Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 141Question →

Apex Retail plans to deploy two new virtual machines named VM-App1 and VM-App2 in the Germany West Central region. The deployment must protect the application from datacenter-wide outages by utilizing Availability Zones. Which of the following actions should you perform to meet this requirement? Select two.

Select all that apply

Show answer & explanation

Answer: Specify different Availability Zones for each virtual machine during their initial creation.; Deploy the virtual machines using Standard SKU public IP addresses.

Answer

Specify different Availability Zones for each virtual machine during their initial creation, and deploy the virtual machines using Standard SKU public IP addresses.
To ensure protection against datacenter-wide outages, virtual machines must be placed in different Availability Zones at the time of their creation. Additionally, only Standard SKU network resources (such as public IP addresses and load balancers) are compatible with Availability Zones, meaning Basic SKU options cannot be used.

Step-by-Step Solution

1
Identify the high availability requirement.
Protection against datacenter-wide outages is required, which necessitates the use of Availability Zones rather than Availability Sets.
Availability Zones distribute VMs across physically separate datacenters within an Azure region, whereas Availability Sets only distribute them within a single datacenter.
2
Determine the VM creation constraint.
VMs must be assigned to different zones (e.g., Zone 1 and Zone 2) during their initial deployment.
Azure does not support moving an existing VM into an Availability Zone after it has been created.
3
Determine the IP address SKU requirement.
Select Standard SKU public IP addresses for the virtual machines.
Only Standard SKU networking resources support zone redundancy and zone alignment; Basic SKU resources do not support Availability Zones.

Key Concept

Configuring Virtual Machines for High Availability using Availability Zones
Question 142Question →

An organization's Microsoft Entra ID tenant contains an administrative unit named Branch-AU. A user named Admin1 is assigned the Groups Administrator role, with the scope of the assignment restricted to Branch-AU. Within Branch-AU, there is a security group named Branch-Support that currently has a membership type of Assigned. Admin1 attempts to convert Branch-Support to a dynamic group and configure a dynamic membership rule based on user attributes. However, Admin1 is unable to change the group's membership type. You need to identify the cause of this issue. What is the cause of the issue?

Show answer & explanation

Answer: Admin1's Groups Administrator role is scoped to the administrative unit, which does not permit the creation or management of dynamic groups.

Answer

Admin1's Groups Administrator role is scoped to the administrative unit, which does not permit the creation or management of dynamic groups.
The correct answer is correct because Microsoft Entra ID restricts the management of dynamic groups to tenant-level administrative roles. Since Admin1's Groups Administrator role is scoped to the Branch-AU administrative unit, Admin1 cannot modify the membership type or edit rules for dynamic groups. A tenant-level role assignment is required because dynamic group queries can evaluate user attributes across the entire tenant, which exceeds the boundaries of an administrative unit.

Step-by-Step Solution

1
Identify the administrator's role and delegation scope in Microsoft Entra ID.
Admin1 is assigned the Groups Administrator role scoped specifically to the Branch-AU administrative unit.
Determining the role and scope helps evaluate the permissions and limits of the administrative assignment.
2
Analyze the requirements for managing dynamic groups and changing membership types.
Converting a group to dynamic or editing dynamic membership rules requires tenant-level administrator privileges.
Dynamic groups evaluate user or device attributes across the entire tenant, making it a directory-wide operation rather than one restricted to a specific scope.
3
Evaluate the administrative unit (AU) scoped role limitations.
Roles scoped to an administrative unit do not permit the management or creation of dynamic groups.
This restriction explains why Admin1 cannot perform the group conversion action.

Key Concept

Microsoft Entra ID administrative unit role scope limitations and dynamic group management requirements
Question 143Question →

You plan to configure a budget named `Budget1` for an Azure subscription. You want to ensure that when actual spending reaches 90%90\% of the budget, email notifications are sent to the billing team. Which of the following settings must you configure when defining the budget alert? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An alert threshold percentage or absolute amount; Email recipients or an Azure Monitor action group

Answer

An alert threshold percentage or absolute amount, and Email recipients or an Azure Monitor action group
To successfully set up budget alerts that notify administrators, you must define the condition that triggers the alert (an alert threshold percentage or absolute amount) and the destination for the alert (email recipients or an Azure Monitor action group). Failing to specify either results in an inactive or silent alert.

Step-by-Step Solution

1
Identify the requirement to generate a notification when a specific budget percentage is reached.
The budget configuration requires a condition to trigger the alert, which is defined by setting an alert threshold percentage or absolute amount.
Without a threshold, Azure Cost Management does not know when to evaluate the budget status.
2
Identify the requirement to send an email notification when the threshold is met.
The budget configuration requires specifying either email recipients directly or linking an Azure Monitor action group.
Without recipient email addresses or action groups, the alert will fire silently without notifying the administration team.

Key Concept

Azure Budgets require both an alert threshold and designated notification recipients (emails or action groups) to successfully alert administrators of spending limits.
Question 144Question →

Apex Global Logistics configures the following Azure Management Group (MG) hierarchy:

* Tenant Root Group
* Logistics-MG
* Operations-MG
* Subscription-Ops1
* Archive-MG
* Subscription-Arch1

The following assignments and configurations are in place:
* An Azure Policy assignment that restricts resource deployment regions is applied to Logistics-MG.
* A user named User1 is assigned the Contributor role at the Operations-MG level.
* A Resource Lock of type CanNotDelete is applied directly to Subscription-Ops1.

You move Subscription-Ops1 from Operations-MG to Archive-MG.

Which of the following describes the impact of this move on User1's permissions and the policy and lock configurations of Subscription-Ops1?

Show answer & explanation

Answer: User1 loses the Contributor role permissions on Subscription-Ops1, while the regional policy from Logistics-MG and the CanNotDelete resource lock remain active on Subscription-Ops1.

Answer

User1 loses the Contributor role permissions on Subscription-Ops1, while the regional policy from Logistics-MG and the CanNotDelete resource lock remain active on Subscription-Ops1.
The correct option is correct because moving Subscription-Ops1 out of Operations-MG removes the subscription from the scope of User1's Contributor role assignment. Since Logistics-MG remains a parent of the subscription's new parent group (Archive-MG), the policy inherited from Logistics-MG continues to apply. Any resource locks applied directly to the subscription are properties of the subscription itself and remain intact after the move.

Step-by-Step Solution

1
Analyze RBAC scope inheritance during subscription relocation.
User1 loses Contributor permissions on Subscription-Ops1.
User1's role assignment is at the Operations-MG level. When Subscription-Ops1 is moved to Archive-MG, it is no longer a child of Operations-MG, so it stops inheriting permissions from that scope.
2
Analyze Azure Policy inheritance through the new hierarchy path.
The regional policy assigned at Logistics-MG remains active on Subscription-Ops1.
Archive-MG is a child of Logistics-MG. Therefore, Subscription-Ops1 still inherits the policy from Logistics-MG after the move.
3
Evaluate the state of the direct resource lock on the subscription.
The CanNotDelete resource lock remains active.
Direct resource locks applied to a subscription are properties of the subscription resource itself and are not deleted or altered when the subscription is moved between management groups.

Key Concept

Azure Management Groups govern subscription-level access, policy, and compliance through hierarchical inheritance.
Question 145Question →

Veloce Systems needs to deploy a two-tier application in the Germany West Central region. The web tier consists of two virtual machines named VM-Web1 and VM-Web2. To meet a 99.95%99.95\% uptime SLA, you plan to deploy the virtual machines in an Availability Set named AvSet-Web.

Which two configuration requirements must be met to deploy this high-availability solution? (Select two.)

Select all that apply

Show answer & explanation

Answer: The virtual machines must be assigned to AvSet-Web during their creation process.; The virtual machines and AvSet-Web must be deployed in the same Azure region.

Answer

The virtual machines must be assigned to the Availability Set during their creation process, and both the virtual machines and the Availability Set must be deployed in the same Azure region.
To configure virtual machines in an Availability Set, the VMs must be associated with the Availability Set during their creation. Once a virtual machine is created, it cannot be added to or removed from an Availability Set. Additionally, an Availability Set is a regional resource, meaning the virtual machines and the Availability Set must reside in the same Azure region.

Step-by-Step Solution

1
Ensure the Availability Set resource exists in the target region prior to deploying the virtual machines.
The Availability Set named AvSet-Web is created in the Germany West Central region.
Virtual machines can only reference an Availability Set that exists in the same region and resource group.
2
Configure the virtual machine deployment settings to associate VM-Web1 and VM-Web2 with AvSet-Web.
VM-Web1 and VM-Web2 are successfully deployed into AvSet-Web.
Azure requires the Availability Set membership to be specified during the VM creation workflow; post-deployment association is not supported.

Key Concept

Availability Sets configuration requirements and regional scope limitations
Estimated Time:1m 30s
Question 146Question →

You manage an Azure Storage account named `sa-finance-prod` that stores sensitive financial documents. You are configuring network security for `sa-finance-prod` to meet the following requirements:

- Only virtual machines in a subnet named `Subnet-Web` within a virtual network named `VNet-Prod` must be allowed to access the storage account over the Azure network backbone.
- System administrators working from an on-premises office must be able to access the storage account. The office uses the public IP address range 203.0.113.0/24203.0.113.0/24.
- Azure Backup must be able to back up the files in `sa-finance-prod` successfully.
- All other public internet access to the storage account must be blocked.

Which of the following configurations should you implement?

Show answer & explanation

Answer: Configure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for 203.0.113.0/24203.0.113.0/24, and enable the option to allow trusted Microsoft services to access the storage account.

Answer

Configure the public network access of the storage account to 'Enabled from selected virtual networks and IP addresses', add a virtual network rule for the subnet with the service endpoint, add the IP firewall rule for the on-premises range, and allow trusted Microsoft services.
The correct configuration enables public network access from selected networks, which is required to evaluate IP firewall rules and virtual network rules. It adds the administrator IP range to the firewall rules, associates the virtual network subnet (which requires the storage service endpoint), and enables the trusted Microsoft services bypass to allow Azure Backup to function.

Step-by-Step Solution

1
Select the correct public network access state.
Choose 'Enabled from selected virtual networks and IP addresses' rather than 'Disabled'.
Disabling public network access ignores all public IP firewall rules, which would block the on-premises administrators using the public IP range.
2
Enable the service endpoint on the subnet.
Enable the `Microsoft.Storage` service endpoint on `Subnet-Web`.
This allows traffic from the subnet to be routed securely over the Azure backbone network to the storage account.
3
Add virtual network and IP rules to the storage account firewall.
Add `Subnet-Web` to the allowed virtual networks list and 203.0.113.0/24203.0.113.0/24 to the firewall IP rules.
This restricts general public access while permitting traffic from the specific subnet and the administrator office.
4
Allow trusted Microsoft services to bypass the firewall.
Check the box to 'Allow Azure services on the trusted services list to access this storage account'.
Azure Backup is a trusted Microsoft service and requires this exception to access the storage account when firewall rules are active.

Key Concept

Azure Storage Firewalls and Virtual Networks network routing, including Service Endpoints, IP rules, and Trusted Microsoft Services bypass.
Question 147Question →

You manage a Microsoft Entra ID tenant. You have an existing security group named Group1. During the creation of Group1, the option 'Microsoft Entra roles can be assigned to the group' was set to Yes. You now need to configure Group1 to automatically add users who have their department attribute set to 'Engineering'. What should you do?

Show answer & explanation

Answer: Create a new security group, set 'Microsoft Entra roles can be assigned to the group' to No, and configure a dynamic user membership rule.

Answer

Create a new security group, set 'Microsoft Entra roles can be assigned to the group' to No, and configure a dynamic user membership rule.
In Microsoft Entra ID, groups that are role-assignable (where 'Microsoft Entra roles can be assigned to the group' is set to Yes) must use the 'Assigned' membership type. Dynamic membership rules are not supported for these groups to maintain security and prevent unauthorized privilege escalation. Therefore, to automate membership based on user attributes like department, you must create a new group that is not role-assignable.

Step-by-Step Solution

1
Analyze the properties of the existing group (Group1) to identify any constraints.
Group1 is identified as a role-assignable group since the option 'Microsoft Entra roles can be assigned to the group' was enabled during creation.
Role-assignable groups have strict configuration limitations that differ from standard security groups.
2
Evaluate if the membership type of a role-assignable group can be converted to dynamic.
Microsoft Entra ID enforces that role-assignable groups must use the 'Assigned' membership type; dynamic membership rules (Dynamic User or Dynamic Device) cannot be used.
To prevent administrative privilege escalation or unintended role assignments via membership rules, Entra ID restricts membership of role-assignable groups to manual/assigned membership only.
3
Formulate a solution that allows the use of dynamic membership rules for the target users.
A new security group must be created with the 'Microsoft Entra roles can be assigned to the group' option set to 'No', allowing its membership type to be configured as Dynamic User with the department-based rule.
Since the existing role-assignable group cannot be converted to dynamic, creating a new non-role-assignable group is the only way to automate membership based on user attributes.

Key Concept

Membership constraints on role-assignable groups in Microsoft Entra ID
Estimated Time:1m 30s
Question 148Question →

Your company wants to delegate user administration tasks, such as resetting passwords, for users in the marketing department only. The delegated administrator must not have administrative privileges over users in other departments.

Which two of the following actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an administrative unit and add the marketing department users to it.; Assign the User Administrator role to the delegated administrator scoped to the administrative unit.

Answer

To delegate user management for a specific subset of users without granting tenant-wide permissions, you must create an administrative unit containing those users and then assign the User Administrator role to the delegated administrator scoped to that administrative unit.
To limit the scope of administrative permissions over a subset of users, you must use Microsoft Entra ID Administrative Units. Creating an administrative unit containing the target users and assigning the User Administrator role scoped specifically to that administrative unit ensures that the delegated administrator can manage only the marketing users and has no administrative rights over other users in the tenant.

Step-by-Step Solution

1
Group the target users into a logical boundary inside Microsoft Entra ID.
An administrative unit is created, and the marketing department users are added to it.
Administrative units are used to define scoped boundaries of users and groups for role assignments.
2
Assign the appropriate Microsoft Entra ID role to the delegated administrator.
The User Administrator role is assigned to the administrator, with the scope set to the newly created administrative unit.
This limits the administrator's capability to reset passwords and modify profiles to only the users within the administrative unit, preventing tenant-wide control.

Key Concept

Delegating Microsoft Entra ID administration using Administrative Units
Estimated Time:45s
Question 149Question →

You have an on-premises Windows Server named Server1 and an Azure file share named share1 in a storage account named storage1. You plan to deploy Azure File Sync. All synchronization traffic must travel over a private network connection, and public network access to both storage1 and the Storage Sync Service must be disabled. Which sequence of steps should you perform to configure Azure File Sync under these security constraints? Arrange the steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Register the Microsoft.StorageSync resource provider first, then create the Storage Sync Service and configure private endpoints for both the service and the storage account. Next, install the Azure File Sync agent on the on-premises server, register the server, and finally create a Sync Group, add a Cloud Endpoint, and then add a Server Endpoint.
The correct order ensures all prerequisites are met: the resource provider must be registered to create the service; the service and private endpoints must exist to allow private registration; the agent must be installed to perform the registration; and the server must be registered and the sync group/cloud endpoint created before a server endpoint can be linked.

Step-by-Step Solution

1
Register the Microsoft.StorageSync resource provider in the Azure subscription.
The subscription is enabled to create Storage Sync Service resources.
You cannot provision the Storage Sync Service resource until the provider is registered.
2
Create the Storage Sync Service and configure private endpoints for the Storage Sync Service and the storage account.
The resources are created and accessible only over the private network connection.
Since public access is disabled, network routing via private endpoints and private DNS resolution must be active for the local server to communicate with Azure during registration and sync.
3
Install the Azure File Sync agent on the on-premises server.
The File Sync service and utilities are installed on the local Windows Server.
The server cannot execute sync or registration commands without the local agent.
4
Register the Windows Server with the Storage Sync Service.
A trust relationship is established, and the server appears as a registered server in the Storage Sync Service.
A server must be registered with the Storage Sync Service before it can be added to any sync group.
5
Create a Sync Group, add a Cloud Endpoint (Azure file share), and add a Server Endpoint (local path).
The synchronization relationship is established, and files begin syncing.
A sync group and a cloud endpoint must exist before you can associate a registered server's local path as a server endpoint.

Key Concept

Deploying Azure File Sync in a secure, private-only network topology requires registering the resource provider, deploying the Storage Sync Service and its private endpoints, installing the local agent, registering the server over the private network, and then configuring the sync group, cloud endpoint, and server endpoint in sequence.
Question 150Question →

Your organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:

* Management Group: `MG-Finance`
* Subscription: `Sub-Finance-Prod`
* Resource Group: `RG-Finance-Sec`
* Storage Account: `safinancedata`

A user named Admin1 is assigned the Microsoft Entra ID Global Administrator role.
A user named User2 is assigned the Reader role at the `Sub-Finance-Prod` subscription level.

You need to configure the environment to meet the following requirements:
1. Admin1 must be able to assign the Reader role to new users at the `RG-Finance-Sec` resource group level.
2. User2 must be able to read and write blob data in a container within the `safinancedata` storage account, but must not have control plane write permissions to any resource in the subscription.

Which of the following actions should you perform to meet these requirements?

Show answer & explanation

Answer: Elevate Admin1's access in Microsoft Entra ID to grant the User Access Administrator role at the root scope, and then assign User2 the Storage Blob Data Contributor role at the storage account level.

Answer

Elevate Admin1's access in Microsoft Entra ID to grant the User Access Administrator role at the root scope, and then assign User2 the Storage Blob Data Contributor role at the storage account level.
To manage Azure resources, a Microsoft Entra ID Global Administrator must first elevate access to receive the User Access Administrator role at the root management group scope. To allow User2 to write blobs without granting control plane write access, the Storage Blob Data Contributor role must be assigned at the storage account level. This provides data plane write capabilities while User2's read-only access (Reader) is inherited from the subscription.

Step-by-Step Solution

1
Determine the role assignment capability of Admin1.
Identify that Admin1 has the Microsoft Entra ID Global Administrator role, which does not automatically grant permissions to manage Azure resources.
By default, Microsoft Entra ID roles and Azure RBAC roles are separate. To manage role assignments on Azure resources, Admin1 must elevate access in Microsoft Entra ID properties to receive the User Access Administrator role at the root management group scope.
2
Analyze User2's current permissions and access requirements.
User2 has Reader permissions at the subscription level. They need to read and write blob data inside a container within the storage account without getting write access to other resources.
Reader is a control plane role and is inherited down to the storage account. To allow write operations on the data plane (blobs) without granting control plane write access (such as modifying firewalls or deleting resources), the Storage Blob Data Contributor role must be assigned at the storage account scope.
3
Identify the correct configuration that combines these two actions.
Admin1 elevates access in Microsoft Entra ID to assign roles, and assigns User2 the Storage Blob Data Contributor role at the storage account scope.
This satisfies both requirements: Admin1 gains the permission to manage role assignments, and User2 obtains the necessary data-plane write access while retaining their read-only control-plane access elsewhere.

Key Concept

Azure RBAC scopes, role inheritance, separation of control plane and data plane, and Entra ID access elevation.
Estimated Time:2m 30s
Question 151Question →

Vanguard Retail plans to deploy a new critical business application in the Germany West Central region. The application will run on two virtual machines named vm-sales-prod1 and vm-sales-prod2. The deployment must satisfy the following requirements:
- Provide a virtual machine uptime SLA of 99.99%.
- Protect the application against datacenter-level outages within the region.
- Distribute incoming network traffic across both virtual machines.

Which of the following configuration options should you implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy vm-sales-prod1 in Availability Zone 1 and vm-sales-prod2 in Availability Zone 2.; Configure a Standard SKU Azure Load Balancer to distribute traffic to the virtual machines.

Answer

Deploy the virtual machines across different Availability Zones (such as Zone 1 and Zone 2) and distribute traffic using a Standard SKU Azure Load Balancer.
To achieve a 99.99% virtual machine uptime SLA and safeguard against datacenter-level failures, virtual machines must be distributed across different Availability Zones within the Germany West Central region. To load balance traffic across these zonal VMs, a Standard SKU Azure Load Balancer is required, as the Basic SKU does not support cross-zone backend pools.

Step-by-Step Solution

1
Analyze the high availability and SLA requirements.
An SLA of 99.99% VM uptime and protection against datacenter-level failures requires deploying the virtual machines across multiple Availability Zones.
Availability Zones reside in physically separate datacenters within a region, providing protection against facility-wide outages and raising the SLA to 99.99%.
2
Evaluate the load balancing requirement for multi-zone VMs.
A Standard SKU Load Balancer is required to distribute traffic to virtual machines deployed in different zones.
Basic SKU Load Balancers do not support zone-redundant configurations or backend pools that span multiple Availability Zones.

Key Concept

Azure Virtual Machine High Availability using Availability Zones and Standard Load Balancers
Question 152Question →

You need to restrict network access to an Azure Storage account named `store77` so that it is only accessible from a subnet named `Subnet1` within a virtual network named `VNet1` using the Azure backbone network. Which two configurations should you implement?

Select all that apply

Show answer & explanation

Answer: Configure the network firewall settings of `store77` to allow access from selected virtual networks and add `VNet1` and `Subnet1`.; Configure the `Microsoft.Storage` service endpoint on `Subnet1`.

Answer

Configure the network firewall settings of the storage account to allow access from selected virtual networks and add the virtual network and subnet, and configure the storage service endpoint on the subnet.
To restrict network access to a specific subnet over the backbone network, you must perform two main configurations: first, configure the subnet to use the `Microsoft.Storage` service endpoint, which optimizes the network route; second, configure the storage account firewall to allow traffic from that specific virtual network and subnet combination.

Step-by-Step Solution

1
Enable the service endpoint on the virtual network subnet.
The subnet is configured to route traffic destined for Azure Storage through the Microsoft backbone network rather than the public internet.
This establishes the necessary network path from the subnet to the storage service.
2
Configure the storage account firewall rules.
The storage account firewall blocks public access and only permits traffic originating from the specified virtual network and subnet.
This secures the storage account by limiting network ingress to the designated subnet.

Key Concept

Securing Azure Storage network access requires both enabling a service endpoint on the source subnet and configuring the storage account firewall to permit traffic from that specific subnet.
Question 153Question →

Your company has branch offices in Seattle and London. You need to configure Azure File Sync to synchronize files from an on-premises Windows Server named Server1 to an Azure file share. You have already created a Storage Sync Service resource in Azure. What must you do next on Server1 to prepare it for file synchronization?

Show answer & explanation

Answer: Install the Azure File Sync agent and register Server1 with the Storage Sync Service.

Answer

Install the Azure File Sync agent and register Server1 with the Storage Sync Service.
To prepare Server1 for synchronization, the administrator must install the Azure File Sync agent on Server1 and run the registration utility to register it with the Storage Sync Service. This establishes the trust relationship necessary to create server endpoints and configure synchronization.

Step-by-Step Solution

1
Download and install the Azure File Sync agent on the local Windows Server (Server1).
The Azure File Sync driver and management cmdlets are installed on Server1.
The agent contains the background services and drivers required to monitor and sync changes between Server1 and Azure.
2
Run the Server Registration utility on Server1.
Server1 is successfully registered with the Storage Sync Service in Azure.
This establishes a secure trust relationship between the local server and the Azure Storage Sync Service using Entra ID authentication.

Key Concept

Azure File Sync Server Registration
Question 154Question →

An administrator configures the following resource hierarchy and role assignments in an Azure environment:

* Microsoft Entra Tenant: The Access management for Azure resources property is set to No.
* Management Group: `MG-CoreServices`
* Subscription: `Sub-SharedServices`
* Resource Group: `rg-networking` (contains a Virtual Network named `vnet-prod`)
* Resource Group: `rg-identity`

A user named User1 is assigned the following roles:
* Global Administrator in the Microsoft Entra tenant
* Reader at the `MG-CoreServices` management group scope
* Network Contributor at the `rg-networking` resource group scope

You need to identify the effective permissions of User1.

Which of the following statements are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: User1 can view the configuration of all resources in the rg-identity resource group.; User1 can modify the configuration of vnet-prod.

Answer

User1 can view the configuration of all resources in the rg-identity resource group, and User1 can modify the configuration of vnet-prod.
The user is able to view the configuration of all resources in the identity resource group and modify the configuration of the virtual network. The Reader role assigned at the management group scope inherits down through the subscription to all resource groups, including the identity resource group, enabling read access. The Network Contributor role assigned at the networking resource group scope grants management permissions on the virtual network. Since Azure RBAC permissions are additive, the Reader assignment at the higher management group level does not restrict the write permissions granted at the resource group level.

Step-by-Step Solution

1
Determine the impact of the Reader role assignment at the management group level.
User1 gains read-only access to all resources in Sub-SharedServices, including rg-networking and rg-identity.
Azure RBAC role assignments inherit down the resource hierarchy: Management Group -> Subscription -> Resource Group -> Resource.
2
Determine the impact of the Network Contributor role assignment at the resource group level.
User1 gains contributor permissions on network resources in rg-networking, such as vnet-prod.
The Network Contributor role grants management permissions on networking resources. These permissions apply to the resource group scope and all child resources inside it.
3
Evaluate the additive nature of RBAC assignments and any conflict resolution.
User1 can modify vnet-prod because the write permissions from the Network Contributor role are added to the read permissions from the Reader role.
Azure RBAC permissions are additive, meaning the effective permissions are the union of all assigned roles. A Reader assignment at a higher scope does not override a Contributor assignment at a lower scope.
4
Evaluate the Microsoft Entra ID Global Administrator role assignment.
The Global Administrator role provides no permissions on Sub-SharedServices resources.
Microsoft Entra ID roles and Azure RBAC roles are managed on separate planes. Without explicit RBAC role assignments or access elevation (which is disabled), Global Administrators do not have access to Azure resources.

Key Concept

Azure RBAC Inheritance and Role Additive Nature vs Microsoft Entra ID Directory Roles
Question 155Question →

You manage an Azure subscription. You need to ensure that detailed cost and usage data is automatically saved to an Azure Storage account every day for external analysis. What should you configure in Azure Cost Management?

Show answer & explanation

Answer: An export

Answer

An export
An export in Azure Cost Management allows you to automate the process of publishing cost and usage data to an Azure Storage account daily, weekly, or monthly.

Step-by-Step Solution

1
Identify the requirement to save detailed cost and usage data to an Azure Storage account automatically on a daily schedule.
The target action is automated raw data delivery, not threshold alerting or compliance auditing.
Understanding the core task helps eliminate tools that are designed only for monitoring thresholds (budgets) or tracking resource compliance (policies).
2
Evaluate the capabilities of Azure Cost Management features.
The Exports feature in Cost Management is specifically designed to output CSV files containing detailed cost data directly to a designated storage container.
This confirms that an export is the correct mechanism for delivering the daily dataset.

Key Concept

Azure Cost Management exports
Question 156Question →

An enterprise manages its Azure resource hierarchy with a Management Group named Production-MG, which contains a subscription named Prod-Sub-01. Prod-Sub-01 contains two resource groups named RG-Core-App and RG-Core-Data.

The following Azure Policy assignments are active:
- An initiative definition named Corp-Governance-Initiative is assigned at Production-MG. The assignment contains an exclusion for the resource group RG-Core-App. The initiative contains two policy definitions: Policy-Tag (denies resource creation if the Environment tag is missing) and Policy-SKU-A (denies VM deployment unless the size is Standard_D2s_v5 or Standard_D8s_v5).
- A policy definition named Policy-SKU-B is assigned directly to Prod-Sub-01. This policy denies VM deployment unless the size is Standard_D2s_v5 or Standard_D4s_v5.
- A policy definition named Policy-SKU-C is assigned directly to RG-Core-App. This policy denies VM deployment unless the size is Standard_D4s_v5.

Which of the following deployments will successfully complete?

Show answer & explanation

Answer: Deploying a virtual machine with size Standard_D4s_v5 in RG-Core-App without the Environment tag

Answer

Deploying a virtual machine with size Standard_D4s_v5 in RG-Core-App without the Environment tag
Deploying a Standard_D4s_v5 VM in RG-Core-App without the Environment tag completes successfully because RG-Core-App is excluded from the management group's policy initiative. Consequently, the tag requirement and the management group's SKU restrictions do not apply to this scope. The subscription policy allows the Standard_D4s_v5 SKU, and the resource group policy explicitly requires the Standard_D4s_v5 SKU, allowing the deployment to satisfy all applicable policy definitions.

Step-by-Step Solution

1
Determine the scope of the management group initiative assignment and exclusions.
The Corp-Governance-Initiative is assigned at Production-MG, meaning it inherits down to Prod-Sub-01, RG-Core-App, and RG-Core-Data. However, RG-Core-App is listed as an exclusion on this assignment. Therefore, Policy-Tag and Policy-SKU-A do not evaluate deployments within RG-Core-App.
Exclusions on policy assignments prevent the policies from being evaluated on resources within the excluded scope.
2
Analyze the policies applied to RG-Core-App.
The active policies are Policy-SKU-B (assigned at Prod-Sub-01, allowing Standard_D2s_v5 or Standard_D4s_v5) and Policy-SKU-C (assigned at RG-Core-App, allowing Standard_D4s_v5). Combining these requirements, only Standard_D4s_v5 is allowed in RG-Core-App. The Environment tag is not required here.
Azure Policy evaluations are cumulative; resources must satisfy all applicable policies in the hierarchy.
3
Analyze the policies applied to RG-Core-Data.
Since RG-Core-Data is not excluded, it is subject to all parent scopes. The active policies are Policy-Tag (requires Environment tag), Policy-SKU-A (allows Standard_D2s_v5 or Standard_D8s_v5), and Policy-SKU-B (allows Standard_D2s_v5 or Standard_D4s_v5). To succeed in RG-Core-Data, a VM must have the Environment tag and be size Standard_D2s_v5 (the intersection of SKU-A and SKU-B).
Resources must comply with the union of restrictions (the intersection of allowed sets) across all assigned policies in their hierarchical path.
4
Evaluate the deployment options against the determined compliance rules.
Deploying a Standard_D4s_v5 VM in RG-Core-App without the tag succeeds because the tag policy does not apply and the SKU is allowed by both Policy-SKU-B and Policy-SKU-C.
This is the only deployment scenario where all applicable policy conditions evaluate to allowed.

Key Concept

Azure Policy Scope Inheritance, Exclusions, and Cumulative Evaluation Logic
Estimated Time:3m 0s
Question 157Question →

Your company has a Microsoft Entra ID tenant containing an Azure subscription named Sub1. The tenant includes a support team named London-Support and an Administrative Unit named London-AU that contains users from the London office.

You need to meet the following requirements:
1. Members of the London-Support group must be able to update the department and profile information of only the users within London-AU.
2. Members of London-Support must have no administrative permissions over other users in the tenant or resources in Sub1.
3. You must automatically assign Microsoft 365 Enterprise licenses to all users who belong to London-AU.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Microsoft Entra ID User Administrator role to the London-Support group with the scope restricted to the London-AU administrative unit.; Create a Microsoft Entra ID security group that uses dynamic user membership, and assign the licenses to that group.

Answer

The correct actions are to assign the Microsoft Entra ID User Administrator role to the London-Support group scoped to the London-AU administrative unit, and to create a Microsoft Entra ID security group that uses dynamic user membership and assign the licenses to that group.
To delegate restricted user management, you assign a directory role (such as User Administrator) to the administrative group with the scope of the Administrative Unit. To automate licensing, you must use group-based licensing with a dynamic security group, as licensing cannot be configured directly on Administrative Units.

Step-by-Step Solution

1
Analyze how to delegate administrative permissions limited to a subset of users.
Determine that an Administrative Unit (London-AU) is the appropriate scope for delegating the User Administrator role to London-Support, which prevents them from managing users outside of the AU.
Administrative units restrict the scope of directory roles to a specific subset of the directory.
2
Analyze how directory roles differ from Azure RBAC roles.
Confirm that the User Administrator role cannot be assigned at the subscription level via Azure RBAC because directory roles and resource roles are managed on different control planes.
Microsoft Entra ID roles manage directory resources (users, groups), while Azure RBAC roles manage Azure resources (VMs, storage) in subscriptions.
3
Analyze how to automate license assignment for the scoped users.
Determine that licenses must be assigned via group-based licensing using a dynamic security group rather than directly to the Administrative Unit.
Direct license assignment to Administrative Units is not supported in Microsoft Entra ID.

Key Concept

Scoping administrative delegation using Administrative Units and automating license management using group-based licensing.
Question 158Question →

An administrator needs to configure temporary access for an external application to upload and read blobs in a container named incoming in an Azure Storage account named corpstore2026. The configuration must meet the following security and access requirements:
- The external application must only be allowed to read and write blobs in the incoming container.
- The external application's access must be restricted to the IP range 198.51.100.0/24198.51.100.0/24.
- The access token must remain valid for a maximum of 4848 hours.
- Access must not be interrupted when the storage account access keys (key1key1 and key2key2) are rotated.
- The administrator must adhere to the principle of least privilege for their own administrative account when generating the SAS.

Which two actions should the administrator perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Storage Blob Data Delegator role to the administrator's Microsoft Entra ID account.; Generate a User Delegation SAS scoped to the container level.

Answer

To meet the requirements, the administrator must assign the Storage Blob Data Delegator role to their account and generate a User Delegation SAS scoped to the container.
Using a User Delegation SAS satisfies the requirement to maintain access during storage account key rotation, as it is signed using Microsoft Entra ID credentials rather than the storage account keys. The Storage Blob Data Delegator role is the least-privilege role that grants the administrative account the ability to generate the user delegation key.

Step-by-Step Solution

1
Identify the correct Shared Access Signature (SAS) type to prevent access disruption during storage account key rotation.
Determine that a User Delegation SAS must be used because it is signed using Microsoft Entra ID credentials and is independent of the storage account access keys.
Rotating storage account access keys (key1key1 and key2key2) immediately invalidates any Service or Account SAS tokens that were signed with those keys.
2
Identify the minimum required RBAC role for the administrator's account to generate the user delegation key.
Assign the Storage Blob Data Delegator role to the administrator's Microsoft Entra ID account.
To create a User Delegation SAS, the administrator must request a user delegation key. The Storage Blob Data Delegator role provides the minimum control plane permission for this action without granting data plane read or write permissions to the data itself.
3
Configure the SAS parameters to restrict access based on the specified security constraints.
Generate the SAS token at the container level (incoming) with an expiration time of less than 4848 hours, HTTPS-only protocol, and the allowed IP range set to 198.51.100.0/24198.51.100.0/24.
This configuration enforces the least privilege principle and respects the strict connectivity and validity duration limits specified in the scenario.

Key Concept

User Delegation SAS allows securing storage access using Microsoft Entra ID credentials, offering independence from account key rotation and requiring specific data-plane RBAC delegation permissions.
Question 159Question →

You are configuring permissions in a Microsoft Entra ID tenant. You plan to assign the Helpdesk Administrator role to a user named AdminA. You must ensure that AdminA can only perform helpdesk operations, such as password resets, for users located in the Munich branch office. Which Microsoft Entra ID resource or configuration should you implement to restrict the scope of this role?

Show answer & explanation

Answer: an administrative unit

Answer

an administrative unit
Administrative units are designed specifically to delegate Microsoft Entra ID administrative roles with a restricted scope, such as limiting a helpdesk administrator to managing users in a specific branch office.

Step-by-Step Solution

1
Create an administrative unit in the Microsoft Entra ID tenant.
A logical container is established within the directory for delegation.
This container will define the scope for the delegated role.
2
Add the users located in the Munich branch office to the newly created administrative unit.
The target scope is populated with the correct user accounts.
Only members of the administrative unit will be affected by the delegated administrator.
3
Assign the Helpdesk Administrator role to AdminA at the administrative unit scope.
AdminA is granted Helpdesk Administrator permissions restricted only to users within that unit.
Role assignments at the administrative unit scope limit the admin's rights to only the members of that unit.

Key Concept

Administrative units in Microsoft Entra ID allow organizations to subdivide a directory into logical chunks and delegate administrative roles with permissions restricted to only those chunks.
Question 160Question →

ZeniSphere Logistics is planning to deploy two new virtual machines, VM-Ship1 and VM-Ship2, in the East US region. The deployment must protect the application from localized hardware failures on a single physical host, such as disk or power supply failures, by ensuring the VMs are placed on different physical hardware racks within the same datacenter. Which Azure feature should you configure for the virtual machines?

Show answer & explanation

Answer: An Availability Set

Answer

An Availability Set
The correct answer is configuring an Availability Set. An Availability Set is a logical grouping capability in Azure that ensures the VMs placed in it are isolated from each other across physical hardware racks, power sources, and network switches within a single datacenter. This protects the VMs from host-level hardware failures.

Step-by-Step Solution

1
Analyze the high availability scope specified in the scenario.
The requirement is to protect against physical host hardware failures (like disk or power) within the same datacenter.
Understanding the failure domain boundary helps determine if local or regional redundancy is appropriate.
2
Evaluate Azure features that provide VM redundancy within a single datacenter.
Availability Sets distribute VMs across different physical hardware racks (fault domains) inside one datacenter.
This matches the requirement to prevent simultaneous failures of both VMs due to single-host or single-rack issues.

Key Concept

Availability Sets protect VMs against localized hardware failures by distributing them across separate physical racks (fault domains) and power/network lines within a single Azure datacenter.
PreviousPage 8 / 63Next