before the allow rule with priority 250.

Answer

The connection is denied because the network interface-level NSG processes the deny rule with priority 150 before the allow rule with priority 250.
For inbound traffic to a virtual machine in a subnet, Azure evaluates the inbound rules of the subnet-level NSG first, followed by the inbound rules of the network interface-level NSG. In this scenario, the subnet-level NSG allows the traffic because the rule with priority 100 is evaluated before priority 200. However, when the traffic reaches the network interface-level NSG (NSG-NIC), the rules are evaluated in priority order (lowest number first). The rule with priority 150 (Deny port 80) is processed before the rule with priority 250 (Allow port 80 to ASG-Web). Therefore, the network interface-level NSG denies the traffic, and the connection attempt fails.

Step-by-Step Solution

1
Evaluate the inbound traffic at the subnet level using NSG-Subnet.
The traffic is allowed by the rule with priority 100 because VM1 is associated with ASG-Web, and priority 100 has precedence over the deny rule at priority 200.
Inbound subnet NSG rules are evaluated first, and lower priority numbers take precedence.
2
Evaluate the inbound traffic at the network interface level using NSG-NIC.
The traffic matches the deny rule with priority 150 (Deny port 80 from Any to Any) which is evaluated before the allow rule at priority 250.
After passing the subnet NSG, inbound traffic is evaluated by the NIC NSG in priority order (lowest number first).
3
Determine the final connection outcome.
The connection attempt fails and is blocked.
For inbound traffic to succeed, it must be allowed by both the subnet-level NSG and the network interface-level NSG. Since the NIC-level NSG denied it, the final outcome is denied.

Key Concept

Azure evaluates both subnet-level and network interface-level NSGs in sequence for inbound traffic, and rules within each NSG are processed in priority order where lower numbers have higher precedence.
Question 985Question →

An organization requires the recovery of an encrypted production virtual machine named `vm-sec-prod` that runs Windows Server 2025. The virtual machine's disks are encrypted using Azure Disk Encryption (ADE) with keys managed in an Azure Key Vault. The virtual machine has suffered operating system corruption, and you must restore it to the original virtual network and subnet.

Which sequence of steps must you perform to restore the encrypted virtual machine?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To restore an Azure Disk Encryption (ADE) encrypted virtual machine, you must first initiate a 'Restore Disks' operation to a staging storage account. Once the restore job finishes, navigate to the storage account container to download the generated ARM template and parameters file. Next, modify the parameters file with the target virtual network, subnet, and VM name. Finally, deploy the modified template using PowerShell, Azure CLI, or the Azure portal to recreate the VM.
For virtual machines encrypted with Azure Disk Encryption (ADE), direct restoration via 'Create virtual machine' or 'Replace existing' is not supported. The administrator must first perform a 'Restore Disks' operation to copy the encrypted VHDs to a staging storage account. Azure Backup automatically generates an ARM template and parameters file in the storage account. The administrator must download these files, modify the parameters (such as the target virtual network, subnet, and VM name), and deploy the template to recreate the VM.

Step-by-Step Solution

1
Initiate 'Restore Disks' in the Recovery Services vault.
Disks are copied to the staging storage account, and deployment templates are generated.
Direct VM restore ('Create virtual machine' or 'Replace existing') is not supported for ADE-encrypted VMs.
2
Locate and download the template files in the staging storage account.
You obtain the `template.json` and `parameters.json` files.
These templates contain the configuration and disks reference required to deploy the VM with its encryption settings.
3
Edit the `parameters.json` file.
The parameters are customized with target network, subnet, and VM names.
This configuration maps the restored resources to the correct infrastructure components.
4
Deploy the template using Azure CLI, PowerShell, or the portal.
A new VM is provisioned using the restored disks.
This registers the VM with the Azure fabric and attaches the encryption keys from Key Vault.

Key Concept

Restoring Azure Disk Encryption (ADE) Encrypted Virtual Machines
Question 986Question →

An administrator is configuring access control for an Azure Log Analytics workspace named Workspace1. Workspace1 collects diagnostic logs and performance metrics from 50 Azure virtual machines distributed across multiple resource groups. A group of developers must be able to query the performance logs of only the virtual machines they manage. The developers must not be able to view logs for other virtual machines, and they must not have access to Workspace1. Which two settings or assignments should the administrator configure? Select two.

Select all that apply

Show answer & explanation

Answer: Configure the access control mode of Workspace1 to use resource or workspace permissions.; Assign the Reader role to the developers on the specific virtual machines they manage.

Answer

Configure the access control mode of Workspace1 to use resource or workspace permissions and assign the Reader role to the developers on the specific virtual machines they manage.
To restrict access so that users can query logs only for the specific virtual machines they manage without workspace access, you must implement resource-context access. This requires configuring the access control mode of Workspace1 to use resource or workspace permissions. Additionally, the developers must have read permissions (such as the Reader role) on the specific virtual machines they manage.

Step-by-Step Solution

1
Determine the required access mode to restrict access to logs by resource.
Identify that resource-context permissions must be used, which is achieved by setting the workspace access control mode to 'Use resource or workspace permissions'.
This allows users to access logs for resources they have permissions for, without needing workspace permissions.
2
Determine the required resource-level role for the developers.
Assign the Reader role to developers on the specific virtual machines they manage.
Users need read permissions on the resource to perform resource-context queries.

Key Concept

Log Analytics Access Control Modes (Workspace-context vs. Resource-context)
Question 987Question →

A company plans to deploy an internal human resources application to Azure App Service. The hosting environment for the web app must meet the following requirements:
- Support custom domain names and SSL/TLS bindings.
- Support automated daily backups of the application content and configuration.
- Support manual scale-out of the App Service plan up to 5 instances.

You need to identify the most cost-effective App Service plan tier that meets all requirements.

Which App Service plan tier should you select?

Show answer & explanation

Answer: S1

Answer

S1
The Standard (S1) tier is the most cost-effective App Service plan tier that meets all requirements. It supports custom domains, SSL bindings, daily automated backups, and scaling up to 10 instances (which satisfies the requirement for up to 5 instances).

Step-by-Step Solution

1
Evaluate the scaling requirement.
The application requires scaling up to 5 instances. The Free (F1) tier supports no scaling, the Basic (B1) tier supports up to 3 instances, while the Standard (S1) and Premium (P1v3) tiers support up to 10 and 30 instances respectively.
This filters out tiers that cannot support the scaling requirement.
2
Evaluate the backup requirement.
The application requires automated backups. Backups are not supported on the Free (F1) or Basic (B1) tiers; they require the Standard (S1) tier or higher.
This filters the remaining tiers to ensure daily automated backups are supported.
3
Identify the most cost-effective tier.
Both the Standard (S1) and Premium (P1v3) tiers satisfy all constraints. The Standard (S1) tier is the lower cost tier of the two.
To satisfy the requirement of finding the most cost-effective solution.

Key Concept

App Service Plan Tiers and Feature Support
Estimated Time:1m 30s
Question 988Question →

Your company has an Azure environment structured with the following hierarchy:

* Management Group: `MG-Production`
* Subscription: `Sub-AppServices`
* Resource Group: `RG-DataStorage`
* Storage Account: `saproddata101`

A user-assigned managed identity named `mi-web-app` is used by an App Service web app. The web app must be able to read, write, and delete blobs inside the containers of `saproddata101` using Microsoft Entra authentication. The solution must follow the principle of least privilege and prevent the managed identity from deleting or modifying the configuration of the storage account itself.

Which role assignment should you configure?

Show answer & explanation

Answer: Assign the Storage Blob Data Contributor role to mi-web-app at the scope of the saproddata101 storage account.

Answer

Assign the Storage Blob Data Contributor role to mi-web-app at the scope of the saproddata101 storage account.
The correct answer is to assign the Storage Blob Data Contributor role to the managed identity at the scope of the saproddata101 storage account. This role grants the specific permissions needed to read, write, and delete blobs using Microsoft Entra authentication. By scoping it to the storage account itself, the permissions are restricted to only this resource, meeting the requirement of least privilege. It also does not grant permissions to modify or delete the storage account resources, ensuring control plane actions are blocked.

Step-by-Step Solution

1
Identify the data plane requirements and authentication method.
The application requires read, write, and delete permissions on blobs using Microsoft Entra ID authentication.
Traditional control-plane roles like Contributor or Storage Account Contributor do not automatically grant direct Microsoft Entra ID-based data access (like Blob read/write) without using access keys.
2
Determine the role that aligns with the principle of least privilege.
The Storage Blob Data Contributor role is selected.
This role allows blob data operations but prevents control plane modifications like deleting or resizing the storage account.
3
Identify the correct scope to apply the role assignment.
The scope must be the storage account itself (saproddata101).
Assigning the role at the management group level (MG-Production) would inherit down and grant access to all storage accounts in the hierarchy, violating least privilege.

Key Concept

Azure RBAC Roles and Scopes for Data Plane Access
Estimated Time:1m 30s
Question 989Question →

You are maintaining a multi-tier application in Azure. One of the virtual machines, `vm-payroll`, has two network interfaces (NICs) and is backed up to a Recovery Services vault. After a corrupt application update, you must restore the virtual machine's operational state.

Which of the following recovery options in the Azure portal support this configuration? (Select two.)

Select all that apply

Show answer & explanation

Answer: Replace existing; Restore disks

Answer

Replace existing and Restore disks are the supported recovery options for virtual machines with multiple network interfaces.
For virtual machines with multiple network interfaces, Azure Backup supports 'Replace existing' (which retains the current VM shell and its multiple NICs) and 'Restore disks' (which recovers the VHD files to a storage account so they can be deployed manually using an ARM template or PowerShell with the required network configuration).

Step-by-Step Solution

1
Identify the constraints of the virtual machine configuration.
The virtual machine `vm-payroll` has multiple network interfaces (NICs).
Azure Backup restore options have different support matrices based on VM configurations such as multiple NICs.
2
Evaluate the 'Create virtual machine' option.
The 'Create virtual machine' option only supports restoring a VM with a single NIC.
To determine if direct VM recreation is possible.
3
Evaluate the remaining restore options.
The 'Replace existing' option swaps the disks on the current VM and preserves NIC configuration. The 'Restore disks' option outputs the VHDs, which can then be deployed manually with multiple NICs.
To identify the supported restore paths.

Key Concept

Azure VM Backup restore options and their network configuration constraints
Question 990Question →

Your company has an Azure virtual machine named VM-Prod-01 deployed in the East US region.

Currently, your Azure environment contains the following vaults:
- A Recovery Services Vault named RSV-West in the West US region
- A Backup Vault named BV-East in the East US region

You need to back up VM-Prod-01.

Which two actions should you perform? (Select two)

Select all that apply

Show answer & explanation

Answer: Create a new Recovery Services Vault in the East US region.; Configure the backup policy for VM-Prod-01 in the new Recovery Services Vault.

Answer

Create a new Recovery Services Vault in the East US region, and configure the backup policy for the virtual machine in that vault.
To back up an Azure virtual machine, you must use a Recovery Services Vault that resides in the same region as the virtual machine. Since the virtual machine is in the East US region, and the only existing Recovery Services Vault is in the West US region, you must first create a new Recovery Services Vault in East US. Afterwards, you configure the backup policy for the virtual machine within that newly created vault.

Step-by-Step Solution

1
Determine the vault type requirement for Azure Virtual Machine backup.
Identify that Azure Virtual Machines require a Recovery Services Vault, which excludes the existing Backup Vault in East US.
Backup Vaults and Recovery Services Vaults support different sets of datasources; virtual machines are supported only by Recovery Services Vaults.
2
Determine the regional alignment requirement.
Identify that the Recovery Services Vault must be located in the same region as the target virtual machine (East US), which excludes the existing Recovery Services Vault in West US.
Azure Backup enforces a regional boundary requiring the vault and the virtual machine to reside in the same region for backup operations.
3
Select the correct deployment and configuration tasks.
Deploy a new Recovery Services Vault in East US and then configure the backup policy for the virtual machine in that new vault.
This satisfies both the vault type requirement and the regional constraint.

Key Concept

Azure Virtual Machine backup requires a Recovery Services Vault located in the same region as the virtual machine.
Estimated Time:1m 0s
Question 991Question →

An administrator is configuring connectivity for a hybrid Azure environment. The environment contains the following resources:
* VNet-Hub (10.10.0.0/1610.10.0.0/16): Contains a virtual network gateway named GW-Hub in GatewaySubnet (10.10.0.0/2410.10.0.0/24), and a virtual machine named VM-Hub in Subnet-Hub (10.10.1.0/2410.10.1.0/24).
* VNet-Spoke (10.20.0.0/1610.20.0.0/16): Contains a virtual machine named VM-Spoke in Subnet-Spoke (10.20.1.0/2410.20.1.0/24).
* GW-Hub is connected to an on-premises network (192.168.1.0/24192.168.1.0/24) via a Site-to-Site VPN connection.

A virtual network peering connection is established between VNet-Hub and VNet-Spoke.

Which configuration must the administrator apply to the peering links to allow VM-Spoke to communicate with the on-premises network?

Show answer & explanation

Answer: Enable 'Allow gateway transit' on the VNet-Hub peering link, and enable 'Use remote gateways' on the VNet-Spoke peering link.

Answer

Enable 'Allow gateway transit' on the VNet-Hub peering link, and enable 'Use remote gateways' on the VNet-Spoke peering link.
The correct configuration is to enable 'Allow gateway transit' on the VNet-Hub peering link and 'Use remote gateways' on the VNet-Spoke peering link. In Azure, the virtual network containing the VPN gateway must allow gateway transit so that its gateway can be shared with peered spokes. Conversely, the spoke virtual network must be configured to use remote gateways to route traffic destined for on-premises through the hub's gateway and automatically receive the propagated routes.

Step-by-Step Solution

1
Identify the hosting location of the Virtual Network Gateway.
The Virtual Network Gateway (GW-Hub) is located in VNet-Hub.
VNet Peering transit configurations depend on which network hosts the gateway resource.
2
Configure the transit behavior on the hosting network (VNet-Hub).
Enable 'Allow gateway transit' on the peering link originating from VNet-Hub.
This allows VNet-Hub to share its gateway with the peered spoke network.
3
Configure the consumption behavior on the spoke network (VNet-Spoke).
Enable 'Use remote gateways' on the peering link originating from VNet-Spoke.
This configures the routing table of VNet-Spoke to dynamically learn and use the gateway routes from VNet-Hub.

Key Concept

Virtual Network Gateway Transit in Peered VNets
Question 992Question →

You are configuring a public Azure Load Balancer named LB-App to distribute incoming traffic across three virtual machines: VM-A, VM-B, and VM-C. The virtual machines are deployed in the same region, are connected to the same virtual network, and are not configured in an Availability Set or Virtual Machine Scale Set. You have already created a Basic SKU public IP address named IP-Web to serve as the frontend. You need to complete the load balancer configuration so that all three virtual machines can receive traffic. Which action should you perform?

Show answer & explanation

Answer: Deploy LB-App as a Standard SKU load balancer, create a Standard SKU public IP address for the frontend, and add the virtual machines to the backend pool.

Answer

Deploy the load balancer as a Standard SKU, create a Standard SKU public IP address for the frontend, and add the virtual machines to the backend pool.
Deploying the load balancer as Standard SKU and creating a Standard SKU public IP address is correct because Standard SKU load balancers support standalone virtual machines in their backend pool, and they require a matching Standard SKU frontend public IP address.

Step-by-Step Solution

1
Analyze the backend virtual machine configuration.
The virtual machines are standalone instances (not in an Availability Set or Virtual Machine Scale Set).
Basic SKU load balancers require backend pool members to be in the same Availability Set or Virtual Machine Scale Set, whereas Standard SKU load balancers support standalone VMs.
2
Determine the required Load Balancer SKU.
A Standard SKU load balancer must be used because the backend VMs are standalone.
Using a Basic SKU load balancer would require recreating the virtual machines inside an Availability Set.
3
Determine the required Public IP SKU.
A Standard SKU public IP address must be created for the frontend.
Azure Load Balancer SKUs and Public IP SKUs must match; a Standard SKU load balancer cannot use a Basic SKU public IP.

Key Concept

Azure Load Balancer SKU compatibility and backend pool configuration constraints
Question 993Question →

You are deploying a containerized application to Azure Container Instances (ACI) that hosts an API listener. The application must run continuously. If the application process exits with an exit code of 0 (successful termination) after completing an internal self-update, the container must be restarted automatically to resume listening for requests. Which restart policy should you configure for the container group?

Show answer & explanation

Answer: Always

Answer

Always
The correct answer is Always because the workload requires a continuous running state. In Azure Container Instances, the Always restart policy guarantees that containers in the group are restarted regardless of their exit status (0 or non-zero). Since the listener container exits with code 0 after self-updating, the Always policy ensures that it is restarted to continue processing requests.

Step-by-Step Solution

1
Analyze the workload requirements.
The workload is a continuous API listener that must stay online indefinitely.
Understanding the lifecycle of the container helps determine the correct container restart behavior.
2
Evaluate the exit condition.
The application exits with code 0 (success) during self-update operations.
Knowing that the process exits with code 0 is critical because it rules out policies that only react to non-zero exit codes.
3
Match the requirement with the correct restart policy.
Select the Always restart policy.
Only the Always policy restarts the container group when a process completes successfully with exit code 0.

Key Concept

Azure Container Instances restart policies determine how ACI manages the lifecycle of containers in a group based on their exit codes. For long-running or continuous services, the Always policy is used to guarantee that the containers are restarted after any termination, including successful exits.
Estimated Time:1m 30s
Question 994Question →

Your company has an Azure subscription containing an Azure Key Vault named KV1, an Azure Firewall named FW1, and a Network Security Group named NSG1. You must configure diagnostic settings for these resources to satisfy specific organizational requirements. Match each logging or monitoring requirement on the left to its most appropriate Azure Monitor diagnostic settings destination on the right. (Each destination may be used once, more than once, or not at all.)

Click a left item, then click its matching right item

Items

Run complex KQL queries to correlate logs across KV1 and other resources to identify security anomalies.
Archive NSG1 flow logs for a period of two years at the lowest possible storage cost.
Stream FW1 activity and resource logs in near real-time to an on-premises third-party SIEM system.
Export KV1 diagnostic metrics to an external partner SaaS monitoring environment like Datadog.

Matches

Show answer & explanation

Answer

Log Analytics workspace matches KQL queries and correlation; Azure Storage account matches lowest cost archiving; Azure Event Hubs matches streaming to an external SIEM; Partner solution matches exporting to Datadog.
Log Analytics workspace is matched to running KQL queries because it is the native query interface for Azure Monitor. Storage account is matched to low-cost archiving because it provides the cheapest long-term raw data storage. Event Hubs is matched to streaming to third-party SIEMs because it serves as the real-time message stream destination. Partner solution is matched to Datadog because Azure Diagnostic Settings support direct partner integration for SaaS monitoring platforms.

Step-by-Step Solution

1
Analyze the KQL query and correlation requirement.
Identify that Log Analytics workspaces natively run KQL and store logs from multiple sources for centralized analysis.
Log Analytics is the primary analytical engine for Azure Monitor logs.
2
Analyze the long-term low-cost storage requirement.
Identify that Azure Storage accounts support tiering and offer the lowest storage costs for compliance archiving.
Log Analytics and Event Hubs are more expensive for purely long-term cold storage.
3
Analyze the near real-time third-party SIEM requirement.
Identify that Event Hubs act as the ingress point to stream event data to external tools like Splunk or QRadar.
Event Hubs provide the pub/sub event pipeline required for third-party integrations.
4
Analyze the SaaS partner monitoring requirement.
Identify that Partner solutions natively connect Azure Monitor data to partner platforms like Datadog.
Azure provides native Diagnostic Setting integrations for specific third-party partners.

Key Concept

Selecting the correct Azure Monitor diagnostic settings destination based on cost, performance, and integration requirements.
Question 995Question →

You have a Standard storage account named `sa-ops-prod` in the East US region. The storage account hosts an SMB file share named `ops-share` and has its firewall configured to restrict access to selected networks. You plan to configure Azure Backup for `ops-share` using a Recovery Services vault. Which two configurations are required to ensure the backup completes successfully? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Configure the storage account to allow trusted Microsoft services to bypass the firewall; Deploy a Recovery Services vault in the East US region to store the backups

Answer

Deploying a Recovery Services vault in the East US region and configuring the storage account to allow trusted Microsoft services to bypass the firewall are both required.
To successfully back up an Azure file share using Azure Backup, the Recovery Services vault must be deployed in the same region as the storage account hosting the share. Additionally, if the storage account firewall is enabled, the option to allow trusted Microsoft services to bypass the firewall must be configured to allow the backup service access.

Step-by-Step Solution

1
Ensure region alignment by deploying the Recovery Services vault in the East US region, matching the region of the storage account.
The vault is prepared in the correct region to back up the file share.
Azure Backup for Azure Files requires the vault and the storage account to reside in the same region.
2
Configure the storage account firewall settings to permit trusted Microsoft services to bypass the firewall.
The Azure Backup service is permitted to communicate with the storage account and execute backup tasks.
When a storage account firewall is enabled, Azure Backup cannot access the file share unless the trusted Microsoft services exception is active.

Key Concept

Azure Files backup requires region alignment between the vault and the storage account, and allowing trusted Microsoft services through the storage firewall if configured.
Question 996Question →

An administrator manages an Azure virtual machine named `VM-Finance01` that is backed up to a Recovery Services vault named `RSV-Prod`. Due to an application failure, the administrator needs to recover the virtual machine by restoring its managed disks. The administrator plans to restore the disks to an existing storage account named `safinancetarget`. The firewalls and virtual networks settings for `safinancetarget` are configured to restrict access to 'Enabled from selected networks and IP addresses'. When the administrator attempts to run the restore operation, the job fails with a permission error. Which combination of configurations is required to ensure that `RSV-Prod` can successfully restore the managed disks to `safinancetarget`?

Show answer & explanation

Answer: Enable the system-assigned managed identity of the Recovery Services vault, assign it the Storage Blob Data Contributor role on the storage account, and configure the storage account firewall to allow trusted Microsoft services.

Answer

Enable the system-assigned managed identity of the Recovery Services vault, assign it the Storage Blob Data Contributor role on the storage account, and configure the storage account firewall to allow trusted Microsoft services.
To restore managed disks from a Recovery Services vault to a firewalled storage account, the Azure Backup service must be able to write to the storage account. This requires enabling a managed identity on the vault, assigning it the Storage Blob Data Contributor role on the target storage account, and allowing trusted Microsoft services to bypass the storage account firewall.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Recovery Services vault.
The vault is registered in Microsoft Entra ID with its own identity, enabling role-based access control.
This is necessary so the vault can authenticate against the target storage account.
2
Assign the Storage Blob Data Contributor role to the vault's managed identity on the destination storage account.
The vault gains data-plane write access to the storage account containers.
The vault must have permissions to write the recovered managed disk VHDs to the storage account.
3
Configure the storage account firewall to allow trusted Microsoft services.
The firewall allows secure traffic from Azure Backup bypass rules.
The firewall normally blocks access from external networks, but checking this option allows the trusted Azure Backup service to bypass the block.

Key Concept

Restoring managed disks to a firewall-enabled storage account using the Recovery Services vault managed identity and trusted service bypass.
Question 997Question →

An organization has an Azure virtual network named `VNet-A` (10.50.0.0/1610.50.0.0/16) that contains three subnets:
- `Subnet-1` (10.50.1.0/2410.50.1.0/24)
- `Subnet-2` (10.50.2.0/2410.50.2.0/24)
- `Subnet-Security` (10.50.10.0/2410.50.10.0/24)

Azure automatically creates a default system route for the local virtual network (10.50.0.0/1610.50.0.0/16, next hop: Virtual network).

To control traffic, an administrator creates a route table named `RT-Prod` and associates it with `Subnet-1`. The route table contains the following user-defined routes (UDRs):
- Route1: Destination prefix 0.0.0.0/00.0.0.0/0, Next hop type: Virtual appliance, Next hop IP address: 10.50.10.410.50.10.4
- Route2: Destination prefix 10.50.2.0/2410.50.2.0/24, Next hop type: None

A virtual machine in `Subnet-1` attempts to connect to a database server at the IP address 10.50.2.5510.50.2.55 in `Subnet-2`.

How is this traffic routed?

Show answer & explanation

Answer: The traffic is dropped.

Answer

The traffic is dropped.
The correct answer states that the traffic is dropped. When the virtual machine attempts to send traffic to the destination IP address 10.50.2.5510.50.2.55, Azure compares the destination against all active routes in the route table associated with the source subnet. The destination matches the user-defined route for 10.50.2.0/2410.50.2.0/24 (prefix length /24), the system local virtual network route for 10.50.0.0/1610.50.0.0/16 (prefix length /16), and the default route for 0.0.0.0/00.0.0.0/0 (prefix length /0). Following the Longest Prefix Match rule, the most specific route (10.50.2.0/2410.50.2.0/24) is selected. Since its next hop type is defined as None, the traffic is discarded.

Step-by-Step Solution

1
Identify the target IP address and determine all matching route prefixes.
Target IP 10.50.2.5510.50.2.55 matches three prefixes: the virtual network local route (10.50.0.0/1610.50.0.0/16), the user-defined route Route2 (10.50.2.0/2410.50.2.0/24), and the default route Route1 (0.0.0.0/00.0.0.0/0).
This establishes the candidate routes that could be used to forward the traffic.
2
Apply the Longest Prefix Match (LPM) rule to select the active route.
The prefix 10.50.2.0/2410.50.2.0/24 has a length of 24, which is longer than both the virtual network prefix length of 16 and the default route prefix length of 0.
Azure's routing decision engine prioritizes routes with the most specific prefix matching the destination IP.
3
Identify the next hop type of the selected route to determine the final path.
The next hop type for Route2 (10.50.2.0/2410.50.2.0/24) is None, which causes the packets to be dropped.
A next hop type of None explicitly instructs the Azure virtual network to drop matching traffic instead of forwarding it.

Key Concept

Azure determines packet routing by selecting the route with the Longest Prefix Match (LPM). User-defined routes with more specific prefixes override standard system routes, and setting the next hop to None acts as a traffic filter.
Question 998Question →

An administrator needs to query a Log Analytics workspace to analyze virtual machine performance. The administrator must retrieve the average CPU utilization for each virtual machine in 5-minute intervals over the past hour. The results must only display intervals where the average CPU utilization exceeds 90 percent. Which KQL query should the administrator run?

Show answer & explanation

Answer: Perf
| where TimeGenerated > ago(1h)
| where CounterName == "% Processor Time"
| summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| where AvgCPU > 90

Answer

The query that uses the summarize operator to calculate AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m) and then filters the output with a subsequent where AvgCPU > 90 clause.
The correct query filters the Perf table to CPU utilization data within the last hour, aggregates the data by computer and 5-minute bins, and then filters the summarized average value. KQL requires the summarize statement to run before a where statement can reference the aggregated column.

Step-by-Step Solution

1
Filter the dataset to the target time range and metric identifier.
Perf | where TimeGenerated > ago(1h) | where CounterName == "% Processor Time"
This reduces the processing load by restricting the data to the correct performance counter from the last hour.
2
Aggregate the performance counter values into 5-minute bins grouped by computer.
summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
The avg function calculates the average value, and the bin function groups the timestamps into discrete 5-minute intervals.
3
Filter the aggregated results to isolate intervals with high CPU usage.
where AvgCPU > 90
The where clause must follow the summarize statement so it can filter on the newly calculated AvgCPU column.

Key Concept

KQL Query Structure and Aggregations
Question 999Question →

You are preparing to deploy Azure Bastion to secure administrative access to virtual machines in a virtual network named ProductionVNet. You plan to secure the deployment using a custom Network Security Group (NSG) associated with the Bastion subnet. To prevent deployment validation failures, you must ensure the NSG is fully configured with the mandatory rules before the Azure Bastion host is provisioned. Which five actions should you perform in sequence?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of actions is to first create the AzureBastionSubnet with a /26 prefix, create a Standard SKU static public IP address, create a Network Security Group (NSG) with the mandatory rules, associate that NSG with the AzureBastionSubnet, and finally provision the Azure Bastion host.
The correct sequence begins with creating the dedicated subnet named exactly AzureBastionSubnet of size /26 or larger, followed by creating the prerequisite Standard SKU public IP address. Next, the NSG must be created and populated with the mandatory Azure Bastion rules. The NSG is then associated with the AzureBastionSubnet. Finally, the Azure Bastion host is provisioned using both the subnet and the public IP, passing the platform's configuration and NSG validation rules.

Step-by-Step Solution

1
Create the subnet named AzureBastionSubnet.
A dedicated subnet of size /26 is added to ProductionVNet.
Azure Bastion requires a dedicated subnet named exactly AzureBastionSubnet with an address prefix of /26 or larger.
2
Create a Standard SKU public IP address.
A static public IP address is created.
Azure Bastion requires a Standard SKU public IP address with static assignment to be specified during deployment.
3
Create the NSG and define the mandatory rules.
An NSG with rules for GatewayManager, AzureCloud, and Internet traffic is created.
Azure Bastion performs strict validation on any associated NSG. The rules must be defined before the NSG is associated to avoid blocking provisioning.
4
Associate the NSG with the AzureBastionSubnet.
The NSG is attached to the AzureBastionSubnet.
Associating the fully compliant NSG to the subnet prior to deploying Azure Bastion ensures validation success.
5
Provision the Azure Bastion host.
The Azure Bastion host is deployed and running.
With the subnet, public IP, and NSG fully prepared, the Bastion host can be successfully provisioned without validation errors.

Key Concept

Azure Bastion deployment requires a dedicated subnet named AzureBastionSubnet of size /26 or larger, a Standard SKU static public IP, and an NSG configured with specific mandatory inbound and outbound rules associated with the subnet to pass deployment validation.
Question 1000Question →

An administrator configures diagnostic settings for an Azure Key Vault named Vault1 to send all audit logs to a Log Analytics workspace. In the diagnostic settings configuration, the administrator selects the Resource-specific destination table option.

The administrator needs to write a KQL query that retrieves the count of failed secret retrieval (SecretGet) operations over the last seven days, grouped by the name of the secret.

Which KQL query should the administrator run?

Show answer & explanation

Answer: AKVAudit
| where TimeGenerated > ago(7d)
| where OperationName == "SecretGet"
| where ResultSignature != "200"
| summarize count() by ObjectName

Answer

The query that targets the AKVAudit table, filters by a TimeGenerated within the last seven days, specifies the 'SecretGet' OperationName, filters out successful '200' responses in ResultSignature, and aggregates the count using the summarize operator by the ObjectName column.
The correct query targets the AKVAudit table because Key Vault diagnostic logs are directed to this table when the Resource-specific destination option is selected. It correctly filters for the 'SecretGet' operation type, identifies failures by checking for a ResultSignature other than the HTTP success status code of '200', and aggregates the results by the ObjectName column using the KQL summarize operator.

Step-by-Step Solution

1
Determine the target table for the Key Vault logs based on the diagnostic settings configuration.
Because the Resource-specific option is selected, Key Vault logs are sent to the dedicated AKVAudit table rather than the shared AzureDiagnostics table.
Choosing the correct table is necessary to ensure the query returns data.
2
Identify the correct column name for the secret name in the target table.
Resource-specific tables use clean, predefined schemas without type suffixes, meaning the secret name is in ObjectName instead of ObjectName_s.
Referencing the incorrect column name will result in a query failure or empty results.
3
Construct the filter and aggregation clauses using valid KQL syntax.
Apply 'where TimeGenerated > ago(7d)' to filter by time, 'where OperationName == "SecretGet"' and 'where ResultSignature != "200"' to filter for failed secret retrievals, and 'summarize count() by ObjectName' to group and aggregate.
Using correct KQL operators such as summarize and by ensures the query compiles and returns the requested count.

Key Concept

Querying resource-specific Azure diagnostic logs using KQL
Estimated Time:2m 0s
PreviousPage 50 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin