All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An administrator is responsible for recovering a critical virtual machine named `vm-db-accelerate` that runs Windows Server 2025. The virtual machine has a premium OS disk and a premium data disk with Write Accelerator enabled. The virtual machine is backed up daily to a Recovery Services vault. Following a database corruption event, the administrator needs to restore the virtual machine from a backup while ensuring that Write Accelerator remains enabled on the restored data disk. Which restore option must the administrator use?

Restore the disks, and then create a new virtual machine from the restored disks.

Select the Create New restore option from the Azure Portal restore wizard.

Select the Replace Existing restore option to overwrite the disks of the running virtual machine.

Use Item-Level Recovery to download the virtual hard disk files and attach them to a new virtual machine.

Show answer & explanation

Answer: Restore the disks, and then create a new virtual machine from the restored disks.

Answer

Restore the disks, and then create a new virtual machine from the restored disks.

Restoring the disks and then creating a new virtual machine is the correct approach. According to Microsoft Azure Backup documentation, if a virtual machine has Write Accelerator enabled, performing a direct 'Create New' virtual machine restore will result in a restored virtual machine without Write Accelerator configured. To preserve this configuration, you must choose 'Restore Disks' and then create the virtual machine from those restored disks.

Step-by-Step Solution

Navigate to the Recovery Services vault, select the backup item for the virtual machine, and trigger a restore operation.

The restore configuration options are displayed.

To initiate the recovery process from an existing backup point.

Choose the 'Restore disks' option instead of 'Create new' or 'Replace existing', specify a staging storage account, and start the restore.

The virtual hard disks (VHDs) and deployment templates are restored to the staging storage account.

Azure Backup does not support enabling Write Accelerator on restored VMs when using the direct 'Create New' VM restore option. Restoring disks is required to maintain this custom configuration.

Use the generated ARM template or custom PowerShell/CLI commands to deploy a new virtual machine from the restored disks, ensuring Write Accelerator is configured.

A new virtual machine is created with the Write Accelerator configuration intact on the premium data disk.

To complete the VM restoration while preserving advanced disk configurations.

Key Concept

Azure Virtual Machine Restore Options and Write Accelerator Limitations

Question 1082Question →

An administrator plans to deploy a new Azure Kubernetes Service (AKS) cluster named aks-shipping. The corporate network team has allocated a single subnet with the address space $192.168.10.0/25$ for the cluster. The cluster is expected to scale to a maximum of $20$ nodes, and each node must support up to $30$ pods. The pods do not require direct IP address visibility from the virtual network, but they must be able to access external resources. Which network configuration should the administrator select for the cluster to prevent IP address exhaustion?

Azure CNI

kubenet

Azure CNI with dynamic pod IP allocation

Azure CNI with a Basic Load Balancer

Show answer & explanation

Answer: kubenet

Answer

Configure the AKS cluster to use the kubenet network model.

The correct option is kubenet. The kubenet network model only assigns IP addresses to the AKS nodes from the virtual network subnet. Pods receive IP addresses from a separate, internal address range and use NAT to access resources outside the cluster. For

20

nodes, this requires only

20

IP addresses (plus a few for upgrade operations), which easily fits within the

128

IP addresses (

123

usable) provided by the

192.168.10.0/25

subnet.

Step-by-Step Solution

Calculate the available IP addresses in the subnet.

192.168.10.0/25

subnet provides

128

IP addresses, with

123

usable after Azure reserves

5

addresses.

This establishes the IP address constraint of the physical subnet hosting the cluster nodes.

Calculate the IP address requirement for Azure CNI.

For

20

nodes running

30

pods each, Azure CNI requires a minimum of

20 \times (30 + 1) = 620

IP addresses from the subnet.

Azure CNI pre-allocates VNet IP addresses to every pod, which will cause IP address exhaustion in the

/25

subnet.

Calculate the IP address requirement for kubenet.

For

20

nodes, kubenet only allocates node IPs from the subnet, requiring approximately

21

IP addresses (including upgrade margin). Pods use an internal private IP range.

This shows that kubenet fits safely within the

123

usable IP addresses of the

/25

subnet.

Key Concept

Azure Kubernetes Service network model selection based on IP address capacity constraints.

Estimated Time:1m 30s

Question 1083Question →

You plan to configure an Azure Application Gateway v2 to use an SSL certificate stored in an Azure Key Vault. You need to configure the components in the correct sequence to ensure that the Application Gateway can retrieve the certificate and secure incoming HTTPS traffic. Which sequence of steps should you perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first create the user-assigned managed identity, then grant it secrets get permissions in the Key Vault, next associate the identity with the Application Gateway, and finally configure the HTTPS listener to reference the Key Vault certificate.

To configure an Application Gateway with an SSL certificate stored in Key Vault, you must first create a user-assigned managed identity. The identity must then be granted permissions to access Key Vault secrets (certificates are stored as secrets). After that, you associate the managed identity with the Application Gateway so it can use the identity. Finally, you configure the HTTPS listener to reference the certificate URI in Key Vault, which validates successfully because the gateway now has an identity with the required access.

Step-by-Step Solution

Create a user-assigned managed identity in Azure.

A new managed identity resource is created and assigned a client ID.

An identity is required for the Application Gateway to authenticate to the Azure Key Vault securely.

Assign the Key Vault Secrets User role (or equivalent access policy) to the managed identity.

The managed identity is granted permission to read secrets from the Key Vault.

Since Key Vault certificates are retrieved as secrets by the Application Gateway, the identity must have read/get access.

Update the Application Gateway to associate it with the user-assigned managed identity.

The Application Gateway resource is configured with the identity's resource ID.

This allows the Application Gateway to act on behalf of the managed identity when calling Key Vault.

Add or update the HTTPS listener on the Application Gateway to point to the Key Vault certificate URI.

The Application Gateway retrieves the certificate and binds it to the HTTPS listener.

This completes the setup, enabling SSL/TLS termination on the Application Gateway using the managed certificate.

Key Concept

Integrating Azure Application Gateway with Azure Key Vault using managed identities for SSL/TLS certificates.

Question 1084Question →

An administrator deploys three Azure virtual networks in the East US region:
- `VNet-East` ( $192.168.1.0/24$ ) with a subnet named `Subnet-East` containing virtual machines.
- `VNet-Hub` ( $192.168.2.0/24$ ) with a subnet named `Subnet-Hub` containing virtual machines and an Azure VPN Gateway.
- `VNet-West` ( $192.168.3.0/24$ ) with a subnet named `Subnet-West` containing virtual machines.

The administrator configures virtual network peering between `VNet-East` and `VNet-Hub` with the following settings:
- On the `VNet-East` to `VNet-Hub` peering: 'Use remote gateways' is enabled and 'Allow forwarded traffic' is enabled.
- On the `VNet-Hub` to `VNet-East` peering: 'Allow gateway transit' is enabled and 'Allow forwarded traffic' is enabled.

No peering or routing is configured directly between `VNet-East` and `VNet-West`. The administrator then configures peering between `VNet-Hub` and `VNet-West` using default settings.

Based on this configuration, is the statement 'Virtual machines in `Subnet-East` can communicate with virtual machines in `Subnet-West` via the VPN Gateway in `VNet-Hub` without any additional routing configuration' true or false?

True

False

Show answer & explanation

Answer: False

Answer

The statement is false because virtual network peering in Azure is non-transitive, and a VPN Gateway in a hub network does not automatically route traffic between peered spoke networks without additional routing configurations such as User-Defined Routes (UDRs).

The statement is false because virtual network peering in Azure is non-transitive. Traffic from VNet-East cannot transit through VNet-Hub to reach VNet-West unless direct peering is established between VNet-East and VNet-West, or transit routing is configured using User-Defined Routes (UDRs) and a routing appliance (like Azure Firewall or an NVA) in the hub network.

Step-by-Step Solution

Analyze the peering topology and transitivity rules in Azure.

The topology consists of two separate peering links: one connecting VNet-East to VNet-Hub, and one connecting VNet-Hub to VNet-West. By design, Azure virtual network peering is non-transitive.

To establish whether traffic from one spoke can reach another spoke automatically through a shared hub.

Examine the peering configurations and gateway settings.

Although gateway transit is enabled on the peering link between VNet-East and VNet-Hub, the link between VNet-Hub and VNet-West uses default settings, which disables remote gateway usage. Furthermore, the Azure VPN Gateway does not automatically perform transit routing for spoke-to-spoke traffic.

To verify if the gateway configuration overrides the non-transitive behavior of peering.

Evaluate the connectivity statement.

Without direct peering between VNet-East and VNet-West, or User-Defined Routes (UDRs) and a routing appliance in VNet-Hub to forward the traffic, the VMs in Subnet-East cannot communicate with VMs in Subnet-West. Therefore, the statement is false.

To determine the correct true/false value based on Azure routing and peering constraints.

Key Concept

Virtual Network Peering transitivity and gateway transit configuration limitations

Question 1085Question →

An administrator configures an Azure Monitor activity log alert to trigger whenever a resource is deleted within a production resource group. The alert uses an action group that contains two actions: an email notification to the operations team and an SMS notification to the operations manager's mobile phone (+44 country code). During a testing window, an automated script deletes 10 temporary resources in the resource group within a two-minute period. The operations team receives 10 emails, but the operations manager only receives the first SMS notification. Which of the following is the most likely reason for this behavior?

SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes.

SMS actions in Azure Monitor action groups are rate-limited to a maximum of 10 messages per hour.

The operations manager's mobile phone country code is not supported for SMS notifications by Azure Monitor.

An alert processing rule is active that suppresses notifications for identical alerts within a 5-minute window.

Show answer & explanation

Answer: SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes.

Answer

SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes.

The correct answer is that SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes. Because the deletions occurred within a two-minute window, only the first event succeeded in sending an SMS, while the subsequent SMS notifications were suppressed by the rate-limiting mechanism. Emails were unaffected because their rate limit is much higher (100 emails per hour).

Step-by-Step Solution

Analyze the observed behavior of the notifications.

The email notification succeeded 10 times, but the SMS notification was delivered only once for the first event.

This indicates that the alert rule itself triggered 10 times and the action group was invoked 10 times, but one specific notification type (SMS) was restricted while the other (email) was not.

Evaluate the country code support.

Since the first SMS was successfully received by the manager (+44), the country code is supported by Azure Monitor action groups.

This rules out any static misconfiguration or lack of geographic support for the destination phone number.

Apply Azure Monitor action group rate limit rules to the timeline.

SMS notifications are limited to 1 message every 5 minutes, whereas email notifications are limited to 100 emails every hour.

The 10 deletions occurred within 2 minutes. The first deletion triggered the first SMS and email. The remaining 9 deletions occurred within the 5-minute SMS rate-limiting window, so the SMS actions were dropped, while the emails were delivered because 10 emails is well below the hourly limit of 100.

Key Concept

Azure Monitor Action Group Rate Limits

Question 1086Question →

You have an Azure subscription containing an Azure Virtual Machine named VM1. VM1 runs Windows Server 2025 and has its OS and data disks encrypted using Server-Side Encryption (SSE) with Customer-Managed Keys (CMK). The customer-managed key is stored in an Azure Key Vault named KV1.

You need to configure Azure Backup for VM1 by using a Recovery Services vault named Vault1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure backup for VM1, you must enable a system-assigned managed identity for Vault1, assign the Key Vault Crypto Service Encryption User role to Vault1's managed identity in KV1, create a backup policy in Vault1, and enable backup for VM1 by associating it with the backup policy.

To back up an Azure Virtual Machine encrypted with Server-Side Encryption using Customer-Managed Keys, the Recovery Services vault must be authorized to access the Key Vault key. You must first enable a system-assigned managed identity for the vault, as the identity must exist before you can assign roles to it. Second, you assign the Key Vault Crypto Service Encryption User role to the vault's managed identity on the Key Vault to grant the necessary wrap/unwrap key permissions. Third, you create the backup policy defining retention and schedule parameters. Finally, you enable backup for the VM and select the policy. This sequence ensures all identity and authorization dependencies are resolved before the backup protection is configured and validated.

Step-by-Step Solution

Enable a system-assigned managed identity for Vault1.

Vault1 is assigned a unique identity in Microsoft Entra ID.

You cannot assign Key Vault access to the vault until it has a registered identity.

In KV1, assign the Key Vault Crypto Service Encryption User role to the managed identity of Vault1.

Vault1's identity is authorized to access the customer-managed key in KV1.

Azure Backup requires permissions to wrap and unwrap keys in order to manage backups for disks encrypted with customer-managed keys.

Create a backup policy in Vault1.

A backup policy is configured containing the scheduled backups and retention timelines.

A policy must exist in the Recovery Services vault to define the backup parameters for the virtual machine.

Enable backup for VM1 and associate it with the backup policy.

VM1 backup is successfully configured and scheduled.

This is the final step that establishes VM protection and performs validation of key access.

Key Concept

Configuring Azure VM Backup for VMs encrypted with Server-Side Encryption and Customer-Managed Keys.

Question 1087Question →

An organization deploys a critical database server on a Windows Server 2025 virtual machine named db-prod-vm in the East US 2 region. The virtual machine uses Standard SSD managed disks. You need to configure backup for db-prod-vm using Azure Backup. In which location must you create the Recovery Services Vault to back up the virtual machine?

The East US 2 region

The Central US region, which is the paired region for East US 2

Any region within the United States geography

Any region, provided the vault is deployed in the same Resource Group as the virtual machine

Show answer & explanation

Answer: The East US 2 region

Answer

The Recovery Services Vault must be created in the East US 2 region.

Azure Backup requires the Recovery Services Vault to be in the same region as the virtual machine being backed up. Since the virtual machine is deployed in East US 2, the Recovery Services Vault must also be created in East US 2.

Step-by-Step Solution

Identify the region where the source virtual machine is deployed.

The virtual machine db-prod-vm is deployed in East US 2.

Azure Backup has a strict region alignment requirement for backing up virtual machines.

Determine the supported vault location based on the virtual machine's region.

The Recovery Services Vault must also be located in East US 2.

Cross-region backups for virtual machines are not supported during initial backup configuration; the vault and the VM must reside in the same region.

Key Concept

Azure Virtual Machine Backup Region Alignment

Estimated Time:45s

Question 1088Question →

Your company has an Azure environment with two subscriptions and multiple resource groups. The resources are configured as shown in the following table:

Resource Name	Type	Subscription	Resource Group	Region
`vm-retail-prod`	Virtual machine	`Sub-Prod`	`rg-retail-prod`	North Europe
`disk-retail-data`	Managed disk	`Sub-Prod`	`rg-retail-data`	West Europe
`bv-retail-ne`	Backup Vault	`Sub-Shared`	`rg-shared-infra`	North Europe
`rsv-retail-we`	Recovery Services Vault	`Sub-Shared`	`rg-shared-infra`	West Europe

You need to implement a backup solution that meets the following requirements:
1. Back up the virtual machine `vm-retail-prod` using a vault in the same region as the VM.
2. Back up the managed disk `disk-retail-data` using native Azure disk backup.

Which combination of vaults should you use to back up these resources?

Create a new Recovery Services Vault in North Europe for the virtual machine, and create a new Backup Vault in West Europe for the managed disk.

Create a new Recovery Services Vault in North Europe for the virtual machine, and use `bv-retail-ne` for the managed disk.

Use `bv-retail-ne` for the virtual machine, and create a new Backup Vault in West Europe for the managed disk.

Use `rsv-retail-we` for the virtual machine, and use `rsv-retail-we` for the managed disk.

Show answer & explanation

Answer: Create a new Recovery Services Vault in North Europe for the virtual machine, and create a new Backup Vault in West Europe for the managed disk.

Answer

Create a new Recovery Services Vault in North Europe for the virtual machine, and create a new Backup Vault in West Europe for the managed disk.

The correct configuration requires matching both the resource type and the region. Azure Virtual Machines must be backed up to a Recovery Services Vault located in the same region (North Europe). Since the existing Recovery Services Vault is in West Europe, a new one must be created in North Europe. Standalone Azure Disks must be backed up to a Backup Vault located in the same region (West Europe). Since the existing Backup Vault is in North Europe, a new one must be created in West Europe.

Step-by-Step Solution

Determine the backup requirements for the virtual machine.

The virtual machine `vm-retail-prod` requires a Recovery Services Vault because Backup Vaults do not support virtual machine backups.

Recovery Services Vaults support virtual machines, SQL Server in Azure VMs, SAP HANA in Azure VMs, and Azure Files. Backup Vaults do not support virtual machine backup.

Determine the region constraints for the virtual machine backup.

The Recovery Services Vault must be in North Europe.

Azure Virtual Machine backups require the source virtual machine and the Recovery Services Vault to reside in the exact same region.

Determine the backup requirements for the managed disk.

The managed disk `disk-retail-data` requires a Backup Vault to use native Azure Disk Backup.

Standalone Azure Disk backup is supported by Backup Vaults, not Recovery Services Vaults.

Determine the region constraints for the managed disk backup.

The Backup Vault must be in West Europe.

Azure Disk Backup requires the Backup Vault and the target managed disk to reside in the exact same region.

Key Concept

Azure backup vault types and regional alignment constraints

Question 1089Question →

An administrator is preparing to deploy an Azure Firewall to control traffic for a virtual network named `VNet-01`. The virtual network has an address space of $10.10.0.0/16$ and contains a subnet named `Subnet-01` with an address prefix of $10.10.1.0/24$ .

You need to configure the virtual network to support the Azure Firewall deployment, and ensure that all outbound traffic from `Subnet-01` to the internet is routed through the firewall.

Which configuration must be implemented?

Create a subnet named `AzureFirewallSubnet` with an address prefix of at least

/26

, and associate a route table with `Subnet-01` that has a route to

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the firewall's private IP address.

Create a subnet named `AzureFirewallSubnet` with an address prefix of at least

/26

, and associate a route table with `Subnet-01` that has a route to

0.0.0.0/0

with a next hop type of Virtual network gateway pointing to the firewall's private IP address.

Create a subnet named `FirewallSubnet` with an address prefix of at least

/28

, and associate a route table with `Subnet-01` that has a route to

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the firewall's private IP address.

Create a subnet named `AzureFirewallSubnet` with an address prefix of at least

/26

, and associate a Network Security Group (NSG) with `Subnet-01` containing a custom outbound rule that denies all traffic to

0.0.0.0/0

except when the destination is the firewall's private IP address.

Show answer & explanation

Answer: Create a subnet named `AzureFirewallSubnet` with an address prefix of at least $/26$ , and associate a route table with `Subnet-01` that has a route to $0.0.0.0/0$ with a next hop type of Virtual appliance pointing to the firewall's private IP address.

Answer

Create a subnet named `AzureFirewallSubnet` with an address prefix of at least

/26

, and associate a route table with `Subnet-01` that has a route to

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the firewall's private IP address.

To route outbound subnet traffic through Azure Firewall, a subnet named `AzureFirewallSubnet` with a prefix of at least

/26

must exist, and a route table with a default route of

0.0.0.0/0

pointing to the firewall's private IP using the Virtual appliance next hop type must be associated with the source subnet.

Step-by-Step Solution

Identify the subnet requirements for Azure Firewall.

Create a subnet named exactly `AzureFirewallSubnet` with a prefix size of at least

/26

Azure Firewall requires a dedicated subnet with this specific name and minimum prefix size to deploy and scale successfully.

Determine the routing mechanism to redirect traffic from `Subnet-01` through the firewall.

Associate a custom route table with `Subnet-01` that overrides default routing.

By default, traffic to the internet goes directly. A User-Defined Route is needed to force this traffic through the firewall.

Define the route parameters in the route table.

Add a route for

0.0.0.0/0

with a next hop type of Virtual appliance and the next hop address set to the firewall's private IP.

The Virtual appliance next hop type directs traffic to the private IP of the firewall instance, which then performs network filtering.

Key Concept

Azure Firewall deployment requires a dedicated `AzureFirewallSubnet` of at least

/26

and a User-Defined Route (UDR) pointing to its private IP with the Virtual appliance next hop type to route subnet traffic through it.

Question 1090Question →

An administrator needs to recover a business-critical virtual machine named `vm-sales-prod` by restoring its managed disks and recreating the virtual machine using the system-generated Azure Resource Manager (ARM) template. What is the correct sequence of steps to perform this recovery process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initiating the restore and selecting 'Restore disks' in the vault, waiting for the backup job to complete, accessing the generated template files, and finally executing a custom deployment using those templates.

The correct order follows the logical process of restoring disks: first, initiating the disk recovery in the vault; second, waiting for the disks and template to be fully generated; third, obtaining the template files; and fourth, deploying the template to recreate the virtual machine.

Step-by-Step Solution

Initiate restore from the vault and select 'Restore disks'.

The restore process is triggered to extract the virtual machine disks from the recovery point.

This is the first action required to retrieve the underlying virtual hard disks from the backup vault.

Wait for the restore job to complete in the vault.

The restored disks and the deployment template are written to the target location.

You cannot deploy the template or attach the disks until the export and restore process finishes.

Retrieve the template and parameters JSON files.

The ARM template files are made available for download or custom deployment.

The system-generated template contains the configuration mappings required to recreate the virtual machine with the restored disks.

Deploy the template using custom deployment in the Azure portal or command line.

A new virtual machine is provisioned using the configuration from the template and linked to the restored disks.

This completes the recovery process by spinning up a functional VM from the recovered disks.

Key Concept

Azure Virtual Machine Recovery and Restore using the 'Restore disks' feature and ARM templates.

Estimated Time:2m 0s

Question 1091Question →

An administrator manages three Azure virtual networks in the North Europe region:

* `VNet-A` with an address space of $10.10.0.0/16$ contains a virtual machine named `VM-A` in a subnet named `Subnet-A` ( $10.10.1.0/24$ ).
* `VNet-B` with an address space of $10.20.0.0/16$ contains a virtual machine named `VM-B` in a subnet named `Subnet-B` ( $10.20.1.0/24$ ).
* `VNet-C` with an address space of $10.30.0.0/16$ contains a virtual machine named `VM-C` in a subnet named `Subnet-C` ( $10.30.1.0/24$ ).

The administrator establishes the following peering connections using default settings:

* `Peering-AB` connects `VNet-A` to `VNet-B`.
* `Peering-BC` connects `VNet-B` to `VNet-C`.

No virtual network gateways or user-defined routes are deployed. `VM-A` can successfully communicate with `VM-B`, but cannot communicate with `VM-C`.

What should the administrator do to allow `VM-A` to communicate with `VM-C`?

Create a direct virtual network peering connection between `VNet-A` and `VNet-C`.

Enable 'Allow forwarded traffic' on both `Peering-AB` and `Peering-BC`.

Enable 'Allow gateway transit' on `Peering-AB` and configure 'Use remote gateways' on `Peering-BC`.

Create and associate a route table with `Subnet-A` and `Subnet-C` that contains a route to the remote network with a next hop type of Virtual Network.

Show answer & explanation

Answer: Create a direct virtual network peering connection between `VNet-A` and `VNet-C`.

Answer

Create a direct virtual network peering connection between `VNet-A` and `VNet-C`.

The correct answer is correct because virtual network peering in Azure is non-transitive. This means that two virtual networks cannot communicate through a transit network unless a Network Virtual Appliance (NVA) or a Virtual Network Gateway is configured to route the traffic. Since no gateways or NVAs are deployed in this scenario, the only way to allow direct communication between `VM-A` and `VM-C` is to establish a direct peering connection between `VNet-A` and `VNet-C`.

Step-by-Step Solution

Analyze the virtual network peering topology.

The topology is a linear chain: `VNet-A` is peered to `VNet-B`, and `VNet-B` is peered to `VNet-C`.

Understanding the layout helps determine why communication fails between the end networks.

Evaluate Azure Virtual Network Peering transit behavior.

Azure Virtual Network Peering is non-transitive. Traffic from `VNet-A` cannot transit through `VNet-B` to reach `VNet-C` by default.

This explains why `VM-A` cannot talk to `VM-C` despite both being peered to `VNet-B`.

Determine the solution with minimal complexity and no additional routing appliances.

Establishing a direct peering link between `VNet-A` and `VNet-C` will enable communication.

Direct peering connects the two networks over the Microsoft backbone without requiring NVAs or gateways.

Key Concept

Azure Virtual Network Peering is non-transitive by default.

Question 1092Question →

You have an Azure virtual network named `VNet1` that contains three subnets named `SubnetA` ( $10.0.1.0/24$ ), `SubnetB` ( $10.0.2.0/24$ ), and `DMZSubnet` ( $10.0.0.0/24$ ). A Network Virtual Appliance (NVA) named `NVA1` is deployed in `DMZSubnet` and has the IP address $10.0.0.4$ .

You need to ensure that all traffic from `SubnetA` to the internet is routed through `NVA1`.

Which two actions should you perform? (Select two.)

Select all that apply

Create a route table, add a route for

0.0.0.0/0

with a next hop type of Virtual appliance and a next hop IP address of

10.0.0.4

, and associate the route table with SubnetA.

Enable IP forwarding on the network interface of NVA1.

Create a route table, add a route for

0.0.0.0/0

with a next hop type of Virtual network gateway and a next hop IP address of

10.0.0.4

, and associate the route table with SubnetA.

Enable IP forwarding on the network interfaces of all virtual machines in SubnetA.

Show answer & explanation

Answer: Create a route table, add a route for $0.0.0.0/0$ with a next hop type of Virtual appliance and a next hop IP address of $10.0.0.4$ , and associate the route table with SubnetA.; Enable IP forwarding on the network interface of NVA1.

Answer

To successfully route SubnetA's internet traffic through NVA1, you must create a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual appliance and a next hop IP address of

10.0.0.4

, associate this route table with SubnetA, and enable IP forwarding on the network interface of NVA1.

To route internet traffic from SubnetA through NVA1, you need to create a UDR table with a route targeting the internet (

0.0.0.0/0

) using the Virtual appliance next hop type pointing to the private IP of NVA1 (

10.0.0.4

), and associate this route table with SubnetA. In addition, you must enable IP forwarding on the network interface of NVA1 to permit it to receive and forward transit packets destined for other networks.

Step-by-Step Solution

Configure the User-Defined Route (UDR) table.

A route table is created and associated with SubnetA, containing a route redirecting

0.0.0.0/0

traffic to the next hop IP

10.0.0.4

with a type of Virtual appliance.

This overrides the default system route for internet traffic (

0.0.0.0/0

), sending it to the NVA instead of directly to the internet.

Enable IP forwarding on the network virtual appliance.

IP forwarding is enabled on the network interface (NIC) of NVA1.

Azure NICs discard packets that do not match their assigned IP address by default. Enabling IP forwarding allows the NVA's NIC to accept and forward transit packets originating from other resources.

Key Concept

Redirecting subnet traffic to a Network Virtual Appliance (NVA) requires configuring a UDR table with a next hop type of Virtual appliance pointing to the NVA's private IP, along with enabling IP forwarding on the NVA's network interface.

Question 1093Question →

An administrator is configuring a new Azure Kubernetes Service (AKS) cluster named aks-retail. The cluster will be deployed in an existing virtual network (VNet) named VNet1. VNet1 has a single subnet named Subnet1 with the address prefix $10.150.0.0/24$ . Due to enterprise IP addressing constraints, no additional subnets can be created in VNet1, and VNet1 cannot be expanded. The cluster must support up to $5$ nodes and $200$ pods. The pods must be able to communicate with each other, and you must use Azure Network Policies to secure pod-to-pod traffic.

Which two network configuration options should you select to meet these requirements? (Select two.)

Select all that apply

Configure the network plugin to use Azure CNI with Overlay.

Configure the network plugin to use Kubenet.

Define a Pod CIDR block that does not overlap with the virtual network or peered networks.

Configure the network plugin to use Azure CNI with dynamic pod IP allocation.

Enable Azure Network Policies on the Kubenet network plugin.

Show answer & explanation

Answer: Configure the network plugin to use Azure CNI with Overlay.; Define a Pod CIDR block that does not overlap with the virtual network or peered networks.

Answer

Configure the network plugin to use Azure CNI with Overlay and define a Pod CIDR block that does not overlap with the virtual network or peered networks.

To support Azure Network Policies while preventing VNet IP address exhaustion and meeting the constraint of not adding new subnets, Azure CNI Overlay is the correct network model. Under Azure CNI Overlay, nodes receive IP addresses from the existing subnet, but pods receive IP addresses from a separate, non-overlapping Pod CIDR block that is defined outside the virtual network.

Step-by-Step Solution

Analyze the IP constraints and subnet limitations.

Standard Azure CNI cannot be used because it requires a large block of IP addresses from the subnet, which exceeds the

251

available IPs in the

10.150.0.0/24

subnet for

5

nodes and

200

pods. Additionally, dynamic pod IP allocation cannot be used because it requires a separate subnet, which violates the requirement that no additional subnets can be created.

Understanding IP subnet limits helps narrow down the network model options.

Evaluate network plugin capabilities for policy requirements.

Kubenet is ruled out because it does not support Azure Network Policies, which is a key requirement.

Ensuring policy compatibility helps select the correct network plugin.

Select Azure CNI Overlay and configure its required parameters.

Azure CNI Overlay is selected. It only assigns node IPs from the VNet subnet, while pods get IPs from a separate overlay address space (Pod CIDR) that must not overlap with the virtual network or peered networks.

Azure CNI Overlay meets both the network policy requirement and the IP address capacity limits under the subnet constraints.

Key Concept

Azure CNI Overlay is designed to resolve VNet IP exhaustion by using a separate overlay address space for pods while supporting standard Azure Network Policies.

Question 1094Question →

An organization deploys an Azure App Service named app-prod-01 that hosts a web application at the default URL app-prod-01.azurewebsites.net. You configure an Azure Application Gateway v2 to publish the web application to the public internet using the custom domain name www.contoso.com. You configure a DNS CNAME record for www.contoso.com pointing to the public IP address of the Application Gateway. You add app-prod-01.azurewebsites.net as a target in the backend pool of the Application Gateway. When users attempt to access https://www.contoso.com, they receive an HTTP 502 (Bad Gateway) error. What should you do on the Application Gateway to resolve the error?

In the Backend Settings of the Application Gateway, enable the host name override and choose to pick the host name from the backend target.

In the App Service Plan configuration, scale down the pricing tier to Free (F1) to disable the default custom domain hostname verification.

Create a User-Defined Route (UDR) on the Application Gateway subnet that specifies the App Service IP address as the next hop with a type of Virtual Network Gateway.

Create an inbound security rule in the Network Security Group (NSG) associated with the Application Gateway subnet that denies traffic from the GatewayManager service tag with a priority of 150.

Show answer & explanation

Answer: In the Backend Settings of the Application Gateway, enable the host name override and choose to pick the host name from the backend target.

Answer

In the Backend Settings of the Application Gateway, enable the host name override and choose to pick the host name from the backend target.

Azure App Service requires that the incoming HTTP host header matches either its default '*.azurewebsites.net' domain name or an explicitly configured custom domain name. By default, Azure Application Gateway preserves the original host header from the client request (in this case, 'www.contoso.com') when forwarding traffic to the backend. Since the App Service is not configured with 'www.contoso.com', it rejects the request, causing the Application Gateway to return an HTTP 502 Bad Gateway error. Enabling the host name override option and picking the host name from the backend target in the Backend Settings ensures that the Application Gateway rewrites the host header to 'app-prod-01.azurewebsites.net' before forwarding the request.

Step-by-Step Solution

Identify the cause of the HTTP 502 (Bad Gateway) error when integrating Application Gateway with Azure App Service.

The App Service expects incoming requests to have a host header matching its default domain (app-prod-01.azurewebsites.net), but the Application Gateway forwards the original client host header (www.contoso.com).

By default, Application Gateway does not modify the host header of forwarded requests.

Configure the Application Gateway to override the host header.

Modify the Backend Settings associated with the App Service backend pool.

Backend Settings define how the Application Gateway connects and forwards requests to the backend servers.

Enable the 'Override with new host name' option and select 'Pick host name from backend target'.

The Application Gateway now dynamically overrides the host header in forwarded requests with the domain name of the App Service.

This allows the App Service to successfully match the host header, resolve the request, and prevent the HTTP 502 error.

Key Concept

Configuring backend settings and host header overrides in Azure Application Gateway for App Service integration

Question 1095Question →

Your company has an Azure virtual network named `VNet1` that contains a workload subnet named `Subnet1`. You need to deploy Azure Firewall to control outbound internet traffic from `Subnet1`. Which two configuration changes must you perform? (Choose two.)

Select all that apply

Create a subnet named AzureFirewallSubnet with an address prefix of /26 or larger.

Create a route table associated with Subnet1 that routes 0.0.0.0/0 to the private IP address of the firewall using a next hop type of Virtual appliance.

Create a subnet named AzureFirewallSubnet with an address prefix of /28.

Create a route table associated with Subnet1 that routes 0.0.0.0/0 to the public IP address of the firewall using a next hop type of Virtual Network Gateway.

Show answer & explanation

Answer: Create a subnet named AzureFirewallSubnet with an address prefix of /26 or larger.; Create a route table associated with Subnet1 that routes 0.0.0.0/0 to the private IP address of the firewall using a next hop type of Virtual appliance.

Answer

To configure Azure Firewall, you must create a dedicated subnet named AzureFirewallSubnet with an address prefix of /26 or larger, and configure a user-defined route in a route table associated with the workload subnet that directs 0.0.0.0/0 traffic to the private IP address of the firewall using the Virtual appliance next hop type.

Deploying Azure Firewall requires a dedicated subnet named AzureFirewallSubnet with a minimum size of /26. To direct outbound traffic through the firewall, a user-defined route for 0.0.0.0/0 must be configured with a next hop type of Virtual appliance pointing to the private IP address of the firewall.

Step-by-Step Solution

Determine the subnet requirements for Azure Firewall

Identify that Azure Firewall requires a dedicated subnet named AzureFirewallSubnet with a minimum prefix of /26.

Azure Firewall cannot be deployed into standard workload subnets and needs a sufficiently large dedicated subnet to scale.

Determine the routing requirements to direct traffic to the firewall

Identify that a route table with a default route of 0.0.0.0/0 pointing to the firewall's private IP address with a next hop of Virtual appliance is required.

Outbound traffic from workloads must be explicitly redirected to the private IP of the firewall; setting the wrong next hop type or using the public IP will break routing.

Associate the route table to the workload subnet

The route table is linked to Subnet1.

This applies the routing rules to the workload subnet's outbound traffic.

Key Concept

Azure Firewall deployment requires a dedicated subnet named AzureFirewallSubnet with at least a /26 prefix. Routing traffic through it requires a User-Defined Route (UDR) pointing to the firewall's private IP address with the Virtual appliance next hop type.

Question 1096Question →

You have an Azure subscription that contains the following resources in the North Europe region:
- A Recovery Services vault named `rsv-ne-backup`.
- A Premium storage account named `sa-hr-records` that hosts an SMB file share named `hr-documents`.
- A resource group named `rg-hr-prod` containing both resources.

The firewall for `sa-hr-records` is enabled and configured to allow access only from selected virtual networks.
An administrator named Admin1 is assigned the Storage Account Contributor role for the `sa-hr-records` storage account and the Backup Operator role for the `rsv-ne-backup` vault.
When Admin1 attempts to configure backup for the `hr-documents` file share using the `rsv-ne-backup` vault, the configuration fails because the storage account is network-isolated and inaccessible to the vault.
Which configuration change should you make to resolve the issue?

Add the outbound IP addresses of the Recovery Services vault to the allowed IP ranges in the firewall settings of the storage account.

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the firewall configuration of the storage account.

Assign the Storage File Data Privileged Contributor role to the managed identity of the Recovery Services vault on the storage account.

Assign the Backup Operator role to the system-assigned managed identity of the storage account.

Show answer & explanation

Answer: Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the firewall configuration of the storage account.

Answer

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the firewall configuration of the storage account.

To back up an Azure File Share hosted in a storage account with an active firewall, you must allow Azure Backup to bypass the firewall. This is achieved by enabling the 'Allow Azure services on the trusted services list to access this storage account' setting in the storage account's network configuration.

Step-by-Step Solution

Analyze the configuration failure

The configuration fails because the Premium storage account hosting the SMB file share has a firewall enabled, blocking the Recovery Services vault from communicating with it.

Azure Backup needs control-plane access to the storage account to manage snapshots and register the file share.

Evaluate network access options for Azure Backup

Since Recovery Services vaults do not have static outbound IP addresses, standard IP firewall rules cannot be used to permit vault access.

Dynamic IP resources require a service-level exception rather than static IP whitelisting.

Configure the trusted services exception

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting on the storage account firewall.

This allows Azure Backup, which is a trusted Microsoft service, to bypass the firewall rules and orchestrate backups of the file share.

Key Concept

Backing up Azure Files in a firewall-secured storage account using Recovery Services Vault

Question 1097Question →

An administrator is configuring Azure Monitor alerts and action groups to support automated operations and notifications. Match each operational requirement to the most appropriate Azure Monitor Action Group action type. Each action type may be used once, more than once, or not at all.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The requirement to notify subscription owners matches the Email Azure Resource Manager Role action. The requirement to send push notifications to the mobile app matches the Email/SMS/Push/Voice action. The requirement to invoke a script in Azure Automation matches the Automation Runbook action. The requirement to deliver a payload requiring Entra ID authentication matches the Secure Webhook action.

Each requirement is mapped to its most specific and functional Action Group action type. Subscription owners are notified using the Email Azure Resource Manager Role action. Push notifications are configured via the Email/SMS/Push/Voice action. Remediation scripts are executed using the Automation Runbook action. Authenticated API calls are handled via the Secure Webhook action.

Step-by-Step Solution

Analyze the requirement for notifying owners of an Azure subscription.

Identify that notifying users based on subscription-level RBAC roles corresponds to the Email Azure Resource Manager Role action.

This avoids hardcoding individual email addresses and dynamically resolves to users holding the Owner role.

Analyze the requirement for sending push notifications to the Azure mobile app.

Identify that mobile push notifications are grouped under the Email/SMS/Push/Voice action type.

This receiver handles direct messaging to user endpoints, including email, SMS text messages, push notifications, and voice calls.

Analyze the requirement to run a script in Azure Automation to restart a VM.

Identify that triggering an automated task or script in Azure Automation corresponds to the Automation Runbook action.

Runbooks are the standard way to execute long-running administrative or remediation tasks in Azure Automation.

Analyze the requirement to send a JSON payload securely with Microsoft Entra ID authentication.

Identify that secure delivery to APIs requiring Entra ID authentication corresponds to the Secure Webhook action.

Secure Webhook uses a service principal and OAuth 2.0 token to authenticate the outgoing request from Azure Monitor.

Key Concept

Azure Monitor Action Groups support various action types (receivers) to dispatch notifications or execute automated remediation tasks when alerts trigger.

Question 1098Question →

An administrator is configuring virtual network peering to establish hybrid connectivity. The environment contains the following resources:
- VNet-Transit-Hub with the address space $172.16.0.0/16$ contains a virtual network gateway named `VPNGateway-Hub` in a subnet named `GatewaySubnet` ( $172.16.0.0/24$ ). `VPNGateway-Hub` is connected to an on-premises network.
- VNet-Client-Spoke with the address space $172.24.0.0/16$ contains a subnet named `Subnet-Application` ( $172.24.1.0/24$ ) where a virtual machine named `VM-App` is deployed.
- A virtual network peering link is established between `VNet-Transit-Hub` and `VNet-Client-Spoke`.

You need to ensure that `VM-App` can communicate with the on-premises network by routing traffic through `VPNGateway-Hub`.

Which two configurations must you enable? (Select two.)

Select all that apply

Enable "Use remote gateways" on the peering link from VNet-Client-Spoke to VNet-Transit-Hub.

Enable "Allow gateway transit" on the peering link from VNet-Transit-Hub to VNet-Client-Spoke.

Enable "Allow forwarded traffic" on the peering link from VNet-Client-Spoke to VNet-Transit-Hub.

Enable "Use remote gateways" on the peering link from VNet-Transit-Hub to VNet-Client-Spoke.

Show answer & explanation

Answer: Enable "Use remote gateways" on the peering link from VNet-Client-Spoke to VNet-Transit-Hub.; Enable "Allow gateway transit" on the peering link from VNet-Transit-Hub to VNet-Client-Spoke.

Answer

Enable "Use remote gateways" on the peering link from VNet-Client-Spoke to VNet-Transit-Hub, and enable "Allow gateway transit" on the peering link from VNet-Transit-Hub to VNet-Client-Spoke.

To allow the virtual machine in the spoke network to use the gateway in the hub network, two settings must be configured. First, on the hub's side of the peering link, you must allow gateway sharing by enabling 'Allow gateway transit'. Second, on the spoke's side of the peering link, you must configure the network to use that remote gateway by enabling 'Use remote gateways'. Together, these settings establish the path for hybrid traffic traversal.

Step-by-Step Solution

Configure the hub-to-spoke peering link configuration.

"Allow gateway transit" is enabled on the peering from VNet-Transit-Hub to VNet-Client-Spoke.

This configuration allows the hub VNet to share its virtual network gateway with the peered spoke VNet.

Configure the spoke-to-hub peering link configuration.

"Use remote gateways" is enabled on the peering from VNet-Client-Spoke to VNet-Transit-Hub.

This configuration allows resources in the spoke VNet to route traffic through the remote gateway in the hub VNet.

Verify end-to-end data plane connectivity.

VM-App in VNet-Client-Spoke can successfully route traffic to the on-premises network.

Both sides of the gateway transit configuration must be enabled for transit routing to work correctly.

Key Concept

Gateway transit in virtual network peering allows a peered virtual network to use the virtual network gateway of another virtual network for cross-premises connectivity.

Alternative Method

Instead of virtual network peering with gateway transit, you could deploy a separate virtual network gateway in the spoke network and establish a separate VPN connection to the on-premises network, although this increases administrative overhead and cost.

Estimated Time:1m 30s

Question 1099Question →

You plan to configure an Azure Application Gateway v2 to handle traffic for a web application. You must ensure that all incoming HTTP requests on port 80 are redirected to HTTPS on port 443 before being forwarded to the backend pool.

Which two of the following components must you configure to accomplish the HTTP-to-HTTPS redirection? (Select two.)

Select all that apply

An HTTP listener configured on port 80.

A request routing rule that uses a redirect configuration targeting the HTTPS listener.

A backend setting with a custom redirection policy targeting port 443.

A custom health probe configured to monitor HTTPS port 443 on the backend servers.

Show answer & explanation

Answer: An HTTP listener configured on port 80.; A request routing rule that uses a redirect configuration targeting the HTTPS listener.

Answer

To redirect HTTP traffic to HTTPS, you must configure an HTTP listener on port 80 to receive the incoming traffic and a request routing rule that uses a redirect configuration targeting the HTTPS listener.

Configuring an HTTP listener on port 80 and a request routing rule that uses a redirect configuration targeting the HTTPS listener allows the Application Gateway to receive port 80 traffic and redirect it to the HTTPS listener before it ever reaches the backend pool.

Step-by-Step Solution

Create an HTTP listener on port 80.

The Application Gateway actively listens for and receives incoming HTTP requests on port 80.

You must capture the unencrypted HTTP traffic before you can apply redirection logic to it.

Configure the request routing rule associated with the HTTP listener.

The routing rule is configured to use a redirection type and target the HTTPS listener.

This links the incoming HTTP traffic to the redirection action, sending clients to the secure endpoint.

Key Concept

HTTP-to-HTTPS redirection on Azure Application Gateway requires routing traffic from an HTTP listener to an HTTPS listener using a request routing rule with redirect configuration.

Question 1100Question →

You have an Azure subscription that contains a Private DNS zone named `internal.contoso.com`. You have three virtual networks named `VNet-Admin`, `VNet-App`, and `VNet-DB` in the same region.

The resources are configured as follows:
- `VNet-Admin` is linked to `internal.contoso.com` with auto-registration enabled.
- `VNet-App` is linked to `internal.contoso.com` with auto-registration disabled.
- `VNet-DB` is not linked to `internal.contoso.com`.
- `VNet-App` and `VNet-DB` are connected via virtual network peering.

Which two statements accurately describe the DNS resolution and registration behavior in this subscription? (Select two.)

Select all that apply

Virtual machines in VNet-App can resolve the DNS records of virtual machines in VNet-Admin.

Virtual machines in VNet-DB cannot resolve DNS records in internal.contoso.com.

Virtual machines in VNet-DB can resolve DNS records in internal.contoso.com because of the peering link with VNet-App.

Virtual machines in VNet-App automatically register their hostnames in internal.contoso.com.

Show answer & explanation

Answer: Virtual machines in VNet-App can resolve the DNS records of virtual machines in VNet-Admin.; Virtual machines in VNet-DB cannot resolve DNS records in internal.contoso.com.

Answer

Virtual machines in VNet-App can resolve the DNS records of virtual machines in VNet-Admin, and virtual machines in VNet-DB cannot resolve DNS records in internal.contoso.com.

Virtual machines in virtual networks linked to an Azure Private DNS zone can resolve records within that zone. Because VNet-Admin is linked with auto-registration enabled, its VMs are registered. Because VNet-App is linked to the zone, its VMs can resolve those registered records. Since VNet-DB is not linked to the zone, it cannot resolve records within it. Virtual network peering does not transitively share Private DNS zone links, meaning VNet-DB remains unable to resolve internal names despite the peering link.

Step-by-Step Solution

Analyze VNet-Admin configuration

Since VNet-Admin is linked to internal.contoso.com with auto-registration enabled, hostnames of VMs in VNet-Admin are registered automatically in the private DNS zone.

Auto-registration on a virtual network link allows automatic creation of A records for VMs in that VNet.

Analyze VNet-App configuration

Since VNet-App is linked to internal.contoso.com with auto-registration disabled, VMs in VNet-App do not auto-register, but they can query the zone and resolve existing records, including VNet-Admin's registered records.

Any linked virtual network can resolve records in the Private DNS zone, even if auto-registration is disabled.

Analyze VNet-DB configuration

Since VNet-DB is not linked to internal.contoso.com, its VMs cannot resolve records in the zone. Peering with VNet-App does not transitively provide access to the Private DNS zone link.

Private DNS zone resolution requires an explicit virtual network link; network peering does not share name resolution configuration by default.

Key Concept

Azure Private DNS Zone virtual network links and auto-registration behavior

Estimated Time:1m 30s

PreviousPage 55 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution