Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 161Question →

Luminary Media Group organizes its Azure resources using the following management group hierarchy:

* Tenant Root Group
* Luminary-MG (An administrator assigns User1 the Reader role here)
* Content-MG (An Azure Policy is assigned here that denies resource creation if the 'Department' tag is missing)
* Sub-Production (Subscription) (An administrator assigns User1 the Contributor role here)
* RG-Video (Resource Group) (A CanNotDelete resource lock is applied here)
* Marketing-MG
* Sub-Marketing (Subscription)

Which two of the following statements are correct regarding the permissions and governance applied to User1 in this hierarchy?

Select all that apply

Show answer & explanation

Answer: User1 can view resources within the Sub-Marketing subscription, but cannot delete resources in the RG-Video resource group.; User1 can create new resources in the RG-Video resource group, provided they include the 'Department' tag.

Answer

User1 can view resources within the Sub-Marketing subscription but cannot delete resources in the RG-Video resource group, and User1 can create new resources in the RG-Video resource group provided they include the 'Department' tag.
The correct options accurately identify that the Reader role assigned at the parent management group inherits down to the Sub-Marketing subscription, enabling read access. Furthermore, they correctly state that User1 has Contributor rights in RG-Video but cannot delete resources due to the CanNotDelete lock, and that new creations require the 'Department' tag due to the inherited Azure Policy from Content-MG.

Step-by-Step Solution

1
Evaluate Reader role inheritance
User1 is assigned the Reader role at Luminary-MG, which propagates down to all child scopes, including Marketing-MG and the Sub-Marketing subscription.
Permissions assigned at a parent management group are inherited by all child management groups, subscriptions, and resources.
2
Evaluate Contributor role and resource lock on RG-Video
User1 has Contributor permissions on Sub-Production and RG-Video, but the CanNotDelete lock on RG-Video prevents resource deletion.
Contributor rights allow creation and modification, but a CanNotDelete lock blocks delete operations for all users regardless of their RBAC roles.
3
Evaluate Azure Policy inheritance
Any resource creation in RG-Video must include the 'Department' tag to comply with the policy set at Content-MG.
Azure Policies applied at a management group level are inherited and enforced on all resources within that hierarchy.

Key Concept

Azure Management Groups allow for the hierarchical inheritance of RBAC roles, Azure Policies, and resource locks down to child subscriptions and resource groups.
Estimated Time:1m 30s
Question 162Question →

AeroSpace Dynamics is planning the deployment of a new line-of-business application in the East US region. To support the application, you must deploy two virtual machines named VM-App1 and VM-App2. The deployment must protect the application against datacenter-wide failures in the region and must guarantee a 99.99% virtual machine uptime SLA. Which deployment configuration meets the requirements?

Show answer & explanation

Answer: Deploy VM-App1 to Availability Zone 1 and VM-App2 to Availability Zone 2.

Answer

Deploy VM-App1 to Availability Zone 1 and VM-App2 to Availability Zone 2.
Deploying virtual machines across different Availability Zones distributes the workloads across physically separate datacenters within an Azure region. This protects against datacenter-wide outages (such as power or cooling failures) and qualifies the deployment for a 99.99% virtual machine uptime SLA.

Step-by-Step Solution

1
Analyze the high availability requirements.
The application requires protection against datacenter-wide outages and a 99.99% virtual machine uptime SLA.
This establishes the target metrics and failure scope (datacenter-wide vs. hardware rack-level).
2
Evaluate Availability Sets against the requirements.
Availability Sets protect against rack-level failures (fault domains) and patching (update domains) inside a single datacenter, providing a 99.95% SLA.
This determines if Availability Sets are sufficient, which they are not since they do not protect against datacenter-wide failures.
3
Evaluate Availability Zones against the requirements.
Availability Zones deploy resources into physically separate datacenters with independent power, cooling, and networking within a region, providing a 99.99% SLA.
This matches the business constraints of datacenter-wide protection and a 99.99% SLA.
4
Verify configuration rules and select the correct option.
Deploying VMs to separate Availability Zones is valid. However, trying to combine zonal deployments with an Availability Set is invalid.
This eliminates configurations that try to combine Availability Zones and Availability Sets for the same VM instances.

Key Concept

Azure Availability Zones vs. Availability Sets configuration and SLAs
Question 163Question →

You need to synchronize a local folder on a Windows Server to an Azure file share using Azure File Sync. Which sequence of actions should you perform to configure the synchronization?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure Azure File Sync, you must first create a Storage Sync Service, install the Azure File Sync agent on the Windows Server, register the server with the Storage Sync Service, create a sync group with a cloud endpoint, and finally create a server endpoint on the registered Windows Server.
Establishing synchronization via Azure File Sync follows a sequential topology construction: configure the cloud control plane (Storage Sync Service), deploy the local agent on the server, establish trust via server registration, set up the sync topology and cloud storage (sync group and cloud endpoint), and then target the local folder (server endpoint).

Step-by-Step Solution

1
Deploy the Storage Sync Service resource in the Azure portal.
A Storage Sync Service resource is successfully created in your resource group.
This resource is the management and orchestration hub for Azure File Sync.
2
Download and install the Azure File Sync agent on the local Windows Server.
The agent and its associated background services are active on the server.
The server requires the local agent to orchestrate file sync and cloud tiering metadata transfers.
3
Run the server registration wizard and authenticate using your Azure credentials.
The Windows Server is registered and appears in the list of registered servers in the Storage Sync Service.
This registration authorizes the server to sync folders through this specific service.
4
Create a sync group inside the Storage Sync Service and associate an Azure file share as the cloud endpoint.
A sync group is initialized with a cloud endpoint linked to an Azure storage account.
The sync group defines the logical boundary for file sync, while the cloud endpoint designates the central cloud copy.
5
Add a server endpoint by specifying a path on the registered Windows Server to the sync group.
A server endpoint is active, and data begins syncing between the local directory and the cloud endpoint.
The server endpoint determines which local folder is mapped into the sync group.

Key Concept

Azure File Sync Deployment Workflow
Question 164Question →

You are configuring an autoscale policy for an Azure Virtual Machine Scale Set (VMSS) named `vmss1` that currently has a capacity of 33 instances. The scale set uses the Uniform orchestration mode. You define the following autoscale rules within a single profile:

* Scale-out rule: Increase the instance count by 11 when the average CPU percentage of the scale set is greater than 70%70\% for a duration of 1010 minutes.
* Scale-in rule: Decrease the instance count by 11 when the average CPU percentage of the scale set is less than 55%55\% for a duration of 1010 minutes.
* Both rules have a cool-down period of 1010 minutes.

A sustained, constant workload requiring a total of 215%215\% CPU capacity (distributed evenly across all active instances) is applied to `vmss1`.

What is the behavior of the scale set under this workload, and how can you resolve any potential issues?

Show answer & explanation

Answer: The scale set will enter an infinite loop of scaling out to 44 instances and scaling in to 33 instances (thrashing). To resolve this, you should decrease the scale-in threshold to 50%50\%.

Answer

The scale set will enter an infinite loop of scaling out to 4 instances and scaling in to 3 instances (thrashing). To resolve this, you should decrease the scale-in threshold to 50%.
The correct option is the one describing that the scale set will enter an infinite loop (thrashing) and suggesting lowering the scale-in threshold. At 33 instances, a load of 215%215\% results in an average CPU of 71.67%71.67\%, which exceeds the 70%70\% scale-out threshold. After the duration is met, the scale set adds 11 instance, making the capacity 44 instances. At 44 instances, the average CPU load drops to 53.75%53.75\%, which is below the 55%55\% scale-in threshold, triggering a scale-in back to 33 instances. This cycle repeats indefinitely. Decreasing the scale-in threshold to 50%50\% prevents the scale-in rule from triggering when the instance count is 44, stabilizing the scale set.

Step-by-Step Solution

1
Calculate the average CPU utilization per instance at the starting capacity of 33 instances under the total workload demand of 215%215\%.
Each instance runs at approximately 71.67%71.67\% CPU utilization (215%/3215\% / 3).
To determine whether the initial conditions will trigger a scale-out rule (>70%> 70\%).
2
Analyze the scaling action and the resulting instance count.
The average CPU utilization (71.67%71.67\%) exceeds the scale-out threshold (70%70\%), causing the scale set to add 11 instance, bringing the total capacity to 44 instances.
To trace the first state transition of the scale set.
3
Calculate the average CPU utilization per instance at the new capacity of 44 instances under the same workload of 215%215\%.
Each instance runs at 53.75%53.75\% CPU utilization (215%/4215\% / 4).
To evaluate the scale set state against the scale-in threshold (<55%< 55\%) once the new instances are active.
4
Identify the stability of the new state and determine the resolution.
The new CPU utilization (53.75%53.75\%) falls below the scale-in threshold (55%55\%), triggering a scale-in back to 33 instances. This creates an infinite loop of scaling (thrashing). To resolve it, the scale-in threshold must be set below 53.75%53.75\% (e.g., 50%50\%) so that the scale-in rule does not trigger at 44 instances.
To resolve the thrashing by ensuring the scale-in threshold accounts for the capacity increase from scaling out.

Key Concept

Avoiding autoscale flapping (thrashing) by correctly spacing metric thresholds to account for capacity changes.
Estimated Time:3m 0s
Question 165Question →

An administrator needs to create a new security group named IT-Admins in a Microsoft Entra ID tenant. The group will be assigned the Helpdesk Administrator role. Which of the following configurations must the administrator select during the group creation process? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set 'Membership type' to Assigned; Set 'Microsoft Entra roles can be assigned to the group' to Yes

Answer

Setting the 'Membership type' to 'Assigned' and setting 'Microsoft Entra roles can be assigned to the group' to 'Yes' are both required configurations.
To assign Microsoft Entra roles directly to a security group, the group must be configured as a role-assignable group. This requires setting the 'Microsoft Entra roles can be assigned to the group' option to 'Yes' during the group creation process, which in turn forces the 'Membership type' to 'Assigned' because dynamic groups cannot be assigned to Microsoft Entra roles.

Step-by-Step Solution

1
Determine the type of role to be assigned.
The Helpdesk Administrator role is a Microsoft Entra ID role.
Microsoft Entra ID roles require specific group configurations for direct assignment, unlike Azure RBAC roles.
2
Evaluate the membership type constraint for role-assignable groups.
Dynamic membership types (Dynamic User or Dynamic Device) are not allowed for role-assignable groups.
Microsoft Entra ID requires role-assignable groups to have their membership type set to 'Assigned'.
3
Identify the creation-time configuration required for role assignment.
The option 'Microsoft Entra roles can be assigned to the group' must be set to 'Yes' during creation.
This switch is only available during the creation phase of the group and cannot be enabled later.

Key Concept

Microsoft Entra ID Role-Assignable Groups
Question 166Question →

Krypton Labs is planning to deploy a new application in the East US 2 region. The application architecture consists of a web tier with two virtual machines (VM-Web1 and VM-Web2) and a database tier with two virtual machines (VM-Db1 and VM-Db2).

The deployment must satisfy the following requirements:
- The web tier must be protected against datacenter-wide outages.
- The database tier VMs must be located in the same physical datacenter to maintain minimal network latency.
- Traffic must be distributed across the web tier VMs.

Which of the following configurations should you select to meet these requirements?

Show answer & explanation

Answer: Deploy VM-Web1 and VM-Web2 across different Availability Zones and associate them with a Standard Load Balancer. Deploy VM-Db1 and VM-Db2 within an Availability Set.

Answer

Deploy the web tier virtual machines (VM-Web1 and VM-Web2) across different Availability Zones using a Standard Load Balancer, and deploy the database tier virtual machines (VM-Db1 and VM-Db2) within an Availability Set.
Deploying the web tier virtual machines across different Availability Zones protects them from datacenter-wide outages because Availability Zones are physically separate datacenters within an Azure region. Since the web tier virtual machines span different Availability Zones, a Standard Load Balancer must be used, as the Basic SKU does not support zone-spanning configurations. Placing the database tier virtual machines within a single Availability Set keeps them within the same physical datacenter to minimize network latency while protecting them against hardware failures through fault and update domains.

Step-by-Step Solution

1
Analyze the high availability requirements for the web tier.
The web tier requires protection against datacenter-wide outages, which necessitates the use of Availability Zones (physically separate datacenters within a region) rather than Availability Sets (logical groupings within a single datacenter).
Availability Zones offer protection from datacenter-level failures, whereas Availability Sets only protect against localized hardware failures within a single datacenter.
2
Select the correct Load Balancer SKU for the web tier.
A Standard Load Balancer must be chosen to distribute traffic to the web tier VMs across different Availability Zones.
A Basic Load Balancer does not support zone-redundant backend pools or spanning across Availability Zones.
3
Analyze the network latency requirements for the database tier.
The database tier VMs must be in the same datacenter to minimize network latency, which is achieved by deploying them in an Availability Set.
An Availability Set ensures the VMs are kept within the same physical datacenter to avoid cross-zone latency while still providing protection against hardware failures via fault and update domains.

Key Concept

Configuring VMs for high availability involves choosing between Availability Zones for zone-level resilience and Availability Sets for rack-level resilience within a single datacenter, along with matching supporting resources like the Standard Load Balancer SKU.
Estimated Time:2m 0s
Question 167Question →

An administrator is managing a standard General Purpose v2 (GPv2) storage account named `corpdatafiles` in the East US region. The storage account is currently configured to use locally redundant storage (LRS).

You need to implement the following requirements:
1. Replicate all data to a secondary region while ensuring that read access to the replicated data is available at all times, even without initiating a failover.
2. Automate the transition of block blobs in a container named `billing` to the Archive tier if the blobs have not been modified for more than 90 days.

Which two actions should you perform to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the replication setting of `corpdatafiles` to Read-access geo-redundant storage (RA-GRS).; Create a lifecycle management rule that uses the prefix filter `billing/` and includes an action to transition the blobs to the Archive tier 90 days after last modification.

Answer

To satisfy the requirements, the replication settings must be configured to Read-access geo-redundant storage (RA-GRS) and a lifecycle management rule must be created using the prefix filter `billing/` to transition the blobs to the Archive tier after 90 days.
The correct actions are to update the replication of the storage account to Read-access geo-redundant storage (RA-GRS) and to implement a lifecycle management rule with a prefix filter matching the target container. Upgrading the replication from LRS to RA-GRS can be performed directly through a configuration change, which automatically enables read access to the secondary region. Creating a lifecycle rule with the prefix `billing/` correctly targets blobs within the `billing` container, allowing them to transition to the Archive tier 90 days after modification.

Step-by-Step Solution

1
Update the storage account replication from LRS to RA-GRS.
The storage account is configured to replicate data to the paired secondary region, and the secondary endpoint becomes available for read access.
Converting LRS to RA-GRS is a supported direct conversion path that satisfies the geo-redundancy and read-access requirements without requiring a failover or live migration request.
2
Define a lifecycle management policy rule with a prefix filter for `billing/`.
The policy is scoped to target only the blobs within the `billing` container.
Specifying the container name followed by a slash matches all blobs inside that container.
3
Add a transition action to the lifecycle rule targeting block blobs.
Blobs are automatically moved to the Archive tier 90 days after their last modification date.
Lifecycle management executes transitions based on the days since last modification, helping optimize storage costs for inactive data.

Key Concept

Configuring replication settings to enable read access in the secondary region and setting up lifecycle management rules with prefix filters to transition block blobs to cheaper tiers.
Question 168Question →

A company plans to use Azure File Sync to synchronize files between an on-premises server named Server1 and an Azure file share named share1. The company has an established ExpressRoute connection between the on-premises network and Azure. To comply with security policies, all synchronization traffic must be routed over the private connection. An administrator performs the following configurations:
1. Deploys a Storage Sync Service named Sync1.
2. Creates a sync group named SyncGroup1 in Sync1, and configures share1 as the cloud endpoint.
3. Restricts network access to the storage account hosting share1 by setting public network access to disabled.
4. Creates a private endpoint for Sync1 in the Azure virtual network and configures DNS resolution for the Storage Sync Service.
5. Installs the Azure File Sync agent on Server1 and registers Server1 with Sync1.
6. Adds Server1 as a server endpoint in SyncGroup1.

After these configurations are applied, the synchronization health status for Server1 shows an error, and files fail to sync. Which action must the administrator perform to resolve this issue?

Show answer & explanation

Answer: Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.

Answer

Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.
The correct answer is correct because Azure File Sync requires connectivity to both the Storage Sync Service and the storage account hosting the target file share. When public access to the storage account is disabled, the local sync agent on Server1 cannot transfer data. Since the sync agent runs on-premises, its traffic is not covered by internal Azure bypasses. Therefore, a private endpoint for the 'file' sub-resource must be configured in the virtual network, allowing the agent to resolve the storage account's FQDN to a private IP and route the sync traffic over the ExpressRoute link.

Step-by-Step Solution

1
Identify the communication pathways required by the Azure File Sync agent.
The agent on Server1 must communicate with the Storage Sync Service (management plane) and the Storage Account (data plane).
Without connectivity to both endpoints, metadata and file data cannot be synchronized.
2
Evaluate the network connectivity settings of the storage account.
Public network access is disabled on the storage account, meaning the agent cannot connect to the default public endpoint over the Internet.
This restriction blocks all inbound traffic to the file share from the on-premises server.
3
Examine if the 'trusted services list' setting can bypass this block for the on-premises agent.
The traffic originates from the on-premises server (Server1), which does not qualify as an internal Azure trusted service.
The firewall bypass rule only applies to direct requests from internal Azure services, not to on-premises agents.
4
Determine the necessary network configuration for private routing.
Create a private endpoint for the storage account using the 'file' sub-resource on the virtual network and configure appropriate DNS resolution.
This establishes a private IP address for the storage account on the virtual network, which is reachable from Server1 over the ExpressRoute connection.

Key Concept

Azure File Sync Private Endpoint Configuration
Question 169Question →

A company has an Azure Storage account that is configured to allow network access only from 'Selected virtual networks and IP addresses'. An administrator needs to ensure that the Azure Backup service can successfully access the storage account to perform backup operations. Which network configuration change should the administrator apply to the storage account?

Show answer & explanation

Answer: Enable the exception that allows trusted Microsoft services to access the storage account.

Answer

Enable the exception that allows trusted Microsoft services to access the storage account.
Enabling the exception to allow trusted Microsoft services to access the storage account is the correct configuration. When a storage account firewall is enabled, Azure services that are defined as trusted, such as Azure Backup, can bypass the firewall restrictions if this exception is checked.

Step-by-Step Solution

1
Navigate to the Azure Storage account in the Azure Portal.
The storage account management blade is displayed.
To modify storage account network settings, you must navigate to the specific storage account resource.
2
Under the Security + networking section, select Networking.
The Firewalls and virtual networks configuration tab is opened.
This is where public network access limits, virtual network rules, IP firewalls, and resource exceptions are managed.
3
Under Exceptions, check the box for 'Allow Azure services on the trusted services list to access this storage account'.
The firewall bypass rule for trusted Microsoft services is enabled.
This exception allows services like Azure Backup to bypass the firewall and access storage resources securely.

Key Concept

Bypassing Azure Storage firewall rules for trusted Microsoft services to ensure managed platform services can access the storage data.
Estimated Time:45s
Question 170Question →

Determine whether the following statement is true or false:

In Azure Cost Management, budget alerts can be configured to trigger when forecasted costs exceed a specified threshold percentage of the budget.

Show answer & explanation

Answer: True

Answer

True
Budget alerts in Azure Cost Management support triggering based on both actual costs and forecasted costs, allowing for proactive cost management.

Step-by-Step Solution

1
Analyze the capabilities of Azure Cost Management budget alerts.
Azure budget alerts can monitor spending and notify administrators when thresholds are met.
To evaluate the statement, we must understand what parameters can trigger a budget alert.
2
Determine if budget alerts support both actual and forecasted cost evaluations.
Azure supports 'Actual' triggers (based on accumulated cost) and 'Forecasted' triggers (based on predicted trend).
This confirms whether forecasted costs are a valid alert trigger.
3
Confirm the truth value of the statement.
Since forecasted costs can trigger budget alerts, the statement is True.
To complete the evaluation of the statement.

Key Concept

Azure Budget Alert Triggers
Question 171Question →

A company's Azure environment contains the following resource hierarchy:
- Management Group: `MG-Finance`
- Subscription: `Sub-Treasury`
- Resource Group: `rg-vault`

A security principal named `AppService-SP` is assigned the Reader role at the `MG-Finance` management group level. An administrator also assigns the Contributor role to `AppService-SP` at the `rg-vault` resource group level.
A developer needs to determine the effective permissions of `AppService-SP` for a key vault named `kv-secrets` located inside `rg-vault`.
Which permissions does `AppService-SP` have for `kv-secrets`?

Show answer & explanation

Answer: Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.

Answer

Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.
The correct answer is correct because Azure RBAC role assignments are additive. A security principal's effective permissions are the sum of all roles assigned at the current scope and any inherited parent scopes. In this scenario, the Contributor role assigned at the resource group scope provides broader access than the Reader role inherited from the management group, granting Contributor-level permissions on the key vault.

Step-by-Step Solution

1
Analyze the role assignments and their respective scopes in the resource hierarchy.
Identify that the Reader role is assigned at the Management Group scope and the Contributor role is assigned at the Resource Group scope.
To evaluate how permissions propagate down the resource hierarchy.
2
Determine how permissions inherit down to the child resource.
The key vault (`kv-secrets`) inherits the Reader role from the Management Group and the Contributor role from the Resource Group.
To map all active role assignments applying to the target resource.
3
Apply the Azure RBAC additive permission model to calculate the effective permissions.
The security principal receives the combined permissions of both roles, where the broader Contributor role includes all operations, resulting in effective Contributor access.
Azure RBAC roles do not override or block each other; they accumulate to form the effective permissions.

Key Concept

Azure RBAC inheritance and additive permission model
Question 172Question →

An organization has a standard General Purpose v2 (GPv2) storage account named proddatastore configured with Geo-Redundant Storage (GRS). A lifecycle management policy is applied to proddatastore to transition logs from the Hot tier to the Archive tier after 30 days, and delete them after 90 days. An administrator is preparing a disaster recovery plan and needs to determine the behavior of the lifecycle management policy and data replication during normal operations and after a potential customer-managed failover. Which of the following statements correctly describes how Azure handles the lifecycle management policy and replication for this storage account?

Show answer & explanation

Answer: The lifecycle management policy runs only in the primary region, with all tier transitions and deletions replicated asynchronously to the secondary region; if a customer-managed failover is initiated, the lifecycle policy definition is preserved and executes in the new primary region.

Answer

The lifecycle management policy runs only in the primary region, with all tier transitions and deletions replicated asynchronously to the secondary region; if a customer-managed failover is initiated, the lifecycle policy definition is preserved and executes in the new primary region.
The correct option stating that the policy runs only in the primary region and is preserved after failover is correct because lifecycle management execution is a data plane activity that occurs on the primary endpoint, and any resulting tier changes or deletions are replicated asynchronously to the secondary region via GRS. Because the lifecycle policy definition is stored as part of the storage account's control plane configuration, it is replicated to the secondary region and remains active to execute on the new primary region after a failover.

Step-by-Step Solution

1
Analyze how lifecycle policies execute in replicated storage accounts.
Identify that lifecycle policies run on the primary endpoint, and the resulting tier updates or deletions are replicated asynchronously to the secondary region.
Lifecycle policies modify blob properties and state, which are data plane changes subject to GRS replication.
2
Evaluate the replication behavior of control plane configurations.
Determine that the policy definition is metadata stored in the storage account configuration, which is replicated to the secondary region.
Control plane metadata is synced to ensure parity between regions in the event of a failover.
3
Assess the state of the lifecycle policy post-failover.
Confirm that after a customer-managed failover, the secondary region becomes the new primary and the preserved policy continues to execute.
Because the policy configuration is replicated, no administrator action is needed to re-apply the lifecycle rules.

Key Concept

Azure Storage lifecycle policies execute on the primary region and replicate data state changes to the secondary region, while the policy configuration is preserved during failover.
Question 173Question →

AeroSpace Dynamics has a business requirement to deploy three new virtual machines, VM-Flight1, VM-Flight2, and VM-Flight3, in the West US 2 region. The deployment must protect the application from localized hardware failures within a single datacenter while minimizing latency. Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a new availability set.; Associate all three virtual machines with the availability set during their deployment.

Answer

Create a new availability set and associate all three virtual machines with the availability set during their deployment.
To protect the virtual machines from localized hardware failures within a single datacenter, the VMs must be grouped into an availability set. The availability set must be created, and the virtual machines must be associated with the availability set during their initial deployment. This ensures that the VMs are distributed across separate physical hardware racks (fault domains) and power/cooling infrastructures.

Step-by-Step Solution

1
Determine the high availability option that protects against localized hardware failures within a single datacenter.
Identify that an availability set is the appropriate solution for localized hardware failures within a single datacenter, whereas availability zones protect against datacenter-wide failures.
An availability set automatically distributes VMs across fault and update domains within a single datacenter to provide 99.95%99.95\% availability SLA.
2
Identify the creation and association rules for availability sets.
Confirm that the availability set must exist first and VMs must be assigned to it during their creation phase.
Azure does not support moving an already deployed VM into an availability set; the VM must be configured with the availability set at launch time.

Key Concept

Azure Availability Sets configuration and constraints
Question 174Question →

You need to delegate password reset permissions for a specific subset of users in your Microsoft Entra ID tenant by using an administrative unit. Which sequence of steps should you perform to complete the delegation? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first create the administrative unit in the Microsoft Entra admin center, then add the target users to the administrative unit, and finally assign the Helpdesk Administrator role to the delegated administrator scoped to the administrative unit.
To delegate management of a specific subset of users, you must first establish the scope boundary by creating an administrative unit. Next, you populate the administrative unit by adding the target users. Finally, you assign the administrative role to the delegated administrator with the scope restricted to that administrative unit. This ensures the administrator's capabilities are limited to the members of the administrative unit.

Step-by-Step Solution

1
Create the administrative unit in Microsoft Entra ID.
An administrative unit is created to act as the boundary for delegated permissions.
The container must exist before members can be added or roles can be scoped to it.
2
Add the target users to the administrative unit.
The target users are members of the administrative unit.
Members must be in the administrative unit so that the delegated administrator's scoped permissions apply to them.
3
Assign the Helpdesk Administrator role to the delegated administrator with the administrative unit as the scope.
The delegated administrator receives helpdesk permissions only for the members of the administrative unit.
This step applies the role assignment to the delegated admin, restricting their authority to the defined administrative unit scope.

Key Concept

Delegation of administrative roles using administrative units as scopes
Question 175Question →

Your company has an Azure environment with a management group named `MG-Corp` and two subscriptions named `Sub-App` and `Sub-Shared`. `Sub-Shared` contains a resource group named `RG-Monitoring` which hosts a storage account named `saexportdata`.

You need to configure Azure Cost Management to meet the following requirements:
- Automatically export daily cost data of `Sub-App` to the `saexportdata` storage account.
- Trigger an automated runbook located in `Sub-Shared` to stop non-production workloads when the monthly costs of `Sub-App` exceed 10,00010,000 USD.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: In `Sub-App`, create a budget and configure an alert threshold associated with an action group that targets the runbook.; In `Sub-App`, configure a Cost Management export that targets the `saexportdata` storage account.

Answer

The correct actions are: (1) In the source subscription, create a budget and configure an alert threshold associated with an action group that targets the runbook; and (2) In the source subscription, configure a Cost Management export that targets the storage account.
To meet the requirements, you must perform two actions. First, to automatically export daily cost data of one subscription to a storage account in another subscription within the same tenant, you can configure a Cost Management export in the source subscription pointing to the target storage account. Second, to trigger an automated runbook when the monthly cost exceeds a threshold, you must create a budget in the source subscription and configure an alert threshold (such as 100%100\%) linked to an action group that targets the runbook.

Step-by-Step Solution

1
Identify the mechanism to automate actions based on cost limits.
Determine that Azure Budgets can trigger Action Groups, which can execute Automation runbooks.
This is necessary to satisfy the requirement of stopping non-production workloads when costs exceed a threshold.
2
Determine the configuration requirements for budget alerts.
Confirm that an alert threshold must be defined to associate the budget with an Action Group.
Simply creating a budget limit without alert thresholds will not trigger any automated action.
3
Analyze how to export daily cost data to a storage account in a different subscription.
Verify that Azure Cost Management exports support cross-subscription destinations within the same Microsoft Entra tenant.
This allows exporting `Sub-App` cost data directly to `saexportdata` in `Sub-Shared`.
4
Evaluate the effect of resource locks on the storage account's resource group.
Recognize that a `ReadOnly` lock blocks `listKeys` (a POST operation) which is required for the export to write data.
This shows that applying a `ReadOnly` lock on the destination resource group will cause the export to fail.

Key Concept

Azure Cost Management budgets require alert thresholds to trigger action groups. Cost exports can target storage accounts in different subscriptions within the same tenant, but control-plane blocking configurations like `ReadOnly` locks will prevent the export from writing data by blocking key retrieval.
Question 176Question →

You configure Azure File Sync to synchronize files between an on-premises Windows Server and an Azure file share. You need to minimize local storage usage on the Windows Server by keeping only recently accessed files on the local disk. What should you configure?

Show answer & explanation

Answer: Enable cloud tiering on the server endpoint.

Answer

Enable cloud tiering on the server endpoint.
Enabling cloud tiering on the server endpoint ensures that infrequently accessed files are replaced with pointer files (stubs) locally, while the full file content is safely stored in the Azure file share, thereby reducing the local server's storage consumption.

Step-by-Step Solution

1
Analyze the technical requirement to keep only active, recently accessed files on the local Windows Server while storing the rest in the cloud.
Identify that Cloud Tiering is the specific Azure File Sync feature designed to optimize local server storage in this manner.
Cloud tiering allows the local server to act as a cache of the full dataset stored in the cloud.
2
Identify the resource configuration location where cloud tiering is enabled.
Cloud tiering must be enabled on the server endpoint within the sync group.
The server endpoint represents the specific path on the registered server where syncing occurs.

Key Concept

Azure File Sync Cloud Tiering
Question 177Question →

Your company has a Microsoft Entra ID tenant named contoso.com that has Microsoft Entra ID P1 licenses assigned to all users. You configure Self-Service Password Reset (SSPR) for the tenant with the following settings:

* Self-service password reset enabled: Selected
* Select group: Group1
* Number of methods required to reset: 1
* Methods available to users: Email, Security questions

`Group1` contains the following users:
* User1: A standard member user who is not assigned any administrator roles.
* User2: A member user assigned the Helpdesk Administrator role.
* User4: A B2B guest user whose identity is managed in an external Microsoft Entra ID tenant.

`User3` is a member user assigned the User Administrator role. `User3` is not a member of `Group1`.

All four users have registered their corporate email address and security questions as authentication methods in contoso.com.

Which users can successfully reset their password by using the SSPR portal of contoso.com?

Show answer & explanation

Answer: User1 only

Answer

Only User1 can successfully reset their password.
The correct option is the one stating that only User1 can reset their password. User1 is a standard user scoped to the SSPR policy who has registered the one required method (email). Administrators (User2 and User3) bypass group scoping but are restricted by the default administrator policy requiring two gates, which also excludes security questions. B2B guest users (User4) cannot reset their credentials in the host tenant.

Step-by-Step Solution

1
Evaluate SSPR scope and requirements for the standard user (User1).
User1 is a member of Group1 and holds no admin roles. The scoped SSPR policy applies, requiring 1 method. Since User1 has registered their email (which is an enabled method), User1 can successfully reset their password.
Standard users are governed by the tenant's scoped SSPR policy.
2
Evaluate SSPR requirements for the administrator users (User2 and User3).
Both User2 (Helpdesk Administrator) and User3 (User Administrator) are governed by the default Microsoft Entra ID administrator SSPR policy. This policy automatically applies to administrators, requires two gates (authentication methods), and explicitly excludes security questions as a valid gate. Since both users only have email and security questions registered, they only possess one valid gate (email) and cannot reset their passwords.
Administrators require a two-gate reset process and cannot use security questions.
3
Evaluate SSPR requirements for the B2B guest user (User4).
User4 is an external B2B guest user whose source of authority is an external Microsoft Entra ID tenant. They cannot reset their password in the host tenant's SSPR portal and must do so at their home identity provider.
SSPR in a host tenant is not supported for B2B collaboration users whose credentials are managed by an external identity provider.

Key Concept

Microsoft Entra ID enforces a default two-gate SSPR policy for administrator roles that bypasses group scoping, requires two valid methods, and excludes security questions. Additionally, external B2B guest users cannot use the host tenant's SSPR portal if their credentials are managed by an external identity provider.
Question 178Question →

You manage a Microsoft Entra ID tenant. You have the following users configured in the tenant:

UserDepartmentUserType
User1SalesMember
User2salesMember
User3MarketingMember
User4SalesGuest

You create a dynamic user group named SalesGroup and configure the dynamic membership rule for SalesGroup as follows:

`(user.department -eq "Sales") -and (user.userType -ne "Guest")`

Which users are members of SalesGroup?

Show answer & explanation

Answer: User1 and User2 only

Answer

User1 and User2 only
The correct answer is the option stating 'User1 and User2 only'. In Microsoft Entra ID, dynamic membership rules evaluate string attributes without case sensitivity, so 'Sales' matches both 'Sales' and 'sales'. Since both User1 and User2 are members, and User4 is a guest, they are the only users matching both conditions of the rule.

Step-by-Step Solution

1
Evaluate the department condition: `user.department -eq "Sales"`.
User1, User2, and User4 match.
Microsoft Entra ID dynamic group membership rules perform case-insensitive string comparisons. Therefore, both 'Sales' and 'sales' satisfy this condition, while 'Marketing' does not.
2
Evaluate the user type condition: `user.userType -ne "Guest"`.
User1 and User2 match.
The `-ne` operator means 'not equal'. User1 and User2 have a UserType of 'Member', which satisfies this condition. User4 has a UserType of 'Guest', so they are excluded.
3
Combine the results of both conditions using the logical `-and` operator.
Only User1 and User2 satisfy both conditions.
The logical `-and` operator requires both parts of the rule to evaluate to true for a user to be included.

Key Concept

Microsoft Entra ID dynamic group membership rules use case-insensitive string comparisons and logical operators to determine group membership.
Estimated Time:1m 30s
Question 179Question →

An organization's Microsoft Entra ID tenant contains the following resources:
- An administrative unit named Office-AU
- A user named Admin1 who is assigned the User Administrator role scoped to Office-AU
- A user named User1 who is a member of Office-AU
- A dynamic user group named Group1 with the membership rule: (user.jobTitle -eq "Specialist")
- A group-based licensing configuration on Group1 that assigns a Microsoft 365 E5 license

User1 has the Job Title set to Specialist, but the Usage Location property is blank. As a result, User1 is automatically added as a member of Group1, but has a licensing assignment state of UsageLocationRequired.

You need to resolve the licensing error and ensure that User1 receives the Microsoft 365 E5 license.

Which action should you perform?

Show answer & explanation

Answer: Have Admin1 update the Usage Location property of User1.

Answer

Have Admin1 update the Usage Location property of User1.
The correct action is to update the Usage Location property of the user. Because the user is a member of the administrative unit, the delegated User Administrator has the required directory permissions to edit the user's properties. Once the Usage Location is set, Microsoft Entra ID automatically processes the pending license assignment.

Step-by-Step Solution

1
Identify the cause of the licensing failure.
The licensing failure is caused by a missing Usage Location on User1, which is a prerequisite for assigning Microsoft 365 licenses.
Microsoft 365 licenses cannot be assigned to users who do not have a Usage Location configured.
2
Determine the administrative permissions required to update the user's properties.
Admin1 is a User Administrator scoped to the Office-AU administrative unit, and User1 is a member of Office-AU.
An administrative unit scopes directory permissions, allowing the delegated administrator to manage properties of users within that unit.
3
Verify if the administrator can update the user's profile.
Admin1 can update User1's Usage Location to a valid country code.
Once the Usage Location is set, Microsoft Entra ID automatically processes the group-based license assignment for the user.

Key Concept

Administrative Unit scoping and Group-based licensing troubleshooting
Estimated Time:2m 0s
Question 180Question →

Aether Financial plans to deploy a new transaction application in the Australia East region. The application will run on two virtual machines named VM-Tx1 and VM-Tx2. The application architecture must meet the following requirements:

- Protect the virtual machines from datacenter-wide failures.
- Guarantee a virtual machine SLA of at least 99.99%99.99\%.

Which two options should you select to meet the requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM-Tx1 in Availability Zone 11 and VM-Tx2 in Availability Zone 22.; Configure a Standard SKU Load Balancer to distribute traffic across the virtual machines.

Answer

Deploy the virtual machines in separate Availability Zones and configure a Standard SKU Load Balancer to distribute traffic across them.
To satisfy the requirements of protecting the virtual machines from datacenter-wide failures and achieving a 99.99%99.99\% SLA, you must deploy the virtual machines across different Availability Zones. Furthermore, because the virtual machines reside in different Availability Zones, a Standard SKU Load Balancer must be configured to distribute incoming traffic, as a Basic SKU Load Balancer does not support routing to backend resources across multiple zones.

Step-by-Step Solution

1
Analyze the high availability and SLA constraints.
The requirements dictate protection against datacenter-wide failures and a minimum virtual machine SLA of 99.99%99.99\%.
Availability Zones provide 99.99%99.99\% SLA by isolating virtual machines in physically separate datacenters within a region, whereas Availability Sets only protect against failures inside a single datacenter (99.95%99.95\% SLA).
2
Select the correct deployment model for the virtual machines.
VM-Tx1 must be deployed in one Availability Zone (such as Zone 11) and VM-Tx2 in another Availability Zone (such as Zone 22).
Distributing the virtual machines across different Availability Zones satisfies the datacenter-wide failure protection and the 99.99%99.99\% SLA requirements.
3
Identify the required load balancer SKU to distribute traffic across the zones.
Use a Standard SKU Load Balancer.
Only a Standard SKU Load Balancer supports backend pools containing virtual machines distributed across different Availability Zones. A Basic SKU Load Balancer is restricted to virtual machines in the same availability set or VMSS.

Key Concept

Azure Availability Zones and Load Balancer SKU Requirements for High Availability
PreviousPage 9 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin