All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

A company runs a Windows Server virtual machine named vm-hr-encryption that uses Azure Disk Encryption (ADE) to secure its OS and data disks. The virtual machine is backed up daily to a Recovery Services vault. Following a failed software installation, the operating system on the virtual machine is corrupted and cannot boot. The operations team needs to recover the virtual machine to a functional state using the latest recovery point. What is the correct method to recover this virtual machine?

Deploy a new virtual machine directly from the recovery point by selecting the 'Create virtual machine' option in the Azure portal.

Overwrite the corrupted disks of the running virtual machine by selecting the 'Replace existing' option in the Azure portal.

Restore the virtual machine's disks to a staging storage account, and then recreate the virtual machine using PowerShell or a template.

Download the Item-Level Recovery script to mount the recovery point volume and manually overwrite the system files.

Show answer & explanation

Answer: Restore the virtual machine's disks to a staging storage account, and then recreate the virtual machine using PowerShell or a template.

Answer

Restore the virtual machine's disks to a staging storage account, and then recreate the virtual machine using PowerShell or a template.

For virtual machines encrypted using Azure Disk Encryption (ADE), direct restoration methods such as creating a new virtual machine or replacing existing disks directly from the Recovery Services vault are not supported. Instead, you must restore the virtual machine disks to a staging storage account first. After the disks are restored, you must recreate the virtual machine using PowerShell or an Azure Resource Manager (ARM) template by linking the restored disks and the original Key Vault secret configuration.

Step-by-Step Solution

Select the Recovery Services vault, navigate to the backup items, and choose the backup item for the encrypted virtual machine.

The backup dashboard for the virtual machine is displayed, showing the available recovery points.

To initiate the recovery process from the correct backup location.

Select the latest recovery point, choose the 'Restore disks' option, and specify a staging storage account.

A restore job is created to extract the virtual machine disks to the staging storage account.

Direct virtual machine creation or disk replacement is not supported for Azure Disk Encryption (ADE) encrypted virtual machines.

Use the restored disks template or run a PowerShell script to create a new virtual machine referencing the restored disks and the original Key Vault settings.

A fully functional, encrypted virtual machine is deployed using the restored disks.

To complete the VM recreation process and associate the restored disks with the appropriate key vault secrets.

Key Concept

Azure Disk Encryption (ADE) restore constraints

Alternative Method

Alternatively, you can perform the restore using Azure CLI by first running 'az backup restore restore-disks' and then creating the VM from the restored managed disks using the CLI or a customized ARM template.

Estimated Time:1m 30s

Question 1102Question →

An organization manages resources across two subscriptions, Sub-Production and Sub-Development, as configured in the following table:

Subscription	Resource Group	Resource Name	Type	Region
Sub-Production	rg-prod-eu	vm-web-01	Virtual Machine	France Central
Sub-Production	rg-prod-eu	disk-web-data	Managed Disk	France Central
Sub-Production	rg-prod-eu	RSV-Central	Recovery Services Vault	Germany West Central
Sub-Production	rg-prod-eu	BV-Central	Backup Vault	Germany West Central
Sub-Development	rg-dev-de	vm-dev-01	Virtual Machine	Germany West Central
Sub-Development	rg-dev-de	db-dev-pg	Azure Database for PostgreSQL	Germany West Central
Sub-Development	rg-dev-de	RSV-Dev	Recovery Services Vault	Germany West Central

You must implement a backup strategy to meet the following requirements:
1. Configure backup for the vm-web-01 virtual machine.
2. Configure backup for the disk-web-data managed disk.
3. Configure backup for the db-dev-pg database.

Which two actions should you perform? (Select two.)

Select all that apply

Create a new Recovery Services Vault in the France Central region, and then configure backup for vm-web-01.

Create a new Backup Vault in the France Central region, and then configure backup for disk-web-data.

Configure backup for vm-web-01 by using RSV-Central.

Configure backup for disk-web-data by using BV-Central.

Show answer & explanation

Answer: Create a new Recovery Services Vault in the France Central region, and then configure backup for vm-web-01.; Create a new Backup Vault in the France Central region, and then configure backup for disk-web-data.

Answer

Create a new Recovery Services Vault in the France Central region to configure backup for the virtual machine, and create a new Backup Vault in the France Central region to configure backup for the managed disk.

To back up the virtual machine vm-web-01, you must use a Recovery Services Vault located in the same region (France Central). Since no Recovery Services Vault exists in France Central, you must create one there. Similarly, to back up the managed disk disk-web-data, you must use a Backup Vault in the same region (France Central). Since the existing Backup Vault is in Germany West Central, you must create a new Backup Vault in France Central.

Step-by-Step Solution

Identify the regional requirements for backing up the virtual machine.

vm-web-01 is in France Central. The backup requires a Recovery Services Vault in the same region. The existing vaults are in Germany West Central. Therefore, a new Recovery Services Vault must be created in France Central.

Azure VM backups are restricted to Recovery Services Vaults within the same geographic region as the VM.

Identify the regional and vault type requirements for backing up the managed disk.

disk-web-data is in France Central. Managed disk backups require a Backup Vault in the same region. The existing Backup Vault (BV-Central) is in Germany West Central. Therefore, a new Backup Vault must be created in France Central.

Azure Managed Disk backups use Backup Vaults and are restricted to the same region as the source disk.

Verify the configuration for the database db-dev-pg.

db-dev-pg is in Germany West Central. It can be backed up using the existing BV-Central Backup Vault since they are in the same region.

PostgreSQL backup is supported by Backup Vaults and the resource and vault reside in the same region, so no new vault is required for this component.

Key Concept

Recovery Services Vaults and Backup Vaults support different resource types and enforce strict regional boundaries for backups.

Question 1103Question →

An administrator configures an Azure Private DNS zone named corp.adatum.com. The environment contains two virtual networks named VNet-App and VNet-DB that are connected via virtual network peering. The corp.adatum.com zone has a virtual network link to VNet-DB with auto-registration enabled. A virtual machine named VM-DB1 is deployed in VNet-DB and is registered in the zone. A virtual machine named VM-App1 is deployed in VNet-App. From VM-App1, attempts to resolve the name vm-db1.corp.adatum.com fail, although network traffic can flow between the virtual machines. What should the administrator do to resolve the name resolution issue?

Configure the virtual network peering to use gateway transit.

Link the VNet-App virtual network to the corp.adatum.com Private DNS zone.

Configure the DNS servers setting of VNet-App to point to the IP address of VM-DB1.

Configure a DNS service endpoint on the subnet of VNet-App.

Show answer & explanation

Answer: Link the VNet-App virtual network to the corp.adatum.com Private DNS zone.

Answer

Link the VNet-App virtual network to the corp.adatum.com Private DNS zone.

To resolve domain names in an Azure Private DNS zone, the virtual network containing the client must have a virtual network link to the DNS zone. Peering alone does not propagate private DNS resolution. Therefore, linking the application virtual network to the private DNS zone is required to allow name resolution.

Step-by-Step Solution

Identify that VM-App1 is located in VNet-App, which currently lacks a virtual network link to the Private DNS zone corp.adatum.com.

Confirming the reason why VM-App1 cannot resolve names in the private DNS zone, despite peering being established.

Azure Private DNS resolution requires a direct virtual network link for any network that needs to resolve records within that private zone.

Configure a new virtual network link in the corp.adatum.com Private DNS zone.

A virtual network link is established pointing to VNet-App.

This link allows the Azure DNS resolver in VNet-App to query the records in corp.adatum.com.

Verify name resolution from VM-App1.

VM-App1 successfully resolves vm-db1.corp.adatum.com to its private IP address.

The newly created link enables VM-App1 to access the zone records.

Key Concept

Azure Private DNS Virtual Network Link

Estimated Time:1m 30s

Question 1104Question →

An administrator is deploying a new Azure Kubernetes Service (AKS) cluster named aks-corp to run internal workloads. The cluster nodes will be deployed into an existing virtual network subnet with the IP address range $172.16.0.0/20$ . The virtual network is peered with an on-premises network that uses the range $192.168.1.0/24$ . You decide to use the Kubenet network plugin. Which combination of Pod CIDR and Service CIDR is valid for this deployment?

Pod CIDR:

10.244.0.0/16

; Service CIDR:

10.0.0.0/16

Pod CIDR:

172.16.16.0/20

; Service CIDR:

172.16.0.0/20

Pod CIDR:

192.168.1.0/24

; Service CIDR:

10.0.0.0/16

Pod CIDR:

10.244.0.0/16

; Service CIDR:

10.244.0.0/16

Show answer & explanation

Answer: Pod CIDR: $10.244.0.0/16$ ; Service CIDR: $10.0.0.0/16$

Answer

Pod CIDR:

10.244.0.0/16

; Service CIDR:

10.0.0.0/16

The correct configuration uses Pod CIDR

10.244.0.0/16

and Service CIDR

10.0.0.0/16

. These ranges do not overlap with the node subnet range of

172.16.0.0/20

, the peered network range of

192.168.1.0/24

, or each other, which satisfies the AKS networking prerequisites.

Step-by-Step Solution

Identify the existing and peered network ranges that must be avoided to prevent IP address overlaps.

The node subnet range is

172.16.0.0/20

and the peered on-premises network range is

192.168.1.0/24

AKS requires that neither the Pod CIDR nor the Service CIDR overlap with these existing network spaces.

Ensure that the proposed Pod CIDR and Service CIDR do not overlap with each other.

The Pod CIDR and Service CIDR must be distinct, non-overlapping IP address spaces.

Internal cluster routing will fail if pods and services share the same subnet ranges.

Evaluate the options against these criteria.

Only the configuration with Pod CIDR

10.244.0.0/16

and Service CIDR

10.0.0.0/16

satisfies all isolation requirements.

This configuration avoids all overlaps with the node subnet, the peered network, and each other.

Key Concept

AKS Kubenet IP Addressing and Overlap Rules

Question 1105Question →

An organization is implementing a centralized security architecture in Azure. They deploy an Azure Firewall in a virtual network named `VNet-Central`. The private IP address of the firewall is `10.100.0.4`. To route all outbound internet traffic from a workload subnet in the same virtual network through the firewall, a new route table must be configured and associated with the workload subnet. Which route configuration should be added to the route table?

Address prefix: `0.0.0.0/0`, Next hop type: `Virtual appliance`, Next hop IP address: `10.100.0.4`

Address prefix: `0.0.0.0/0`, Next hop type: `Virtual Network Gateway`, Next hop IP address: `10.100.0.4`

Address prefix: `0.0.0.0/0`, Next hop type: `Virtual appliance`, Next hop IP address: The public IP address of the Azure Firewall

Address prefix: `0.0.0.0/0`, Next hop type: `Internet`, Next hop IP address: None

Show answer & explanation

Answer: Address prefix: `0.0.0.0/0`, Next hop type: `Virtual appliance`, Next hop IP address: `10.100.0.4`

Answer

To route outbound internet traffic through the Azure Firewall, configure a route with the address prefix `0.0.0.0/0`, the next hop type set to `Virtual appliance`, and the next hop IP address set to the private IP address of the firewall (`10.100.0.4`).

To route outbound internet traffic through an Azure Firewall, you must define a custom route with the address prefix `0.0.0.0/0`. The next hop type must be `Virtual appliance` to target the firewall, and the next hop IP address must be the private IP address of the firewall (`10.100.0.4`) so that the traffic is correctly forwarded to the firewall's internal interface.

Step-by-Step Solution

Identify the destination for all internet traffic.

The destination address prefix is `0.0.0.0/0` representing all IPv4 addresses external to the virtual network.

Outbound default routing in Azure is defined by the destination prefix `0.0.0.0/0`.

Select the correct next hop type for a firewall appliance.

The next hop type must be set to `Virtual appliance`.

Azure Firewall acts as a network virtual appliance (NVA) to inspect and filter traffic.

Determine the next hop IP address for routing within the virtual network.

The next hop IP address is the private IP address of the Azure Firewall (`10.100.0.4`).

Internal traffic within the virtual network must be sent to the internal/private IP of the firewall rather than its public IP.

Key Concept

Routing traffic through Azure Firewall using User-Defined Routes (UDRs)

Estimated Time:1m 30s

Question 1106Question →

You manage an Azure environment that contains a Recovery Services vault named Vault1 in the East US region. You have a source Premium storage account named Storage1 that hosts an SMB file share named Share1. Backup is configured for Share1 to Vault1. You create a new target Standard storage account named Storage2 that hosts an SMB file share named Share2. You need to restore the contents of Share1 to Share2. Which sequence of steps should you perform to complete the alternate location restore using the Azure portal? To answer, move the appropriate actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, register the target Standard storage account hosting the SMB file share with the Recovery Services vault. Second, in the Recovery Services vault, navigate to the backup items, select the source Premium storage account hosting the SMB file share, and select Restore Share. Third, in the Restore pane, select Alternate Location, and select the registered target Standard storage account and target SMB file share. Fourth, select the conflict resolution setting (Overwrite or Skip) and trigger the restore operation to the target Standard storage account hosting the SMB file share.

To perform an alternate location restore of an SMB file share, the target Standard storage account must first be registered with the Recovery Services vault. After registration, the administrator can initiate the Restore Share operation from the vault's backup items for the source Premium storage account. During configuration, the administrator selects Alternate Location and specifies the registered target Standard storage account and target SMB file share. Finally, the conflict resolution policy is selected, and the restore job is triggered to the target Standard storage account.

Step-by-Step Solution

The target Standard storage account is associated with the vault and becomes eligible as a destination for alternate location restores.

Azure Backup requires target storage accounts to be registered with the vault before they can host restored file shares.

In the Recovery Services vault, navigate to the backup items, select the source Premium storage account (hosting the SMB file share), and select Restore Share.

The Restore Share wizard is launched for the selected backup point of the source SMB file share on the Premium storage account.

This starts the restore workflow for the specific backup item.

In the Restore pane, select Alternate Location, and then select the registered target Standard storage account (hosting the SMB file share) and the target SMB file share.

The destination target Standard storage account and SMB file share are configured for the restore job.

Specifies that the restore is going to an alternate destination rather than overwriting the original location.

Select the conflict resolution setting (Overwrite or Skip) and trigger the restore operation to the target Standard storage account hosting the SMB file share.

The restore job is submitted to Azure Backup for execution on the target Standard storage account.

This defines the behavior when files already exist in the target share and runs the actual restore process.

Key Concept

To perform an alternate location restore of an Azure file share using Azure Backup, the destination storage account must be registered with the same Recovery Services vault as the backup. NFS file shares do not support Azure Backup; only SMB file shares are supported.

Question 1107Question →

An administrator is configuring an Azure Monitor action group to send alert notifications to a third-party IT Service Management (ITSM) system via a Webhook action. The administrator must ensure that the JSON payload structure is identical, regardless of whether the alert is based on a metric threshold, an activity log event, or a log search query. Which configuration should the administrator enable in the action group?

Enable the common alert schema

Enable the secure webhook option

Configure an alert processing rule with a custom payload action

Add a custom header to the Webhook action defining the alert type

Show answer & explanation

Answer: Enable the common alert schema

Answer

Enable the common alert schema

Enabling the common alert schema standardizes the JSON payload format sent by Azure Monitor for all types of alerts (such as metric alerts, activity log alerts, and log search alerts). This allows downstream systems like ticketing platforms or custom APIs to parse incoming alerts using a single, unified data model rather than requiring custom parsers for each alert source.

Step-by-Step Solution

Identify the administrative requirement to unify the alert schema across different signal types (metric, log, activity log) sent to a third-party Webhook endpoint.

Recognized that different alert types in Azure Monitor historically had distinct schema formats, making integration complex.

Understanding the need for schema standardization is critical to choosing the correct action group feature.

Evaluate the Azure Monitor Action Group configurations that modify the webhook payload properties.

Identified the 'Enable the common alert schema' toggle as the built-in feature that standardizes the JSON structure across all alert signals.

This configuration directly maps to the requirement of sending an identical payload structure.

Key Concept

Azure Monitor Common Alert Schema

Question 1108Question →

An administrator named Jordan is configuring Azure Backup for an SMB file share named `sharesmbcorp` hosted in a Premium storage account named `storprdpremium` in the North Europe region. The storage account's network security is configured to allow access only from selected networks. Jordan currently has the following RBAC assignments:
- `Backup Operator` role on the Recovery Services Vault named `rsv-prd-europe`
- `Reader` role on the resource group containing `storprdpremium`

Jordan attempts to configure the backup of `sharesmbcorp` to `rsv-prd-europe` but the configuration fails.

Which two actions should you perform to allow Jordan to configure the backup? (Select two.)

Select all that apply

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the network settings of `storprdpremium`.

Assign Jordan the Contributor role on `storprdpremium`.

Assign Jordan the Storage File Data Privileged Contributor role on `storprdpremium`.

Add the public IP address of the Recovery Services Vault to the firewall allowed list of `storprdpremium`.

Show answer & explanation

Answer: Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the network settings of `storprdpremium`.; Assign Jordan the Contributor role on `storprdpremium`.

Answer

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting in the network settings of the storage account, and assign the administrator the Contributor role on the storage account.

To successfully configure the backup of an Azure File share in a secured storage account, two requirements must be met: First, the storage firewall must allow the backup service, which is achieved by enabling the 'Allow Azure services on the trusted services list' option. Second, the administrator must have control-plane write permissions (Contributor role) on the storage account to register the storage account with the vault.

Step-by-Step Solution

Configure the storage account firewall bypass.

Azure Backup is allowed to communicate with the storage account despite the firewall configuration.

Since the storage account has its firewall enabled, Azure Backup needs the trusted Microsoft services exception enabled to interact with the file shares.

Assign the necessary control-plane role to the administrator.

The administrator has the Contributor role on the storage account.

Configuring backup requires control-plane permissions on the storage account to register the storage account with the Recovery Services Vault.

Key Concept

To backup a firewalled Azure File share, you must allow trusted Microsoft services to bypass the storage account firewall, and the administrator configuring the backup must have the Contributor role on the storage account.

Estimated Time:2m 0s

Question 1109Question →

An administrator is designing a backup strategy for the following resources in an Azure environment:

Resource Name	Resource Type	Region	Resource Group	Subscription
`vm-ops-prod`	Virtual machine	West US	`rg-west-ops`	`Subscription1`
`disk-ops-data`	Managed disk	West US	`rg-west-data`	`Subscription1`
`pg-orders-prod`	Azure Database for PostgreSQL	East US	`rg-east-db`	`Subscription2`
`share-logs-prod`	Azure File share	East US	`rg-east-storage`	`Subscription2`

The environment currently contains two vaults:
* A Recovery Services vault named `rsv-west` located in `rg-west-ops` in the `West US` region of `Subscription1`
* A Backup vault named `bv-east` located in `rg-east-db` in the `East US` region of `Subscription2`

Which of the resources can be successfully backed up using only the existing vaults?

vm-ops-prod and share-logs-prod only

disk-ops-data and pg-orders-prod only

vm-ops-prod and pg-orders-prod only

vm-ops-prod, disk-ops-data, and share-logs-prod only

Show answer & explanation

Answer: vm-ops-prod and pg-orders-prod only

Answer

Only vm-ops-prod and pg-orders-prod can be backed up using the existing vaults.

The correct answer is the option stating that only vm-ops-prod and pg-orders-prod can be backed up. This is because vm-ops-prod (Azure VM) is in West US and can be backed up to rsv-west (Recovery Services vault in West US). Similarly, pg-orders-prod (PostgreSQL) is in East US and can be backed up to bv-east (Backup vault in East US).

Step-by-Step Solution

Analyze the backup requirements for the virtual machine (vm-ops-prod) and the Recovery Services vault (rsv-west).

The virtual machine is in West US (Subscription1). Azure VM backup requires a Recovery Services vault in the same region and subscription. Since rsv-west is a Recovery Services vault in West US (Subscription1), vm-ops-prod can be successfully backed up to rsv-west.

Recovery Services vaults support Azure VM backups, and the vault must reside in the same region and subscription as the target virtual machine.

Analyze the backup requirements for the managed disk (disk-ops-data).

The managed disk is in West US (Subscription1). Azure Disk Backup requires a Backup vault in the same region and subscription. The only Backup vault available is bv-east (East US, Subscription2). The Recovery Services vault rsv-west is in the correct region but does not support Azure Disk backup.

Azure Disk backup is supported by Backup vaults (not Recovery Services vaults) and requires the vault to be in the exact same region and subscription as the disk.

Analyze the backup requirements for the Azure Database for PostgreSQL server (pg-orders-prod) and the Backup vault (bv-east).

The database is in East US (Subscription2). PostgreSQL backup requires a Backup vault in the same region and subscription. Since bv-east is a Backup vault in East US (Subscription2), pg-orders-prod can be successfully backed up to bv-east.

Backup vaults support Azure Database for PostgreSQL backups, and the vault must reside in the same region and subscription as the target database.

Analyze the backup requirements for the Azure File share (share-logs-prod).

The file share is in East US (Subscription2). Azure Files backup requires a Recovery Services vault in the same region and subscription. The only Recovery Services vault available is rsv-west (West US, Subscription1). The Backup vault bv-east is in the correct region and subscription but does not support Azure Files backup.

Azure Files backup is supported by Recovery Services vaults (not Backup vaults) and requires the vault to be in the same region and subscription as the storage account hosting the file share.

Key Concept

Azure Backup vault types (Recovery Services Vault vs. Backup Vault) have distinct resource support matrices and strict regional and subscription alignment constraints.

Question 1110Question →

Your company has an Azure environment containing two virtual networks in the East US region:
* `VNet-Prod` ( $10.80.0.0/16$ ) contains a virtual machine named `VM-Prod` and is linked to an Azure Private DNS zone named `private.contoso.com`.
* `VNet-Dev` ( $10.90.0.0/16$ ) contains a virtual machine named `VM-Dev`.

You establish a virtual network peering between `VNet-Prod` and `VNet-Dev` with the following configuration:
* 'Allow forwarded traffic' is enabled on both peering links.
* 'Allow gateway transit' is disabled on `VNet-Prod`.
* 'Use remote gateways' is disabled on `VNet-Dev`.

`VM-Dev` can successfully access `VM-Prod` using its private IP address, but it cannot resolve the name `vm-prod.private.contoso.com`.

Which action should you take to resolve the name resolution issue?

Link VNet-Dev to the private.contoso.com Private DNS zone.

Enable 'Allow gateway transit' on the peering link from VNet-Prod to VNet-Dev.

Enable 'Use remote gateways' on the peering link from VNet-Dev to VNet-Prod.

Enable DNS active registration for VNet-Dev in the private.contoso.com settings.

Show answer & explanation

Answer: Link VNet-Dev to the private.contoso.com Private DNS zone.

Answer

Link VNet-Dev to the private.contoso.com Private DNS zone.

Linking the development virtual network to the Private DNS zone allows the Azure DNS resolver in the development network to query the zone records. Peering only configures network routing; it does not share private DNS zone resolution spaces automatically.

Step-by-Step Solution

Verify the status of IP-level connectivity between the virtual networks.

IP connectivity is established via peering, but DNS resolution fails because peering does not transitively extend Private DNS zone resolution scope.

Ensures that the problem is not a lower-level network routing issue.

Check the virtual network links associated with the private.contoso.com Private DNS zone.

Identify that only VNet-Prod has an active virtual network link to the Private DNS zone.

For any virtual network to resolve names in an Azure Private DNS zone, it must be explicitly linked to that zone.

Add a new virtual network link in the Private DNS zone settings targeting VNet-Dev.

Azure-provided DNS in VNet-Dev can now query the DNS database of the Private DNS zone.

This establishes the logical control plane relationship required for name resolution.

Key Concept

Azure Private DNS Zone Virtual Network Links

Estimated Time:1m 30s

Question 1111Question →

An administrator plans to deploy Azure Firewall to secure outbound traffic from a virtual network named VNet1. VNet1 has an address space of $10.10.0.0/16$ and contains a workload subnet named WorkloadSubnet with an address prefix of $10.10.1.0/24$ .

Which two actions should the administrator perform to deploy the firewall and route WorkloadSubnet traffic through it? (Select two.)

Select all that apply

Create a subnet named AzureFirewallSubnet that has an address prefix of

10.10.2.0/26

Create a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.

Create a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual Network Gateway pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.

Create a subnet named FirewallSubnet that has an address prefix of

10.10.2.0/28

Show answer & explanation

Answer: Create a subnet named AzureFirewallSubnet that has an address prefix of $10.10.2.0/26$ .; Create a route table containing a route for $0.0.0.0/0$ with a next hop type of Virtual appliance pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.

Answer

Create a subnet named AzureFirewallSubnet with an address prefix of

10.10.2.0/26

AND create a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.

To successfully deploy Azure Firewall and route traffic from a workload subnet, two main components must be configured: first, a dedicated subnet named exactly AzureFirewallSubnet must be created within the virtual network, and it must have a subnet mask of

/26

or larger (such as

/26

/25

). Second, a route table with a default route (

0.0.0.0/0

) pointing to the private IP address of the firewall as a 'Virtual appliance' next hop must be created and associated with the workload subnet.

Step-by-Step Solution

Define the subnet for the Azure Firewall.

Create a subnet named AzureFirewallSubnet with a prefix size of at least

/26

(e.g.,

10.10.2.0/26

Azure Firewall requires a dedicated subnet named exactly AzureFirewallSubnet with a minimum prefix size of

/26

to accommodate the firewall instances.

Route traffic from the workload subnet to the firewall.

Create a route table with a route for

0.0.0.0/0

(all internet-bound traffic) using a next hop type of Virtual appliance and specify the private IP address of the firewall.

To force outbound internet traffic from WorkloadSubnet through the firewall, a custom route table (UDR) is required, and the next hop must be the firewall's private IP, which acts as a virtual appliance.

Associate the route table.

Associate the route table with WorkloadSubnet.

The route table only applies to subnets to which it is explicitly associated.

Key Concept

Deploying and routing traffic through Azure Firewall requires a dedicated subnet named AzureFirewallSubnet (minimum

/26

prefix) and a User-Defined Route (UDR) with the next hop type set to Virtual appliance pointing to the firewall's private IP address.

Question 1112Question →

An administrator needs to configure an Azure Application Gateway v2 to host two distinct web applications: sales.contoso.com and marketing.contoso.com. Traffic for sales.contoso.com must be directed to a backend pool named PoolSales, and traffic for marketing.contoso.com must be directed to a backend pool named PoolMarketing. Both applications use HTTPS on port 443. Which configuration should the administrator implement to route the traffic correctly?

Create a single basic listener on port 443, and configure a path-based routing rule that maps the subdomain host headers to the backend pools.

Create a single basic listener on port 443, and configure a user-defined route (UDR) with a next hop type of Virtual Network Gateway to route traffic based on host headers.

Create two multi-site listeners (one for sales.contoso.com and one for marketing.contoso.com), and configure two basic routing rules to map each listener to its respective backend pool.

Create two multi-site listeners, and associate a Network Security Group (NSG) to the Application Gateway subnet with an inbound rule of priority 4096 that denies port 443 traffic.

Show answer & explanation

Answer: Create two multi-site listeners (one for sales.contoso.com and one for marketing.contoso.com), and configure two basic routing rules to map each listener to its respective backend pool.

Answer

Create two multi-site listeners (one for sales.contoso.com and one for marketing.contoso.com), and configure two basic routing rules to map each listener to its respective backend pool.

To host multiple websites or subdomains on a single Azure Application Gateway, you must configure a multi-site listener for each unique domain name. This enables the gateway to evaluate the HTTP Host header of incoming requests. Each multi-site listener is then associated with its own basic routing rule to direct traffic to the correct backend pool.

Step-by-Step Solution

Analyze routing requirements

Identify that incoming traffic must be separated and routed to distinct backend pools (PoolSales and PoolMarketing) based on the request's host header (sales.contoso.com or marketing.contoso.com).

This determines that Layer 7 host-based routing is required.

Select listener configuration

Create two multi-site listeners on port 443, one configured with the host name sales.contoso.com and the other with marketing.contoso.com.

Basic listeners do not support host header differentiation, whereas multi-site listeners permit hosting multiple domain names on a single gateway instance.

Configure request routing rules

Create two basic routing rules, linking the sales listener to PoolSales and the marketing listener to PoolMarketing.

Routing rules map the traffic received by specific listeners to the appropriate backend pools.

Key Concept

Multi-site listeners and request routing rules in Azure Application Gateway

Question 1113Question →

You manage an Azure subscription that contains a private DNS zone named corp.internal.

You have two virtual networks named VNet-Prod and VNet-Dev that are connected via virtual network peering.

The corp.internal private DNS zone is linked to VNet-Prod with auto-registration enabled. Several virtual machines in VNet-Prod have automatically registered their DNS records in the zone.

You deploy a new virtual machine named VM-Dev1 in VNet-Dev.

You discover that VM-Dev1 cannot resolve the DNS names of the virtual machines in VNet-Prod using the corp.internal suffix.

You need to ensure that VM-Dev1 can resolve the DNS names in corp.internal.

What should you do?

Create a virtual network link from the corp.internal private DNS zone to VNet-Dev.

Enable gateway transit on the virtual network peering between VNet-Prod and VNet-Dev.

Enable auto-registration on the virtual network peering connection from VNet-Prod to VNet-Dev.

Configure the DNS server settings of VNet-Dev to point to the private IP address of the virtual network gateway in VNet-Prod.

Show answer & explanation

Answer: Create a virtual network link from the corp.internal private DNS zone to VNet-Dev.

Answer

Create a virtual network link from the corp.internal private DNS zone to VNet-Dev.

Creating a virtual network link from the corp.internal private DNS zone to VNet-Dev is required because Azure Private DNS zones require an explicit link to any virtual network that needs to resolve its DNS records. Peering two virtual networks enables IP routing between them but does not automatically extend Private DNS zone resolution capabilities to the peered network.

Step-by-Step Solution

Identify the requirement: A virtual machine in VNet-Dev needs to resolve DNS records in the corp.internal Private DNS zone.

Determine that name resolution requires a virtual network link between VNet-Dev and corp.internal.

By default, Azure Private DNS zones are only resolvable by virtual networks that have an active virtual network link associated with the zone. Peering alone does not propagate Private DNS zone resolution.

Configure the virtual network link in the Azure Portal, CLI, or PowerShell.

Create a new virtual network link for the private DNS zone corp.internal pointing to VNet-Dev.

Linking VNet-Dev to the private DNS zone allows resources in VNet-Dev (such as VM-Dev1) to query the Azure default DNS IP (168.63.129.16) and resolve names within that zone.

Key Concept

Azure Private DNS Zone Virtual Network Links

Question 1114Question →

Your company has an Azure virtual machine named VM1. You configure an Azure Monitor metric alert rule to trigger when the CPU usage of VM1 exceeds $90\%$ for more than 15 minutes. You need to configure the system to send an email notification to the operations team and automatically trigger an Azure Automation runbook when the alert fires. Additionally, you must suppress all notifications during a planned weekly maintenance window on Sundays without modifying the metric alert rule. Which of the following actions should you perform? (Select TWO.)

Select all that apply

Create an action group that includes both the email notification action and the Automation runbook action.

Create an alert processing rule configured to suppress notifications during the Sunday maintenance window.

Create an alert processing rule that directly defines the email notification and Automation runbook actions.

Configure a recurring schedule within the action group properties to disable the notifications during the maintenance window.

Show answer & explanation

Answer: Create an action group that includes both the email notification action and the Automation runbook action.; Create an alert processing rule configured to suppress notifications during the Sunday maintenance window.

Answer

Create an action group that includes both the email notification action and the Automation runbook action, and create an alert processing rule configured to suppress notifications during the Sunday maintenance window.

To meet the requirements, you must use an Action Group to define the specific actions (sending an email and triggering a runbook) because Action Groups are the designated resources for notifications and automated tasks. Additionally, to suppress alerts during a weekly maintenance window without modifying the alert rule itself, you must create an Alert Processing Rule configured to suppress notifications. This allows you to block notifications dynamically based on a schedule.

Step-by-Step Solution

Define the notification and remediation actions in an Action Group.

An Azure Monitor action group is created containing the email address of the operations team and the link to the Azure Automation runbook.

Action groups centralize the execution of notifications and automation tasks in response to Azure Monitor alerts.

Implement suppression for the weekly maintenance window.

An alert processing rule is configured with a rule action of 'Suppress' and a weekly recurrence schedule for Sundays.

Alert processing rules intercept triggered alerts and apply suppression logic before notifications are sent, ensuring no notifications go out during maintenance without altering the alert rule or action group.

Key Concept

Configuring notifications and automated responses using Action Groups, and managing alert behavior during maintenance windows using Alert Processing Rules.

Question 1115Question →

You have an Azure subscription that contains a Recovery Services vault named `rsv-backup-prod` and a Premium storage account named `safilesprod` in the West US region. The storage account hosts an SMB file share named `share-hr`. Daily backups for `share-hr` are configured in `rsv-backup-prod`.

The firewall for `safilesprod` is configured to allow access only from selected networks. An administrator named Liam is assigned the Backup Operator role for `rsv-backup-prod` and the Reader role for `safilesprod`.

Liam attempts to restore a set of deleted files from a daily backup to the original location, but the restore operation fails with a network access error.

What should you configure to resolve the issue?

Configure the firewall of `safilesprod` to allow trusted Microsoft services to access the storage account.

Assign Liam the Storage File Data Privileged Contributor role on `safilesprod`.

Add the public IP address of the client computer Liam is using to the firewall rules of `safilesprod`.

Configure the private endpoint of `safilesprod` to allow inbound traffic from the subnet hosting the Recovery Services vault.

Show answer & explanation

Answer: Configure the firewall of `safilesprod` to allow trusted Microsoft services to access the storage account.

Answer

Configure the firewall of the storage account to allow trusted Microsoft services to access the storage account.

The correct option is to configure the firewall of the storage account to allow trusted Microsoft services to access the storage account. When a storage account firewall is configured to restrict access to selected networks, the Azure Backup service (which runs as a trusted Microsoft service) requires this exception to bypass the firewall and perform backup or restore operations on the Azure file share.

Step-by-Step Solution

Identify the cause of the failure based on the network access error.

The firewall of the storage account restricts access to selected networks, blocking the Azure Backup service.

Azure Backup runs as a trusted Microsoft service outside the customer's private virtual network.

Enable the firewall bypass exception on the storage account.

The option 'Allow trusted Microsoft services to access this storage account' is enabled on the storage account firewall settings.

This allows the Azure Backup service to bypass the network restrictions and successfully perform the restore operation.

Key Concept

Azure Files Backup Firewall Bypass

Estimated Time:1m 30s

Question 1116Question →

An administrator is deploying a new Azure Kubernetes Service (AKS) cluster named $aks-billing$ . The cluster must use Azure CNI for high performance, but the existing virtual network ( $VNet1$ ) has a limited address space ( $10.10.0.0/16$ ) with only a single $/24$ subnet ( $subnet1$ ) available for the cluster nodes. The application requires deploying up to $500$ pods across the cluster. The pods must be able to communicate with each other, but they do not require direct IP address access from the rest of the virtual network. Which network configuration should the administrator select to meet these requirements?

Azure CNI Overlay

Azure CNI with dynamic Pod IP allocation

Standard Azure CNI

Kubenet networking

Show answer & explanation

Answer: Azure CNI Overlay

Answer

Azure CNI Overlay

Azure CNI Overlay is the correct solution because it combines the performance benefits of Azure CNI with the IP savings of a private Pod CIDR. Nodes are assigned IP addresses from the

/24

subnet in the VNet, while the

500

pods are assigned IP addresses from a private overlay network, fitting within the single subnet limit.

Step-by-Step Solution

Analyze the IP capacity constraint

The target cluster requires supporting up to

500

pods, but only a single

/24

subnet is available. A

/24

subnet provides only

251

usable IP addresses in Azure.

Determining available IP address capacity helps eliminate options that would cause IP address exhaustion.

Evaluate the performance and subnet constraints

The requirements specify using Azure CNI for high performance and working within a single subnet. Standard Azure CNI would exhaust IPs, and dynamic Pod IP allocation requires an additional subnet.

Aligning subnet counts and performance requirements narrows down the configuration options.

Select the correct network model

Azure CNI Overlay is selected. It uses a single subnet for nodes (VNet IPs) and a private overlay address space for pods (saving VNet IPs), while still utilizing the high-performance Azure CNI data plane.

Azure CNI Overlay meets both the single subnet constraint, the

500

pod capacity requirement, and the performance mandate.

Key Concept

Azure CNI Overlay allows AKS pods to use a separate private IP address space while still leveraging the high-performance Azure CNI routing mechanism, resolving VNet IP exhaustion in single-subnet environments.

Question 1117Question →

An administrator is configuring virtual network peering between two Azure virtual networks:
- `VNet1` ( $10.100.0.0/16$ ) contains a subnet named `Subnet1` ( $10.100.1.0/24$ ) where virtual machines are deployed.
- `VNet2` ( $10.200.0.0/16$ ) contains a subnet named `Subnet2` ( $10.200.1.0/24$ ) where virtual machines are deployed.

The administrator configures a virtual network peering link from `VNet1` to `VNet2`. The peering status for this link is Initiated.

True or False: The virtual machines in `Subnet1` can communicate with the virtual machines in `Subnet2` while the peering status is Initiated.

True

False

Show answer & explanation

Answer: False

Answer

The statement is false because virtual network peering requires two peering links—one in each direction—to be configured before communication can occur.

The correct answer is false because establishing connectivity requires peering links to be configured on both virtual networks. A single link results in an 'Initiated' status and does not allow communication.

Step-by-Step Solution

Create a peering link from VNet1 to VNet2.

The peering link status on VNet1 is set to Initiated.

This establishes the first half of the peering connection.

Create a reciprocal peering link from VNet2 to VNet1.

The peering status on both VNet1 and VNet2 transitions to Connected.

This completes the bidirectional peering path.

Verify data plane traffic between virtual machines in Subnet1 and Subnet2.

Virtual machines can now communicate bidirectionally.

Peering is active only when the status is Connected on both ends.

Key Concept

Virtual network peering requires bidirectional configuration links to establish communication.

Question 1118Question →

A virtual machine on an internal subnet attempts to establish an outbound HTTPS connection to an external service. The outbound traffic is routed through an Azure Firewall. The firewall is configured with a Network rule collection that permits all outbound TCP traffic on port 443 to any destination, and an Application rule collection that denies access to the target domain of the external service. What is the result of the connection attempt?

The connection is allowed because the Network rule matches first, allowing the traffic and bypassing the evaluation of the Application rule.

The connection is denied because the Application rule has a higher evaluation priority than the Network rule.

The connection is denied because explicit Deny rules in any collection type take precedence over Allow rules.

The connection is allowed because Application rules are only evaluated for HTTP traffic on port 80, not HTTPS traffic on port 443.

Show answer & explanation

Answer: The connection is allowed because the Network rule matches first, allowing the traffic and bypassing the evaluation of the Application rule.

Answer

The connection is allowed because the Network rule matches first, allowing the traffic and bypassing the evaluation of the Application rule.

The correct answer is correct because Azure Firewall processes Network rules before Application rules. When the outbound connection matches the Network rule (which allows TCP port 443 traffic to any destination), the firewall allows the connection immediately. Because a match was found in the Network rules, the Application rules are bypassed entirely, meaning the Deny rule for the specific domain is never evaluated.

Step-by-Step Solution

Identify the destination port and protocol of the connection attempt.

The traffic is HTTPS, which uses TCP port 443.

Understanding the port and protocol helps determine which firewall rules are candidates for matching.

Compare the traffic against the configured rule collections in their order of evaluation.

Network rules are evaluated first. The connection matches the Network rule that allows TCP port 443 traffic to any destination.

Azure Firewall evaluates rule collections in a specific hierarchy: DNAT rules first, then Network rules, and finally Application rules.

Determine the final action and whether subsequent rules are evaluated.

The traffic is allowed by the matching Network rule, and evaluation terminates. The Application rule is not evaluated.

Once a match is found in a rule collection type, Azure Firewall applies the rule action and skips the remaining collection types.

Key Concept

Azure Firewall rule processing hierarchy and evaluation order

Estimated Time:1m 30s

Question 1119Question →

An organization deploys a Premium storage account named sa-ops-share in the West US 2 region. The network routing configuration for sa-ops-share is set to 'Enabled from selected virtual networks and IP addresses'. The storage account contains two file shares:
- share-smb-conf: An SMB file share.
- share-nfs-conf: An NFS file share.

A Recovery Services vault named rsv-ops-backup is deployed in the same region. An administrator named Alex is assigned the built-in Backup Operator role for the resource group containing both resources. Alex needs to configure Azure Backup for the file shares using rsv-ops-backup.

When Alex attempts to configure the backup, the operation fails due to permission errors and network connectivity issues.

Which of the following actions must be performed to ensure that backup can be successfully configured for the supported file shares? (Select two)

Select all that apply

Assign Alex the Storage Account Contributor role on the sa-ops-share storage account.

Enable the 'Allow trusted Microsoft services to access this storage account' setting under the firewall configuration of sa-ops-share.

Assign Alex the Storage File Data Privileged Reader role on the sa-ops-share storage account.

Configure a separate backup policy in rsv-ops-backup for the share-nfs-conf file share.

Show answer & explanation

Answer: Assign Alex the Storage Account Contributor role on the sa-ops-share storage account.; Enable the 'Allow trusted Microsoft services to access this storage account' setting under the firewall configuration of sa-ops-share.

Answer

Assign Alex the Storage Account Contributor role on the sa-ops-share storage account, and enable the 'Allow trusted Microsoft services to access this storage account' setting under the firewall configuration of sa-ops-share.

To successfully configure backup for the SMB file share, the administrator must resolve both the registration permission issue and the network firewall restriction. Assigning the Storage Account Contributor role ensures the administrator has the control plane write access required to register the storage account with the Recovery Services vault. Enabling the 'Allow trusted Microsoft services to access this storage account' setting allows the backup service to bypass the storage firewall and access the file shares.

Step-by-Step Solution

Determine protocol supportability for Azure Files backup.

Identify that share-smb-conf (SMB) is supported, whereas share-nfs-conf (NFS) is not supported by Azure Backup.

Azure Files backup using Recovery Services vaults only supports SMB file shares.

Analyze control plane RBAC permissions required for configuring backup.

Identify that the Backup Operator role is insufficient because registering a storage account requires write permissions (Microsoft.Storage/storageAccounts/write).

Assigning the Storage Account Contributor role to Alex provides the required permissions to write backup metadata and register the storage account with the vault.

Address network connectivity restrictions.

Identify that the vault cannot access the storage account due to the firewall restricting access to selected networks.

Enabling the 'Allow trusted Microsoft services...' bypass allows Azure Backup to communicate with the storage account and access the SMB file share.

Key Concept

Configuring Azure Files Backup requires specific control plane permissions (Storage Account Contributor or Owner) to register the storage account, network firewall bypass configurations for trusted services, and adheres to protocol limitations (only SMB is supported).

Question 1120Question →

You manage an Azure subscription. You assign the Contributor role to a Microsoft Entra ID group named Ops-Team.

You configure an Azure Monitor metric alert rule to monitor a virtual machine named VM-Prod1.

You create an action group named ActionGroup1 that uses the Email Azure Resource Manager Role action type, configured to send emails to the Contributor role. You associate ActionGroup1 with the metric alert rule.

When the metric alert triggers, members of Ops-Team do not receive the email notification.

You need to ensure that the members of Ops-Team receive the alert notifications.

What should you do?

Configure ActionGroup1 to use the Email/SMS message/Push/Voice action type and specify the email addresses of the administrators.

Configure ActionGroup1 to use the Email/SMS message/Push/Voice action type and select the Ops-Team group directly from the directory.

Assign the Contributor role to the Ops-Team group at the VM-Prod1 resource level instead of the subscription level.

Create an Azure Policy assignment to forward the alert notification to the members of the Ops-Team group.

Show answer & explanation

Answer: Configure ActionGroup1 to use the Email/SMS message/Push/Voice action type and specify the email addresses of the administrators.

Answer

Configure ActionGroup1 to use the Email/SMS message/Push/Voice action type and specify the email addresses of the administrators.

The correct option is to configure the action group to use the Email/SMS message/Push/Voice action type and specify the email addresses of the administrators. The Email Azure Resource Manager Role action type only sends emails to Microsoft Entra ID users who have direct role assignments at the subscription level. It does not resolve group memberships or send emails to Microsoft Entra ID groups. Therefore, manual email configuration (or utilizing a mail-enabled distribution group's email address) is required to ensure group members receive the notifications.

Step-by-Step Solution

Analyze the limitation of the Email Azure Resource Manager Role action type in Azure Monitor action groups.

The Email Azure Resource Manager Role action type only sends emails to direct user accounts assigned to the target role at the subscription level. It does not support group memberships, service principals, or resource-level assignments.

This explains why the members of the Ops-Team group did not receive notifications despite the group having the Contributor role.

Identify the appropriate action group configuration to notify the group members.

Use the Email/SMS message/Push/Voice action type, which allows entering explicit email addresses (such as individual addresses or a shared distribution list).

This bypasses the group-membership limitation of the Resource Manager role notification action.

Key Concept

Azure Monitor Action Groups support notifying roles or explicit email addresses, but role-based notification has strict limits regarding group inheritance and assignment scope.

PreviousPage 56 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution