Examkin

All practice questions

429 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 1Question →

An administrator is planning to deploy a new Azure Kubernetes Service (AKS) cluster named `aks-finance`. The cluster must integrate with an on-premises network, and pods must be directly reachable from the on-premises network using their own IP addresses from the Azure Virtual Network (VNet) without any network address translation (NAT). The network security team has allocated a small subnet with a /24/24 prefix for the cluster nodes, but wants to ensure that pod deployments do not quickly exhaust the IP addresses in this node subnet.

Which two configuration options should the administrator select to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the cluster to use the Azure CNI network plugin.; Enable dynamic pod IP allocation to allocate pod IP addresses from a separate subnet.

Answer

Configure the cluster to use the Azure CNI network plugin and enable dynamic pod IP allocation to allocate pod IP addresses from a separate subnet.
To ensure pods have direct connectivity to the on-premises network without NAT, the Azure CNI network plugin must be used since it assigns VNet IPs directly to pods. To prevent the node subnet from being exhausted by pod IP allocations, dynamic pod IP allocation should be enabled. This allows nodes and pods to reside in different subnets, ensuring that the node subnet is not exhausted by the pod density.

Step-by-Step Solution

1
Identify the routing requirement for pods to be reachable from on-premises without NAT.
Determine that the Azure CNI network plugin must be used. Azure CNI provides native VNet IP addresses directly to pods, allowing them to be reachable from peered networks or on-premises networks without network address translation.
Kubenet and Azure CNI Overlay both use a private address space for pods and utilize NAT at the node level for outbound traffic, which prevents direct inbound routing to pods.
2
Address the subnet capacity constraint where nodes are allocated a small /24/24 subnet.
Select dynamic pod IP allocation to split nodes and pods into separate subnets.
By default, Azure CNI pre-allocates VNet IP addresses from the same subnet for every node and its maximum pods, leading to rapid IP exhaustion. Dynamic pod IP allocation allows pods to draw from a separate subnet, protecting the node subnet from exhaustion.

Key Concept

Azure CNI vs Kubenet, and Dynamic Pod IP Allocation in Azure Kubernetes Service (AKS)
Question 2Question →

You have an Azure subscription that contains an Azure Storage account named storage1. You need to configure a Log Search alert rule that triggers when there are more than 100 failed access attempts within 5 minutes. When the alert triggers, you must meet the following requirements:
1. Automatically disable public network access on storage1 to mitigate the security risk.
2. Send an email notification to the Security Operations team.

Which two actions should you configure in the Azure Monitor Action Group associated with the alert rule? (Select two.)

Select all that apply

Show answer & explanation

Answer: An Email/SMS/Push/Voice action configured with the email address of the Security Operations team.; An Azure Logic App action configured to run a workflow that updates the network rules of storage1.

Answer

Configure an Email/SMS/Push/Voice action with the email of the Security Operations team, and configure an Azure Logic App action to run a workflow that updates the network rules of storage1.
To satisfy both requirements, you configure the action group with two distinct actions. The email notification is configured using the Email/SMS/Push/Voice action type. The automated security mitigation is achieved using the Azure Logic App action type, which executes a workflow to modify the storage account's network rules.

Step-by-Step Solution

1
Identify the notification requirement.
An Email/SMS/Push/Voice action type is standard for sending direct emails to an operations or security team.
This satisfies the requirement to send an email notification to the Security Operations team.
2
Identify the remediation requirement.
An Azure Logic App (or Azure Automation Runbook) can be used to execute API calls or scripts to modify resource configurations.
This satisfies the requirement to automatically disable public network access on storage1.
3
Differentiate between Action Group actions and other Azure Monitor configuration options.
Alert processing rules adjust alert routing/suppression, and diagnostic settings handle log forwarding. Neither acts as a remediation action within an Action Group.
This rules out the incorrect options.

Key Concept

Azure Monitor Action Groups support various action types including notification types (Email/SMS/Push/Voice) and automation/remediation types (Logic Apps, Automation Runbooks, Azure Functions, Webhooks) to respond to alerts.
Question 3Question →

You are deploying a new Azure Kubernetes Service (AKS) cluster named `aks-finance` into an existing Azure virtual network. The deployment must meet the following requirements:

* The Kubernetes pods must receive IP addresses directly from a dedicated subnet in the virtual network, distinct from the subnet used by the cluster nodes.
* User application workloads must not run on the same virtual machines as the cluster's system pods.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the cluster to use Azure CNI with dynamic pod IP allocation.; Apply the CriticalAddonsOnly=true:NoSchedule taint to the system node pool.

Answer

Configure the cluster to use Azure CNI with dynamic pod IP allocation, and apply the CriticalAddonsOnly=true:NoSchedule taint to the system node pool.
Configuring Azure CNI with dynamic pod IP allocation allows pods to be assigned IP addresses from a dedicated subnet that is separate from the node subnet. Applying the CriticalAddonsOnly=true:NoSchedule taint to the system node pool ensures that only system pods, which have the appropriate tolerations, can be scheduled on the system nodes, thereby isolating user workloads.

Step-by-Step Solution

1
Select the appropriate network configuration to assign pod IPs from a separate subnet.
Identify that Azure CNI with dynamic pod IP allocation meets this requirement by separating node and pod subnets.
Standard Azure CNI and Kubenet do not support allocating pod IPs from a separate virtual network subnet without utilizing dynamic allocation.
2
Select the configuration to prevent user workloads from running on system nodes.
Identify that applying the CriticalAddonsOnly=true:NoSchedule taint to the system node pool isolates it.
Kubernetes uses taints and tolerations to restrict which pods can run on specific nodes. The CriticalAddonsOnly taint specifically targets user workloads.

Key Concept

Azure Kubernetes Service (AKS) networking options (Azure CNI with dynamic IP allocation) and workload isolation using taints.
Question 4Question →

Aetheris Logistics is planning the deployment of a new line-of-business application in the East US 2 region. The architecture consists of three web tier virtual machines (VM-Web-Prod1, VM-Web-Prod2, and VM-Web-Prod3) and two database tier virtual machines (VM-DB-Prod1 and VM-DB-Prod2).

The deployment must satisfy the following requirements:
- The web tier must achieve a service level agreement (SLA) of at least 99.99%99.99\% virtual machine uptime and be resilient against datacenter-wide failures.
- The database tier must be protected against localized hardware failures, such as server rack or power outages, within a single datacenter. The database tier does not require zone-wide redundancy.
- All high availability configurations must be applied during the initial deployment phase.

Which two configuration actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy VM-Web-Prod1, VM-Web-Prod2, and VM-Web-Prod3 across three separate Availability Zones.; Deploy VM-DB-Prod1 and VM-DB-Prod2 in a new Availability Set.

Answer

Deploying the web tier virtual machines across three separate Availability Zones, and deploying the database tier virtual machines in a new Availability Set.
To achieve a 99.99%99.99\% uptime SLA and protect the web tier against datacenter-wide failures, the web VMs must be distributed across separate Availability Zones. To protect the database tier against localized hardware failures (like a rack failure) within a single datacenter without requiring zone redundancy, the database VMs must be deployed in an Availability Set. Both configurations must be specified at the time of virtual machine creation.

Step-by-Step Solution

1
Analyze the high availability and SLA requirements for the web tier VMs (VM-Web-Prod1, VM-Web-Prod2, VM-Web-Prod3).
The web tier requires a 99.99%99.99\% uptime SLA and resilience against datacenter-wide outages.
This requirement determines that Azure Availability Zones must be used, as Availability Zones provide isolation across separate physical datacenters within a region and support the 99.99%99.99\% SLA.
2
Analyze the high availability requirements for the database tier VMs (VM-DB-Prod1, VM-DB-Prod2).
The database tier requires protection against localized hardware failures (such as server rack or power outages) but does not need zone-wide redundancy.
An Availability Set meets this requirement by distributing VMs across multiple physical hardware racks (fault domains) and maintenance groups (update domains) within a single datacenter, providing a 99.95%99.95\% SLA.
3
Evaluate the feasibility of combining Availability Zones and Availability Sets for the web tier.
Determine that placing VMs in both Availability Zones and a single Availability Set is invalid.
Availability Zones and Availability Sets are mutually exclusive configuration options during VM deployment. An Availability Set cannot span across multiple Availability Zones.
4
Evaluate the timing requirements for configuring the Availability Set for the database tier.
Determine that the database VMs must be placed in the Availability Set during creation.
Azure does not support adding an existing, deployed standalone virtual machine to an Availability Set. It must be configured during the VM creation process.

Key Concept

Azure Virtual Machine High Availability configurations, specifically the features, limitations, and mutual exclusivity of Availability Zones and Availability Sets.
Question 5Question →

You manage the network security for an Azure environment. You have a storage account named `corpdata2026` with its firewall configured to deny all public network traffic by default. The environment contains a virtual network named `VNet1` with two subnets: `SubnetA` and `SubnetB`. You must implement a solution that satisfies the following requirements:
- Virtual machines in `SubnetA` must be able to securely transfer data to `corpdata2026` over its public endpoint without routing traffic over the public internet.
- Virtual machines in `SubnetB` must not have any network access to `corpdata2026`.
- The Azure Backup service must be able to perform scheduled backups of the file shares in `corpdata2026`.
- No private endpoints can be deployed due to IP address space constraints in `VNet1`.

Which two configuration actions should you perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enable the Microsoft.Storage service endpoint on SubnetA and add a virtual network rule for SubnetA to the firewall of corpdata2026.; Select the exception that allows trusted Microsoft services to access the storage account in the firewall settings of corpdata2026.

Answer

Enable the Microsoft.Storage service endpoint on SubnetA, add a virtual network rule for SubnetA to the firewall of corpdata2026, and select the exception that allows trusted Microsoft services to access the storage account in the firewall settings of corpdata2026.
To securely connect SubnetA to the storage account over its public endpoint without traversing the public internet, a virtual network service endpoint for Microsoft.Storage must be enabled on SubnetA, and SubnetA must be allowed in the virtual network rules of the storage account firewall. To allow Azure Backup to access the restricted storage account, the 'Allow trusted Microsoft services to access this storage account' firewall exception must be enabled.

Step-by-Step Solution

1
Enable the service endpoint for Microsoft.Storage on the target subnet.
Traffic from SubnetA destined for Azure Storage is routed through the Microsoft backbone network instead of the public internet.
This is a prerequisite for adding a virtual network rule to the storage account firewall.
2
Add a virtual network rule to the firewall of corpdata2026 targeting SubnetA.
The storage account accepts traffic originating from SubnetA while continuing to deny all other public networks.
This permits VMs in SubnetA to access the storage account, while VMs in SubnetB remain blocked since SubnetB is not added to the virtual network rules.
3
Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account firewall.
The Azure Backup service can securely access the storage account resources to perform backup tasks.
Azure Backup is a trusted Microsoft service and requires this network exception to bypass the firewall when public access is restricted.

Key Concept

Azure Storage firewalls allow restricting access to specific virtual networks using Service Endpoints and allowing trusted Microsoft services via built-in exceptions.
Question 6Question →

Your organization uses the following Azure resource hierarchy:
* A Management Group named Corp-MG.
* Two subscriptions under Corp-MG named Prod-Sub and Dev-Sub.
* Prod-Sub contains two resource groups: RG-Core and RG-Data.
* Dev-Sub contains a resource group named RG-Dev.

The following Azure Policy configurations are in place:

ScopeAssignment / Policy DetailEffectAllowed/Required ValuesExclusions
Corp-MGInitiative Gov-Initiative containing:
- VM SKU restriction policy
- Resource tag enforcement policy		Deny
Deny
- Standard_D2s_v3, Standard_D4s_v3
- Tag Environment must exist		None
Prod-SubPolicy Region-RestrictionDenyEast US, West USRG-Data

You need to identify which resource deployment attempts will succeed.

Which two deployment attempts will complete successfully? (Select two.)

Select all that apply

Show answer & explanation

Answer: A Standard_D2s_v3 virtual machine deployed to RG-Data in North Europe with the tag Environment set to Production.; A Standard_D4s_v3 virtual machine deployed to RG-Core in East US with the tag Environment set to Production.

Answer

The two successful deployments are: (1) A Standard_D2s_v3 virtual machine deployed to RG-Data in North Europe with the tag Environment set to Production, and (2) A Standard_D4s_v3 virtual machine deployed to RG-Core in East US with the tag Environment set to Production.
The correct deployments are those that satisfy the management group VM SKU and tag requirements, while also respecting the subscription region limits or qualifying for their exclusions. Specifically, the Standard_D2s_v3 VM deployed to RG-Data in North Europe with the Environment tag succeeds because the VM SKU and tags are valid, and RG-Data is excluded from the region restrictions. The Standard_D4s_v3 VM in RG-Core (East US) succeeds because its SKU, region, and tags are all within the allowed limits.

Step-by-Step Solution

1
Evaluate the management group (Corp-MG) policy constraints for all deployment attempts.
The Corp-MG level policy requires the VM SKU to be either Standard_D2s_v3 or Standard_D4s_v3, and requires the Environment tag to be present. This blocks the attempt using Standard_B2s and the attempt without any tags.
Since both subscriptions inherit from Corp-MG, all resources under them must comply with these policies.
2
Evaluate the subscription-level (Prod-Sub) region-restriction policy for the remaining attempts.
The subscription policy restricts deployments to East US and West US, but excludes RG-Data. Therefore, a VM deployed in RG-Core must be in East US or West US, whereas a VM deployed in RG-Data can be in any region (such as North Europe).
Policy exclusions exempt the specified scopes from the policy assignment's evaluation rules.
3
Verify which deployments satisfy all applicable inherited and scope-specific policies.
The Standard_D2s_v3 VM in RG-Data (North Europe) succeeds due to the exclusion. The Standard_D4s_v3 VM in RG-Core (East US) succeeds because it complies with the region rule and all other inherited rules.
Only deployments that do not trigger a 'Deny' action from any active policy assignments will be allowed to complete.

Key Concept

Azure Policy evaluation logic takes into account hierarchical inheritance (from Management Groups down to Resource Groups) and respects explicit exclusions configured on individual policy assignments.
Question 7Question →

An organization has the following Azure resource hierarchy:
* Tenant Root Group (Management Group)
* MG-Platform (Management Group)
* Sub-Connectivity (Subscription)
* RG-HubNet (Resource Group)
* MG-Apps (Management Group)
* Sub-App01 (Subscription)
* RG-AppLogic (Resource Group)
* RG-AppData (Resource Group)

You have a security group named DatabaseOps-SG. The members of this group must be able to perform the following tasks:
* Manage Azure SQL servers and databases within RG-AppData.
* Read and write database backup blobs directly in a storage account located in RG-AppData.
* View virtual networks and subnet configurations within RG-HubNet to assist with database private endpoint configuration.

The solution must follow the principle of least privilege.

Which three role assignments should you configure? (Select three).

Select all that apply

Show answer & explanation

Answer: Assign SQL Server Contributor to DatabaseOps-SG at the RG-AppData scope; Assign Storage Blob Data Contributor to DatabaseOps-SG at the RG-AppData scope; Assign Reader to DatabaseOps-SG at the RG-HubNet scope

Answer

Assign SQL Server Contributor at the RG-AppData scope, Storage Blob Data Contributor at the RG-AppData scope, and Reader at the RG-HubNet scope.
The correct role assignments are SQL Server Contributor at the RG-AppData scope, Storage Blob Data Contributor at the RG-AppData scope, and Reader at the RG-HubNet scope. The SQL Server Contributor role allows managing SQL servers and databases within the specific resource group without subscription-wide access. The Storage Blob Data Contributor role is required because standard control-plane roles (such as Contributor) do not grant permissions to read and write blobs directly. Assigning the Reader role at the RG-HubNet scope allows viewing the network infrastructure required to set up private endpoints without granting permissions to modify the network.

Step-by-Step Solution

1
Identify the required control plane roles for SQL Database management.
SQL Server Contributor at the RG-AppData scope.
This role allows database and server management at the minimum required resource group scope.
2
Identify the required data plane roles for Blob Storage access.
Storage Blob Data Contributor at the RG-AppData scope.
Control plane roles do not grant access to Blob data, so a data plane role is required.
3
Identify the required permissions for viewing network configurations.
Reader at the RG-HubNet scope.
This permits viewing the virtual network configurations in the connectivity subscription without modify permissions.

Key Concept

Azure RBAC utilizes separate roles for control plane and data plane operations and enforces scope inheritance down the resource hierarchy.
Estimated Time:2m 30s
Question 8Question →

An administrator is configuring secure access to a blob container named compliance-records in an Azure Storage account named auditstoreprod. An external auditing application requires read-only access to the blobs. Security policy dictates that storage account access keys must not be used, and access must be authenticated using Microsoft Entra ID credentials. The connection must be restricted to the IP range 198.51.100.0/24 and must use HTTPS only. Which two configuration actions should you perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Generate a User Delegation SAS signed with a user delegation key acquired using Microsoft Entra ID credentials.; Configure the SAS token parameters to restrict access to the IP address range 198.51.100.0/24 and set the allowed protocol to HTTPS only.

Answer

Generate a User Delegation SAS signed with a user delegation key acquired using Microsoft Entra ID credentials, and configure the SAS token parameters to restrict access to the IP address range 198.51.100.0/24 and set the allowed protocol to HTTPS only.
To meet the security requirements, a User Delegation SAS must be generated because it is signed with Microsoft Entra ID credentials rather than the storage account keys. Furthermore, the IP address constraints and HTTPS protocol must be configured directly within the SAS token parameters to restrict access. A User Delegation SAS has a maximum lifetime of 7 days, and control plane roles like Reader do not grant data plane read access.

Step-by-Step Solution

1
Determine the type of SAS to generate based on signing requirements.
Identify that a User Delegation SAS must be used.
Security policy prohibits the use of storage account access keys, requiring Microsoft Entra ID credentials for signing.
2
Configure the network and protocol parameters on the SAS token.
Set allowed IP addresses to 198.51.100.0/24 and protocol to HTTPS-only.
Enforces network source restrictions and transport security constraints directly within the token.
3
Verify token lifetime parameters.
Ensure the token validity does not exceed 7 days.
The underlying user delegation key is restricted to a maximum lifetime of 7 days.

Key Concept

Configuring a User Delegation SAS with security constraints such as allowed IP ranges and HTTPS-only protocols, and understanding its lifetime limitations.
Question 9Question →

An administrator is configuring autoscaling for an Azure Virtual Machine Scale Set named `vmss-api`. The scale set must meet the following requirements:
- Maintain a baseline of 22 instances under normal conditions.
- Scale out by 22 instances if CPU usage exceeds 80%80\% for 1010 minutes.
- Maintain a fixed count of 66 instances every weekday (Monday through Friday) between 09:0009:00 and 17:0017:00 to handle business traffic.

Which two configurations should the administrator implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: A default autoscale profile containing a metric-based scale-out rule that increases the instance count when CPU usage exceeds 80%80\%.; A recurring autoscale profile active Monday through Friday from 09:0009:00 to 17:0017:00, with the minimum, maximum, and default capacity all set to 66.

Answer

To meet the requirements, the administrator must implement a default autoscale profile containing a metric-based scale-out rule for the CPU threshold, and a recurring autoscale profile active Monday through Friday from 09:0009:00 to 17:0017:00 with the minimum, maximum, and default capacity all set to 66.
The correct configurations involve creating a default autoscale profile to manage the baseline capacity of 22 instances and run the metric-based scale-out rule based on CPU usage, alongside a recurring autoscale profile that overrides the default settings during business hours (Monday through Friday, 09:0009:00 to 17:0017:00) by setting the minimum, maximum, and default capacity to 66 to maintain a fixed count.

Step-by-Step Solution

1
Define the default autoscale profile.
The default profile is configured with a minimum capacity of 22, and includes a scale-out rule that triggers when CPU usage exceeds 80%80\% for 1010 minutes.
This ensures that under normal conditions (outside of business hours), the scale set maintains a baseline of 22 instances and can scale out if load increases.
2
Define the recurring autoscale profile.
A recurring profile is created for Monday through Friday from 09:0009:00 to 17:0017:00, with minimum, maximum, and default capacity values set to 66.
Setting the minimum, maximum, and default capacities to the same value forces the scale set to scale to exactly 66 instances during the recurring schedule, ignoring the metric-based rules of the default profile.
3
Configure profile precedence in Azure Autoscale.
The recurring profile takes precedence over the default profile during its scheduled hours.
Azure Autoscale automatically prioritizes active scheduled or recurring profiles over the default profile, ensuring the scale set behavior transitions seamlessly between the two profiles.

Key Concept

Azure Autoscale Profiles
Question 10Question →

You manage an Azure environment containing a virtual network named VNet1. VNet1 has two subnets: SubnetA and SubnetB. SubnetA has the Microsoft.Storage service endpoint enabled. You have an Azure Storage Account named storage1. You need to implement a network security configuration for storage1 to meet the following requirements:

1. Virtual machines in SubnetA must be able to access storage1 over the public endpoint of the storage account using the Azure backbone network.
2. Virtual machines in SubnetB must be able to access storage1 using a private IP address within VNet1.
3. Azure Backup must be able to back up the data stored in storage1 successfully.

Which three actions should you perform? (Choose three.)

Select all that apply

Show answer & explanation

Answer: On the firewall settings of storage1, configure the public network access to be enabled from selected virtual networks and IP addresses, and add SubnetA.; Create a private endpoint for storage1 in SubnetB.; Configure the firewall of storage1 to allow trusted Microsoft services to access this storage account.

Answer

To meet the requirements, you must allow access from SubnetA by adding it to the allowed virtual networks on the storage firewall, create a private endpoint for the storage account in SubnetB to provide a private IP address, and enable the 'Allow trusted Microsoft services to access this storage account' bypass option to allow Azure Backup to function.
To satisfy all requirements: 1. The firewall of the storage account must be configured to allow access from selected networks, specifically adding the subnet that has the service endpoint enabled. 2. A private endpoint must be created in the subnet without the service endpoint, which projects a private IP address into that subnet for secure private access. 3. The exception to allow trusted Microsoft services to access the storage account must be enabled to ensure Azure Backup can access the account despite firewall restrictions.

Step-by-Step Solution

1
Configure virtual network rules for SubnetA
Allows virtual machines in SubnetA to access storage1 over its public endpoint using the Azure backbone network via the existing service endpoint.
Required to satisfy the first requirement for SubnetA access over the public endpoint.
2
Provision a private endpoint in SubnetB
Assigns a private IP address from SubnetB's address space to storage1.
Required to satisfy the second requirement for private IP access from SubnetB.
3
Enable the trusted Microsoft services bypass on storage1
Permits Azure Backup to bypass the storage firewall and access the data.
Required to satisfy the third requirement for Azure Backup operation when the public network access is restricted.

Key Concept

Azure Storage firewall rules, Service Endpoints, and Private Endpoints

Alternative Method

Instead of using a service endpoint for SubnetA, you could also configure a private endpoint for SubnetA, but this does not satisfy the specific requirement to access the storage account over its public endpoint using the Azure backbone network.
Estimated Time:2m 0s
Question 11Question →

Apex Genomics plans to deploy a new critical genomic sequencing analysis portal. The application tier will consist of four virtual machines. The design must meet the following requirements:
- Protect the application tier from datacenter-level failures.
- Provide a 99.99%99.99\% SLA for the virtual machines.
- Support load balancing using an Azure Load Balancer.

You need to configure the virtual machines for high availability.

Which two configurations should you implement? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy the virtual machines across multiple Availability Zones in the West US 3 region.; Associate the virtual machines with a Standard SKU Azure Load Balancer.

Answer

Deploy the virtual machines across multiple Availability Zones in the West US 3 region, and associate the virtual machines with a Standard SKU Azure Load Balancer.
To protect against datacenter-level failures and achieve a 99.99%99.99\% SLA, virtual machines must be deployed across physically separate Availability Zones. Additionally, because the VMs are deployed across different Availability Zones, a Standard SKU Azure Load Balancer must be used since the Basic SKU does not support cross-zone backend distribution.

Step-by-Step Solution

1
Analyze the high availability and SLA requirements.
Datacenter-level protection and a 99.99%99.99\% SLA require deploying virtual machines across physically isolated Availability Zones rather than logical Availability Sets.
Availability Zones provide isolation against datacenter failures and guarantee a 99.99%99.99\% SLA, whereas Availability Sets only protect against rack-level/hardware failures within a single datacenter and offer a 99.95%99.95\% SLA.
2
Determine the load balancing requirements for zonal VM deployments.
A Standard SKU Azure Load Balancer is selected.
Basic SKU Load Balancers cannot distribute traffic to virtual machines residing in multiple Availability Zones, making Standard Load Balancer mandatory for zone-redundant backend configurations.

Key Concept

Azure virtual machine high availability configurations: Availability Zones provide datacenter-level redundancy and a 99.99%99.99\% SLA, which requires a Standard SKU Load Balancer.
Question 12Question →

An administrator is managing a standard general-purpose v2 storage account named storage1. The storage account currently uses Locally Redundant Storage (LRS) and contains a blob container named archive.

The administrator needs to meet the following requirements:
1. Ensure the storage account is replicated to a secondary region to protect against regional outages.
2. Automatically move blobs in the archive container to the Archive storage tier if they have not been modified for more than 90 days.

Which two actions should the administrator perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Change the replication setting of the storage account to Geo-redundant storage (GRS) in the storage account configuration.; Create a lifecycle management rule that includes a prefix match filter of archive/ and a rule action to transition blobs to the Archive tier after 90 days.

Answer

To meet the requirements, the administrator must change the replication of the storage account to Geo-redundant storage (GRS) and create a lifecycle management rule with a prefix match of archive/ to transition the blobs to the Archive tier after 90 days.
To protect against regional outages, the replication configuration of the storage account must be modified to Geo-redundant storage (GRS), which is a supported self-service change. To automate the transition of blobs to the Archive tier after 90 days, a lifecycle management rule is required. The prefix filter for the container must be defined starting directly with the container name (e.g., 'archive/') and cannot start with a leading slash.

Step-by-Step Solution

1
Navigate to the configuration blade of the storage account in the Azure portal and change the replication setting.
The replication configuration of the storage account is changed from LRS to GRS.
GRS replicates the data asynchronously to a secondary region, providing protection against regional outages. This conversion path is supported directly without a support request.
2
Create a lifecycle management rule under the Lifecycle Management blade of the storage account.
A new lifecycle management policy rule is defined.
Lifecycle management rules allow automating transitions to colder tiers and deleting blobs based on their modification age.
3
Configure the rule's prefix filter to target the archive container using 'archive/' and set the transition action to Archive tier after 90 days.
The rule is scoped to target only the blobs in the archive container and transition them to the Archive tier.
The prefix filter must start with the container name and must not contain a leading slash. Setting the days after modification to 90 satisfies the lifecycle requirement.

Key Concept

Configuring Geo-redundant storage replication conversion and setting up Azure Blob Storage Lifecycle Management rules using prefix matching.
Question 13Question →

You are planning the replication configuration for a new Azure Storage account. The storage account must meet the following requirements:

* Provide protection against a datacenter failure within the primary region by replicating data across three availability zones.
* Provide protection against a regional disaster by replicating data to a secondary region.

Which two replication options should you select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Geo-zone-redundant storage (GZRS); Read-access geo-zone-redundant storage (RA-GZRS)

Answer

Geo-zone-redundant storage (GZRS) and Read-access geo-zone-redundant storage (RA-GZRS)
The correct options are Geo-zone-redundant storage (GZRS) and Read-access geo-zone-redundant storage (RA-GZRS). Both options synchronously replicate data across three availability zones in the primary region, protecting against datacenter failures, and then asynchronously replicate the data to a secondary region for disaster recovery.

Step-by-Step Solution

1
Analyze the primary region redundancy requirement.
The requirement to protect against datacenter failure by replicating across three availability zones requires zone-redundant storage (ZRS) replication in the primary region.
Locally-redundant storage (LRS) only replicates within a single datacenter, whereas ZRS replicates across three zones.
2
Analyze the secondary region disaster recovery requirement.
The requirement to replicate to a secondary region requires geo-replication.
Only GRS, RA-GRS, GZRS, and RA-GZRS replicate data to a secondary region.
3
Select the configurations that meet both requirements.
Combining primary zone-redundancy (ZRS) and secondary geo-redundancy leads to Geo-zone-redundant storage (GZRS) and Read-access geo-zone-redundant storage (RA-GZRS).
Both GZRS and RA-GZRS offer zone redundancy in the primary region and copy data to a secondary region.

Key Concept

Combining zone-redundant storage (ZRS) with geo-redundancy to achieve Geo-zone-redundancy in Azure Storage replication.
Question 14Question →

An administrator is configuring a General Purpose v2 (GPv2) storage account named corpstore01 in the East US region. The storage account currently uses Locally Redundant Storage (LRS) and hosts critical application logs. The administrator must meet the following requirements:

- Replicate the storage account to the West US region to protect against regional outages while allowing read access to the replicated data in West US under normal operations.
- Automatically move block blobs inside the container named telemetry that begin with the prefix daily/ to the Archive storage tier if they have not been modified for more than 90 days.
- Ensure that the storage account is prepared for customer-managed failover, and understand the redundancy state of the account after a failover is executed.

Which of the following configurations and statements are correct for this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the replication of the storage account to Read-Access Geo-Redundant Storage (RA-GRS).; Create a lifecycle management policy rule with a prefix filter set to telemetry/daily/ to transition the blobs to the Archive tier.

Answer

Configure the replication of the storage account to Read-Access Geo-Redundant Storage (RA-GRS), and create a lifecycle management policy rule with a prefix filter set to telemetry/daily/ to transition the blobs to the Archive tier.
To satisfy the requirements, the storage account must be configured for Read-Access Geo-Redundant Storage (RA-GRS) to allow read access to the secondary region under normal operations. Additionally, lifecycle rules require prefix filters to start with the container name, meaning the correct path is telemetry/daily/.

Step-by-Step Solution

1
Select the appropriate replication tier to meet read-access requirements.
Read-Access Geo-Redundant Storage (RA-GRS) is selected because it replicates data to West US and allows read access to the secondary endpoint under normal operations.
Standard GRS does not allow read access to the secondary endpoint unless a failover is initiated, making RA-GRS the correct choice.
2
Determine the prefix formatting for the lifecycle management policy rule.
The prefix must be formatted as telemetry/daily/.
Azure lifecycle management policies evaluate prefixes starting with the container name. A prefix of daily/ would look for a container named daily instead of targeting the container named telemetry.
3
Evaluate the behavior of customer-managed failover on replication redundancy.
The failover converts the account to Locally Redundant Storage (LRS) in the new primary region.
When a failover occurs, the secondary region becomes the primary region, and the account replication changes to LRS. Redundancy is not automatically preserved as RA-GRS.

Key Concept

Azure Storage account replication options and Blob Lifecycle Management prefix rule filters.
Question 15Question →

You manage two General Purpose v2 (GPv2) storage accounts in the East US region:

* `storage1`: Configured with Locally Redundant Storage (LRS).
* `storage2`: Configured with Zone-Redundant Storage (ZRS).

You need to update the replication configuration of both storage accounts to meet the following requirements:

* Replicate all data to a secondary region (West US).
* Maintain zone redundancy in the primary region.
* Ensure there is no downtime or data loss during the configuration change.
* Avoid manual data replication.

Which two actions should you perform?

Select all that apply

Show answer & explanation

Answer: For storage2, change the replication setting to Geo-zone-redundant storage (GZRS) in the Azure portal.; For storage1, submit a support request to Microsoft to perform a live migration to Geo-zone-redundant storage (GZRS).

Answer

To meet the requirements, you should change the replication setting of storage2 to Geo-zone-redundant storage (GZRS) in the Azure portal, and submit a support request to Microsoft to perform a live migration to Geo-zone-redundant storage (GZRS) for storage1.
To maintain zone redundancy in the primary region and replicate to a secondary region, the storage accounts must use Geo-zone-redundant storage (GZRS). For the storage account configured with ZRS (storage2), converting to GZRS is a self-service operation that can be performed directly in the Azure portal. For the storage account configured with LRS (storage1), converting to GZRS cannot be done via self-service and requires submitting a support request to Microsoft to perform a live migration, which avoids downtime and data copying.

Step-by-Step Solution

1
Determine the required replication type.
Both storage accounts must be zone-redundant in East US and geo-replicated to West US, which requires Geo-zone-redundant storage (GZRS).
GZRS replicates data synchronously across three Azure availability zones in the primary region and asynchronously to a secondary region.
2
Evaluate the migration path for storage2.
Changing from Zone-Redundant Storage (ZRS) to Geo-zone-redundant storage (GZRS) is supported as a direct self-service conversion.
Azure allows self-service changes from ZRS to GZRS directly from the Azure portal, PowerShell, or Azure CLI.
3
Evaluate the migration path for storage1.
Changing from Locally Redundant Storage (LRS) to Geo-zone-redundant storage (GZRS) requires a live migration.
Self-service conversion from LRS directly to GZRS is not supported. To avoid downtime and manual copy, a support ticket must be submitted for a Microsoft-managed live migration.

Key Concept

Replication migration paths and constraints for Azure GPv2 storage accounts
Question 16Question →

An organization is designing its Azure Management Group hierarchy to manage multiple subscriptions. Which of the following statements regarding the structure and inheritance behavior of Azure Management Groups are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A management group hierarchy supports up to six levels of depth, excluding the root management group and subscriptions.; Each child management group or subscription can have only one parent management group.

Answer

A management group hierarchy supports up to six levels of depth, excluding the root management group and subscriptions; and each child management group or subscription can have only one parent management group.
The correct statements are that a management group hierarchy supports up to six levels of depth (excluding the root and subscriptions) and that each child management group or subscription can have only one parent management group. These represent standard structural constraints in Azure resource governance.

Step-by-Step Solution

1
Analyze the structural rules of Azure Management Group hierarchies.
Determine that the maximum depth of the hierarchy is six levels (excluding the root management group and subscriptions), and the structure is a strict tree where each node has exactly one parent.
This establishes the fundamental layout constraints for management groups.
2
Evaluate the inheritance behavior of resource locks and policies across the hierarchy.
Confirm that both policies and resource locks are inherited down the hierarchy and cannot be bypassed or blocked by lower-level configurations.
This rules out the options claiming that resource locks do not inherit or that policy inheritance can be blocked.
3
Verify the properties and lifecycle of the Root Management Group.
Confirm that the Root Management Group is a system-created, undeletable container that serves as the root of the hierarchy.
This rules out the option stating that the Root Management Group can be deleted.

Key Concept

Azure Management Groups allow logical grouping of subscriptions and resources in a hierarchical tree structure to apply policies and RBAC roles that inherit down the hierarchy. The hierarchy supports up to six levels of depth (excluding root and subscriptions), and each child node can have only one parent.
Question 17Question →

Your organization has 15 TB15\text{ TB} of archival data stored on-premises that needs to be transferred to Azure. You decide to employ the Azure Import/Export service. Before shipping the physical hard drives to the Azure datacenter, you must prepare them on-premises.

Which of the following requirements must be met during the drive preparation phase? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The drives must be formatted with the NTFS file system.; The drives must be basic disks containing only a single partition.

Answer

The drives must be formatted with the NTFS file system and must be basic disks containing only a single partition.
For Azure Import/Export import jobs, each physical drive must be formatted with the NTFS file system and configured as a basic disk containing a single partition. These requirements ensure compatibility with the Azure datacenter import environment.

Step-by-Step Solution

1
Determine the supported file systems for the Azure Import/Export service.
The service supports only the NTFS file system for drives used in import jobs.
NTFS is the mandatory file system required by the Microsoft Azure Import/Export tool when copying files to Azure Storage.
2
Determine the supported disk and volume configurations.
Only basic disks with a single volume partition are supported.
The service does not support dynamic disks, external spanning, RAID configurations, or multiple partitions on the same physical drive.

Key Concept

Drive preparation requirements for Azure Import/Export service
Question 18Question →

Your company has a requirement to copy on-premises archival data to Microsoft Azure by shipping physical hard drives. You decide to use the Azure Import/Export service. Which two Azure storage services can you specify as direct destinations for the import job? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Blob storage; Azure Files

Answer

Azure Blob storage and Azure Files
The Azure Import/Export service is designed for transferring file-based and object-based data. It supports importing directly into Azure Blob storage (block blobs and page blobs) and Azure Files (file shares).

Step-by-Step Solution

1
Review the supported target storage services for the Azure Import/Export service.
The service supports copying files to Azure Blob storage (block blobs and page blobs) and Azure Files.
This determines which storage accounts and service endpoints can receive the imported data.
2
Identify the incorrect options based on service limitations.
Azure Queue storage and Azure Table storage are not files-based or object-based storage services that support physical disk imports.
This helps eliminate unsupported destinations.

Key Concept

Azure Import/Export supported destination storage types
Estimated Time:45s
Question 19Question →

An organization has the following Azure resource hierarchy and configuration:

* A management group named `MG-Finance`.
* An Azure subscription named `Sub-FinanceProd` that is associated with `MG-Finance`.
* A resource group named `RG-Payments` within `Sub-FinanceProd`.
* A virtual machine named `vm-pay1` and a storage account named `sa-paylogs` within `RG-Payments`.

The following role assignments are configured:

* `User1` is assigned the Microsoft Entra ID `Global Administrator` role. The directory setting Access management for Azure resources is set to No.
* `User2` is assigned the `Reader` role at the `MG-Finance` management group level, and the `Contributor` role at the `RG-Payments` resource group level.
* `User3` is assigned the `User Access Administrator` role at the `Sub-FinanceProd` subscription level.

Which TWO actions can be performed based on the configured permissions? (Select two.)

Select all that apply

Show answer & explanation

Answer: User2 can create a new virtual machine in RG-Payments.; User3 can assign the Reader role to another user on vm-pay1.

Answer

User2 can create a new virtual machine in RG-Payments, and User3 can assign the Reader role to another user on vm-pay1.
The correct actions are those where the assigned roles grant the necessary control plane permissions at the appropriate scopes. The user assigned the Contributor role at the resource group level inherits write permissions within that specific scope, which allows virtual machine creation. The user assigned the User Access Administrator role at the subscription level inherits authorization management permissions, allowing role assignments on the virtual machine.

Step-by-Step Solution

1
Analyze the effective permissions of User1.
User1 is a Microsoft Entra ID Global Administrator but access elevation is set to No.
Verify if directory-level administrator roles automatically inherit subscription-level Azure resource permissions.
2
Analyze the effective permissions of User2.
User2 has Reader at the management group and Contributor at the resource group.
Determine the effective permissions at the resource group scope, noting that RBAC assignments are additive and the more permissive Contributor role applies locally.
3
Analyze the effective permissions of User3.
User3 has User Access Administrator at the subscription level.
Verify that the User Access Administrator role inherits to child resources to allow modifying role assignments.
4
Evaluate data plane access for User2 on the storage account.
User2 has Contributor on the resource group containing the storage account, but this does not grant data plane access for blobs via Microsoft Entra ID authentication.
Check the separation between control plane and data plane RBAC roles in Azure Storage.

Key Concept

Understanding Azure RBAC role assignments, scoping, inheritance, and the separation of Entra ID directory roles from Azure resource roles.
Question 20Question →

Your company has an Azure environment with a subscription named Sub1. Inside Sub1, there is a resource group named RG-Dev that contains several virtual machines.

You need to grant a user named User1 the permission to restart the virtual machines and to delegate role assignments to other team members within RG-Dev. The solution must use the principle of least privilege.

Which two of the following role assignments should you configure? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign the Virtual Machine Contributor role to User1 at the RG-Dev scope.; Assign the User Access Administrator role to User1 at the RG-Dev scope.

Answer

To meet the requirements, you must assign the Virtual Machine Contributor role to User1 at the RG-Dev scope to allow virtual machine management, and assign the User Access Administrator role to User1 at the RG-Dev scope to allow delegating role assignments.
To satisfy the requirements, two roles must be assigned at the resource group level: Virtual Machine Contributor (to manage the virtual machines) and User Access Administrator (to delegate role assignments to other users). These roles represent the least privilege configuration required for the scenario.

Step-by-Step Solution

1
Identify the minimum required role for virtual machine management.
The Virtual Machine Contributor role is selected, as it permits restarting and managing virtual machines without excess permissions.
This fulfills the requirement to manage virtual machines under the principle of least privilege.
2
Identify the minimum required role for role delegation.
The User Access Administrator role is selected, as it permits managing role assignments without granting full resource ownership (Owner role).
This fulfills the requirement to delegate role assignments under the principle of least privilege.
3
Evaluate the correct scope for these assignments.
The role assignments must be applied at the resource group scope (RG-Dev) to target the specific resources and limit access.
Applying roles at the resource group level ensures the permissions inherit only to resources within RG-Dev, satisfying the scope requirement.

Key Concept

Azure RBAC roles are scoped to specific resource hierarchies (Management Group, Subscription, Resource Group, Resource). Assigning Virtual Machine Contributor allows VM management, while User Access Administrator allows role delegation. Microsoft Entra ID directory roles and Administrative Units do not directly grant Azure resource permissions.
Page 1 / 22Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin