All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

A healthtech company is deploying a secure Azure Kubernetes Service (AKS) cluster named `aks-clinical` in a virtual network named `VNet1` ( $10.200.0.0/16$ ) to host a patient data portal. The cluster is configured as a private cluster, which creates a private endpoint for the API server in `VNet1` and associates it with a Private DNS zone.

A peered virtual network named `VNet2` ( $10.201.0.0/16$ ) contains management virtual machines that administrators use to manage Azure resources. Virtual network peering is successfully established between `VNet1` and `VNet2`.

Administrators report that the management VMs in `VNet2` cannot connect to `aks-clinical` because they are unable to resolve the fully qualified domain name (FQDN) of the AKS API server.

Which configuration step should you perform to resolve the DNS resolution issue?

Configure gateway transit and allow gateway transit on the virtual network peering between VNet1 and VNet2.

Re-deploy the AKS cluster to use the Kubenet network plugin instead of the Azure CNI network plugin.

Create a virtual network link to VNet2 in the Private DNS zone associated with the AKS cluster.

Configure the DNS server settings of VNet2 to point to the private IP address of the AKS API server.

Show answer & explanation

Answer: Create a virtual network link to VNet2 in the Private DNS zone associated with the AKS cluster.

Answer

Create a virtual network link to VNet2 in the Private DNS zone associated with the AKS cluster.

For resources in a peered virtual network to resolve the FQDN of a private AKS cluster's API server, the Private DNS zone created for the cluster must be linked to the peered virtual network (VNet2). Linking the zone allows the Azure DNS resolver (

168.63.129.16

) in VNet2 to query the Private DNS zone and return the private IP address of the API server's private endpoint.

Step-by-Step Solution

Identify the resource responsible for resolving the FQDN of a private AKS cluster.

The private AKS cluster utilizes an Azure Private DNS zone (such as `privatelink.<region>.azmk8s.io`) to map the API server's FQDN to its private endpoint IP address.

By default, this zone is only linked to the virtual network where the cluster is created (VNet1).

Configure DNS resolution for the peered virtual network (VNet2).

A virtual network link must be added within the Private DNS zone configuration, targeting VNet2.

This link allows VMs in VNet2 using the Azure default DNS service (

168.63.129.16

) to query the Private DNS zone and successfully resolve the FQDN to the private IP.

Key Concept

Private AKS DNS resolution and Virtual Network Link requirements.

Estimated Time:1m 30s

Question 1062Question →

An administrator needs to query Syslog messages from Linux virtual machines in a Log Analytics workspace.

The administrator wants to identify all log entries from the 'auth' facility that have a severity level of 'err' and were generated within the last $24\text{ hours}$ . The query must display only the time of the event, the computer name, and the log message.

Which KQL query should the administrator run to meet these requirements?

Syslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" and SeverityLevel == "err"
| project TimeGenerated, Computer, SyslogMessage

Syslog
| project TimeGenerated, Computer, SyslogMessage
| where TimeGenerated > ago(24h)
| where Facility == "auth" and SeverityLevel == "err"

Syslog
| where TimeGenerated > ago(24h)
| where Facility = "auth" and SeverityLevel = "err"
| project TimeGenerated, Computer, SyslogMessage

Syslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" or SeverityLevel == "err"
| project TimeGenerated, Computer, SyslogMessage

Show answer & explanation

Answer: Syslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" and SeverityLevel == "err"
| project TimeGenerated, Computer, SyslogMessage

Answer

The query that filters by TimeGenerated, Facility, and SeverityLevel using the double equals comparison operator (==) before using the project operator to limit the output columns to TimeGenerated, Computer, and SyslogMessage.

The correct query begins with the Syslog table, filters logs from the last 24 hours, applies the correct criteria using the double equals comparison operator (==) combined with the logical 'and' operator, and then uses the 'project' operator to output only the requested columns (TimeGenerated, Computer, and SyslogMessage). This maintains the required columns in the pipeline for filtering before they are projected.

Step-by-Step Solution

Identify the base table and filter by time.

Start the query with the Syslog table, and filter log entries generated in the last 24 hours using '| where TimeGenerated > ago(24h)'.

Filtering records by time first optimizes query performance by reducing the dataset early.

Filter by the required criteria using correct operators.

Add '| where Facility == "auth" and SeverityLevel == "err"'.

The 'and' operator ensures both criteria must be met, and the double equals (==) is the correct comparison operator in KQL.

Project the requested columns.

Apply '| project TimeGenerated, Computer, SyslogMessage'.

The project operator selects only the specified columns for the final output. This must be done after all filters that require other columns have been executed.

Key Concept

KQL query pipeline processing, filtering, and column projection

Estimated Time:1m 30s

Question 1063Question →

Your company has an Azure environment with two virtual networks in the East US region: `VNet-Prod` ( $10.10.0.0/16$ ) containing production virtual machines, and `VNet-Shared` ( $10.20.0.0/16$ ) hosting shared services. An Azure Virtual Network Gateway is deployed in `VNet-Shared` to facilitate connectivity to your on-premises network. You are configuring a virtual network peering connection between `VNet-Prod` and `VNet-Shared`. You need to ensure that the virtual machines in `VNet-Prod` can access your on-premises resources by using the Virtual Network Gateway in `VNet-Shared`. Which two configurations should you perform?

Select all that apply

Enable 'Allow gateway transit' on the peering link from VNet-Shared to VNet-Prod.

Enable 'Use remote gateways' on the peering link from VNet-Prod to VNet-Shared.

Enable 'Use remote gateways' on the peering link from VNet-Shared to VNet-Prod.

Enable 'Allow gateway transit' on the peering link from VNet-Prod to VNet-Shared.

Show answer & explanation

Answer: Enable 'Allow gateway transit' on the peering link from VNet-Shared to VNet-Prod.; Enable 'Use remote gateways' on the peering link from VNet-Prod to VNet-Shared.

Answer

Enable 'Allow gateway transit' on the peering link from VNet-Shared to VNet-Prod, and enable 'Use remote gateways' on the peering link from VNet-Prod to VNet-Shared.

To allow the spoke virtual network to use a gateway in the peered virtual network, you must establish a bidirectional peering where: the gateway-hosting virtual network (VNet-Shared) permits transit by enabling 'Allow gateway transit', and the spoke virtual network (VNet-Prod) is configured to use the remote gateway by enabling 'Use remote gateways'.

Step-by-Step Solution

Identify the virtual network hosting the Virtual Network Gateway.

VNet-Shared is identified as the host network containing the gateway.

Only the virtual network that contains the gateway can transit gateway traffic.

Configure the peering link originating from the gateway host virtual network.

Enable 'Allow gateway transit' on the peering link from VNet-Shared to VNet-Prod.

This allows VNet-Shared to act as a transit point and share its gateway resources with the peered network.

Configure the peering link originating from the spoke virtual network.

Enable 'Use remote gateways' on the peering link from VNet-Prod to VNet-Shared.

This allows VMs in VNet-Prod to route their on-premises destined traffic through the gateway located in the peered VNet-Shared.

Key Concept

Virtual Network Peering Gateway Transit

Question 1064Question →

An administrator needs to configure backups for an Azure virtual machine named VM1 by using Azure Backup.

Which of the following requirements must be met to successfully configure the virtual machine backup? (Select TWO)

Select all that apply

The Recovery Services vault must be located in the same Azure region as the virtual machine.

The virtual machine can be associated with only one backup policy at a time.

The Recovery Services vault can be located in any Azure region within the same Azure subscription.

The virtual machine must be powered on and in the Running state during the backup configuration process.

Show answer & explanation

Answer: The Recovery Services vault must be located in the same Azure region as the virtual machine.; The virtual machine can be associated with only one backup policy at a time.

Answer

To successfully configure backup for the virtual machine, the Recovery Services vault must be in the same Azure region as the virtual machine, and the virtual machine can be associated with only one backup policy at a time.

For the backup configuration to succeed, the Recovery Services vault must reside in the same Azure region as the virtual machine. In addition, Azure Backup restricts each virtual machine to be associated with exactly one backup policy at a time.

Step-by-Step Solution

Determine the regional requirement for the vault.

The Recovery Services vault must match the region of the virtual machine.

Azure Backup does not support configuring backups for virtual machines using a Recovery Services vault located in a different region.

Check backup policy association limits per virtual machine.

Only one backup policy can be assigned to a virtual machine.

Azure Backup enforces a one-to-one relationship between a protected virtual machine and its backup policy.

Key Concept

Prerequisites and policy limits for Azure Virtual Machine backup configuration

Question 1065Question →

An administrator plans to deploy a single Azure Application Gateway v2 instance to distribute web traffic to a backend pool of virtual machines. Which two of the following configuration actions must be performed on the subnet hosting the Application Gateway to support this deployment?

Select all that apply

Provision the Application Gateway within a dedicated subnet that contains no other resources.

Configure an inbound security rule in the subnet's Network Security Group (NSG) to allow traffic from the GatewayManager service tag on destination ports 65200-65535.

Deploy the Application Gateway in the same subnet as the backend virtual machines to optimize internal routing latency.

Add an inbound security rule in the subnet's Network Security Group (NSG) that blocks all traffic from the GatewayManager service tag to secure the gateway.

Show answer & explanation

Answer: Provision the Application Gateway within a dedicated subnet that contains no other resources.; Configure an inbound security rule in the subnet's Network Security Group (NSG) to allow traffic from the GatewayManager service tag on destination ports 65200-65535.

Answer

Provision the Application Gateway within a dedicated subnet containing no other resources, and configure an inbound security rule in the subnet's Network Security Group (NSG) to allow traffic from the GatewayManager service tag on destination ports 65200-65535.

Azure Application Gateway v2 mandates deployment into a dedicated subnet that contains no other resource types (except other application gateways). Additionally, it requires that the Network Security Group (NSG) associated with this subnet allows inbound traffic from the GatewayManager service tag on ports 65200-65535 for infrastructure health and management communication.

Step-by-Step Solution

Analyze subnet requirements for Azure Application Gateway v2.

Identify that the subnet hosting the Application Gateway must be dedicated and cannot contain other resources like backend virtual machines.

This is a prerequisite for Azure Application Gateway deployment to function properly and segregate traffic.

Analyze Network Security Group (NSG) rules for management traffic.

Identify that destination ports 65200-65535 must be opened for inbound traffic from the GatewayManager service tag.

Azure infrastructure uses these ports to manage the health and configuration of the Application Gateway.

Key Concept

Azure Application Gateway Subnet and NSG configuration requirements

Estimated Time:1m 30s

Question 1066Question →

An administrator is configuring routing for an Azure virtual network named `VNet-Ecom` ( $10.80.0.0/16$ ). The virtual network contains three subnets: `Web-Subnet` ( $10.80.1.0/24$ ), `Database-Subnet` ( $10.80.2.0/24$ ), and `DMZ-Subnet` ( $10.80.10.0/24$ ). A Network Virtual Appliance (NVA) is deployed in `DMZ-Subnet` with the private IP address $10.80.10.4$ and has IP forwarding enabled. You create a custom route table named `RT-Web` and associate it with `Web-Subnet`. You need to ensure that all traffic from `Web-Subnet` to `Database-Subnet` is inspected by the NVA. Which route configuration should you add to `RT-Web`?

Address prefix:

10.80.2.0/24

, Next hop type: Virtual network gateway, Next hop address:

10.80.10.4

Address prefix:

10.80.2.0/24

, Next hop type: Virtual appliance, Next hop address:

10.80.10.4

Address prefix:

10.80.2.0/24

, Next hop type: Virtual appliance, Next hop address:

10.80.2.4

Address prefix:

10.80.0.0/16

, Next hop type: Virtual appliance, Next hop address:

10.80.10.4

Show answer & explanation

Answer: Address prefix: $10.80.2.0/24$ , Next hop type: Virtual appliance, Next hop address: $10.80.10.4$

Answer

Address prefix:

10.80.2.0/24

, Next hop type: Virtual appliance, Next hop address:

10.80.10.4

To route traffic from one subnet to another through a firewall or other virtual appliance, you must define a route with the destination prefix of the target subnet (in this case, the database subnet prefix

10.80.2.0/24

), specify the next hop type as 'Virtual appliance', and provide the private IP address of the virtual appliance (

10.80.10.4

). Since the user-defined route has a more specific prefix (

10.80.2.0/24

) than the default system route for the VNet (

10.80.0.0/16

), Azure will select the user-defined route based on the longest prefix match rule, forwarding the traffic to the virtual appliance.

Step-by-Step Solution

Identify the target destination subnet and its address prefix.

The target destination is Database-Subnet, which has the address prefix

10.80.2.0/24

UDRs require a destination address prefix to match and route traffic to the correct destination.

Determine the correct next hop type and IP address for the Network Virtual Appliance (NVA).

Next hop type must be 'Virtual appliance', and the next hop IP address must be the NVA's interface IP (

10.80.10.4

An NVA in Azure is represented by the 'Virtual appliance' next hop type, and its private IP must be reachable within the VNet.

Select the route prefix that overrides the system route without causing routing loops.

Use the destination prefix

10.80.2.0/24

rather than the entire VNet prefix

10.80.0.0/16

Using

10.80.2.0/24

targets only database traffic, avoiding a routing loop that would occur if the entire VNet range (which contains the NVA itself) were routed to the NVA.

Key Concept

Configuring User-Defined Routes (UDRs) to direct traffic through a Network Virtual Appliance (NVA) requires specifying a 'Virtual appliance' next hop type with the NVA's private IP, using the most specific destination IP prefix to avoid routing loops.

Estimated Time:1m 30s

Question 1067Question →

An administrator configures virtual networking in an Azure subscription. The subscription contains a virtual network named VNet1 with two subnets named Subnet1 and Subnet2. Subnet1 is associated with a network security group (NSG) named NSG-Subnet1. Subnet2 is associated with an NSG named NSG-Subnet2.

A virtual machine named VM1 is deployed in Subnet1 and its network interface (NIC) is associated with an NSG named NSG-NIC1. VM1 is also associated with an Application Security Group (ASG) named ASG-AppServer.

A virtual machine named VM2 is deployed in Subnet2 and is associated with an ASG named ASG-Database.

NSG-NIC1 contains the following outbound security rules:
* Priority 150: Allow outbound TCP port 1433 from ASG-AppServer to ASG-Database.
* Priority 300: Deny outbound TCP port 1433 from Any to Any.

NSG-Subnet1 contains the following outbound security rules:
* Priority 120: Deny outbound TCP port 1433 from Any to Any.
* Priority 220: Allow outbound TCP port 1433 from ASG-AppServer to ASG-Database.

What is the outcome when VM1 attempts to initiate a connection to VM2 on TCP port 1433?

The connection is blocked by the subnet-level NSG (NSG-Subnet1).

The connection is allowed because the NIC-level NSG outbound rule has a lower priority number than the subnet-level NSG deny rule.

The connection is blocked by the NIC-level NSG (NSG-NIC1).

The connection is allowed because the subnet-level NSG allows traffic targeting the ASG-Database group at priority 220.

Show answer & explanation

Answer: The connection is blocked by the subnet-level NSG (NSG-Subnet1).

Answer

The connection is blocked by the subnet-level NSG (NSG-Subnet1).

For outbound traffic from VM1, Azure first evaluates the outbound rules of the NIC-level NSG (NSG-NIC1), where the rule with priority 150 matches and allows the connection. Next, Azure evaluates the outbound rules of the subnet-level NSG (NSG-Subnet1). In NSG-Subnet1, the deny rule with priority 120 has a lower priority number than the allow rule with priority 220. Because rules with lower priority numbers are processed first, the connection is blocked at the subnet-level NSG.

Step-by-Step Solution

Evaluate outbound traffic at the NIC-level NSG (NSG-NIC1).

The traffic is allowed by the rule with priority 150 (Allow outbound TCP port 1433 from ASG-AppServer to ASG-Database) because it has a lower priority number (higher precedence) than the deny rule with priority 300.

For outbound traffic, Azure first evaluates network security group rules associated with the network interface (NIC).

Evaluate outbound traffic at the subnet-level NSG (NSG-Subnet1).

The traffic is blocked by the rule with priority 120 (Deny outbound TCP port 1433 from Any to Any) because it is processed before the allow rule with priority 220.

After passing the NIC-level NSG, outbound traffic must also pass through the subnet-level NSG rules. Within an NSG, rules are processed in priority order (lower numbers first).

Key Concept

Azure evaluates outbound traffic by first checking NIC-level NSGs and then subnet-level NSGs. Within each NSG, rules are evaluated sequentially in ascending order of their priority numbers, where smaller numbers have higher precedence.

Estimated Time:1m 30s

Question 1068Question →

An administrator manages an Azure subscription that contains an Azure App Service plan named ASP1. ASP1 is currently configured for the Basic (B1) pricing tier and hosts a web app named App1.

The administrator plans to deploy two new web apps named App2 and App3. The deployment must meet the following requirements:
- App2 must support auto-scaling based on CPU utilization.
- App3 must support custom domains and SSL bindings.
- Hosting costs must be minimized.

Which two actions should the administrator perform? (Select TWO.)

Select all that apply

Scale up ASP1 to the Standard (S1) pricing tier.

Deploy App2 and App3 to ASP1.

Deploy App2 to ASP1 and create a new App Service plan in the Basic (B1) pricing tier for App3.

Create a new App Service plan in the Standard (S1) pricing tier for App2 and deploy App3 to ASP1.

Scale up ASP1 to the Premium V3 (P1v3) pricing tier.

Show answer & explanation

Answer: Scale up ASP1 to the Standard (S1) pricing tier.; Deploy App2 and App3 to ASP1.

Answer

Scale up the existing App Service plan ASP1 to the Standard (S1) pricing tier and deploy both App2 and App3 to ASP1.

Scaling the existing plan to the Standard (S1) tier is the most cost-effective way to enable auto-scaling for the second app and custom domains/SSL for the third app. Consolidating all three web apps into the same plan minimizes costs because they will share the same underlying virtual machine instances and be billed under a single plan.

Step-by-Step Solution

Determine the minimum pricing tier required to support the features of the new apps.

App2 requires auto-scaling, which is first supported at the Standard tier. App3 requires custom domains and SSL, which are supported in Basic and Standard tiers.

This establishes that the hosting environment must be at least in the Standard pricing tier.

Analyze how to minimize hosting costs for multiple apps.

App Service plans are the billing units. Multiple apps can be hosted in the same plan to share the same underlying VM instances and pricing tier features.

This shows that consolidating all apps into a single Standard plan is cheaper than deploying them across separate plans (e.g., one Basic and one Standard plan).

Key Concept

App Service plan pricing tiers and resource sharing

Estimated Time:1m 30s

Question 1069Question →

You are implementing a monitoring solution in Azure. You configure an Azure Monitor metric alert to monitor the CPU usage of a critical database virtual machine. When the CPU usage exceeds 90%, the alert must send a notification to a third-party ticketing system's REST API endpoint. The ticketing system's API accepts JSON payloads but requires a custom schema with specific fields (such as 'ticket_priority' and 'source_device') that do not match the default Azure Monitor alert schema or the Common Alert Schema. You need to implement a solution that transforms the alert payload into the required format and forwards it to the API, while minimizing administrative effort and avoiding custom code maintenance. Which of the following is the best solution to meet this requirement?

Route the alert to an Azure Logic App by using the Logic App action in the action group, and configure the workflow to parse the alert JSON, map it to the custom schema, and call the REST API.

Modify the webhook action in the action group to use a custom JSON payload template that maps the Azure Monitor schema to the third-party schema.

Create an alert processing rule with a custom action to rewrite the alert payload properties before the action group is executed.

Configure the webhook action in the action group to use the Common Alert Schema, and define the required custom fields in the Custom HTTP Headers section of the webhook configuration.

Show answer & explanation

Answer: Route the alert to an Azure Logic App by using the Logic App action in the action group, and configure the workflow to parse the alert JSON, map it to the custom schema, and call the REST API.

Answer

Route the alert to an Azure Logic App by using the Logic App action in the action group, and configure the workflow to parse the alert JSON, map it to the custom schema, and call the REST API.

The correct option is to route the alert to an Azure Logic App. Logic Apps provide a built-in trigger for Azure Monitor alerts and visual tools to parse and map the alert JSON payload into the specific schema required by the third-party API, all without writing or maintaining custom code. This represents the lowest administrative effort and satisfies all constraints.

Step-by-Step Solution

Analyze Azure Monitor Action Group capabilities for payload customization.

Confirm that Webhook actions in Azure Monitor only support the legacy schema and the Common Alert Schema, and do not allow custom JSON body transformation or templating.

This establishes that direct configuration inside the Action Group cannot satisfy the custom payload requirement.

Evaluate the capabilities of Azure Logic Apps for this scenario.

Determine that Logic Apps have built-in HTTP request triggers, a JSON parsing action, and an HTTP action to call external APIs, allowing payload restructuring without custom code.

This confirms that Logic Apps provide a low-admin, low-code solution that avoids custom code maintenance (unlike custom Azure Functions or Automation runbooks).

Select the correct integration method in the Action Group.

Configure the Action Group to use the native Logic App action, which triggers the workflow whenever the alert fires.

Using the native Logic App action simplifies the configuration and ensures reliable triggering.

Key Concept

Azure Monitor Action Groups support various action types, but they cannot customize or rewrite the JSON payload of an alert directly. For custom schema mapping, an intermediary service like Azure Logic Apps should be used to parse, transform, and forward the payload to third-party APIs.

Question 1070Question →

A company's Azure infrastructure in the East US region uses a hub-and-spoke network topology. The hub virtual network, named `VNet-Hub` ( $10.50.0.0/16$ ), hosts a Virtual Network Gateway that establishes a Site-to-Site VPN connection to the corporate headquarters. A spoke virtual network, named `VNet-SpokeA` ( $10.51.0.0/16$ ), contains a subnet hosting an active virtual machine named `VM-A`. To enable hybrid connectivity, you create a virtual network peering connection between `VNet-Hub` and `VNet-SpokeA`. You must ensure that `VM-A` can access resources in the corporate headquarters through the Virtual Network Gateway in `VNet-Hub`.

Which configuration should you apply to the peering links?

On the peering link from VNet-Hub to VNet-SpokeA, select 'Allow gateway transit'. On the peering link from VNet-SpokeA to VNet-Hub, select 'Use the remote virtual network's gateway'.

Keep the default settings for both peering links, as virtual network peering automatically routes traffic to the Virtual Network Gateway in VNet-Hub.

On the peering link from VNet-Hub to VNet-SpokeA, select 'Use the remote virtual network's gateway'. On the peering link from VNet-SpokeA to VNet-Hub, select 'Allow gateway transit'.

On both peering links, select 'Allow forwarded traffic' and leave the gateway settings disabled.

Show answer & explanation

Answer: On the peering link from VNet-Hub to VNet-SpokeA, select 'Allow gateway transit'. On the peering link from VNet-SpokeA to VNet-Hub, select 'Use the remote virtual network's gateway'.

Answer

To allow the spoke virtual network to use the hub's gateway, the peering link from VNet-Hub to VNet-SpokeA must have 'Allow gateway transit' enabled, and the peering link from VNet-SpokeA to VNet-Hub must have 'Use the remote virtual network's gateway' enabled.

The configuration of 'Allow gateway transit' on the hub peering link permits the hub to share its Virtual Network Gateway. Concurrently, enabling 'Use the remote virtual network's gateway' on the spoke peering link instructs the spoke VNet to route traffic destined for on-premises through that remote hub gateway.

Step-by-Step Solution

Identify where the Virtual Network Gateway resides.

The gateway is in VNet-Hub.

This determines which network must act as the transit hub.

Configure the hub's peering link settings.

Enable 'Allow gateway transit' on the peering link from VNet-Hub to VNet-SpokeA.

This allows VNet-Hub to share its gateway with the peered spoke network.

Configure the spoke's peering link settings.

Enable 'Use the remote virtual network's gateway' on the peering link from VNet-SpokeA to VNet-Hub.

This configures the routing in the spoke network to send hybrid traffic through the gateway in the peered hub.

Key Concept

Gateway transit in Azure Virtual Network Peering allows a peered virtual network to use a virtual network gateway in the hub network for cross-premises connectivity.

Question 1071Question →

Your company is deploying a new Azure Kubernetes Service (AKS) cluster named 'aks-secure' to host a hybrid application in 'VNet1' (address space 172.16.0.0/12) using the subnet 'aks-subnet' (172.16.1.0/24). The application consists of standard web services and high-performance computing (HPC) batch workloads. The HPC workloads must run only on GPU-enabled virtual machines, while the standard web services must not run on the GPU-enabled nodes. You need to configure the AKS cluster and workloads to enforce this isolation. Which two actions should you perform? (Select two.)

Select all that apply

Add a new node pool with a taint of 'sku=gpu:NoSchedule' to the AKS cluster.

In the pod specification of the HPC workloads, add a toleration that matches the 'sku=gpu:NoSchedule' taint.

In the pod specification of the standard workloads, add a toleration that matches the 'sku=gpu:NoSchedule' taint.

In the pod specification of the standard workloads, add a nodeSelector pointing to the GPU-enabled node pool.

Configure an Azure Kubernetes Service (AKS) network policy to restrict scheduling to the GPU-enabled subnet.

Show answer & explanation

Answer: Add a new node pool with a taint of 'sku=gpu:NoSchedule' to the AKS cluster.; In the pod specification of the HPC workloads, add a toleration that matches the 'sku=gpu:NoSchedule' taint.

Answer

To isolate the workloads, you must add a node pool with a taint of 'sku=gpu:NoSchedule' to the AKS cluster and configure a toleration matching this taint in the pod specification of the HPC workloads.

Applying a taint with the 'NoSchedule' effect to the GPU-enabled node pool ensures that no workloads can be scheduled on those nodes unless they carry a matching toleration. By adding the toleration only to the HPC workloads, you ensure that they can be scheduled on the GPU nodes, while standard web services (which lack the toleration) are prevented from scheduling there, maintaining isolation.

Step-by-Step Solution

Determine the isolation mechanism for the GPU-enabled node pool.

Identify that applying a taint with the 'NoSchedule' effect to the GPU node pool will block all pods from scheduling on these nodes by default.

Taints prevent pods from being scheduled on specific nodes unless those pods have a matching toleration.

Configure the GPU-enabled node pool in the AKS cluster.

Add a new node pool with the taint 'sku=gpu:NoSchedule'.

Applying the taint at the node pool level ensures all nodes generated in that pool inherit the taint.

Allow the HPC workloads to run on the tainted GPU nodes.

Add a matching toleration for 'sku=gpu:NoSchedule' to the pod specification of the HPC workloads.

Only pods with the corresponding toleration can bypass the node taint and be scheduled on the GPU nodes, while standard workloads without the toleration remain on standard nodes.

Key Concept

AKS Node Pool Taints and Tolerations

Question 1072Question →

Your company deploys a virtual machine named AppVM1 in the North Europe region. You need to configure a backup strategy for AppVM1 by using Azure Backup. You plan to create a new Recovery Services Vault for the backups. In which Azure region must you create the Recovery Services Vault?

North Europe

West Europe

Any Azure region globally

Any regional pair of North Europe

Show answer & explanation

Answer: North Europe

Answer

The Recovery Services Vault must be created in the North Europe region.

The correct answer is North Europe. For Azure Virtual Machine backup, the Recovery Services Vault must be created in the same Azure region as the virtual machine you want to back up.

Step-by-Step Solution

Identify the region of the source virtual machine.

The virtual machine AppVM1 is located in the North Europe region.

Azure Backup requires co-location of the vault and the virtual machine to perform backup operations.

Determine the required region for the Recovery Services Vault.

The vault must also be created in the North Europe region.

Azure does not support backing up virtual machines to a Recovery Services Vault deployed in a different region.

Key Concept

Recovery Services Vault regional requirements for virtual machine backup

Question 1073Question →

An administrator is configuring an Azure Application Gateway v2 named AppGw1. The administrator needs to configure path-based routing for a web application to meet the following requirements:
- Traffic to contoso.com/images/* must route to a backend pool named PoolImages.
- Traffic to contoso.com/videos/* must route to a backend pool named PoolVideos.
- All other traffic must route to a backend pool named PoolDefault.

Which routing rule type and configuration should the administrator use on AppGw1?

A basic routing rule with three listeners, one for each path, and three separate backend pools.

A path-based routing rule with a path map that defines paths for /images/* and /videos/* pointing to their respective backend pools, and PoolDefault configured as the default backend target.

A path-based routing rule with a multi-site listener for each path and a single backend settings association.

A basic routing rule with a single multi-site listener and custom health probes configured for each path.

Show answer & explanation

Answer: A path-based routing rule with a path map that defines paths for /images/* and /videos/* pointing to their respective backend pools, and PoolDefault configured as the default backend target.

Answer

A path-based routing rule with a path map that defines paths for /images/* and /videos/* pointing to their respective backend pools, and PoolDefault configured as the default backend target.

A path-based routing rule allows Azure Application Gateway to evaluate the path pattern of incoming request URLs (such as /images/* or /videos/*) and forward them to corresponding backend pools. Any traffic that does not match the specified path patterns is automatically directed to the default backend target (PoolDefault).

Step-by-Step Solution

Determine the routing requirements.

Identify that traffic needs to be routed to different backend pools based on the URL path segment (e.g., /images/* and /videos/*).

This establishes that path-based routing is required rather than basic routing or multi-site hosting.

Select the routing rule type.

Choose a path-based routing rule type on the Application Gateway.

Basic routing rules only route traffic based on host header or port, whereas path-based rules allow URL-path matching rules.

Configure the path map and default target.

Add path rules for /images/* mapping to PoolImages and /videos/* mapping to PoolVideos, and assign PoolDefault as the default backend target.

A path-based rule requires a default target to handle any requests that do not match the specified paths.

Key Concept

Application Gateway Path-based routing rules

Question 1074Question →

An administrator is configuring network security for an Azure virtual network named $VNet-Corp$ . The virtual network contains a single subnet named $Subnet-App$ that is associated with a Network Security Group (NSG) named $NSG-App$ .

Three virtual machines are deployed in $Subnet-App$ :
- $VM-Client$ is associated with an Application Security Group (ASG) named $ASG-Client$ .
- $VM-Logic$ is associated with an Application Security Group (ASG) named $ASG-Logic$ .
- $VM-Database$ is not associated with any ASG.

You need to configure $NSG-App$ to meet the following requirements:
- Allow $VM-Client$ to establish connections to the application logic service running on $VM-Logic$ over TCP port $8080$ .
- Prevent $VM-Database$ and all other sources within the virtual network from connecting to $VM-Logic$ on TCP port $8080$ .
- Follow the principle of least privilege and use the minimum number of security rules.

Which two inbound security rules should you add to $NSG-App$ ? (Select two.)

Select all that apply

A rule that allows TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 120

A rule that denies TCP port 8080 traffic with a Source of Any, a Destination of ASG-Logic, and a Priority of 150

A rule that allows TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 180

A rule that denies TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 100

Show answer & explanation

Answer: A rule that allows TCP port 8080 traffic with a Source of ASG-Client, a Destination of ASG-Logic, and a Priority of 120; A rule that denies TCP port 8080 traffic with a Source of Any, a Destination of ASG-Logic, and a Priority of 150

Answer

To meet the requirements, you must add an inbound rule allowing TCP port 8080 traffic from the client Application Security Group to the logic Application Security Group with a priority of 120, and another inbound rule denying TCP port 8080 traffic from any source to the logic Application Security Group with a priority of 150.

The correct configuration consists of an inbound allow rule with a priority of 120 and a deny rule with a priority of 150. NSG rules are evaluated in order of priority (lower numerical values first). When traffic from the client VM (associated with the client Application Security Group) arrives, it matches the allow rule at priority 120 and is permitted; evaluation then stops. Traffic from the database VM or other sources does not match the allow rule, so it continues to the deny rule at priority 150, where it is blocked. This successfully restricts access to the logic VM on port 8080 to only the client VM.

Step-by-Step Solution

Determine how to target the source and destination VMs.

Identify that the source VM-Client is in the client Application Security Group, and the destination VM-Logic is in the logic Application Security Group.

Using Application Security Groups allows for grouping VMs and applying rules to those groups instead of individual IP addresses, minimizing administrative effort.

Configure the rule to allow the desired traffic flow.

Define an inbound rule allowing TCP port 8080 traffic from the client Application Security Group to the logic Application Security Group with a priority of 120.

This satisfies the requirement to permit VM-Client to connect to VM-Logic on port 8080.

Configure the rule to block all other traffic to the destination.

Define an inbound rule denying TCP port 8080 traffic from any source to the logic Application Security Group with a priority of 150.

Since the default rules allow all VNet-to-VNet inbound traffic, this rule is required to block other VMs in the subnet, such as VM-Database, from accessing VM-Logic on port 8080. The priority must be higher (meaning a larger number, like 150) than the allow rule (120) so that the allow rule takes precedence for the client VM.

Key Concept

Azure Network Security Group rules are processed in priority order (lower numbers evaluated first). Application Security Groups can be used as sources or destinations to define security rules based on application structure.

Question 1075Question →

An administrator is managing an Azure virtual network named `VNet-Enterprise` with an address space of $172.16.0.0/12$ . The virtual network includes the following subnets:
- `Subnet-Public` ( $172.16.1.0/24$ )
- `Subnet-FW` ( $172.16.2.0/24$ ) containing a firewall network virtual appliance (NVA) at IP address $172.16.2.4$
- `Subnet-Private` ( $172.20.0.0/16$ )

A route table named `RT-Public` is associated with `Subnet-Public`. The route table contains the following user-defined routes:
- Route 1: Address prefix: $172.20.0.0/24$ , Next hop type: Virtual appliance, Next hop address: $172.16.2.4$
- Route 2: Address prefix: $172.20.0.0/16$ , Next hop type: Virtual network gateway

IP forwarding is enabled on the firewall NVA. A virtual machine in `Subnet-Public` attempts to initiate a connection to a database server at IP address $172.20.0.50$ .

How will Azure route the traffic destined for the database server?

To the virtual appliance at

172.16.2.4

because the route with the address prefix

172.20.0.0/24

has the longest prefix match.

To the virtual network gateway because Route 2 has a higher precedence than Route 1 due to the next hop type definition.

Directly to the database server in Subnet-Private because the system route for the virtual network address space (

172.16.0.0/12

) overrides user-defined routes.

The traffic is dropped because Route 1 defines a next hop address that is in a different subnet than the destination IP address.

Show answer & explanation

Answer: To the virtual appliance at $172.16.2.4$ because the route with the address prefix $172.20.0.0/24$ has the longest prefix match.

Answer

To the virtual appliance at

172.16.2.4

because the route with the address prefix

172.20.0.0/24

has the longest prefix match.

The destination IP address

172.20.0.50

matches both Route 1 (

172.20.0.0/24

) and Route 2 (

172.20.0.0/16

). According to Azure's routing rules, the route with the longest prefix match (most specific mask, which is /24 in this case) is selected. Since Route 1 is selected, the traffic is forwarded to the virtual appliance at

172.16.2.4

Step-by-Step Solution

Determine the destination IP address and check which address prefixes in the route table and system routes match this destination.

The destination IP

172.20.0.50

matches three prefixes: the system route for the virtual network (

172.16.0.0/12

), Route 1 (

172.20.0.0/24

), and Route 2 (

172.20.0.0/16

Before applying routing logic, all matching routes must be identified.

Apply the Longest Prefix Match (LPM) rule to select the most specific route.

The prefix

172.20.0.0/24

(/24) is longer and more specific than

172.20.0.0/16

(/16) and

172.16.0.0/12

(/12). Therefore, Route 1 is selected.

Azure uses the longest prefix match to choose the route for a packet.

Determine the routing action based on the selected route's next hop configuration.

The next hop is the virtual appliance at

172.16.2.4

, so traffic is forwarded to this IP address.

The selected route dictates the next hop where the packet will be sent.

Key Concept

Azure route selection order and Longest Prefix Match (LPM)

Question 1076Question →

Your company has an Azure virtual network named `VNet-Finance` ( $10.150.0.0/16$ ). The virtual network contains the following three subnets:

* `WebSubnet` ( $10.150.1.0/24$ )
* `SecureDMZ` ( $10.150.10.0/24$ )
* `AppSubnet` ( $10.150.2.0/24$ )

You deploy a Network Virtual Appliance (NVA) named `NVA-1` to `SecureDMZ`. `NVA-1` is assigned the private IP address $10.150.10.4$ .

You need to ensure that all traffic sent from `WebSubnet` to `AppSubnet` is routed through `NVA-1` for inspection.

Which two actions should you perform? (Select two.)

Select all that apply

Create a route table, add a route for destination

10.150.2.0/24

with a next hop type of Virtual Appliance and a next hop IP address of

10.150.10.4

, and associate the route table with WebSubnet.

Enable IP forwarding on the network interface (NIC) of NVA-1.

Create a route table, add a route for destination

10.150.2.0/24

with a next hop type of Virtual Network Gateway and a next hop IP address of

10.150.10.4

, and associate the route table with SecureDMZ.

Create a route table, add a route for destination

10.150.2.0/24

with a next hop type of Virtual Appliance and a next hop IP address of

10.150.10.4

, and associate the route table with AppSubnet.

Show answer & explanation

Answer: Create a route table, add a route for destination $10.150.2.0/24$ with a next hop type of Virtual Appliance and a next hop IP address of $10.150.10.4$ , and associate the route table with WebSubnet.; Enable IP forwarding on the network interface (NIC) of NVA-1.

Answer

Create a route table, add a route for destination

10.150.2.0/24

with a next hop type of Virtual Appliance and next hop IP address of

10.150.10.4

, associate it with WebSubnet, and enable IP forwarding on the network interface of NVA-1.

To route traffic from the web tier to the app tier through a firewall or NVA, you must define a User-Defined Route (UDR) specifying the destination subnet IP range (

10.150.2.0/24

) and designating the Next Hop Type as a Virtual Appliance pointing to the NVA's IP (

10.150.10.4

). This route table must be associated with the source subnet (WebSubnet) where the traffic originates. Additionally, the NVA's network interface (NIC) in Azure must have IP forwarding enabled so that it does not drop packets destined for other IP addresses.

Step-by-Step Solution

Define the user-defined route (UDR) to redirect the outbound traffic.

A route table is created with a route for destination

10.150.2.0/24

(AppSubnet) pointing to the next hop type of Virtual Appliance with the IP address

10.150.10.4

This overrides the default system route that routes traffic directly between subnets within the same virtual network.

Associate the route table with the source subnet.

The route table is associated with WebSubnet.

UDRs only apply to traffic originating from the subnet with which the route table is associated.

Configure the Network Virtual Appliance's interface to permit transit traffic.

IP forwarding is enabled on the Azure network interface (NIC) of NVA-1.

By default, Azure network interfaces drop traffic that is not destined for or originating from the IP address assigned to the NIC. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Key Concept

Configuring custom routing through a Network Virtual Appliance (NVA) requires creating a route table, defining a route with a Next Hop Type of 'Virtual Appliance' pointing to the NVA's IP, associating the route table with the source subnet, and enabling IP forwarding on the NVA's network interface.

Question 1077Question →

An administrator needs to write a KQL query in Log Analytics to identify all failed secret retrieval operations (SecretGet) in an Azure Key Vault. The query must find operations that failed due to unauthorized access (status codes 401 or 403) within the last 7 days.

Which two of the following KQL queries will return the correct results? (Select TWO)

Select all that apply

AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider == "MICROSOFT.KEYVAULT" and OperationName == "SecretGet"
| where ResultSignature in ("401", "403")

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where OperationName == "SecretGet"
| where ResultSignature == "401" or ResultSignature == "403"
| where TimeGenerated >= ago(7d)

AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider = "MICROSOFT.KEYVAULT"
| where OperationName = "SecretGet"
| where ResultSignature == 401 or 403

Show answer & explanation

Answer: AzureDiagnostics
| where TimeGenerated > ago(7d)
| where ResourceProvider == "MICROSOFT.KEYVAULT" and OperationName == "SecretGet"
| where ResultSignature in ("401", "403"); AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where OperationName == "SecretGet"
| where ResultSignature == "401" or ResultSignature == "403"
| where TimeGenerated >= ago(7d)

Answer

The correct queries are the ones that use the double equals operator (`==`) for equality comparison, filter using the string values `"401"` and `"403"`, and do not use the SQL-style `select` keyword.

The correct queries use valid Kusto Query Language (KQL) syntax to filter the Log Analytics workspace. Specifically, they utilize the double equals operator (`==`) for equality comparison, filter the time range properly with the `ago` function, and query `ResultSignature` against string values (since diagnostic status codes in `AzureDiagnostics` are stored as strings). The order of the `where` clauses does not affect the correctness of the KQL query, so both variations are valid.

Step-by-Step Solution

Filter the dataset to the correct time range and resource provider.

The query includes `where TimeGenerated > ago(7d)` and `where ResourceProvider == "MICROSOFT.KEYVAULT"`.

This restricts the search scope to Key Vault logs from the past 7 days to optimize query performance.

Filter by the specific operation and failure status codes.

The query applies `where OperationName == "SecretGet"` and checks for `ResultSignature` values of "401" or "403".

This retrieves only the failed secret retrieval operations.

Verify KQL syntax and operator usage.

Use double equals (`==`) for comparisons and either `in ("401", "403")` or `ResultSignature == "401" or ResultSignature == "403"`.

KQL uses `==` for equality comparison and requires explicit operands for logical conditions, while columns must be projected using `project` rather than SQL `select`.

Key Concept

Writing valid KQL queries in Azure Log Analytics to filter diagnostic logs using proper comparison operators, string matching, and standard KQL syntax.

Estimated Time:1m 30s

Question 1078Question →

You have an Azure virtual machine named VM1 that runs Windows Server 2022 and is deployed in the West US 2 region. VM1 contains the following disks:
* An OS disk that is a Premium SSD
* A data disk named Disk1 that is a Premium SSD
* A data disk named Disk2 that is an Ultra Disk

You need to configure backup for VM1 by using Azure Backup. The solution must meet the following requirements:
* Back up the OS disk and Disk1.
* Minimize administrative effort.
* Support restoring VM1 to a secondary region in the event of a regional outage in West US 2.

Which configuration should you implement?

Create a Recovery Services Vault in the West US 2 region, configure the vault storage replication to Geo-Redundant Storage (GRS) with Cross-Region Restore enabled, and configure a backup policy that excludes Disk2.

Create a Recovery Services Vault in the East US 2 region, configure the vault storage replication to Locally-Redundant Storage (LRS), and configure a backup policy that includes Disk2.

Create a Recovery Services Vault in the West US 2 region, configure the vault storage replication to Geo-Redundant Storage (GRS) with Cross-Region Restore enabled, configure a backup policy that includes all disks, and configure the storage firewall on the vault's staging storage account to deny trusted Microsoft services.

Create a Recovery Services Vault in the West US 2 region, configure the vault storage replication to Zone-Redundant Storage (ZRS), and configure a backup policy that includes Disk2 while planning to use the 'Replace existing' restore option to bypass Disk2 during recovery.

Show answer & explanation

Answer: Create a Recovery Services Vault in the West US 2 region, configure the vault storage replication to Geo-Redundant Storage (GRS) with Cross-Region Restore enabled, and configure a backup policy that excludes Disk2.

Answer

The correct configuration requires the Recovery Services Vault to be deployed in the same region as the virtual machine (West US 2). To support disaster recovery to a secondary region, the vault storage replication must be configured as Geo-Redundant Storage (GRS) with Cross-Region Restore enabled. Because Ultra Disks are not supported by Azure Backup, the backup policy must explicitly exclude Disk2 so that the backup configuration can be successfully established for the remaining disks (the OS disk and Disk1).

Step-by-Step Solution

Select the correct region for the Recovery Services Vault.

The Recovery Services Vault is created in the West US 2 region, matching the region of the source virtual machine VM1.

Azure Backup requires the Recovery Services Vault and the virtual machine being backed up to reside in the same geographical region.

Configure vault storage redundancy and Cross-Region Restore.

Vault storage replication is set to Geo-Redundant Storage (GRS) and Cross-Region Restore (CRR) is enabled.

GRS replicates backup data to a secondary paired region, and CRR enables restoring the virtual machine in that secondary region even if the primary region is fully functional or experiencing an outage.

Exclude the unsupported Ultra Disk (Disk2) in the backup policy.

The backup policy is configured with Disk2 added to the excluded disks list.

Azure Backup does not support backing up Ultra Disks. The backup configuration will fail unless unsupported disks are explicitly excluded from the backup policy.

Key Concept

Azure VM Backup requires same-region vaults, GRS with CRR for secondary region restore, and explicit exclusion of unsupported disk types like Ultra Disks.

Estimated Time:3m 0s

Question 1079Question →

You are configuring monitoring for an Azure subscription. Match each operational alerting requirement to the most appropriate Azure Monitor alert signal type and action group configuration.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The requirement for VM deletion matches with the Activity Log alert and Secure Webhook action. The CPU spike monitoring matches with the Metric alert and SMS action. The log analytics database error query matches with the Log Search alert and Logic App action.

The correct mapping pairs the Activity Log alert with the Secure Webhook for administrative tasks requiring authentication, the Metric alert with SMS for resource performance monitoring subject to standard rate limits, and the Log Search alert with Logic Apps for processing logs and orchestrating workflows.

Step-by-Step Solution

Analyze the signal source for the VM deletion requirement.

Since VM deletion is an administrative action, it is captured in the Azure Activity Log, indicating that an Activity Log alert is required. The requirement to trigger a secure external API endpoint that requires authentication points to a Secure Webhook.

Secure Webhooks allow Azure Monitor to authenticate to APIs secured by Microsoft Entra ID.

Analyze the signal source for the CPU spike requirement.

CPU utilization is a platform metric emitted to Azure Monitor Metrics, indicating a Metric alert should be used. The rate limit of

1

message per

5

minutes matches the standard rate limiting behavior of the SMS notification type in Action Groups.

Metric alerts evaluate CPU metrics with low latency, and SMS notifications are throttled to

1

SMS every

5

minutes to prevent spamming.

Analyze the signal source for the database error requirement.

Queries running against logs in Log Analytics workspaces are processed using Log Search alerts. A multi-step recovery workflow can be triggered by calling a Logic App from the Action Group.

Log Search alerts are designed to query log data at specified intervals, and Logic Apps are suitable for running automation orchestrations.

Key Concept

Azure Monitor Alerts (Metric, Log Search, Activity Log) and Action Group actions (Secure Webhook, SMS, Logic App) have specific signal source mapping and behavioral/rate limits.

Question 1080Question →

You plan to configure Azure Backup for a new Azure virtual machine named VM1. You must complete the initial configuration steps to ensure that VM1 is backed up successfully. Arrange the steps in the correct sequence to configure backup for the virtual machine.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure backup for an Azure virtual machine, you must first create a Recovery Services vault in the same region as the virtual machine. Next, you define a backup policy specifying the frequency and retention settings. Finally, you enable backup on the virtual machine by linking it to the vault and the policy.

The correct sequence starts with creating a Recovery Services vault in the same region as the virtual machine. Then, a backup policy must be defined to establish the schedule and retention rules. Finally, backup is enabled on the virtual machine, which references both the created vault and the policy.

Step-by-Step Solution

Create a Recovery Services vault in the same Azure region as the virtual machine.

A vault is created to store the backups in the correct region.

Azure Backup requires the Recovery Services vault to be in the same geographic region as the target virtual machine.

Create a backup policy.

The backup schedule and retention configurations are defined.

A backup policy must exist to dictate when snapshots are taken and how long they are stored.

Enable backup on the virtual machine.

The virtual machine is associated with the vault and policy, initiating the configuration.

This links the virtual machine to the vault and policy, enabling protection and scheduling the initial backup.

Key Concept

Configuring Azure Virtual Machine Backup requires a Recovery Services vault in the same region, a backup policy defining schedules and retention, and enabling backup on the VM.

Estimated Time:45s

PreviousPage 54 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept