Tüm alıştırma soruları

An administrator is planning to deploy a new Azure Kubernetes Service (AKS) cluster named `aks-finance`. The cluster must integrate with an on-premises network, and pods must be directly reachable from the on-premises network using their own IP addresses from the Azure Virtual Network (VNet) without any network address translation (NAT). The network security team has allocated a small subnet with a $/24$ prefix for the cluster nodes, but wants to ensure that pod deployments do not quickly exhaust the IP addresses in this node subnet.

Which two configuration options should the administrator select to meet these requirements? (Select two.)

You have an Azure subscription that contains an Azure Storage account named storage1. You need to configure a Log Search alert rule that triggers when there are more than 100 failed access attempts within 5 minutes. When the alert triggers, you must meet the following requirements:
1. Automatically disable public network access on storage1 to mitigate the security risk.
2. Send an email notification to the Security Operations team.

Which two actions should you configure in the Azure Monitor Action Group associated with the alert rule? (Select two.)

You are deploying a new Azure Kubernetes Service (AKS) cluster named `aks-finance` into an existing Azure virtual network. The deployment must meet the following requirements:

* The Kubernetes pods must receive IP addresses directly from a dedicated subnet in the virtual network, distinct from the subnet used by the cluster nodes.
* User application workloads must not run on the same virtual machines as the cluster's system pods.

Which two actions should you perform? (Select two.)

Aetheris Logistics is planning the deployment of a new line-of-business application in the East US 2 region. The architecture consists of three web tier virtual machines (VM-Web-Prod1, VM-Web-Prod2, and VM-Web-Prod3) and two database tier virtual machines (VM-DB-Prod1 and VM-DB-Prod2).

The deployment must satisfy the following requirements:
- The web tier must achieve a service level agreement (SLA) of at least $99.99\%$ virtual machine uptime and be resilient against datacenter-wide failures.
- The database tier must be protected against localized hardware failures, such as server rack or power outages, within a single datacenter. The database tier does not require zone-wide redundancy.
- All high availability configurations must be applied during the initial deployment phase.

Which two configuration actions should you perform? (Select two.)

You manage the network security for an Azure environment. You have a storage account named `corpdata2026` with its firewall configured to deny all public network traffic by default. The environment contains a virtual network named `VNet1` with two subnets: `SubnetA` and `SubnetB`. You must implement a solution that satisfies the following requirements:
- Virtual machines in `SubnetA` must be able to securely transfer data to `corpdata2026` over its public endpoint without routing traffic over the public internet.
- Virtual machines in `SubnetB` must not have any network access to `corpdata2026`.
- The Azure Backup service must be able to perform scheduled backups of the file shares in `corpdata2026`.
- No private endpoints can be deployed due to IP address space constraints in `VNet1`.

Which two configuration actions should you perform to meet these requirements?

Your organization uses the following Azure resource hierarchy:
* A Management Group named Corp-MG.
* Two subscriptions under Corp-MG named Prod-Sub and Dev-Sub.
* Prod-Sub contains two resource groups: RG-Core and RG-Data.
* Dev-Sub contains a resource group named RG-Dev.

The following Azure Policy configurations are in place:

You need to identify which resource deployment attempts will succeed.

Which two deployment attempts will complete successfully? (Select two.)

You manage an Azure environment containing a management group named `MG-Dev`. The management group contains two subscriptions: `Sub-Dev-01` and `Sub-Dev-02`.

You need to implement a cost control strategy to meet the following requirements:
1. Monitor combined spending across both subscriptions and notify the engineering lead via email if the combined monthly cost exceeds $5{}000$ USD.
2. Automatically stop all virtual machines (VMs) in a resource group named `rg-temp-resources` in `Sub-Dev-01` if the monthly cost of that resource group exceeds $1{}000$ USD.

You perform the following configurations:
- Create a budget named `Budget-MG` at the `MG-Dev` scope with a limit of $5{}000$ USD and add the engineering lead's email to the alert threshold.
- Create a budget named `Budget-Temp` at the `rg-temp-resources` scope with a limit of $1{}000$ USD, and configure an action group that triggers an Azure Automation runbook to stop the VMs.
- Apply a `ReadOnly` lock to the `rg-temp-resources` resource group.

Which of the following describes the outcome of this configuration when the budget thresholds are exceeded?

An organization has the following Azure resource hierarchy:
* Tenant Root Group (Management Group)
* MG-Platform (Management Group)
* Sub-Connectivity (Subscription)
* RG-HubNet (Resource Group)
* MG-Apps (Management Group)
* Sub-App01 (Subscription)
* RG-AppLogic (Resource Group)
* RG-AppData (Resource Group)

You have a security group named DatabaseOps-SG. The members of this group must be able to perform the following tasks:
* Manage Azure SQL servers and databases within RG-AppData.
* Read and write database backup blobs directly in a storage account located in RG-AppData.
* View virtual networks and subnet configurations within RG-HubNet to assist with database private endpoint configuration.

The solution must follow the principle of least privilege.

Which three role assignments should you configure? (Select three).

An administrator is configuring an Azure App Service web app named app-corp to access private blobs in an Azure Storage account named storagecorp. The firewall settings of storagecorp are configured to 'Enabled from selected virtual networks and IP addresses'. The administrator enables a system-assigned managed identity for app-corp and assigns the 'Storage Blob Data Reader' role to the identity for the storage account. However, outbound connections from app-corp to storagecorp fail with a network access error. Which configuration should the administrator implement to allow app-corp to successfully access the blobs in storagecorp?

An administrator is configuring secure access to a blob container named compliance-records in an Azure Storage account named auditstoreprod. An external auditing application requires read-only access to the blobs. Security policy dictates that storage account access keys must not be used, and access must be authenticated using Microsoft Entra ID credentials. The connection must be restricted to the IP range 198.51.100.0/24 and must use HTTPS only. Which two configuration actions should you perform to meet these requirements?

An administrator needs to grant a partner application temporary read-only access to a blob container named reports-2026 in an Azure Storage account named datacorp2026. The access configuration must meet the following security requirements:
- The partner application must only connect from the IP address range 192.0.2.0/24.
- The connection must be restricted to HTTPS only.
- The credentials must expire automatically after 8 hours.
- The solution must not rely on storage account access keys to sign the token.

Which configuration should the administrator use?

An administrator is configuring autoscaling for an Azure Virtual Machine Scale Set named `vmss-api`. The scale set must meet the following requirements:
- Maintain a baseline of $2$ instances under normal conditions.
- Scale out by $2$ instances if CPU usage exceeds $80\%$ for $10$ minutes.
- Maintain a fixed count of $6$ instances every weekday (Monday through Friday) between $09:00$ and $17:00$ to handle business traffic.

Which two configurations should the administrator implement to meet these requirements? (Select two.)

You manage an Azure environment containing a virtual network named VNet1. VNet1 has two subnets: SubnetA and SubnetB. SubnetA has the Microsoft.Storage service endpoint enabled. You have an Azure Storage Account named storage1. You need to implement a network security configuration for storage1 to meet the following requirements:

1. Virtual machines in SubnetA must be able to access storage1 over the public endpoint of the storage account using the Azure backbone network.
2. Virtual machines in SubnetB must be able to access storage1 using a private IP address within VNet1.
3. Azure Backup must be able to back up the data stored in storage1 successfully.

Which three actions should you perform? (Choose three.)

Apex Genomics plans to deploy a new critical genomic sequencing analysis portal. The application tier will consist of four virtual machines. The design must meet the following requirements:
- Protect the application tier from datacenter-level failures.
- Provide a $99.99\%$ SLA for the virtual machines.
- Support load balancing using an Azure Load Balancer.

You need to configure the virtual machines for high availability.

Which two configurations should you implement? (Select two.)

An administrator has an Azure Storage account named store1 that currently uses locally redundant storage (LRS). The administrator must configure replication to protect the data against a regional outage. Additionally, the data in the secondary region must be available for read access before any failover is initiated. Which configuration should the administrator use?

You need to create a dynamic user group in Microsoft Entra ID. The group must automatically include all users whose department attribute is set to Sales. Which membership rule should you use?

You plan to use the Azure Import/Export service to import $12\text{ TB}$ of archive data from your on-premises network to an Azure Storage account. You have prepared several SATA hard drives and need to run the WAImportExport tool on a Windows client machine to copy the files and prepare the drives.

Which file must be generated by the WAImportExport tool during drive preparation and then uploaded to the Azure portal when creating the import job?

A financial services company organizes its Azure resources using a Management Group hierarchy. The Root Management Group has a child Management Group named FinanceMG, which contains two Azure subscriptions: Sub-Prod and Sub-Dev. A security administrator assigns the Reader role to a user group at the FinanceMG level and assigns a Policy definition at the Root Management Group level. Additionally, a Resource Lock of type CanNotDelete is applied to a specific resource group inside Sub-Prod. Which of the following statements is true regarding how these settings are applied to the resources within the subscriptions?

You plan to use the Azure Import/Export service to copy on-premises data to an Azure storage account. You need to prepare the physical hard drives before shipping them to an Azure datacenter. Which command-line tool must you run on your local computer to prepare the drives?

You manage an Azure subscription that contains an Azure Storage account named storage1. The storage account is configured as a General Purpose v1 (GPv1) account and uses Locally Redundant Storage (LRS). You need to create a lifecycle management rule that will automatically transition blobs in a container named backups to the Archive access tier after 30 days. What should you do first?