Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 381Soru →

An administrator is configuring hybrid storage using Azure File Sync. A Windows Server named Server1 is registered with a Storage Sync Service named StorageSync1. A sync group named SyncGroup1 is created in StorageSync1 and contains a cloud endpoint pointing to an Azure file share named share1, and a server endpoint pointing to the path D:\Projects on Server1. To meet a compliance requirement for off-site replica separation, the administrator creates a second sync group named SyncGroup2 in StorageSync1 with a cloud endpoint pointing to a separate Azure file share named share2. The administrator then attempts to add a server endpoint pointing to the path D:\Projects on Server1 within SyncGroup2. What is the result of attempting to create the server endpoint in SyncGroup2?

Cevabı ve açıklamayı göster

Cevap: The operation will fail because Azure File Sync does not support multiple server endpoints referencing the same or overlapping directory paths on the same registered server.

Cevap

The operation will fail because Azure File Sync does not support multiple server endpoints referencing the same or overlapping directory paths on the same registered server.
The correct option is that the operation will fail because Azure File Sync does not support multiple server endpoints referencing the same or overlapping directory paths on the same registered server. Each server endpoint path must be unique across all sync groups within the Storage Sync Service to prevent synchronization loop issues.

Adım Adım Çözüm

1
Analyze the request to sync the same local directory path D:\Projects on Server1 to two different sync groups.
Identify that the path D:\Projects is already in use by SyncGroup1 as a server endpoint.
Before configuring a server endpoint, Azure File Sync validates that the path is not already associated with another endpoint.
2
Evaluate Azure File Sync constraints regarding path overlap.
Recall that Azure File Sync prohibits duplicate or nested/overlapping server endpoint paths on the same registered server across all sync groups.
This constraint prevents synchronization conflicts, race conditions, and loops between different cloud endpoints.
3
Determine the outcome of attempting to register D:\Projects in SyncGroup2.
The configuration attempt will fail with an validation error.
Azure File Sync enforces that each path on a server can only map to one sync group.

Anahtar Kavram

Azure File Sync server endpoint path exclusivity
Soru 382Soru →

An organization has an Azure environment structured with the following resource hierarchy:

* MG-Production (Management Group)
* Sub-Prod (Subscription)
* RG-App (Resource Group)
* VM-Web (Virtual Machine)
* RG-Data (Resource Group)
* sa-prod (Storage Account)
* kv-prod (Key Vault)

You are tasked with assigning built-in Azure role-based access control (RBAC) roles to four administrative security groups. Your configurations must strictly adhere to the principle of least privilege.

Match each administrative requirement to the correct Azure RBAC role and scope.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Restart and configure VM-Web, but must not be able to modify the virtual network or other resources in RG-App.
Manage sa-prod configurations and regenerate access keys, but must not be granted direct data plane access to containers via Microsoft Entra ID.
Read secret values inside kv-prod, but must not be able to modify key vault resource properties or management settings.
Assign roles across all resource groups within Sub-Prod, but must not be able to deploy or delete resource groups.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Requirement for VM-Web matches Virtual Machine Contributor at VM-Web scope; requirement for sa-prod matches Storage Account Contributor at sa-prod scope; requirement for kv-prod matches Key Vault Secrets User at kv-prod scope; requirement for Sub-Prod role assignment matches User Access Administrator at Sub-Prod scope.
The correct pairings match the security requirements to the most restricted built-in role and scope. Virtual Machine Contributor at the VM-Web scope limits VM control to only VM-Web. Storage Account Contributor at the sa-prod scope allows control plane settings management (like key regeneration) without granting Entra ID data access. Key Vault Secrets User at the kv-prod scope permits data-plane read access to secrets without administrative control plane capabilities. User Access Administrator at the Sub-Prod scope permits subscription-wide role assignment management without resource modification permissions.

Adım Adım Çözüm

1
Analyze the VM-Web requirement. The group needs to manage configuration and power state on VM-Web but not access networks or other resources. Virtual Machine Contributor is the built-in role that allows virtual machine management. The scope should be restricted to the VM-Web resource itself to satisfy least privilege.
WebAdmins is matched to Virtual Machine Contributor at the scope of VM-Web.
Limits VM management capability to the specific VM resource scope.
2
Analyze the sa-prod requirement. The group needs control plane management of the storage account (including key regeneration) but no Entra ID data plane access. Storage Account Contributor grants control plane access but does not grant data plane roles such as Storage Blob Data Reader or Contributor. The scope must be sa-prod.
AppDeployers is matched to Storage Account Contributor at the scope of sa-prod.
Restricts access to the control plane at the resource scope, denying Entra ID data access.
3
Analyze the kv-prod requirement. The group needs to read secret values but not manage policies or vault properties. Key Vault Secrets User is a data plane role that allows reading secrets without control plane permissions. The scope must be kv-prod.
SecAuditors is matched to Key Vault Secrets User at the scope of kv-prod.
Provides secrets data plane read access without administrative control plane permissions.
4
Analyze the Sub-Prod requirement. The group needs to manage role assignments across all resource groups under Sub-Prod but not modify resources. User Access Administrator is the Azure RBAC role that manages role assignments. The scope must be Sub-Prod so that it inherits to all child resource groups.
SecurityAdmins is matched to User Access Administrator at the scope of Sub-Prod.
Allows subscription-wide role delegation while preventing resource creation/deletion.

Anahtar Kavram

Azure RBAC roles and scopes configuration
Soru 383Soru →

Vanguard Systems manages an Azure subscription named sub-vanguard-secure. An administrator deploys a storage account named savanguarddata and an Azure Key Vault named kv-vanguard-secrets with the following configurations:

savanguarddata:
- Identity: Configured with a User-Assigned Managed Identity named uami-encrypt.
- Firewall: Enabled, with 'Allow trusted Microsoft services to access this storage account' set to Yes.

kv-vanguard-secrets:
- Properties: Soft-delete is Enabled; Purge protection is Enabled.
- Permission model: Azure role-based access control (Azure RBAC).
- Firewall: Enabled from selected networks, with 'Allow trusted Microsoft services to bypass this firewall' set to No.

The administrator assigns the Key Vault Crypto Service User role to uami-encrypt at the key vault scope.

When attempting to enable customer-managed keys (CMK) on savanguarddata using a key from kv-vanguard-secrets, the configuration fails. What is the cause of the configuration failure?

Cevabı ve açıklamayı göster

Cevap: The Key Vault firewall blocks the Azure Storage service because the bypass for trusted Microsoft services is disabled on kv-vanguard-secrets.

Cevap

The Key Vault firewall blocks the Azure Storage service because the bypass for trusted Microsoft services is disabled on the Key Vault.
The correct option correctly identifies that the Key Vault firewall is blocking the Azure Storage service. When a Key Vault restricts access to selected networks, the Azure Storage service (which is a trusted Microsoft service) cannot retrieve or use the key for encryption unless the Key Vault's firewall settings explicitly allow trusted Microsoft services to bypass the restriction.

Adım Adım Çözüm

1
Verify Managed Identity and RBAC permissions
The User-Assigned Managed Identity has the correct data-plane role (Key Vault Crypto Service User) assigned at the appropriate scope, so identity permissions are not the issue.
To ensure the correct role is applied to the configured identity.
2
Analyze Key Vault firewall configuration
The Key Vault firewall restricts access to selected networks, and the bypass for trusted Microsoft services is set to No.
Azure Storage is a trusted Microsoft service that needs to communicate with the Key Vault to access the encryption keys.
3
Identify the communication direction and failure point
The Azure Storage service initiates outbound traffic to the Key Vault. The Key Vault firewall blocks this traffic because the bypass is disabled.
Determining why the connection is refused despite the storage account's firewall allowing trusted services.

Anahtar Kavram

Azure Storage Customer-Managed Keys (CMK) require network integration bypasses on the Key Vault firewall if the vault is secured behind selected networks.
Soru 384Soru →

Your company has a Microsoft Entra ID tenant that contains the following resources:
- An Administrative Unit named Sales-AU
- A security group named Sales-Group
- A user named User1 who is in Sales-AU and is a member of Sales-Group
- A user named Admin1 who is assigned the User Administrator role scoped to Sales-AU

You configure group-based licensing for Sales-Group. A Microsoft 365 E5 license is assigned to Sales-Group.

You discover that User1 is not assigned the license due to an empty usage location property.

You need to ensure that User1 is assigned the license. The solution must use the principle of least privilege.

What should you do?

Cevabı ve açıklamayı göster

Cevap: Have Admin1 configure the Usage location property on the user account of User1.

Cevap

Have Admin1 configure the Usage location property on the user account of User1.
The correct action is to have Admin1 configure the Usage location property on the user account of User1. In Microsoft Entra ID, group-based licensing requires each user to have a usage location configured on their individual user object before a license can be assigned. Admin1 holds the User Administrator role scoped to Sales-AU, and since User1 is a member of Sales-AU, Admin1 has the necessary administrative permissions to update User1's properties without requiring tenant-wide administrator roles.

Adım Adım Çözüm

1
Identify the scope of the administrative delegation.
Admin1 is a User Administrator scoped to the Sales-AU administrative unit.
Understanding the administrative boundary helps determine who has permissions to modify User1, who is a member of Sales-AU.
2
Determine the root cause of the licensing error.
User1's license assignment failed because the usage location property is empty.
Microsoft Entra ID requires a usage location to be configured for any user before a license can be assigned.
3
Apply the principle of least privilege to resolve the error.
Admin1 updates the usage location property directly on User1's user account.
Admin1 already has the scoped User Administrator role for Sales-AU, allowing them to modify User1 without requiring tenant-wide administrative privileges or incorrect Azure RBAC assignments.

Anahtar Kavram

Delegating administration of user properties and licenses using Administrative Units and scoped directory roles.
Tahmini Süre:1m 30s
Soru 385Soru →

An administrator is designing several Azure Virtual Machine (VM) deployments with specific performance, latency, and backup requirements. Match each Azure VM feature or configuration option to its primary technical constraint or characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ephemeral OS Disk
Ultra Disk
Proximity Placement Group
Custom Script Extension

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ephemeral OS Disk matches local storage without Azure Backup support; Ultra Disk matches the requirement to be deployed in an Availability Zone and restricted from OS disk usage; Proximity Placement Group matches physically colocating VM resources to reduce network latency; Custom Script Extension matches post-deployment scripts with a 90-minute timeout.
The correct matches represent standard characteristics and boundaries defined by Azure: Ephemeral OS disks operate on local VM cache/temp disks without Azure Backup support; Ultra Disks are data-only and require an Availability Zone; Proximity Placement Groups physically colocate VMs to minimize latency; and Custom Script Extensions timeout after 90 minutes.

Adım Adım Çözüm

1
Analyze Ephemeral OS Disk requirements.
Confirm Ephemeral OS disks are stored locally on the VM's cache or temp disk and do not support Azure Backup.
Identify the primary storage location and service restrictions of ephemeral storage.
2
Analyze Ultra Disk requirements.
Confirm Ultra Disks are data-only disks and require placement within an Availability Zone.
Identify the architectural placement and OS constraints of Ultra Disks.
3
Analyze Proximity Placement Group purpose.
Determine that PPGs physically colocate VMs within the same region or data center.
Differentiate between geographical separation features and latency minimization tools.
4
Analyze Custom Script Extension constraints.
Identify the 90-minute execution timeout threshold for VM extension scripts.
Examine script execution limits and failure states for Azure VM extensions.

Anahtar Kavram

Azure VM storage, latency optimization, and extension capabilities during deployment.
Soru 386Soru →

You plan to deploy a new Azure virtual machine named VM1. The deployment must meet the following requirements:
- VM1 must host a high-performance database that uses Azure Ultra Disks.
- A custom configuration script must run automatically inside VM1 immediately after deployment.

Which two actions should you perform to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Ultra Disk compatibility on VM1.; Install the Custom Script Extension on VM1.

Cevap

Enable Ultra Disk compatibility on the virtual machine and install the Custom Script Extension on the virtual machine.
Enabling Ultra Disk compatibility on the virtual machine allows the VM to attach Ultra Disks for high-performance database storage. Installing the Custom Script Extension ensures that the custom script is automatically executed inside the virtual machine immediately after deployment.

Adım Adım Çözüm

1
Configure the virtual machine settings for high-performance storage by enabling Ultra Disk compatibility.
The virtual machine is configured to support Ultra Disks as data disks.
Azure Ultra Disks require the VM to have Ultra Disk compatibility explicitly enabled during deployment.
2
Configure the virtual machine extensions by selecting the Custom Script Extension and providing the configuration script.
The Custom Script Extension is added to the virtual machine deployment template.
The Custom Script Extension executes the script inside the virtual machine immediately after provisioning is complete.

Anahtar Kavram

To deploy a virtual machine that uses Ultra Disks and runs automated startup configurations, you must enable Ultra Disk compatibility on the virtual machine and use a virtual machine extension such as the Custom Script Extension.
Tahmini Süre:1m 30s
Soru 387Soru →

Nebula Logistics plans to deploy a new web application in the North Europe region. The application will run on two new virtual machines named VM-Web1 and VM-Web2. The deployment must meet the following requirements:
- Guarantee a virtual machine uptime SLA of at least 99.99%99.99\%.
- Protect the application against datacenter-wide failures.

Which two configurations should you implement? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy VM-Web1 to Availability Zone 1 and VM-Web2 to Availability Zone 2.; Associate the virtual machines with a Standard Load Balancer.

Cevap

Deploying the virtual machines across different Availability Zones and associating them with a Standard Load Balancer.
To guarantee an SLA of 99.99%99.99\% for virtual machine connectivity, instances must be deployed across two or more Availability Zones in the same region. A Standard Load Balancer is required because it supports zone-redundant backend pools that can span multiple Availability Zones to distribute traffic to the virtual machines.

Adım Adım Çözüm

1
Evaluate the SLA target of 99.99%99.99\% for virtual machine uptime.
Determine that an uptime SLA of 99.99%99.99\% requires virtual machines to be distributed across two or more Availability Zones in the same region, as Availability Sets only guarantee up to a 99.95%99.95\% SLA.
Availability Zones provide independent power, cooling, and networking infrastructure, protecting the application from datacenter-wide outages.
2
Select the correct zone placement configuration for VM-Web1 and VM-Web2.
Configure VM-Web1 to be deployed in Availability Zone 1 and VM-Web2 in Availability Zone 2.
This configuration ensures that the virtual machines are physically separated into distinct datacenters within the region.
3
Select the load balancer tier required to distribute traffic to the zone-distributed virtual machines.
Select a Standard Load Balancer and configure its backend pool to include both VMs.
Standard Load Balancer supports zone-redundant backend pools that can span across multiple Availability Zones, which is a requirement for load-balancing across zones.

Anahtar Kavram

Azure Virtual Machine High Availability options (Availability Zones vs Availability Sets) and their corresponding SLA and Load Balancer requirements.
Tahmini Süre:2m 0s
Soru 388Soru →

An administrator needs to restrict network access to an Azure Storage account named stdatafiles. The storage account must only be accessible from a subnet named Subnet1 in a virtual network named VNet1, and from an on-premises administration workstation with the public IP address 203.0.113.50.

Which two actions should you perform?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable the Microsoft.Storage service endpoint on Subnet1.; Configure the stdatafiles firewall to allow access from selected virtual networks and IP addresses, then add VNet1/Subnet1 and the IP address 203.0.113.50.

Cevap

Enable the Microsoft.Storage service endpoint on Subnet1, and configure the stdatafiles firewall to allow access from selected virtual networks and IP addresses, adding VNet1/Subnet1 and the client's public IP address.
To allow secure, direct access from an Azure subnet, the Microsoft.Storage service endpoint must be enabled on the subnet. Once enabled, the subnet and the public IP address of the on-premises workstation can be added to the storage account's firewall rules when set to allow access from selected networks.

Adım Adım Çözüm

1
Enable the Microsoft.Storage service endpoint on Subnet1 of VNet1.
The subnet is enabled to securely route traffic to the storage service over the Azure backbone network.
This is a prerequisite before a subnet can be added to the allowed networks list of a storage account firewall.
2
Configure the storage account firewall settings.
The firewall is configured to block all public internet traffic except for the specified networks and IP addresses.
Adding VNet1/Subnet1 and the public IP address 203.0.113.50 ensures only these specific sources can connect.

Anahtar Kavram

Azure Storage firewall configuration and virtual network service endpoints.
Soru 389Soru →

You are deploying and configuring virtual machines in Azure. Match each Azure Virtual Machine feature to its primary purpose.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Custom Script Extension
Azure VM Agent
Boot Diagnostics

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Custom Script Extension matches with executing post-deployment scripts. Azure VM Agent matches with installing and managing extensions. Boot Diagnostics matches with capturing console logs and screenshots.
Each VM component aligns with its correct administrative purpose: the Custom Script Extension executes scripts inside the VM, the VM Agent hosts extensions and coordinates with the fabric, and Boot Diagnostics monitors startup logs and screenshot outputs.

Adım Adım Çözüm

1
Identify the purpose of Custom Script Extension.
It executes custom scripts inside the virtual machine immediately after deployment to automate setup tasks.
Custom Script Extension is explicitly designed to bootstrap VM configurations.
2
Identify the purpose of the Azure VM Agent.
It facilitates communication with the Azure fabric and manages extensions.
The VM Agent is the mandatory host process that manages all other VM extensions.
3
Identify the purpose of Boot Diagnostics.
It captures serial logs and console screenshots to troubleshoot startup issues.
Boot Diagnostics allows administrators to see why a VM is stuck during the boot sequence.

Anahtar Kavram

Azure Virtual Machine features and configuration options
Soru 390Soru →

Your company has an Azure subscription containing a resource group named RG1. You plan to configure a new virtual network named VNet1 in RG1. Within VNet1, you need to create a subnet named Subnet1. You plan to deploy 2727 virtual machines in Subnet1. Each virtual machine requires a dynamic private IP address from Subnet1. You must minimize the size of the subnet to conserve IP address space. Which subnet prefix is the smallest size that can support the virtual machines?

Cevabı ve açıklamayı göster

Cevap: /27

Cevap

The prefix /27/27 is the smallest subnet size that can support the virtual machines.
The subnet prefix /27/27 is correct because it provides a total of 3232 IP addresses (232−27=322^{32-27} = 32). Since Azure reserves 55 IP addresses in every subnet (the first four and the last one), the number of usable IP addresses is 32−5=2732 - 5 = 27. This exactly matches the requirement of 2727 virtual machines, making it the smallest subnet size (highest prefix length) that can support the deployment.

Adım Adım Çözüm

1
Calculate the total number of IP addresses required for the virtual machines and Azure's system reservations.
3232 total IP addresses are required (2727 for the virtual machines + 55 reserved by Azure).
Azure reserves the first four IP addresses and the last IP address in each subnet for its own infrastructure and routing services.
2
Evaluate the total number of IP addresses provided by different CIDR prefix sizes to find the smallest subnet size that is at least 3232.
A /27/27 subnet provides 3232 IP addresses, whereas a /28/28 subnet provides 1616 IP addresses, and a /26/26 subnet provides 6464 IP addresses.
The number of IP addresses is calculated using the formula 232−prefix2^{32 - \text{prefix}}. A /27/27 prefix (232−27=322^{32-27} = 32) is the smallest prefix length that provides at least 3232 IP addresses.

Anahtar Kavram

Subnet IP address calculation and Azure reserved IP addresses
Tahmini Süre:1m 0s
Soru 391Soru →

You have an Azure App Service web app named WebApp1 that is hosted on a Standard S1 App Service plan. WebApp1 has a production slot and a deployment slot named staging. You configure regional virtual network integration for the staging slot to connect to a virtual network named VNet1. The production slot does not have virtual network integration configured. You perform a slot swap between the staging slot and the production slot. What is the status of the virtual network integration for the slots after the swap?

Cevabı ve açıklamayı göster

Cevap: The staging slot remains integrated with VNet1, and the production slot has no virtual network integration.

Cevap

The staging slot remains integrated with VNet1, and the production slot has no virtual network integration.
Virtual network integration is a slot-specific (sticky) setting in Azure App Service. When you perform a slot swap, slot-specific settings do not change their assignment. Therefore, the staging slot retains its integration with VNet1, and the production slot remains without any virtual network integration.

Adım Adım Çözüm

1
Identify the setting being modified, which is regional virtual network integration configured on an Azure App Service deployment slot.
Recognized that VNet integration is a network configuration setting applied to a specific slot.
Before performing a swap, it is necessary to determine which configurations are slot-specific and which ones travel with the swap.
2
Verify if regional virtual network integration is listed as a setting that swaps or remains sticky to the slot during a swap operation.
Confirmed that virtual network integration is sticky to the slot (does not swap) according to Azure App Service architecture rules.
This determines whether the configuration remains bound to the staging slot or transfers to the production slot during the swap.
3
Deduce the final state of both slots after the swap is completed.
The staging slot keeps VNet1 integration, and the production slot remains without VNet integration.
Since the setting does not swap, the network configuration stays assigned to the original slot names.

Anahtar Kavram

Understanding which Azure App Service settings are sticky to the slot and do not swap during a slot swap operation.
Tahmini Süre:1m 30s
Soru 392Soru →

NovaHealth plans to deploy a new patient records application consisting of 33 virtual machines in the West US 3 region. The deployment must guarantee a virtual machine uptime SLA of at least 99.99%99.99\% and protect the application against datacenter-level failures. You need to configure the high availability solution for the virtual machines. Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machines across two or more Availability Zones in West US 3.; Deploy an Azure Standard Load Balancer to distribute traffic to the virtual machines.

Cevap

Deploy the virtual machines across two or more Availability Zones in West US 3, and deploy an Azure Standard Load Balancer to distribute traffic to the virtual machines.
To satisfy a 99.99%99.99\% virtual machine uptime SLA and protect against datacenter-level outages, virtual machines must be distributed across two or more Availability Zones. Because the virtual machines are distributed across zones, an Azure Standard Load Balancer must be deployed to distribute traffic, as the Basic SKU load balancer does not support zonal backend pools.

Adım Adım Çözüm

1
Analyze the SLA and high availability requirements.
The target SLA is 99.99%99.99\%, and the application must be protected against datacenter-level failures.
This requirement determines whether to use Availability Sets (which offer 99.95%99.95\% SLA and protect only against local hardware failures) or Availability Zones (which offer 99.99%99.99\% SLA and protect against datacenter outages).
2
Select the appropriate virtual machine deployment target.
Select Availability Zones as the deployment target.
Deploying virtual machines across two or more Availability Zones in the West US 3 region satisfies both the 99.99%99.99\% SLA and the datacenter-level protection requirements.
3
Identify the load balancing requirement for the multi-zone deployment.
Select an Azure Standard Load Balancer.
An Azure Standard Load Balancer is required because Basic Load Balancers do not support backend pools containing zonal virtual machines.

Anahtar Kavram

Configuring Virtual Machines for High Availability using Availability Zones and Standard Load Balancer.
Soru 393Soru →

An administrator is managing an Azure Virtual Machine Scale Set (VMSS) named `vmss-web` that uses Uniform orchestration and has its upgrade policy set to Manual. The administrator needs to deploy a custom configuration script to all existing and future VM instances in `vmss-web` using the Custom Script Extension. The script is stored locally.

Which sequence of actions should the administrator perform to achieve this goal?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

First, upload the configuration script to a private Azure Storage account. Second, generate a SAS token with read permissions for the script blob. Third, add the Custom Script Extension to the scale set model referencing the script URI and SAS token. Fourth, trigger a manual upgrade on the existing VM instances.
The correct order requires first securing the script in Azure Storage, generating a SAS token for secure access, updating the VMSS model definition, and finally triggering a manual upgrade of the existing VM instances since the upgrade policy is set to Manual.

Adım Adım Çözüm

1
Upload the configuration script to an Azure Storage account.
The script is hosted in a private Azure Storage blob container.
Before the scale set instances can execute the script, it must be accessible from an Azure storage service.
2
Generate a SAS token for the script blob.
A secure access token is created that grants read access to the script.
Since the storage account container is private for security, a SAS token provides a secure way for the scale set to download the script without public access.
3
Add the Custom Script Extension to the VMSS model.
The VMSS configuration model is updated with the extension definition containing the script URI and SAS token.
Updating the VMSS model ensures that the extension configuration is saved in the scale set template, making it active for all future scale-out instances.
4
Trigger a manual upgrade on existing instances.
Existing VM instances are updated to the latest VMSS model configuration.
Since the upgrade policy of the scale set is Manual, existing instances will not automatically apply the new model. A manual upgrade triggers the Custom Script Extension execution on these running instances.

Anahtar Kavram

Configuring Custom Script Extensions and applying model updates under a Manual upgrade policy in a Virtual Machine Scale Set.
Soru 394Soru →

An administrator is planning the deployment of a new virtual machine named `VM-Analytics` in the East US region. The virtual machine will host a database workload that requires sub-millisecond storage latency using an Ultra Disk, and must be protected against datacenter-wide failures. You also need to configure a daily backup solution for `VM-Analytics`.

Which of the following actions should you perform to meet these requirements? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machine in an Availability Zone and enable the Ultra SSD compatibility setting.; Create a Recovery Services Vault in the East US region to configure the virtual machine backup.

Cevap

Deploy the virtual machine in an Availability Zone with Ultra SSD compatibility enabled, and create a Recovery Services Vault in the East US region.
To meet all requirements, the administrator must deploy the virtual machine in an Availability Zone (which satisfies the datacenter-wide failure protection and supports Ultra Disks) with the Ultra SSD compatibility setting enabled. Additionally, the Recovery Services Vault used to back up the virtual machine must be created in the same region (East US) as the virtual machine.

Adım Adım Çözüm

1
Evaluate the storage and high availability requirements for the virtual machine.
The requirement for sub-millisecond latency demands Ultra Disks, which can only be attached to virtual machines with Ultra SSD compatibility enabled. Datacenter-wide protection requires deploying the VM in an Availability Zone rather than an Availability Set.
Ultra Disks are only supported in Availability Zones or as standalone VMs, and Availability Zones protect against zone-wide (datacenter) outages.
2
Determine the region requirements for the backup solution.
The Recovery Services Vault must be created in the East US region.
Azure Virtual Machine Backup requires the Recovery Services Vault to be in the exact same region as the source virtual machine.

Anahtar Kavram

Virtual Machine storage compatibility and regional backup constraints
Soru 395Soru →

You are designing a virtual network named VNet1 with an address space of 10.2.0.0/1610.2.0.0/16. You must configure three subnets within VNet1 to meet the following requirements:
- Subnet-App: Must support at least 27 virtual machines.
- A gateway subnet to support an Azure VPN Gateway.
- A subnet to deploy Azure Bastion.

You want to minimize the address space allocated to each subnet by using the maximum prefix length (smallest subnet mask) possible.

Which subnet configuration should you use?

Cevabı ve açıklamayı göster

Cevap: Subnet-App: 10.2.0.0/2710.2.0.0/27; GatewaySubnet: 10.2.0.32/2910.2.0.32/29; AzureBastionSubnet: 10.2.0.64/2610.2.0.64/26

Cevap

Subnet-App: 10.2.0.0/2710.2.0.0/27; GatewaySubnet: 10.2.0.32/2910.2.0.32/29; AzureBastionSubnet: 10.2.0.64/2610.2.0.64/26
The correct configuration allocates 10.2.0.0/2710.2.0.0/27 for Subnet-App, which provides 32 IP addresses (32−5=2732 - 5 = 27 usable), satisfying the 27 VM requirement. It uses the correct name GatewaySubnet and the minimum size of /29/29 (8 IP addresses, 3 usable) for the VPN gateway. Lastly, it utilizes the correct name AzureBastionSubnet and the minimum size of /26/26 (64 IP addresses, 59 usable) for Azure Bastion.

Adım Adım Çözüm

1
Calculate the subnet size required for Subnet-App to host 27 virtual machines.
A /27 subnet mask is required.
Azure reserves 5 IP addresses in every subnet (the first 4 and the last 1). To support 27 hosts, the subnet must have a total capacity of at least 27+5=3227 + 5 = 32 IP addresses. A /28 subnet provides only 16 addresses (11 usable), whereas a /27 subnet provides 32 addresses (27 usable).
2
Determine the minimum subnet size and name for the VPN Gateway.
The subnet must be named GatewaySubnet and have a minimum size of /29.
Azure VPN Gateways must be deployed in a subnet named exactly GatewaySubnet. Azure requires this subnet to be at least /29 to function correctly.
3
Determine the minimum subnet size and name for Azure Bastion.
The subnet must be named AzureBastionSubnet and have a minimum size of /26.
Azure Bastion must be deployed in a dedicated subnet named exactly AzureBastionSubnet. The prefix size must be /26 or larger (/26, /25, etc.) to pass deployment validation.

Anahtar Kavram

Azure subnet design rules, host address reservations, and service-specific subnet constraints
Tahmini Süre:2m 0s
Soru 396Soru →

An organization deploys a background processing tool as an Azure App Service web app. The application requires a continuous connection pool and must run uninterrupted. Additionally, the web app's instances should handle incoming requests in a stateless manner, meaning client session affinity must be deactivated. Which two settings under the General settings configuration of the web app must be modified to support this scenario? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set Always on to On; Set ARR affinity to Off

Cevap

To support this scenario, you must set Always on to On and set ARR affinity to Off.
Enabling the Always on setting prevents the app from being unloaded due to inactivity, ensuring background tasks run continuously. Disabling the ARR affinity setting deactivates client session affinity, allowing stateless distribution of client requests across all available app instances.

Adım Adım Çözüm

1
Determine the setting required to keep the application continuously active.
Always on must be configured to On.
By default, App Service web apps are unloaded if they are idle. Setting Always on to On ensures the app remains loaded to run background tasks continuously.
2
Determine the setting required to handle requests in a stateless manner.
ARR affinity must be configured to Off.
ARR affinity routes subsequent requests from a client to the same instance. Disabling ARR affinity allows stateless request distribution across all instances.

Anahtar Kavram

Configuring App Service general settings including Always on and ARR affinity.
Soru 397Soru →

Your company has an Azure subscription named `Sub-Finance-01` that contains a resource group named `rg-reporting`. You need to implement a cost control and governance strategy for `rg-reporting` that meets the following requirements:

* Send an email notification to the billing team when the resource group's monthly spending reaches $8,000.
* Prevent any virtual machines in `rg-reporting` from being deleted.
* Allow users to continue starting, stopping, and resizing the virtual machines in `rg-reporting`.

Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a monthly budget of $10,000 at the rg-reporting scope, configure an alert threshold at 80% of the budget, and specify the billing team's email address in the alert settings.; Apply a CanNotDelete lock to rg-reporting.

Cevap

To meet the requirements, you must apply a CanNotDelete resource lock to the resource group, and create a monthly budget of $10,000 with an alert threshold of 80% configured with the billing team's email address.
The correct actions are to apply a CanNotDelete lock to the resource group and configure a monthly budget with an alert threshold of 80% (8,000)thattargetsthebillingteam′semail.ACanNotDeletelockpreventsresourcedeletionwhileallowinguserstoperformcontroloperationslikestarting,stopping,orresizingvirtualmachines.Settingabudgetthresholdat808,000) that targets the billing team's email. A CanNotDelete lock prevents resource deletion while allowing users to perform control operations like starting, stopping, or resizing virtual machines. Setting a budget threshold at 80% of a 10,000 budget correctly alerts the billing team when spending reaches $8,000.

Adım Adım Çözüm

1
Select the appropriate resource lock level.
Applying a CanNotDelete lock restricts deletion of resources while permitting all other modification and operation actions (such as VM start, stop, and resize).
This directly satisfies the requirement to prevent deletion while maintaining developer control capabilities.
2
Configure the budget and threshold notifications.
Creating a 10,000budgetwithanalertthresholdsetto8010,000 budget with an alert threshold set to 80% triggers an alert when the actual or forecasted cost reaches 8,000.
This satisfies the requirement to notify the billing team at the $8,000 spend level.
3
Ensure the notification recipients are configured.
Adding the billing team's email address to the budget alert threshold configures the direct email delivery.
Without configuring the email recipients or action group, the budget alerts remain silent.

Anahtar Kavram

Azure Budgets and Resource Locks are used together to govern resource costs and operations. CanNotDelete locks prevent deletion while allowing resource management actions, whereas budgets notify administrators of cost thresholds without blocking operations.
Tahmini Süre:1m 30s
Soru 398Soru →

You have an Azure App Service web app named App1 that is currently hosted on a Free (F1) App Service plan. You need to configure a custom domain named www.contoso.com for App1 and secure it using a free Azure App Service Managed Certificate.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To configure the custom domain and secure it with an App Service Managed Certificate, you must first scale up the App Service plan to the Basic tier or higher. Next, create a DNS CNAME record mapping the custom domain to the default App Service URL. Then, add the custom domain to the App Service. Afterward, create the free App Service Managed Certificate for the custom domain. Finally, create a Server Name Indication (SNI) SSL binding for the custom domain using the managed certificate.
The correct order follows the logical dependency chain of Azure App Service configurations: first, upgrade the hosting environment (App Service plan) to support the required features. Second, prepare the external DNS routing. Third, register and verify the custom domain on the App Service. Fourth, generate the TLS/SSL certificate for the verified domain. Fifth, create the SSL binding to secure the incoming traffic.

Adım Adım Çözüm

1
Scale up the App Service plan to the Basic tier or higher.
The App Service plan is upgraded to a tier that supports custom domains and SSL bindings.
The Free (F1) tier does not support custom domains or SSL. Upgrading to at least the Basic tier is required for App Service Managed Certificates.
2
Create a DNS CNAME record that maps www.contoso.com to the default Azure App Service domain name.
A CNAME record is configured in the DNS provider pointing to the default App Service domain name.
Azure requires domain ownership verification before a custom domain can be added to the App Service. The CNAME record fulfills this validation.
3
Add the www.contoso.com custom domain to App1.
The custom domain is verified and added to the App Service.
You cannot issue a certificate or configure bindings for a domain that is not first registered and verified with the App Service.
4
Create a free App Service Managed Certificate for www.contoso.com.
A managed TLS/SSL certificate is generated by Azure for the custom domain.
The custom domain must be registered with the App Service before Azure can validate and issue a managed certificate for it.
5
Create a Server Name Indication (SNI) SSL binding for www.contoso.com using the managed certificate.
The custom domain is secured with SSL/TLS encryption.
Creating the SSL binding is the final step to apply the generated certificate to the custom domain traffic.

Anahtar Kavram

Configuring custom domains and SSL bindings with App Service Managed Certificates on Azure App Services.
Tahmini Süre:3m 0s
Soru 399Soru →

An administrator is preparing to deploy a new virtual machine named VM-App-01 in the East US region. The virtual machine will run a line-of-business application. The subscription contains a Recovery Services vault named Vault-Backup located in the West US region. You must configure daily backups for VM-App-01 using Azure Backup during the creation of the virtual machine. Which action must you perform to successfully configure the backup?

Cevabı ve açıklamayı göster

Cevap: Create a new Recovery Services vault in the East US region.

Cevap

Create a new Recovery Services vault in the East US region.
To back up a virtual machine in Azure, the Recovery Services vault must be in the same region as the virtual machine. Since the new virtual machine is being deployed to the East US region and the existing vault is in the West US region, a new Recovery Services vault must be created in the East US region.

Adım Adım Çözüm

1
Identify the region of the virtual machine being deployed and the target Recovery Services vault.
The virtual machine is in East US, while the existing vault is in West US.
Azure Backup requires the Recovery Services vault to reside in the same region as the resource being backed up.
2
Determine the necessary resource provision to support backup during VM creation.
A Recovery Services vault must be created in the East US region.
Since the existing vault is in West US, a new vault in the East US region is required to successfully register and enable the backup for the new VM.

Anahtar Kavram

Recovery Services Vault Region Alignment
Soru 400Soru →

During a post-migration audit, an Azure administrator creates a resource group named `rg-finance-billing` to house audit data. The administrator applies the following configurations to the resource group:
- A tag named `CostCenter: Finance-101`
- A ReadOnly resource lock named `lock-finance-ro`

Subsequently, the administrator deploys a Storage Account named `safinanceaudit` into `rg-finance-billing`.

The administrator then attempts to perform the following operations:
1. View a cost report in Azure Cost Management filtered by the `CostCenter: Finance-101` tag to analyze the costs of `safinanceaudit`.
2. Retrieve the access keys for `safinanceaudit` using the Azure portal.
3. Upload a CSV file to a blob container named `audit-logs` inside `safinanceaudit` using Azure Storage Explorer.

Which of the operations will succeed?

Cevabı ve açıklamayı göster

Cevap: Operation 3 only

Cevap

Only Operation 3 will succeed because resource locks restrict only management plane (control plane) operations, allowing data-plane actions like uploading a blob. Operation 1 fails because tags are not automatically inherited by child resources. Operation 2 fails because retrieving keys is a control-plane POST operation blocked by the inherited ReadOnly lock.
The correct answer is the option stating that only Operation 3 will succeed. Uploading a blob to a storage account container is a data-plane action. Since Azure resource locks only restrict control-plane operations managed by Azure Resource Manager, data-plane operations are not blocked. Operation 1 fails because tags applied to a resource group are not inherited by resources within that group. Operation 2 fails because retrieving storage account keys uses the listKeys action, which is a control-plane POST operation and is blocked by the inherited ReadOnly lock.

Adım Adım Çözüm

1
Evaluate the tag inheritance rule for Operation 1.
The tag applied to the resource group is not inherited by the storage account.
Azure resource tags do not inherit from resource groups to resources automatically. Thus, filtering by the tag will not show the storage account's costs.
2
Evaluate the lock inheritance rule for Operation 2.
The storage account inherits the ReadOnly lock applied to the resource group.
Resource locks are inherited by all child resources in the resource group scope.
3
Determine the impact of the ReadOnly lock on retrieval of access keys in Operation 2.
The key retrieval operation is blocked.
Listing storage account access keys requires a POST request to the control plane, which is blocked by a ReadOnly lock.
4
Determine the impact of the ReadOnly lock on uploading a blob in Operation 3.
The blob upload operation succeeds.
Uploading a blob is a data-plane operation, and Azure resource locks only restrict control-plane (management) operations.

Anahtar Kavram

Resource lock inheritance and distinction between control-plane and data-plane operations, combined with tag inheritance behavior.
ÖncekiSayfa 20 / 63Sonraki
Tüm alıştırma soruları — Microsoft Azure Administrator (AZ-104) | Examkin