Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 1221Question →

An administrator needs to configure backup for a newly deployed Azure virtual machine named vm-prod-app01 in the East US region. Which sequence of steps must the administrator perform to configure the backup and ensure the first recovery point is created immediately?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure backup and immediately create the first recovery point, the administrator must first create a Recovery Services vault in the same region as the virtual machine, configure a backup policy, enable backup by linking the virtual machine to the vault and policy, and then run an on-demand backup.
The correct configuration workflow starts with creating a Recovery Services vault in the same region as the target virtual machine. Next, a backup policy must be established to define retention and schedule rules. Once the prerequisites exist, backup is enabled on the virtual machine by linking it to the vault and policy. Finally, to fulfill the requirement of creating the first recovery point immediately, an on-demand backup (Backup now) is triggered.

Step-by-Step Solution

1
Create the Recovery Services vault
A vault is created in the East US region.
Azure Backup requires that the Recovery Services vault and the target virtual machine reside in the same Azure region.
2
Create or configure the backup policy
A backup policy is defined with specific schedule and retention parameters.
A policy defines when backups are captured and how long they are kept, which is a prerequisite for enabling virtual machine protection.
3
Enable backup on the virtual machine
The virtual machine is associated with the vault and policy.
This registers the virtual machine with Azure Backup and assigns the protection policy.
4
Trigger an on-demand backup (Backup now)
The initial backup job begins immediately.
By default, enabling backup schedules future runs but does not execute them immediately. An on-demand backup is required to generate the first recovery point right away.

Key Concept

Setting up virtual machine backup requires establishing a vault in the same region, defining retention and schedule parameters via a backup policy, enabling protection on the target virtual machine, and triggering an on-demand backup for immediate protection.
Question 1222Question →

Your company has an Azure subscription containing a virtual machine named VM-AppProd located in the East US region. You need to implement a backup solution for VM-AppProd. You currently have the following vaults deployed in the subscription:

* RSV-East: A Recovery Services vault in the East US region
* RSV-West: A Recovery Services vault in the West US region
* BV-East: A Backup vault in the East US region

Which of these vaults can be used to configure the backup for VM-AppProd?

Show answer & explanation

Answer: RSV-East only

Answer

Only RSV-East can be used to configure the backup for the virtual machine.
The correct answer is RSV-East only. Azure Virtual Machine backup is supported only in Recovery Services vaults, and the vault must be located in the same region as the virtual machine. Since VM-AppProd is in East US, only a Recovery Services vault in East US (RSV-East) can be used.

Step-by-Step Solution

1
Identify the required vault type for Azure Virtual Machine backup.
Azure Virtual Machine backups are supported only by Recovery Services vaults. Backup vaults are used for other resources like Azure Disks, Blobs, or PostgreSQL databases.
This filters out BV-East from the available options.
2
Determine the regional requirements for the Recovery Services vault.
The Recovery Services vault must be in the same Azure region as the virtual machine being backed up (East US).
This filters out RSV-West because it is located in the West US region.
3
Select the matching vault that satisfies both criteria.
RSV-East is the only Recovery Services vault located in the East US region.
This determines the final correct option.

Key Concept

Azure Virtual Machine backup requires a Recovery Services vault in the same region as the target virtual machine.
Estimated Time:1m 0s
Question 1223Question →

You have an Azure subscription. You deploy a virtual machine named vm-retail-prod in the UK South region. The virtual machine runs Windows Server 2022.

A network security group (NSG) named nsg-retail is associated with the subnet hosting vm-retail-prod. Currently, nsg-retail contains a custom outbound rule that blocks all outbound traffic to the internet.

You plan to configure Azure Backup for vm-retail-prod.

Which two actions should you perform to enable the backup configuration? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a Recovery Services Vault in the UK South region.; Configure an outbound security rule in nsg-retail that allows traffic to the AzureBackup service tag.

Answer

To configure backup for the virtual machine, you must create a Recovery Services Vault in the UK South region and configure an outbound security rule in the network security group (NSG) that allows traffic to the AzureBackup service tag.
The Recovery Services Vault must be created in the same region as the virtual machine (UK South). Additionally, the virtual machine extension needs outbound connectivity to Azure Backup endpoints, which can be permitted by creating an outbound rule in the network security group (NSG) targeting the AzureBackup service tag.

Step-by-Step Solution

1
Identify the regional requirement for the vault.
The Recovery Services Vault must be deployed in the same region as the target virtual machine, which is UK South.
Azure Backup does not support backing up virtual machines to a Recovery Services Vault located in a different region.
2
Analyze network security group (NSG) requirements for VM backup.
The virtual machine must have outbound connectivity to the Azure Backup service.
The backup extension running inside the virtual machine communicates with Azure Backup service endpoints. If outbound traffic is blocked, backups will fail.
3
Determine the correct NSG rule configuration.
Add an outbound rule allowing traffic to the AzureBackup service tag.
Service tags simplify NSG configuration by representing groups of IP addresses. The AzureBackup tag covers all public IP addresses utilized by the backup service. Inbound rules are not required as the connection is outbound initiated.

Key Concept

Azure Virtual Machine Backup prerequisites require a Recovery Services Vault in the same region as the virtual machine, along with outbound network connectivity to the Azure Backup service.
Question 1224Question →

A company runs a production workload on a virtual machine named vm-db-prod in the Central US region. You are tasked with configuring a backup solution for vm-db-prod using Azure Backup. The backup solution must satisfy the following requirements:
- Create backups multiple times per day to minimize potential data loss.
- Enable the ability to restore the virtual machine in the East US secondary paired region in the event of a regional disaster.
Which configuration should you implement to meet these requirements?

Show answer & explanation

Answer: Create a Recovery Services Vault in the Central US region configured with Geo-redundant storage (GRS) and Cross Region Restore enabled, and associate it with an Enhanced backup policy

Answer

Create a Recovery Services Vault in the Central US region configured with Geo-redundant storage (GRS) and Cross Region Restore enabled, and associate it with an Enhanced backup policy.
The correct configuration requires the Recovery Services Vault to be in the same region as the virtual machine (Central US). To perform backups multiple times per day, an Enhanced backup policy must be used since Standard backup policies only support a single daily backup. To allow the virtual machine to be restored in the secondary paired region (East US), the vault's storage redundancy must be configured as Geo-redundant storage (GRS) and Cross Region Restore must be explicitly enabled.

Step-by-Step Solution

1
Determine the required vault region
The Recovery Services Vault must be created in the Central US region.
Azure Backup requires that the Recovery Services Vault resides in the same geographical region as the source virtual machine being backed up.
2
Select the appropriate backup policy type
Select the Enhanced backup policy type.
The Standard backup policy type only supports one backup per day. The Enhanced backup policy type must be used to schedule multiple backups per day (such as hourly backups).
3
Configure vault storage redundancy and restore options
Configure the vault with Geo-redundant storage (GRS) and enable Cross Region Restore (CRR).
Cross Region Restore allows restoration of backups in the secondary paired region (East US). Enabling Cross Region Restore requires that the vault storage redundancy is set to Geo-redundant storage (GRS) before backups are configured.

Key Concept

Azure Virtual Machine Backup configuration requirements, specifically regional alignment, standard vs. enhanced policies for backup frequency, and storage redundancy settings required for Cross Region Restore.
Estimated Time:1m 30s
Question 1225Question →

You need to configure backup for an Azure virtual machine named vm-finance-prod that is located in the West US region. You must ensure that an initial backup recovery point is created immediately. Which sequence of actions should you perform? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with creating a Recovery Services vault in the West US region, followed by selecting the Virtual machine workload in the vault's Backup settings. Next, choose or define the backup policy, select the target virtual machine vm-finance-prod to enable backup, and finally trigger a Backup now operation from the backup items menu to create the initial recovery point immediately.
The correct sequence aligns with the prerequisite structure of Azure Backup: first, a vault must be deployed in the same region as the virtual machine. Second, backup goals must be configured in the vault to specify the workload. Third, the policy must be defined. Fourth, the policy is associated with the virtual machine to enable protection. Finally, because the initial backup does not run automatically upon enablement, an on-demand backup must be explicitly triggered using the 'Backup now' option.

Step-by-Step Solution

1
Create a Recovery Services vault in the same region as the virtual machine.
A vault is created in West US, which is a prerequisite because a Recovery Services vault can only back up VMs in the same region.
Azure VMs can only be backed up to a Recovery Services vault that resides in the same Azure region.
2
Configure the backup goal in the vault.
The vault prepares configuration steps for backing up an Azure Virtual Machine.
This tells Azure Backup which resource type is being protected to present the correct configuration options.
3
Select or create a backup policy.
A schedule and retention policy are linked to the backup scope.
A policy defines when backups are captured and how long they are kept.
4
Select the target virtual machine and enable backup.
The backup extension is installed on the VM, and it is registered with the vault.
This registers the VM and applies the selected backup policy to it.
5
Trigger a Backup now operation on the backup item.
An on-demand backup job starts, creating the initial recovery point.
Standard scheduled backups do not run immediately; an on-demand backup is required to create a recovery point right away.

Key Concept

Azure Virtual Machine backup configuration workflow requires creating a vault in the same region, defining a policy, registering/enabling backup for the VM, and optionally triggering an on-demand backup if immediate protection is needed.
Estimated Time:2m 0s
Question 1226Question →

An administrator plans to configure Azure Backup for an Azure virtual machine named vm-shipping-prod. The virtual machine has the following configuration:

* Operating System: Red Hat Enterprise Linux 8.6
* Location: West US 2 region
* Disks: Multiple managed disks encrypted at rest using Server-Side Encryption (SSE) with Customer-Managed Keys (CMK)
* Key Vault: kv-shipping-keys (located in the West US 2 region, holds the customer-managed keys)

You need to set up a Recovery Services Vault named rsv-shipping-backup and enable backup for vm-shipping-prod.

Which of the following actions must you perform to successfully configure and run the backup? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Create the Recovery Services Vault in the West US 2 region; Enable a system-assigned managed identity for the Recovery Services Vault and grant it permissions to the Key Vault

Answer

To successfully configure the backup, you must create the Recovery Services Vault in the West US 2 region and enable a system-assigned managed identity for the Recovery Services Vault, granting it permissions to the Key Vault.
For successful VM backup configuration, the Recovery Services Vault must be in the same region (West US 2) as the VM. Additionally, because the VM utilizes Server-Side Encryption with Customer-Managed Keys, the Recovery Services Vault's system-assigned managed identity must be enabled and granted permissions to the Key Vault containing those keys so that the backup service can read the keys during operations.

Step-by-Step Solution

1
Determine the required region for the Recovery Services Vault.
The Recovery Services Vault must be created in the West US 2 region.
Azure Virtual Machine backups require the vault and the target virtual machine to reside in the exact same Azure region.
2
Determine the encryption mechanism used by the virtual machine.
The disks use Server-Side Encryption (SSE) with Customer-Managed Keys (CMK).
SSE with CMK has different identity and permission requirements compared to Azure Disk Encryption (ADE).
3
Configure vault identity and access permissions for SSE with CMK.
Enable a system-assigned managed identity on the Recovery Services Vault and assign it permissions to access the Key Vault.
Azure Backup uses the Recovery Services Vault's managed identity to access the Customer-Managed Keys in the Key Vault for SSE-encrypted disks.

Key Concept

Azure Virtual Machine backup configuration prerequisites, regional constraints, and encryption configuration requirements.
Question 1227Question →

You configure a backup solution for an Azure virtual machine named vm-hr-prod with the following parameters:
- Operating system: Windows Server 2022
- Region: East US
- Disk type: Premium SSD
- Encryption: Azure Disk Encryption (ADE) with keys stored in a key vault named kv-hr-prod in the East US region

The key vault kv-hr-prod has its firewall configured to restrict access to 'Selected networks' only.

You deploy a Recovery Services vault named rsv-hr-prod in the East US region. When you attempt to enable backup for vm-hr-prod, the initial validation fails due to key vault access restrictions.

You need to ensure that vm-hr-prod can be successfully backed up while maintaining the key vault's firewall restrictions.

What should you do?

Show answer & explanation

Answer: Configure the network security settings of the key vault kv-hr-prod to allow trusted Microsoft services to bypass the firewall.

Answer

Configure the network security settings of the key vault to allow trusted Microsoft services to bypass the firewall.
When backing up an Azure virtual machine encrypted with Azure Disk Encryption (ADE), the Recovery Services vault must be able to access the encryption keys stored in the key vault. If the key vault has a firewall enabled that restricts access to selected networks, the Azure Backup service will be blocked from accessing the keys. Allowing trusted Microsoft services to bypass the key vault's firewall resolves this blocker, enabling the Recovery Services vault to retrieve the keys and complete the backup.

Step-by-Step Solution

1
Verify that the Recovery Services vault and the virtual machine reside in the same region.
Both the vault and the virtual machine are in the East US region, which is the required configuration.
Azure VM Backup requires the vault and the target VM to be in the same geographic region.
2
Identify the blocker preventing the backup of the Azure Disk Encryption (ADE) encrypted virtual machine.
The key vault storing the encryption keys has a firewall enabled, preventing the Azure Backup service from reading the keys.
To backup ADE-encrypted VMs, the Recovery Services vault must retrieve keys from the key vault.
3
Enable the trusted Microsoft services bypass on the key vault firewall settings.
The Recovery Services vault can bypass the firewall and retrieve the keys needed to perform the backup.
Enabling this bypass allows Azure Backup to access the key vault securely without disabling the firewall.

Key Concept

Configuring backups for Azure Disk Encryption (ADE) virtual machines with key vault firewalls.
Question 1228Question →

An administrator needs to configure Azure backup for a new Azure virtual machine named VM1 by using the Azure Portal. The solution must ensure that VM1 is backed up daily and that an initial backup is executed immediately.

Which four actions should the administrator perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Create a Recovery Services vault in the same region as VM1, define a backup policy in the Recovery Services vault that specifies a daily backup schedule, associate VM1 with the backup policy and enable backup, and then go to Backup Items, select VM1, and select Backup now.
The correct sequence starts with creating a Recovery Services vault in the same region as the target virtual machine because cross-region backups are not supported for standard Azure VMs. Once the vault is ready, a backup policy defining the backup frequency (daily) and retention range must be defined within the vault. The virtual machine (VM1) is then associated with this policy to enable protection. Finally, because the requirement specifies running the initial backup immediately, the administrator must navigate to the backup items and trigger an on-demand backup using 'Backup now'.

Step-by-Step Solution

1
Create a Recovery Services vault.
A vault is established in the same region as VM1 to store backup data.
Azure VMs can only be backed up to a Recovery Services vault located in the same geographic region as the VM.
2
Define a backup policy.
A policy containing backup frequency and retention periods is created in the vault.
A backup policy is required to configure when backups occur and how long they are kept.
3
Enable backup for VM1.
VM1 is protected under the defined policy.
This registers the VM with the vault and sets up scheduled backups.
4
Trigger Backup now.
The initial backup job starts immediately.
Enabling backup only schedules future backups. To get an immediate backup, an on-demand backup must be manually triggered.

Key Concept

Azure Virtual Machine Backup configuration workflow using Recovery Services Vault and Backup Policies.
Question 1229Question →

You have an Azure virtual machine named vm-db-prod with the following configuration:
- Operating System: Red Hat Enterprise Linux 9.2
- Region: West US 3
- Disk Configuration: One 128 GB OS disk (Premium SSD) and two 1 TB data disks (Premium SSD v2)
- Recovery Services Vault: rsv-db-prod (located in West US 3)

You need to configure backup for vm-db-prod to ensure that all disks are backed up successfully.

Which action should you perform?

Show answer & explanation

Answer: Create an Enhanced backup policy in the Recovery Services Vault and associate it with the virtual machine.

Answer

Create an Enhanced backup policy in the Recovery Services Vault and associate it with the virtual machine.
The correct action is to create an Enhanced backup policy in the Recovery Services Vault and associate it with the virtual machine. Azure Backup supports backing up VMs with Premium SSD v2 or Ultra Disks only when using an Enhanced backup policy. The vault rsv-db-prod is in West US 3, which matches the virtual machine's region, enabling a valid backup configuration.

Step-by-Step Solution

1
Identify the disk types used by the virtual machine.
The VM uses one Premium SSD disk and two Premium SSD v2 disks.
Different disk tiers have different backup policy tier requirements in Azure Backup.
2
Determine the backup policy type needed for Premium SSD v2 disks.
Premium SSD v2 disks require the Enhanced backup policy type; they are not supported by the Standard backup policy.
To back up all disks successfully, the policy must support the Premium SSD v2 tier.
3
Select the correct Recovery Services Vault.
The vault must be in the same region as the VM (West US 3). Use rsv-db-prod.
Azure Backup does not support backing up VMs to a Recovery Services Vault located in a different region.

Key Concept

Azure Backup Enhanced policies support advanced features such as Premium SSD v2, Ultra Disks, multiple backups per day, and zone-redundant storage.
Estimated Time:1m 30s
Question 1230Question →

An administrator is configuring backups for a new virtual machine named vm-finance-prod that runs Windows Server 2025 and is located in the East US region. The virtual machine has Azure Disk Encryption (ADE) enabled, and its encryption secrets are stored in an Azure Key Vault named kv-finance-keys in the East US region. The Key Vault's firewalls and virtual networks are configured to restrict access to selected networks only.

Which two actions are required to configure backups for vm-finance-prod successfully? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a Recovery Services Vault in the East US region.; Configure the firewall of the Key Vault kv-finance-keys to allow trusted Microsoft services.

Answer

To successfully back up the virtual machine, you must create a Recovery Services Vault in the East US region and configure the Key Vault firewall to allow trusted Microsoft services to bypass the network restrictions.
To back up an Azure Virtual Machine, the backup must be configured in a Recovery Services Vault that matches the region of the source virtual machine (East US). In addition, for virtual machines using Azure Disk Encryption (ADE), the backup service must be able to reach the Key Vault containing the secrets. When the Key Vault has firewalls enabled, enabling the option to allow trusted Microsoft services to bypass the firewall is the supported configuration that permits the backup service to safely retrieve the encryption keys.

Step-by-Step Solution

1
Identify the geographical region of the target virtual machine.
The virtual machine is located in the East US region.
Azure Virtual Machine backups require the backup vault to be in the same region as the virtual machine.
2
Determine the required vault type for backing up an Azure Virtual Machine.
A Recovery Services Vault must be selected instead of a Backup Vault.
Recovery Services Vaults support virtual machine backup workloads, whereas Backup Vaults support other resources like Azure Disks and Blobs.
3
Configure the Key Vault firewall to allow Azure Backup access.
Enable the 'Allow trusted Microsoft services to bypass this firewall' option.
Since the virtual machine is encrypted using Azure Disk Encryption (ADE), Azure Backup must retrieve the keys and secrets from the Key Vault. If the Key Vault firewall restricts access, this bypass is required to grant the backup service access.

Key Concept

Azure Virtual Machine Backup Configuration with Azure Disk Encryption and Region Matching
Question 1231Question →

An enterprise administrator is setting up the initial backup configuration for an Azure virtual machine with the following specifications:
- Name: vm-finance-prod
- Operating System: Red Hat Enterprise Linux 8.8
- Azure Region: East US
- Disk Type: Premium SSD (LRS)
- Recovery Services Vault: rsv-finance-prod (located in East US)

The disks of vm-finance-prod are encrypted using Azure Disk Encryption (ADE) with customer-managed keys (CMK) stored in an Azure Key Vault named kv-finance-prod (located in East US). The firewall of kv-finance-prod is enabled and configured to allow access from selected networks only.

During the initial backup configuration, the administrator notices that the backup jobs fail with an error indicating that Azure Backup cannot access the key vault.

Which configuration change should the administrator implement to resolve this issue?

Show answer & explanation

Answer: Modify the network security settings of the key vault to enable the bypass option for trusted Microsoft services.

Answer

Modify the network security settings of the key vault to enable the bypass option for trusted Microsoft services.
When a virtual machine is encrypted using Azure Disk Encryption (ADE), Azure Backup must access the associated Azure Key Vault to retrieve the encryption keys during backup and restore operations. If the key vault's firewall is enabled to restrict access, the administrator must configure the key vault's firewall settings to allow trusted Microsoft services, which includes Azure Backup, to bypass the restriction.

Step-by-Step Solution

1
Identify the encryption status of the virtual machine and the storage of its encryption keys.
The VM uses Azure Disk Encryption with keys stored in an Azure Key Vault.
Azure Backup needs access to the Key Vault to back up encrypted VMs.
2
Determine the network access configuration on the Key Vault.
The Key Vault firewall is enabled, restricting network access.
A restricted Key Vault firewall blocks external access, including from the Azure Backup service.
3
Apply the appropriate security bypass configuration on the Key Vault network settings.
The bypass option for trusted Microsoft services is enabled on the Key Vault.
This allows Azure Backup to retrieve the required encryption keys and complete the backup.

Key Concept

Azure Backup configuration for Azure Disk Encryption (ADE) enabled virtual machines requires Key Vault firewall bypass for trusted Microsoft services.
Question 1232Question →

You have an Azure virtual machine named VM1 in the East US region. You need to configure Azure Backup for VM1 to store backups in a Recovery Services vault and immediately perform the initial backup. You plan to automate the setup using Azure PowerShell. Which sequence of Azure PowerShell cmdlets should you execute?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure and run the initial backup using Azure PowerShell, you must first run `New-AzRecoveryServicesVault` to create the vault. Next, run `Set-AzRecoveryServicesVaultContext` to set the vault as the active context for your session. Then, run `Enable-AzRecoveryServicesBackupProtection` to register the virtual machine and assign a backup policy. Finally, execute `Backup-AzRecoveryServicesBackupItem` to run the initial backup immediately.
The correct order establishes the prerequisite storage resource, points the session to the target resource, configures policy protection rules for the virtual machine, and then executes the backup job.

Step-by-Step Solution

1
Create the Recovery Services vault.
A vault resource is provisioned in Azure.
All backup configuration parameters and recovery points reside within a Recovery Services vault.
2
Configure the active vault session context.
The PowerShell session targets the correct vault resource.
Setting the vault context ensures that subsequent management commands execute against this specific vault.
3
Enable backup protection for the virtual machine.
The virtual machine is registered to the vault and associated with a policy.
A virtual machine must be bound to a policy within the vault before any backups can be executed.
4
Trigger the initial backup job.
An on-demand backup job begins running.
Enabling protection schedules backups, but an explicit call to backup is required to generate the first recovery point immediately.

Key Concept

Configuring Azure Virtual Machine backups using Azure PowerShell cmdlets.
Estimated Time:2m 0s
Question 1233Question →

An organization is configuring Microsoft Entra ID to support various corporate and external collaboration requirements. Match each administrative requirement on the left to its corresponding minimum configuration or licensing setting on the right.

Click a left item, then click its matching right item

Items

Restrict guest users from searching the directory and inviting other guests, while permitting member users who do not have directory administrator roles to invite guests.
Allow external users to self-register for a corporate web application, authenticate using their Google accounts, and automatically receive a dynamic group membership.
Ensure that when cloud-only users reset their passwords, they must provide both a mobile app notification and a security question, and this capability must only be enabled for members of a specific department.
Enable users synchronized from on-premises AD to perform SSPR, ensuring their passwords are changed in the on-premises directory and that custom banned passwords are blocked on-premises.

Matches

Show answer & explanation

Answer

Match the requirements as follows: 1) Restrict guest invites to members/admins matches Guest Invite settings set to member users and specific admin roles. 2) Google self-register with dynamic groups matches Google Identity Provider, self-service user flow, and Microsoft Entra ID P1. 3) Scoped SSPR with mobile app/security questions matches SSPR enabled for Selected group, P1 licenses, and the selected auth methods. 4) Hybrid SSPR with custom banned passwords matches on-premises writeback in Entra Connect, Entra Password Protection agents, and P1 licenses.
Matching each scenario correctly requires understanding Microsoft Entra ID features and licensing tiers. Scoped SSPR, Dynamic Groups, Password Writeback, and Microsoft Entra Password Protection all require Microsoft Entra ID P1. Guest invitation restrictions are handled under External Collaboration settings, and external self-service sign-up utilizes User Flows paired with external Identity Providers like Google.

Step-by-Step Solution

1
Analyze the guest invitation requirements.
Identified that guest users should not invite others, but members should be able to. This is configured in the External Collaboration settings of Microsoft Entra ID under Guest Invite Settings.
To restrict guest access while maintaining membership invitation privileges without requiring administrator roles.
2
Analyze the self-service sign-up and dynamic group assignment requirements.
Determined that Google federation and user flows handle external registration, and dynamic groups (which require Microsoft Entra ID P1) automate group membership.
To verify that dynamic group features for guest users require the appropriate tenant licensing tier.
3
Analyze SSPR scoping and authentication requirements for cloud-only departmental users.
Determined that scoping SSPR to 'Selected' groups rather than the entire tenant requires Microsoft Entra ID P1. The authentication methods must include mobile app notification and security questions.
To ensure correct SSPR scoping rules and authentication method selection are implemented under the correct license constraints.
4
Analyze hybrid SSPR and on-premises custom password protection requirements.
Identified that password writeback via Microsoft Entra Connect syncs password changes to on-premises AD, and Microsoft Entra Password Protection agents enforce banned passwords on-premises. Both require Microsoft Entra ID P1.
To validate hybrid SSPR writeback capability and Password Protection integration with Active Directory Domain Services.

Key Concept

Microsoft Entra ID Self-Service Password Reset (SSPR) licensing, scoping, authentication methods, hybrid writeback, and External Collaboration B2B guest invitation and user flow settings.
Question 1234Question →

An administrator manages an Azure tenant with the following resource hierarchy:
* Management Group: `MG-Corp`
* Subscription: `Sub-Dev`
* Resource Group: `RG-App`

A user named User1 needs to view all resources within `RG-App`.

Which two role assignments will allow User1 to view the resources? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Reader role to User1 at the `RG-App` scope.; Assign the Reader role to User1 at the `Sub-Dev` scope.

Answer

Assigning the Reader role to User1 at the resource group scope, or assigning the Reader role to User1 at the subscription scope.
Assigning the Reader role at either the resource group scope (direct assignment) or the subscription scope (inherited assignment) successfully grants read access to all resources within the resource group. Azure RBAC assignments inherit down the resource hierarchy: from subscription to resource group to child resources.

Step-by-Step Solution

1
Evaluate the required permission and target scope.
The user needs to view all resources in the resource group `RG-App`.
This establishes the target resource and required access level (read access).
2
Analyze direct and inherited RBAC assignments.
An assignment at the resource group level (`RG-App`) grants access directly. An assignment at the subscription level (`Sub-Dev`) inherits down to the resource group.
Azure RBAC inheritance flows from management groups to subscriptions, then to resource groups, and finally to resources.
3
Examine Entra ID roles and Administrative Units.
Entra ID roles (like Global Reader) and Administrative Units are directory-level features and do not govern subscription resource access.
Ensures directory management features are not confused with Azure resource management plane (RBAC) controls.

Key Concept

Azure RBAC role assignments can be applied at different scopes, and child resources inherit role assignments from parent scopes (Management Groups, Subscriptions, and Resource Groups).
Question 1235Question →

An administrator is planning the deployment of a new application architecture in the East US 2 region to support a critical business service. The deployment consists of three web servers named `VM-Web1`, `VM-Web2`, and `VM-Web3`, and two database servers named `VM-DB1` and `VM-DB2`.

The deployment must meet the following configuration requirements:
- The web servers must be resilient to localized datacenter-wide failures and must achieve a virtual machine uptime SLA of at least 99.99%99.99\%.
- The database servers must be colocated in the same physical datacenter to minimize network latency, while still protecting against hardware rack failures within that datacenter.
- The database servers must maintain a virtual machine connectivity SLA of at least 99.95%99.95\%.

Which high availability and placement configuration should the administrator implement?

Show answer & explanation

Answer: Deploy the web servers across three distinct Availability Zones. Deploy the database servers in a single Availability Set assigned to a specific Availability Zone, and associate the database servers with a Proximity Placement Group.

Answer

Deploy the web servers across three distinct Availability Zones, deploy the database servers in a single Availability Set assigned to a specific Availability Zone, and associate the database servers with a Proximity Placement Group.
Deploying the web servers across three distinct Availability Zones satisfies the 99.99%99.99\% SLA and provides resilience against localized datacenter-wide failures. Deploying the database servers in a single Availability Set assigned to a specific Availability Zone and associating them with a Proximity Placement Group satisfies the 99.95%99.95\% SLA, protects them against hardware rack failures, and ensures physical colocation to minimize latency.

Step-by-Step Solution

1
Analyze the high availability and SLA requirements for the web tier.
The web tier requires protection against localized datacenter-wide failures and an SLA of at least 99.99%99.99\%.
Only Availability Zones (deploying VMs across different physical datacenters in a region) can protect against datacenter-wide outages and provide a 99.99%99.99\% SLA. Availability Sets only guarantee 99.95%99.95\% and are limited to a single datacenter.
2
Analyze the latency and colocation requirements for the database tier.
The database tier requires low network latency (colocation) and protection against rack-level failure within the same facility, with an SLA of at least 99.95%99.95\%.
To minimize latency, the database VMs must be in the same datacenter/zone and grouped in a Proximity Placement Group. To protect against hardware rack failures within that zone and achieve a 99.95%99.95\% SLA, they must be placed in an Availability Set.
3
Synthesize the two requirements into a valid Azure configuration.
Web VMs are deployed in three zones (Zone 1, Zone 2, Zone 3). Database VMs are deployed in an Availability Set that is pinned to one of these zones (e.g., Zone 1) and associated with a Proximity Placement Group.
This setup satisfies all SLA, physical placement, and fault-isolation constraints without violating Azure configuration rules (such as the inability to span Availability Sets across multiple Availability Zones).

Key Concept

Azure Virtual Machine High Availability (Availability Sets vs. Availability Zones) and Proximity Placement Groups
Question 1236Question →

An administrator is configuring autoscale rules for an Azure Virtual Machine Scale Set (VMSS) named `vmss-app`. The scale-out rule is triggered when the average CPU usage exceeds 80%80\%. To prevent scale thrashing (frequent, alternating scaling up and down of instances), which of the following autoscale parameters must be configured? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A scale-in rule with a CPU threshold set sufficiently below the scale-out threshold (e.g., at 60%60\% or lower); A cooldown period to specify the amount of time to wait before subsequent scaling actions occur

Answer

To prevent scale thrashing in an Azure Virtual Machine Scale Set, you must configure a scale-in rule with a threshold set sufficiently below the scale-out threshold, and configure a cooldown period.
To prevent VMSS autoscale thrashing, administrators must configure two main parameters: a scale-in rule with a threshold set significantly lower than the scale-out threshold, and a cooldown period. The threshold buffer ensures that removing an instance does not immediately trigger a scale-out event. The cooldown period pauses further scaling evaluations for a specified time to let new instances load and handle traffic.

Step-by-Step Solution

1
Analyze how scale thrashing occurs in autoscale rules.
Thrashing occurs when the scale-in and scale-out thresholds are too close. For instance, if scale-out is at 80%80\% and scale-in is at 75%75\%, removing a VM can immediately push average CPU back above 80%80\%, causing an infinite loop of scaling.
Identifying the mathematical cause of thrashing determines the required parameter adjustments.
2
Verify the role of the scale-in threshold buffer.
Configuring the scale-in threshold significantly lower (e.g., 60%60\%) provides a buffer so that the capacity decrease does not immediately trigger another scale-out.
Ensuring a wide gap between scale-out and scale-in thresholds resolves cyclical capacity issues.
3
Determine the impact of the cooldown period.
The cooldown period enforces a delay (e.g., 5 to 10 minutes) before another autoscale action can occur, letting metrics stabilize as new instances boot up.
Time-based throttling is critical to allow new VMs to start serving traffic before Azure Monitor re-evaluates the rules.

Key Concept

Preventing instance thrashing in Virtual Machine Scale Sets by configuring proper metric thresholds and cooldown durations.
Question 1237Question →

An administrator is configuring network security for an Azure Storage account named dataops2026. The storage account's network access is currently restricted to 'Enabled from selected virtual networks and IP addresses'. The administrator must ensure that only virtual machines inside a subnet named AppSubnet of a virtual network named VNet-Core can access the storage account. In addition, Azure Backup must be able to back up the storage account's blobs. Which of the following configurations are required to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable the Microsoft.Storage service endpoint on AppSubnet.; Select the 'Allow trusted Microsoft services to access this storage account' bypass option on dataops2026.

Answer

To allow access from the subnet and enable backups, you must enable the Microsoft.Storage service endpoint on the application subnet and select the option to allow trusted Microsoft services to access the storage account.
Enabling the Microsoft.Storage service endpoint on the application subnet allows the subnet's virtual machines to communicate securely with the storage account and registers the subnet identity with the storage firewall. Selecting the trusted Microsoft services exception allows Azure Backup to bypass the network-level restrictions and access the storage account.

Step-by-Step Solution

1
Enable the Microsoft.Storage service endpoint on AppSubnet within VNet-Core.
Allows traffic from the subnet to securely reach the storage account using Azure's private backbone network and exposes the subnet identity to the storage firewall.
Restricting access to a specific subnet requires the subnet to have the service endpoint enabled so the storage account firewall can validate the subnet resource ID.
2
Configure the storage account firewall settings to allow traffic from AppSubnet.
Limits network access to only the configured subnet and allowed IPs.
Ensures public network access is restricted to the designated subnet.
3
Enable the 'Allow trusted Microsoft services to access this storage account' bypass setting on dataops2026.
Enables Azure Backup to access the storage account blobs despite the firewall restrictions.
Azure Backup is a trusted Microsoft service and requires this network exception to perform backup tasks when public access is restricted.

Key Concept

Azure Storage network security rules require service endpoints on subnets to restrict access, and trusted service bypasses to allow backup and management services to function.
Question 1238Question →

Your company has an Azure subscription containing a resource group named RG-Hub and a virtual network named VNet-Transit. You need to deploy an Azure Bastion host into VNet-Transit to provide secure access to virtual machines. You must create a new subnet in VNet-Transit to host the Azure Bastion service. Which subnet configuration must you use?

Show answer & explanation

Answer: Name: AzureBastionSubnet; Prefix size: /26 or larger

Answer

Name: AzureBastionSubnet; Prefix size: /26 or larger
The correct subnet configuration for Azure Bastion is to use the exact name 'AzureBastionSubnet' and a subnet prefix of /26 or larger. This ensures that the Azure platform can identify the subnet and that there are sufficient IP addresses for scaling the Bastion host instances.

Step-by-Step Solution

1
Determine the exact subnet name requirement for Azure Bastion.
The subnet must be named exactly 'AzureBastionSubnet'.
Azure uses this specific name to provision and manage the Bastion service resources correctly.
2
Determine the minimum prefix size required for the Bastion subnet.
The minimum subnet prefix size is /26.
Azure Bastion requires a /26 or larger prefix to support the required number of IP addresses for host instances and scaling.

Key Concept

Azure Bastion Subnet Requirements
Question 1239Question →

An organization is designing a new Azure Virtual Network named `vnet-shared` with an address space of 10.150.0.0/2210.150.0.0/22 to support their multi-tier applications and secure administrative access. The virtual network must contain the following:

- A subnet named `Subnet-App` to host exactly 12 virtual machines.
- A subnet to host an Azure Bastion deployment to allow secure management of the virtual machines.
- A subnet to host a VPN gateway for hybrid connectivity.

You need to select the subnet configuration that minimizes wasted IP addresses while meeting all deployment requirements.

Which configuration should you choose?

Show answer & explanation

Answer: AzureBastionSubnet: 10.150.0.0/26, GatewaySubnet: 10.150.0.64/27, and Subnet-App: 10.150.0.96/27

Answer

The subnet configuration with AzureBastionSubnet configured as 10.150.0.0/26, GatewaySubnet configured as 10.150.0.64/27, and Subnet-App configured as 10.150.0.96/27.
The correct configuration uses the required name and meets the minimum /26 prefix size for AzureBastionSubnet. For Subnet-App, a /27 prefix provides 32 IP addresses. After subtracting the 5 IP addresses reserved by Azure (the first four and the last one), it provides 27 usable IP addresses, which is sufficient to host 12 virtual machines. GatewaySubnet is configured with a valid /27 prefix.

Step-by-Step Solution

1
Determine the requirements for the Azure Bastion subnet.
The subnet must be named exactly `AzureBastionSubnet` and have a prefix length of at least `/26` (6464 IP addresses). This eliminates configurations using `/27` or incorrect names like `BastionSubnet`.
Azure Bastion enforces strict naming and sizing validation during deployment.
2
Calculate the size requirement for the application subnet.
To host 1212 virtual machines, the subnet must support at least 12+5=1712 + 5 = 17 IP addresses due to Azure reserving the first four and the last IP address of each subnet. A `/28` subnet only contains 1616 total IP addresses (1111 usable), which is insufficient. The smallest valid CIDR block is `/27` (3232 total IP addresses, 2727 usable).
Azure reserves 5 IP addresses per subnet for protocol and routing services.
3
Verify the VPN gateway subnet requirement.
The subnet must be named `GatewaySubnet`. A prefix size of `/27` is supported and valid.
Azure VPN Gateway requires a dedicated subnet named GatewaySubnet, with a recommended size of `/27` or `/28` (minimum `/29`).

Key Concept

Azure Virtual Network subnet sizing constraints, Azure's 5 reserved IP addresses per subnet, and dedicated subnet requirements for Azure Bastion and GatewaySubnet.
Question 1240Question →

An administrator is deploying a new virtual machine named WebVM1 to host a stateless web application. The deployment must meet the following requirements:
- Use an Ephemeral OS disk with a size of 128128 GB.
- Allow WebVM1 to read files from a container in an Azure storage account named storage1.
Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Select a virtual machine size that provides a local cache or temporary storage size of at least 128128 GB.; Assign the Storage Blob Data Reader role to the managed identity of WebVM1 at the scope of storage1.

Answer

To support this configuration, you must select a virtual machine size that provides a local cache or temporary storage size of at least 128128 GB, and assign the Storage Blob Data Reader role to the managed identity of WebVM1 at the scope of storage1.
Selecting a virtual machine size with a local cache or temporary storage size of at least 128128 GB ensures there is sufficient local capacity to host the 128128 GB Ephemeral OS disk. Assigning the Storage Blob Data Reader role to the managed identity of WebVM1 at the scope of storage1 provides the necessary data-plane permissions for the VM to read files from the blob containers.

Step-by-Step Solution

1
Analyze the storage requirements for deploying a virtual machine with an Ephemeral OS disk.
Identify that the chosen virtual machine size must have a local cache or temporary disk capacity equal to or greater than the desired OS disk size (128128 GB).
Ephemeral OS disks are created on local virtual machine storage (cache or temporary disk) rather than remote Azure storage.
2
Configure the access control settings to allow the virtual machine to read files from the storage account.
Identify that the Storage Blob Data Reader role must be assigned to the virtual machine's managed identity at the storage account scope.
Reading blobs from a container requires data plane permissions, which are provided by the Storage Blob Data Reader role rather than standard control-plane roles.

Key Concept

Configuring virtual machine storage and access control during creation.
Estimated Time:2m 0s
PreviousPage 62 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin