Examkin

All practice questions

644 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 1Question →

You manage an Azure environment containing a management group named `MG-Dev`. The management group contains two subscriptions: `Sub-Dev-01` and `Sub-Dev-02`.

You need to implement a cost control strategy to meet the following requirements:
1. Monitor combined spending across both subscriptions and notify the engineering lead via email if the combined monthly cost exceeds 50005{}000 USD.
2. Automatically stop all virtual machines (VMs) in a resource group named `rg-temp-resources` in `Sub-Dev-01` if the monthly cost of that resource group exceeds 10001{}000 USD.

You perform the following configurations:
- Create a budget named `Budget-MG` at the `MG-Dev` scope with a limit of 50005{}000 USD and add the engineering lead's email to the alert threshold.
- Create a budget named `Budget-Temp` at the `rg-temp-resources` scope with a limit of 10001{}000 USD, and configure an action group that triggers an Azure Automation runbook to stop the VMs.
- Apply a `ReadOnly` lock to the `rg-temp-resources` resource group.

Which of the following describes the outcome of this configuration when the budget thresholds are exceeded?

Show answer & explanation

Answer: The email notification is successfully sent, but the virtual machines in `rg-temp-resources` are not stopped because the `ReadOnly` lock inherits to the virtual machines and prevents the runbook from modifying their power state.

Answer

The email notification is successfully sent, but the virtual machines in `rg-temp-resources` are not stopped because the `ReadOnly` lock inherits to the virtual machines and prevents the runbook from modifying their power state.
The budget configured at the management group scope successfully sends email notifications because management group budgets support direct email alerts. However, the ReadOnly lock applied at the resource group scope inherits to all child resources (the virtual machines). Because stopping a virtual machine requires a POST action that modifies the resource state, the ReadOnly lock blocks the Azure Automation runbook from stopping the virtual machines.

Step-by-Step Solution

1
Evaluate the behavior of the budget configured at the management group scope (Budget-MG).
The budget is successfully evaluated, and since email alerts are supported at the management group scope, the email notification is sent to the engineering lead.
Azure Cost Management budgets support scope configurations at the management group level, including email notifications for threshold alerts.
2
Evaluate the inheritance and impact of the ReadOnly lock on `rg-temp-resources`.
The ReadOnly lock inherits to all virtual machines within the resource group, blocking operations that modify resource state, such as stopping or deallocating the VMs.
Azure Resource locks applied at a parent scope (resource group) are inherited by all child resources. A ReadOnly lock blocks all write and write-equivalent POST operations.
3
Determine the outcome when the budget threshold triggers the Azure Automation runbook.
The runbook fails to stop the virtual machines, leaving them running and continuing to accrue costs.
Although the budget alert triggers the runbook, the inherited ReadOnly lock blocks the runbook's API request to stop the VMs.

Key Concept

Azure budgets can be scoped to management groups to aggregate cost data and trigger alerts. Additionally, resource locks are inherited and restrict both manual and automated resource operations, including power state changes on virtual machines.
Estimated Time:1m 30s
Question 2Question →

An administrator is configuring an Azure App Service web app named app-corp to access private blobs in an Azure Storage account named storagecorp. The firewall settings of storagecorp are configured to 'Enabled from selected virtual networks and IP addresses'. The administrator enables a system-assigned managed identity for app-corp and assigns the 'Storage Blob Data Reader' role to the identity for the storage account. However, outbound connections from app-corp to storagecorp fail with a network access error. Which configuration should the administrator implement to allow app-corp to successfully access the blobs in storagecorp?

Show answer & explanation

Answer: Configure Regional VNet Integration for app-corp to connect to a subnet in a virtual network, and add that subnet to the allowed networks list of storagecorp.

Answer

Configure Regional VNet Integration for app-corp to connect to a subnet in a virtual network, and add that subnet to the allowed networks list of storagecorp.
The correct configuration is to enable Regional VNet Integration on the App Service web app and then allow that integrated subnet on the storage account's firewall. Regional VNet Integration routes the outbound traffic from the App Service web app into the virtual network, allowing it to conform to network rules and be permitted by the storage account's firewalls.

Step-by-Step Solution

1
Enable Regional VNet Integration on the App Service web app app-corp.
The web app's outbound traffic is routed into a delegated subnet within a virtual network.
This allows the outbound traffic to originate from a private IP within the virtual network rather than the public outbound IP addresses of the App Service multitenant infrastructure.
2
Configure the storage account firewall settings on storagecorp.
The delegated subnet from the virtual network is added to the allowed networks list.
This tells the storage account firewall to permit traffic originating from that specific subnet, establishing a secure network path.
3
Verify role assignment and test connectivity.
The web app app-corp successfully reads blobs from storagecorp using its managed identity.
With both the network path allowed via VNet integration and data plane authorization granted via the Storage Blob Data Reader role, the secure access is fully enabled.

Key Concept

Azure App Service Regional VNet Integration and Storage Firewall configuration
Question 3Question →

An administrator needs to grant a partner application temporary read-only access to a blob container named reports-2026 in an Azure Storage account named datacorp2026. The access configuration must meet the following security requirements:
- The partner application must only connect from the IP address range 192.0.2.0/24.
- The connection must be restricted to HTTPS only.
- The credentials must expire automatically after 8 hours.
- The solution must not rely on storage account access keys to sign the token.

Which configuration should the administrator use?

Show answer & explanation

Answer: A User Delegation SAS configured with read permissions, restricted to HTTPS, allowed IP range 192.0.2.0/24, and an 8-hour expiration.

Answer

A User Delegation SAS configured with read permissions, restricted to HTTPS, allowed IP range 192.0.2.0/24, and an 8-hour expiration.
A User Delegation SAS is signed using a user delegation key that is secured by Microsoft Entra ID credentials rather than the storage account access keys, satisfying the security requirement. It also supports granular restrictions such as HTTPS-only, allowed IP ranges, and expiration times to meet least privilege requirements.

Step-by-Step Solution

1
Analyze the access key requirement.
Identify that the solution must not rely on storage account access keys to sign the token, which eliminates the use of Account SAS and Service SAS.
Both Account SAS and Service SAS are signed directly with the storage account access keys (Key1 or Key2).
2
Evaluate the protocol and network requirements.
Confirm that the SAS token must enforce HTTPS-only and restrict client access to the IP range 192.0.2.0/24.
These constraints ensure compliance with network security and transmission policies.
3
Select the correct security credential type.
Choose a User Delegation SAS, which uses Microsoft Entra ID credentials to request a user delegation key to sign the SAS, and configure it with the required IP, protocol, and expiration settings.
This satisfies the requirement to avoid account keys while enforcing all required data-plane constraints.

Key Concept

A User Delegation SAS is secured using Microsoft Entra ID credentials rather than storage account access keys, allowing fine-grained access control with automatic revocation linked to the identity's permissions.
Estimated Time:1m 30s
Question 4Question →

An administrator has an Azure Storage account named store1 that currently uses locally redundant storage (LRS). The administrator must configure replication to protect the data against a regional outage. Additionally, the data in the secondary region must be available for read access before any failover is initiated. Which configuration should the administrator use?

Show answer & explanation

Answer: Configure the storage account to use read-access geo-redundant storage (RA-GRS).

Answer

Configure the storage account to use read-access geo-redundant storage (RA-GRS).
Configuring the storage account to use read-access geo-redundant storage (RA-GRS) satisfies both requirements. It replicates data to a secondary region to protect against a regional disaster, and it provides a secondary read-only endpoint that is accessible to clients before any failover is initiated.

Step-by-Step Solution

1
Identify the primary requirement: replicate data to a secondary region to protect against a regional outage.
Locally redundant storage (LRS) and zone-redundant storage (ZRS) are ruled out because they keep data within the primary region.
LRS replicates within a single datacenter, and ZRS replicates across zones in a single region. Neither replicates to a secondary region.
2
Identify the secondary requirement: the replicated data in the secondary region must be read-accessible before failover.
Standard geo-redundant storage (GRS) is ruled out because it does not support read access to the secondary region prior to failover.
RA-GRS (Read-Access Geo-Redundant Storage) must be chosen because it explicitly enables a read-only endpoint in the secondary region while keeping primary and secondary data synchronized.

Key Concept

Selecting the correct Azure Storage replication option based on durability, geographical distribution, and read availability requirements.
Estimated Time:45s
Question 5Question →

You need to create a dynamic user group in Microsoft Entra ID. The group must automatically include all users whose department attribute is set to Sales. Which membership rule should you use?

Show answer & explanation

Answer: (user.department -eq "Sales")

Answer

The correct membership rule is (user.department -eq "Sales").
The correct dynamic membership rule query uses the expression '(user.department -eq "Sales")' because Microsoft Entra ID dynamic group rules use OData syntax with operators like '-eq' for exact matches and 'user' to reference user attributes.

Step-by-Step Solution

1
Identify the target object type for the dynamic group.
Since the group is populated based on user attributes, the rule prefix must begin with 'user.' rather than 'device.'
This target represents user properties in the Entra ID schema.
2
Select the correct comparison operator for an exact match.
The operator '-eq' is the correct syntax for equality in Entra ID dynamic rules.
Microsoft Entra ID dynamic membership rules use OData query syntax, which implements PowerShell-style operators like '-eq' for equivalence.
3
Assemble the dynamic membership query.
Combine the user prefix, department property, operator, and the value to form '(user.department -eq "Sales")'.
This produces a syntactically correct query that the Entra ID rule parser can validate and process.

Key Concept

Dynamic group membership rules in Microsoft Entra ID require specific OData/PowerShell-like syntax and correct object prefixes (user or device).
Question 6Question →

You plan to use the Azure Import/Export service to import 12 TB12\text{ TB} of archive data from your on-premises network to an Azure Storage account. You have prepared several SATA hard drives and need to run the WAImportExport tool on a Windows client machine to copy the files and prepare the drives.

Which file must be generated by the WAImportExport tool during drive preparation and then uploaded to the Azure portal when creating the import job?

Show answer & explanation

Answer: A journal (.jrn) file that contains drive information, BitLocker encryption keys, and file copy logs.

Answer

The journal (.jrn) file containing drive information, BitLocker encryption keys, and file copy logs.
The journal (.jrn) file is the standard output of the WAImportExport tool. It contains the drive metadata, BitLocker encryption keys, and log of copied files. Uploading this file to the Azure portal during import job creation is mandatory because it allows Azure to decrypt the physical drive once it arrives at the Azure datacenter.

Step-by-Step Solution

1
Run the WAImportExport tool on the on-premises client machine to copy data and prepare the drives.
The tool copies the data to the hard drives, encrypts them using BitLocker, and generates a journal (.jrn) file.
The journal file is required to link the physical drive to the import job.
2
Create an import job in the Azure portal.
You provide destination storage account details, shipping information, and upload the generated journal (.jrn) file.
Azure needs the journal file to retrieve the BitLocker recovery keys and map the drive contents to the destination storage account.
3
Ship the physical drives to the Azure datacenter.
Azure operators mount the drives and use the uploaded journal file info to copy the data to your storage account.
This completes the offline transfer process securely without exposing encryption keys in transit.

Key Concept

Drive preparation and journal (.jrn) file requirements in Azure Import/Export service.
Question 7Question →

A financial services company organizes its Azure resources using a Management Group hierarchy. The Root Management Group has a child Management Group named FinanceMG, which contains two Azure subscriptions: Sub-Prod and Sub-Dev. A security administrator assigns the Reader role to a user group at the FinanceMG level and assigns a Policy definition at the Root Management Group level. Additionally, a Resource Lock of type CanNotDelete is applied to a specific resource group inside Sub-Prod. Which of the following statements is true regarding how these settings are applied to the resources within the subscriptions?

Show answer & explanation

Answer: Both the Reader role assignment and the policy definition are inherited by all resources within Sub-Prod and Sub-Dev, while the CanNotDelete lock only applies to the specific resource group and its child resources within Sub-Prod.

Answer

Both the Reader role assignment and the policy definition are inherited by all resources within Sub-Prod and Sub-Dev, while the CanNotDelete lock only applies to the specific resource group and its child resources within Sub-Prod.
Both Azure RBAC role assignments and Azure Policy definitions inherit downward through the Management Group hierarchy, meaning settings applied at parent management groups affect all child subscriptions and resources. Resource locks, however, only inherit downward from their assignment scope (the resource group) to its child resources, and do not propagate upward or affect other subscriptions.

Step-by-Step Solution

1
Analyze the inheritance of the policy assigned at the Root Management Group level.
The policy is inherited by the child Management Group (FinanceMG), both subscriptions (Sub-Prod and Sub-Dev), and all resource groups and resources beneath them.
Azure policies applied at a higher scope in the hierarchy automatically inherit to all child scopes.
2
Analyze the inheritance of the Reader role assigned at the FinanceMG level.
The Reader role assignment is inherited by both Sub-Prod and Sub-Dev, as well as all resource groups and resources within them.
Azure RBAC role assignments inherit downward through the management group hierarchy to all child subscriptions and resources.
3
Analyze the scope of the Resource Lock applied at the resource group level inside Sub-Prod.
The CanNotDelete lock applies only to that specific resource group and the resources inside it.
Resource locks only inherit downward to child resources within the targeted scope and do not propagate upward or laterally in the hierarchy.

Key Concept

Inheritance behavior of Azure Policies, RBAC role assignments, and Resource Locks in a Management Group hierarchy
Question 8Question →

You plan to use the Azure Import/Export service to copy on-premises data to an Azure storage account. You need to prepare the physical hard drives before shipping them to an Azure datacenter. Which command-line tool must you run on your local computer to prepare the drives?

Show answer & explanation

Answer: WAImportExport.exe

Answer

WAImportExport.exe
The WAImportExport tool is the official command-line utility used to prepare hard drives for the Azure Import/Export service. It copies data to the drive, encrypts it using BitLocker, and creates a journal file (.jrn) containing the drive information and folder structure, which is required to create the import job in Azure.

Step-by-Step Solution

1
Identify the requirement to prepare physical drives for shipment as part of the Azure Import/Export service workflow.
Drives must be formatted, encrypted using BitLocker, and have data copied along with a generated journal (.jrn) file.
The Import/Export service requires pre-encrypted drives with companion metadata to identify and safely import the data at the Azure datacenter.
2
Evaluate the available tools for this specific drive preparation task.
The WAImportExport tool is the only utility that prepares the drive and outputs the required journal files.
Standard network-based copy tools like AzCopy or Storage Explorer do not perform physical drive preparation or BitLocker encryption tracking.

Key Concept

Azure Import/Export drive preparation prerequisites and tools
Question 9Question →

You manage an Azure subscription that contains an Azure Storage account named storage1. The storage account is configured as a General Purpose v1 (GPv1) account and uses Locally Redundant Storage (LRS). You need to create a lifecycle management rule that will automatically transition blobs in a container named backups to the Archive access tier after 30 days. What should you do first?

Show answer & explanation

Answer: Upgrade the storage account to a General Purpose v2 (GPv2) storage account.

Answer

Upgrade the storage account to a General Purpose v2 (GPv2) storage account.
Azure Blob Storage lifecycle management and blob tiering (such as transitioning blobs to the Archive access tier) are supported only on General Purpose v2 (GPv2) accounts, Premium Block Blob accounts, and Blob Storage accounts. General Purpose v1 (GPv1) accounts do not support blob tiering or lifecycle management policies. Therefore, the GPv1 storage account must first be upgraded to GPv2 to support the creation and execution of lifecycle rules.

Step-by-Step Solution

1
Identify the storage account type and capabilities.
The current account is GPv1, which does not support blob tiering (Hot, Cool, Cold, Archive) or lifecycle management policies.
Lifecycle management and tiering operations require a General Purpose v2 (GPv2), Premium Block Blob, or Blob Storage account.
2
Determine the required upgrade path.
Upgrade the GPv1 storage account to a GPv2 storage account.
Upgrading to GPv2 is a non-disruptive, in-place action that unlocks access to lifecycle management and blob tiering without modifying the replication settings or RBAC permissions.

Key Concept

Azure Blob Storage Lifecycle Management and Account Upgrades
Estimated Time:1m 30s
Question 10Question →

Your company has an Azure subscription named Sub1 that contains a resource group named RG1. You need to ensure that a user named User1 can view all resources inside RG1. User1 must not be able to view resources in any other resource groups within Sub1, nor modify any resources. Which action should you perform?

Show answer & explanation

Answer: Assign the Reader role to User1 at the RG1 resource group scope.

Answer

Assign the Reader role to User1 at the RG1 resource group scope.
Assigning the Reader role at the resource group scope grants the user read-only permissions for all resources within that specific resource group. Because the scope is restricted to the resource group, the user cannot view resources in other resource groups within the subscription, satisfying all requirements.

Step-by-Step Solution

1
Determine the minimum permission required to view resources.
The Reader role is identified as the appropriate built-in role to view resources without permission to modify them.
The Reader role allows viewing resources but does not allow any modifications.
2
Determine the correct scope for the role assignment to restrict access to a single resource group.
The resource group (RG1) scope is selected.
Assigning a role at the resource group scope limits the permissions to only that resource group, whereas assigning it at the subscription scope would allow inheritance to all other resource groups in the subscription.

Key Concept

Azure RBAC inheritance and scopes
Question 11Question →

You manage a Microsoft Entra ID tenant. You create an administrative unit named Regional-AU and add several security groups to it.

You need to delegate the ability to manage the membership of these security groups to a user named Admin1. The solution must follow the principle of least privilege.

Which role and scope should you assign to Admin1?

Show answer & explanation

Answer: Groups Administrator role scoped to Regional-AU

Answer

Groups Administrator role scoped to Regional-AU
Assigning the Groups Administrator role scoped to Regional-AU is correct because it grants the specific permissions needed to manage group memberships, and administrative units allow directory role delegation to be scoped to a subset of directory objects, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the administrative tasks and the target objects.
The task is to manage membership for security groups placed inside an Administrative Unit.
Understanding the scope of administration helps narrow down the required role and boundary.
2
Compare the permissions of User Administrator and Groups Administrator.
Groups Administrator allows managing group properties and memberships. User Administrator has broader access, including user and password management.
Least privilege requires choosing the role with the fewest permissions that still accomplishes the task.
3
Determine the appropriate scope for the assignment.
The groups are contained within Regional-AU. Directory roles can be scoped to administrative units, whereas Azure RBAC scopes (resource groups/subscriptions) cannot be used for directory roles.
Assigning the role at the administrative unit scope ensures the permission is restricted to the specific groups.

Key Concept

Delegating group management using Administrative Units and least privilege directory roles
Estimated Time:1m 30s
Question 12Question →

An organization uses an Azure tenant hierarchy configured as follows:
- Tenant Root Group (Management Group)
- MG-Prod (Management Group)
- Sub-Prod-01 (Subscription)
- RG-Sec (Resource Group)
- RG-App (Resource Group)
- VM-App-01 (Virtual Machine)

You have two users with the following role configurations:
- User1 is assigned the Global Administrator directory role in Microsoft Entra ID. No other roles are assigned.
- User2 is assigned the User Access Administrator role at the MG-Prod management group scope.

User1 needs to assign the Contributor role to a security group at the RG-App scope.
User2 needs to assign the Reader role to a service principal at the RG-Sec scope.

Who can perform their respective role assignments without modifying any existing permissions or configurations?

Show answer & explanation

Answer: Only User2

Answer

Only User2 can perform the role assignment without modifying existing permissions.
The correct option is that only User2 can perform the role assignment. User2 has the User Access Administrator role at the MG-Prod scope, which grants them the ability to write role assignments. Because of Azure RBAC inheritance, this permission flows down to all child scopes including the Sub-Prod-01 subscription and the RG-Sec resource group. User1, despite being a Microsoft Entra ID Global Administrator, cannot perform resource-level role assignments by default. Global Administrators must first elevate their access in the Azure portal, which explicitly assigns them the User Access Administrator role at the Tenant Root Group level before they can manage Azure subscription permissions.

Step-by-Step Solution

1
Analyze the Microsoft Entra ID role assignment for User1.
User1 has the Global Administrator directory role.
Microsoft Entra ID roles are structurally separate from Azure RBAC roles. A Global Administrator has no default permissions to manage Azure resources (subscriptions, resource groups, etc.) until they explicitly elevate their access in the Entra ID settings.
2
Analyze the Azure RBAC role assignment and scope for User2.
User2 has the User Access Administrator role at the MG-Prod management group scope.
The User Access Administrator role contains the `Microsoft.Authorization/roleAssignments/write` data action, which allows the user to configure role assignments at their assigned scope.
3
Apply the principles of RBAC scope inheritance down the hierarchy.
User2's permissions at MG-Prod inherit down through Sub-Prod-01 to RG-Sec.
Azure RBAC assignments are inherited from parent scopes (Management Groups) to child scopes (Subscriptions and Resource Groups). Since RG-Sec is a child of Sub-Prod-01, which is a child of MG-Prod, User2 has effective User Access Administrator rights at the RG-Sec level.

Key Concept

Azure RBAC roles inherit down the resource hierarchy (Management Group -> Subscription -> Resource Group -> Resource), whereas Microsoft Entra ID directory roles do not automatically grant permissions on Azure resources without explicit access elevation.
Estimated Time:2m 0s
Question 13Question →

An organization has an Azure subscription containing a General Purpose v2 (GPv2) storage account named storage1 configured with Geo-Redundant Storage (GRS). The storage account contains two blob containers:

* media-delivery – Stores active, frequently accessed media assets used by a web application.
* compliance-logs – Stores historical logs.

To minimize storage costs, a lifecycle management policy is applied to storage1 with a rule that transitions all blobs in compliance-logs to the Archive tier 30 days after creation.

A major regional outage occurs in the primary region of storage1. An administrator attempts to initiate a customer-managed failover of storage1 to the secondary region to restore write capabilities for the web application, but the failover operation is blocked.

Which of the following is the most appropriate action to resolve this issue and ensure the web application can fail over to the secondary region in the event of a future primary region outage?

Show answer & explanation

Answer: Create a separate storage account for the historical logs, configure its lifecycle policy to archive the logs, and keep only the active media assets in storage1.

Answer

Create a separate storage account for the historical logs, configure its lifecycle policy to archive the logs, and keep only the active media assets in storage1.
The correct action is to split the active and archived workloads into separate storage accounts. Azure customer-managed failover is blocked for any storage account that contains archived blobs. Because rehydration is a write operation that cannot be performed when the primary endpoint is offline, the administrator cannot rehydrate the blobs during an outage to bypass the block. Separating the logs to a different storage account ensures the active media storage account contains no archived blobs and can be failed over immediately.

Step-by-Step Solution

1
Identify the blocker preventing the customer-managed failover of the storage account.
The failover is blocked because the storage account contains archived blobs, which is a known limitation of customer-managed failover in Azure.
Azure blocks customer-managed failover for any storage account containing one or more blobs in the Archive tier.
2
Evaluate the viability of rehydrating the blobs or modifying the lifecycle policy during a primary region outage.
Both rehydration and lifecycle policy modifications are write operations that must be processed by the primary endpoint, which is currently offline.
During a primary region outage, the secondary endpoint is read-only (in RA-GRS) and cannot accept write commands, meaning blobs cannot be rehydrated and policies cannot be modified.
3
Formulate a design pattern to prevent this failover blocker in future scenarios.
Split the workloads by creating a separate storage account for the compliance logs (which require archiving) and keeping the active media assets in the primary GRS storage account.
Separating the active and archived workloads ensures that the active storage account does not contain archived blobs, allowing customer-managed failover to succeed instantly during a disaster.

Key Concept

Customer-managed failover limitations with archived blobs and storage account design
Estimated Time:3m 0s
Question 14Question →

An organization's Azure environment is structured with the following hierarchy:
- Tenant Root Group
- Corporate-MG (Management Group)
- Production-MG (Management Group)
- Azure Subscription A
- Resource Group: RG-Shared-01

The following configurations are implemented:
1. A CanNotDelete resource lock is applied to RG-Shared-01.
2. A user is assigned the Owner role at the Corporate-MG level.
3. The administrator assigns the same user a custom RBAC role at the RG-Shared-01 level. The custom role contains a NotActions statement for deleting resources.

The user attempts to delete an Azure storage account that resides inside RG-Shared-01.

What is the outcome of the user's deletion attempt?

Show answer & explanation

Answer: The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.

Answer

The deletion attempt fails because the resource lock applied at the resource group level is inherited by the storage account, preventing deletion regardless of the user's RBAC permissions.
The correct option is the one stating that the deletion attempt fails due to resource lock inheritance. Resource locks applied at the resource group scope are inherited by all resources within that group. A CanNotDelete lock prevents any user—including those with Owner or Contributor permissions—from deleting the resource. Therefore, the user cannot delete the storage account.

Step-by-Step Solution

1
Determine the user's effective RBAC permissions down the hierarchy.
The user has the Owner role inherited from Corporate-MG. The custom role with NotActions at the resource group level does not restrict this access because Azure RBAC is additive.
Understanding inheritance and the additive nature of RBAC is required to evaluate permissions.
2
Evaluate the impact of the resource lock.
The CanNotDelete lock is applied to RG-Shared-01. It inherits to the storage account.
Locks take precedence over RBAC user permissions and prevent deletion for all users.
3
Combine RBAC and resource lock effects to determine the final outcome.
The deletion fails due to the inherited resource lock.
Confirming that locks block write/delete operations even for subscription Owners.

Key Concept

Resource locks take precedence over RBAC permissions and are inherited down the resource hierarchy.
Estimated Time:1m 30s
Question 15Question →

An administrator needs to import 22 TB22\text{ TB} of data from an on-premises Windows file server to an Azure storage account. The target destination is an Azure Files share. Due to limited WAN bandwidth, the administrator decides to use the Azure Import/Export service to ship physical hard drives to an Azure datacenter.

Which of the following processes must the administrator use to prepare the hard drives and configure the import job?

Show answer & explanation

Answer: Format the drives as NTFS, run the WAImportExport V2 tool on a local Windows machine using the storage account access key to copy the data and encrypt the drives with BitLocker, and upload the generated journal (.jrn) files when creating the import job in the Azure portal.

Answer

Format the drives as NTFS, run the WAImportExport V2 tool on a local Windows machine using the storage account access key to copy the data and encrypt the drives with BitLocker, and upload the generated journal (.jrn) files when creating the import job in the Azure portal.
The correct process for importing data into Azure Files using the Import/Export service requires formatting the drives as NTFS and running the WAImportExport V2 tool on a local Windows machine. The tool uses the storage account access key to copy the data, encrypts the drives with BitLocker, and generates journal (.jrn) files. These journal files must then be uploaded to Azure when creating the import job to allow the Azure datacenter to decrypt and ingest the data.

Step-by-Step Solution

1
Format the physical SATA hard drives as NTFS using a local Windows machine.
The drives are prepared with the required file system for the Azure Import/Export service.
Azure Import/Export only supports NTFS-formatted drives for Windows-based data prep.
2
Run the WAImportExport V2 tool, specifying the source path, destination Azure Files share, and the storage account access key.
The data is copied to the drives, the drives are encrypted using BitLocker, and journal (.jrn) files are generated.
WAImportExport version 2 is specifically designed for Azure Files import. The storage account access key is needed to authenticate and encrypt the drives.
3
Create an import job in the Azure portal and upload the generated journal (.jrn) files.
The import job is configured and transition details (like shipping carrier tracking info) are provided.
Azure uses the journal files to identify the drives, decrypt them, and copy the files to the correct target share.

Key Concept

Drive preparation and prerequisite handling using the WAImportExport tool for Azure Files imports via the Import/Export service.
Estimated Time:2m 30s
Question 16Question →

Zenith Retail Group uses the following Azure Management Group hierarchy:

* Tenant Root Group (Policy assigned: Allowed locations restricted to `East US` with Deny effect)
* Retail-Operations (Management Group) (Policy assigned: Allowed locations restricted to `East US 2` with Deny effect; Role assignment: User1 is assigned the Contributor role)
* Online-Store (Management Group)
* Sub-Online-Prod (Subscription) (Role assignment: User1 is assigned the Reader role)
* RG-Web-Prod (Resource Group) (Resource Lock: CanNotDelete lock applied)

User1 attempts to create a new virtual machine in the resource group `RG-Web-Prod` in the `East US 2` region.

Which of the following describes the outcome of the deployment attempt?

Show answer & explanation

Answer: The deployment is denied because it violates the Allowed locations policy assigned at the Tenant Root Group level.

Answer

The deployment is denied because it violates the Allowed locations policy assigned at the Tenant Root Group level.
The correct option is correct because Azure Policy evaluation is cumulative across all hierarchical scopes. A resource deployment must comply with the policy assignments at the resource scope, resource group scope, subscription scope, and all parent management group scopes. The virtual machine deployment in East US 2 satisfies the policy at the Retail-Operations level, but violates the Tenant Root Group policy, which only permits East US.

Step-by-Step Solution

1
Evaluate the effective RBAC permissions for User1 on the target resource group.
User1 has effective Contributor permissions.
Azure RBAC role assignments are additive. The inherited Contributor assignment from the Retail-Operations management group level is not canceled or overridden by the more specific Reader assignment at the subscription level.
2
Evaluate the impact of the resource lock on the resource group.
The CanNotDelete lock does not block virtual machine creation.
A CanNotDelete lock prevents authorized users from deleting a resource, but allows creating, reading, or modifying resources.
3
Evaluate the cumulative effect of the assigned Azure Policies.
The deployment is blocked by the Tenant Root Group policy.
Azure Policy evaluations are cumulative. For a resource to be successfully deployed, it must satisfy the policy rules at all scopes in its path. Since the Tenant Root Group restricts deployments to East US and the Retail-Operations group restricts them to East US 2, deploying a resource in East US 2 violates the Tenant Root Group policy.

Key Concept

Azure Policy and RBAC inheritance and evaluation within Management Group hierarchies
Estimated Time:3m 0s
Question 17Question →

Your company has a Microsoft Entra ID tenant. You need to delegate password reset capabilities to a user named Admin1. Admin1 must only be allowed to reset passwords for users who meet both of the following criteria:

* Belong to the Sales department.
* Have their usage location set to the United States (US).

You need to implement a solution that requires the minimum administrative effort and follows the principle of least privilege.

Which configuration should you implement?

Show answer & explanation

Answer: Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.

Answer

Create an Administrative Unit (AU), configure a dynamic membership rule for the AU using the query (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'), and assign Admin1 the Helpdesk Administrator role scoped to the AU.
The correct configuration uses an Administrative Unit (AU) with a dynamic membership rule configured with standard OData v3.0 query syntax (user.department -eq 'Sales') -and (user.usageLocation -eq 'US'). The Helpdesk Administrator role can be scoped to an AU, which delegates password reset permissions for the members of that AU to Admin1, satisfying the least privilege principle.

Step-by-Step Solution

1
Determine the administrative scope delegation mechanism
Administrative Unit (AU) is selected as the container for delegation
Microsoft Entra ID roles cannot be scoped to a group to delegate user administration of that group's members. Instead, Administrative Units must be used to restrict the administrative scope of directory roles.
2
Write the dynamic membership rule using correct OData syntax and attributes
(user.department -eq 'Sales') -and (user.usageLocation -eq 'US')
The dynamic query syntax requires OData v3.0 operators (e.g., -eq instead of ==) and valid user attribute names (e.g., user.usageLocation instead of user.location).
3
Assign the least privileged role to Admin1
Admin1 is assigned the Helpdesk Administrator role scoped to the AU
The Helpdesk Administrator role allows resetting passwords for non-administrator users. Scoping this role to the AU ensures Admin1 can only perform resets for users matching the AU's dynamic membership criteria.

Key Concept

Delegating administrative permissions over specific users using Administrative Units and dynamic membership rules in Microsoft Entra ID.
Question 18Question →

An administrator manages a General Purpose v2 (GPv2) storage account named storagelogsa in the East US region. The storage account is currently configured to use Locally Redundant Storage (LRS) and contains block blobs in a container named activitylogs.

A lifecycle management policy is applied to the storage account with a single rule:
- Filter: Blob prefix is activitylogs/archive/
- Action: Transition blobs to the Archive tier 30 days after modification.

Currently, the container contains:
- 500 blobs under activitylogs/raw/ (all modified 45 days ago, currently in the Hot tier)
- 200 blobs under activitylogs/archive/ (all modified 45 days ago, currently in the Archive tier)

You need to change the replication configuration of the storage account from LRS to Zone-Redundant Storage (ZRS) to ensure zonal availability. When you attempt to change the replication setting in the Azure portal, the option is unavailable.

Which of the following actions should you perform first to enable the replication configuration change?

Show answer & explanation

Answer: Rehydrate the 200 blobs in the activitylogs/archive/ path to the Hot or Cool tier.

Answer

Rehydrate the 200 blobs in the activitylogs/archive/ path to the Hot or Cool tier.
The correct action is to rehydrate the archived blobs. Azure Storage replication conversions (such as moving from Locally Redundant Storage to Zone-Redundant Storage) are blocked if the storage account contains any blobs in the Archive tier. Rehydrating the blobs under the archived path to Hot or Cool tier satisfies this prerequisite.

Step-by-Step Solution

1
Analyze the current state of the blobs and lifecycle policy rules.
Identify that the 200 blobs under the prefix activitylogs/archive/ have been transitioned to the Archive tier because they were modified 45 days ago, which exceeds the 30-day threshold defined in the lifecycle policy.
Understanding the tier of the existing blobs is critical since replication changes have specific tier restrictions.
2
Evaluate the replication conversion requirements for Azure storage accounts.
Identify that Azure blocks changing the replication configuration (e.g., LRS to ZRS) of any storage account that contains blobs in the Archive tier.
Archived blobs are offline and must be rehydrated to an online tier (Hot or Cool) before metadata or configuration changes like replication conversion can be applied.
3
Select the correct remediation step.
Determine that the archived blobs must be rehydrated first to allow the replication change to proceed.
Rehydrating the blobs brings them back to an online tier, fulfilling the prerequisite for changing the storage account replication configuration.

Key Concept

Azure Storage replication changes are blocked if the storage account contains any blobs in the Archive tier. Before converting replication (such as LRS to ZRS), all archived blobs must be rehydrated to Hot or Cool.
Question 19Question →

An organization has the following Azure resource hierarchy and configuration:
- A management group named MG-Production contains an Azure subscription named Sub-App.
- Sub-App contains a resource group named RG-Data.
- RG-Data contains a storage account named storage1.
- A ReadOnly resource lock is applied directly to the storage1 resource.

The following security principals are configured:
- User1 is a Microsoft Entra ID user with the Global Administrator directory role. The 'Access management for Azure resources' setting is disabled in the directory properties.
- User2 has the Reader role assigned at the MG-Production level and the Storage Blob Data Contributor role assigned at the RG-Data level.
- User3 has the Contributor role assigned at the Sub-App level.

All users attempt to access resources using Microsoft Entra ID authentication. Which of the following describes the effective permissions of the users?

Show answer & explanation

Answer: User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 is blocked from regenerating access keys for storage1.

Answer

User1 cannot view the properties of storage1, User2 can upload blobs to storage1, and User3 is blocked from regenerating access keys for storage1.
The correct option is correct because User1's Global Administrator directory role does not grant Azure resource access unless the access management elevation toggle is enabled. User2 holds the Storage Blob Data Contributor role, which allows them to upload blobs since resource locks only restrict Azure Resource Manager control-plane actions and do not block data-plane operations. Finally, User3 is prevented from regenerating access keys because key regeneration is a control-plane write action that is explicitly blocked by the ReadOnly lock applied to the storage account.

Step-by-Step Solution

1
Evaluate User1's permissions based on their directory role.
User1 has no access to subscription resources.
Microsoft Entra ID administrator roles (like Global Administrator) do not automatically grant permissions to Azure subscription resources. Since 'Access management for Azure resources' is disabled, User1 has no inherited roles in the subscription.
2
Evaluate User2's permissions and the impact of the ReadOnly lock on data plane actions.
User2 can upload blobs to storage1.
User2 inherits control-plane read access (from the Reader assignment at the management group level) and has direct data-plane write access (from the Storage Blob Data Contributor assignment at the resource group level). The ReadOnly resource lock applied to the storage account only prevents control-plane modifications (write/delete) and does not block data-plane actions like uploading blobs.
3
Evaluate User3's permissions and the impact of the ReadOnly lock on control plane actions.
User3 is blocked from regenerating access keys on storage1.
User3 inherits the Contributor role, which would normally allow regenerating storage account keys. However, key regeneration is a control-plane write operation. The ReadOnly lock applied directly to the resource blocks all control-plane write and delete operations, regardless of whether the Contributor role was inherited from a higher scope.

Key Concept

Azure resource locks only restrict control-plane (management) operations and do not block data-plane operations. Additionally, Microsoft Entra ID administrative roles do not implicitly grant Azure RBAC permissions unless explicitly elevated, and subscription Contributor does not provide data-plane access for storage.
Question 20Question →

An organization's Azure environment is structured with the following resource hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-Production`
- Resource Group: `RG-App-Services`

A user named Admin1 is assigned the Global Administrator directory role in Microsoft Entra ID. Admin1 logs into the Azure portal but is unable to view the resources within `RG-App-Services` or the subscription itself. What should you do to allow Admin1 to view the web apps inside `RG-App-Services`?

Show answer & explanation

Answer: Assign Admin1 the Reader Azure RBAC role at the `Sub-Production` subscription scope.

Answer

Assign Admin1 the Reader Azure RBAC role at the `Sub-Production` subscription scope.
Assigning the Reader role at the subscription scope ensures that the read permission inherits down through the resource hierarchy to the resource group and individual resources. Because Entra ID directory roles do not automatically grant permissions to manage subscription resources, an explicit Azure RBAC assignment is necessary.

Step-by-Step Solution

1
Identify the relationship between Entra ID roles and Azure RBAC roles.
Confirm that the Global Administrator directory role does not automatically grant permissions to Azure subscription resources.
Entra ID and Azure RBAC have separate authorization control planes.
2
Evaluate the target scope and minimum permissions required to fulfill the request.
The requirement is to view the web apps inside the `RG-App-Services` resource group.
Choosing the correct built-in role (Reader) and the proper scope (subscription or resource group) is necessary to grant the access.
3
Determine the proper assignment scope that will propagate down to the resources.
Assigning the Reader role at the `Sub-Production` subscription scope will propagate via inheritance down to the `RG-App-Services` resource group and the web apps inside it.
Azure RBAC utilizes a hierarchical inheritance model where permissions applied at a parent scope flow down to all child scopes.

Key Concept

Azure RBAC role assignment scopes and role inheritance, specifically the separation between Microsoft Entra ID roles and Azure RBAC roles.
Estimated Time:1m 30s
Page 1 / 33Next