Examkin

All practice questions

1186 questions

All types1,186Multiple choice620Multiple select228True / False291Matching47
Question 221Question →

A retail chain operates point-of-sale physical Linux servers at multiple store locations. The IT team wants to manage and govern these servers using Azure Policy without migrating the workloads to the Azure cloud. Is it true or false that Azure Arc can project these on-premises physical servers as registered resources in Azure Resource Manager?

Show answer & explanation

Answer: True

Answer

True
Azure Arc allows organizations to project on-premises physical servers, both Windows and Linux, as resources in Azure Resource Manager. This enables central management via the Azure Portal and the application of Azure governance tools like Azure Policy without relocating the server workloads.

Step-by-Step Solution

1
Analyze the organization's requirements: they need to manage on-premises physical Linux servers using Azure governance tools (Azure Policy) without migrating the servers to the cloud.
Identify that the core requirement is managing non-Azure resources from a centralized Azure control plane.
This establishes the context for evaluating the capability of Azure Arc.
2
Evaluate the capabilities of Azure Arc regarding physical servers.
Confirm that Azure Arc enables the registration of physical servers (running Windows or Linux) outside of Azure as hybrid machines projected into Azure Resource Manager.
This directly determines if the statement is true or false.

Key Concept

Azure Arc extends Azure management and governance (such as Azure Policy and Azure Resource Manager) to physical and virtual servers located on-premises or in other clouds without migrating them.
Question 222Question →

An organization is designing a monitoring and alerting strategy for a mission-critical web application hosted on Azure Virtual Machines and Azure SQL Database. The IT team must implement solutions to address three distinct needs:

1. Receive notifications and track status updates regarding widespread infrastructure issues, planned maintenance, or regional outages affecting the Azure SQL Database service itself in their active region.
2. Collect and analyze performance data, such as CPU utilization and memory usage, at one-minute intervals to trigger immediate automated scaling actions for the virtual machines.
3. Perform complex diagnostic queries and correlate log data across multiple virtual machines, operating system logs, and application logs spanning the last 30 days.

Which combination of Azure features should the organization use to satisfy these three requirements?

Show answer & explanation

Answer: 1. Azure Service Health; 2. Azure Monitor Metrics; 3. Azure Monitor Logs (Log Analytics)

Answer

The correct combination is to use Azure Service Health for regional infrastructure outages, Azure Monitor Metrics for near real-time VM scaling, and Azure Monitor Logs (Log Analytics) for complex queries and log correlation.
The correct option outlines the appropriate service for each requirement: Azure Service Health notifies the organization about platform-level outages affecting Azure SQL Database; Azure Monitor Metrics collects lightweight performance metrics at high frequency for instant autoscale alerts; and Azure Monitor Logs (Log Analytics) utilizes KQL to run complex, correlation queries across aggregated logs over the past 30 days.

Step-by-Step Solution

1
Analyze Requirement 1 regarding widespread infrastructure issues, planned maintenance, or regional outages.
Identify that Azure Service Health is the dedicated tool to keep track of global, regional, or service-level health, outages, and planned maintenance affecting Azure services.
Azure Monitor tracks the health and performance of your specific resources, whereas Azure Service Health tracks the health of the Azure infrastructure itself.
2
Analyze Requirement 2 regarding near real-time performance data (CPU/memory) and auto-scaling.
Identify that Azure Monitor Metrics is designed for high-frequency, near real-time data collection, which is optimal for trigger-based alerts and immediate auto-scaling.
Metrics are stored in a lightweight, time-series database optimized for fast retrieval and evaluation.
3
Analyze Requirement 3 regarding complex diagnostic queries and data correlation across multiple logs.
Identify that Azure Monitor Logs (Log Analytics) is the component that uses the Kusto Query Language (KQL) to search, aggregate, and correlate diverse log datasets over custom time ranges.
Log Analytics workspace supports writing complex queries to combine event logs, syslogs, and application logs into a single analysis.

Key Concept

Azure Monitor (Metrics vs. Logs) and its relationship with Azure Service Health
Estimated Time:1m 30s
Question 223Question →

A financial services company is planning two projects. First, they want to compare the overall financial impact of migrating their entire on-premises VMware environment—including server hardware, virtualization licensing, maintenance labor, and power costs—to Azure over a three-year period. Second, they need to estimate the monthly consumption costs for a new cloud-native serverless application and a NoSQL database they plan to deploy in Azure next month. Which tools should the company use to estimate the costs for these two projects?

Show answer & explanation

Answer: The Total Cost of Ownership (TCO) Calculator for the data center migration, and the Azure Pricing Calculator for the new cloud-native application.

Answer

The Total Cost of Ownership (TCO) Calculator should be used for the on-premises migration comparison, and the Azure Pricing Calculator should be used to estimate costs for the new cloud-native application.
The Total Cost of Ownership (TCO) Calculator is the correct tool for comparing on-premises infrastructure costs (which include CapEx items like hardware, virtualization licenses, electricity, and maintenance labor) with Azure. The Azure Pricing Calculator is the correct tool for estimating the monthly operating costs (OpEx) of specific new cloud-native Azure services prior to their deployment.

Step-by-Step Solution

1
Analyze the requirements for the data center migration project.
The project requires comparing existing on-premises costs (including physical servers, labor, software licenses, electricity, and overhead) to Azure services.
The Total Cost of Ownership (TCO) Calculator is specifically designed to accept these on-premises parameters to produce a cost-comparison report against Azure.
2
Analyze the requirements for the new cloud-native application.
The project requires estimating the monthly consumption costs for specific Azure services (serverless compute and NoSQL database) before deployment.
The Azure Pricing Calculator provides detailed, configuration-based cost estimates for individual Azure services based on usage parameters.

Key Concept

Azure Pricing Calculator vs. Total Cost of Ownership (TCO) Calculator
Question 224Question →

A financial institution wants to link its local data center to Azure resources. The institution requires a private connection that completely bypasses the public internet to ensure maximum security and predictable performance. Which Azure service should the institution implement to meet these requirements?

Show answer & explanation

Answer: ExpressRoute

Answer

ExpressRoute
ExpressRoute is the correct service because it establishes a private, dedicated connection from an on-premises data center to Azure through a connectivity provider. This connection does not traverse the public internet, ensuring low latency, high reliability, and maximum privacy.

Step-by-Step Solution

1
Analyze the requirements for the hybrid connection between the on-premises data center and Azure.
The connection must be private and must completely bypass the public internet.
To ensure maximum security and predictable network performance.
2
Compare the available Azure connectivity options against these requirements.
ExpressRoute is the only hybrid connectivity option that uses a private dedicated connection instead of routing traffic over the public internet.
VPN Gateway and Point-to-Site VPN rely on the public internet, and Virtual Network Peering is for VNet-to-VNet connection within Azure.

Key Concept

ExpressRoute provides a private dedicated connection that bypasses the public internet.
Question 225Question →

A company needs to connect its local office to an Azure virtual network. The connection must be established quickly, utilize the company's existing public internet connection, and ensure all data in transit is encrypted.

Which Azure service should the company implement?

Show answer & explanation

Answer: Azure VPN Gateway

Answer

Azure VPN Gateway
The correct answer is the virtual private network gateway service because it is designed to establish an encrypted tunnel over the public internet between the local site and the Azure Virtual Network, which matches the scenario constraints.

Step-by-Step Solution

1
Analyze the requirements for the hybrid connection: it must use the public internet, encrypt data in transit, and be quick to establish.
Determine that the connection requires an encrypted tunnel over the public internet.
This rules out private lines like ExpressRoute that do not run over the public internet.
2
Identify the service that matches these requirements.
Azure VPN Gateway is selected because it establishes a secure IPsec connection over the public internet.
To verify that VPN Gateway meets all the company's hybrid networking requirements.

Key Concept

Azure VPN Gateway provides encrypted connectivity between an on-premises network and an Azure Virtual Network over the public internet.
Question 226Question →

A logistics company is designing a serverless solution to automate its shipment tracking pipeline. The solution has two distinct requirements:

1. It must orchestrate a visual, low-code workflow that triggers when a package is delayed, sending notifications through Microsoft Teams and updating a Salesforce record using pre-built API connectors.
2. It must execute a proprietary C# code script to calculate custom shipping insurance risk adjustments based on telemetry data.

Which Azure services should the company select for requirement 1 and requirement 2?

Show answer & explanation

Answer: Azure Logic Apps for requirement 1, and Azure Functions for requirement 2

Answer

Azure Logic Apps for requirement 1, and Azure Functions for requirement 2
The correct option is Azure Logic Apps for requirement 1 and Azure Functions for requirement 2. Azure Logic Apps provides a low-code, designer-first orchestration platform with out-of-the-box connectors to services like Salesforce and Microsoft Teams. Azure Functions provides a serverless execution environment for running custom code, such as C# scripts, without managing infrastructure.

Step-by-Step Solution

1
Analyze the workflow orchestration requirement (Requirement 1)
The requirement specifies a visual, low-code workflow with pre-built connectors to external SaaS platforms like Microsoft Teams and Salesforce.
This points to Azure Logic Apps, which is designed specifically for connector-first orchestration with minimal code.
2
Analyze the code execution requirement (Requirement 2)
The requirement specifies running a custom, proprietary C# script using telemetry data.
This points to Azure Functions, which is a code-first serverless service designed to run custom code snippets in response to triggers.
3
Synthesize the service choices and match with the options
The correct combination is Azure Logic Apps for requirement 1 and Azure Functions for requirement 2.
Combining these two services provides a fully serverless solution with minimal management overhead, matching all constraints.

Key Concept

Azure Serverless Compute (Functions and Logic Apps)
Estimated Time:1m 30s
Question 227Question →

A startup's IT team consists of administrators using local machines running macOS, Ubuntu Linux, and Windows 11. The team needs to configure a set of administrative tools to deploy Azure resources. Which two statements are correct regarding the compatibility and hosting of Azure management tools for this team?

Select all that apply

Show answer & explanation

Answer: Azure CLI and Azure PowerShell can both be installed locally on macOS, Ubuntu Linux, and Windows 11 to execute scripts.; Azure Cloud Shell provides a browser-based environment that includes both Azure CLI and Azure PowerShell, requiring no local installation of either tool.

Answer

The correct statements are that Azure CLI and Azure PowerShell can both be installed locally on macOS, Ubuntu Linux, and Windows 11, and that Azure Cloud Shell provides a browser-based environment pre-installed with both tools.
The correct options are correct because Azure CLI and Azure PowerShell are cross-platform utilities that can be installed on Windows, macOS, and Linux. Additionally, Azure Cloud Shell runs in a cloud container and is fully accessible via browser on any platform without requiring local installations.

Step-by-Step Solution

1
Evaluate local installation requirements for Azure CLI and Azure PowerShell across different operating systems.
Confirm that both tools support cross-platform installation on macOS, Linux, and Windows.
To verify if local deployment is possible for all team members.
2
Analyze Azure Cloud Shell features and dependency on local workstation OS.
Establish that Cloud Shell is cloud-hosted, requires no local installation, and provides both CLI and PowerShell tools to any client browser.
To determine browser-based accessibility capabilities.

Key Concept

Cross-platform compatibility of Azure management tools (Azure Portal, Azure CLI, Azure PowerShell, and Azure Cloud Shell).
Question 228Question →

An administrator wants to use Azure Cloud Shell to manage cloud resources. Is it true or false that you must install the Azure CLI or Azure PowerShell modules on your local computer before you can use Azure Cloud Shell?

Show answer & explanation

Answer: False

Answer

The statement is false because Azure Cloud Shell runs in a cloud-hosted container and does not require local installation of the Azure CLI or Azure PowerShell.
The statement is false. Azure Cloud Shell is a cloud-hosted, browser-based management tool that comes with Azure CLI and Azure PowerShell pre-installed, meaning administrators do not need to install these tools locally to manage resources.

Step-by-Step Solution

1
Analyze how Azure Cloud Shell is accessed and hosted.
Azure Cloud Shell is accessed directly through a web browser (e.g., via the Azure Portal) and is hosted in the cloud by Microsoft.
This establishes that the execution environment is remote, not local.
2
Determine if command-line tools are pre-configured in the container.
Microsoft pre-installs and updates Azure CLI and Azure PowerShell in the Cloud Shell container.
This confirms that the administrator does not need to download or install these tools on their local operating system to use the cloud shell.

Key Concept

Azure Cloud Shell is a browser-accessible, pre-configured shell environment that removes the need for local command-line tool installations.
Question 229Question →

An administrator assigns an Azure Policy definition that blocks public network access to storage accounts (using the 'Deny' effect) at a management group level. A developer subsequently creates a new subscription under this management group, creates a new resource group within that subscription, and attempts to deploy a storage account with public network access enabled. The deployment will be blocked due to policy inheritance. Is this statement true?

Show answer & explanation

Answer: True

Answer

True
The statement is true because Azure Policy assignments are inherited down the resource hierarchy (Management Groups -> Subscriptions -> Resource Groups -> Resources). Any resources created in child scopes, even after the policy is assigned, must comply with the policy. The 'Deny' effect actively blocks the creation of non-compliant resources.

Step-by-Step Solution

1
Determine the policy assignment scope and inheritance behavior.
The policy is assigned at the management group level, meaning the policy rule is inherited by all child scopes, including any subscriptions and resource groups nested beneath it.
Azure governance follows a hierarchy where child scopes automatically inherit policy assignments from parent scopes.
2
Evaluate the impact on newly created resources and scopes.
Newly created subscriptions and resource groups under the management group immediately inherit the active policy definition.
Inheritance is dynamic and applies to all current and future resources within the scope of the assignment.
3
Determine the effect of the policy on the deployment attempt.
The 'Deny' effect blocks the creation of the non-compliant storage account.
The 'Deny' effect is evaluated during resource creation or update and prevents the deployment if it does not comply with the policy rules.

Key Concept

Azure Policy inheritance and enforcement scopes
Question 230Question →

A development team wants to deploy a containerized web application to Azure. The application must scale automatically in response to web traffic fluctuations, support custom SSL certificates, and require zero virtual machine or container orchestrator management. The team also wants Microsoft to handle all host-level operating system updates.

Which Azure service should the team select to meet these requirements?

Show answer & explanation

Answer: Azure App Service

Answer

Azure App Service
Azure App Service is a fully managed Platform as a Service (PaaS) that supports containerized web applications. It provides built-in auto-scaling, custom domains, and SSL certificate support out of the box. Since it is a PaaS service, Microsoft handles all host-level operating system patching and infrastructure management, requiring zero virtual machine or container orchestrator configuration from the customer.

Step-by-Step Solution

1
Analyze the requirements: container deployment, automated HTTP-based scaling, custom SSL support, zero virtual machine or orchestrator management, and Microsoft-managed host patching.
Identified the need for a fully managed PaaS solution optimized for web hosting and containers.
This filters out IaaS solutions and complex container orchestrators.
2
Evaluate the options against these criteria.
Azure Virtual Machines requires manual patching (IaaS). Azure Kubernetes Service requires container orchestration management. Azure Container Instances lacks native HTTP auto-scaling and direct SSL/custom domain integration. Azure App Service meets all requirements.
Matching service capabilities ensures the selected option satisfies all operational constraints.

Key Concept

Azure Container Instances, Azure Kubernetes Service, and Azure App Service capabilities
Question 231Question →

An organization has an Azure management group named Finance-MG that contains three Azure subscriptions. A user needs to view the configuration details of all resources across all three subscriptions, but must not be allowed to modify any resources or grant permissions to other users. Which of the following administrative actions should you perform to meet this requirement?

Show answer & explanation

Answer: Assign the Reader role to the user at the Finance-MG management group level.

Answer

Assign the Reader role to the user at the Finance-MG management group level.
Assigning the Reader role at the management group level allows the user to view all resource configurations across all subscriptions in that group due to inheritance, without permitting any modifications or access delegation.

Step-by-Step Solution

1
Identify the required level of access (read-only access to resource configurations without modification or delegation capabilities).
The Reader built-in role matches this access level exactly.
The Reader role allows viewing resources but does not allow making changes (like Contributor) or managing access (like Owner/User Access Administrator).
2
Determine the scope where the role assignment should be applied to cover all three subscriptions.
The parent Finance-MG management group is the appropriate scope.
Due to Azure RBAC inheritance, permissions assigned at a parent management group propagate down to all child subscriptions and their nested resources.

Key Concept

Azure RBAC Scope and Inheritance
Question 232Question →

A company is designing a globally distributed application that must store user profiles using MongoDB-compatible JSON documents and social connections using Gremlin-compatible graph queries. The company wants to ensure that Microsoft manages all database software updates and operating system patching.

Which Azure database service should the company choose?

Show answer & explanation

Answer: Azure Cosmos DB

Answer

Azure Cosmos DB
Azure Cosmos DB is the correct answer because it is Microsoft's globally distributed, multi-model NoSQL database. It natively supports both the MongoDB API (for JSON documents) and the Gremlin API (for graph data) while running as a fully managed Platform as a Service (PaaS) where Microsoft handles all operating system patching and software updates.

Step-by-Step Solution

1
Identify the data model and API requirements.
The application requires MongoDB-compatible JSON document storage and Gremlin-compatible graph query support.
This establishes that the solution must be a multi-model NoSQL database service rather than a traditional relational database.
2
Identify the management and patching requirements.
Microsoft must manage all database updates and operating system patching, pointing to a Platform as a Service (PaaS) model.
This rules out Infrastructure as a Service (IaaS) offerings like SQL Server on Azure Virtual Machines, where the customer is responsible for OS updates.
3
Select the service that satisfies both requirements.
Azure Cosmos DB is the only PaaS database service in Azure that natively supports both MongoDB (document) and Gremlin (graph) APIs.
This matches all design and management constraints.

Key Concept

Azure Cosmos DB is a fully managed NoSQL database service that supports multiple APIs (multi-model) for flexible data access, while eliminating operating system patching overhead.
Question 233Question →

A financial services firm hosts a critical transactional system on Azure. The system consists of multiple Azure Virtual Machines (IaaS) and an Azure SQL Database (PaaS).

To align with corporate governance policies, the operations team must satisfy the following three requirements:
1. Prevent administrators from deploying any new resources outside the 'East US 2' region.
2. Identify which of the currently running virtual machines are underutilized so they can be shut down or resized to save costs.
3. Prevent the accidental deletion of the production Azure SQL Database by any user, including administrators.

Which combination of Azure services and features should the operations team use to meet these requirements?

Show answer & explanation

Answer: Azure Policy to restrict deployment regions, Azure Advisor to identify underutilized virtual machines, and resource locks to prevent database deletion.

Answer

The correct combination requires using Azure Policy to restrict deployment regions, Azure Advisor to identify underutilized virtual machines, and resource locks to prevent database deletion.
The correct option matches the requirements to their respective Azure services: Azure Policy enforces deployment compliance (e.g., allowed locations), Azure Advisor identifies cost-optimization opportunities such as underutilized virtual machines, and resource locks (CanNotDelete) prevent the database from being deleted.

Step-by-Step Solution

1
Analyze the first requirement: preventing resource deployment outside the 'East US 2' region.
Identify that Azure Policy is the correct tool because it enforces compliance and configuration rules, such as allowed locations, on resources.
Azure Policy allows organizations to define rules for resource properties, preventing non-compliant resource creation.
2
Analyze the second requirement: identifying underutilized virtual machines to optimize cost.
Identify that Azure Advisor is the correct tool because its Cost recommendation category evaluates resource utilization data and suggests right-sizing or shutting down idle virtual machines.
Azure Advisor provides personalized, actionable best practices across cost, security, reliability, performance, and operational excellence.
3
Analyze the third requirement: preventing accidental deletion of the production database.
Identify that Resource Locks (specifically a CanNotDelete lock) are the correct mechanism to protect critical resources from deletion.
Resource locks apply a restriction that prevents deletion or modification by any user, including resource owners and administrators.

Key Concept

Azure Management and Governance boundaries including Azure Advisor, Azure Policy, and Resource Locks.
Estimated Time:2m 0s
Question 234Question →

A company stores database backup files in an Azure Blob Storage container. To reduce storage costs, an Azure lifecycle management policy automatically transitions these files to the Archive storage tier 7 days after creation. A database administrator needs to test a backup restore process by running a validation script that reads the binary contents of a backup file created 15 days ago.

Which action must the administrator perform before running the validation script?

Show answer & explanation

Answer: Rehydrate the backup file by changing its storage tier to Hot or Cool, or by copying it to a new blob in an online tier.

Answer

Rehydrate the backup file by changing its storage tier to Hot or Cool, or by copying it to a new blob in an online tier.
To read or access the data within a blob that is in the Archive storage tier, the data must first be rehydrated to an online tier (Hot or Cool). This can be achieved by changing the tier of the existing blob or by copying the archived blob to a new blob in an online tier.

Step-by-Step Solution

1
Identify the current storage tier of the database backup file.
The file was created 15 days ago, so the lifecycle policy has moved it to the Archive storage tier.
Data in the Archive tier is stored offline and cannot be read directly.
2
Determine the requirement for running the validation script.
The script must read the binary contents of the backup file.
Reading binary data requires the file to be online.
3
Select the correct method to bring the archived data online.
Initiate blob rehydration by changing the tier to Hot or Cool, or by copying the blob to a new blob in an online tier.
Rehydration is the only way to make the archived binary data readable again.

Key Concept

Azure Blob Storage Archive tier data must be rehydrated to an online tier (Hot or Cool) before its binary contents can be read or accessed.
Question 235Question →

An administrator assigns an Azure Policy with the 'Modify' effect to remediate non-compliant resources within a resource group. To perform the remediation of these resources, Azure Policy executes the remediation tasks by using the security credentials of the administrator who assigned the policy. Is this statement true or false?

Show answer & explanation

Answer: False

Answer

False
The correct answer is false because Azure Policy remediation tasks do not run under the security credentials of the administrator who assigned the policy; instead, they require a managed identity with the necessary RBAC permissions.

Step-by-Step Solution

1
Analyze how Azure Policy remediation works for effects like 'Modify' and 'DeployIfNotExists'.
Identify that these effects require a managed identity to perform remediation actions.
Remediation involves changing or creating Azure resources, which requires write permissions.
2
Determine the security context used to execute these remediation tasks.
Recognize that Azure Policy creates a managed identity (either system-assigned or user-assigned) and uses that identity's permissions.
Azure enforces security boundaries and does not impersonate the user credentials of the administrator.
3
Evaluate the statement in the prompt against these findings.
The statement claims the tasks are run using the security credentials of the administrator who assigned the policy, which is false.
This contradicts the security model of Azure Policy remediation which uses managed identities.

Key Concept

Azure Policy Remediation Security Context
Question 236Question →

An organization has deployed a production database on Azure. The database administrator wants to find out if there are any specific recommendations to optimize the database's performance and responsiveness without manually writing custom alerts. Which Azure tool should they use to retrieve these automated, personalized best-practice suggestions?

Show answer & explanation

Answer: Azure Advisor

Answer

Azure Advisor
The correct option is Azure Advisor because it evaluates resource configuration and usage telemetry to suggest improvements across five key pillars, including performance optimization.

Step-by-Step Solution

1
Identify the goal of the administrator, which is to obtain personalized, automated recommendations to optimize performance and responsiveness.
The target requirement falls under performance optimization recommendations.
Understanding the requirement helps isolate the Azure service designed specifically to evaluate resources against best practices.
2
Compare the capabilities of Azure Advisor, Azure Policy, Azure Monitor, and Microsoft Defender for Cloud.
Azure Advisor is the correct tool because it automatically provides recommendations across five categories including Performance.
This confirms which tool aligns with automatic, personalized optimization recommendations.

Key Concept

Azure Advisor provides personalized recommendations to optimize Azure deployments across cost, security, reliability, performance, and operational excellence.
Estimated Time:45s
Question 237Question →

A company needs to store data in a non-relational (NoSQL) database that supports multi-model APIs and offers global scale. Which Azure database service should the company use?

Show answer & explanation

Answer: Azure Cosmos DB

Answer

Azure Cosmos DB
Azure Cosmos DB is Microsoft's globally distributed, multi-model NoSQL database service. It is designed to support non-relational data structures, single-digit millisecond latency, and multiple APIs (such as MongoDB, Cassandra, and Gremlin).

Step-by-Step Solution

1
Identify the key requirement in the scenario, which is a non-relational (NoSQL) database that supports multi-model APIs and global scale.
The target database type is NoSQL with multi-API support.
Filtering database options by their data model is the first step to selecting the correct service.
2
Evaluate the available Azure database services to find the one that fits a NoSQL multi-API model.
Azure Cosmos DB is identified as the NoSQL option, while Azure SQL Database, SQL Server on Azure VMs, and Azure Database for PostgreSQL are relational database services.
This distinguishes the relational services from the non-relational services.

Key Concept

Azure Database Services (Relational, Non-Relational, and Cosmos DB)
Estimated Time:45s
Question 238Question →

An IT department is training new administrators on Azure management tools. Which two statements correctly describe the operating system compatibility of Azure CLI and Azure PowerShell when installed locally? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure CLI can be installed and run on Windows, macOS, and Linux.; Azure PowerShell can be installed and run on Windows, macOS, and Linux.

Answer

Azure CLI can be installed and run on Windows, macOS, and Linux, and Azure PowerShell can be installed and run on Windows, macOS, and Linux.
Both Azure CLI and Azure PowerShell are designed to be cross-platform. They can be installed locally on Windows, macOS, and Linux, allowing administrators to use their preferred scripting language across different client operating systems.

Step-by-Step Solution

1
Evaluate the operating system compatibility of Azure CLI.
Azure CLI is cross-platform and runs on Windows, macOS, and Linux.
To identify if Azure CLI is restricted to specific operating systems.
2
Evaluate the operating system compatibility of Azure PowerShell.
Azure PowerShell (running on PowerShell Core) is cross-platform and runs on Windows, macOS, and Linux.
To identify if Azure PowerShell is restricted to Windows.

Key Concept

Cross-platform capability of Azure command-line tools
Question 239Question →

An online retailer needs to securely connect a local branch office to an Azure Virtual Network. The retailer has a limited budget and wants to use their existing public internet connection. Which two of the following statements correctly describe this connection? Select two.

Select all that apply

Show answer & explanation

Answer: An Azure VPN Gateway is used to establish a Site-to-Site connection over the public internet.; The network traffic sent through the VPN tunnel is encrypted for security.

Answer

The correct answer states that an Azure VPN Gateway is used to establish a Site-to-Site connection over the public internet, and that the network traffic sent through the VPN tunnel is encrypted for security.
The correct statements describe how a Site-to-Site VPN Gateway connection is deployed over the public internet and how it encrypts data in transit. This satisfies the requirements of a low-cost, secure connection over an existing internet link.

Step-by-Step Solution

1
Analyze the requirements for connectivity: secure (encrypted), budget-friendly, and utilizing the existing public internet.
Identify that Azure VPN Gateway satisfies these requirements because it is low-cost, encrypts data in transit, and routes over the public internet.
This matches the budget constraint and the physical path requirements.
2
Evaluate ExpressRoute and cloud deployment model implications.
Determine that ExpressRoute is incorrect because it uses private connections (not the public internet) and that linking on-premises to public cloud results in a hybrid cloud model.
This eliminates the incorrect options.

Key Concept

Hybrid network connectivity options in Azure (VPN Gateway vs ExpressRoute)
Question 240Question →

An administrator needs to configure access to a virtual machine named Web-VM located in a resource group named App-RG.

The configuration must meet the following requirements:
1. A developer must be able to start, stop, and configure Web-VM.
2. The developer must not be able to grant access permissions to other users.
3. No user, including the developer, should be able to accidentally delete Web-VM.

To meet these requirements with the least privilege, which configuration should the administrator implement?

Show answer & explanation

Answer: Assign the Contributor role to the developer at the Web-VM scope, and apply a Delete lock to Web-VM.

Answer

Assign the Contributor role to the developer at the Web-VM scope, and apply a Delete lock to Web-VM.
The correct option assigns the Contributor role directly at the Web-VM resource scope, which allows the developer to manage the virtual machine but prevents them from delegating access to others (unlike the Owner role). Applying a Delete lock prevents accidental deletion of the resource while still allowing operational actions like starting and stopping the VM.

Step-by-Step Solution

1
Determine the correct Azure Role-Based Access Control role that allows resource management but prevents access delegation.
The Contributor role permits full management (start, stop, configure) of the resource but does not allow managing permissions, unlike the Owner role.
This satisfies the requirement to allow configuration while preventing the developer from granting access to others.
2
Select the correct scope for the role assignment to adhere to the principle of least privilege.
Assign the role at the Web-VM resource level rather than the App-RG resource group level.
This limits the developer's permissions specifically to the required virtual machine.
3
Choose the appropriate resource lock to prevent accidental deletion while allowing normal operations.
A Delete lock prevents deletion but allows starting and stopping the VM, whereas a ReadOnly lock would block starting and stopping the VM.
This satisfies the requirement to prevent deletion while maintaining operational capabilities.

Key Concept

Azure Role-Based Access Control (RBAC) roles, scopes, and resource locks integration
PreviousPage 12 / 60Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin