Tüm alıştırma soruları

You are designing the deployment of a new Azure Virtual Machine (VM) named `VM-DB1` in the East US region. The VM will host a database workload with the following requirements:
- High availability with protection against datacenter-wide failures.
- A data disk that supports $40,000$ IOPS and $600$ MB/s throughput.
- Full VM backups containing all disks using an Azure Recovery Services vault.

To meet these requirements, you plan to deploy `VM-DB1` to Availability Zone $1$, enable Ultra Disk compatibility on the VM, attach an Ultra Disk as a data disk, and configure a backup policy in a Recovery Services vault located in the East US region.

Which of the following statements correctly identifies the constraint that will prevent this deployment plan from being completed as designed?

An organization has an on-premises Windows Server named Server1 that uses Azure File Sync to synchronize files to an Azure file share named share1. The file share is hosted in an Azure Storage account named storage1.

To comply with security policies, you configure the firewall on storage1 by setting public network access to 'Enabled from selected virtual networks and IP addresses'. You also select the option to 'Allow trusted Microsoft services to access this storage account'.

Immediately after applying these settings, you observe that Server1 can no longer synchronize files with share1.

You need to restore the synchronization between Server1 and share1 while keeping the public network access restricted to selected networks.

What should you do?

A partner application requires temporary access to upload files to a container named 'incoming' within an Azure storage account. The partner must only be allowed to write data to this specific container for a period of two hours, without any permissions to access other services or containers.

What security configuration should be implemented to satisfy these requirements under the principle of least privilege?

You are planning the deployment of a new virtual machine named AppVM-Prod to host a high-performance database. The workload has the following requirements:

* Storage: A $2\text{ TB}$ data disk that must deliver $60,000$ IOPS with sub-millisecond latency. The IOPS and throughput must be adjustable dynamically without virtual machine downtime.
* High Availability: Protection against entire datacenter outages within the primary hosting region.
* Backup: Daily backups must be configured and stored in an existing Recovery Services Vault named Vault-EastUS2, which is located in the East US 2 region.

Which configuration and deployment strategy should you select to meet these requirements?

You are deploying three Azure virtual machines that will run a load-balanced application. You configure the virtual machines within an Availability Set. Which type of failure or disruption does this configuration protect the application against?

Your company is deploying several Azure virtual machines (VMs) to support different application workloads. You need to configure various post-deployment configuration and monitoring tasks.

Match each administrative requirement to the correct Azure virtual machine feature or extension.

An organization has an Azure subscription named `Sub-App-01` that contains three resource groups: `rg-prod-web`, `rg-prod-db`, and `rg-dev-temp`. You need to configure Azure Cost Management, budgets, and governance to meet the following requirements:
- Monitor spending across the entire subscription with a monthly budget of $\\$ 10{}000 $. - When the subscription spending reaches$ 90\%$($\\$9{}000$) of the budget, a webhook must trigger an Azure Logic App to delete all virtual machines in `rg-dev-temp`.
- Prevent accidental deletion of any production resources in `rg-prod-web` and `rg-prod-db` by administrators.
- Ensure the Logic App can successfully delete the virtual machines in `rg-dev-temp` when triggered.

Which two actions should you perform? (Select two.)

An organization wants to implement governance across its Azure subscriptions. The administrator plans to use Azure Policy to restrict allowed virtual machine SKUs to 'Standard_D2s_v3' and audit resources that do not have a 'Department' tag. Which of the following statements regarding the implementation and behavior of these policies are correct? (Select TWO)

You are configuring Azure Virtual Machines (VMs) to automate various deployment tasks. Match each Azure VM Extension to its primary configuration use case.

AeroSpace Dynamics is deploying a flight telemetry analysis workload in the Central US region. The workload will run on $3$ virtual machines named VM-Telemetry1, VM-Telemetry2, and VM-Telemetry3. The customer requires a service level agreement (SLA) of at least $99.99\%$ virtual machine uptime. You need to configure a high availability solution that meets the SLA requirements.

Which deployment strategy should you select?

An administrator is configuring an Azure Virtual Machine Scale Set (VMSS) named `vmss-app`. The administrator needs to configure a scale-in policy to control which virtual machines are terminated first when the scale set scales down.

Which of the following are valid scale-in policy values that can be configured for a VMSS? (Select TWO.)

You plan to deploy an Azure App Service web app. You need to configure a deployment slot named staging to test updates before swapping them into production. Which App Service Plan pricing tier is the minimum required to support deployment slots?

An organization needs to grant a third-party application read-only access to a specific private blob container named compliance-records in an Azure Storage account named corpdata104. The access configuration must meet the following requirements:
- Access must be limited to a maximum duration of 4 hours.
- Access must be restricted to the client IP address range 198.51.100.0/24.
- Only HTTPS connections are allowed.
- The security team mandates that storage account access keys must not be used or exposed to sign the token, ensuring all access is tied to and authorized by a specific Microsoft Entra ID identity.

Which configuration should you implement to meet these requirements?

Your organization has a Microsoft Entra ID tenant. A security group named Sales-Group has its membership type set to Assigned. A user named User1 is configured as the owner of Sales-Group and does not hold any directory roles. You need to configure Sales-Group to dynamically include users based on their department.

Can User1 change the membership type of Sales-Group to Dynamic User?

Your company has an Azure Storage account named `mystorageacct`. You need to grant a third-party application read-only access to a specific blob container named `datasets`. The access must meet the following security requirements:

* Access must be restricted to HTTPS only.
* Access must only be allowed from the IP address range `192.0.2.128/26`.
* You must be able to revoke the access immediately before the planned expiration time, without affecting other applications or rotating the storage account keys.

Which of the following should you create to meet these requirements?

An organization has a Microsoft Entra ID tenant with the following configurations:

* Self-Service Password Reset (SSPR) is enabled for a selected security group named SSPR-Group.
* SSPR-Group is a dynamic group that contains User1 and User2 as direct members.
* A security group named Nested-Group is added as a direct member of SSPR-Group. User3 is a direct member of Nested-Group.
* In the External collaboration settings, Guest invite settings is set to "Only users assigned to specific admin roles can invite guest users".
* User1 is assigned the Directory Writers role.
* User2 is assigned the Guest Inviter role.
* User3 is a standard user with no administrator roles.

Which users can perform a self-service password reset, and which users can invite external guest users?

An organization has an Azure resource hierarchy consisting of a Management Group named Corp-MG, a subscription named Sub-Production under Corp-MG, and three resource groups under Sub-Production: RG-App-Prod, RG-Database-Prod, and RG-Shared-Services.

The following policy assignments are active in the environment:
- Assignment 1: An Azure Policy definition that restricts allowed virtual machine SKUs to 'Standard_D2s_v3' and 'Standard_D4s_v3'. The policy effect is set to Deny. This policy is assigned at the Sub-Production subscription level with an exclusion configured for RG-Shared-Services.
- Assignment 2: A custom policy definition that denies the deployment of any resource if it does not have the 'Environment' tag with the value 'Production'. This policy is assigned at the Corp-MG Management Group level with no exclusions.

An administrator attempts to perform the following actions:
- Action 1: Deploy a virtual machine with SKU 'Standard_F4s' and the tag 'Environment: Production' in RG-Shared-Services.
- Action 2: Deploy a virtual machine with SKU 'Standard_D2s_v3' and no tags in RG-Database-Prod.

Which of the deployments will succeed?

Aether Energy is planning to deploy a web application in the East US region. The deployment must guarantee a $99.99\%$ virtual machine uptime SLA and distribute incoming traffic across the virtual machines. The design includes $2$ virtual machines named VM-Web1 and VM-Web2.

Which $2$ actions should you perform to meet the requirements? Select $2$.

An administrator is configuring a Virtual Machine Scale Set (VMSS) named `vmss-api` that uses Uniform orchestration mode and a Rolling upgrade policy to host a web service. After deploying an application update by updating the VMSS model, the administrator observes that all instances are upgraded in sequence, but the web service becomes unavailable because the new version has a startup bug. The rolling upgrade did not pause or roll back because the VM provisioning status of the upgraded instances remained 'Succeeded'. You need to ensure that future rolling upgrades automatically pause and roll back if the web service fails to start on upgraded instances. What should you configure?

An administrator configures the network firewall of an Azure Storage account named stsecurityprod to restrict access to 'Selected networks'. The administrator adds a virtual network rule to allow access from a subnet named Subnet-App in a virtual network named VNet-Internal.

However, applications running on virtual machines within Subnet-App receive a 'NetworkAccessDenied' error when attempting to read blobs from stsecurityprod.

Which configuration is required to resolve this connectivity issue?