Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 1201Question →

An administrator is configuring backups for resources in a multi-region Azure environment. The resources are deployed as shown in the following table:

SubscriptionResource GroupResource NameResource TypeAzure Region
Sub-Core-Prodrg-compute-eastvm-prod-eastVirtual machineEast US
Sub-Core-Prodrg-compute-westvm-prod-westVirtual machineWest US
Sub-Core-Prodrg-storage-westsa-data-westStorage account (blobs)West US
Sub-Mgmt-Backuprg-backups-eastrsv-backup-eastRecovery Services VaultEast US
Sub-Mgmt-Backuprg-backups-westbv-backup-westBackup VaultWest US

Which backup or restore configuration can be successfully implemented for these resources?

Show answer & explanation

Answer: Back up vm-prod-east to rsv-backup-east.

Answer

Back up vm-prod-east to rsv-backup-east.
The configuration to back up the virtual machine in the East US region to the Recovery Services Vault in the East US region is valid because Azure Backup supports cross-subscription virtual machine backups as long as the source virtual machine and the target vault reside in the same Azure region.

Step-by-Step Solution

1
Verify regional alignment requirements for Azure Virtual Machine backups.
Virtual machines must reside in the same region as the Recovery Services Vault to which they are backed up.
Azure Backup does not support cross-region backup configuration for virtual machines using Recovery Services Vaults.
2
Check cross-subscription support for virtual machine backup configuration.
Azure Backup allows backing up virtual machines to a vault in a different subscription within the same tenant.
This allows for centralized backup management across subscriptions.
3
Evaluate the vm-prod-east to rsv-backup-east backup configuration.
Both the virtual machine and the Recovery Services Vault are located in the East US region, making the configuration valid despite being in different subscriptions.
The regional constraint is satisfied and cross-subscription backup is supported.

Key Concept

Recovery Services Vaults require virtual machines to be in the same region to configure backups, but support cross-subscription configurations under the same tenant.
Question 1202Question →

You are configuring diagnostic settings for a Recovery Services vault to enable Azure Backup Reports using a Log Analytics workspace. You select the resource-specific destination table option. You need to ensure the reports can display historical data for backup job status and backup storage utilization. Which set of diagnostic log categories must you select?

Show answer & explanation

Answer: CoreBackup, AddonBackupJobs, and AddonBackupStorage

Answer

CoreBackup, AddonBackupJobs, and AddonBackupStorage
To enable Azure Backup Reports in a Log Analytics workspace using resource-specific tables, you must select the appropriate log categories. CoreBackup contains basic metadata about vaults, backup items, and policies. AddonBackupJobs provides status and tracking details for backup jobs. AddonBackupStorage contains details on storage usage and data footprint. Together, these three categories populate the backup job status and storage utilization reports.

Step-by-Step Solution

1
Identify the destination schema mode chosen for the diagnostic settings.
The scenario specifies the resource-specific option, meaning logs will be routed to dedicated tables instead of the legacy AzureDiagnostics table.
Resource-specific mode routes categories to individual tables rather than a unified legacy table, which determines how log categories map to destinations.
2
Determine the reporting requirements requested in the scenario.
The requirements are to display historical data for backup job status and backup storage utilization.
This helps filter out unrelated log categories like alerts, policies, or standard tenant/subscription-level activity logs.
3
Match the required reports to the corresponding resource-specific diagnostic log categories.
CoreBackup contains the vault and item metadata. AddonBackupJobs contains job status logs. AddonBackupStorage contains storage usage logs.
Enabling these three categories ensures the workspace receives all the data fields necessary to populate both the job history and storage usage components of Azure Backup Reports.

Key Concept

Azure Backup Reports and Monitoring
Question 1203Question →

You have an Azure VPN Gateway named `vng-prod-east` that connects an on-premises network to an Azure Virtual Network. You need to configure diagnostic logging and monitoring for `vng-prod-east` to meet the following requirements:
- Send all VPN tunnel resource health and connection status logs to a Log Analytics workspace named `law-ops` for query analysis.
- Route all gateway metrics to a storage account named `sa-monitoring-archive` for long-term retention.

Which of the following configuration actions should you perform to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Create a diagnostic setting on `vng-prod-east`, select the `TunnelDiagnostic` and `GatewayDiagnostic` log categories, and select Send to Log Analytics workspace with `law-ops` as the destination.; Create a diagnostic setting on `vng-prod-east`, select the `AllMetrics` metric category, and select Archive to a storage account with `sa-monitoring-archive` as the destination.

Answer

Create a diagnostic setting on the VPN Gateway sending the required logs to the Log Analytics workspace, and create a diagnostic setting on the VPN Gateway archiving all metrics to the storage account.
To satisfy the requirements, diagnostic settings must be created directly on the source resource, `vng-prod-east`. One setting or configuration block must route the relevant VPN gateway log categories (`TunnelDiagnostic` and `GatewayDiagnostic`) to the Log Analytics workspace `law-ops` for query capability. A second setting or configuration block must route the metrics (`AllMetrics`) to the target storage account `sa-monitoring-archive` for long-term archiving.

Step-by-Step Solution

1
Identify the source resource to configure.
Diagnostic settings must be configured on the source resource (the VPN Gateway `vng-prod-east`), not the destination resources.
Azure Monitor routes logs and metrics from source resources based on settings defined on those sources.
2
Configure log routing for connection and tunnel health.
Create a diagnostic setting on `vng-prod-east` selecting the `TunnelDiagnostic` and `GatewayDiagnostic` log categories and targeting the `law-ops` Log Analytics workspace.
This satisfies the requirement to send VPN tunnel and connection health logs to Log Analytics.
3
Configure metric routing for archiving.
Create a diagnostic setting on `vng-prod-east` selecting the `AllMetrics` category and targeting the `sa-monitoring-archive` storage account.
This satisfies the requirement to archive gateway metrics to storage for long-term retention.

Key Concept

Azure Monitor diagnostic settings are configured on a source resource to route specific log and metric categories to destination endpoints, such as Log Analytics or Azure Storage.
Question 1204Question →

You are planning to implement Azure Backup Reports to analyze historical backup trends and usage data across multiple Recovery Services vaults. Which of the following tasks must you perform to configure and view the reports? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure diagnostic settings on each Recovery Services vault to send backup logs to a Log Analytics workspace.; Open Backup Center, select Backup Reports, and configure the workspace routing to point to your Log Analytics workspace.

Answer

To configure Azure Backup Reports, you must configure diagnostic settings on each Recovery Services vault to send backup logs to a Log Analytics workspace, and then open Backup Center, select Backup Reports, and configure the workspace routing to point to your Log Analytics workspace.
To use Azure Backup Reports, you must forward backup data from the Recovery Services vaults to a Log Analytics workspace using diagnostic settings. You then view the reports by pointing the Backup Reports dashboard (within Backup Center or Power BI) to that workspace.

Step-by-Step Solution

1
Enable diagnostic data collection from the Recovery Services vaults.
Backup diagnostic logs (such as backup jobs, core backup events, and policy details) are streamed to a central repository.
Azure Backup Reports do not display real-time portal data; they rely on historical diagnostic telemetry forwarded from the vaults.
2
Select a destination for the diagnostic logs.
A Log Analytics workspace receives and stores the diagnostic logs from the vault.
A Log Analytics workspace acts as the primary data store and query source for Backup Reports.
3
Access and configure the reporting interface.
The Backup Reports dashboard in Backup Center or Power BI is linked to the Log Analytics workspace, rendering the historical data.
Connecting the report interface to the workspace allows it to visualize the aggregated backup telemetry.

Key Concept

Azure Backup Reports rely on vault-level diagnostic settings routing logs to a central Log Analytics workspace which is then selected as the data source.
Question 1205Question →

Your company has an Azure subscription named Sub-Finance-Prod that contains the resources shown in the following table:

Resource NameResource TypeAzure RegionResource Group
VM-Core-01Virtual machineEast USRG-Core
stfinance01Storage account (block blobs)East USRG-Finance

You deploy the following vaults to a resource group named RG-Backup:
- RSV-East-01: A Recovery Services vault in East US
- RSV-West-01: A Recovery Services vault in West US
- BV-East-01: A Backup vault in East US

You need to back up VM-Core-01 and configure operational backup for the block blobs in stfinance01.

Which two actions should you perform? Select two.

Select all that apply

Show answer & explanation

Answer: Configure the backup of VM-Core-01 to RSV-East-01.; Assign the Storage Blob Data Contributor role on stfinance01 to the system-assigned managed identity of BV-East-01.

Answer

To successfully back up the resources, you must configure the backup of VM-Core-01 to RSV-East-01 and assign the Storage Blob Data Contributor role on stfinance01 to the system-assigned managed identity of BV-East-01.
To back up Azure Virtual Machines, the Recovery Services Vault must be in the same region as the virtual machine. Therefore, VM-Core-01 (in East US) must be backed up to RSV-East-01. To configure operational backup for Azure Blobs, a Backup Vault is used, and the vault's managed identity must be assigned the Storage Blob Data Contributor role on the target storage account to grant the necessary data-plane permissions.

Step-by-Step Solution

1
Determine the backup vault type and region requirements for the virtual machine VM-Core-01.
VM-Core-01 is a virtual machine located in the East US region. It must be backed up to a Recovery Services Vault located in the same region, which is RSV-East-01.
Azure Backup requires virtual machines and their corresponding Recovery Services Vaults to be in the same geographic region.
2
Determine the backup vault type and permission requirements for the block blobs in stfinance01.
Block blobs require a Backup Vault (BV-East-01) for operational backups. The Backup Vault's system-assigned managed identity must be granted the Storage Blob Data Contributor role on stfinance01.
Operational backup for Azure Blobs is a capability of Backup Vaults, and the vault requires data-plane access (provided by the Storage Blob Data Contributor role) to read and back up the blobs.

Key Concept

Azure Backup regional constraints for virtual machines using Recovery Services Vaults, and data-plane role assignments (Storage Blob Data Contributor) for configuring block blob backups using Backup Vaults.
Question 1206Question →

An administrator needs to configure secure administrative access to virtual machines in a virtual network named `VNet-Secure`. The virtual network currently contains a single workload subnet and no other resources. The administrator plans to secure the Bastion subnet with a Network Security Group (NSG).

What is the correct sequence of steps to configure the virtual network environment and establish a secure connection using Azure Bastion?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure and use Azure Bastion, first create the dedicated `AzureBastionSubnet` with a prefix of at least /26/26. Next, configure and associate a Network Security Group (NSG) with the required inbound and outbound rules to this subnet. Then, deploy the Azure Bastion host using a Standard SKU public IP address. Finally, connect to the target virtual machine from the Azure portal.
The correct sequence begins with creating the dedicated `AzureBastionSubnet` with a prefix of /26/26 or larger. Before deploying the Bastion host, any associated Network Security Group (NSG) must be configured with the mandatory rules (such as inbound HTTPS from GatewayManager) and linked to the subnet to pass deployment validation. Once the network infrastructure is ready, the Azure Bastion host is deployed using a Standard SKU public IP. Finally, the administrator can initiate a secure RDP or SSH session to target virtual machines.

Step-by-Step Solution

1
Add a subnet named `AzureBastionSubnet` with a prefix of /26/26 or larger.
The dedicated subnet is created, defining the address space for the Bastion service.
Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with at least a /26/26 prefix.
2
Associate an NSG with the mandatory security rules to the `AzureBastionSubnet`.
The subnet is secured, and Azure will pass NSG validation during Bastion deployment.
If an NSG is associated with the `AzureBastionSubnet`, Azure validates its rules during the Bastion host provisioning phase.
3
Provision the Azure Bastion host using a Standard SKU public IP address.
The Bastion host is deployed and running in the `AzureBastionSubnet`.
The Bastion host requires a pre-existing subnet and a Standard SKU public IP to deploy.
4
Connect to the target virtual machine via the Connect blade in the Azure portal.
A secure RDP or SSH session is established in the browser.
The session relies on the running Bastion host to proxy the connection over HTTPS (443443).

Key Concept

Deploying Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a prefix of /26/26 or larger. If a Network Security Group (NSG) is associated with this subnet, it must contain specific mandatory rules (such as allowing HTTPS from GatewayManager inbound) to pass deployment validation. The Bastion host also requires a Standard SKU public IP address.
Estimated Time:2m 0s
Question 1207Question →

Your company has two Azure subscriptions named Sub-Production and Sub-Management. The subscriptions contain the resources shown in the following table:

Resource NameResource TypeAzure RegionResource GroupSubscription
VM-App-EastVirtual MachineEast USRG-AppSub-Production
Disk-App-EastManaged DiskEast USRG-AppSub-Production
VM-DB-WestVirtual MachineWest USRG-DatabaseSub-Production
Vault-RSV-EastRecovery Services VaultEast USRG-Backup-EastSub-Management
Vault-BV-EastBackup VaultEast USRG-Backup-EastSub-Management
Vault-RSV-CentralRecovery Services VaultCentral USRG-Backup-CentralSub-Management

You need to configure backup for VM-App-East.

Which vault can you use to back up VM-App-East?

Show answer & explanation

Answer: Vault-RSV-East only

Answer

Vault-RSV-East only
The correct answer is Vault-RSV-East only because backing up an Azure Virtual Machine requires a Recovery Services Vault located in the same region as the VM. VM-App-East is in the East US region, and Vault-RSV-East is the only Recovery Services Vault in that region. Cross-subscription backup is supported.

Step-by-Step Solution

1
Determine the resource type of VM-App-East and identify its backup vault compatibility.
VM-App-East is an Azure Virtual Machine, which can only be backed up to a Recovery Services Vault, not a Backup Vault.
Recovery Services Vaults support virtual machine backups, whereas Backup Vaults support other workloads like Azure Disks, Azure Blobs, and Azure Database for PostgreSQL.
2
Check the regional constraints for Azure Virtual Machine backups.
The Recovery Services Vault must be in the same region (East US) as VM-App-East.
Azure Backup requires that the virtual machine and the Recovery Services Vault reside in the same geographical region.
3
Filter the available vaults based on resource type, region, and subscription compatibility.
Only Vault-RSV-East matches all requirements (Recovery Services Vault in East US).
Although Vault-RSV-East is in a different subscription (Sub-Management) and resource group (RG-Backup-East), cross-subscription and cross-resource group backups are supported as long as the vault is in the same region as the VM.

Key Concept

Azure Virtual Machine backups require a Recovery Services Vault in the same region as the virtual machine.
Estimated Time:1m 30s
Question 1208Question →

You are planning the deployment of Azure Bastion to enable secure administrative access to resources in a virtual network named `CorpServices-VNet`. The virtual network has an address space of 192.168.0.0/16192.168.0.0/16. Which subnet configuration must you create to support the deployment of the Azure Bastion host?

Show answer & explanation

Answer: A subnet named AzureBastionSubnet with an address space of 192.168.10.0/26192.168.10.0/26

Answer

A subnet named AzureBastionSubnet with an address space of 192.168.10.0/26192.168.10.0/26
The correct subnet configuration must use the exact name 'AzureBastionSubnet' and have a subnet mask of /26/26 or larger (such as /26/26, /25/25, or /24/24) to accommodate the minimum IP address requirement for the Bastion scale units.

Step-by-Step Solution

1
Identify the required naming convention for the Azure Bastion subnet.
The subnet must be named exactly 'AzureBastionSubnet'.
Azure Bastion uses this specific subnet name to deploy and manage its resources.
2
Determine the minimum subnet size required for Azure Bastion.
The subnet prefix must be /26/26 or larger (e.g., /26/26, /25/25, /24/24).
Azure Bastion requires a /26/26 subnet range to support host scaling and high availability requirements.
3
Select the option that meets both the naming and subnet size requirements.
The option specifying 'AzureBastionSubnet' with a /26/26 prefix satisfies both conditions.
This configuration is valid and supported by Azure Bastion.

Key Concept

Azure Bastion Subnet Requirements
Estimated Time:1m 30s
Question 1209Question →

You need to configure diagnostic settings for several Azure resources. Match each administrative monitoring requirement on the left to the most appropriate Azure Monitor diagnostic setting destination on the right. Each destination may be used once, more than once, or not at all.

Click a left item, then click its matching right item

Items

Retain resource diagnostic logs for 365 days for regulatory compliance at the lowest possible cost.
Stream security and access logs with minimal latency to an external, third-party SIEM system.
Perform complex correlation queries across multiple resources using Kusto Query Language (KQL).
Send log data to a supported SaaS partner monitoring tool using a native Azure service integration.

Matches

Show answer & explanation

Answer

Retain logs for 365 days at lowest cost matches Azure Storage account; Stream logs with minimal latency to external SIEM matches Azure Event Hub; Perform complex correlation queries using KQL matches Log Analytics workspace; Send log data to SaaS partner matches Partner integration.
Each monitoring requirement maps to a specific destination type supported by Azure Monitor diagnostic settings. Archive/long-term low-cost storage maps to Azure Storage accounts. Low-latency external streaming maps to Azure Event Hubs. Querying and analysis using KQL maps to Log Analytics workspaces. Sending logs directly to supported partner tools maps to Partner integrations.

Step-by-Step Solution

1
Identify the destination required for low-cost, long-term retention.
Azure Storage account is identified, as it offers the cheapest cold storage options for archiving logs.
Regulatory compliance requiring 365-day retention without active querying is best served by archival storage.
2
Identify the destination for real-time streaming to external platforms.
Azure Event Hub is identified, as it acts as an event ingestor and streamer.
Integrating with an external SIEM system with minimal latency requires a streaming service like Event Hubs.
3
Identify the destination for advanced querying using KQL.
Log Analytics workspace is identified, as it contains the database engine for log searches.
To write Kusto Query Language (KQL) queries across resource logs, the logs must be sent to a Log Analytics workspace.
4
Identify the destination for third-party SaaS integrations.
Partner integration is identified.
Direct integrations with platforms like Datadog or Dynatrace are configured under the Partner integration option.

Key Concept

Azure Monitor diagnostic settings destination routing and use cases
Question 1210Question →

Your company has an Azure subscription named Sub-Corp-Ops that contains the resources shown in the following table:

Resource NameResource TypeAzure Region
VM-App-01Virtual machineeastus2
Disk-Data-01Azure Diskwestus3
Files-Config-01Azure File shareeastus2

You have the following vault resources:

Vault NameVault TypeAzure Region
RSV-EastRecovery Services Vaulteastus2
RSV-WestRecovery Services Vaultwestus3
BV-EastBackup Vaulteastus2
BV-WestBackup Vaultwestus3

You need to configure Azure Backup for VM-App-01, Disk-Data-01, and Files-Config-01. The solution must minimize the number of vaults used.

Which two vaults should you use?

Select all that apply

Show answer & explanation

Answer: RSV-East; BV-West

Answer

RSV-East and BV-West
The correct vaults are RSV-East and BV-West. RSV-East (a Recovery Services Vault in eastus2) is required because both VM-App-01 and Files-Config-01 reside in eastus2 and require a Recovery Services Vault. BV-West (a Backup Vault in westus3) is required because Disk-Data-01 resides in westus3 and Azure Disk backup is supported only by Backup Vaults, which must match the resource region.

Step-by-Step Solution

1
Determine the backup vault requirements for the virtual machine (VM-App-01) and Azure File share (Files-Config-01).
Both resources are in the eastus2 region and must be backed up using a Recovery Services Vault in the same region. This requires RSV-East.
Azure Virtual Machines and Azure Files backups are supported by Recovery Services Vaults and must reside in the same region as the source resources.
2
Determine the backup vault requirements for the Azure Disk (Disk-Data-01).
The resource is in the westus3 region and must be backed up using a Backup Vault in the same region. This requires BV-West.
Azure Disk backup is supported by Backup Vaults (not Recovery Services Vaults) and the vault must reside in the same region as the disk.
3
Combine the requirements to find the minimum set of vaults.
Using RSV-East and BV-West satisfies all backup and regional requirements with exactly two vaults.
This configuration uses the minimum number of vaults required while complying with both workload type and regional constraints.

Key Concept

Azure Recovery Services Vault and Backup Vault regional and workload compatibility rules
Question 1211Question →

You are deploying Azure Bastion to a virtual network named Corp-VNet. You have created the required subnet named AzureBastionSubnet with a /26 prefix size. You need to configure a Network Security Group (NSG) and associate it with AzureBastionSubnet to support Azure Bastion operations. Which two of the following security rules must be added to the NSG to allow Azure Bastion to function correctly? (Select two.)

Select all that apply

Show answer & explanation

Answer: An inbound security rule that allows HTTPS traffic on TCP port 443 from the GatewayManager service tag; An outbound security rule that allows RDP and SSH traffic on TCP ports 3389 and 22 to the VirtualNetwork service tag

Answer

The correct configurations are: an inbound security rule allowing HTTPS traffic on TCP port 443 from GatewayManager, and an outbound security rule allowing RDP and SSH traffic on TCP ports 3389 and 22 to the VirtualNetwork.
To support Azure Bastion, the associated Network Security Group (NSG) must allow inbound HTTPS traffic from the control plane (GatewayManager) and outbound RDP/SSH traffic to the target virtual machines in the VirtualNetwork.

Step-by-Step Solution

1
Identify control plane traffic requirements.
Azure Bastion needs inbound HTTPS (port 443) traffic from the GatewayManager service tag.
This is mandatory for Azure control plane communications and health monitoring.
2
Identify target connectivity traffic requirements.
Azure Bastion must send outbound RDP (port 3389) and SSH (port 22) traffic to the target virtual machines in the VirtualNetwork.
This allows Bastion to establish sessions on the target VMs.
3
Verify internet inbound/outbound RDP and SSH rules.
Direct RDP/SSH traffic from or to the Internet is unnecessary and should be blocked.
Bastion proxy communication uses HTTPS for inbound client connections and strictly routes RDP/SSH to private destinations.

Key Concept

Azure Bastion Subnet Network Security Group (NSG) Rules
Question 1212Question →

Your company has an Azure subscription named Sub-Ops-Resources that contains the resources shown in the following table:

Resource NameResource TypeAzure RegionResource Group
RSV-NorthRecovery Services VaultNorth Europerg-sec-ne
BV-WestBackup VaultWest Europerg-sec-we
VM-Prod-01Virtual MachineNorth Europerg-prod-ne
Disk-Data-02Managed DiskWest Europerg-prod-we

Which configuration should you use to back up VM-Prod-01 and Disk-Data-02?

Show answer & explanation

Answer: Back up VM-Prod-01 to RSV-North, and back up Disk-Data-02 to BV-West.

Answer

Back up VM-Prod-01 to RSV-North, and back up Disk-Data-02 to BV-West.
The correct configuration is to back up VM-Prod-01 to RSV-North and Disk-Data-02 to BV-West. Azure Backup requires that Recovery Services Vaults used for backing up Virtual Machines reside in the same region as the target VMs (VM-Prod-01 and RSV-North are both in North Europe). Similarly, Azure Disk backup requires a Backup Vault located in the same region as the managed disk (Disk-Data-02 and BV-West are both in West Europe).

Step-by-Step Solution

1
Determine the vault type and regional requirements for VM-Prod-01.
VM-Prod-01 is an Azure Virtual Machine located in North Europe. It must be backed up to a Recovery Services Vault (RSV) in the same region, which is RSV-North.
Azure VM backup policies and operations are managed by Recovery Services Vaults, and the vault must reside in the same region as the virtual machine being protected.
2
Determine the vault type and regional requirements for Disk-Data-02.
Disk-Data-02 is an Azure Managed Disk located in West Europe. It must be backed up to a Backup Vault in the same region, which is BV-West.
Azure Disk backup is supported via Backup Vaults, and the Backup Vault must reside in the same region as the target managed disk.
3
Combine the requirements to select the correct configuration.
VM-Prod-01 maps to RSV-North, and Disk-Data-02 maps to BV-West.
This configuration respects both the vault type compatibility and regional boundary constraints for both resources.

Key Concept

Azure Recovery Services Vaults support Virtual Machine and Azure Files backup within the same region, whereas Backup Vaults support Managed Disks and Blob storage backups within the same region.
Question 1213Question →

An enterprise administrator manages a single virtual network named Production-VNet containing a subnet named AzureBastionSubnet. The virtual network hosts several Linux and Windows virtual machines. A bastion host named Prod-Bastion is deployed in the subnet using the Basic SKU. Developers need to connect to these virtual machines through Prod-Bastion using non-standard SSH and RDP ports. Which action must the administrator perform to support this configuration?

Show answer & explanation

Answer: Upgrade the Azure Bastion SKU from Basic to Standard.

Answer

Upgrade the Azure Bastion SKU from Basic to Standard.
Upgrading the Azure Bastion host to the Standard SKU is required to enable support for custom ports. The Basic SKU only allows connectivity to target VMs using standard ports (22 for SSH and 3389 for RDP), whereas the Standard SKU supports custom port selection.

Step-by-Step Solution

1
Identify the SKU capability requirements for custom ports.
The Basic SKU of Azure Bastion only supports standard connectivity to target VMs (port 22 for SSH and port 3389 for RDP). The Standard SKU is required to configure and connect via custom (non-standard) port numbers.
This establishes that the current Basic SKU is the limiting factor preventing connections via non-standard ports.
2
Determine the upgrade path.
Azure Bastion allows an in-place upgrade from the Basic SKU to the Standard SKU.
This confirms that upgrading the SKU directly is a valid and supported administrative action.
3
Perform the upgrade.
The Azure Bastion host is upgraded to the Standard SKU, enabling the custom ports feature.
Completing this action allows developers to connect using their desired non-standard SSH and RDP port configurations.

Key Concept

Azure Bastion SKU capabilities and feature differences
Question 1214Question →

An administrator is setting up backups for a new deployment in an Azure subscription named sub-logistics-core. The deployment contains the following resources:

* A virtual machine named vm-shipping-east in the East US region
* A virtual machine named vm-inventory-west in the West US region
* An Azure File share named share-shipping-docs hosted in a storage account in the East US region

The administrator needs to configure backups for all three resources while minimizing the number of vaults.

Which two of the following actions should the administrator perform? (Select two)

Select all that apply

Show answer & explanation

Answer: Create a Recovery Services Vault in the East US region.; Create a Recovery Services Vault in the West US region.

Answer

Create a Recovery Services Vault in the East US region, and create a Recovery Services Vault in the West US region.
To back up the resources while complying with regional constraints, you must create one Recovery Services Vault in the East US region (to protect the East US virtual machine and the East US File share) and one Recovery Services Vault in the West US region (to protect the West US virtual machine). Azure Virtual Machines can only be backed up to a vault in the same region.

Step-by-Step Solution

1
Identify the regional requirements for backing up Azure Virtual Machines.
Azure Virtual Machines must be backed up to a Recovery Services Vault located in the same region as the VM.
This is a key regional design requirement for Azure Backup.
2
Identify the regional requirements for backing up Azure File shares.
Azure File shares must be backed up to a Recovery Services Vault located in the same region as the storage account hosting the file share.
Azure File shares must align regionally with the vault protecting them.
3
Determine the required vaults based on the resources' regions.
A Recovery Services Vault is needed in East US for the East US VM and File share, and another Recovery Services Vault is needed in West US for the West US VM.
This setup respects the regional constraints while using the minimum number of vaults.

Key Concept

Azure Backup requires virtual machines and the Recovery Services Vaults protecting them to reside in the same geographical region. Similarly, Azure File shares must be backed up to a Recovery Services Vault in the same region as their parent storage account.
Question 1215Question →

An administrator manages an Azure subscription named `sub-retail-prod` that contains the resources shown in the following table:

Resource NameTypeRegion
`rsv-emea-01`Recovery Services VaultWest Europe
`bv-emea-01`Backup VaultWest Europe
`vm-app-01`Virtual MachineNorth Europe
`vm-web-02`Virtual MachineWest Europe
`disk-db-01`Managed Disk (attached to `vm-web-02`)West Europe
`stemea01`Storage AccountWest Europe

The administrator needs to configure backup for these resources.

Which configuration can be successfully implemented?

Show answer & explanation

Answer: Back up `disk-db-01` to `bv-emea-01`.

Answer

Back up `disk-db-01` to `bv-emea-01`.
Backing up the managed disk to the Backup Vault is supported because Azure Managed Disks must be backed up to a Backup Vault rather than a Recovery Services Vault, and both the disk and the vault reside in the same region (West Europe).

Step-by-Step Solution

1
Identify the backup target and vault types required for each resource.
Virtual machines and Azure Files require Recovery Services Vaults. Azure Managed Disks and Blob containers require Backup Vaults.
Azure Backup segregates workloads between Recovery Services Vaults and Backup Vaults depending on the resource type.
2
Verify regional constraints for Recovery Services Vault and Backup Vault configurations.
The resource to be backed up and the corresponding vault must reside in the same Azure region.
Cross-region backup association is not supported for these resource types.
3
Evaluate the proposed options based on vault type, region alignment, and permission requirements.
Only backing up the managed disk in West Europe to the Backup Vault in West Europe satisfies all constraints.
This matches both the correct vault type (Backup Vault for Disks) and regional alignment (West Europe).

Key Concept

Recovery Services Vault vs. Backup Vault capability and regional alignment constraints
Question 1216Question →

An administrator is configuring backups for resources in an Azure subscription named `sub-prod-finance`. The subscription contains the resources shown in the following table:

Resource nameResource typeRegion
`rsv-finance-east`Recovery Services vaultEast US
`bv-finance-east`Backup vaultEast US
`vm-web-east`Virtual machineEast US
`vm-db-west`Virtual machineWest US
`safinanceeast`Storage accountEast US
`disk-web-east`Managed diskEast US

Which two configurations can the administrator implement? Select two.

Select all that apply

Show answer & explanation

Answer: Back up `vm-web-east` to `rsv-finance-east`; Back up `disk-web-east` to `bv-finance-east`

Answer

Back up `vm-web-east` to `rsv-finance-east` and back up `disk-web-east` to `bv-finance-east`
The correct configurations are backing up `vm-web-east` to `rsv-finance-east` and backing up `disk-web-east` to `bv-finance-east`. Virtual machine backups require a Recovery Services vault in the same region as the virtual machine. Since both `vm-web-east` and `rsv-finance-east` are in East US, this configuration is valid. Azure Disk backup is supported by Backup vaults (not Recovery Services vaults), and both `disk-web-east` and `bv-finance-east` are in East US, which is valid.

Step-by-Step Solution

1
Analyze regional requirements for virtual machine backup
The virtual machine `vm-web-east` and Recovery Services vault `rsv-finance-east` are both in East US, making this a valid configuration. The virtual machine `vm-db-west` is in West US, which violates the regional alignment rule for Recovery Services vaults.
Azure VM backups require the VM and the Recovery Services vault to be in the same region.
2
Determine the correct vault type and regional support for Azure Disk backup
Managed disks must be backed up to a Backup vault. Since `disk-web-east` and `bv-finance-east` are both in East US, backing up the disk to the Backup vault is a valid configuration.
Azure Disk backup is supported by Backup vaults (not Recovery Services vaults) and requires regional alignment.
3
Evaluate role requirements for Azure Blob backup using Backup vault
Assigning the Reader role is insufficient as it does not grant the necessary data plane permissions required by the Backup vault's managed identity to write or manage backups in the storage account.
Blob backup requires data-plane authorization (specifically the Storage Account Backup Contributor role), whereas Reader is a control-plane only role.

Key Concept

Recovery Services vaults and Backup vaults support different resource types and have strict regional and role-based access control constraints.
Question 1217Question →

Your company has an Azure subscription named `sub-global-infra` that contains the resources shown in the following table:

Resource NameResource TypeRegion
vm-linux-prodVirtual MachineFrance Central
disk-linux-osManaged DiskFrance Central
rsv-franceRecovery Services VaultFrance Central
bv-franceBackup VaultFrance Central
bv-germanyBackup VaultGermany West Central

You need to configure Azure Backup for `vm-linux-prod` and `disk-linux-os` using the available vaults.

Which configuration should you use?

Show answer & explanation

Answer: Back up vm-linux-prod to rsv-france, and back up disk-linux-os to bv-france.

Answer

Back up vm-linux-prod to rsv-france, and back up disk-linux-os to bv-france.
The correct configuration is to back up vm-linux-prod to rsv-france, and back up disk-linux-os to bv-france. This is because Azure VMs must be backed up to a Recovery Services Vault in the same region, and Azure Managed Disks must be backed up to a Backup Vault in the same region.

Step-by-Step Solution

1
Determine the vault type and regional requirements for backing up the Azure Virtual Machine (vm-linux-prod).
Azure Virtual Machines require a Recovery Services Vault located in the same region (France Central). Therefore, vm-linux-prod must be backed up to rsv-france.
Azure VMs are supported by Recovery Services Vaults, and cross-region backup configuration for VMs is not supported.
2
Determine the vault type and regional requirements for backing up the Azure Managed Disk (disk-linux-os).
Azure Managed Disks require a Backup Vault located in the same region (France Central). Therefore, disk-linux-os must be backed up to bv-france.
Azure Disk Backup is supported by Backup Vaults, not Recovery Services Vaults, and requires the vault to be in the same region as the source disk.

Key Concept

Azure Backup supports different vault types and regional alignment depending on the resource type: Recovery Services Vaults for Azure VMs, and Backup Vaults for Azure Managed Disks, both requiring regional alignment.
Question 1218Question →

An administrator is configuring a backup solution for an Azure virtual machine named vm-hr-prod. The virtual machine has the following configuration:
- OS: Windows Server 2022
- Region: East US 2
- Disks: Two Premium SSD managed disks

The administrator must ensure that the backup data is replicated to a secondary region for disaster recovery and that all backup operations succeed without network access issues to staging resources.

Which of the following configurations should the administrator implement?

Show answer & explanation

Answer: Create a Recovery Services vault in the East US 2 region, configure the vault's storage replication to Geo-redundant storage (GRS), and enable backup for the virtual machine.

Answer

Create a Recovery Services vault in the East US 2 region, configure the vault's storage replication to Geo-redundant storage (GRS), and enable backup for the virtual machine.
To back up an Azure virtual machine, the Recovery Services vault must reside in the same Azure region as the virtual machine (East US 2). To replicate backups to a secondary region (West US 2, which is the paired region for East US 2), the storage replication type of the Recovery Services vault must be configured as Geo-redundant storage (GRS).

Step-by-Step Solution

1
Determine the correct region for the Recovery Services vault.
The Recovery Services vault must be deployed in the same region as the virtual machine (East US 2).
Azure Backup does not support backing up virtual machines to a Recovery Services vault located in a different region.
2
Configure the storage replication settings for the Recovery Services vault.
Set the vault storage replication type to Geo-redundant storage (GRS) before configuring backups.
GRS ensures that backup data is replicated to the secondary paired region (West US 2) for disaster recovery.
3
Enable backup for the virtual machine within the vault.
The virtual machine is associated with a backup policy inside the vault, initiating the backup process.
This establishes the relationship and starts the protection schedule.

Key Concept

Azure Virtual Machine Backup Configuration and Regional Constraints
Question 1219Question →

An administrator is configuring Azure Backup for a new virtual machine named vm-shipping-prod in the West Europe region. The virtual machine has standard network configurations and uses managed disks.

Which of the following configuration requirements must be met to ensure the backup job completes successfully? (Select two.)

Select all that apply

Show answer & explanation

Answer: The Recovery Services Vault must be located in the West Europe region.; The network security group (NSG) associated with the virtual machine must allow outbound traffic to the AzureBackup service tag.

Answer

The Recovery Services Vault must be located in the West Europe region, and the network security group (NSG) associated with the virtual machine must allow outbound traffic to the AzureBackup service tag.
To successfully back up vm-shipping-prod, the Recovery Services Vault must be deployed in the same region (West Europe). Furthermore, the VM requires outbound network access to the Azure Backup service, which is commonly allowed by configuring NSG rules targeting the AzureBackup service tag.

Step-by-Step Solution

1
Determine the required region for the Recovery Services Vault.
The vault must be created in West Europe, matching the region of the virtual machine vm-shipping-prod.
Azure Backup enforces a region boundary; a Recovery Services Vault cannot protect virtual machines situated in a different Azure region.
2
Evaluate network connectivity requirements for virtual machine backup agents and extensions.
Ensure outbound connectivity is allowed to the AzureBackup service tag via NSG rules.
The backup agent running inside the VM must communicate with the Azure Backup service to coordinate snapshot capture and data transfer.

Key Concept

Successful Azure VM backup configuration requires locating the Recovery Services Vault in the same region as the target virtual machine and ensuring the VM possesses outbound network connectivity to the Azure Backup service endpoints.
Question 1220Question →

An enterprise plans to configure Azure Backup for a newly deployed virtual machine named `vm-hr-core` in the North Europe region. The administrator wants to use an existing Recovery Services Vault named `rsv-hr-backup` that is located in the West Europe region. However, when trying to configure the backup, the vault is not available to select. Which of the following explains why the vault cannot be selected, and what is the correct solution?

Show answer & explanation

Answer: The Recovery Services Vault and the virtual machine must reside in the same Azure region. You must create a new Recovery Services Vault in the North Europe region.

Answer

The Recovery Services Vault and the virtual machine must reside in the same Azure region. You must create a new Recovery Services Vault in the North Europe region.
Azure Backup requires that the Recovery Services Vault and the target virtual machine exist in the same geographical region. Because the virtual machine is in North Europe and the vault is in West Europe, the vault cannot be selected. Creating a new Recovery Services Vault in the North Europe region solves the issue.

Step-by-Step Solution

1
Identify the region of the source virtual machine.
The source virtual machine is located in the North Europe region.
Azure resources must be evaluated by their geographic placement.
2
Identify the region of the target Recovery Services Vault.
The Recovery Services Vault is located in the West Europe region.
Verifying the vault location determines if it meets the co-location requirement.
3
Apply Azure Backup location requirements.
Azure Backup requires the vault and virtual machine to be in the same region, meaning a new vault must be created in North Europe.
Ensures the correct architectural pattern is implemented to resolve the configuration issue.

Key Concept

Recovery Services Vault and Virtual Machine region matching requirement
Estimated Time:1m 15s
PreviousPage 61 / 63Next