Tüm alıştırma soruları

You plan to configure continuous deployment for an Azure App Service web app named WebApp1 from a repository hosted on GitHub. You need to configure the connection using GitHub Actions. Which sequence of administrative steps should you perform in the Azure portal? Move the steps from the list of steps to the answer area and arrange them in the correct order.

Aether Dynamics has an Azure subscription named sub-aether-prod. You deploy an Azure Storage account named sa-aether-data and an Azure Key Vault named kv-aether-keys. To comply with security standards, all data stored in sa-aether-data must be encrypted using customer-managed keys (CMK). You configure a user-assigned managed identity named uami-storage-enc. The key vault is configured with retention and purge prevention settings active, and uses the Vault access policy permission model. You configure sa-aether-data to use CMK and select uami-storage-enc as the encryption identity. However, when you attempt to save the configuration, the operation fails with an access denied error. What is the most likely cause of this failure?

You plan to deploy a new Azure virtual machine named VM1. You have an existing Recovery Services Vault named Vault1 located in the East US region. You must ensure that VM1 can be backed up to Vault1. Which configuration setting must you select for VM1 during its creation?

An organization implements an Azure governance model with the following hierarchy and configuration:

* A management group named `Tenant-MG` contains a child management group named `Biz-MG`.
* `Biz-MG` contains a subscription named `Sub-Finance`.
* `Sub-Finance` contains two resource groups named `RG-Prod` and `RG-Dev`.

The following policy assignments are applied:

* At `Biz-MG`, an Azure Policy Initiative named `Governance-Initiative` is assigned. An exclusion is configured on this assignment for the scope of `RG-Dev`. The initiative contains two policy definitions:
* A policy that denies the creation of resources without the tag `Env`.
* A policy that denies the creation of Storage Accounts unless the SKU is `Standard_LRS` or `Standard_GRS`.
* At `Sub-Finance`, a policy named `SKU-Limit-Policy` is assigned that denies the creation of Storage Accounts unless the SKU is `Standard_LRS`.

An administrator attempts to perform several deployments. Which deployment action will succeed?

An administrator is designing the deployment of a new virtual machine named `VM-Prod-DB` to host a database. The database requires storage that supports up to $90,000$ IOPS and sub-millisecond latency. Additionally, the database must be protected against datacenter-level outages. The administrator must also ensure that:

1. `VM-Prod-DB` is backed up daily to an existing Recovery Services Vault named `RSV-Prod-01` located in the East US 2 region.
2. `VM-Prod-DB` is placed in the backend pool of a public load balancer.

Which of the following configurations should the administrator select to deploy `VM-Prod-DB` successfully?

Orion FinTech plans to deploy a new web portal consisting of two virtual machines named VM-Web1 and VM-Web2 in the Japan East region. The deployment must guarantee a virtual machine SLA of at least $99.99\%$ and protect the application from datacenter-wide failures. You need to configure the compute and load balancing infrastructure. Which two options should you select? (Select two.)

You plan to deploy a new virtual machine named `VM-DB-prod` in the East US region to host a database workload. The database requires storage capable of handling up to $80,000$ IOPS and $1,200\text{ MB/s}$ throughput. The deployment must meet the following requirements:
- Protect the database instance against datacenter-level failures in the region.
- Allow the addition of Ultra Disk managed disks to meet the performance targets.

Which configuration must you select during the virtual machine creation process to satisfy these requirements?

You are configuring security for an application that must retrieve log files from a blob container within an Azure Storage account named applogs. The application service principal requires read access to the logs using Microsoft Entra ID authentication, but must not be allowed to modify the blobs or manage the storage account metadata. Which built-in Azure role-based access control (RBAC) role is the most appropriate to assign to the service principal?

Your organization's Azure environment is structured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Security-MG (Management Group)
- Subscription1 (Subscription)
- RG-Secure (Resource Group)

You need to grant a security auditor named Auditor1 the ability to view all resources and access control assignments within RG-Secure. Auditor1 must not be able to modify any resources or manage access control assignments.

Which role should you assign to Auditor1 to meet the requirement under the principle of least privilege?

A company implements network-level security on an Azure Storage account named stdata2026. The storage account's network access is set to 'Enabled from selected virtual networks and IP addresses', and the virtual network VNet-App and subnet Subnet-Web are added to the allowed networks list. However, virtual machines running inside Subnet-Web are unable to access the storage containers in stdata2026. You need to resolve this issue and allow the virtual machines to access the storage account over the Azure backbone network. Which configuration should you perform on Subnet-Web?

An organization's Azure environment features a management group named `MG-Global` that contains two subscriptions: `Sub-APAC` and `Sub-EMEA`. A storage account named `stglobalcosts` is located in a resource group named `rg-reporting` inside the `Sub-APAC` subscription.

You need to configure a daily export of the combined cost data for both subscriptions to the `stglobalcosts` storage account.

What should you do?

You have an Azure App Service web app named WebApp1 that is hosted on a Standard (S1) App Service plan. WebApp1 has a production slot and a deployment slot named Staging. You need to configure the deployment slots to meet the following requirements:
- The database connection string must always point to the production database for the production slot, and to the staging database for the Staging slot, even after a slot swap is performed.
- A subset of users must be automatically routed to the Staging slot without requiring manual URL changes or custom cookies.

Which two configuration actions should you perform? (Select two.)

You are configuring a Virtual Machine Scale Set (VMSS) named `vmss-worker` that runs a CPU-bound processing service. The VMSS is configured with a minimum instance count of 2 and a maximum instance count of 10. The scale-out rule is configured to increase the instance count by 1 when the average CPU percentage is greater than 75% for 10 minutes. You need to configure a scale-in rule that decreases the instance count by 1 when the workload decreases. The scale-in rule must prevent thrashing (immediate scale-in) when the scale set is running at its minimum capacity of 2 instances and triggers a scale-out. Which of the following is the maximum CPU percentage threshold you should configure for the scale-in rule?

An administrator is configuring an Azure App Service web app to ensure it remains active and does not unload from memory during periods of no user traffic. Which configuration setting should the administrator enable, and what is the minimum required App Service plan tier for this setting?

An administrator is creating a new Azure virtual machine. Which configuration limit is directly determined by the selected virtual machine size?

You have two Azure App Service web apps named webapp1 and api1. Both web apps run on the Standard S1 App Service plan. You configure regional virtual network integration for webapp1 to Subnet1 in a virtual network named VNet1. You need to ensure that api1 only accepts incoming traffic from webapp1. The solution must ensure that all communication from webapp1 to api1 traverses VNet1. You must minimize administrative effort and avoid using private endpoints. Which set of actions should you perform?

An Azure subscription contains a resource group named `rg-prod-data`. The resource group contains an Azure Storage account named `storelogs1`. A `ReadOnly` lock is applied directly to the resource group `rg-prod-data`. No other locks or tags are applied to the resource group or the storage account. An administrator needs to retrieve the access keys for `storelogs1` using the Azure portal. Does the lock applied to `rg-prod-data` prevent the administrator from retrieving the access keys for `storelogs1`?

A company's Microsoft Entra ID tenant contains a security group named Engineering-Dept. You assign a Microsoft 365 E5 license to Engineering-Dept. Several users in Engineering-Dept report that they cannot access Microsoft 365 services. When checking the license status, you find a 'License assignment error' state due to a missing usage location on the user objects. You need to resolve the licensing error and delegate the management of these users to a local administrator named Admin1. The solution must minimize administrative privileges and prevent Admin1 from managing users outside of Engineering-Dept. Which two actions should you perform? (Select two.)

Your company has an Azure subscription named sub-nebula-prod that contains the following resources:
- An Azure Storage account named sanebuladata
- A user-assigned managed identity named uami-storage-encrypt
- An Azure Key Vault named kv-nebula-keys

The Key Vault has soft delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) as its permission model.

You associate uami-storage-encrypt with sanebuladata.
You need to configure sanebuladata to use a customer-managed key stored in kv-nebula-keys for encryption.

Which two actions should you perform? (Select two.)

Your company has an Azure subscription that contains an Azure Virtual Machine named VM-App1 and a storage account named storeevents2026. VM-App1 runs a custom background service that must retrieve and delete messages from a queue named processing-queue in storeevents2026. You need to configure authentication for the service to access the queue. The solution must meet the following requirements:
- Use Microsoft Entra ID authentication.
- Follow the principle of least privilege.

Which two configurations should you perform? (Select two.)