Examkin

All practice questions

80 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 1Question →

Your organization needs to import 40 TB40\text{ TB} of on-premises data to an Azure Storage account. You have ordered an Azure Data Box device, and it has just been delivered to your datacenter. Which of the following shows the correct sequence of steps you must perform to configure the device, copy the data, and complete the import process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with cabling and configuring the IP address of the Data Box, followed by unlocking the device using credentials from the Azure portal. Next, the data is copied to the shares. Afterward, the prepare-to-ship verification is run, the device is shut down, and finally, it is shipped to the Azure datacenter where the upload progress is monitored.
The correct sequence follows the logical lifecycle of a physical Data Box deployment: first, network setup is required to reach the device management interface; second, security credentials from the Azure portal must be used to unlock the storage; third, the data is copied over the local network; fourth, a verification and locking process ('prepare to ship') must be executed before powering down; and finally, the device is shipped and the progress is tracked.

Step-by-Step Solution

1
Connect the Data Box to the local network and set its IP address.
Access to the Data Box local web user interface is established.
You must establish network connectivity first to manage the device.
2
Unlock the device using credentials retrieved from the Azure portal.
The device is unlocked and storage shares are made available.
The device is locked by default for security during shipping.
3
Copy data to the SMB or NFS shares on the Data Box.
All source files are transferred to the device storage.
This is the primary stage of transferring data onto the physical medium.
4
Execute the 'Prepare to ship' command and shut down the device.
Data integrity is validated, the device is locked, and it is safely powered down.
This verifies the transfer and secures the data before shipment.
5
Ship the device to the Azure datacenter and track its progress.
The physical device is shipped, the data is imported by Azure, and progress is monitored.
This initiates the final ingestion of the data into the target Azure Storage account.

Key Concept

Azure Data Box deployment and import workflow steps.
Question 2Question →

An administrator needs to restrict access to an Azure Storage account named storage1 so that it only accepts traffic originating from a specific subnet in a virtual network. What is the correct sequence of steps to configure this network restriction in the Azure portal?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is to first navigate to the storage1 storage account, go to the Networking settings under Security + networking, set the Public network access to 'Enabled from selected virtual networks and IP addresses', add the target virtual network and subnet, and then select Save to apply the changes.
To restrict access to a storage account from a specific subnet, the administrator must navigate to the storage account, access the Networking settings, change Public network access to 'Enabled from selected virtual networks and IP addresses', add the target subnet under Virtual networks, and save the settings.

Step-by-Step Solution

1
Locate the target storage account resource.
The storage1 account page is opened.
All network settings for the resource are configured within its instance page.
2
Access the Networking blade.
The Networking configuration interface is loaded.
This blade houses firewall and virtual network access rules.
3
Restrict public network access settings.
The firewall rules are opened for configuration.
By default, access is allowed from all networks; this must be restricted to selected networks first.
4
Associate the allowed virtual network and subnet.
The subnet is added to the firewall exceptions list.
This explicitly authorizes traffic coming from that specific subnet.
5
Save the settings.
The updated network configuration is saved and active.
Firewall rules do not take effect until they are explicitly saved in the portal.

Key Concept

Azure Storage Firewall Configuration
Estimated Time:1m 0s
Question 3Question →

You need to secure network access to an Azure Storage account named `saoperations` from a virtual network named `VNet-Prod`. The storage account contains blob data. The security requirements are:

1. Public network access to `saoperations` must be disabled.
2. VMs in `VNet-Prod` must access `saoperations` using a private IP address.
3. VMs in `VNet-Prod` must resolve the storage account's fully qualified domain name (FQDN) to its private IP address.

In which sequence should you perform the configuration steps to minimize service disruption and ensure correct name resolution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps starts with creating the Private DNS Zone, followed by linking the zone to the virtual network. Next, the private endpoint is created, followed by configuring the Private DNS zone group. Finally, public network access to the storage account is disabled.
The correct sequence ensures that the DNS infrastructure and private connection are completely configured and linked to the virtual network before public access is disabled, preventing connection dropouts. Creating the Private DNS Zone first allows the subsequent virtual network link and zone group auto-registration to reference the zone. The zone group automatically updates the Private DNS Zone with the private endpoint's IP. Once the endpoint is functional, disabling public network access completes the lockdown.

Step-by-Step Solution

1
Create the Private DNS Zone.
A Private DNS Zone named `privatelink.blob.core.windows.net` is provisioned.
The Private DNS Zone acts as the authoritative source for the private endpoint IP addresses and must exist before linking or auto-registration can be configured.
2
Link the Private DNS Zone to `VNet-Prod`.
The Private DNS Zone is linked to the virtual network.
This link allows virtual machines inside the virtual network to perform DNS resolution against the zone.
3
Create the private endpoint.
A private endpoint is deployed in `VNet-Prod` with a private IP address mapped to the `blob` sub-resource of `saoperations`.
The private endpoint establishes private connectivity to the storage account.
4
Configure the Private DNS zone group.
The private IP address of the private endpoint is registered to the Private DNS Zone.
This automates the creation of the DNS A record mapping `saoperations.privatelink.blob.core.windows.net` to the private IP address.
5
Disable public network access on the storage account.
The storage account firewall is configured to block public network traffic.
This secures the storage account by ensuring that traffic is only allowed via the private endpoint, avoiding disruption by doing this after private connectivity is operational.

Key Concept

Azure Storage private endpoint configuration requires a specific sequence starting with Private DNS Zone creation, Virtual Network linking, Private Endpoint provisioning, Private DNS zone group integration, and finally disabling public network access to prevent service downtime.
Question 4Question →

You have an on-premises Windows Server named Server1 and an Azure file share named share1 in a storage account named storage1. You plan to deploy Azure File Sync. All synchronization traffic must travel over a private network connection, and public network access to both storage1 and the Storage Sync Service must be disabled. Which sequence of steps should you perform to configure Azure File Sync under these security constraints? Arrange the steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Register the Microsoft.StorageSync resource provider first, then create the Storage Sync Service and configure private endpoints for both the service and the storage account. Next, install the Azure File Sync agent on the on-premises server, register the server, and finally create a Sync Group, add a Cloud Endpoint, and then add a Server Endpoint.
The correct order ensures all prerequisites are met: the resource provider must be registered to create the service; the service and private endpoints must exist to allow private registration; the agent must be installed to perform the registration; and the server must be registered and the sync group/cloud endpoint created before a server endpoint can be linked.

Step-by-Step Solution

1
Register the Microsoft.StorageSync resource provider in the Azure subscription.
The subscription is enabled to create Storage Sync Service resources.
You cannot provision the Storage Sync Service resource until the provider is registered.
2
Create the Storage Sync Service and configure private endpoints for the Storage Sync Service and the storage account.
The resources are created and accessible only over the private network connection.
Since public access is disabled, network routing via private endpoints and private DNS resolution must be active for the local server to communicate with Azure during registration and sync.
3
Install the Azure File Sync agent on the on-premises server.
The File Sync service and utilities are installed on the local Windows Server.
The server cannot execute sync or registration commands without the local agent.
4
Register the Windows Server with the Storage Sync Service.
A trust relationship is established, and the server appears as a registered server in the Storage Sync Service.
A server must be registered with the Storage Sync Service before it can be added to any sync group.
5
Create a Sync Group, add a Cloud Endpoint (Azure file share), and add a Server Endpoint (local path).
The synchronization relationship is established, and files begin syncing.
A sync group and a cloud endpoint must exist before you can associate a registered server's local path as a server endpoint.

Key Concept

Deploying Azure File Sync in a secure, private-only network topology requires registering the resource provider, deploying the Storage Sync Service and its private endpoints, installing the local agent, registering the server over the private network, and then configuring the sync group, cloud endpoint, and server endpoint in sequence.
Question 5Question →

You need to synchronize a local folder on a Windows Server to an Azure file share using Azure File Sync. Which sequence of actions should you perform to configure the synchronization?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure Azure File Sync, you must first create a Storage Sync Service, install the Azure File Sync agent on the Windows Server, register the server with the Storage Sync Service, create a sync group with a cloud endpoint, and finally create a server endpoint on the registered Windows Server.
Establishing synchronization via Azure File Sync follows a sequential topology construction: configure the cloud control plane (Storage Sync Service), deploy the local agent on the server, establish trust via server registration, set up the sync topology and cloud storage (sync group and cloud endpoint), and then target the local folder (server endpoint).

Step-by-Step Solution

1
Deploy the Storage Sync Service resource in the Azure portal.
A Storage Sync Service resource is successfully created in your resource group.
This resource is the management and orchestration hub for Azure File Sync.
2
Download and install the Azure File Sync agent on the local Windows Server.
The agent and its associated background services are active on the server.
The server requires the local agent to orchestrate file sync and cloud tiering metadata transfers.
3
Run the server registration wizard and authenticate using your Azure credentials.
The Windows Server is registered and appears in the list of registered servers in the Storage Sync Service.
This registration authorizes the server to sync folders through this specific service.
4
Create a sync group inside the Storage Sync Service and associate an Azure file share as the cloud endpoint.
A sync group is initialized with a cloud endpoint linked to an Azure storage account.
The sync group defines the logical boundary for file sync, while the cloud endpoint designates the central cloud copy.
5
Add a server endpoint by specifying a path on the registered Windows Server to the sync group.
A server endpoint is active, and data begins syncing between the local directory and the cloud endpoint.
The server endpoint determines which local folder is mapped into the sync group.

Key Concept

Azure File Sync Deployment Workflow
Question 6Question →

You need to delegate password reset permissions for a specific subset of users in your Microsoft Entra ID tenant by using an administrative unit. Which sequence of steps should you perform to complete the delegation? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first create the administrative unit in the Microsoft Entra admin center, then add the target users to the administrative unit, and finally assign the Helpdesk Administrator role to the delegated administrator scoped to the administrative unit.
To delegate management of a specific subset of users, you must first establish the scope boundary by creating an administrative unit. Next, you populate the administrative unit by adding the target users. Finally, you assign the administrative role to the delegated administrator with the scope restricted to that administrative unit. This ensures the administrator's capabilities are limited to the members of the administrative unit.

Step-by-Step Solution

1
Create the administrative unit in Microsoft Entra ID.
An administrative unit is created to act as the boundary for delegated permissions.
The container must exist before members can be added or roles can be scoped to it.
2
Add the target users to the administrative unit.
The target users are members of the administrative unit.
Members must be in the administrative unit so that the delegated administrator's scoped permissions apply to them.
3
Assign the Helpdesk Administrator role to the delegated administrator with the administrative unit as the scope.
The delegated administrator receives helpdesk permissions only for the members of the administrative unit.
This step applies the role assignment to the delegated admin, restricting their authority to the defined administrative unit scope.

Key Concept

Delegation of administrative roles using administrative units as scopes
Question 7Question →

An administrator needs to configure secure private access to an Azure Storage account named corpstore2026 from a virtual network named VNet1. The solution must ensure that resources in VNet1 can resolve the storage account's fully qualified domain name (FQDN) to its private IP address. All public internet access to the storage account must be blocked. In which order should the administrator perform the configuration steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure secure private access and DNS resolution for the storage account, the administrator must first create the Private DNS zone, link it to the virtual network, deploy the private endpoint to allocate a private IP address, retrieve that private IP address, and finally create the DNS A record mapping the FQDN to the private IP address.
The correct sequence ensures that the DNS infrastructure is prepared and linked to the virtual network first. Once the private endpoint is created, its allocated private IP address can be retrieved and registered as an A record in the Private DNS zone. This ensures seamless transition and correct name resolution from resources within VNet1.

Step-by-Step Solution

1
Create the Private DNS zone named privatelink.blob.core.windows.net.
The Private DNS zone is created in the Azure subscription, preparing the namespace for private resolution.
You must establish the private zone before you can link it to virtual networks or add records to it.
2
Link the Private DNS zone to VNet1.
A virtual network link is established between the Private DNS zone and VNet1.
This step enables name resolution within the virtual network so that resources in VNet1 query the private zone.
3
Create the private endpoint for corpstore2026 in Subnet1 of VNet1.
A private endpoint is provisioned, and a private IP address is allocated from Subnet1's range.
Creating the private endpoint establishes the physical private network interface and generates the private IP address needed for the DNS record.
4
Retrieve the allocated private IP address from the private endpoint's network interface.
The specific private IP address is identified.
The exact private IP address must be known to create the correct A record in the next step.
5
Create a DNS A record in the Private DNS zone mapping corpstore2026.blob.core.windows.net to the private IP address.
The DNS record is added to the private zone.
This updates the DNS resolution path so that requests from VNet1 directed to the storage account resolve to the private endpoint instead of the public endpoint.

Key Concept

Configuring private access to Azure Storage requires deploying a private endpoint and setting up private DNS resolution so that clients resolve the storage account's FQDN to its private endpoint IP address.
Estimated Time:2m 0s
Question 8Question →

Your company has a Microsoft Entra ID tenant. You need to delegate user and license administration tasks for the Sales department. The solution must meet the following requirements:
- A user named Admin1 must be able to reset passwords and manage license assignments for users in the Sales department.
- Admin1's administrative permissions must be restricted to the Sales department users only.
- Licensing conflicts for Sales department users must be resolved by prioritizing group-based licensing over direct assignments.

Which four actions should you perform in sequence? (To answer, arrange the appropriate actions from the list of actions in the correct order.)

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, create the Sales-AU administrative unit and add the Sales department users. Next, assign the User Administrator role to Admin1 at the Sales-AU scope. Then, assign the license to the Sales-Group security group. Finally, remove the direct license assignments from the individual user accounts.
To delegate management of a specific subset of users, you must first define that scope using an administrative unit (Sales-AU) and add the users to it. Next, assign the User Administrator role to Admin1, scoping it specifically to the Sales-AU. Group-based licensing is configured by assigning the license to the security group containing the users. Finally, direct user-level licenses are removed to resolve conflicts and fully transition to group-based licensing.

Step-by-Step Solution

1
Create an administrative unit named Sales-AU and add the Sales department users to it.
An administrative boundary (Sales-AU) containing only the Sales department users is established.
This sets up the scope for delegating administrative tasks.
2
Assign the User Administrator role to Admin1 with the scope set to Sales-AU.
Admin1 is granted User Administrator rights restricted only to the members of Sales-AU.
This complies with the principle of least privilege, preventing Admin1 from managing users outside the Sales department.
3
Assign the license to the Sales-Group security group that contains the Sales department users.
Group-based licensing is configured, allowing all group members to inherit the license.
This establishes group-based licensing as required to minimize administrative overhead.
4
Remove the direct license assignments from the individual user accounts in Sales-AU.
The direct assignments are cleared, leaving only the inherited group licenses active.
This resolves licensing conflicts and ensures that licensing is managed at the group level.

Key Concept

Administrative Units (AUs) allow scoping directory roles (such as User Administrator) to a subset of users. Group-based licensing enables license assignment to a group, which is inherited by its members. Transitioning from direct to group-based licensing requires assigning the license to the group and then removing the direct assignments from individual users.
Question 9Question →

An administrator needs to migrate a folder named `C:\Data` from an on-premises VM to a container named `migration-data` in an Azure Storage account named `mystorageacct` using AzCopy. The migration must meet the following security requirements:

- Authentication to the storage account must be performed using a Microsoft Entra ID service principal.
- Network access to the storage account must be restricted, allowing connections only from the migration VM's public IP address, which is 203.0.113.80203.0.113.80.

Which sequence of actions should the administrator perform on the Azure Portal and the migration VM to execute the migration successfully? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions is: First, assign the Storage Blob Data Contributor role to the service principal. Second, configure the storage account firewall to allow traffic from the public IP address. Third, set the client secret using the environment variable on the migration VM. Fourth, authenticate using the service principal login command. Fifth, execute the AzCopy copy command.
The correct order follows a progression from cloud authorization and network provisioning down to the local machine's environment setup, command-line login, and execution. Setting the RBAC permissions and updating the storage firewall on the Azure side ensures the cloud resources are ready. Setting the environment variable on the migration VM is a prerequisite for running the service principal login command. Once logged in, the copy command can interact with the storage container.

Step-by-Step Solution

1
Assign the Storage Blob Data Contributor role to the service principal.
The service principal is authorized to write blobs to the storage account.
Without this RBAC role assignment, any copy operations using Entra ID credentials will fail with an authorization error.
2
Add the public IP address 203.0.113.80203.0.113.80 to the storage account firewall rules.
The storage account permits inbound connections from the migration VM.
If the firewall is not configured, the migration VM will be unable to communicate with the storage endpoint.
3
Set the `AZCOPY_SPA_CLIENT_SECRET` environment variable on the migration VM.
The client secret is stored securely in the local shell environment.
AzCopy does not accept client secrets directly in the CLI syntax; it relies on reading this specific environment variable.
4
Execute the `azcopy login --service-principal` command using the Application ID and Tenant ID.
The local AzCopy session is successfully authenticated with Microsoft Entra ID.
Authentication must occur before attempting data transfer commands that use Microsoft Entra ID credentials.
5
Execute `azcopy copy "C:\Data" "https://mystorageacct.blob.core.windows.net/migration-data"`.
The folder content is uploaded to the target blob container.
This command initiates the actual data movement once security, firewall, and authentication configurations are complete.

Key Concept

Configuring secure authentication and network connectivity parameters for AzCopy migrations using Microsoft Entra ID and storage account firewalls.
Question 10Question →

Your organization is planning to deploy Azure File Sync to synchronize files from an on-premises Windows Server to an Azure file share. You need to configure the initial sync topology. Which sequence of actions should you perform to set up the sync topology? To answer, arrange the actions in the correct sequential order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure Azure File Sync, you first deploy the Storage Sync Service, install the Azure File Sync agent on the Windows Server, register the server to the service, and then create a Sync Group containing the Cloud Endpoint and the Server Endpoint.
Establishing Azure File Sync requires a logical sequence of prerequisites. First, the Storage Sync Service must exist in the cloud. Second, the agent must be installed on the local server. Third, that agent uses the service identity to register the server. Finally, the Sync Group, Cloud Endpoint (Azure File Share), and Server Endpoint (local path) are created to start syncing.

Step-by-Step Solution

1
Create the Storage Sync Service resource in the Azure portal.
The control plane for synchronization is deployed in Azure.
This resource is a prerequisite for registering servers and organizing synchronization groups.
2
Download and install the Azure File Sync agent on the target Windows Server.
The background services and PowerShell modules for synchronization are installed on the server.
The server cannot communicate with the Storage Sync Service or register without the agent software.
3
Run the server registration wizard or PowerShell commands to register the server.
The Windows Server is successfully registered under the Storage Sync Service.
A server must be registered before it can be used as a sync endpoint.
4
Create a Sync Group, assign the Azure file share as the Cloud Endpoint, and assign the local folder as the Server Endpoint.
File synchronization between the local folder and the cloud share is established.
This step links the cloud storage and local storage to initiate data sync.

Key Concept

Azure File Sync Deployment Sequence
Question 11Question →

You need to configure automatic scale-out rules for an Azure Virtual Machine Scale Set (VMSS) named vmss1vmss1. The scale-out rule must increase the instance count when the average CPU utilization exceeds 75%75\%. In which sequence should you perform the configuration steps in the Azure Portal?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, navigate to the scale set resource and select Scaling. Second, choose Custom autoscale. Third, add a scale rule for Percentage CPU greater than 75. Finally, click Save to apply the configuration.
The correct order begins with navigating to the scaling menu of the VMSS, followed by switching from manual scale to custom autoscale. Once custom autoscale is active, a scale-out rule targeting CPU percentage greater than 75% must be added, and finally, the configuration must be saved to apply the settings.

Step-by-Step Solution

1
Navigate to the VMSS and open the Scaling configuration page.
You are presented with the scaling configurations for the scale set.
This is the entry point for configuring scaling policies on a Virtual Machine Scale Set.
2
Select Custom autoscale.
The UI updates to allow configuring dynamic rules based on metrics.
This enables metric-based scaling as opposed to manual scale configuration.
3
Add a scale rule for CPU utilization greater than 75%.
A rule is added to the default profile that triggers scale-out under the defined condition.
This satisfies the requirement to trigger scale-out based on high CPU usage.
4
Save the configuration.
The autoscale settings are successfully saved and applied.
The autoscale settings only take effect after being saved.

Key Concept

Configuring metric-based autoscale settings for Virtual Machine Scale Sets in the Azure Portal.
Question 12Question →

A company has an on-premises file server named Server1 that is currently registered to a Storage Sync Service and configured as a server endpoint in SyncGroup1. You deploy a new on-premises server named Server2 to replace Server1.

You need to migrate the synchronization workload from Server1 to Server2 while ensuring users experience minimal disruption and no data is lost.

Which sequence of actions should you perform?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, install the Azure File Sync agent on Server2 and register Server2 with the Storage Sync Service; second, create a server endpoint for Server2 in SyncGroup1; third, wait for the initial sync of the file metadata namespace to complete on Server2; fourth, redirect user connections and network share mappings from Server1 to Server2; and finally, remove the server endpoint for Server1 from SyncGroup1.
The correct migration path is to first register Server2 and create a server endpoint in the existing sync group. This allows Server2 to synchronize the namespace (metadata) from the cloud. Once namespace sync is complete, client connections are redirected to Server2. Finally, Server1's endpoint is removed from the sync group.

Step-by-Step Solution

1
Install the Azure File Sync agent on Server2 and register it.
Server2 is registered and visible under registered servers in the Storage Sync Service.
A server must be registered with the Storage Sync Service before it can participate in synchronization.
2
Create a server endpoint for Server2 in SyncGroup1.
Server2 is added to SyncGroup1 as a server endpoint.
Creating the server endpoint registers Server2 as a sync participant for the specific Azure file share in the sync group.
3
Wait for the metadata namespace sync to finish.
Server2 downloads all file metadata and directory structures.
Users cannot access files on Server2 until the namespace synchronization has populated the file database locally.
4
Redirect client connections from Server1 to Server2.
Users access their shares on Server2 instead of Server1.
Redirecting users ensures new changes are made on Server2, which will sync up to Azure.
5
Remove the server endpoint for Server1.
Server1 is disconnected from SyncGroup1.
After users are migrated, Server1's endpoint can be safely removed, stopping its synchronization.

Key Concept

Server retirement and replacement migration using Azure File Sync
Estimated Time:3m 0s
Question 13Question →

You have an Azure subscription that contains a virtual network named VNet1 and a storage account named stcorpdata. You need to configure secure private access to the storage account from VNet1 using a private endpoint. The solution must ensure that resources in VNet1 can resolve the storage account's FQDN to its private IP address. Which sequence of steps should you perform to complete the configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To configure secure private access to the storage account, you must first create the private DNS zone, link the zone to the virtual network, create the private endpoint, integrate it with the DNS zone to auto-register DNS records, and finally restrict the storage account's public network access.
The correct order establishes the prerequisite DNS infrastructure (creating the private DNS zone and linking it to the virtual network) before creating the private endpoint and integrating it. Finally, public access is disabled to restrict all traffic to the private network route.

Step-by-Step Solution

1
Create a private DNS zone named privatelink.blob.core.windows.net.
The DNS namespace for the private endpoint is established in the subscription.
You must create the private DNS zone first so that it can be linked to virtual networks and receive DNS records.
2
Link the private DNS zone to VNet1.
VMs in VNet1 are configured to query the private DNS zone for name resolution.
Without linking the zone to the VNet, resources in the VNet will be unable to resolve the private DNS zone records.
3
Create a private endpoint for the blob service of stcorpdata in VNet1.
A private IP address is allocated to the storage account within the VNet subnet.
The private endpoint must be created to establish a private network interface for the storage service.
4
Configure private DNS integration with the private DNS zone.
A DNS A record is registered mapping stcorpdata.privatelink.blob.core.windows.net to the private endpoint's IP address.
DNS integration ensures that clients can resolve the storage account's public endpoint FQDN to the private IP address.
5
Set the public network access of the storage account to Disabled.
Public internet traffic to the storage account is blocked, and access is restricted to private endpoints only.
This locks down the storage account to complete the security configuration once private connectivity is confirmed.

Key Concept

Configuring private network access and private DNS integration for Azure Storage accounts.
Question 14Question →

You need to configure a custom domain named www.contoso.com for an Azure App Service web app. In which sequence should you perform the configuration steps to verify domain ownership and bind the custom domain?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First retrieve the custom domain verification ID (asuid) from the Custom domains blade of the App Service, then create a TXT record with the host name 'asuid.www' pointing to the verification ID at your DNS registrar, and finally add and validate the custom domain name in the App Service custom domains settings.
The correct order requires retrieving the verification ID first, creating the corresponding TXT record in the DNS zone to prove ownership, and then adding and validating the domain name within the Azure App Service custom domains configuration.

Step-by-Step Solution

1
Retrieve the custom domain verification ID (asuid) from the App Service.
The verification ID is obtained from the Azure Portal.
This unique ID is required to configure the DNS TXT record for ownership verification.
2
Create the TXT record in your DNS zone at your domain registrar.
A TXT record with the host name 'asuid.www' pointing to the verification ID is created.
Azure queries this TXT record during the validation step to verify domain ownership.
3
Add the custom domain 'www.contoso.com' to the App Service and click Validate.
The custom domain is successfully validated and bound to the App Service.
This completes the binding process after ownership has been successfully verified via DNS.

Key Concept

Azure App Service Custom Domain Verification and Binding
Question 15Question →

You need to upload a local file to an Azure Blob storage container using AzCopy. You plan to use Microsoft Entra ID authentication instead of a Shared Access Signature (SAS) token. Arrange the steps in the correct sequence to perform this upload.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first assign the Storage Blob Data Contributor role, then log in using the `azcopy login` command, and finally execute the transfer using the `azcopy copy` command.
To perform a file upload using AzCopy with Microsoft Entra ID authentication, you must first ensure your user account has the required data plane permissions (such as Storage Blob Data Contributor). Then, you must authenticate the tool session by running `azcopy login`. Once logged in, you can run `azcopy copy` to copy the file to the destination URL.

Step-by-Step Solution

1
Assign the Storage Blob Data Contributor role to the administrator's user account.
The administrator's identity is authorized to perform data plane operations on the blob container.
Microsoft Entra ID authentication requires specific data plane RBAC roles. Management-plane roles like Owner or Contributor do not grant data plane access by default.
2
Run `azcopy login` and authenticate.
An active authenticated command-line session is established.
Before performing any commands that rely on Microsoft Entra ID authentication, the AzCopy tool must be logged in using your identity.
3
Run `azcopy copy` with the source and destination paths.
The local file is successfully uploaded to the destination blob container.
The copy command runs under the context of the logged-in identity to write the file to the container.

Key Concept

Microsoft Entra ID Authentication Sequence for AzCopy
Question 16Question →

Your company uses an Azure Virtual Machine Scale Set (VMSS) named vmss-web to host a web application. You need to configure a custom autoscale policy to scale out the VMSS when CPU usage exceeds 7575 percent. In what sequence must you perform these actions in the Azure Portal?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, navigate to the Scaling settings of the Virtual Machine Scale Set. Second, enable Custom autoscale. Third, add the rule specifying the CPU threshold and scale-out behavior. Finally, save the settings.
To set up a custom autoscale policy, you must first browse to the scaling options of the target VMSS. Since VMSS defaults to manual scale, you must switch the configuration to Custom autoscale. Once enabled, you configure the specific CPU metric rule and then save the changes to commit them to the resource.

Step-by-Step Solution

1
Open the Virtual Machine Scale Set scaling section
Displays scaling configuration options
Allows you to modify the scaling policy from default manual configuration
2
Enable Custom autoscale
Unlocks the ability to add scale rules
By default, scale sets are set to manual scale and do not support metric-based triggers without enabling custom autoscale
3
Configure the scale-out rule based on CPU metric
Creates the trigger definition
Associates the 7575 percent threshold with the scale-out action
4
Save the configuration
Applies the autoscale setting to the VMSS
The rules will not execute until saved and provisioned by the Azure Resource Manager

Key Concept

Configuring metric-based custom autoscale rules on an Azure Virtual Machine Scale Set
Estimated Time:1m 0s
Question 17Question →

An administrator is managing an Azure Virtual Machine Scale Set (VMSS) named `vmss-app` that uses Uniform orchestration, has a current instance count of 5, and uses a Manual upgrade policy. The administrator needs to deploy a custom shell script that configures a web server on all current and future VM instances in the scale set.

Which sequence of actions should the administrator perform to ensure that the configuration is registered in the scale set model and applied to all active instances? To answer, arrange the actions in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

First, upload the script to the Azure Storage blob container. Second, generate a SAS token for the script blob. Third, add the Custom Script Extension to the VMSS model referencing the blob URI and SAS token. Fourth, manually trigger an upgrade on the existing VMSS instances to apply the updated model.
The correct sequence begins with uploading the script and generating a SAS token, as the VMSS model configuration requires a valid URI and credentials to be defined. Once the model is updated, the manual upgrade must be triggered last so that the instances pull the newly modified model rather than the old one.

Step-by-Step Solution

1
Upload the script file to a container in an Azure Storage account.
The configuration script is stored securely in Azure, ready to be retrieved.
The Custom Script Extension requires a URI to download the configuration script during execution.
2
Generate a Shared Access Signature (SAS) token for the script blob.
A secure access token is created for the blob.
The VMSS instances need read-only access to download the script without making the storage container public.
3
Add the Custom Script Extension to the VMSS configuration model.
The VMSS model is updated with the extension configuration, ensuring future instances will apply it automatically.
Modifying the scale set model registers the extension but does not automatically push it to currently running instances when using Manual upgrade mode.
4
Select the existing VM instances in the scale set and trigger a manual upgrade.
The 5 existing instances pull the updated VMSS model and execute the Custom Script Extension.
Under a Manual upgrade policy, existing instances must be explicitly upgraded to adopt the latest VMSS model.

Key Concept

Applying configuration changes to existing and future instances of a Virtual Machine Scale Set (VMSS) with a Manual upgrade policy.
Question 18Question →

You have an Azure App Service web app named WebApp1 and an Azure Key Vault named Vault1. You need to store a database connection string in Vault1 as a secret and configure WebApp1 to securely retrieve the connection string without exposing the raw secret value in the App Service configuration. Which sequence of steps should you perform to complete this configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To securely reference a Key Vault secret in WebApp1, you must first enable a system-assigned managed identity for WebApp1, then assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1, retrieve the Secret Identifier URL of the database connection string secret from Vault1, and finally create an application setting in WebApp1 that references the Secret Identifier using the key vault reference syntax.
The correct sequence starts with enabling the system-assigned managed identity because the identity must exist in Microsoft Entra ID before any access permissions can be granted. Once created, the Key Vault Secrets User role must be assigned to the identity so that WebApp1 can read secrets. Next, the Secret Identifier URL is retrieved from Vault1 to point to the correct secret. Finally, the App Service application settings must be updated with this URI using the Key Vault reference syntax so that the runtime can fetch the secret.

Step-by-Step Solution

1
Enable a system-assigned managed identity for WebApp1.
A service principal is registered in Microsoft Entra ID for the web app, allowing it to authenticate to other Azure services.
An identity must exist before permissions can be assigned to it.
2
Assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1.
The web app's managed identity is granted read access to secrets in Vault1.
By default, App Services do not have permission to read secrets from Key Vault; authorization is required.
3
Retrieve the Secret Identifier URL of the database connection string secret from Vault1.
You obtain the specific URI pointing to the secret version in Key Vault.
The App Service application setting configuration requires this URI to resolve the secret value.
4
Create an application setting in WebApp1 that references the retrieved Secret Identifier using the key vault reference syntax.
WebApp1 resolves the secret at runtime and exposes it as an environment variable to the application code.
The `@Microsoft.KeyVault` syntax tells the App Service runtime to fetch the secret on behalf of the application.

Key Concept

Azure App Service Key Vault references allow web apps to pull secrets from Key Vault at runtime using managed identities, keeping credentials out of the application configuration.
Estimated Time:1m 30s
Question 19Question →

Your organization has an on-premises Windows Server named Server1. You need to configure Azure File Sync to synchronize a local folder on Server1 with a new Azure file share. You have already created a resource group and a storage account in Azure. Which sequence of actions should you perform to establish synchronization? To answer, move the appropriate actions to the answer area and arrange them in the correct order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Deploy a Storage Sync Service resource in the Azure subscription, install the Azure File Sync agent on Server1, register Server1 with the Storage Sync Service, create a Sync Group and add the Azure file share as a Cloud Endpoint, and then create a Server Endpoint on Server1 pointing to the local folder.
To deploy Azure File Sync, you must first create the Storage Sync Service in Azure. Next, you must install the Azure File Sync agent on the on-premises Windows Server. Once the agent is installed, you register the Windows Server with the Storage Sync Service. After the server is registered, you create a sync group and define the cloud endpoint (the Azure file share). Finally, you create a server endpoint to link the local path on the registered server to the sync group.

Step-by-Step Solution

1
Deploy the Storage Sync Service in Azure.
The central management resource is available to coordinate synchronization.
All servers must register to a Storage Sync Service, and sync groups reside within it.
2
Install the Azure File Sync agent on Server1.
The file sync driver and registration utility are installed on the local server.
The registration utility and sync agent are required on the host OS before registration can occur.
3
Register Server1 with the Storage Sync Service.
Server1 appears as a registered server in the Storage Sync Service resource.
Establishing a trust relationship is required before the server can host sync endpoints.
4
Create a Sync Group and add the Azure file share as a Cloud Endpoint.
The sync topology container is established, linking the cloud storage.
A sync group and a cloud endpoint must exist before any local folders can be added to the sync topology.
5
Create a Server Endpoint on Server1 pointing to the local folder.
Synchronization begins between the local folder on Server1 and the Azure file share.
The server endpoint links the registered server's local path to the sync group.

Key Concept

Azure File Sync deployment order and topological dependencies
Estimated Time:2m 30s
Question 20Question →

You need to implement a hybrid file distribution solution using Azure File Sync. The environment consists of a local Windows Server 2025 file server and an Azure storage account containing an empty file share. You must deploy Azure File Sync to synchronize the local folder with the Azure file share. Which sequence of steps should you perform to complete the deployment and start synchronization?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Deploy the Storage Sync Service, install the Azure File Sync agent on the local Windows Server, register the server with the Storage Sync Service, create a Sync Group and add the Azure file share as a cloud endpoint, and then create a server endpoint representing the local directory.
The correct deployment sequence starts with creating the Storage Sync Service in Azure. Next, you install the agent on the Windows Server and register that server to the Storage Sync Service. After the server is registered, you create a Sync Group and define the cloud endpoint (Azure file share). Finally, you add the server endpoint mapping the local folder to start synchronization.

Step-by-Step Solution

1
Deploy the Storage Sync Service resource in Azure.
A top-level Storage Sync Service is available in the Azure subscription to manage the sync topology.
You must establish the cloud management infrastructure before attempting to connect on-premises servers.
2
Install the Azure File Sync agent on the local Windows Server.
The File Sync agent services and command-line tools are installed on the local operating system.
The server requires the agent binaries to communicate and coordinate sync activities with Azure.
3
Register the Windows Server with the Storage Sync Service.
The server is registered and appears in the Registered Servers list of the Storage Sync Service.
This establishes trust between the local server and the Azure Storage Sync Service resource.
4
Create a Sync Group and add the cloud endpoint (Azure file share).
A Sync Group is established with the Azure file share acting as the master repository.
The cloud endpoint defines where the synced data resides in Azure and must be configured before local endpoints are mapped.
5
Create a server endpoint inside the Sync Group.
The local folder path is mapped as a server endpoint, initiating synchronization between the server and the cloud.
This finalizes the sync path, triggering the actual replication of files.

Key Concept

Azure File Sync deployment order requires establishing the Azure-side management resource, preparing and registering the server, defining the sync group topology with a cloud endpoint, and lastly establishing the server endpoint.
Page 1 / 4Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin