All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

To route spoke-to-spoke traffic through a firewall, a network engineer deploys three Azure virtual networks:

* VNet-Transit ( $172.16.0.0/16$ ) contains a Network Virtual Appliance (NVA) in its subnet to act as a router.
* VNet-App ( $172.30.0.0/16$ ) contains application virtual machines.
* VNet-Data ( $192.168.50.0/24$ ) contains database virtual machines.

The engineer establishes peering between VNet-App and VNet-Transit, and between VNet-Data and VNet-Transit. No direct peering exists between VNet-App and VNet-Data.

Route tables containing user-defined routes (UDRs) are applied to the subnets in VNet-App and VNet-Data to direct traffic destined for the other spoke to the NVA's private IP address.

To ensure that the virtual machines in VNet-App and VNet-Data can successfully communicate, which configuration is required on the virtual network peering links?

Enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit.

Enable 'Allow gateway transit' on the peering connections within VNet-Transit and select 'Use remote gateways' on VNet-App and VNet-Data.

Enable 'Allow forwarded traffic' only on the peering connections within VNet-Transit pointing to VNet-App and VNet-Data.

Configure the next hop type as 'Virtual Network Gateway' in the route tables assigned to the subnets in VNet-App and VNet-Data.

Show answer & explanation

Answer: Enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit.

Answer

Enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit.

The correct option is to enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit. Because the NVA in VNet-Transit forwards packets that originate from outside VNet-Transit (e.g., from VNet-App to VNet-Data), the destination virtual networks must be configured to allow forwarded traffic. Otherwise, Azure will drop these packets.

Step-by-Step Solution

Analyze the traffic path between the two spokes.

Traffic from VNet-App destined for VNet-Data goes to the NVA in VNet-Transit, which then forwards the packets to VNet-Data. The return path is the reverse.

Understanding the packet flow helps identify where peering settings are evaluated.

Identify the nature of the forwarded traffic arriving at the destination virtual networks.

When VNet-Data receives packets from the peering link with VNet-Transit, the packets have a source IP from VNet-App. Since the source IP does not belong to VNet-Transit, Azure classifies this as forwarded traffic.

Azure blocks forwarded traffic by default unless explicitly allowed.

Determine the correct peering setting to allow forwarded traffic on the receiving virtual networks.

The 'Allow forwarded traffic' (or allowForwardedTraffic: true) setting must be enabled on VNet-App's peering link to VNet-Transit and VNet-Data's peering link to VNet-Transit.

This allows both spoke virtual networks to accept packets forwarded by the NVA in the hub.

Key Concept

Virtual network peering does not support transitive routing by default. To route traffic between two spokes through a Network Virtual Appliance in a hub VNet, you must use User-Defined Routes and enable the 'Allow forwarded traffic' setting on the peerings in the spoke VNets.

Question 1042Question →

You are deploying a single Azure Application Gateway v2 to host two web applications: billing.contoso.com and claims.contoso.com. Both applications must share a single public IP address on the gateway, but traffic must be routed to separate backend pools: BillingPool and ClaimsPool. You need to configure the Application Gateway listeners and routing rules to ensure traffic is correctly directed to the appropriate backend pool. Which configuration should you implement?

Create two multi-site listeners, one for billing.contoso.com and another for claims.contoso.com, and configure two basic routing rules to associate each listener with its respective backend pool.

Create a single basic listener configured for the public IP address, and configure a path-based routing rule that routes traffic based on HTTP Host headers.

Create a single multi-site listener with the host name set to *.contoso.com, and configure a single basic routing rule with a redirection configuration to the backend pools.

Create two multi-site listeners, one for billing.contoso.com and another for claims.contoso.com, and configure a single path-based routing rule that references both listeners.

Show answer & explanation

Answer: Create two multi-site listeners, one for billing.contoso.com and another for claims.contoso.com, and configure two basic routing rules to associate each listener with its respective backend pool.

Answer

Create two multi-site listeners, one for billing.contoso.com and another for claims.contoso.com, and configure two basic routing rules to associate each listener with its respective backend pool.

Configuring separate multi-site listeners allows the Application Gateway to route traffic based on the Host header of incoming requests. Since each listener must be linked to its own backend pool, two separate routing rules are required to complete the configuration.

Step-by-Step Solution

Create two backend pools: BillingPool and ClaimsPool.

The backend pools are provisioned and ready to receive traffic.

The gateway needs targets to route traffic to for each application.

Configure two multi-site listeners, one with host name billing.contoso.com and the other with claims.contoso.com.

The Application Gateway is configured to listen for requests arriving on the single public IP address with specific Host headers.

Multi-site listeners evaluate the HTTP Host header of incoming requests to distinguish between different domains.

Create two basic routing rules to link each listener to its corresponding backend pool.

Requests for billing.contoso.com are forwarded to BillingPool, and requests for claims.contoso.com are forwarded to ClaimsPool.

Each listener must have its own routing rule to map requests to the correct backend pool.

Key Concept

Multi-site hosting and routing configuration on Azure Application Gateway

Estimated Time:1m 30s

Question 1043Question →

An administrator is designing a backup strategy for an Azure subscription that contains the resources listed in the following table:

Resource Name	Resource Type	Region	Resource Group
VM-Alpha	Virtual Machine	East US	RG-A
VM-Beta	Virtual Machine	West US	RG-B
share-delta	Azure Files Share	East US	RG-A
db-pg-01	Azure Database for PostgreSQL	West US	RG-B

The administrator needs to back up all four resources. Which two actions should the administrator perform to implement a supported backup vault configuration?

Select all that apply

Create a Recovery Services Vault in the East US region to protect VM-Alpha and share-delta.

Create a Backup Vault in the West US region to protect db-pg-01.

Create a single Recovery Services Vault in the East US region to protect VM-Alpha, VM-Beta, and share-delta.

Create a Backup Vault in the East US region to protect VM-Alpha and share-delta.

Create a Recovery Services Vault in the West US region to protect db-pg-01.

Show answer & explanation

Answer: Create a Recovery Services Vault in the East US region to protect VM-Alpha and share-delta.; Create a Backup Vault in the West US region to protect db-pg-01.

Answer

Create a Recovery Services Vault in the East US region to protect VM-Alpha and share-delta, and create a Backup Vault in the West US region to protect db-pg-01.

Creating a Recovery Services Vault in the East US region is correct because VM-Alpha and share-delta are both in the East US region and are supported by Recovery Services Vaults. Creating a Backup Vault in the West US region is correct because db-pg-01 is an Azure Database for PostgreSQL instance in the West US region, which is supported by Backup Vaults.

Step-by-Step Solution

Analyze workload compatibility for Recovery Services Vaults and Backup Vaults.

Recovery Services Vaults support Azure Virtual Machines and Azure Files. Backup Vaults support Azure Database for PostgreSQL.

Each vault type has a distinct set of supported data sources.

Determine the regional constraints for the Recovery Services Vault target resources.

VM-Alpha and share-delta are in the East US region, meaning they can share a Recovery Services Vault in East US. VM-Beta is in West US, so it cannot be backed up to the East US vault.

Azure VM and Azure Files backups must be stored in a Recovery Services Vault located in the same region as the source resources.

Determine the vault type and regional requirements for the database.

db-pg-01 is an Azure Database for PostgreSQL instance in West US, requiring a Backup Vault in the West US region.

PostgreSQL backups require a Backup Vault, and the vault must reside in the same region as the database.

Key Concept

Recovery Services Vaults are used for VM and file share backups within the same region, while Backup Vaults are used for workloads like Azure Database for PostgreSQL within the same region.

Question 1044Question →

An Azure subscription contains the following resources:
* A virtual machine named `VM-Web-Prod` in `East US 2`
* A virtual machine named `VM-App-Dev` in `West US`
* A Recovery Services Vault named `Vault-West` in `West US`
* A Backup Vault named `Vault-East` in `East US 2`

You need to back up `VM-Web-Prod` by using Azure Backup. Which action should you perform?

Create a new Recovery Services Vault in the East US 2 region.

Configure the backup of VM-Web-Prod to use Vault-West.

Configure the backup of VM-Web-Prod to use Vault-East.

Move VM-Web-Prod to the West US region and use Vault-West.

Show answer & explanation

Answer: Create a new Recovery Services Vault in the East US 2 region.

Answer

Create a new Recovery Services Vault in the East US 2 region.

To back up an Azure Virtual Machine, you must use a Recovery Services Vault, and the vault must reside in the same region as the virtual machine. Because the target virtual machine is in East US 2 and the only existing Recovery Services Vault is in West US, you must create a new Recovery Services Vault in East US 2.

Step-by-Step Solution

Determine the resource type and vault compatibility.

Azure Virtual Machines require a Recovery Services Vault for backup.

Backup Vaults do not support backing up Azure Virtual Machines; they support other workloads like Azure Disks and Blobs.

Check the regional requirements for Azure VM backup.

The Recovery Services Vault must be in the same region as the virtual machine.

Azure Backup does not support backing up a virtual machine to a vault in another region.

Determine the required resource to create.

Since there is no Recovery Services Vault in East US 2, a new Recovery Services Vault must be created in East US 2.

This configuration meets both the vault type requirement and the regional constraint.

Key Concept

To back up an Azure Virtual Machine, you must deploy a Recovery Services Vault in the same region as the virtual machine.

Question 1045Question →

An organization plans to host a customer feedback portal on Azure App Service. The deployment must satisfy the following technical requirements:
- Enable automatic scale-out of the application up to five instances based on average CPU utilization.
- Provide a staging environment to validate application updates before swapping them to the production slot.
- Support automated daily backups of the application's configuration and content.

Which App Service plan pricing tier is the most cost-effective option that meets all the requirements?

P1v3

Show answer & explanation

Answer: S1

Answer

S1 is the most cost-effective App Service plan pricing tier that supports autoscaling, staging slots, and daily backups.

The S1 (Standard) tier is the lowest pricing tier that supports automatic scale-out (up to 10 instances), deployment slots (up to 5 slots), and daily backups (up to 10 daily backups).

Step-by-Step Solution

Analyze the scaling requirement.

Autoscaling (automatic scale-out based on metrics) is supported in the Standard (S1) tier and above. The Basic (B1) and Shared (D1) tiers only support manual scaling.

Filter out tiers that cannot meet the automated scaling requirement.

Analyze the deployment slots requirement.

Deployment slots (staging slots) are supported starting from the Standard (S1) tier (up to 5 slots) and above. Basic (B1) and Shared (D1) tiers do not support deployment slots.

Ensure pre-production validation is supported before swapping into production.

Analyze the backup requirement.

Automated backups are supported in the Standard (S1) tier (up to 10 backups per day) and above. The Basic (B1) and Shared (D1) tiers do not support automated backups.

Confirm backup capabilities for the customer feedback portal.

Select the most cost-effective tier that satisfies all requirements.

Both S1 and P1v3 satisfy all requirements. S1 is the lower-cost tier compared to P1v3.

Fulfill the requirement of selecting the most cost-effective pricing tier.

Key Concept

Azure App Service plan tier capabilities

Question 1046Question →

An administrator needs to query the AzureActivity table in a Log Analytics workspace to identify all failed attempts to write (create or update) virtual machines under the Microsoft.Compute resource provider. The analysis must cover only the last seven days. The results must display the time the operation occurred, the email address of the caller, and the associated resource group, sorted in descending order by the event time.

Which Kusto Query Language (KQL) query should the administrator run?

AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue == 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue == 'Failed'
| project TimeGenerated, Caller, ResourceGroup
| order by TimeGenerated desc

AzureActivity
| where TimeGenerated > ago(7d)
| project TimeGenerated, Caller, ResourceGroup
| where OperationNameValue == 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue == 'Failed'
| order by TimeGenerated desc

AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue = 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue = 'Failed'
| project TimeGenerated, Caller, ResourceGroup
| order by TimeGenerated desc

SELECT TimeGenerated, Caller, ResourceGroup
FROM AzureActivity
WHERE TimeGenerated > ago(7d)
AND OperationNameValue = 'Microsoft.Compute/virtualMachines/write'
AND ActivityStatusValue = 'Failed'
ORDER BY TimeGenerated DESC

Show answer & explanation

Answer: AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue == 'Microsoft.Compute/virtualMachines/write' and ActivityStatusValue == 'Failed'
| project TimeGenerated, Caller, ResourceGroup
| order by TimeGenerated desc

Answer

The correct query is the one that filters the AzureActivity logs by time and failure status, projects the required columns, and then sorts them by time using KQL pipeline operators in the correct order.

The correct query uses KQL operators in the proper sequence: it first filters the data using where, then prunes columns using project, and finally orders the data using order by. The filters use the KQL double equals (==) operator to check for value matching.

Step-by-Step Solution

Filter log data early in the pipeline

Limits rows to the last 7 days using the ago(7d) function and filters for virtual machine write failures.

Filtering early reduces memory overhead and ensures that necessary columns are available before projection.

Project target columns

Retains only the TimeGenerated, Caller, and ResourceGroup columns in the data pipeline.

This fulfills the output requirement of presenting only these three columns.

Sort the results

Orders the projected data by TimeGenerated in descending order.

Sorting in descending order presents the most recent events first.

Key Concept

KQL query syntax, pipeline ordering, and operator usage in Log Analytics

Question 1047Question →

An Azure administrator is designing the routing for a virtual network named `VNet-Internal` ( $172.30.0.0/16$ ). The virtual network contains the following subnets:

* `Subnet-Web` ( $172.30.10.0/24$ )
* `Subnet-App` ( $172.30.20.0/24$ )
* `Subnet-DMZ` ( $172.30.30.0/24$ )

A virtual appliance named `NVA-Firewall` is deployed in `Subnet-DMZ` and is assigned the private IP address $172.30.30.5$ . IP forwarding is disabled on the network interface of `NVA-Firewall`.

You assign a custom route table named `RT-Web` to `Subnet-Web`. The route table contains the following rules:

* Route 1: Destination address prefix $172.30.20.0/24$ ; Next hop type: Virtual appliance; Next hop IP address $172.30.30.5$
* Route 2: Destination address prefix $172.30.0.0/16$ ; Next hop type: None

A virtual machine in `Subnet-Web` attempts to initiate a TCP connection to a server in `Subnet-App` at the IP address $172.30.20.15$ .

What will happen to this network traffic?

The traffic will be sent to the network interface of the virtual appliance and then discarded.

The traffic will be discarded at the subnet level before leaving the source subnet.

The traffic will bypass the user-defined routes and be delivered directly to the server using the default system route.

The traffic will be forwarded to the Virtual Network Gateway for routing.

Show answer & explanation

Answer: The traffic will be sent to the network interface of the virtual appliance and then discarded.

Answer

The traffic will be sent to the network interface of the virtual appliance and then discarded.

The traffic will be forwarded to the virtual appliance because the user-defined route for the application subnet is a more specific match than the route for the entire virtual network. Since IP forwarding is disabled on the network interface of the virtual appliance, the interface will discard any packets not addressed to its own IP address.

Step-by-Step Solution

Determine the applicable routes for the destination IP address

172.30.20.15

from `Subnet-Web`.

The two matching routes in the route table are Route 1 (

172.30.20.0/24

) and Route 2 (

172.30.0.0/16

Both routes cover the destination IP address, but Route 1 has a more specific prefix.

Apply the Longest Prefix Match (LPM) rule to select the active route.

Route 1 (

172.30.20.0/24

) takes precedence over Route 2 (

172.30.0.0/16

Azure uses the most specific route prefix (longest prefix match) to forward traffic.

Analyze the next hop behavior and NVA configuration.

Traffic is forwarded to the next hop IP

172.30.30.5

. However, since the network interface of the virtual appliance does not have IP forwarding enabled, it drops the packets.

A network interface on an Azure VM drops packets destined for other IP addresses unless IP forwarding is explicitly enabled on that interface.

Key Concept

User-defined route precedence, Longest Prefix Match (LPM), and the requirement for IP forwarding on NVAs.

Question 1048Question →

Your company is deploying a new Azure Kubernetes Service (AKS) cluster named aks-billing to host a financial application. You must configure the cluster to use the Azure CNI network model where nodes and pods share the same subnet.

The deployment configuration has the following parameters:
* Initial node count: 4
* Maximum pods per node: 20

Excluding the standard five IP addresses reserved by Azure, what is the minimum number of IP addresses that must be available in the subnet to support the cluster nodes, pods, and rolling upgrades?

105

Show answer & explanation

Answer: 105

Answer

105

The correct calculation for the minimum IP addresses required by an Azure CNI cluster in a single subnet is based on the formula

(N + 1) + ((N + 1) \times M)

, where

N

is the number of nodes and

M

is the maximum number of pods per node. For 4 nodes and 20 pods per node, this equals

(4 + 1) + ((4 + 1) \times 20) = 5 + 100 = 105

. This ensures that the subnet has sufficient IP addresses for the initial nodes, their pods, and an additional surge node with its pods during rolling upgrades.

Step-by-Step Solution

Identify the network model and the formula for Azure CNI IP planning.

The network model is Azure CNI. The formula to calculate required IP addresses is

(N + 1) + ((N + 1) \times M)

, where

N

represents the initial number of nodes, and

M

represents the maximum number of pods per node.

Azure CNI pre-allocates IP addresses for all pods on every node, including an additional node (surge node) created during upgrades.

Substitute the given values into the formula:

N = 4

nodes and

M = 20

pods per node.

Calculation:

(4 + 1) + ((4 + 1) \times 20) = 5 + (5 \times 20) = 5 + 100 = 105

This computes the sum of the total nodes (including the upgrade node) and the total pre-allocated pod IP addresses for those nodes.

Verify if the question excludes Azure reserved IPs and determine the final minimum requirement.

The question specifically asks for the requirement excluding the five standard reserved IPs, so the final count is 105.

Azure reserves 5 IP addresses per subnet, which would increase the required subnet size but are not part of the active cluster IP footprint calculated here.

Key Concept

IP address planning for Azure Kubernetes Service (AKS) using the Azure CNI network model

Question 1049Question →

An administrator is configuring virtual network peering to establish connectivity across three Azure virtual networks in the same region:
* VNet-App (address space $10.150.0.0/16$ ) containing a virtual machine named VM-App.
* VNet-Hub (address space $10.160.0.0/16$ ) containing a virtual machine named VM-Hub.
* VNet-DB (address space $10.170.0.0/16$ ) containing a virtual machine named VM-DB.

The administrator configures a virtual network peering between VNet-App and VNet-Hub, and another peering between VNet-Hub and VNet-DB. No user-defined routes (UDRs) or virtual network gateways are deployed.

Statement: VM-App can successfully establish a direct connection to VM-DB over the peered networks.

Is this statement true or false?

True

False

Show answer & explanation

Answer: False

Answer

False

The correct answer is False because virtual network peering is non-transitive by default. Spoke virtual networks cannot communicate with each other through a hub virtual network unless a routing appliance is introduced or a direct peering link is configured between the spokes.

Step-by-Step Solution

Analyze the peering topology.

VNet-App is peered with VNet-Hub, and VNet-Hub is peered with VNet-DB. No direct peering link exists between VNet-App and VNet-DB.

Understanding the layout of virtual network peerings is necessary to evaluate the default path routing behavior.

Evaluate the transit behavior of default Azure virtual network peering.

Virtual network peering is non-transitive, meaning VNet-Hub will not automatically forward packets between VNet-App and VNet-DB.

This is a core constraint of Azure virtual networking designed to prevent unauthorized transit routing.

Determine the connection status between VM-App and VM-DB.

Because peering is non-transitive and no gateway or NVA routing is configured, VM-App cannot establish a direct connection to VM-DB.

Evaluating final connectivity under the default configuration yields the answer.

Key Concept

Transitive routing limitations in Virtual Network Peering

Question 1050Question →

A virtual machine named `VM-Web1` is associated with an Application Security Group named `ASG-ProdWeb` within an Azure environment. The subnet hosting `VM-Web1` uses a Network Security Group named `NSG-Subnet`. The network interface of `VM-Web1` uses a Network Security Group named `NSG-NIC`.

`NSG-Subnet` contains the following inbound security rule:

Priority	Port	Protocol	Source	Destination	Action
150	443	TCP	Internet	Any	Allow

`NSG-NIC` contains the following inbound security rules:

Priority	Port	Protocol	Source	Destination	Action
110	443	TCP	Any	`ASG-ProdWeb`	Deny
120	443	TCP	Internet	Any	Allow

A user attempts to establish an HTTPS (TCP port 443) connection from the Internet to `VM-Web1`.

Which of the following describes the final status of this connection attempt?

Traffic is permitted to reach the virtual machine because the subnet security group rule is evaluated first and grants access.

Traffic is blocked at the network interface level by the security rule with priority 110.

Traffic is permitted to reach the virtual machine because the allow rule with priority 120 overrides the deny rule with priority 110.

Traffic is blocked at the subnet level because subnet-level rules always take precedence over network interface-level rules.

Show answer & explanation

Answer: Traffic is blocked at the network interface level by the security rule with priority 110.

Answer

Traffic is blocked at the network interface level by the security rule with priority 110.

Inbound traffic to an Azure virtual machine is evaluated first by the subnet-level NSG and then by the network interface-level NSG. In this scenario, the subnet NSG allows the traffic (priority 150). Next, the network interface NSG evaluates the traffic. Within the network interface NSG, rules are processed by priority from lowest number to highest. The rule with priority 110 (Deny to the Application Security Group) is evaluated before the rule with priority 120 (Allow). Since the destination virtual machine is a member of that Application Security Group, the deny rule matches first and blocks the traffic.

Step-by-Step Solution

Evaluate the inbound traffic against the subnet-level Network Security Group (`NSG-Subnet`).

The traffic is permitted because the rule with priority 150 matches the inbound HTTPS traffic from the Internet and allows it.

For inbound traffic, Azure evaluates the subnet-level NSG before the network interface-level NSG.

Evaluate the inbound traffic against the network interface-level Network Security Group (`NSG-NIC`) starting with the rule that has the lowest priority number.

The rule with priority 110 is evaluated first because 110 is less than 120.

Azure processes NSG rules in order of priority, where lower numbers have higher precedence (higher logical priority).

Determine if the rule with priority 110 matches the inbound traffic to `VM-Web1`.

The traffic matches because the destination is `VM-Web1` (associated with the network interface in `ASG-ProdWeb`) and the port is 443, resulting in the traffic being denied.

Application Security Groups (ASGs) allow grouping network interfaces to apply security rules, and since `VM-Web1`'s network interface is associated with `ASG-ProdWeb`, this rule is matched.

Key Concept

Evaluation order of subnet-level and network interface-level Network Security Groups (NSGs), and rule precedence based on priority numbers.

Question 1051Question →

You plan to configure an Azure Application Gateway v2 to support end-to-end TLS encryption. The backend pool contains web servers that use a self-signed TLS certificate.

You need to configure the Application Gateway to ensure that all traffic from clients to the backend servers is encrypted using TLS.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps starts with exporting the public key certificate (.cer) from the backend servers, uploading it to the Application Gateway to establish a trusted root certificate, configuring HTTPS backend settings with that certificate, creating an HTTPS listener with a frontend certificate (.pfx), and finally linking these components with a request routing rule.

To configure end-to-end TLS on Azure Application Gateway v2 with self-signed backend certificates, you must first export the backend public key (.cer) and upload it to the gateway as a trusted root certificate. This allows you to configure HTTPS backend settings. You then configure the frontend listener using an HTTPS listener with a private key certificate (.pfx) to decrypt client traffic. Finally, you bind these together using a request routing rule.

Step-by-Step Solution

Export the public key of the self-signed certificate from the backend servers as a .cer file.

You obtain the public certificate required by the gateway to trust the backend.

Azure Application Gateway v2 requires the public key of the self-signed backend certificate to validate the TLS connection to the backend.

Upload the exported .cer certificate to the Application Gateway to create a trusted root certificate.

The trusted root certificate is created and registered on the gateway.

The certificate must be defined on the gateway before it can be associated with backend settings.

Create HTTPS backend settings and select the uploaded trusted root certificate.

The backend settings are configured to use HTTPS and trust the backend servers.

This establishes secure communication from the Application Gateway to the backend servers.

Create an HTTPS listener, upload the frontend certificate (.pfx file), and bind it to port 443.

The gateway is configured to accept secure client requests.

A certificate with a private key (.pfx) is required to decrypt client requests at the gateway level.

Create a request routing rule that links the HTTPS listener, the backend pool, and the HTTPS backend settings.

The end-to-end traffic flow is established and traffic is correctly routed.

The routing rule ties all configurations together to direct incoming HTTPS traffic to the backend pool using HTTPS.

Key Concept

Azure Application Gateway v2 requires both a frontend TLS certificate (.pfx) for the listener and a backend trusted root certificate (.cer) for the backend settings to achieve end-to-end TLS encryption with self-signed backend certificates.

Question 1052Question →

You manage the Azure infrastructure for an organization with resources distributed across two subscriptions. The resources are configured as shown in the following table:

Subscription	Resource Group	Resource Name	Resource Type	Region
Subscription1	RG-App-Central	vm-app-prod	Virtual Machine	Central US
Subscription1	RG-App-Central	disk-app-data	Managed Disk	Central US
Subscription2	RG-Ops-East	rsv-backup-east	Recovery Services Vault	East US
Subscription2	RG-Ops-East	bv-ops-east	Backup Vault	East US

You need to configure a backup solution for the virtual machine vm-app-prod.

Which two actions should you perform? Select two.

Select all that apply

Create a new Recovery Services Vault in the Central US region.

Create a backup policy inside the new Recovery Services Vault in the Central US region.

Configure backup for vm-app-prod using the rsv-backup-east vault.

Configure backup for vm-app-prod using the bv-ops-east vault.

Show answer & explanation

Answer: Create a new Recovery Services Vault in the Central US region.; Create a backup policy inside the new Recovery Services Vault in the Central US region.

Answer

Create a new Recovery Services Vault in the Central US region and create a backup policy inside the new Recovery Services Vault in the Central US region.

To back up an Azure Virtual Machine, the virtual machine and the Recovery Services Vault must reside in the same geographical region. Because the virtual machine is in the Central US region and the existing Recovery Services Vault is in the East US region, you must create a new Recovery Services Vault in the Central US region. Additionally, a backup policy must be defined within the vault to complete the configuration.

Step-by-Step Solution

Identify the region of the virtual machine to be backed up.

The virtual machine vm-app-prod resides in the Central US region.

Azure Virtual Machine backups require the source VM and the target Recovery Services Vault to be in the same geographic region.

Evaluate the existing vaults for compatibility and location.

The existing Recovery Services Vault (rsv-backup-east) is in the East US region, making it incompatible. The existing Backup Vault (bv-ops-east) is in the East US region and does not support VM backups.

Azure VMs must be backed up using a Recovery Services Vault, and cross-region backups are not supported during initial backup configuration.

Determine the necessary administrative steps to enable backup in the correct location.

A new Recovery Services Vault must be provisioned in the Central US region, and a backup policy must be configured within that vault.

Creating the vault in the Central US region satisfies the regional constraint, and the backup policy is required to define schedule and retention.

Key Concept

Azure VM backups require a Recovery Services Vault located in the same region as the target virtual machine, and are not supported by Backup Vaults.

Question 1053Question →

A company plans to deploy an enterprise web application to Azure App Service. The application hosting environment must meet the following requirements:
- Integrate with an Azure Virtual Network (VNet) to access a backend database securely.
- Enable automated daily backups of the web application.
- Scale out to at least 15 instances to handle seasonal traffic spikes.

Which of the following App Service plan pricing tiers meet all these requirements? (Select two.)

Select all that apply

Premium V3 (P1v3)

Isolated V2 (I1v2)

Standard (S1)

Basic (B1)

Show answer & explanation

Answer: Premium V3 (P1v3); Isolated V2 (I1v2)

Answer

Premium V3 (P1v3) and Isolated V2 (I1v2)

The Premium V3 tier supports up to 30 instances, and the Isolated V2 tier supports up to 100 instances. Both tiers also support automated backups and regional VNet integration, satisfying all specified requirements.

Step-by-Step Solution

Analyze the scaling requirement.

The web application must be able to scale out to at least 15 instances. Standard tier plans support a maximum of 10 instances, and Basic tier plans support a maximum of 3 instances. Only Premium and Isolated tiers support scaling to 15 or more instances.

This requirement rules out the Standard and Basic pricing tiers.

Analyze the automated backup requirement.

The plan must support automated daily backups. Standard, Premium, and Isolated tiers support automated backups, while the Basic tier does not.

This requirement rules out the Basic tier.

Analyze the VNet integration requirement.

The plan must support regional VNet integration. Regional VNet integration is supported across the Basic, Standard, Premium, and Isolated tiers.

All evaluated tiers satisfy the VNet integration requirement, leaving Premium V3 and Isolated V2 as the only tiers that meet all constraints.

Key Concept

Azure App Service plan tier capabilities, specifically scaling limits and backup support.

Question 1054Question →

An administrator needs to monitor role-based access control (RBAC) changes in an Azure subscription. You must write a KQL query in Log Analytics to retrieve all logs from the AzureActivity table related to the creation or deletion of Azure RBAC role assignments over the last 14 days. The query must display the time the operation occurred, the user who initiated the action, and the operation name. Which two KQL queries should the administrator use to achieve this goal? (Select two.)

Select all that apply

AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue startswith "Microsoft.Authorization/roleAssignments"
| project TimeGenerated, Caller, OperationNameValue

AzureActivity
| where TimeGenerated > ago(14d)
| where OperationNameValue in ("Microsoft.Authorization/roleAssignments/write", "Microsoft.Authorization/roleAssignments/delete")
| project TimeGenerated, Caller, OperationNameValue

AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/*"
| project TimeGenerated, Caller, OperationNameValue

AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue = "Microsoft.Authorization/roleAssignments/write" or OperationNameValue = "Microsoft.Authorization/roleAssignments/delete"
| project TimeGenerated, Caller, OperationNameValue

Show answer & explanation

Answer: AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationNameValue startswith "Microsoft.Authorization/roleAssignments"
| project TimeGenerated, Caller, OperationNameValue; AzureActivity
| where TimeGenerated > ago(14d)
| where OperationNameValue in ("Microsoft.Authorization/roleAssignments/write", "Microsoft.Authorization/roleAssignments/delete")
| project TimeGenerated, Caller, OperationNameValue

Answer

The queries that use the 'startswith' operator to match the prefix of the role assignment operations, or the 'in' operator with the exact operation names, and use the double equals sign (==) for comparison, are correct.

The correct queries successfully filter the logs to the past 14 days, use valid KQL syntax ('startswith' or the 'in' operator) to target both 'write' and 'delete' operations for role assignments, and project the required fields.

Step-by-Step Solution

Filter by the correct time window using the TimeGenerated field and the ago(14d) function.

Limits the query results to the last 14 days.

This satisfies the temporal constraint of the query request.

Filter by the relevant operations using a valid string matching operator.

Matches operation names for creating or deleting role assignments using either 'startswith' with the base namespace or 'in' with the specific operation strings.

KQL requires the double equals (==) for exact matching, or specific operators like 'startswith' for prefix matching. Wildcards with '==' or single '=' comparisons are invalid syntax.

Select the required columns using the project operator.

The final output contains only the TimeGenerated, Caller, and OperationNameValue columns.

This meets the output requirements of the scenario.

Key Concept

Writing valid KQL queries in Log Analytics with correct operators for filtering and projection.

Question 1055Question →

An enterprise network consists of three Azure virtual networks in the East US region:

* VNet-Hub with the address space $10.100.0.0/16$ , which contains a virtual network gateway.
* VNet-Spoke1 with the address space $10.101.0.0/16$ , which contains a subnet hosting `VM-1`.
* VNet-Spoke2 with the address space $10.102.0.0/16$ , which contains a subnet hosting `VM-2`.

You establish bidirectional peering links between `VNet-Hub` and `VNet-Spoke1`, and between `VNet-Hub` and `VNet-Spoke2`.

You need to ensure that `VM-1` can communicate with your on-premises network using the gateway in `VNet-Hub`. The solution must minimize administrative effort and ensure `VM-2` cannot access the on-premises network.

What configuration settings should you apply to the virtual network peering links?

Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit, and configure the peering link from VNet-Spoke1 to VNet-Hub to use the remote virtual network's gateway.

Configure the peering link from VNet-Hub to VNet-Spoke1 to use the remote virtual network's gateway, and configure the peering link from VNet-Spoke1 to VNet-Hub to allow gateway transit.

Configure the peering links between VNet-Hub and both spokes to enable Allow forwarded traffic, and create a route table in VNet-Spoke1 with a next hop type of Virtual Appliance.

Enable Allow gateway transit and Use remote virtual network's gateway globally on all peering links, as gateway transit settings are automatically applied transitively to all peered networks.

Show answer & explanation

Answer: Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit, and configure the peering link from VNet-Spoke1 to VNet-Hub to use the remote virtual network's gateway.

Answer

Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit, and configure the peering link from VNet-Spoke1 to VNet-Hub to use the remote virtual network's gateway.

The correct answer properly configures gateway transit: the hub network (VNet-Hub) hosting the VPN gateway must have 'Allow gateway transit' enabled, while the spoke network (VNet-Spoke1) consuming the gateway must have 'Use remote virtual network's gateway' enabled. This allows VM-1 to route traffic to the on-premises network through VNet-Hub, while VM-2 remains unaffected since its peering link settings are not modified.

Step-by-Step Solution

Identify the location of the Virtual Network Gateway and the VM that needs connectivity.

The Virtual Network Gateway is in VNet-Hub. VM-1 is in VNet-Spoke1. Connectivity is needed between VM-1 and on-premises via VNet-Hub.

This establishes which network is the transit provider (VNet-Hub) and which is the transit consumer (VNet-Spoke1).

Determine the necessary peering settings on the gateway hosting side (VNet-Hub).

Enable 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke1.

This configuration permits VNet-Spoke1 to leverage the gateway residing in VNet-Hub.

Determine the necessary peering settings on the spoke side (VNet-Spoke1).

Enable 'Use remote virtual network's gateway' (or 'Use remote gateways') on the peering link from VNet-Spoke1 to VNet-Hub.

This allows resources in VNet-Spoke1 to route their traffic to on-premises via the remote gateway.

Key Concept

Gateway transit in virtual network peering allows peered virtual networks to share a VPN or ExpressRoute gateway for on-premises connectivity.

Estimated Time:1m 30s

Question 1056Question →

You have an Azure virtual machine named VM1 deployed in the East US region. You plan to configure backup for VM1 by using Azure Backup. Which requirement must be met by the Recovery Services vault you select for VM1?

The Recovery Services vault must be located in the East US region.

The Recovery Services vault can be located in any region within the United States geography.

The Recovery Services vault must be configured to allow access from VM1 by adding the public IP address of VM1 to the vault's storage firewall bypass list.

The Recovery Services vault must be configured using the 'Replace existing' restore type before the initial backup of VM1 can be enabled.

Show answer & explanation

Answer: The Recovery Services vault must be located in the East US region.

Answer

The Recovery Services vault must be located in the East US region.

The correct answer is correct because Azure Backup enforces a regional boundary for virtual machine backups. A Recovery Services vault must be deployed in the same geographical region (in this case, East US) as the target virtual machine to be selected for its backup configuration.

Step-by-Step Solution

Identify the region of the source virtual machine.

The source virtual machine VM1 is deployed in the East US region.

Azure Virtual Machine backups require the source resource and the destination vault to be aligned by region.

Determine the regional requirement for the target Recovery Services vault.

The Recovery Services vault must also reside in the East US region.

Azure Backup does not support backing up virtual machines to a vault located in a different Azure region.

Key Concept

Azure Virtual Machine backup configuration requires that the Recovery Services vault reside in the same region as the source virtual machine.

Question 1057Question →

You are configuring an Azure App Service plan to host a student enrollment portal. The configuration must meet the following requirements:

- Allow developers to test application updates in a separate staging deployment slot before swapping to production.
- Automatically scale the instance count to handle traffic spikes, up to a maximum of 5 instances.
- Configure a custom domain name secured with an SSL certificate.

Which App Service pricing tier is the most cost-effective option that meets all requirements?

Basic (B1)

Free (F1)

Standard (S1)

Premium (P1v3)

Show answer & explanation

Answer: Standard (S1)

Answer

Standard (S1)

The Standard (S1) tier is the most cost-effective tier that supports all three requirements: custom domains with SSL, automatic scaling (up to 10 instances), and deployment slots (up to 5).

Step-by-Step Solution

Evaluate the scaling requirement.

Automatic scaling is required. The Free (F1) and Basic (B1) tiers do not support autoscale (Basic only supports manual scale up to 3 instances). This rules out those options.

To eliminate pricing tiers that do not support automated scale-out capabilities based on demand metrics.

Evaluate the deployment slot requirement.

Staging slots are required. Standard (S1) supports up to 5 deployment slots, and Premium (P1v3) supports up to 20 deployment slots.

To identify which remaining tiers support separate slot configurations for staging updates.

Determine the most cost-effective tier between Standard (S1) and Premium (P1v3).

Standard (S1) satisfies all requirements (custom domains/SSL, autoscale up to 10 instances, and up to 5 deployment slots) and is cheaper than Premium (P1v3).

To select the tier that meets all criteria at the lowest price point.

Key Concept

Azure App Service pricing tier features and cost optimization

Question 1058Question →

Your company has an Azure virtual network named `VNet-Production` ( $10.10.0.0/16$ ) that contains the following subnets:

* `FrontendSubnet` ( $10.10.10.0/24$ )
* `SecureAppSubnet` ( $10.10.20.0/24$ )
* `DMZSubnet` ( $10.10.99.0/24$ )

A Network Virtual Appliance (NVA) is deployed in `DMZSubnet` and has an IP address of $10.10.99.4$ .

A route table is associated with `FrontendSubnet` and contains the following route:

* Route name: `To-NVA`
* Destination IP address/CIDR: $10.10.20.0/24$
* Next hop type: `Virtual appliance`
* Next hop IP address: $10.10.99.4$

A user attempts to send traffic from a virtual machine in `FrontendSubnet` to a database server at $10.10.20.55$ in `SecureAppSubnet`.

Which two statements correctly describe how Azure routes this traffic based on prefix match and UDR override rules? (Select TWO.)

Select all that apply

Azure will select the route with the destination prefix

10.10.20.0/24

for traffic destined to

10.10.20.55

because it is the longest prefix match (LPM).

The user-defined route for

10.10.20.0/24

overrides the default system VNet local route for that subnet range because user-defined routes take precedence over system routes.

Azure will route the traffic using the default system local VNet route for

10.10.0.0/16

because system routes always take precedence over user-defined routes.

Azure will discard the traffic because next-hop IP addresses for virtual appliances must be in the destination subnet rather than a transit subnet.

Show answer & explanation

Answer: Azure will select the route with the destination prefix $10.10.20.0/24$ for traffic destined to $10.10.20.55$ because it is the longest prefix match (LPM).; The user-defined route for $10.10.20.0/24$ overrides the default system VNet local route for that subnet range because user-defined routes take precedence over system routes.

Answer

Azure will route the traffic using the user-defined route with the destination prefix

10.10.20.0/24

because it is the longest prefix match for

10.10.20.55

, and user-defined routes override the default system local virtual network routes.

Azure uses the Longest Prefix Match (LPM) algorithm to choose the route for a packet. Because the target IP address is

10.10.20.55

, the route for

10.10.20.0/24

is a longer prefix match than the default system route of

10.10.0.0/16

. Furthermore, User-Defined Routes take precedence over default system routes, ensuring the packet is correctly sent to the NVA rather than routed locally.

Step-by-Step Solution

Identify the destination IP and matching prefixes.

The target IP is

10.10.20.55

. The matching routes are the VNet local system route (

10.10.0.0/16

) and the user-defined route (

10.10.20.0/24

This establishes the candidates for routing evaluation.

Apply the Longest Prefix Match (LPM) rule.

The prefix

10.10.20.0/24

is longer and more specific than

10.10.0.0/16

LPM is the primary rule Azure uses to determine route selection among overlapping prefixes.

Evaluate UDR versus system route precedence.

The UDR (

10.10.20.0/24

) takes precedence over the default VNet local system route.

UDRs allow administrators to override system routes to redirect traffic (e.g., through an NVA).

Key Concept

Azure routes traffic based on the longest prefix match (LPM) first, and when prefixes match, User-Defined Routes (UDRs) override system routes.

Question 1059Question →

An organization deploys an Azure virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Web` (address prefix $10.0.1.0/24$ ) and `Subnet-Data` (address prefix $10.0.2.0/24$ ).

`Subnet-Web` hosts the following virtual machines:
* `VM-Web1` and `VM-Web2`, which are associated with an Application Security Group (ASG) named `ASG-Web`.
* `VM-Management`, which is associated with an ASG named `ASG-Admin`.

`Subnet-Data` hosts a virtual machine named `VM-SQL1`, which is associated with an ASG named `ASG-SQL`.

A Network Security Group (NSG) named `NSG-Data` is associated with `Subnet-Data`. There are no other custom security rules in `NSG-Data`.

You need to configure `NSG-Data` to allow incoming database traffic on TCP port $1433$ from `VM-Web1` and `VM-Web2` to `VM-SQL1`. All other traffic from `Subnet-Web` to `VM-SQL1` on TCP port $1433$ must be blocked.

Which two inbound security rules should you configure in `NSG-Data` to meet the requirements while maintaining the principle of least privilege? (Select two.)

Select all that apply

An inbound rule with Priority:

120

, Source: `ASG-Web`, Destination: `ASG-SQL`, Port:

1433

, Action: Allow

An inbound rule with Priority:

220

, Source: `ASG-Web`, Destination: `ASG-SQL`, Port:

1433

, Action: Allow

An inbound rule with Priority:

180

, Source:

10.0.1.0/24

, Destination: `ASG-SQL`, Port:

1433

, Action: Deny

An inbound rule with Priority:

110

, Source:

10.0.1.0/24

, Destination: `ASG-SQL`, Port:

1433

, Action: Deny

Show answer & explanation

Answer: An inbound rule with Priority: $120$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Port: $1433$ , Action: Allow; An inbound rule with Priority: $180$ , Source: $10.0.1.0/24$ , Destination: `ASG-SQL`, Port: $1433$ , Action: Deny

Answer

To meet the requirements, you must configure two inbound security rules: one rule with priority

120

that allows TCP port

1433

traffic from source `ASG-Web` to destination `ASG-SQL`, and another rule with priority

180

that denies TCP port

1433

traffic from source

10.0.1.0/24

to destination `ASG-SQL`.

To permit database traffic only from the web servers while blocking all other hosts in the same source subnet, you must establish an allow rule with higher precedence (lower priority number) than the fallback deny rule. The rule with priority

120

explicitly allows traffic from the source Application Security Group `ASG-Web` to the destination `ASG-SQL`. The rule with priority

180

denies traffic from the source subnet prefix

10.0.1.0/24

to the destination `ASG-SQL`. Since the allow rule has priority

120

and the deny rule has priority

180

, traffic from the web servers matches the allow rule first and is permitted. Traffic from other virtual machines in the subnet (such as the management server) does not match the allow rule and falls through to be blocked by the deny rule.

Step-by-Step Solution

Determine rule processing order rules for Network Security Groups.

Rules are processed sequentially in ascending order of their priority numbers. The first rule that matches the traffic properties is applied, and no subsequent rules are evaluated.

This determines how the allow and deny rules will interact with each other.

Select the correct allow rule targeting the web virtual machines.

Identify that the allow rule must target `ASG-Web` as the source and `ASG-SQL` as the destination with priority

120

This allows database traffic specifically from the virtual machines in the web Application Security Group.

Select the correct deny rule targeting the remaining subnet hosts.

Identify that the deny rule must target the subnet prefix

10.0.1.0/24

as the source and `ASG-SQL` as the destination with priority

180

This denies traffic from all other hosts in the web subnet. Because the deny rule has a higher priority number (

180

) than the allow rule (

120

), legitimate traffic matching the allow rule is processed first and permitted, while all other traffic matches the deny rule and is blocked.

Key Concept

Azure Network Security Group inbound rule processing precedence, where lower priority numbers take precedence over higher priority numbers, combined with the use of Application Security Groups to group virtual machines for security policies.

Estimated Time:1m 30s

Question 1060Question →

An administrator is configuring a single Azure Application Gateway v2 named AppGW1 to support two custom domains: `orders.contoso.com` and `inventory.contoso.com`. Traffic for `orders.contoso.com` must route to a backend pool named `OrderPool`. Traffic for `inventory.contoso.com` must route to a backend pool named `InventoryPool`. What is the minimum number of listeners and routing rules required on AppGW1?

Two multi-site listeners and two routing rules

One basic listener and two routing rules

One multi-site listener and one routing rule

Two basic listeners and one routing rule

Show answer & explanation

Answer: Two multi-site listeners and two routing rules

Answer

Two multi-site listeners and two routing rules

To route traffic to different backend pools based on distinct host names (multi-site hosting), you must configure a separate multi-site listener for each host name. Since there are two separate domains (`orders.contoso.com` and `inventory.contoso.com`) pointing to different backend pools, two multi-site listeners are required. Each listener must be associated with a dedicated routing rule that maps the listener to its respective backend pool, requiring a total of two routing rules.

Step-by-Step Solution

Determine listener requirements for hosting multiple domain names.

Two multi-site listeners are required, one listening for `orders.contoso.com` and the other for `inventory.contoso.com`.

Basic listeners do not evaluate host headers to differentiate traffic for multiple domains, so multi-site listeners must be used.

Determine the routing rule configuration to send traffic to different backend pools.

Two separate routing rules are required.

Each routing rule binds a single listener to a backend pool. Since we have two listeners pointing to two different backend pools, we need two separate routing rules.

Key Concept

Azure Application Gateway listeners and routing rules configuration for hosting multiple sites.

PreviousPage 53 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept