All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

You plan to configure an Azure Application Gateway v2 named AppGw1 to perform SSL termination. The SSL certificates must be stored securely in an Azure Key Vault named KV1.

You need to configure AppGw1 to retrieve the SSL certificates from KV1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, create a user-assigned managed identity. Second, assign the Key Vault Secrets User role on KV1 to the user-assigned managed identity. Third, associate the user-assigned managed identity with AppGw1. Fourth, create an HTTPS listener on AppGw1 that references the certificate URI in KV1.

To configure Azure Application Gateway with SSL certificates from Key Vault, you must first create a user-assigned managed identity. Then, you grant that identity read access (Key Vault Secrets User role) to the Key Vault. Next, you associate the identity with the Application Gateway. Finally, you configure the HTTPS listener on the Application Gateway referencing the Key Vault certificate URI. This ensures the gateway has the credentials and permissions needed to pull the certificate.

Step-by-Step Solution

Create a user-assigned managed identity.

A user-assigned managed identity is created.

The Application Gateway needs a managed identity to authenticate to Key Vault without storing credentials. The identity must be created before it can be assigned permissions or associated with resources.

Assign the Key Vault Secrets User role on KV1 to the user-assigned managed identity.

The identity is granted read access to secrets in KV1.

Application Gateway retrieves SSL certificates from Key Vault as secrets. Assigning the Key Vault Secrets User role (or equivalent access policy) ensures the identity has the necessary permission to get the certificate.

Associate the user-assigned managed identity with AppGw1.

AppGw1 is updated to reference the user-assigned managed identity.

The Application Gateway must be explicitly configured with the user-assigned managed identity so it knows which identity to present when calling Key Vault.

Create an HTTPS listener on AppGw1 that references the certificate URI in KV1.

An HTTPS listener is created and successfully fetches the certificate.

The listener can now be configured to retrieve the certificate from Key Vault. This step must be performed last because the listener setup references the certificate in Key Vault and requires the gateway to already have the associated managed identity.

Key Concept

Azure Key Vault integration with Azure Application Gateway for SSL termination

Question 1122Question →

An organization deploys an Azure Application Gateway v2 instance to expose two internal web applications. The applications are accessed from the internet using the URLs 'https://finance.adventureworks.com' and 'https://hr.adventureworks.com'. Both applications must use secure connections, and TLS/SSL termination must be performed at the Application Gateway. Which two configuration components should you implement on the Application Gateway to support this routing scenario?

Select all that apply

Two frontend listeners with the listener type set to Multi-site, each configured for HTTPS and associated with its respective host name and SSL certificate.

Two request routing rules that associate each of the multi-site listeners with their respective backend pools and HTTP settings.

A single frontend listener of type Basic configured for HTTPS on port 443, utilizing a multi-domain SSL certificate to serve both host names.

An inbound Network Security Group (NSG) rule on the Application Gateway subnet that denies traffic from the GatewayManager service tag on ports 65200 through 65535.

Show answer & explanation

Answer: Two frontend listeners with the listener type set to Multi-site, each configured for HTTPS and associated with its respective host name and SSL certificate.; Two request routing rules that associate each of the multi-site listeners with their respective backend pools and HTTP settings.

Answer

Two frontend listeners with the listener type set to Multi-site, and two request routing rules linking each listener to its backend pool and HTTP settings.

To host multiple websites with distinct domain names on a single Application Gateway using HTTPS, you must configure multiple site-specific listeners. Multi-site listeners are required to bind each hostname (finance.adventureworks.com and hr.adventureworks.com) to its respective SSL certificate. In addition, you must create request routing rules to associate each listener with the appropriate backend pool and HTTP settings.

Step-by-Step Solution

Determine the type of listener required to support multiple domains on a single Application Gateway.

Identify that Multi-site listeners are required because they evaluate the Host header of incoming HTTP requests, whereas Basic listeners do not.

To route traffic to different backend pools based on whether the URL is finance.adventureworks.com or hr.adventureworks.com, the gateway must distinguish between the domains.

Configure the frontend listeners for TLS/SSL termination.

Create two separate HTTPS Multi-site listeners on port 443, uploading the corresponding SSL certificate and specifying the respective host name for each.

Each domain requires its own SSL certificate to secure connections, which must be terminated at the gateway's frontend listeners.

Configure request routing rules to forward traffic from listeners to backends.

Create two request routing rules that connect each Multi-site listener to its respective backend pool and backend HTTP settings.

Routing rules map the traffic received by a listener to the correct backend pool using the configured HTTP settings.

Key Concept

To host multiple secure websites on a single Application Gateway, you must configure separate Multi-site listeners with the correct host name bindings and certificates, and map them using request routing rules to their respective backend pools.

Question 1123Question →

You have an Azure subscription that contains a Recovery Services vault named rsv-prod-01 in the East US region. You also have a Premium storage account named storageaccount01 in the East US region that hosts an SMB file share named share-prod-01. The firewall of the Premium storage account is configured to allow access from selected networks only.

You need to configure Azure Backup for the SMB file share.

Which four actions should you perform in sequence? To arrange the actions in the correct sequence, move the appropriate actions from the list of actions to the answer area and order them correctly.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, configure the firewall of the Premium storage account containing the SMB file share to allow access from selected networks and enable the trusted Microsoft services bypass. Second, in the Recovery Services vault, initiate the Backup configuration for Azure FileShare and select the Premium storage account. Third, select the SMB file share share-prod-01 from the discovered list. Fourth, select or create a backup policy and click Enable Backup.

To successfully configure backup for an SMB file share in a Premium storage account with a firewall enabled: 1. You must first allow network access by enabling the trusted Microsoft services bypass. 2. Next, from the Recovery Services vault, you configure the backup workflow and register the Premium storage account. 3. Then, you select the specific SMB file share from the discovered shares. 4. Finally, you assign the backup policy and enable the protection.

Step-by-Step Solution

Configure the Premium storage account's firewall settings.

The firewall allows trusted Microsoft services to access the storage account.

The Recovery Services vault needs network access to bypass the firewall and query the storage account.

Configure Backup in the Recovery Services vault.

The Premium storage account is registered, and its file shares are discovered.

Registering the storage account is a prerequisite for selecting specific file shares for backup.

Select the SMB file share share-prod-01.

The target file share is selected for backup protection.

You must specify which file share within the storage account is to be protected.

Select or create a backup policy and enable backup.

Azure Backup is configured and active for the selected SMB file share.

The policy defines the schedule and retention rules for the backup jobs.

Key Concept

Configuring Azure Backup for a Premium SMB file share behind a storage firewall.

Question 1124Question →

You manage a public Azure DNS zone named `contoso.com`. You need to delegate a new subdomain named `east.contoso.com` to a separate public DNS zone in Azure DNS. Which sequence of actions should you perform to complete the delegation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To delegate a subdomain in Azure DNS, you must first create the public child DNS zone (`east.contoso.com`), retrieve the

4

assigned name servers for that child zone, create a new NS record set named `east` in the parent DNS zone (`contoso.com`), and then populate that NS record set with the name servers noted from the child zone.

The correct sequence starts with creating the child zone because Azure DNS assigns name servers dynamically during creation. Once the child zone is active, the administrator notes the assigned name servers. The final steps require creating an NS record set in the parent zone and populating it with the child zone's name servers, establishing the authoritative link.

Step-by-Step Solution

Create the child DNS zone `east.contoso.com`.

The child zone is created and Azure DNS automatically generates NS and SOA records containing the assigned name servers.

You cannot retrieve name servers or link the subdomain until the child zone resource exists in Azure.

Retrieve and note the name servers (NS) from the child zone.

You obtain the list of the

4

unique Azure name server addresses assigned to host the subdomain.

These specific name servers are required to tell the parent zone where to direct queries for the subdomain.

Create a new NS record set named `east` in the parent `contoso.com` zone.

An NS record set placeholder for the `east` subdomain is created in the parent zone.

The parent zone must contain a delegation record to route traffic for the subdomain.

Populate the new NS record set with the child zone's name servers.

The parent zone points directly to the child zone's authoritative name servers.

This establishes the active DNS delegation, completing the configuration.

Key Concept

DNS subdomain delegation in Azure DNS requires creating the child zone, retrieving its designated name servers, and adding those name servers as an NS record set in the parent zone.

Question 1125Question →

You are configuring Azure Backup for a newly deployed architecture in the Sub-Prod-App subscription. The infrastructure includes the resources described in the table below:

Resource Name	Type	Region	Resource Group
VM-App-01	Virtual Machine	North Europe	RG-Core
Disk-Data-01	Managed Disk	North Europe	RG-Core
Share-Docs-01	Azure File Share	West Europe	RG-Data
VM-App-02	Virtual Machine	West Europe	RG-Core

You create a Recovery Services vault named RSV-Core in North Europe and a Backup vault named BV-Core in North Europe.

You need to identify which backup configurations are supported using these vaults. Which backup configuration is valid for these resources?

Back up VM-App-01 to RSV-Core, and back up Disk-Data-01 to BV-Core.

Back up VM-App-02 to RSV-Core, and back up Share-Docs-01 to a new Recovery Services vault located in North Europe.

Configure the backup of Share-Docs-01 to RSV-Core using the subscription Owner role, which automatically grants the required data plane access to view and copy file share contents.

Perform a 'Replace existing' restore operation on VM-App-01 to migrate the virtual machine and its configurations directly into the West Europe region.

Show answer & explanation

Answer: Back up VM-App-01 to RSV-Core, and back up Disk-Data-01 to BV-Core.

Answer

The correct configuration is to back up VM-App-01 to RSV-Core and back up Disk-Data-01 to BV-Core.

The correct configuration is to back up the virtual machine in North Europe to the Recovery Services vault in the same region, and back up the managed disk in North Europe to the Backup vault in the same region. This correctly aligns the resource types with their supported vault types and respects the regional constraints of Azure Backup.

Step-by-Step Solution

Identify the regional constraints for Azure Virtual Machine and Azure File Share backups.

Determine that VM-App-01 and Disk-Data-01 reside in North Europe, while Share-Docs-01 and VM-App-02 reside in West Europe.

Backups for virtual machines and file shares require the resources and the vaults to reside in the same Azure region.

Analyze vault type compatibility for the North Europe resources.

VM-App-01 (Virtual Machine) requires a Recovery Services Vault (RSV-Core), and Disk-Data-01 (Managed Disk) requires a Backup Vault (BV-Core).

Managed disks are backed up using Backup Vaults, while virtual machines are backed up using Recovery Services Vaults.

Evaluate the options to identify the correct vault and regional mapping.

The configuration backing up VM-App-01 to RSV-Core and Disk-Data-01 to BV-Core is the only valid option.

This configuration satisfies both the regional constraint (same region) and the vault type support matrix.

Key Concept

Recovery Services Vaults vs Backup Vaults regionality and feature compatibility

Question 1126Question →

Your company plans to deploy a new Azure Kubernetes Service (AKS) cluster named `aks-shipping`. You have an existing virtual network (`VNet1`) containing a subnet named `aks-subnet` with the address space $10.200.0.0/24$ . Due to address space limitations, the corporate network team mandates that the cluster must not consume more than $150$ IP addresses from `aks-subnet`. The cluster must meet the following requirements:

* The cluster must scale up to a maximum of $80$ nodes.
* Each node must support up to $30$ pods.
* Pod IP addresses must be directly routable from an on-premises network via an ExpressRoute connection without performing Network Address Translation (NAT).

Which two configuration actions should you perform to meet these requirements? (Select two.)

Select all that apply

Configure the cluster network plugin to use Azure CNI.

Enable dynamic pod IP allocation and assign a separate subnet for pod IP addresses.

Configure the cluster network plugin to use Kubenet.

Configure the cluster network plugin to use Azure CNI Overlay.

Deploy the cluster using standard Azure CNI without dynamic pod IP allocation.

Show answer & explanation

Answer: Configure the cluster network plugin to use Azure CNI.; Enable dynamic pod IP allocation and assign a separate subnet for pod IP addresses.

Answer

To meet the requirements, the cluster network plugin must be configured to use Azure CNI, and dynamic pod IP allocation must be enabled with a separate subnet assigned for pod IP addresses.

To satisfy the direct routability requirement without NAT, the AKS cluster must use Azure CNI. To satisfy the constraint of not consuming more than

150

IP addresses from the node subnet (`aks-subnet`) for

80

nodes, you must enable dynamic pod IP allocation. This allows the nodes to be deployed in the node subnet (consuming only one IP address per node) and the pods to be deployed in a separate, dedicated subnet.

Step-by-Step Solution

Analyze the routing and NAT requirement.

Kubenet and Azure CNI Overlay are ruled out because they both use NAT for traffic leaving the nodes, which prevents pod IPs from being directly routable from the on-premises network.

The scenario requires pod IP addresses to be directly routable from the on-premises network via ExpressRoute without performing NAT.

Analyze the IP consumption limit on the node subnet.

Standard Azure CNI is ruled out because it pre-allocates IPs for pods directly from the node subnet. For

80

nodes with

30

pods each, this would consume over

2400

IPs, exceeding the limit of

150

IPs.

The node subnet `aks-subnet` has a limit of

150

IP addresses for the cluster.

Select the configuration that combines VNet-routable IPs with minimized node subnet consumption.

Azure CNI with dynamic pod IP allocation satisfies both: nodes are placed in the node subnet (consuming

80

IPs, under the

150

limit), and pods are placed in a separate subnet (retaining direct VNet routing and on-premises reachability).

Dynamic pod IP allocation separates the node and pod subnets, allowing the node subnet to host only the nodes.

Key Concept

Azure CNI with Dynamic Pod IP Allocation

Question 1127Question →

An administrator configures diagnostic settings on a Recovery Services vault named Vault1 to enable Azure Backup Reports. The administrator targets a central Log Analytics workspace named Workspace1. To comply with corporate security and performance policies, the diagnostic setting is configured to use the Resource-specific schema. The administrator only selects the CoreAzureBackup log category. A week later, the administrator runs a Kusto Query Language (KQL) query targeting the AddonAzureBackupJobs table to analyze backup job execution times and status history, but the query returns no results. What should the administrator do to resolve this issue?

Modify the diagnostic settings of Vault1 to select the AddonAzureBackupJobs log category.

Modify the diagnostic settings of Vault1 to use the AzureDiagnostics table schema.

Modify the KQL query to retrieve job details from the CoreAzureBackup table.

Configure diagnostic settings on the individual virtual machines to send Guest OS diagnostic logs to Workspace1.

Show answer & explanation

Answer: Modify the diagnostic settings of Vault1 to select the AddonAzureBackupJobs log category.

Answer

Modify the diagnostic settings of the Recovery Services vault to select the AddonAzureBackupJobs log category.

The correct action is to modify the diagnostic settings to select the AddonAzureBackupJobs log category. In Resource-specific schema mode, Azure Backup routes diagnostics logs to specific dedicated tables. The AddonAzureBackupJobs table is only populated when the corresponding AddonAzureBackupJobs log category is selected in the diagnostic settings of the Recovery Services vault.

Step-by-Step Solution

Identify the data needed for the query

The query requires job execution times and status history, which are part of the backup job diagnostic data.

Understanding what logs contain the required information is necessary to locate the root cause.

Analyze the current diagnostic settings configuration

Only the CoreAzureBackup log category is selected, and the destination schema is set to Resource-specific.

This configuration sends vault and policy metadata (to the CoreAzureBackup table) but does not enable the collection of job logs.

Determine the required log category for Resource-specific schema

In Resource-specific schema, job logs are sent to the AddonAzureBackupJobs table, which requires enabling the AddonAzureBackupJobs log category in the vault's diagnostic settings.

Enabling the correct log category ensures that the Azure Backup service routes the required data to the Log Analytics workspace.

Key Concept

Azure Backup diagnostic settings and Log Analytics table mapping in Resource-specific mode

Question 1128Question →

You configure an Azure Application Gateway v2 to distribute traffic to a backend pool of virtual machines. The web application hosted on the virtual machines requires authentication at the root directory ( $/$ ) and returns an HTTP $401$ (Unauthorized) response to unauthenticated requests. As a result, the default Application Gateway health probes fail, and the backend pool is marked as unhealthy. You need to ensure the Application Gateway correctly identifies the backend servers as healthy. What should you do?

Add a user-defined route (UDR) to the Application Gateway subnet with the next hop type set to Virtual Network Gateway to redirect probe traffic.

Create an inbound network security group (NSG) rule on the Application Gateway subnet with a priority of

100

to allow traffic from the Virtual Network Manager service tag.

Create a custom health probe that targets an unauthenticated status endpoint, and associate the probe with the backend settings.

Configure virtual network peering transit settings to allow the health probe traffic to route transitively through an Azure Firewall.

Show answer & explanation

Answer: Create a custom health probe that targets an unauthenticated status endpoint, and associate the probe with the backend settings.

Answer

Create a custom health probe that targets an unauthenticated status endpoint, and associate the probe with the backend settings.

The correct configuration is to create a custom health probe that targets an unauthenticated status endpoint (or accommodates the expected HTTP status code) and associate this probe with the backend settings of the Application Gateway. By default, Application Gateway expects HTTP status codes between

200

and

399

. An application-level authentication requirement returning HTTP

401

will cause the default probe to fail, which is resolved by pointing the probe to a bypass or health-check page.

Step-by-Step Solution

Analyze the health probe failure.

The default health probe targets the root path (

/

) and expects an HTTP status code between

200

and

399

. Because the root path requires authentication, it returns an HTTP

401

code, which the gateway interprets as unhealthy.

Understanding why the default probe fails is necessary to determine the required configuration change.

Define a custom health probe configuration.

A custom health probe is defined to target an unauthenticated path (such as a dedicated

/health

page) or configured to accept HTTP

401

as a healthy response status code.

Custom health probes allow customization of the request path, intervals, and acceptable status code ranges.

Associate the custom health probe with the backend settings.

The custom health probe is linked to the backend settings (formerly HTTP settings) of the Application Gateway, which are applied to the backend pool.

Health probes must be associated with the corresponding backend settings to override the default probing behavior.

Key Concept

Configure custom health probes for Azure Application Gateway

Question 1129Question →

An Azure administrator deploys three virtual networks in the East US region:

* `VNet-Hub` ( $192.168.0.0/16$ ) contains a subnet named `Subnet-Hub` with a virtual machine named `VM-Hub`.
* `VNet-Spoke1` ( $192.168.1.0/24$ ) contains a subnet named `Subnet-Spoke1` with a virtual machine named `VM-1`.
* `VNet-Spoke2` ( $192.168.2.0/24$ ) contains a subnet named `Subnet-Spoke2` with a virtual machine named `VM-2`.

You configure virtual network peering between `VNet-Hub` and `VNet-Spoke1`, and between `VNet-Hub` and `VNet-Spoke2`. `VM-Hub` can communicate with both `VM-1` and `VM-2`. However, `VM-1` and `VM-2` are unable to communicate with each other.

Which of the following configuration changes must you perform to enable direct network connectivity between `VM-1` and `VM-2`?

Enable the Allow gateway transit setting on the peering connections for VNet-Hub, and the Use remote gateways setting on the peering connections for VNet-Spoke1 and VNet-Spoke2.

Configure a User-Defined Route (UDR) in VNet-Spoke1 and VNet-Spoke2 with the next hop type set to Virtual Network Gateway pointing to VNet-Hub.

Configure a virtual network peering connection directly between VNet-Spoke1 and VNet-Spoke2.

Enable the Allow forwarded traffic setting on the virtual network peering connections between VNet-Hub and both spoke virtual networks.

Show answer & explanation

Answer: Configure a virtual network peering connection directly between VNet-Spoke1 and VNet-Spoke2.

Answer

Configure a virtual network peering connection directly between VNet-Spoke1 and VNet-Spoke2.

Virtual network peering is non-transitive. Traffic cannot transit a middle virtual network (hub) to reach another peered virtual network (spoke) unless a Network Virtual Appliance (NVA) is deployed in the hub. To enable direct communication between the two spoke virtual networks without an NVA, a direct peering link must be created between them.

Step-by-Step Solution

Analyze the topology and connectivity issue.

VNet-Hub is peered with both VNet-Spoke1 and VNet-Spoke2. However, VM-1 in VNet-Spoke1 cannot communicate with VM-2 in VNet-Spoke2 because virtual network peering is non-transitive.

By design, traffic cannot transit a middle virtual network (VNet-Hub) to reach another peered network unless a routing device (like a Network Virtual Appliance) is configured in that hub.

Evaluate configuration settings required to bypass non-transitivity directly.

To allow VM-1 and VM-2 to communicate directly without passing through VNet-Hub, a direct network path must be established.

Establishing direct peering between VNet-Spoke1 and VNet-Spoke2 bypasses VNet-Hub entirely.

Confirm the correct configuration action.

Configure a bidirectional virtual network peering directly between VNet-Spoke1 and VNet-Spoke2.

This establishes direct, low-latency communication between the two spoke networks.

Key Concept

Virtual network peering is non-transitive by default. To route traffic between two spokes, you must either peer them directly or route traffic through a Network Virtual Appliance (NVA) in the hub using User-Defined Routes.

Question 1130Question →

Your company has an Azure virtual network named VNet-Core that contains a workload subnet named Subnet-Workload. You deploy an Azure Firewall. You plan to configure network rules that use fully qualified domain names (FQDNs) to filter outbound traffic from Subnet-Workload. You need to configure the firewall to act as a DNS proxy so that virtual machines in Subnet-Workload resolve DNS queries through the firewall. Which two configurations should you perform?

Select all that apply

Enable DNS Proxy in the settings of the Azure Firewall Policy.

Configure the DNS servers settings of VNet-Core to use the private IP address of the Azure Firewall.

Add a route to the route table of Subnet-Workload with a next hop type of Virtual Appliance pointing to the firewall's private IP for the destination 168.63.129.16/32.

Configure a virtual network link with auto-registration enabled from VNet-Core to a Private DNS Zone.

Show answer & explanation

Answer: Enable DNS Proxy in the settings of the Azure Firewall Policy.; Configure the DNS servers settings of VNet-Core to use the private IP address of the Azure Firewall.

Answer

Enable DNS Proxy in the settings of the Azure Firewall Policy, and configure the DNS servers settings of VNet-Core to use the private IP address of the Azure Firewall.

Enabling the DNS proxy setting in the Azure Firewall Policy and configuring the virtual network's DNS server settings to target the firewall's private IP ensures that the virtual machines direct their DNS queries through the firewall. This allows the firewall to map domain names to IP addresses for FQDN-based network rules.

Step-by-Step Solution

Enable the DNS proxy setting on the Azure Firewall or its associated firewall policy to allow it to receive and process DNS requests.

The firewall starts listening on port 53 for DNS queries.

This is necessary so the firewall can intercept and log the DNS resolution mapping for FQDN-based network rules.

Configure the DNS settings of the virtual network (VNet-Core) containing the client virtual machines.

Set the DNS servers configuration from Default (Azure-provided) to Custom, and specify the private IP address of the Azure Firewall.

This ensures that client machines automatically receive the firewall's IP address as their primary DNS server via DHCP.

Key Concept

Azure Firewall DNS Proxy configuration requires enabling DNS proxy in the firewall policy and specifying the firewall's private IP as the custom DNS server on the virtual network.

Question 1131Question →

You are designing a monitoring strategy for an Azure environment. You need to map each operational requirement to the correct Azure Monitor component. Match each requirement to the appropriate component.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Identify administrative control-plane operations matches with Activity Log Alert; Monitor high-frequency, numerical data points matches with Metric Alert; Execute complex KQL queries matches with Log Search Alert; Orchestrate notifications matches with Action Group.

The correct matches align each specific Azure Monitor resource or configuration item with its corresponding operational function: Activity Log alerts for administrative operations, Metric alerts for numerical telemetry, Log Search alerts for queries using KQL, and Action Groups for routing notifications.

Step-by-Step Solution

Analyze the log source for control-plane events.

Determine that actions like resource deletions are recorded in the Activity Log, making Activity Log Alerts the correct mechanism.

Activity logs track resource management operations at the subscription and resource level.

Analyze performance-based requirements.

Determine that numerical thresholds like CPU utilization are tracked via metrics, making Metric Alerts the correct mechanism.

Metric telemetry is optimized for high-frequency, low-latency evaluation of numeric values.

Analyze requirements involving custom log analysis.

Determine that querying structured workspace tables using KQL query conditions maps to Log Search Alerts.

Log Search Alerts run KQL queries to evaluate logs at set time intervals.

Analyze how notifications are processed.

Associate the orchestration of email alerts, webhooks, and automation tools with Action Groups.

Action Groups centralize the configuration of notification channels and automated action targets.

Key Concept

Azure Monitor Alert and Action Configurations

Estimated Time:2m 0s

Question 1132Question →

A company named Contoso, Ltd. plans to implement backups for a critical file share. You are configuring a backup policy in a Recovery Services vault named `rsv-contoso-sea` in the Southeast Asia region. The target file share is an SMB file share named `records-smb` hosted within a Premium storage account named `sapremrecords`. The network configuration for `sapremrecords` is configured to 'Enabled from selected networks' to meet security compliance.

During the configuration of the backup, the vault is unable to discover the file share inside the storage account.

Which of the following actions should you perform to resolve this issue?

Configure the firewall of the storage account to allow inbound traffic from the public IP address of the Recovery Services vault.

Assign the Storage File Data Privileged Reader role to the Recovery Services vault's system-assigned managed identity on the storage account.

Configure the firewalls and virtual networks settings of the storage account to allow trusted Microsoft services to access the storage account.

Assign the Backup Operator role to the storage account's resource group to grant the vault permission to write snapshots.

Show answer & explanation

Answer: Configure the firewalls and virtual networks settings of the storage account to allow trusted Microsoft services to access the storage account.

Answer

Configure the firewalls and virtual networks settings of the storage account to allow trusted Microsoft services to access the storage account.

The correct action is to allow trusted Microsoft services to access the storage account. When a storage account firewall is configured to restrict access to selected networks, Azure Backup (which is a trusted Microsoft service) cannot access it unless the exception for trusted services is enabled in the firewall configuration.

Step-by-Step Solution

Identify the cause of the discovery failure.

The storage account network configuration is restricting access to selected networks, preventing the Recovery Services vault from communicating with it.

By default, enabling the storage firewall blocks external services, including Azure Backup, from registering or discovering shares.

Select the correct mitigation strategy.

Determine that Azure Backup is classified as a trusted Microsoft service.

Using the built-in trusted service exception is the secure and supported method to bypass the firewall for backup operations.

Enable the trusted service bypass on the storage account.

Access is granted to the backup service, allowing the vault to discover and configure backup for the SMB file share.

Checking the option to allow trusted Microsoft services permits the vault to register the storage account and execute backup jobs.

Key Concept

To configure backups for Azure File shares hosted in a storage account with firewall restrictions, you must enable the trusted Microsoft services bypass in the storage account's network settings.

Question 1133Question →

To support a new internal application architecture, you deploy a virtual network named `VNet-Core` and create two Azure Private DNS zones named `corp.internal` and `services.internal`.

You attempt to create virtual network links from `VNet-Core` to both private DNS zones, enabling the auto-registration setting on both links.

What is the outcome of this configuration?

The second virtual network link will fail to be created because a virtual network can be linked to only one private DNS zone with auto-registration enabled.

Both links will be created successfully, and the virtual machines in `VNet-Core` will automatically register their DNS records in both private DNS zones.

Both links will be created successfully, but the virtual machines in `VNet-Core` will only automatically register their DNS records in the private DNS zone that was linked first.

The configuration will fail because a virtual network can only be linked to a single private DNS zone, regardless of whether auto-registration is enabled.

Show answer & explanation

Answer: The second virtual network link will fail to be created because a virtual network can be linked to only one private DNS zone with auto-registration enabled.

Answer

The second virtual network link will fail to be created because a virtual network can be linked to only one private DNS zone with auto-registration enabled.

Azure Private DNS allows a virtual network to be linked to multiple private DNS zones for name resolution. However, a virtual network can only be linked to a single private DNS zone with auto-registration enabled. Attempting to enable auto-registration on a second link for the same virtual network will fail during deployment.

Step-by-Step Solution

Analyze the requirements for linking a virtual network to multiple Azure Private DNS zones.

A virtual network can be linked to multiple Private DNS zones for name resolution.

Enabling name resolution across multiple zones is a supported scenario.

Identify the restriction on the auto-registration feature for virtual network links.

Each virtual network can have at most one link with auto-registration enabled.

Azure enforces this limit to avoid duplicate or conflicting DNS records for a single VM across multiple zones.

Evaluate the deployment outcome of configuring two auto-registration links for the same virtual network.

The creation of the second link with auto-registration enabled fails.

The system validates and rejects the second auto-registration link.

Key Concept

Virtual network link limitations in Azure Private DNS

Question 1134Question →

An administrator is preparing to deploy an Azure Kubernetes Service (AKS) cluster. The cluster will be deployed into an existing virtual network (`VNet1`) that has an address space of $10.150.0.0/16$ and a subnet named `subnet1` with an address space of $10.150.1.0/24$ .

Which IP address configuration for the Service CIDR and DNS service IP represents a valid deployment setup?

Service CIDR:

172.16.0.0/16

; DNS service IP:

172.16.0.1

Service CIDR:

10.150.2.0/24

; DNS service IP:

10.150.2.10

Service CIDR:

172.16.0.0/16

; DNS service IP:

172.16.0.10

Service CIDR:

172.16.0.0/16

; DNS service IP:

10.150.1.10

Show answer & explanation

Answer: Service CIDR: $172.16.0.0/16$ ; DNS service IP: $172.16.0.10$

Answer

Service CIDR:

172.16.0.0/16

; DNS service IP:

172.16.0.10

The configuration specifying a Service CIDR of

172.16.0.0/16

and a DNS service IP of

172.16.0.10

is correct. The Service CIDR is outside the virtual network's range (

10.150.0.0/16

), avoiding routing conflicts. Additionally, the DNS service IP is located within the Service CIDR range and is not the first host IP address (

172.16.0.1

), which is reserved for the internal Kubernetes API server.

Step-by-Step Solution

Check for Service CIDR overlap with the existing virtual network.

The Service CIDR range must not fall within the

10.150.0.0/16

VNet address space.

To avoid routing conflicts, the Service CIDR must be completely separate from the virtual network address space.

Verify that the DNS service IP address falls within the defined Service CIDR block.

For a Service CIDR of

172.16.0.0/16

, the DNS service IP must be an address starting with

172.16

The DNS service IP must be a part of the Kubernetes service network space.

Ensure the DNS service IP is not the first IP address of the Service CIDR range.

Avoid using

172.16.0.1

as the DNS service IP address.

The first address in the Service CIDR is reserved for the internal Kubernetes API server (the kubernetes service).

Key Concept

Azure Kubernetes Service IP Address Planning and Configuration

Question 1135Question →

Your company has an Azure environment with the resources shown in the following table:

Subscription	Resource Group	Resource Name	Resource Type	Region
Sub-Production	RG-App-East	VM-App-East	Virtual Machine	East US
Sub-Production	RG-App-East	saappprod	Storage Account (Blobs)	East US
Sub-Production	RG-App-East	RSV-App-East	Recovery Services Vault	East US
Sub-Production	RG-App-East	BV-App-East	Backup Vault	East US
Sub-Production	RG-Backup-West	RSV-App-West	Recovery Services Vault	West US
Sub-Development	RG-Dev-East	VM-Dev-East	Virtual Machine	East US

You need to configure Azure Backup for VM-App-East and enable operational backup for the blobs in saappprod.

Which two actions should you perform? (Select two.)

Select all that apply

Configure a backup policy in RSV-App-East and associate it with VM-App-East.

Configure a backup policy in RSV-App-West and associate it with VM-App-East.

Configure a backup policy in BV-App-East for saappprod, and assign the Storage Account Backup Contributor role to the managed identity of BV-App-East.

Configure a backup policy in BV-App-East for saappprod, and assign the Contributor role on RG-App-East to the managed identity of BV-App-East.

Show answer & explanation

Answer: Configure a backup policy in RSV-App-East and associate it with VM-App-East.; Configure a backup policy in BV-App-East for saappprod, and assign the Storage Account Backup Contributor role to the managed identity of BV-App-East.

Answer

Configure a backup policy in RSV-App-East for VM-App-East, and configure a backup policy in BV-App-East for saappprod while assigning the Storage Account Backup Contributor role to the managed identity of BV-App-East.

To back up Azure VMs, you must use a Recovery Services Vault in the same region and subscription as the VM. In this scenario, VM-App-East is in East US, so it must be associated with RSV-App-East. For operational backup of blobs, you must use a Backup Vault in the same region, and you must assign the data-plane Storage Account Backup Contributor role to the vault's managed identity on the target storage account (saappprod) so the service has direct read and write access to the blob data.

Step-by-Step Solution

Determine the backup vault type and regional requirements for the virtual machine.

VM-App-East is a virtual machine and requires a Recovery Services Vault. The vault must be located in the same region (East US) and subscription (Sub-Production) as the virtual machine. Therefore, RSV-App-East is selected.

Azure VM backup only supports same-region, same-subscription Recovery Services Vaults.

Determine the backup vault type and access requirements for Azure Blob backup.

Azure Blob operational backup requires a Backup Vault rather than a Recovery Services Vault. The Backup Vault (BV-App-East) must be selected.

Backup Vaults support Azure Blobs, Azure Disks, and Azure PostgreSQL databases, whereas Recovery Services Vaults do not support Blob operational backups.

Configure the necessary data-plane permissions for the Blob backup process.

Assign the Storage Account Backup Contributor role to the system-assigned managed identity of BV-App-East on the storage account saappprod.

Azure Backup needs data-plane level permissions on the storage account. Standard control-plane roles (like Owner or Contributor) assigned at higher scopes do not automatically grant the required data-plane access for the Backup service.

Key Concept

Recovery Services Vaults are used for VM backups and must match the VM's region/subscription, whereas Backup Vaults are used for operational backups of blobs/disks and require direct data-plane role assignments (like Storage Account Backup Contributor) for permission authentication.

Question 1136Question →

An administrator configures an Azure Monitor action group to send email notifications to the members of a custom Azure subscription role named Ops-Admin. The custom role is assigned to a Microsoft Entra ID security group named Ops-Group. Several users are members of Ops-Group, but none of them are directly assigned the custom role. When an alert triggers, none of the members of Ops-Group receive the email notifications. What should you do to ensure the members receive the emails?

Modify the action group configuration to target the Object ID of the security group directly.

Configure an alert processing rule to forward the alerts to the security group.

Assign the custom role directly to the individual users rather than the security group.

Enable the Common Alert Schema setting on the action group action.

Show answer & explanation

Answer: Assign the custom role directly to the individual users rather than the security group.

Answer

Assign the custom role directly to the individual users rather than the security group.

The correct option is to assign the custom role directly to the individual users. The Email Azure Resource Manager Role action in Azure Monitor action groups only sends email to Microsoft Entra ID users who are directly assigned the role. It does not support resolving members of Microsoft Entra ID groups that hold the role assignment.

Step-by-Step Solution

Analyze the action group configuration and the notification mechanism.

The action group is configured to send emails using the 'Email Azure Resource Manager Role' action.

This action type resolves role assignments at the subscription scope to find email addresses.

Identify limitations of the Email Azure Resource Manager Role action.

Azure Monitor only sends emails to users with direct role assignments. It does not traverse group memberships to find users who inherit the role.

This is a designed limitation of the Azure Monitor alerting platform to prevent excessive nested group resolution overhead.

Determine the solution to bypass this limitation.

Assigning the role directly to the individual users ensures Azure Monitor resolves their email addresses.

Direct role assignments are successfully processed by the Email Azure Resource Manager Role action.

Key Concept

Azure Monitor Action Group Role Receiver Limitations

Question 1137Question →

Your company has an Azure environment with two virtual networks in the East US region: VNet-Hub ( $10.10.0.0/16$ ) and VNet-Spoke1 ( $10.20.0.0/16$ ). VNet-Hub contains a Virtual Network Gateway connected to an on-premises network. Virtual machines are deployed in both virtual networks. You need to configure virtual network peering between VNet-Hub and VNet-Spoke1 so that virtual machines in VNet-Spoke1 can access the on-premises network through the gateway in VNet-Hub. Which two configuration settings should you enable? (Select two.)

Select all that apply

Configure the peering link from VNet-Spoke1 to VNet-Hub to use remote gateways.

Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit.

Configure the peering link from VNet-Hub to VNet-Spoke1 to use remote gateways.

Configure the peering link from VNet-Spoke1 to VNet-Hub to allow gateway transit.

Show answer & explanation

Answer: Configure the peering link from VNet-Spoke1 to VNet-Hub to use remote gateways.; Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit.

Answer

To allow the spoke virtual network to access the on-premises network via the hub's gateway, you must enable 'Use remote gateways' on the peering link from VNet-Spoke1 to VNet-Hub, and enable 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke1.

To route traffic from a spoke virtual network through a gateway in a hub virtual network, two settings are required. First, the peering from the hub VNet (VNet-Hub) to the spoke VNet (VNet-Spoke1) must have 'Allow gateway transit' enabled, which permits the hub to share its gateway. Second, the peering from the spoke VNet (VNet-Spoke1) to the hub VNet (VNet-Hub) must have 'Use remote gateways' enabled, which directs the spoke to route traffic through the hub's gateway.

Step-by-Step Solution

Identify which virtual network contains the Virtual Network Gateway.

VNet-Hub contains the Virtual Network Gateway connected to the on-premises network.

This determines which network will transit traffic and which network will use a remote gateway.

Configure the peering link initiated from the hub virtual network (VNet-Hub to VNet-Spoke1).

Enable the 'Allow gateway transit' setting.

This permits VNet-Hub to share its gateway with the peered spoke network.

Configure the peering link initiated from the spoke virtual network (VNet-Spoke1 to VNet-Hub).

Enable the 'Use remote gateways' setting.

This allows the virtual machines in the spoke network to route their traffic to the gateway in the hub network.

Key Concept

Enabling gateway transit and remote gateways in peered virtual networks allows spoke networks to utilize a shared gateway in a hub network.

Estimated Time:1m 30s

Question 1138Question →

You have an Azure virtual network named `Hub-VNet` that contains an Azure Firewall. The firewall is configured with a private IP address of $10.10.1.4$ . You also have a peered virtual network named `Spoke-VNet` that contains a subnet named `Subnet-App`. You associate a new route table named `RouteTable-Spoke` with `Subnet-App`. You need to ensure that all outbound internet traffic from `Subnet-App` is routed through the Azure Firewall in `Hub-VNet`.

Which route should you add to `RouteTable-Spoke`?

A route with a destination address prefix of

0.0.0.0/0

, a next hop type of Virtual appliance, and a next hop IP address of

10.10.1.4

A route with a destination address prefix of

0.0.0.0/0

, a next hop type of Virtual network gateway, and a next hop IP address of

10.10.1.4

A route with a destination address prefix of

0.0.0.0/0

and a next hop type of Internet.

No custom route; instead, enable the Use Remote Gateways option on the peering connection from `Spoke-VNet` to `Hub-VNet`.

Show answer & explanation

Answer: A route with a destination address prefix of $0.0.0.0/0$ , a next hop type of Virtual appliance, and a next hop IP address of $10.10.1.4$ .

Answer

A route with a destination address prefix of

0.0.0.0/0

, a next hop type of Virtual appliance, and a next hop IP address of

10.10.1.4

To route all outbound internet traffic from a spoke subnet to an Azure Firewall in a hub VNet, you must associate a route table with the spoke subnet and add a default route (

0.0.0.0/0

). Because Azure Firewall acts as a network virtual appliance, the next hop type must be configured as 'Virtual appliance' and the next hop IP address must be the private IP address of the firewall (

10.10.1.4

Step-by-Step Solution

Identify the target destination for the route.

Since the requirement is to route all outbound internet traffic, the destination address prefix must be set to

0.0.0.0/0

, which matches all IPv4 addresses not covered by more specific routes.

The system needs to know which traffic is subject to this routing rule.

Select the correct next hop type for Azure Firewall.

The next hop type must be set to 'Virtual appliance'.

Azure Firewall behaves as a network virtual appliance (NVA) inside the virtual network hierarchy.

Specify the next hop address.

The next hop address must be the private IP address of the Azure Firewall (

10.10.1.4

This directs the virtual network's routing engine to forward matching packets directly to the firewall's internal interface.

Key Concept

Configuring custom routing (User-Defined Routes) to direct traffic through Azure Firewall.

Estimated Time:1m 30s

Question 1139Question →

Your company has virtual machines backed up to three Recovery Services vaults across different Azure regions. You are tasked with configuring Azure Backup Reports to perform historical auditing on backup job statuses and storage trends over the last 90 days. You deploy a central Log Analytics workspace named Workspace-Central.

Which two actions should you perform to implement the required backup reporting solution? (Select two.)

Select all that apply

For each Recovery Services vault, create a diagnostic setting that directs logs to Workspace-Central using the Resource-specific destination table.

In the diagnostic settings for each vault, select the CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance log categories.

Create a separate Log Analytics workspace in each of the three regions, as diagnostic logs from Recovery Services vaults can only be sent to a workspace in the same region.

Configure diagnostic settings on each of the virtual machines to route Guest OS performance counters to Workspace-Central.

Show answer & explanation

Answer: For each Recovery Services vault, create a diagnostic setting that directs logs to Workspace-Central using the Resource-specific destination table.; In the diagnostic settings for each vault, select the CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance log categories.

Answer

Configure a diagnostic setting on each Recovery Services vault to send logs to Workspace-Central using the Resource-specific table schema, and ensure that the CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance log categories are selected.

To set up Azure Backup Reports, diagnostic logs must be enabled at the vault level. Routing them to a central Log Analytics workspace using the Resource-specific schema allows the reports to read specialized tables. Selecting the correct log categories (CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance) is mandatory to ensure all historical backup metadata is transferred to the workspace.

Step-by-Step Solution

Open the Azure Portal, navigate to each of the three Recovery Services vaults, and locate the Diagnostic settings blade.

Diagnostic settings configurations are made accessible for each vault.

Diagnostic settings dictate where backup metadata is forwarded for historical analysis.

Add a new diagnostic setting targeting Workspace-Central and select the Resource-specific option.

Logs will be routed directly to individual tables structured for Azure Backup Reports.

The Resource-specific schema avoids the single large AzureDiagnostics table, improving query performance and reducing cost.

Check the boxes for CoreAzureBackup, AddonAzureBackupJobs, AddonAzureBackupPolicy, AddonAzureBackupStorage, and AddonAzureBackupProtectedInstance.

The target tables in Log Analytics will receive the data points required for the backup reports.

Failing to check these specific log categories leaves the workspace without the historical metrics needed to display job runs and storage trends.

Key Concept

Azure Backup Reports configuration requires configuring diagnostic settings on the Recovery Services vaults to forward specific resource-specific log categories to a central Log Analytics workspace.

Estimated Time:2m 0s

Question 1140Question →

You manage an Azure subscription that contains a Private DNS zone named corp.contoso.com and two virtual networks named VNet-Prod and VNet-Test. You need to configure Azure DNS to meet the following requirements:

- Virtual machines deployed in VNet-Prod must automatically register their DNS records in corp.contoso.com.
- Virtual machines deployed in VNet-Test must be able to resolve the names of virtual machines in VNet-Prod by using the corp.contoso.com zone.
- Virtual machines deployed in VNet-Test must not automatically register their DNS records in corp.contoso.com.

Which two actions should you perform? (Select two.)

Select all that apply

Create a virtual network link from corp.contoso.com to VNet-Prod and select the Enable auto-registration option.

Create a virtual network link from corp.contoso.com to VNet-Test and clear the Enable auto-registration option.

Create a virtual network link from corp.contoso.com to VNet-Test and select the Enable auto-registration option.

Configure virtual network peering between VNet-Prod and VNet-Test.

Show answer & explanation

Answer: Create a virtual network link from corp.contoso.com to VNet-Prod and select the Enable auto-registration option.; Create a virtual network link from corp.contoso.com to VNet-Test and clear the Enable auto-registration option.

Answer

Create a virtual network link from corp.contoso.com to VNet-Prod and select the Enable auto-registration option, and create a virtual network link from corp.contoso.com to VNet-Test and clear the Enable auto-registration option.

To satisfy the requirements, two virtual network links must be created. The link to VNet-Prod must have auto-registration enabled so that VMs in VNet-Prod are automatically registered in the DNS zone. The link to VNet-Test must have auto-registration disabled (cleared) so that VMs in VNet-Test can resolve names from the DNS zone (including the registered VMs from VNet-Prod) but do not register their own names.

Step-by-Step Solution

Configure name resolution and auto-registration for the production network.

A virtual network link is created between corp.contoso.com and VNet-Prod with the Enable auto-registration option selected.

This ensures that virtual machines in VNet-Prod are registered in the DNS zone and can resolve records within it.

Configure name resolution without auto-registration for the test network.

A virtual network link is created between corp.contoso.com and VNet-Test with the Enable auto-registration option cleared.

This allows virtual machines in VNet-Test to resolve DNS names registered in the zone (such as those from VNet-Prod) without registering their own records.

Key Concept

Azure Private DNS Zone Virtual Network Links and Auto-Registration

PreviousPage 57 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept