Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 1001Question →

You have three Azure virtual networks: VNet-Production (10.50.0.0/1610.50.0.0/16), VNet-Shared (10.60.0.0/1610.60.0.0/16), and VNet-Database (10.70.0.0/1610.70.0.0/16). VNet-Production is peered with VNet-Shared, and VNet-Shared is peered with VNet-Database. No virtual network gateways or network virtual appliances are deployed in the virtual networks. Statement: A virtual machine deployed in VNet-Production can communicate with a virtual machine deployed in VNet-Database over the peering connections. Is this statement true or false?

Show answer & explanation

Answer: False

Answer

The statement is false because Azure virtual network peering is non-transitive by default, meaning traffic from VNet-Production cannot pass through VNet-Shared to reach VNet-Database.
The correct answer is false because virtual network peering in Azure is non-transitive. Even though VNet-Production is peered with VNet-Shared, and VNet-Shared is peered with VNet-Database, traffic originating from VNet-Production cannot traverse VNet-Shared to reach VNet-Database. A direct peering link or a transit routing mechanism (like a gateway or network virtual appliance) is required to establish communication.

Step-by-Step Solution

1
Analyze the network topology and peering links.
VNet-Production is peered with VNet-Shared, and VNet-Shared is peered with VNet-Database. No direct peering exists between VNet-Production and VNet-Database.
This establishes that any communication path between VNet-Production and VNet-Database must traverse VNet-Shared.
2
Evaluate the default transitivity rules of Azure virtual network peering.
Virtual network peering is strictly non-transitive.
This determines whether traffic can flow through VNet-Shared to reach another peered network without a gateway or router.
3
Check for transit routing configurations in the scenario.
No virtual network gateways or network virtual appliances are deployed.
Without transit routing capabilities, traffic between VNet-Production and VNet-Database is blocked at VNet-Shared.

Key Concept

Virtual network peering is non-transitive. To route traffic through a transit hub network, you must configure a VPN gateway or a Network Virtual Appliance (NVA) alongside User-Defined Routes (UDRs).
Question 1002Question →

You manage an Azure subscription that contains a Premium storage account named sa-corp-files in the East US 2 region. The storage account hosts two file shares: an SMB file share named records-smb and an NFS file share named records-nfs. The firewall of sa-corp-files is enabled and configured to allow traffic only from selected virtual networks and IP addresses. The option 'Allow trusted Microsoft services to access this storage account' is currently disabled. You have a Recovery Services vault named rsv-corp-backup in the East US 2 region. Your user account is assigned the Backup Operator role at the resource group level containing all these resources. You need to configure a backup policy in rsv-corp-backup to back up the supported file shares in sa-corp-files while ensuring the minimum administrative permissions are assigned. Which of the following actions should you perform?

Show answer & explanation

Answer: Enable 'Allow trusted Microsoft services to access this storage account' on the firewall of sa-corp-files, assign the Storage Account Contributor role to your user account on sa-corp-files, and configure backup for the records-smb file share only.

Answer

Enable 'Allow trusted Microsoft services to access this storage account' on the firewall of the storage account, assign the Storage Account Contributor role to your user account on the storage account, and configure backup for the SMB file share only.
To back up an Azure file share using Azure Backup, several conditions must be met: 1. Only SMB file shares are supported; NFS file shares cannot be backed up using this service. 2. When the storage account firewall is enabled, you must enable the 'Allow trusted Microsoft services to access this storage account' setting to permit Azure Backup access. 3. The administrator configuring the backup needs write permissions on the storage account (such as Storage Account Contributor or Contributor) to register the storage account and manage snapshots, which are not provided by the Backup Operator role.

Step-by-Step Solution

1
Identify file share protocol compatibility for Azure Backup.
Only the SMB file share (records-smb) can be backed up using Azure Backup; the NFS file share (records-nfs) is not supported.
Azure Files backup via Recovery Services vaults supports only SMB file shares.
2
Configure storage account firewall settings.
Enable 'Allow trusted Microsoft services to access this storage account' bypass on the storage account firewall.
This allows the Azure Backup service to securely access the firewall-protected storage account to perform backup operations.
3
Verify and assign required RBAC permissions.
Assign the Storage Account Contributor (or Contributor) role to the user account on the storage account.
The Backup Operator role only grants permissions on the Recovery Services vault, but configuring Azure Files backup requires write permissions (such as creating share snapshots) on the storage account itself.

Key Concept

Azure Files backup compatibility, storage firewall bypass, and RBAC requirements
Question 1003Question →

An administrator manages an Azure virtual machine named vm-analytics that runs Windows Server 2022. The virtual machine has one OS disk and one data disk named disk-data-01, both of which are Azure Managed Disks. The virtual machine is backed up daily to a Recovery Services vault named vault-prod. The data disk disk-data-01 becomes corrupted due to a database write error. The administrator needs to restore the data disk to its state from a backup taken yesterday. The restore process must meet the following requirements:
- The virtual machine vm-analytics must remain online and continue serving users.
- The restored disk must be attached to vm-analytics as a new data disk to allow data verification.
- Administrative effort must be minimized.

Which recovery configuration should the administrator select in the Azure portal?

Show answer & explanation

Answer: Select the Restore disks option and set Restore as Managed Disks to Yes.

Answer

Select the Restore disks option and set Restore as Managed Disks to Yes.
Selecting the 'Restore disks' option with 'Restore as Managed Disks' set to 'Yes' restores the disks directly as Managed Disk resources in the specified resource group. This allows the administrator to attach the restored disk containing the data to the running virtual machine without interrupting the virtual machine's status, minimizing administrative effort.

Step-by-Step Solution

1
In the Azure portal, navigate to the backup items of the Recovery Services vault and select the restore point from yesterday.
The restore configuration page opens with options to recover the virtual machine.
This allows the selection of the restore point containing the uncorrupted data disk.
2
Select 'Restore disks' as the restore type and set 'Restore as Managed Disks' to 'Yes'.
Azure Backup restores the disks directly as Managed Disk resources in the specified resource group using the staging storage account.
Restoring directly as Managed Disks avoids the need to manually convert VHD files in a storage account into Managed Disks.
3
Attach the newly restored Managed Disk containing the data to the running virtual machine.
The disk becomes available to the operating system without shutting down the virtual machine.
This meets the requirement to keep the virtual machine online during verification.

Key Concept

Azure Virtual Machine Restore Options
Estimated Time:1m 30s
Question 1004Question →

You are planning to deploy a public Azure Load Balancer named LB1 to distribute incoming traffic across three virtual machines named VM1, VM2, and VM3. The virtual machines are deployed in different Availability Zones within the same virtual network.

You need to configure the load balancer and its frontend IP address.

Which two actions should you perform? Select two.

Select all that apply

Show answer & explanation

Answer: Create a Standard SKU Azure Load Balancer.; Create a Standard SKU public IP address.

Answer

Create a Standard SKU Azure Load Balancer and a Standard SKU public IP address.
To support virtual machines deployed across different Availability Zones, a Standard SKU Load Balancer must be deployed. In addition, the SKU of the frontend public IP address must match the SKU of the load balancer, which requires creating a Standard SKU public IP address.

Step-by-Step Solution

1
Analyze the deployment topology of the backend virtual machines.
The virtual machines are deployed in different Availability Zones within the same virtual network.
This determines the minimum SKU capabilities required for the load balancer backend pool.
2
Select the load balancer SKU that supports the VM topology.
Standard SKU Azure Load Balancer.
Basic SKU load balancers do not support backend pools spanning multiple Availability Zones, whereas Standard SKU load balancers do.
3
Determine the required SKU for the frontend public IP address.
Standard SKU public IP address.
Azure Load Balancers require that the frontend IP configurations use a SKU matching the load balancer SKU itself. Therefore, a Standard SKU load balancer requires a Standard SKU public IP.

Key Concept

Azure Load Balancer SKU compatibility and Availability Zone requirements
Question 1005Question →

You have an Azure subscription that contains an Azure Application Gateway named AppGW1. You need to configure diagnostic settings for AppGW1 to meet the following requirements:

- All Web Application Firewall (WAF) logs must be streamed to a third-party Security Information and Event Management (SIEM) system with minimal latency.
- All platform metrics must be archived for a minimum of 365 days at the lowest possible cost.
- WAF logs must not be archived in the storage account, and platform metrics must not be streamed to the SIEM system.

Which configuration should you use to meet these requirements?

Show answer & explanation

Answer: Two diagnostic settings: one that routes WAF logs to an Azure Event Hub, and a second that routes platform metrics to an Azure Storage account.

Answer

Two diagnostic settings: one that routes WAF logs to an Azure Event Hub, and a second that routes platform metrics to an Azure Storage account.
The correct answer provides the necessary separation of telemetry streams. By creating two diagnostic settings, the administrator can configure the first setting to route only WAF logs to the Azure Event Hub, and the second setting to route only the metrics to the Azure Storage account. This architecture prevents WAF logs from being archived in storage and prevents metrics from being pushed to the SIEM, optimizing ingestion costs and complying with security policies.

Step-by-Step Solution

1
Determine the appropriate Azure target destinations for the logs and metrics based on performance and cost requirements.
Event Hub is selected for low-latency streaming to the external SIEM. Storage Account is selected for low-cost, long-term archiving of metrics.
Log Analytics workspace retention is cost-prohibitive for 365 days compared to Storage Account archiving, and Event Hubs are the standard mechanism for real-time SIEM integration.
2
Analyze how diagnostic settings distribute data when multiple destinations are configured in a single setting.
A single diagnostic setting duplicates all selected log and metric categories to all destinations defined within that setting.
To satisfy the isolation requirement (WAF logs only to SIEM, metrics only to Storage), separate routing definitions must be established.
3
Formulate the final configuration structure to minimize overlap.
Two distinct diagnostic settings are configured on the AppGW1 resource: one routing only the WAF log category to the Event Hub, and the second routing only the platform metrics to the Storage account.
This satisfies the routing and retention requirements while complying with the strict isolation policies.

Key Concept

Azure Monitor Diagnostic Settings Routing Behavior
Question 1006Question →

An administrator is setting up a backup policy for a file share hosted in Azure. The resources are configured as follows:
- Storage Account: `sa-finance-prod` (Standard general-purpose v2, configured with a storage firewall restricting access to selected networks)
- File Share: `fin-share-main` (SMB file share)
- Region: East US
- Backup Target: A Recovery Services vault named `rsv-finance` in the East US region

During the backup configuration wizard inside the Recovery Services vault, the administrator cannot find the `sa-finance-prod` storage account to select it.

Which of the following actions will resolve this discovery issue?

Show answer & explanation

Answer: Select the option to allow trusted Microsoft services to bypass the firewall in the storage account network settings.

Answer

Select the option to allow trusted Microsoft services to bypass the firewall in the storage account network settings.
The correct answer is to select the option to allow trusted Microsoft services to bypass the firewall in the storage account network settings. When a storage account's firewall is enabled, Azure Backup (which runs as a trusted Microsoft service) is blocked from accessing the storage account control and data planes unless this specific exception is configured in the firewalls and virtual networks settings of the storage account.

Step-by-Step Solution

1
Identify the blocker preventing the Recovery Services vault from discovering the storage account.
The storage account network firewall blocks all traffic except from selected networks.
Since the Recovery Services vault is outside the selected networks, discovery traffic is blocked.
2
Determine the standard Azure mechanism for allowing Azure Backup to access firewalled storage accounts.
The 'Allow trusted Microsoft services...' exception must be enabled.
Azure Backup is a trusted Microsoft service and can bypass the firewall when this exception is configured.

Key Concept

Azure Backup requires the 'Allow trusted Microsoft services' bypass to access Azure File Shares in storage accounts protected by firewalls.
Estimated Time:45s
Question 1007Question →

An organization has an Azure virtual machine named VM-Sales-01 located in the East US region. The virtual machine is backed up to a Recovery Services vault named Vault-Sales with Cross-Region Restore (CRR) enabled. The secondary region is West US. Due to an outage in the East US region, you must recover the workload in the West US region using Azure Backup. Which restore options are available in the secondary region when configuring the restore in the Azure portal? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a new virtual machine in the secondary region; Restore the virtual machine's disks to a storage account in the secondary region

Answer

The correct options are creating a new virtual machine in the secondary region and restoring the virtual machine's disks to a storage account in the secondary region.
When performing a Cross-Region Restore (CRR) for an Azure virtual machine, Azure Backup allows you to either create a new virtual machine in the secondary region or restore the disks to a storage account in the secondary region. The replace option is unavailable because the target virtual machine is in the primary region and does not exist in the secondary region.

Step-by-Step Solution

1
Identify the recovery target region and service configuration.
The target region is the secondary region (West US) utilizing Cross-Region Restore (CRR).
Determining the target region dictates the available restore workflows.
2
Evaluate the supported recovery types for Cross-Region Restore (CRR).
Azure Backup supports 'Create Virtual Machine' and 'Restore Disks' in the secondary region.
Replacing an existing virtual machine requires the original virtual machine to reside in the target recovery region, which is not true for the secondary region.

Key Concept

Cross-Region Restore (CRR) capabilities and limitations for Azure Virtual Machines
Question 1008Question →

An administrator is configuring monitoring and alerting for an Azure subscription containing several production virtual machines. The administrator has the following requirements:

1. Send an email notification to the operations team if CPU utilization exceeds 90% for a sustained period.
2. Trigger an external automation endpoint (webhook) securely using Microsoft Entra ID authentication if a virtual machine is deleted.
3. Temporarily disable notifications during scheduled weekly maintenance windows.

Which of the following statements regarding the behavior and configuration of these Azure Monitor alerts and Action Groups are correct? (Select two)

Select all that apply

Show answer & explanation

Answer: If the CPU alert triggers repeatedly, email notifications to a single email address will be throttled if they exceed 100 emails in an hour.; To secure the webhook action using Microsoft Entra ID authentication, you must configure the Action Group with the Object ID of the service principal representing the webhook's application registration.

Answer

Email notifications are rate-limited to 100 emails per hour per address, and securing a webhook with Entra ID authentication requires specifying the service principal's Object ID.
Email actions in Azure Monitor Action Groups are rate-limited to a maximum of 100 emails per hour per address to avoid spam. To secure a webhook action with Microsoft Entra ID authentication, you must configure the Action Group with the Object ID of the service principal representing the webhook application registration.

Step-by-Step Solution

1
Analyze the notification rate-limiting behavior for email actions.
Email actions in Azure Monitor Action Groups are throttled if they exceed 100 emails per hour to a specific email address.
This is a built-in protection mechanism in Azure Monitor to prevent notification fatigue and spam.
2
Evaluate secure webhook requirements with Microsoft Entra ID authentication.
The Action Group must be configured with the Object ID of the service principal of the registered application that represents the secure webhook endpoint.
This establishes the identity authorization flow required to trigger the secure endpoint.
3
Determine the correct approach to suppress notifications during maintenance.
Alert Processing Rules should be configured to suppress notifications during the maintenance window.
Directly disabling and enabling rules manually or via script creates configuration overhead and is prone to errors.
4
Check the rate limiting behavior for SMS notifications.
SMS notifications are rate-limited to 1 message every 5 minutes per phone number.
This prevents excessive charges and message floods, making the claim that they are exempt incorrect.

Key Concept

Azure Monitor Alert and Action Group configuration including rate limits, secure webhook authentication, and alert suppression.
Question 1009Question →

A non-profit organization is deploying a public-facing event registration web application to Azure App Service. The hosting plan for the web application must meet the following requirements:
- Allow the application to be accessed using a custom domain with an SSL binding.
- Support scaling up to a maximum of 10 instances to handle traffic spikes during event registrations.
- Support at least one staging slot to perform testing before deploying to production.
You need to identify the most cost-effective App Service plan tier that meets all requirements.
Which App Service plan tier should you select?

Show answer & explanation

Answer: Standard (S1)

Answer

Standard (S1)
The Standard (S1) tier is the most cost-effective tier that satisfies all requirements. It supports custom domains, SSL bindings, scaling up to 10 instances, and up to 5 staging slots.

Step-by-Step Solution

1
Evaluate the requirement for staging slots.
Staging slots require at least the Standard tier.
Free and Basic tiers do not support deployment slots.
2
Evaluate the scaling requirement of up to 10 instances.
The Standard tier supports scaling up to 10 instances.
The Basic tier is limited to a maximum of 3 instances, whereas the Standard tier supports up to 10 instances.
3
Identify the most cost-effective tier that meets all requirements.
The Standard tier is selected.
Both Standard and Premium v3 meet all requirements, but Standard is more cost-effective than Premium.

Key Concept

Determining the minimal App Service Plan pricing tier based on features such as staging slots, instance scaling limits, and custom domain SSL bindings.
Question 1010Question →

Your company plans to deploy an Azure Kubernetes Service (AKS) cluster named AKS1. The cluster will host a multi-tier application consisting of a web frontend and a database backend.

You need to configure AKS1 to meet the following requirements:
- The database backend pods must run only on a specific node pool named dbpool. No other pods must run on dbpool.
- Traffic between the frontend pods and the backend pods must be restricted using rules applied within the cluster.

Which two configurations should you implement? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Apply a taint to the dbpool node pool and add a corresponding toleration to the database backend pods.; Enable a network policy provider when deploying the AKS cluster.

Answer

To meet the requirements, you must apply a taint to the dbpool node pool and add a corresponding toleration to the database backend pods to isolate the database workload. Additionally, you must enable a network policy provider when deploying the AKS cluster to filter traffic between pods.
To ensure database pods run exclusively on the dbpool node pool, you must apply a taint to the node pool and add a matching toleration to the database pods. This prevents other pods from being scheduled on these nodes. To restrict pod-to-pod network traffic, you must enable a network policy provider (such as Azure Network Policy or Calico) during AKS cluster creation, which allows Kubernetes network policies to filter traffic between the frontend and backend pods.

Step-by-Step Solution

1
Configure node pool isolation.
Apply a taint to the dbpool node pool. This ensures that only pods with the matching toleration (the database backend pods) can be scheduled on these nodes, preventing other workloads from running there.
Taints and tolerations are the standard Kubernetes mechanism for attracting or repelling pods to/from specific nodes.
2
Enable network policy capabilities.
Select and enable a network policy provider (such as Azure Network Policy or Calico) when creating the AKS cluster.
A network policy provider must be enabled at cluster deployment time to enforce network policy rules that restrict pod-to-pod traffic.

Key Concept

Configuring node pool isolation using taints/tolerations and securing pod-to-pod traffic with network policies in Azure Kubernetes Service (AKS).
Question 1011Question →

An organization has an Azure subscription containing the following resources:
- `VM-App-01`: An Azure virtual machine located in the North Europe region. It has an attached managed disk named `Disk-Data-01`.
- `SA-Files-01`: A general-purpose v2 storage account located in the West Europe region, hosting an Azure File share named `Share-Assets-01`.
- `RSV-WE`: A Recovery Services Vault located in the West Europe region.
- `RSV-NE`: A Recovery Services Vault located in the North Europe region.
- `BV-NE`: A Backup Vault located in the North Europe region.

An administrator needs to configure backups for `VM-App-01` at the virtual machine level, `Disk-Data-01` at the independent disk level, and `Share-Assets-01` at the file share level.

Which configuration represents the correct vault alignment and prerequisite matching to back up these resources?

Show answer & explanation

Answer: Back up the virtual machine to the North Europe Recovery Services Vault, back up the managed disk to the North Europe Backup Vault, and back up the file share to the West Europe Recovery Services Vault.

Answer

Back up the virtual machine to the North Europe Recovery Services Vault, back up the managed disk to the North Europe Backup Vault, and back up the file share to the West Europe Recovery Services Vault.
The correct configuration aligns each resource with its supported vault type and regional constraints. Azure VMs require a Recovery Services Vault in the same region (North Europe). Azure Managed Disks require a Backup Vault in the same region (North Europe). Azure File shares require a Recovery Services Vault in the same region as the storage account (West Europe).

Step-by-Step Solution

1
Determine the vault type and regional requirements for the Azure virtual machine backup.
The virtual machine is in North Europe, requiring a Recovery Services Vault in the same region (North Europe).
Azure Virtual Machines can only be backed up to a Recovery Services Vault within the same geographical region as the VM.
2
Determine the vault type and regional requirements for the independent managed disk backup.
The managed disk is in North Europe, requiring a Backup Vault in the same region (North Europe).
Azure Managed Disks are backed up using Backup Vaults (not Recovery Services Vaults), and the vault must reside in the same region as the disk.
3
Determine the vault type and regional requirements for the Azure File share backup.
The file share is in West Europe, requiring a Recovery Services Vault in the same region (West Europe).
Azure File share backups are managed via Recovery Services Vaults, which must reside in the same region as the storage account hosting the file share.

Key Concept

Understanding the distinct support matrices and regional constraints for Recovery Services Vaults and Backup Vaults across different resource types (VMs, Managed Disks, and File Shares).
Estimated Time:2m 30s
Question 1012Question →

An administrator is configuring network security for a hub-and-spoke virtual network topology in Azure. The hub virtual network (VNet-Hub) contains an Azure Bastion host deployed in a subnet named `AzureBastionSubnet` (address prefix 10.1.0.0/26). The spoke virtual network (VNet-Spoke) hosts database virtual machines in a subnet named DB-Subnet (address prefix 10.2.0.0/24). VNet-Hub and VNet-Spoke are peered. You need to configure the Network Security Groups (NSGs) associated with both `AzureBastionSubnet` and DB-Subnet to allow administrators to establish RDP and SSH sessions to the database virtual machines using Azure Bastion. Which configuration should you apply to the NSGs?

Show answer & explanation

Answer: For `AzureBastionSubnet`, add an outbound NSG rule allowing traffic to the `VirtualNetwork` service tag on destination ports 3389 and 22. For DB-Subnet, add an inbound NSG rule allowing traffic from the `VirtualNetwork` service tag on destination ports 3389 and 22.

Answer

For `AzureBastionSubnet`, add an outbound NSG rule allowing traffic to the `VirtualNetwork` service tag on destination ports 3389 and 22. For DB-Subnet, add an inbound NSG rule allowing traffic from the `VirtualNetwork` service tag on destination ports 3389 and 22.
The correct configuration establishes the necessary data path between the Bastion host and the peered spoke virtual machines. The Azure Bastion host initiates RDP (3389) and SSH (22) sessions outbound to target VMs. Therefore, `AzureBastionSubnet` requires an outbound rule allowing destination `VirtualNetwork` on ports 3389 and 22. In turn, the target spoke subnet (DB-Subnet) must allow inbound RDP/SSH traffic from the hub virtual network, which is represented by the `VirtualNetwork` service tag.

Step-by-Step Solution

1
Analyze Azure Bastion communication architecture in a peered network setup.
Azure Bastion connects to target VMs using RDP (port 3389) and SSH (port 22) through the virtual network peering connection.
Understanding the port requirements for the data path is necessary to determine the correct security rule rules.
2
Determine the required outbound NSG rule for the Bastion host subnet (`AzureBastionSubnet`).
An outbound rule allowing traffic to destination service tag `VirtualNetwork` on ports 3389 and 22 is required.
The `VirtualNetwork` service tag includes local and peered virtual networks, allowing Bastion to initiate RDP/SSH connections to spoke VMs.
3
Determine the required inbound NSG rule for the target subnet (DB-Subnet) in the spoke VNet.
An inbound rule allowing traffic from source service tag `VirtualNetwork` (or the specific hub Bastion subnet prefix) on ports 3389 and 22 is required.
The target VMs must accept incoming connection requests from the Bastion host on standard management ports.

Key Concept

Azure Bastion uses RDP (3389) and SSH (22) to connect to target virtual machines. In a peered virtual network configuration, the Network Security Groups (NSGs) for both the Bastion subnet and the target VM subnet must permit this outbound and inbound traffic using the `VirtualNetwork` service tag.
Question 1013Question →

A company runs a network architecture in Microsoft Azure. The layout consists of a virtual network named `VNet-Corp` (192.168.0.0/16192.168.0.0/16) with three subnets: `Subnet-App` (192.168.1.0/24192.168.1.0/24), `Subnet-Db` (192.168.2.0/24192.168.2.0/24), and `Subnet-NVA` (192.168.100.0/24192.168.100.0/24). A firewall appliance named `NVA1` is placed in `Subnet-NVA` with a private IP address of 192.168.100.4192.168.100.4.

You must ensure that all network packets originating from the application tier (`Subnet-App`) and destined for the database tier (`Subnet-Db`) are inspected by `NVA1`.

Which two actions should you perform? (Each correct answer presents part of the solution.)

Select all that apply

Show answer & explanation

Answer: Enable IP forwarding on the network interface of `NVA1`.; Create a route table, add a route for destination 192.168.2.0/24192.168.2.0/24 with a next hop type of Virtual appliance and IP address 192.168.100.4192.168.100.4, and associate the route table with `Subnet-App`.

Answer

Enable IP forwarding on the network interface of `NVA1`, and create a route table containing a route for destination 192.168.2.0/24192.168.2.0/24 with a next hop type of Virtual appliance and IP address 192.168.100.4192.168.100.4, then associate the route table with `Subnet-App`.
To route traffic from a subnet through a Network Virtual Appliance (NVA), you must create a route table with a User-Defined Route (UDR) pointing to the NVA's IP address. The next hop type must be set to 'Virtual appliance' to ensure Azure correctly forwards the packets to the NVA's private IP. Additionally, because the NVA will receive traffic destined for a different IP address (the database subnet), you must enable IP forwarding on the NVA's network interface (NIC) so that the operating system inside the NVA can forward the traffic to its final destination rather than dropping it.

Step-by-Step Solution

1
Identify the target destination range and next-hop NVA IP address.
The target destination subnet is `Subnet-Db` (192.168.2.0/24192.168.2.0/24), and the next-hop IP address is the NVA's interface (192.168.100.4192.168.100.4).
Creating a User-Defined Route requires identifying the specific destination traffic range to intercept and the precise IP address of the device that will process the traffic.
2
Configure the custom routing table and route.
A route table is created with a route entry specifying destination 192.168.2.0/24192.168.2.0/24, next hop type 'Virtual appliance', and next hop IP address 192.168.100.4192.168.100.4. The route table is associated with `Subnet-App`.
This configuration overrides the default Azure system route that normally routes traffic directly between subnets within the same virtual network.
3
Enable IP forwarding on the network interface of `NVA1` in Azure.
IP forwarding is enabled on the Azure network interface resource associated with `NVA1`.
Azure network interfaces drop packets that have a destination IP address different from the IP address assigned to the interface. Enabling IP forwarding allows the NVA to receive and forward these packets.

Key Concept

Configuring user-defined routes to redirect subnet traffic through a network virtual appliance, requiring both a route table entry and IP forwarding enablement on the appliance's network interface.
Estimated Time:2m 0s
Question 1014Question →

An administrator needs to analyze subscription activity logs in a Log Analytics workspace. The administrator must identify all successful deletions of Azure resource locks that occurred within the last 14 days.

Which of the following KQL queries will return the correct results? (Select two.)

Select all that apply

Show answer & explanation

Answer: AzureActivity
| where TimeGenerated > ago(14d)
| where OperationNameValue =~ "Microsoft.Authorization/locks/delete"
| where ActivityStatusValue =~ "Success"; AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue contains "locks/delete" and ActivityStatusValue == "Success"

Answer

The KQL queries that correctly retrieve the successful deletions of resource locks in the last 14 days are the query using the ago(14d) function with case-insensitive operators (=~) and the query using the contains operator with a logical 'and' clause.
The correct queries successfully filter the logs using valid KQL syntax. The query that utilizes the =~ operator ensures case-insensitive matching for both the operation name and the success status, while referencing ago(14d) to limit the results to the last 14 days. The other correct query utilizes the contains operator to search for the substring 'locks/delete' and combines the conditions on a single line using the 'and' logical operator, which is functionally equivalent and syntactically valid.

Step-by-Step Solution

1
Filter by time range
Filter the rows using TimeGenerated and the ago(14d) function to capture events from the last 14 days.
Log Analytics stores the event timestamp in the TimeGenerated column, which must be compared to a datetime. The ago(14d) function returns the datetime representing 14 days ago.
2
Filter by operation type and status
Apply filters on OperationNameValue (using =~ or contains) and ActivityStatusValue (matching 'Success').
Resource lock deletions generate events under the operation name Microsoft.Authorization/locks/delete, and successful executions are marked as Success in the ActivityStatusValue column.
3
Apply valid KQL syntax
Ensure that the queries use correct operators (like project instead of select, and ago() instead of direct timespan values).
Using SQL keywords like select or comparing datetime to timespan values directly results in query compilation errors in Log Analytics.

Key Concept

Writing KQL queries to retrieve activity log events from a Log Analytics workspace using proper time, string comparison, and projection filters.
Question 1015Question →

You have an Azure virtual machine named VM-App10 running Windows Server 2025. The VM is backed up to a Recovery Services vault. A user accidentally deletes a folder on VM-App10. You need to recover the deleted folder by using the File Recovery feature. Which of the following represents the correct sequence of steps you must perform to recover the folder?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To perform file-level recovery from an Azure VM backup, you must first initiate File Recovery in the Azure portal and choose a recovery point. Next, download the recovery script and copy the generated password. Run the script on the local machine where you want to recover the files to mount the backup volumes. Copy the required folder from the mounted drives. Finally, unmount the disks in the Azure portal to end the recovery session.
The correct sequence starts with configuring the File Recovery session in the portal to generate the script and password. The administrator must then download the script and password, run the script on a machine to mount the backup disks, copy the target files, and finally unmount the disks in the portal to close the session.

Step-by-Step Solution

1
Select File Recovery in the Azure portal.
Initiates the file recovery session for the selected recovery point.
You must establish a recovery session in Azure to generate the script and password for mounting the backup disks.
2
Download the executable script and copy the generated password.
The script and credentials are made available on the local machine.
The script is required to perform the local mounting process, and the password is required to authenticate and decrypt the mounted volumes.
3
Run the script on the local machine.
The backup volumes are mounted as local drives.
The script establishes a secure iSCSI connection to mount the recovery point disks directly to the local machine.
4
Copy the deleted folder to the target location.
The folder is recovered.
Once the drives are mounted locally, they can be browsed like any standard local drive to retrieve files.
5
Unmount the disks in the Azure portal.
The recovery session is terminated and local drives are unmounted.
Unmounting the disks releases the resources and cleans up the active connection to the recovery point.

Key Concept

File recovery from Azure VM backups using the downloadable script mounts the backup disks locally via iSCSI, allowing users to copy individual files and folders before closing the recovery session.
Estimated Time:1m 30s
Question 1016Question →

An organization deploys two virtual machines across different resource groups:

* `VM-App-East` in resource group `RG-East`, located in the East US region.
* `VM-Web-West` in resource group `RG-West`, located in the West US region.

The environment also contains two Recovery Services vaults:

* `RSV-East` in resource group `RG-Backups`, located in the East US region.
* `RSV-West` in resource group `RG-Backups`, located in the West US region.

You need to configure backups for both virtual machines. Which two configurations should you use? (Select two.)

Select all that apply

Show answer & explanation

Answer: Back up `VM-App-East` to `RSV-East`; Back up `VM-Web-West` to `RSV-West`

Answer

Configure backup for the virtual machine in East US to use the Recovery Services Vault in East US, and configure backup for the virtual machine in West US to use the Recovery Services Vault in West US.
Azure virtual machines can only be backed up to a Recovery Services Vault that resides in the same region. Therefore, the virtual machine in East US must be backed up to the vault in East US, and the virtual machine in West US must be backed up to the vault in West US.

Step-by-Step Solution

1
Determine the region of the source virtual machines.
The application virtual machine is in East US and the web virtual machine is in West US.
Azure Recovery Services Vault backups are bound by regional constraints.
2
Verify the region of the available Recovery Services Vaults.
One vault is located in East US and the other vault is located in West US.
Target vaults must match the region of the resources they back up.
3
Align the resources with the correct vault based on their regional locations.
Associate the application virtual machine with the vault in East US, and associate the web virtual machine with the vault in West US.
This matches the regional requirement for Recovery Services Vault backup operations.

Key Concept

Azure Recovery Services Vaults require that target virtual machines and the vault reside in the same Azure region to configure and perform backups.
Question 1017Question →

An organization deploys three virtual networks in the West US region:

* VNet-Sales with address space 172.20.10.0/24172.20.10.0/24. VM-Sales is deployed in a subnet within VNet-Sales.
* VNet-Hub with address space 172.20.0.0/24172.20.0.0/24. VNet-Hub contains no virtual machines or gateways.
* VNet-Finance with address space 172.20.20.0/24172.20.20.0/24. VM-Finance is deployed in a subnet within VNet-Finance.

You configure a bidirectional virtual network peering between VNet-Sales and VNet-Hub. You also configure a bidirectional virtual network peering between VNet-Finance and VNet-Hub. There is no peering connection between VNet-Sales and VNet-Finance.

VM-Sales is unable to establish network communication with VM-Finance.

Which configuration change should you implement to allow VM-Sales to communicate directly with VM-Finance with the lowest latency?

Show answer & explanation

Answer: Configure a direct virtual network peering between VNet-Sales and VNet-Finance.

Answer

Configure a direct virtual network peering between VNet-Sales and VNet-Finance.
Establishing a direct virtual network peering between the two spoke networks (VNet-Sales and VNet-Finance) is the correct solution. Since Azure virtual network peering is non-transitive, traffic cannot route from one spoke to another through a hub network unless a virtual network gateway or a Network Virtual Appliance (NVA) is configured in the hub network to route the traffic. Direct peering provides the lowest latency and does not require additional routing resources.

Step-by-Step Solution

1
Analyze the current network topology and identify connectivity limitations.
Identify that VNet-Sales is peered with VNet-Hub, and VNet-Finance is peered with VNet-Hub, but there is no peering between VNet-Sales and VNet-Finance.
To understand why VM-Sales cannot communicate with VM-Finance.
2
Recall the transitivity properties of Azure Virtual Network Peering.
Recognize that VNet peering is non-transitive, meaning traffic cannot traverse from VNet-Sales to VNet-Finance via VNet-Hub without a routing appliance or gateway.
To determine why the current hub-and-spoke configuration prevents direct communication.
3
Identify the configuration that provides the lowest latency direct communication path.
Determine that establishing a direct virtual network peering between VNet-Sales and VNet-Finance connects the spokes directly.
Direct peering routes traffic over the Microsoft backbone network with optimal latency and without needing intermediate virtual appliances.

Key Concept

Azure Virtual Network Peering is non-transitive. Direct peering between two virtual networks is required for direct low-latency communication unless transitive routing is established through a gateway or Network Virtual Appliance (NVA).
Estimated Time:1m 30s
Question 1018Question →

An administrator is configuring a new Azure Kubernetes Service (AKS) cluster in an existing virtual network. The corporate network security team requires that all pods receive IP addresses that are directly routable within the virtual network. However, to conserve IP address space, the subnet allocated for the AKS cluster nodes is limited to a /24/24 prefix, while a large number of pods must run on the cluster. Which AKS network configuration should you select to meet these requirements?

Show answer & explanation

Answer: Azure CNI with dynamic pod IP allocation

Answer

Azure CNI with dynamic pod IP allocation
Azure CNI with dynamic pod IP allocation solves the IP exhaustion issue by deploying nodes and pods in separate subnets. The nodes subnet can be small (such as a /24/24 subnet), while the pods are allocated IPs from a larger, separate subnet. Because both subnets are part of the virtual network, the pod IP addresses remain directly routable within the virtual network.

Step-by-Step Solution

1
Analyze the networking requirements for the AKS cluster
The pods must have IP addresses that are directly routable in the virtual network, and the node subnet is limited to a /24/24 prefix.
Direct routability requires Azure CNI instead of Kubenet or Overlay models, but standard Azure CNI on a single /24/24 subnet will cause IP exhaustion.
2
Evaluate Azure CNI with dynamic pod IP allocation
This model separates node and pod subnets, allowing pod IPs to be dynamically allocated from a different, larger subnet.
By using a separate subnet for pods, the node subnet does not run out of IP addresses, and pods still receive directly routable IPs from the virtual network space.

Key Concept

Azure Kubernetes Service (AKS) network models and IP address planning
Question 1019Question →

You are configuring diagnostic settings for a Recovery Services vault named Vault1 to enable Azure Backup Reports. You target a Log Analytics workspace and select the Resource-specific option.

Which of the following log categories must you enable to report on backup jobs and backup policies? Select two.

Select all that apply

Show answer & explanation

Answer: AddonAzureBackupJobs; AddonAzureBackupPolicy

Answer

To configure Azure Backup Reports using resource-specific settings, you must enable the AddonAzureBackupJobs and AddonAzureBackupPolicy log categories.
Azure Backup Reports require specific diagnostic logs from the Recovery Services vault to populate the reporting tables. When using the Resource-specific schema, the AddonAzureBackupJobs category is needed to monitor backup job executions, and the AddonAzureBackupPolicy category is needed to monitor policy details.

Step-by-Step Solution

1
In the Azure portal, navigate to the Recovery Services vault and open Diagnostic settings.
You can view existing settings or add a new one.
Vault data must be sent to a destination to be available for reporting.
2
Add a diagnostic setting, choose a Log Analytics workspace, and select Resource-specific.
The destination is configured for resource-specific tables.
Resource-specific mode is recommended for Azure Backup Reports.
3
Select the checkboxes for AddonAzureBackupJobs and AddonAzureBackupPolicy.
The specified logs are configured to stream to the workspace.
These categories provide the necessary telemetry for jobs and policies in the Backup Reports workbook.

Key Concept

Resource-specific Diagnostic Settings log categories for Azure Backup Reports
Question 1020Question →

You manage an Azure environment that includes a Recovery Services vault named `rsv-prod-eastus` in the East US region. Your department has a Premium storage account named `stfinprod` in the East US region. This storage account hosts two file shares:

1. `sharesmb` - an SMB-based file share.
2. `sharenfs` - an NFS-based file share.

The networking configuration of `stfinprod` has firewalls and virtual networks enabled, with access restricted to selected networks only. An administrator named Admin1 needs to configure Azure Backup for the file shares in `stfinprod` using the existing Recovery Services vault. Currently, Admin1 has only the `Backup Operator` role assigned on `rsv-prod-eastus` and the `Reader` role assigned on `stfinprod`.

You need to ensure that Admin1 can configure the backup successfully while maintaining the firewall restrictions on the storage account.

Which three of the following actions should you perform? (Select three.)

Select all that apply

Show answer & explanation

Answer: In the firewall settings of `stfinprod`, enable the option to allow trusted Microsoft services to access the storage account.; Assign Admin1 the `Storage Account Contributor` role on `stfinprod` and the `Backup Contributor` role on `rsv-prod-eastus`.; Configure backup only for the `sharesmb` file share, as Azure Backup does not support backups for NFS file shares.

Answer

To configure the backup, you must enable the trusted Microsoft services bypass on the storage account firewall, assign the Storage Account Contributor role on the storage account and the Backup Contributor role on the Recovery Services vault to the administrator, and target only the SMB-based file share since NFS-based file shares are not supported by Azure Backup.
To configure backup for the file share under network and permission constraints, you must configure the storage account's firewall to allow trusted Microsoft services to access it, which permits Azure Backup to orchestrate snapshots. You must also assign management plane roles (Storage Account Contributor on the storage account and Backup Contributor on the vault) to enable the administrator to configure the policy and register the resource. Finally, you can only protect the SMB share, as Azure Backup does not support NFS shares.

Step-by-Step Solution

1
Determine protocol support for Azure Files Backup.
Identify that only the SMB file share can be backed up because Azure Backup does not support NFS file shares.
This establishes which resource is eligible for registration and prevents configuration errors due to protocol incompatibility.
2
Address network restrictions on the storage account.
Configure the storage account firewall to allow trusted Microsoft services.
This allows the Azure Backup service to communicate with the storage account and manage snapshots while keeping the public network access restricted to selected networks.
3
Elevate permissions on the Recovery Services vault.
Assign the Backup Contributor role to the administrator.
The Backup Operator role only permits triggering backups and restores; configuring backup policies and registering storage accounts requires Backup Contributor or Owner permissions.
4
Configure management plane permissions on the storage account.
Assign the Storage Account Contributor role to the administrator.
Registering the storage account with the Recovery Services vault writes registration metadata to the storage account, which requires control plane write permissions.

Key Concept

Azure Files Backup configuration requirements, including protocol limitations, firewall bypass settings, and RBAC control plane requirements.
PreviousPage 51 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin