Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 561Soru →

An administrator is configuring a deployment slot named staging for an Azure App Service web app named app-finance that runs on a Standard S1 App Service plan. The web app connects to an Azure SQL database. The production slot must connect to a database named db-prod by retrieving a connection string from an Azure Key Vault named kv-prod. The staging slot must connect to a database named db-stage by retrieving a connection string from an Azure Key Vault named kv-stage. A system-assigned managed identity is enabled on both the production slot and the staging slot. The database connection string is configured in the App Service settings under the name DbConnectionString using Key Vault references. The administrator needs to configure the web app and Key Vaults to ensure that after a slot swap, the web app running in the production slot connects to db-prod and the web app running in the staging slot connects to db-stage, without any authentication failures. Which of the following configurations should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Secrets User role in kv-prod to the production slot's managed identity, and grant the Key Vault Secrets User role in kv-stage to the staging slot's managed identity.

Cevap

Configure DbConnectionString as a deployment slot setting in both slots. Grant the Key Vault Secrets User role in kv-prod to the production slot's managed identity, and grant the Key Vault Secrets User role in kv-stage to the staging slot's managed identity.
The correct configuration requires marking the DbConnectionString setting as a deployment slot setting in both slots. This ensures that the setting is sticky to the slot and does not swap when the deployment slots are swapped, keeping the production slot pointing to the production Key Vault (kv-prod) and the staging slot pointing to the staging Key Vault (kv-stage). Additionally, because system-assigned managed identities are resource-specific and do not swap with the slots, the production slot's managed identity must be granted the Key Vault Secrets User role in kv-prod, and the staging slot's managed identity must be granted the Key Vault Secrets User role in kv-stage to read the secret values.

Adım Adım Çözüm

1
Configure the DbConnectionString setting in both the production and staging slots using Key Vault references pointing to the respective Key Vault secrets.
The production slot points to the secret in kv-prod and the staging slot points to the secret in kv-stage.
Allows the App Service to securely retrieve database connection strings from Azure Key Vault without storing them in plain text.
2
Mark the DbConnectionString app setting as a deployment slot setting (sticky setting) in both slots.
The setting value is locked to the slot and does not swap during deployment slot swaps.
Prevents the production slot from swapping its connection string configuration with the staging slot, ensuring it always points to the production database.
3
Assign the Key Vault Secrets User role to the production slot's managed identity on kv-prod, and to the staging slot's managed identity on kv-stage.
Each slot's system-assigned managed identity has the required data-plane permissions to read secrets from its respective Key Vault.
System-assigned managed identities are resource-specific and sticky to their respective slots. Because they do not swap, each identity must be granted the specific permissions needed for its corresponding Key Vault.

Anahtar Kavram

Deployment slots and managed identities in Azure App Service. System-assigned managed identities are bound to the specific slot instance and do not swap, requiring separate Key Vault permissions for each slot. App settings must be configured as deployment slot settings to remain sticky during a slot swap.
Soru 562Soru →

An administrator is configuring a new virtual network named `vnet-prod` in an Azure subscription. The virtual network is assigned the address space 10.15.4.0/2210.15.4.0/22. The administrator must create the following subnets:

* A subnet named `Subnet-App` to host up to 125125 virtual machines.
* A subnet to support an Azure Bastion host.
* A subnet named `GatewaySubnet` to support a VPN Gateway.

To conserve IP addresses for future expansion, the administrator wants to allocate the minimum required address space to each subnet. Which configuration of subnet prefix lengths should the administrator use?

Cevabı ve açıklamayı göster

Cevap: /24/24 for `Subnet-App`, /26/26 for `AzureBastionSubnet`, and /29/29 for `GatewaySubnet`

Cevap

The configuration using /24/24 for `Subnet-App`, /26/26 for `AzureBastionSubnet`, and /29/29 for `GatewaySubnet`.
The correct configuration uses /24/24 for `Subnet-App` (providing 251251 usable addresses, which accommodates the required 125125 hosts after subtracting the 55 Azure reserved IP addresses), /26/26 for `AzureBastionSubnet` (meeting the minimum prefix requirement of /26/26 for Azure Bastion hosts), and /29/29 for `GatewaySubnet` (meeting the minimum prefix requirement of /29/29 for Azure VPN Gateways).

Adım Adım Çözüm

1
Calculate the size required for `Subnet-App`.
/24/24 subnet prefix.
To host 125125 virtual machines, the subnet must also accommodate the 55 IP addresses reserved by Azure (the first 44 and the last 11 address of the subnet). This requires a total of 125+5=130125 + 5 = 130 IP addresses. A /25/25 subnet provides 128128 IP addresses (123123 usable), which is insufficient. A /24/24 subnet provides 256256 IP addresses (251251 usable), which is the minimum sufficient size.
2
Determine the size requirement for the Azure Bastion subnet.
/26/26 subnet prefix.
Azure Bastion must be deployed in a subnet named exactly `AzureBastionSubnet` and configured with a prefix length of /26/26 or larger (e.g., /26/26, /25/25, /24/24). A /27/27 subnet is too small and is not supported.
3
Determine the size requirement for `GatewaySubnet`.
/29/29 subnet prefix.
The subnet used for an Azure Virtual Network Gateway must be named `GatewaySubnet`. It must have a minimum prefix length of /29/29 to accommodate the gateway instances and Azure's 55 reserved IPs. A /30/30 subnet is invalid as it only contains 44 total IP addresses.

Anahtar Kavram

Azure Virtual Network subnet sizing constraints, Azure reserved IP addresses, and specific subnet size requirements for Azure Bastion and VPN Gateways.
Soru 563Soru →

An administrator is planning the subnet topology for a new virtual network named `VNet-Prod` in an Azure subscription. `VNet-Prod` is assigned the address space 10.150.16.0/2010.150.16.0/20.

The administrator must configure the following subnets within `VNet-Prod` to support a hybrid application deployment:
- A subnet for a virtual network gateway to enable hybrid connectivity with an on-premises network. This subnet must use the smallest valid address space allowed by Azure.
- A subnet for Azure Bastion to enable secure administrative access. This subnet must use the smallest valid address space allowed by Azure.
- A subnet named `Subnet-Compute` that must host up to 124124 virtual machines.
- A subnet named `Subnet-Database` that must host up to 2727 database instances.

The administrator wants to define these subnets sequentially starting from the beginning of the `VNet-Prod` address space (10.150.16.0/2010.150.16.0/20), minimizing unallocated address space, and ensuring that no subnets overlap.

Which of the following subnet configurations should the administrator select?

Cevabı ve açıklamayı göster

Cevap: GatewaySubnet: 10.150.16.0/2910.150.16.0/29; AzureBastionSubnet: 10.150.16.64/2610.150.16.64/26; Subnet-Database: 10.150.16.128/2710.150.16.128/27; Subnet-Compute: 10.150.17.0/2410.150.17.0/24

Cevap

GatewaySubnet: 10.150.16.0/29; AzureBastionSubnet: 10.150.16.64/26; Subnet-Database: 10.150.16.128/27; Subnet-Compute: 10.150.17.0/24
The correct configuration uses the smallest valid subnet masks that meet Azure requirements and host counts, while respecting subnet alignment boundaries. Specifically, the gateway subnet uses a /29 prefix (the minimum size for a GatewaySubnet), the Azure Bastion subnet uses a /26 prefix (the minimum size for AzureBastionSubnet), the database subnet uses a /27 prefix (which provides exactly the 32 addresses required for 27 databases plus 5 Azure-reserved IPs), and the compute subnet uses a /24 prefix (since 124 VMs plus 5 reserved IPs equals 129 IPs, which exceeds the 128-address limit of a /25 prefix). All blocks are aligned on their respective mathematical boundaries (multiples of their sizes), resulting in a valid and non-overlapping configuration.

Adım Adım Çözüm

1
Determine the minimum prefix sizes required for Azure infrastructure subnets.
GatewaySubnet requires a minimum prefix of /29. AzureBastionSubnet requires a minimum prefix of /26.
Azure enforces these minimum size requirements for gateway and bastion deployments to ensure sufficient IP space for internal routing and scaling.
2
Calculate the minimum prefix sizes for application and database subnets, accounting for Azure-reserved IP addresses.
Subnet-Compute requires a /24 prefix (124 VMs + 5 reserved = 129 IPs, which exceeds the 128-address limit of a /25). Subnet-Database requires a /27 prefix (27 databases + 5 reserved = 32 IPs, which fits exactly in a /27).
Azure reserves 5 IP addresses per subnet (the first 4 and the last 1). These must be added to the workload host count to determine the minimum valid subnet block size.
3
Align the subnets sequentially on their respective binary boundaries starting from 10.150.16.0.
GatewaySubnet occupies 10.150.16.0/29 (10.150.16.0 - 10.150.16.7). AzureBastionSubnet is a /26 block and must start on a multiple of 64, which is 10.150.16.64/26 (10.150.16.64 - 10.150.16.127). Subnet-Database is a /27 block and must start on a multiple of 32, which is 10.150.16.128/27 (10.150.16.128 - 10.150.16.159). Subnet-Compute is a /24 block and must start on a /24 boundary (where the fourth octet is 0), which is 10.150.17.0/24 (10.150.17.0 - 10.150.17.255).
Classless Inter-Domain Routing (CIDR) requires subnets to start on addresses that are multiples of their block sizes. This alignment prevents overlap and ensures routing validity.

Anahtar Kavram

Azure-specific subnet sizing requirements combined with standard CIDR boundary alignment rules.
Tahmini Süre:3m 0s
Soru 564Soru →

An administrator is planning the deployment of several Azure virtual machines to meet specific application requirements. Match each virtual machine deployment requirement on the left to the appropriate Azure configuration feature on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Configure a virtual machine during deployment to automatically download and execute a bash script stored in an Azure Storage account.
Group multiple virtual machines physically close to each other within a region to achieve the lowest possible network latency.
Configure a virtual machine to support the attachment of high-performance storage that guarantees sub-millisecond latency.
Configure a virtual machine to support Intel Software Guard Extensions (SGX) secure enclaves and boot volumes larger than 2 TB2\text{ TB}.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Configure a virtual machine during deployment to automatically download and execute a bash script stored in an Azure Storage account matches with Custom Script Extension. Group multiple virtual machines physically close to each other within a region to achieve the lowest possible network latency matches with Proximity Placement Group. Configure a virtual machine to support the attachment of high-performance storage that guarantees sub-millisecond latency matches with Ultra Disk compatibility. Configure a virtual machine to support Intel Software Guard Extensions (SGX) secure enclaves and boot volumes larger than 2 TB2\text{ TB} matches with Generation 2 architecture.
The correct matches align each specific deployment need to the feature designed for that purpose: Custom Script Extension for bootstrapping code execution, Proximity Placement Groups for physical proximity/low latency, Ultra Disk compatibility for enabling high-performance storage, and Generation 2 architecture for advanced hardware capabilities.

Adım Adım Çözüm

1
Analyze the post-deployment script execution requirement.
Matched with Custom Script Extension.
Azure Custom Script Extension allows for bootstrap configuration by executing custom scripts immediately after VM provisioning.
2
Analyze the network latency minimization requirement.
Matched with Proximity Placement Group.
A Proximity Placement Group ensures that VMs are deployed in the same physical datacenter to minimize latency.
3
Analyze the sub-millisecond storage requirement.
Matched with Ultra Disk compatibility.
Ultra Disks provide sub-millisecond latencies but require the VM to have Ultra Disk compatibility enabled.
4
Analyze the Intel SGX and larger boot volume requirement.
Matched with Generation 2 architecture.
Generation 2 VMs support modern features like UEFI boot, larger OS disks, and Intel SGX confidential computing, which are unsupported on Generation 1.

Anahtar Kavram

Azure Virtual Machine creation configurations, including extensions, hardware generation features, storage support, and placement groups.
Soru 565Soru →

You are managing an Azure environment in the East US region. You have an Azure Virtual Machine named VM-Mgmt that has a single network interface named nic-mgmt. Currently, nic-mgmt has a primary IP configuration named ipconfig1, which is a member of the backend pool of a Standard SKU public load balancer named LB-Prod. To facilitate direct administration, you need to assign a new public IP address named PIP-Mgmt directly to ipconfig1. All resources are located in the East US region. Which SKU and allocation method must you configure for PIP-Mgmt?

Cevabı ve açıklamayı göster

Cevap: Standard SKU and Static allocation

Cevap

Standard SKU and Static allocation
The correct configuration is Standard SKU and Static allocation. When a virtual machine's network interface is associated with the backend pool of a Standard SKU load balancer, any public IP address directly assigned to that network interface must also be a Standard SKU public IP to maintain SKU compatibility. Furthermore, Standard SKU public IP addresses in Azure only support Static allocation.

Adım Adım Çözüm

1
Identify the SKU of the load balancer associated with the virtual machine's network interface.
The load balancer (LB-Prod) is a Standard SKU load balancer.
Azure requires SKU matching between a load balancer and any public IP addresses associated with resources in its backend pool.
2
Determine the required SKU for the public IP address (PIP-Mgmt).
PIP-Mgmt must be configured with the Standard SKU.
Associating a Basic SKU public IP with a network interface in a Standard Load Balancer backend pool is not supported.
3
Determine the allocation method for the Standard SKU public IP address.
The allocation method must be set to Static.
Standard SKU public IP addresses in Azure only support Static IP address allocation.

Anahtar Kavram

Standard SKU Public IP allocation and SKU matching with Standard Load Balancer backend pools
Tahmini Süre:2m 0s
Soru 566Soru →

An administrator is deploying a new Azure Kubernetes Service (AKS) cluster in an environment with an existing virtual network (10.100.0.0/1610.100.0.0/16). To comply with a tenant security mandate, traffic from Pods to on-premises databases must not undergo network address translation (NAT), and each Pod must be assigned a unique, routable IP address from the virtual network subnet (10.100.1.0/2410.100.1.0/24). Which network model should the administrator configure for the AKS cluster?

Cevabı ve açıklamayı göster

Cevap: Azure CNI

Cevap

Azure CNI
The correct answer is Azure CNI. Under this model, every Pod gets an IP address from the subnet and can be accessed directly. This avoids network address translation (NAT) for outbound traffic from the node to the rest of the virtual network or on-premises networks.

Adım Adım Çözüm

1
Analyze the requirement for Pod IP allocation and NAT.
Pods must receive IP addresses directly from the virtual network subnet and must not use NAT to communicate with external resources.
This is a direct feature of the Azure CNI network model, whereas Kubenet uses NAT for outbound node traffic.
2
Identify the network plugin that supports direct subnet IP allocation.
Azure CNI allocates IPs to Pods from the subnet, whereas Kubenet allocates IPs from a logical private range.
Choosing Azure CNI satisfies both the no-NAT requirement and the direct subnet IP assignment requirement.

Anahtar Kavram

Azure CNI assigns IP addresses from the subnet directly to the Pods, avoiding NAT for communication with other resources in the virtual network.
Tahmini Süre:1m 0s
Soru 567Soru →

An administrator configures a Network Security Group (NSG) associated with a subnet. The subnet contains two virtual machines: `VM-Web` (associated with Application Security Group `ASG-Web`) and `VM-DB` (associated with `ASG-DB`).

The NSG has the following inbound security rules:

RulePrioritySourceDestinationPortProtocolAction
Rule 1100100ASG-WebASG-DB14331433TCPAllow
Rule 2200200AnyASG-DB14331433TCPDeny

Which two of the following statements correctly describe how traffic is processed by these rules?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is allowed.; TCP traffic on port 14331433 from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.

Cevap

TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is allowed, and TCP traffic on port 14331433 from virtual machines not associated with `ASG-Web` to `VM-DB` is denied.
TCP traffic on port 14331433 from `VM-Web` to `VM-DB` is allowed because Rule 1 (priority 100100) is evaluated first and matches the source and destination ASGs. For virtual machines not in `ASG-Web`, Rule 1 does not match, meaning evaluation falls through to Rule 2 (priority 200200), which explicitly denies all inbound TCP traffic on port 14331433 to `ASG-DB`.

Adım Adım Çözüm

1
Determine the evaluation order of the NSG rules based on priority.
Rule 1 (priority 100100) is evaluated before Rule 2 (priority 200200).
Azure NSGs process rules sequentially starting from the lowest priority number.
2
Evaluate traffic originating from `VM-Web` to `VM-DB` on port 14331433.
The traffic matches Rule 1 because the source `VM-Web` is in `ASG-Web` and the destination `VM-DB` is in `ASG-DB`. The action is Allow.
Once a rule matches, no further rules are evaluated for that traffic.
3
Evaluate traffic originating from other virtual machines to `VM-DB` on port 14331433.
The traffic does not match Rule 1. It is then evaluated against Rule 2, which matches the source as Any and denies the traffic.
If a rule does not match, processing continues to the next priority rule.

Anahtar Kavram

Network Security Group rules are evaluated in order of priority (lowest number first). Once a rule matches, evaluation stops. Application Security Groups allow rules to be scoped to specific groups of VMs.
Soru 568Soru →

You have a Network Security Group (NSG) associated with an Azure subnet. The NSG contains the following two inbound security rules:

* `Rule1`: Priority 200200, Source: `Internet`, Destination: `*`, Port: 33893389, Protocol: `TCP`, Action: `Deny`
* `Rule2`: Priority 150150, Source: `Internet`, Destination: `*`, Port: 33893389, Protocol: `TCP`, Action: `Allow`

A user attempts to establish a Remote Desktop Protocol (RDP) connection from the Internet to a virtual machine in the subnet. Which of the following describes the outcome of this connection attempt?

Cevabı ve açıklamayı göster

Cevap: Allowed, because the rule with priority 150150 is processed before the rule with priority 200200

Cevap

The connection is allowed because the rule with priority 150150 is evaluated before the rule with priority 200200, and it permits the traffic.
In Azure Network Security Groups (NSGs), security rules are processed in priority order, where lower numbers have higher precedence. When traffic matches a rule, processing stops. Because the rule with priority 150150 (Allow) is lower than the rule with priority 200200 (Deny), the Allow rule is evaluated first and the traffic is permitted.

Adım Adım Çözüm

1
Identify the priority numbers of the matching rules.
Rule 1 has a priority of 200200, and Rule 2 has a priority of 150150.
NSG rules are evaluated in order of priority.
2
Determine which rule takes precedence based on the priority numbers.
Rule 2 (priority 150150) takes precedence over Rule 1 (priority 200200) because a lower number indicates higher priority.
In Azure NSGs, lower priority numbers have higher precedence.
3
Apply the action of the rule with the highest precedence.
The traffic is allowed because Rule 2's action is Allow.
Once a rule matches the traffic, that rule is applied and subsequent rules are not evaluated.

Anahtar Kavram

Azure NSG rule processing order is based on priority numbers, where smaller numbers have higher priority.
Soru 569Soru →

An administrator has uploaded a private PFX SSL certificate to an Azure App Service web app. The administrator now needs to configure the custom domain www.contoso.com for the web app and secure it using the uploaded certificate.

Which three actions should the administrator perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To configure the custom domain and secure it with the uploaded certificate, first create a CNAME record pointing the custom domain to the App Service default domain. Next, add the custom domain to the App Service. Finally, create an SNI SSL binding for the custom domain using the uploaded certificate.
To configure a custom domain and secure it, the DNS record must be created first to pass the Azure ownership verification check. Once the domain is added, the SSL binding can be created to link the domain with the uploaded PFX certificate.

Adım Adım Çözüm

1
Create a CNAME record in the DNS registrar's zone pointing the custom domain to the App Service default domain.
Domain ownership validation requirement is satisfied.
Azure requires validation of domain ownership before a custom domain can be added to the App Service.
2
Add the custom domain to the App Service.
The custom domain is registered and mapped to the App Service.
The hostname must be registered with the App Service before SSL bindings can be applied to it.
3
Create an SNI SSL binding for the custom domain using the uploaded certificate.
HTTPS traffic to the custom domain is secured with the PFX certificate.
Binds the certificate to the custom domain to enable HTTPS encryption.

Anahtar Kavram

Configuring custom domains and SSL bindings in Azure App Services.
Tahmini Süre:2m 0s
Soru 570Soru →

Your company has an on-premises Windows Server named FileServer-West1 that has a single volume E: with a total capacity of 2 TB (2,000 GB). You implement Azure File Sync to synchronize volume E: with an Azure file share.

You need to configure Azure File Sync cloud tiering to meet the following requirements:
* A minimum of 400 GB of free space must always be maintained on volume E:.
* Files that have not been accessed or modified within the last 14 days must be cached in the cloud, provided the volume free space target is not compromised.

How should you configure the cloud tiering settings on the server endpoint?

Cevabı ve açıklamayı göster

Cevap: Enable cloud tiering, set the Volume Free Space policy to 20%, and enable the Date policy set to 14 days.

Cevap

Enable cloud tiering, set the Volume Free Space policy to 20%, and enable the Date policy set to 14 days.
The correct configuration requires enabling cloud tiering on the server endpoint, setting the Volume Free Space policy to 20% (since 400 GB is 20% of the 2 TB volume capacity), and enabling the Date policy set to 14 days. When both policies are enabled, the Volume Free Space policy takes precedence to ensure that the specified local volume free space is maintained.

Adım Adım Çözüm

1
Calculate the required Volume Free Space percentage.
The target free space is 400 GB out of a total volume capacity of 2 TB (2,000 GB). The percentage is calculated as follows:
400 GB2000 GB×100%=20%\frac{400\text{ GB}}{2000\text{ GB}} \times 100\% = 20\%
Note that Azure File Sync cloud tiering requires specifying the free space as a percentage.
Azure File Sync cloud tiering's Volume Free Space policy is defined as a percentage from 0% to 100% of the volume's total capacity.
2
Determine the configuration of the Date policy.
The Date policy must be enabled and set to 14 days.
This policy tiers files that have not been accessed or modified within the specified number of days to the cloud, as long as the Volume Free Space policy threshold is not violated.
3
Configure the server endpoint settings.
Apply the cloud tiering configuration directly to the server endpoint.
Azure File Sync cloud tiering policies are configured at the server endpoint level within the Storage Sync Service.

Anahtar Kavram

Azure File Sync cloud tiering policies (Volume Free Space and Date policies)
Tahmini Süre:1m 30s
Soru 571Soru →

An administrator is configuring a daily database backup utility using Azure Container Instances (ACI). The utility consists of a single container that connects to a database, exports the data, uploads it to an Azure Blob Storage container, and then terminates.

The backup script is designed to return an exit code of 00 on success, and a non-zero exit code if the upload fails due to transient network issues. If the upload fails, the utility must automatically attempt to rerun the backup. To avoid unnecessary costs, the container must not run after a successful backup.

The administrator deploys the container instance using the default configuration settings. However, they notice that the container group continuously restarts and runs the backup script in an infinite loop, even when the upload succeeds.

Which of the following modifications should the administrator make to achieve the desired behavior?

Cevabı ve açıklamayı göster

Cevap: Change the restart policy of the container group to OnFailure

Cevap

Change the restart policy of the container group to OnFailure
By default, Azure Container Instances (ACI) deploys container groups with a restart policy of 'Always'. This causes the container to restart indefinitely, regardless of its exit code. Changing the restart policy to 'OnFailure' ensures the container group will automatically restart if the backup script fails (returns a non-zero exit code) and will stop running (terminating the container group) once it completes successfully (returns an exit code of 0).

Adım Adım Çözüm

1
Identify the default restart policy of Azure Container Instances.
By default, ACI container groups are deployed with a restart policy of 'Always'.
This explains why the container group enters an infinite loop, running the script repeatedly even after returning an exit code of 0.
2
Analyze the requirements for container execution and termination.
The container must stop on successful completion (exit code 0) but must restart if it fails (non-zero exit code).
This narrows down the required restart policy to one that distinguishes between success and failure exit codes.
3
Determine the correct restart policy to apply.
The 'OnFailure' restart policy restarts containers only when they fail, and transitions the group to a terminated state upon successful completion.
This satisfies both requirements of stopping on success and retrying on failure.

Anahtar Kavram

Restart policies control the lifecycle and automatic restart behavior of container groups in Azure Container Instances.
Soru 572Soru →

An administrator is configuring an Azure Virtual Machine named VM-App1. The virtual machine has a single network interface named nic-app1. The primary IP configuration (ipconfig1) of nic-app1 has a private IP address and is associated with a Standard SKU public IP address named PIP1. The administrator needs to add a secondary IP configuration (ipconfig2) to nic-app1. The secondary configuration requires its own public IP address named PIP2. Which configuration must be selected for PIP2?

Cevabı ve açıklamayı göster

Cevap: Standard SKU and Static allocation

Cevap

Standard SKU and Static allocation
The correct configuration is Standard SKU and Static allocation. Azure requires all public IP addresses associated with a single network interface to use the same SKU. Since the primary public IP address (PIP1) uses the Standard SKU, the secondary public IP address (PIP2) must also use the Standard SKU. Furthermore, Standard SKU public IP addresses only support Static allocation, whereas Basic SKU public IP addresses support both Static and Dynamic allocation.

Adım Adım Çözüm

1
Analyze the SKU of the existing public IP address associated with the network interface.
The existing public IP address (PIP1) is a Standard SKU public IP.
Azure enforces SKU consistency on a single network interface, meaning all public IP configurations must use the same SKU.
2
Determine the required SKU for the new public IP address (PIP2).
PIP2 must be created with the Standard SKU.
Mixing Standard and Basic SKU public IPs on the same network interface is not supported.
3
Determine the supported allocation method for the Standard SKU public IP address.
The allocation method must be set to Static.
Standard SKU public IP addresses in Azure only support Static allocation and do not support Dynamic allocation.

Anahtar Kavram

SKU alignment and allocation rules for multiple Public IP addresses on a single network interface
Soru 573Soru →

An organization has an Azure resource hierarchy consisting of a management group named MG-Finance and two child subscriptions named Sub-Billing and Sub-Reporting.

An administrator creates an Azure Policy initiative named Finance-Compliance-Initiative that contains the following policy definitions:
- A policy that restricts storage account creation to the East US region (Effect: Deny).
- A policy that requires secure transfer (HTTPS) to be enabled for all storage accounts (Effect: Deny).

The administrator assigns Finance-Compliance-Initiative to MG-Finance and adds Sub-Reporting to the exclusion list of the assignment.

The administrator then attempts to perform the following operations:
- Operation A: In Sub-Billing, create a storage account in the West US region with HTTPS enabled.
- Operation B: In Sub-Reporting, create a storage account in the West US region with HTTPS disabled.

Which of the following describes the outcome of these operations?

Cevabı ve açıklamayı göster

Cevap: Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.

Cevap

Operation A is blocked because of the location restriction policy, while Operation B succeeds because the subscription is excluded from the initiative assignment.
The correct option is that Operation A is blocked due to the location policy, and Operation B succeeds. Azure Policy evaluates assignments down the resource hierarchy. Because the initiative is assigned to the management group, it inherits to child subscriptions. However, because Sub-Reporting is explicitly excluded, none of the policies apply to Operation B, allowing the storage account to be created. Sub-Billing is not excluded, so its resource creation (Operation A) is evaluated. Even though secure transfer is enabled, the location (West US) violates the allowed locations policy, and the Deny effect prevents the creation.

Adım Adım Çözüm

1
Identify the scope of the policy initiative assignment and inheritance.
The initiative is assigned at MG-Finance, which covers child subscriptions Sub-Billing and Sub-Reporting by inheritance.
Understanding scope helps determine which resources are subject to policy evaluation.
2
Apply the exclusion configuration to the inheritance path.
Sub-Reporting is excluded, meaning no policies in the initiative apply to it. Sub-Billing remains fully subject to the policies.
Exclusions bypass policy evaluation for the designated scope.
3
Evaluate Operation A against the active policies in Sub-Billing.
The location is West US, which violates the 'East US only' allowed locations policy. Because the policy effect is Deny, the operation is blocked.
A Deny effect blocks the resource creation immediately if any policy rule in the assignment is violated.
4
Evaluate Operation B against the active policies in Sub-Reporting.
Since Sub-Reporting is excluded from the assignment, the policies are not evaluated, allowing the operation to succeed.
Excluding a scope prevents any actions from being blocked or audited by the assignment.

Anahtar Kavram

Azure Policy scopes, exclusions, inheritance, and the Deny effect.
Soru 574Soru →

An organization is deploying Azure File Sync to synchronize files from an on-premises Windows Server named NY-FS01 to an Azure file share. The destination file share is hosted in a storage account named stsyncdata which has its firewall configured to restrict network access to 'Selected networks'. The organization's security policy prohibits exposing storage traffic to the public internet. Which of the following actions should you perform to enable successful file synchronization while adhering to the security policy?

Cevabı ve açıklamayı göster

Cevap: Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.

Cevap

Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.
Configuring a private endpoint for the file sub-resource of the storage account allows the on-premises sync agent to transfer files over a private IP address using VPN or ExpressRoute. This satisfies the 'Selected networks' firewall constraint without exposing the storage account's endpoints to the public internet.

Adım Adım Çözüm

1
Determine the network path requirements for the Azure File Sync agent.
Identify that the agent must communicate with the Storage Sync Service and the Storage Account directly to upload/download data.
Although the Storage Sync Service orchestrates the sync topology, data plane traffic goes directly to the Azure File share endpoint in the storage account.
2
Evaluate the network security constraints of the storage account.
Recognize that because the storage account firewall is set to 'Selected networks', public internet connections from the on-premises server will be blocked.
An on-premises server is treated as an untrusted public source by default under 'Selected networks' rules.
3
Identify the private networking solution that meets the security policy.
Implement a private endpoint for the file sub-resource of the storage account, allowing traffic to transit privately via VPN or ExpressRoute.
A private endpoint maps a private IP address from a virtual network to the storage account, keeping the sync traffic within the private network boundary.

Anahtar Kavram

Secure network connectivity for Azure File Sync and Azure Files using private endpoints
Tahmini Süre:1m 30s
Soru 575Soru →

An administrator needs to configure temporary access for a partner application to download blobs from a container named incoming-transfers in an Azure Storage account named partnerdataretrieval. The access configuration must meet the following security requirements:
- The partner application must only connect from the public IP address 198.51.100.55.
- The connection must be restricted to HTTPS.
- Access must automatically expire after 8 hours.
- The administrator must be able to revoke this access immediately before the 8-hour period expires without affecting other active SAS tokens or rotating the storage account access keys.

Which two actions should the administrator perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a stored access policy on the incoming-transfers container.; Generate a Service SAS for the container that references the stored access policy, specifying the allowed IP address and requiring HTTPS.

Cevap

Create a stored access policy on the container and generate a Service SAS for the container that references the stored access policy while specifying the allowed IP address and requiring HTTPS.
To support immediate revocation of the Shared Access Signature (SAS) without affecting other tokens, you must associate the SAS with a stored access policy on the container. A Service SAS supports association with stored access policies, allowing revocation by simply deleting or modifying the policy. The specific constraints for the client IP address and HTTPS protocol are specified when generating the SAS token.

Adım Adım Çözüm

1
Determine the type of SAS required for immediate revocation without key rotation.
Identify that a Service SAS is required because it supports stored access policies, whereas an Account SAS does not.
Stored access policies allow immediate revocation by deleting or changing the policy, which meets the security requirement.
2
Create the stored access policy on the target container.
A stored access policy is created directly on the incoming-transfers container.
Stored access policies are defined at the container or resource level, not at the storage account level.
3
Generate the Service SAS token referencing the policy and applying network/protocol constraints.
The Service SAS is generated with the client IP address restricted to 198.51.100.55 and protocol restricted to HTTPS.
Constraints like allowed IP addresses and protocols must be defined on the SAS token itself during generation.

Anahtar Kavram

Manage Storage Access Keys and Shared Access Signatures (SAS)
Soru 576Soru →

An administrator is configuring an Azure Virtual Machine Scale Set (VMSS) named VMSS1 that uses Uniform orchestration. VMSS1 currently has five instances running a web application, and the upgrade policy is set to Manual. You need to configure VMSS1 to meet the following requirements:
- When a new version of the OS image is published, the instances must be updated automatically in batches to prevent application downtime.
- VMSS1 must scale out by two instances when the average CPU utilization exceeds 80%80\% for 10 minutes.
- VMSS1 must scale in by one instance when CPU utilization drops, but you must prevent rapid scaling loops (thrashing).

Which two configuration settings should you implement? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Change the upgrade policy of VMSS1 to Rolling.; Configure a scale-in rule with an average CPU threshold of 30%30\% and a cooldown period of 10 minutes.

Cevap

To configure the scale set correctly, you must change the upgrade policy to Rolling to ensure updates occur in batches without causing application downtime, and configure a scale-in rule with a low CPU threshold (such as 30%30\%) and an adequate cooldown period (such as 10 minutes) to prevent instance thrashing.
The Rolling upgrade policy updates instances in batches, which prevents downtime by keeping a subset of instances online. To prevent instance thrashing, the scale-in metric threshold must be set significantly lower than the scale-out threshold, and the cooldown period must be long enough to let the system stabilize after scaling actions.

Adım Adım Çözüm

1
Select the appropriate upgrade policy for batch updates.
The Rolling upgrade policy is chosen, as it updates instances in sequential batches rather than all at once.
This maintains application availability during image upgrades.
2
Determine the scale-in CPU threshold and cooldown window to prevent thrashing.
A threshold of 30%30\% CPU utilization with a 10-minute cooldown is selected.
This leaves a wide margin between scale-out (80%80\%) and scale-in (30%30\%), giving the new instances time to boot and handle load before another scaling decision is made, preventing rapid scale-up/scale-down cycles.

Anahtar Kavram

Configuring Virtual Machine Scale Set upgrade policies and preventing autoscale thrashing.
Soru 577Soru →

An organization configures the External Collaboration settings for their Microsoft Entra ID tenant as follows:
- Guest user access: Guest users have limited access to properties and memberships of directory objects
- Guest invite settings: Only users assigned to specific admin roles can invite guest users

The tenant has the following users:
- User1: Assigned the User Administrator role at the tenant level in Microsoft Entra ID.
- User2: Assigned the Owner role at the subscription level for the Azure subscription linked to the tenant.
- User3: A guest user who has been assigned the Guest Inviter role in Microsoft Entra ID.
- User4: Assigned the User Administrator role scoped to a specific Administrative Unit within the tenant.

Which users can invite external guest users to the tenant?

Cevabı ve açıklamayı göster

Cevap: User1 and User3 only

Cevap

User1 and User3 only
The correct answer is the option containing User1 and User3 only. In Microsoft Entra ID, when the guest invite settings are restricted to specific administrative roles, the permitted roles by default include Global Administrator, User Administrator, and Guest Inviter. User1 is a tenant-level User Administrator, and User3 has the Guest Inviter role, which allows them to invite guests even though User3 is a guest user. User2 has subscription-level Owner permissions, which is an Azure RBAC role and does not grant Microsoft Entra ID directory permissions. User4 is scoped to an Administrative Unit, which limits their administrative actions to that unit and does not allow them to perform tenant-level actions like inviting guest users. Finally, dynamic groups cannot be assigned directory roles, making that configuration invalid.

Adım Adım Çözüm

1
Identify the Entra ID tenant-level roles that are permitted to invite guest users when guest invite settings are restricted to specific admin roles.
The permitted roles include Global Administrator, User Administrator, Directory Writers, and Guest Inviter.
This establishes the baseline of directory-level permissions required for guest invitation under the restricted policy.
2
Evaluate each user's permissions and scope against the permitted roles.
User1 holds the tenant-wide User Administrator role (permitted). User2 holds a subscription-level RBAC role, which does not grant Entra ID directory permissions (not permitted). User3 holds the Guest Inviter role (permitted). User4 is scoped to an Administrative Unit, which prevents tenant-wide actions like inviting guest users (not permitted).
This determines which of the individual users are capable of inviting guests based on their role and scope.
3
Evaluate the group assignment option for dynamic groups.
Entra ID roles cannot be assigned to dynamic groups; they can only be assigned to role-assignable groups with assigned membership.
This rules out the possibility of assigning the Guest Inviter role to a dynamic group.

Anahtar Kavram

Microsoft Entra ID External Collaboration settings control guest invitation rights. When restricted to specific admin roles, only tenant-wide administrative roles (such as User Administrator and Guest Inviter) are authorized. Azure RBAC roles do not grant these directory rights, and Administrative Unit scopes restrict directory administrators from performing tenant-wide operations.
Soru 578Soru →

Your company plans to deploy a new Azure virtual network named `VNet-Core` in an Azure subscription. The virtual network will be assigned the address space `172.16.0.0/22172.16.0.0/22.

You need to configure the following three subnets within `VNet-Core`:
- A subnet for a VPN gateway named `GatewaySubnet`.
- A subnet for Azure Bastion named `AzureBastionSubnet`.
- A subnet named `Subnet-App` that must support at least 5858 virtual machines.

Which two of the following subnet configurations should you implement? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: `Subnet-App` using the address range `172.16.2.0/26172.16.2.0/26`; `AzureBastionSubnet` using the address range `172.16.3.0/26172.16.3.0/26`

Cevap

The correct subnet configurations are Subnet-App using the address range 172.16.2.0/26 and AzureBastionSubnet using the address range 172.16.3.0/26.
The correct configurations are the workload subnet Subnet-App using the 172.16.2.0/26 address space and the AzureBastionSubnet using the 172.16.3.0/26 address space. Subnet-App requires 58 usable IP addresses. A /26 subnet provides 64 total addresses, leaving 59 usable after Azure's 5 reserved IP addresses are subtracted, which is sufficient. AzureBastionSubnet requires a prefix of at least /26, which is satisfied by 172.16.3.0/26.

Adım Adım Çözüm

1
Calculate the minimum prefix size required for Subnet-App to support at least 5858 virtual machines.
A /26/26 prefix is required.
Azure reserves 55 IP addresses in every subnet (the first four and the last one). For 5858 virtual machines, the subnet must have a total capacity of at least 58+5=6358 + 5 = 63 IP addresses. A /27/27 subnet provides only 3232 total addresses (32−5=2732 - 5 = 27 usable), whereas a /26/26 subnet provides 6464 total addresses (64−5=5964 - 5 = 59 usable), which meets the requirement.
2
Determine the prefix size requirement for AzureBastionSubnet.
A prefix size of /26/26 or larger is required.
Azure Bastion requires a dedicated subnet named exactly `AzureBastionSubnet` with a prefix size of at least /26/26 (e.g., /26/26, /25/25, etc.) to accommodate its scale-out instances. A prefix of /27/27 is invalid.
3
Determine the prefix size requirement for GatewaySubnet.
A prefix size of /29/29 or larger is required.
The VPN Gateway requires a subnet named exactly `GatewaySubnet` with a prefix size of at least /29/29. A prefix of /30/30 is invalid and has zero usable IP addresses after accounting for the 55 reserved IPs.
4
Verify that the chosen correct subnet address ranges do not overlap and fit within the VNet address space.
The subnet ranges `172.16.2.0/26` and `172.16.3.0/26` do not overlap and both reside within the `172.16.0.0/22` address space.
The `172.16.0.0/22` address space covers `172.16.0.0` through `172.16.3.255`. The subnets `172.16.2.0/26` (covering `172.16.2.0` to `172.16.2.63`) and `172.16.3.0/26` (covering `172.16.3.0` to `172.16.3.63`) are distinct and valid.

Anahtar Kavram

Azure virtual networks reserve five IP addresses in every subnet (first four and the last one). Dedicated subnets like GatewaySubnet (minimum /29) and AzureBastionSubnet (minimum /26) have strict prefix size constraints.
Tahmini Süre:2m 30s
Soru 579Soru →

An administrator is planning the deployment of a critical web application to Azure App Service. The application has the following hosting requirements:
- Must automatically scale out up to 1212 instances during periods of high CPU utilization.
- Must support at least 22 deployment slots to enable zero-downtime deployments.
- Must minimize overall hosting costs.

Which App Service plan pricing tier should you select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Premium v3 (P1v3)

Cevap

Premium v3 (P1v3)
The Premium v3 (P1v3) pricing tier is correct because it supports automatic scale-out up to 3030 instances (meeting the 1212 instances requirement) and supports up to 2020 staging slots (meeting the 22 slots requirement), while being the most cost-effective option that satisfies all criteria.

Adım Adım Çözüm

1
Evaluate the scaling requirements against the instance limits of the App Service plan tiers.
Basic (B1) supports up to 33 instances (manual only). Standard (S1) supports up to 1010 instances (automatic). Premium v3 (P1v3) supports up to 3030 instances (automatic). Isolated v2 (I1v2) supports up to 100100 instances (automatic). Standard (S1) and Basic (B1) are eliminated because they cannot scale to 1212 instances.
This step determines which tiers can satisfy the scaling target of 1212 instances.
2
Evaluate the deployment slot requirements for the remaining tiers.
Both Premium v3 (P1v3) and Isolated v2 (I1v2) support up to 2020 deployment slots, which easily satisfies the requirement of at least 22 slots.
This step ensures that the hosting environment can support zero-downtime deployment workflows using staging slots.
3
Compare the cost profiles of the remaining compliant tiers to find the most cost-effective option.
Premium v3 (P1v3) operates on multi-tenant dedicated hardware and is significantly cheaper than Isolated v2 (I1v2), which runs inside a dedicated App Service Environment (ASE). Premium v3 is chosen as the most cost-effective tier.
This satisfies the cost-minimization constraint of the scenario.

Anahtar Kavram

App Service Plan pricing tier capabilities and limits
Tahmini Süre:2m 0s
Soru 580Soru →

You are configuring a virtual network named `vnet-dev` for a testing environment. Within `vnet-dev`, you create a subnet named `subnet-test` and assign it the address prefix 10.10.5.0/2810.10.5.0/28. What is the maximum number of virtual machines that can be successfully deployed and receive IP addresses in `subnet-test`?

Cevabı ve açıklamayı göster

Cevap: 11

Cevap

11
A subnet configured with a /28/28 prefix has 1616 total IP addresses (232−28=162^{32-28} = 16). Azure reserves the first four IP addresses and the last IP address of the subnet range, totaling 55 reserved IPs. Subtracting these 55 reserved IPs from the 1616 total IPs results in 1111 usable IP addresses available for virtual machines.

Adım Adım Çözüm

1
Determine the total number of IP addresses in the subnet's CIDR block.
A /28/28 subnet prefix has a total of 232−28=24=162^{32-28} = 2^4 = 16 IP addresses.
The CIDR prefix determines the host bits and total address pool.
2
Apply Azure-specific subnet reservations.
Azure reserves the first four IP addresses (10.10.5.010.10.5.0, 10.10.5.110.10.5.1, 10.10.5.210.10.5.2, 10.10.5.310.10.5.3) and the last IP address (10.10.5.1510.10.5.15) in the subnet range, which is 55 addresses in total.
Azure virtual networks always reserve five IP addresses in every subnet for protocol and service operations.
3
Calculate the usable IP addresses for host virtual machines.
16 total addresses−5 reserved addresses=1116 \text{ total addresses} - 5 \text{ reserved addresses} = 11 usable IP addresses.
Only non-reserved IP addresses in a subnet can be assigned to virtual machines.

Anahtar Kavram

Azure Subnet IP Address Reservation
ÖncekiSayfa 29 / 63Sonraki