Tüm alıştırma soruları

1252 soru

Tüm türler1,252 Çoktan seçmeli644 Çoklu seçim429 Doğru / Yanlış47 Eşleştirme52 Sıralama80

You plan to configure a new Azure Kubernetes Service (AKS) cluster that will use the Azure CNI network plugin. Which of the following are characteristics of this network model? (Select two.)

Geçerli olan tümünü seçin

Every pod in the cluster is assigned a private IP address from the subnet of the virtual network.

The cluster requires a larger virtual network IP address space than a Kubenet-based cluster of the same size.

Pods are assigned IP addresses from a separate address space and must use Network Address Translation (NAT) to access other virtual network resources.

User-defined routes (UDRs) must be manually created on the subnet to enable pod-to-pod communication across different nodes.

Each pod is automatically assigned a public IP address to allow direct inbound traffic from the internet.

Cevabı ve açıklamayı göster

Cevap: Every pod in the cluster is assigned a private IP address from the subnet of the virtual network.; The cluster requires a larger virtual network IP address space than a Kubenet-based cluster of the same size.

Cevap

Every pod in the cluster is assigned a private IP address from the subnet of the virtual network, and the cluster requires a larger virtual network IP address space than a Kubenet-based cluster of the same size.

Under the Azure CNI model, pods receive IP addresses directly from the pre-configured subnet of the virtual network, which allows direct IP-level communication with other resources but requires a larger block of IPs from the subnet.

Adım Adım Çözüm

Analyze the features of the Azure CNI network plugin.

Identify that Azure CNI assigns IP addresses to pods directly from the subnet, which facilitates direct communication with other VNet resources without NAT.

This is a key architectural feature of Azure CNI that distinguishes it from Kubenet.

Evaluate the IP address planning requirements for Azure CNI.

Determine that since pods consume subnet IPs, a larger block of IP addresses must be allocated and planned in advance compared to Kubenet, where pods use a separate logical space.

IP exhaustion is a major configuration consideration when deploying AKS with Azure CNI.

Anahtar Kavram

Azure CNI vs Kubenet networking configuration in Azure Kubernetes Service (AKS)

Tahmini Süre:45s

Soru 582Soru →

Your company has an on-premises Windows Server named OSLO-SRV01 and an Azure subscription containing a storage account and a file share named oslo-files. You plan to implement Azure File Sync to centralize file storage.

What is the correct sequence of steps you must perform to configure and establish synchronization between OSLO-SRV01 and the Azure file share?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

Deploy a Storage Sync Service resource in Azure, install the Azure File Sync agent on OSLO-SRV01, register OSLO-SRV01 with the Storage Sync Service, create a sync group and a cloud endpoint targeting the oslo-files share, and finally create a server endpoint specifying the local folder path on OSLO-SRV01.

Establishing Azure File Sync requires a specific logical sequence: first, establishing the management resource in Azure (Storage Sync Service); second, preparing the local server by installing the required agent software; third, registering the local server to establish trust; fourth, defining the sync group topology with the cloud-side storage (cloud endpoint); and finally, adding the local storage location (server endpoint) to start the synchronization process.

Adım Adım Çözüm

Deploy the Storage Sync Service resource in Azure.

The logical synchronization management plane is established in Azure.

This top-level Azure resource must exist before servers can register or endpoints can be configured.

Install the Azure File Sync agent on OSLO-SRV01.

The File Sync agent components and registration utilities are installed on the local server.

The server needs the agent installed to communicate and perform the registration process.

The server is registered and appears under Registered Servers in Azure.

A trust relationship must be established between the local server and the Azure Storage Sync Service.

Create a sync group and add a cloud endpoint.

A sync group is created containing the cloud endpoint pointing to the oslo-files share.

The sync topology must be defined, and a cloud endpoint must exist before configuring server endpoints.

Create a server endpoint.

The local server path is linked to the sync group and synchronization begins.

Server endpoints map the actual local directory to the sync group topology.

Anahtar Kavram

Azure File Sync Deployment Sequence

Soru 583Soru →

An organization has the following Azure resource hierarchy:

* A Management Group named MG-Production
* An Azure subscription named Sub-App1 under MG-Production
* A Resource Group named RG-Data within Sub-App1

The administrator wants to ensure that all Azure Storage Accounts created within the hierarchy are configured to block public blob access. If a storage account is deployed with public access enabled, it must be automatically remediated by setting the property to disabled, without blocking the resource creation.

Which assignment scope and policy effect should the administrator use to meet these requirements?

Assign the policy to MG-Production and use the Modify effect.

Assign the policy to MG-Production and use the Deny effect.

Assign the policy to RG-Data and use the Audit effect.

Assign the policy to Sub-App1 and use the Append effect.

Cevabı ve açıklamayı göster

Cevap: Assign the policy to MG-Production and use the Modify effect.

Cevap

Assign the policy to MG-Production and use the Modify effect.

Assigning the policy to the management group MG-Production ensures it applies to all subscriptions and resource groups under it, including Sub-App1 and RG-Data. The Modify effect is used to add, update, or remove properties or tags during resource creation or update, enabling automatic remediation without blocking the deployment.

Adım Adım Çözüm

Analyze the scope requirement

The requirement states that the policy must apply to all storage accounts created within the hierarchy. Assigning the policy to the parent Management Group (MG-Production) ensures inheritance down to all child subscriptions (Sub-App1) and resource groups (RG-Data).

Azure Policy assignments at a higher scope are inherited by all child resources and scopes.

Identify the required policy effect

The policy must automatically remediate the resource (set public access to disabled) without blocking the deployment. The Modify effect is designed to add or modify properties during resource creation or update.

The Modify effect allows updating resource properties in-flight during deployment, whereas Deny blocks creation and Audit only reports compliance status.

Combine scope and effect

The correct configuration is to assign the policy at MG-Production with the Modify effect.

This satisfies both the hierarchy-wide enforcement scope and the non-blocking remediation requirement.

Anahtar Kavram

Azure Policy Scope and Effects

Soru 584Soru →

Your company has an Azure virtual network named `VNet-Production` that contains two subnets named `Subnet-Database` ( $172.16.1.0/24$ ) and `Subnet-Security` ( $172.16.2.0/24$ ). By default, virtual machines in `Subnet-Database` route traffic directly to the internet using the default system routes. A third-party firewall virtual machine with the private IP address of $172.16.2.4$ is deployed in `Subnet-Security`. You need to redirect all outbound internet traffic ( $0.0.0.0/0$ ) from `Subnet-Database` to the firewall. Which next hop type must you specify in the route table to ensure the traffic is sent to the firewall's private IP address?

Virtual network gateway

Internet

Virtual appliance

VnetLocal

Cevabı ve açıklamayı göster

Cevap: Virtual appliance

Cevap

Virtual appliance

The correct answer is 'Virtual appliance'. When you want to route traffic through a custom virtual machine acting as a firewall or network virtual appliance (NVA), you must create a User-Defined Route (UDR) and select 'Virtual appliance' as the next hop type, providing the private IP address of the firewall VM (

172.16.2.4

Adım Adım Çözüm

Identify the destination and the device that will process the traffic.

The destination is the internet (

0.0.0.0/0

), and the processing device is a firewall virtual machine acting as a Network Virtual Appliance (NVA) at the IP address

172.16.2.4

This determines that custom routing is required to override the default system route to the internet.

Select the correct Azure next hop type for a virtual machine that inspects or filters traffic.

The correct next hop type is 'Virtual appliance' because the firewall is a VM running in a subnet.

Azure route tables require the 'Virtual appliance' hop type when directing traffic to a user-defined private IP address of a virtual machine.

Anahtar Kavram

Selecting the correct next hop type for custom routing to a Network Virtual Appliance (NVA)

Tahmini Süre:45s

Soru 585Soru →

You have an Azure App Service web app named WebApp1 that runs on the Premium V2 App Service plan. You need to configure custom backups for WebApp1. The backups must be stored in an Azure Storage account named storage1. The storage account has its firewall enabled, restricting all public access. Which five actions should you perform in sequence to configure the backups? To answer, arrange the actions in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

Configure Regional Virtual Network Integration for WebApp1 to a subnet, configure the firewall of storage1 to allow access from that subnet, enable a system-assigned managed identity for WebApp1, assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1, and configure the backup settings for WebApp1 by selecting storage1 and setting the authentication method to Managed Identity.

To secure backups of an Azure App Service to a firewall-restricted storage account, you must route the backup traffic over a virtual network and authenticate using a managed identity. First, you configure Regional Virtual Network Integration to place the App Service outbound traffic in a subnet. Second, you update the storage account firewall to permit traffic from that subnet. Third, you enable a system-assigned managed identity on the App Service. Fourth, you assign the Storage Blob Data Contributor role to this identity on the storage account. Finally, you configure the backup settings using the managed identity.

Adım Adım Çözüm

Configure Regional Virtual Network Integration for WebApp1 to a subnet.

Outbound traffic from WebApp1 is routed through the specified subnet.

This is necessary to establish a network path to a storage account that has its firewall enabled, as public access is blocked.

Configure the firewall of storage1 to allow access from the subnet integrated with WebApp1.

The storage account accepts connections originating from the integrated subnet.

Since the storage account restricts access to trusted networks, the subnet associated with the web app's VNet integration must be added to the allowed networks list.

Enable a system-assigned managed identity for WebApp1.

An identity for WebApp1 is registered in Microsoft Entra ID.

Backing up over a firewall-secured storage account requires using a managed identity for authentication, as SAS tokens are not supported under this configuration.

Assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1.

WebApp1 is authorized to write blobs to storage1.

The managed identity requires permissions to write the backup files to the storage container, which is provided by the Storage Blob Data Contributor role.

Configure the backup settings for WebApp1 by selecting storage1 and setting the authentication method to Managed Identity.

Automated backups are configured and running successfully using the secured path.

Specifying the storage account and selecting the managed identity finishes the configuration and starts backing up the web app.

Anahtar Kavram

Configuring secure backups for Azure App Services using VNet integration and managed identities.

Soru 586Soru →

Your company has an Azure subscription containing a virtual network named VNet1 ( $10.150.0.0/16$ ). VNet1 contains a subnet named Subnet1 ( $10.150.1.0/24$ ). You need to deploy a new Azure Kubernetes Service (AKS) cluster named AKS1 to run a microservices application. The deployment must meet the following requirements:
- The cluster must support a system node pool that can scale up to a maximum of 10 nodes.
- Each node in the system node pool must support up to 30 pods.
- The IP addresses for the pods must be routable directly within VNet1 without using Network Address Translation (NAT).
- The cluster API server must not be exposed to the public internet, and must be accessible only from VNet1 and peered networks.
- You must minimize administrative effort for DNS resolution of the API server.

Which two configurations should you perform? (Select two.)

Geçerli olan tümünü seçin

Deploy AKS1 to Subnet1 and configure it to use the Kubenet network plugin.

Create a new subnet in VNet1 with an address prefix of 10.150.2.0/23 and deploy AKS1 using the Azure CNI network plugin.

Enable the private cluster feature and configure the cluster to use a system-assigned private DNS zone.

Enable the private cluster feature and deploy a custom Azure Private DNS zone named privatelink.eastus.azmk8s.io.

Deploy AKS1 to Subnet1 and configure it to use the Azure CNI network plugin.

Cevabı ve açıklamayı göster

Cevap: Create a new subnet in VNet1 with an address prefix of 10.150.2.0/23 and deploy AKS1 using the Azure CNI network plugin.; Enable the private cluster feature and configure the cluster to use a system-assigned private DNS zone.

Cevap

Create a new subnet in VNet1 with at least a /23 address prefix, configure it with the Azure CNI network plugin, enable the private cluster feature, and configure the cluster to use a system-assigned private DNS zone.

The correct configurations are to create a new subnet in the virtual network with at least a /23 address prefix using the Azure CNI plugin, and to enable the private cluster feature with a system-assigned private DNS zone. Azure CNI assigns IP addresses to pods directly from the VNet subnet, which requires a minimum of

(10 \text{ nodes} + 1 \text{ upgrade node}) \times (30 \text{ pods} + 1) + 5 \text{ reserved IPs} = 346

IPs. Since a /24 subnet only offers 251 usable IPs, a /23 subnet (507 usable IPs) is required. Enabling a private cluster secures the API server, and a system-assigned private DNS zone minimizes administration compared to manual DNS zone creation.

Adım Adım Çözüm

Calculate the required number of IP addresses for the Azure CNI network plugin.

The minimum number of IP addresses required is calculated as

(N + S) \times (P + 1) + 5

, where

N

is the maximum number of nodes (

10

S

is the max surge nodes (

1

for rolling upgrades), and

P

is the maximum number of pods per node (

30

). This equals

(10 + 1) \times (30 + 1) + 5 = 346

IP addresses.

Azure CNI pre-allocates an IP address for each node and each pod from the subnet, plus 5 reserved IPs for Azure services.

Select the appropriate subnet size.

A /24 subnet provides 256 IP addresses (251 usable), which is insufficient. A /23 subnet provides 512 IP addresses (507 usable), which accommodates the 346 required IP addresses.

To avoid IP address exhaustion during operations and upgrades, the subnet prefix must be at least /23.

Evaluate the routing requirement.

Azure CNI must be used because it assigns VNet-routable IP addresses directly to pods without requiring NAT. Kubenet uses NAT for pod-to-pod communication outside the node.

Direct routability within VNet1 without NAT is a strict requirement.

Select the private cluster and DNS configuration.

Enable the private cluster feature to secure the API server behind a Private Endpoint, and configure it to use a system-assigned private DNS zone.

This isolates the API server from the public internet and minimizes administrative effort by letting Azure automatically manage the private DNS zone life cycle.

Anahtar Kavram

Azure CNI IP addressing requirements and private AKS cluster DNS configuration.

Soru 587Soru →

You are deploying an Azure Standard Load Balancer named LB1 to load balance traffic across three virtual machines. You need to create a new Public IP address named pip-web to use as the frontend IP configuration for LB1. Which two settings should you configure for pip-web?

Geçerli olan tümünü seçin

SKU: Standard

Allocation: Static

SKU: Basic

Allocation: Dynamic

Cevabı ve açıklamayı göster

Cevap: SKU: Standard; Allocation: Static

Cevap

The correct configurations are Standard for the SKU and Static for the allocation method.

To ensure compatibility, a Standard Load Balancer must use a Standard SKU Public IP address. Because Standard SKU Public IPs only support Static allocation, you must configure both Standard SKU and Static allocation.

Adım Adım Çözüm

Determine the required SKU for the Public IP address based on the Load Balancer type.

Since the load balancer is a Standard Load Balancer, the associated Public IP address must also be a Standard SKU.

Azure requires SKU alignment between the Load Balancer and the Public IP used in its frontend IP configuration.

Identify the supported allocation method for the Standard SKU Public IP address.

Standard SKU Public IP addresses only support Static allocation.

Dynamic allocation is not available for Standard SKU Public IP addresses in Azure.

Anahtar Kavram

Configuring Public IP SKU and allocation methods for Azure Load Balancer frontend IP configurations.

Soru 588Soru →

An enterprise administrator is tasked with updating the network configuration of a virtual machine named VM-Backend located in the West US 2 region. The virtual machine has a single network interface named nic-backend, which is currently a member of the backend pool of a Standard Load Balancer named LB-App.

To host a new secure database management service, you must configure a secondary IP configuration on nic-backend. This secondary configuration requires a public IP address.

Which two actions should you perform to configure the secondary IP configuration? (Choose two.)

Geçerli olan tümünü seçin

Create a public IP address that uses the Standard SKU and Static allocation.

Associate the Standard SKU public IP address with the secondary IP configuration on nic-backend.

Create a public IP address that uses the Basic SKU and Static allocation.

Create a public IP address that uses the Standard SKU and Dynamic allocation.

Cevabı ve açıklamayı göster

Cevap: Create a public IP address that uses the Standard SKU and Static allocation.; Associate the Standard SKU public IP address with the secondary IP configuration on nic-backend.

Cevap

Create a public IP address that uses the Standard SKU and Static allocation, and associate the Standard SKU public IP address with the secondary IP configuration on nic-backend.

For a virtual machine associated with a Standard Load Balancer, any associated public IP addresses must match the Standard SKU. Standard SKU public IP addresses require the Static allocation method. Therefore, you must create a Standard SKU public IP with Static allocation and associate it with the secondary IP configuration on the network interface.

Adım Adım Çözüm

Determine the required SKU for the public IP address based on the load balancer configuration.

Since the VM's network interface is a member of the backend pool of a Standard Load Balancer, the public IP address must also be of the Standard SKU.

Standard Load Balancers do not support mixing Basic SKU public IPs with Standard SKU backend resources.

Determine the allocation method for the Standard SKU public IP.

Select the Static allocation method.

Standard SKU public IP addresses require Static allocation when configured in this environment.

Configure the secondary IP configuration on the network interface.

Associate the newly created Standard SKU public IP address with the secondary IP configuration on nic-backend.

This binds the public IP to the secondary private IP address configured on the network interface.

Anahtar Kavram

Configure Public and Private IP Addresses

Soru 589Soru →

A cloud architect is designing a hybrid network architecture in Azure to support a multi-tier web application and secure administrative access. The virtual network, named `vnet-corporate`, is allocated the address block $172.16.0.0/21$ . The architect defines the following subnets:

- `subnet-web`: $172.16.1.0/24$
- `subnet-db`: $172.16.2.0/23$

To provide secure RDP and SSH access to the virtual machines without exposing public IP addresses, the architect plans to deploy Azure Bastion using the Basic SKU. They propose creating a new subnet named `AzureBastionSubnet` with the address prefix $172.16.4.0/27$ .

Statement: The proposed configuration is sufficient to successfully deploy the Azure Bastion host.

Doğru

Yanlış

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false.

The proposed configuration is invalid because the Azure Bastion host requires a subnet with a prefix size of at least `/26`. The proposed prefix size of `/27` is too small, causing the deployment to fail.

Adım Adım Çözüm

Determine the IP range of the virtual network `vnet-corporate` using its CIDR prefix.

The address block

172.16.0.0/21

spans from

172.16.0.0

172.16.7.255

This establishes the outer boundaries for all subnet IP ranges.

Verify if the proposed subnets fit within the virtual network boundaries without overlapping.

`subnet-web` (

172.16.1.0/24

172.16.1.0

172.16.1.255

), `subnet-db` (

172.16.2.0/23

172.16.2.0

172.16.3.255

), and `AzureBastionSubnet` (

172.16.4.0/27

172.16.4.0

172.16.4.31

) are all valid, non-overlapping subsets of the

172.16.0.0/21

address space.

To confirm that the IP allocation itself is mathematically valid and contained.

Check the deployment requirements for the Azure Bastion service.

Azure Bastion requires a subnet named `AzureBastionSubnet` with a minimum prefix size of `/26` (which provides 64 IP addresses).

To verify if the proposed `/27` prefix size (providing only 32 IP addresses) meets the service requirements.

Anahtar Kavram

Azure Bastion Subnet Constraints

Soru 590Soru →

An administrator is configuring a virtual network named `vnet-office` with an address space of $192.168.0.0/22$ . The virtual network currently contains two subnets:
- `Subnet-A` with an address prefix of $192.168.0.0/24$
- `Subnet-B` with an address prefix of $192.168.1.0/24$

The administrator wants to create a third subnet named `Subnet-C` that provides the maximum number of usable IP addresses from the remaining address space.

Statement: The administrator can configure `Subnet-C` with the address prefix $192.168.2.0/23$ without causing any address space overlap.

Is this statement true or false?

Doğru

Yanlış

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True

The proposed subnet prefix

192.168.2.0/23

represents the exact remaining IP address space in the virtual network (

192.168.2.0

through

192.168.3.255

), resulting in no overlaps and maximizing the subnet size.

Adım Adım Çözüm

Identify the total IP range allocated to the virtual network.

The prefix

192.168.0.0/22

covers the range from

192.168.0.0

192.168.3.255

(total of

1024

addresses).

Determining the outer boundary of the network is necessary to find the remaining unassigned blocks.

Calculate the range of addresses occupied by the existing subnets.

`Subnet-A` (

192.168.0.0/24

) occupies

192.168.0.0

192.168.0.255

. `Subnet-B` (

192.168.1.0/24

) occupies

192.168.1.0

192.168.1.255

. The occupied range is

192.168.0.0

192.168.1.255

This identifies which IPs are already allocated to prevent overlapping subnets.

Define the remaining free address space and find the largest single CIDR block that fits it.

The free space is

192.168.2.0

192.168.3.255

. This block size is

512

addresses, which corresponds to a

/23

subnet mask. The block is aligned on a

/23

boundary, meaning

192.168.2.0/23

perfectly matches this range.

This confirms that the proposed prefix is mathematically valid and fully utilizes the remaining space without overlap.

Anahtar Kavram

Determining maximum non-overlapping subnet size in an Azure Virtual Network.

Soru 591Soru →

Your company has a Microsoft Entra ID tenant. You need to delegate administrative tasks related to Self-Service Password Reset (SSPR) and External Identities to different members of the IT support team.

Match each administration task to the least privileged administrative role required to perform the task.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Enable SSPR matches with Authentication Policy Administrator; Configure external collaboration settings matches with User Administrator; Configure cross-tenant access settings matches with Security Administrator; Reset passwords for non-administrative users matches with Helpdesk Administrator.

The correct matching aligns each SSPR and External Identities task with its least privileged administrative role. The Authentication Policy Administrator role is required to manage SSPR authentication methods. The User Administrator role manages tenant-wide guest collaboration settings. The Security Administrator role is required to modify cross-tenant access settings, which dictate inbound and outbound trust relations. The Helpdesk Administrator role is the minimum role required to reset passwords for non-administrative users.

Adım Adım Çözüm

Identify the administrative requirements for Self-Service Password Reset (SSPR) configuration.

Configuring SSPR scopes and authentication methods requires the Authentication Policy Administrator role.

This role is specifically scoped to manage authentication methods and password policies.

Identify the administrative requirements for external collaboration settings.

Configuring tenant-wide guest invitation restrictions requires the User Administrator role.

User Administrators can manage all aspects of user and group management, including guest invitations and collaboration settings.

Identify the administrative requirements for cross-tenant access settings.

Configuring cross-tenant access settings and trust settings requires the Security Administrator role.

Cross-tenant settings affect the security perimeter and trust relationships, thus requiring the Security Administrator role.

Identify the administrative requirements for resetting non-administrative user passwords.

Resetting passwords for standard users requires the Helpdesk Administrator role.

This is the least privileged role designed to handle password resets and support requests for non-administrators.

Anahtar Kavram

Assigning least privileged administrative roles for Microsoft Entra ID management tasks related to SSPR and External Identities.

Soru 592Soru →

Your organization is implementing Azure Policy to enforce governance standards across multiple subscriptions. You need to match the specific operational compliance requirements with the correct Azure Policy effects. Match each operational requirement on the left to its corresponding Azure Policy effect on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

To enforce the requirements, block resource creation with Deny, log non-compliance without blocking with Audit, insert default tags during creation with Modify, and automatically provision missing dependent resources with DeployIfNotExists.

Each requirement correctly maps to the corresponding Azure Policy effect: Deny blocks non-compliant requests; Audit logs non-compliant configurations; Modify adjusts tags or properties on the fly; and DeployIfNotExists deploys a template when a dependent resource is missing.

Adım Adım Çözüm

Analyze the prevention requirement: 'Block the creation or update of any resource that does not contain a required tag.'

Identify that blocking resource deployment corresponds to the Deny effect.

Deny is the standard effect to enforce compliance by preventing non-conforming resource deployment requests at the Azure Resource Manager level.

Analyze the logging requirement: 'Generate a compliance warning... without preventing the deployment.'

Identify that logging non-compliance without interrupting deployment corresponds to the Audit effect.

Audit evaluates the resource and records non-compliance events in the dashboard without hindering resource creation or modifications.

Analyze the tag injection requirement: 'Automatically insert a default tag during resource creation if the tag is missing.'

Identify that inserting or altering tags or properties during creation matches the Modify effect.

Modify is optimized for adding, modifying, or removing tags and properties during resource creation or update via remediation tasks.

Analyze the dependent resource deployment requirement: 'Provision a diagnostic settings resource automatically if it is missing.'

Identify that deploying a nested or dependent template-based resource corresponds to the DeployIfNotExists effect.

DeployIfNotExists checks for the existence of a child/related resource and executes a template deployment to remediate if the resource is absent.

Anahtar Kavram

Azure Policy effects determine what action is taken when a policy definition is evaluated against resources.

Tahmini Süre:1m 30s

Soru 593Soru →

You are administering an Azure environment containing a virtual network named `VNet-Core` ( $172.16.0.0/16$ ). The virtual network contains three subnets:
- `Subnet-Workload` ( $172.16.10.0/24$ ) containing application servers.
- `Subnet-DB` ( $172.16.20.0/24$ ) containing database servers.
- `Subnet-NVA` ( $172.16.100.0/24$ ) containing a third-party firewall VM named `NVA-Firewall` with a primary network interface named `nva-nic1` and IP address $172.16.100.4$ .

`VNet-Core` is peered with a hub virtual network named `VNet-Hub` ( $10.10.0.0/16$ ) that has gateway transit configured. An ExpressRoute gateway in `VNet-Hub` propagates a BGP route for the on-premises network range $192.168.50.0/24$ to the subnets in `VNet-Core`.

A route table named `RT-Workload` is associated with `Subnet-Workload` and contains the following custom routes:
- Destination: $172.16.20.0/24$ , Next Hop Type: `VirtualAppliance`, Next Hop IP: $172.16.100.4$
- Destination: $0.0.0.0/0$ , Next Hop Type: `VirtualAppliance`, Next Hop IP: $172.16.100.4$

A new corporate security policy specifies that:
1. All outbound internet traffic from `Subnet-Workload` must be inspected by `NVA-Firewall`.
2. Traffic from `Subnet-Workload` to a specific on-premises server at $192.168.50.99$ must be routed through `NVA-Firewall` for compliance auditing.
3. All other traffic from `Subnet-Workload` to the $192.168.50.0/24$ network must bypass `NVA-Firewall` and go directly through the ExpressRoute gateway.
4. Active traffic routing through `NVA-Firewall` must not be dropped at the virtual network interface level.

Which configuration should you implement to satisfy these requirements?

Add a route to `RT-Workload` with the destination prefix

192.168.50.99/32

, the next hop type set to `VirtualNetworkGateway`, and the next hop IP address

172.16.100.4

. Then, enable IP forwarding on the network interface `nva-nic1`.

Add a route to `RT-Workload` with the destination prefix

192.168.50.0/24

, the next hop type set to `VirtualAppliance`, and the next hop IP address

172.16.100.4

. Then, enable IP forwarding on the network interfaces of all application servers in `Subnet-Workload`.

Add a route to `RT-Workload` with the destination prefix

192.168.50.99/32

, the next hop type set to `VirtualAppliance`, and the next hop IP address

172.16.100.4

. Then, enable IP forwarding on the network interface `nva-nic1`.

Add a route to `RT-Workload` with the destination prefix

192.168.50.99/32

, the next hop type set to `VirtualAppliance`, and the next hop IP address

172.16.100.4

. Then, enable IP forwarding at the virtual network level on `VNet-Core`.

Cevabı ve açıklamayı göster

Cevap: Add a route to `RT-Workload` with the destination prefix $192.168.50.99/32$ , the next hop type set to `VirtualAppliance`, and the next hop IP address $172.16.100.4$ . Then, enable IP forwarding on the network interface `nva-nic1`.

Cevap

Add a route to RT-Workload with the destination prefix 192.168.50.99/32, the next hop type set to VirtualAppliance, and the next hop IP address 172.16.100.4. Then, enable IP forwarding on the network interface nva-nic1.

To route traffic for the specific host

192.168.50.99

through the firewall while sending the rest of the

192.168.50.0/24

network directly via the gateway, we must utilize Azure's Longest Prefix Match (LPM) algorithm. A User-Defined Route (UDR) for

192.168.50.99/32

with a next hop of `VirtualAppliance` (

172.16.100.4

) represents the longest prefix match for that specific host, forcing traffic to go through the firewall. For other hosts in the

192.168.50.0/24

subnet, the BGP route (

192.168.50.0/24

) will be a longer prefix match than the default route (

0.0.0.0/0

), causing them to bypass the firewall and route directly through the ExpressRoute gateway. Additionally, to allow the firewall virtual machine to receive and forward traffic not matching its own destination IP, IP forwarding must be enabled on its network interface (`nva-nic1`).

Adım Adım Çözüm

Identify the destination prefix requirements for the specific host vs the rest of the subnet.

The specific host requires the destination

192.168.50.99/32

, while the rest of the subnet uses

192.168.50.0/24

Using a more specific prefix (/32) ensures that traffic to that host is evaluated first by Azure's Longest Prefix Match (LPM) algorithm.

Determine the routing precedence between the UDR and the BGP-propagated route.

For

192.168.50.99

, the UDR

192.168.50.99/32

wins over the BGP route

192.168.50.0/24

. For other hosts in

192.168.50.0/24

, the BGP route wins over the default UDR

0.0.0.0/0

Azure routes traffic based on the longest prefix match. The UDR route overrides the BGP route for the specific host, while the BGP route overrides the default UDR for the rest of the subnet.

Verify next hop type and IP address requirements.

The next hop type must be `VirtualAppliance` and the IP address must be the internal IP of the firewall (

172.16.100.4

A virtual appliance next hop is required to route traffic through a custom firewall, and the IP address must reside in a locally reachable subnet.

Identify where to configure IP forwarding.

Enable IP forwarding on the firewall's network interface (`nva-nic1`).

Azure drop-filters packets where the source or destination IP does not match the IP of the receiving NIC unless IP forwarding is explicitly enabled on that NIC.

Anahtar Kavram

Azure Longest Prefix Match (LPM) and NVA IP Forwarding

Tahmini Süre:3m 0s

Soru 594Soru →

Your company has an Azure Storage account named corpstorage2026 that contains a blob container named uploads. The storage account network firewall is enabled. You need to grant a partner application access to upload blobs to the uploads container. The access configuration must meet the following security requirements:
- The partner application must only be allowed to access the uploads container.
- The partner application must only connect from the public IP address 198.51.100.45 over HTTPS.
- The authorization credentials must automatically expire after 4 days.
- The token must be signed using Microsoft Entra ID credentials instead of the storage account access keys.

Which of the following actions should you perform?

Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 4 days.

Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 10 days.

Assign the partner application's service principal the Contributor role on the storage account to authorize the direct upload of blobs, and avoid generating a SAS token.

Generate a Service SAS for the uploads container with an expiration of 4 days, and enable the 'Allow trusted Microsoft services to access this storage account' firewall exception to permit the partner application's connection.

Cevabı ve açıklamayı göster

Cevap: Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 4 days.

Cevap

Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 4 days.

A User Delegation SAS meets the requirement to sign access using Microsoft Entra ID credentials instead of storage account keys. Because the validity period of 4 days is within the maximum 7-day threshold for a user delegation key, this SAS is valid. The token is correctly scoped at the container level and enforces the HTTPS-only protocol and the client IP address restriction.

Adım Adım Çözüm

Determine the SAS signing mechanism.

Since the security requirement states that the token must be signed using Microsoft Entra ID credentials instead of the storage account access keys, a User Delegation SAS must be used rather than a Service SAS or Account SAS.

User Delegation SAS is the only SAS type that is signed using a user delegation key acquired with Microsoft Entra ID credentials.

Evaluate the validity duration constraint.

The validity duration must be 4 days, which is less than the maximum limit of 7 days.

A User Delegation SAS key is valid for a maximum of 7 days; a 10-day request would be rejected.

Verify scope, protocol, and network restrictions.

Scope the SAS to the uploads container, set allowed protocol to HTTPS, set allowed IP to 198.51.100.45, and set permissions to Write.

This configuration satisfies the container-level scope, protocol, and IP filtering restrictions while granting the minimum required permissions.

Anahtar Kavram

Selecting and configuring a User Delegation SAS to enforce least privilege access, protocol restrictions, IP filters, and validity duration limits.

Soru 595Soru →

An administrator creates a new Azure virtual network named `VNet-Main` containing a subnet named `Subnet-Web` ( $192.168.10.0/24$ ) and a subnet named `Subnet-Security` ( $192.168.20.0/24$ ). A custom firewall VM is installed in `Subnet-Security` at $192.168.20.10$ . By default, system routes allow direct subnet-to-subnet communication and direct outbound internet access. You need to ensure that all outbound internet traffic from `Subnet-Web` is redirected through the custom firewall VM instead of going directly to the internet. Which two actions are required to achieve this goal? (Select two.)

Geçerli olan tümünü seçin

Enable IP forwarding on the Azure network interface (NIC) of the custom firewall VM.

Create a route table containing a

0.0.0.0/0

route that specifies

192.168.20.10

as the next hop address, and link this table to `Subnet-Web`.

Create a route table containing a

0.0.0.0/0

route that specifies

192.168.20.10

as the next hop address, and link this table to `Subnet-Security`.

Enable IP forwarding on the Azure network interfaces (NICs) of all VMs in `Subnet-Web`.

Cevabı ve açıklamayı göster

Cevap: Enable IP forwarding on the Azure network interface (NIC) of the custom firewall VM.; Create a route table containing a $0.0.0.0/0$ route that specifies $192.168.20.10$ as the next hop address, and link this table to `Subnet-Web`.

Cevap

Enable IP forwarding on the Azure network interface (NIC) of the custom firewall VM, and create a route table containing a

0.0.0.0/0

route that specifies

192.168.20.10

as the next hop address, and link this table to `Subnet-Web`.

To route outbound traffic from the web subnet through a custom firewall, you must create a route table with a default route (

0.0.0.0/0

) pointing to the firewall's private IP address (

192.168.20.10

) and associate it with the web subnet. This user-defined route overrides the default system route to the Internet. Additionally, because the firewall VM is acting as a router/transit device, you must enable IP forwarding on its Azure network interface so Azure does not drop transit packets.

Adım Adım Çözüm

Configure the Network Virtual Appliance (NVA) capability by enabling IP forwarding on the custom firewall VM's network interface in Azure.

The firewall VM is permitted to receive and forward network transit traffic not addressed to itself.

By default, Azure drops traffic sent to a virtual machine if the destination IP does not match the VM's network interface IP.

Create a custom route table, add a route for the default destination (

0.0.0.0/0

) pointing to the private IP of the firewall (

192.168.20.10

) as the next hop, and associate this route table with `Subnet-Web`.

The custom User-Defined Route (UDR) overrides the default system route for internet traffic (

0.0.0.0/0

-> Internet) for all hosts in `Subnet-Web`.

User-Defined Routes have a higher precedence than default system routes, allowing administrators to redirect outbound traffic.

Anahtar Kavram

User-defined routing precedence and network virtual appliance transit configuration

Soru 596Soru →

You need to allow external HTTP traffic (port $80$ ) from the internet to a web server VM (`VM-Web`) and allow database traffic (port $1433$ ) from `VM-Web` to a database server VM (`VM-DB`). You associate `VM-Web` with an Application Security Group named `ASG-Web`, and `VM-DB` with an Application Security Group named `ASG-DB`. Which of the following inbound security rules must be added to the Network Security Group (NSG) to allow this traffic while maintaining the principle of least privilege? (Select two).

Geçerli olan tümünü seçin

An inbound rule with Source: `Internet`, Destination: `ASG-Web`, Destination Port:

80

, and Action: `Allow`

An inbound rule with Source: `ASG-Web`, Destination: `ASG-DB`, Destination Port:

1433

, and Action: `Allow`

An inbound rule with Source: `ASG-DB`, Destination: `ASG-Web`, Destination Port:

1433

, and Action: `Allow`

An inbound rule with Source: `ASG-Web`, Destination: `Internet`, Destination Port:

80

, and Action: `Allow`

Cevabı ve açıklamayı göster

Cevap: An inbound rule with Source: `Internet`, Destination: `ASG-Web`, Destination Port: $80$ , and Action: `Allow`; An inbound rule with Source: `ASG-Web`, Destination: `ASG-DB`, Destination Port: $1433$ , and Action: `Allow`

Cevap

An inbound rule with Source: Internet, Destination: ASG-Web, Destination Port: 80, and Action: Allow; and An inbound rule with Source: ASG-Web, Destination: ASG-DB, Destination Port: 1433, and Action: Allow

To establish connectivity, we need to allow inbound HTTP traffic on port

80

from the internet to the web servers (associated with the web Application Security Group) and allow SQL Server traffic on port

1433

from the web servers to the database servers (associated with the database Application Security Group). Thus, the correct rules specify the internet as the source for the HTTP rule and the web Application Security Group as the source for the database rule.

Adım Adım Çözüm

Identify the source and destination for the external HTTP traffic.

The traffic originates from the internet and targets the web servers. The rule must have Source: `Internet` and Destination: `ASG-Web` on port

80

This allows external web clients to access the web servers.

Identify the source and destination for the internal database traffic.

The traffic originates from the web servers and targets the database servers. The rule must have Source: `ASG-Web` and Destination: `ASG-DB` on port

1433

This allows the web application to query the SQL database.

Anahtar Kavram

Configuring inbound NSG rules targeting Application Security Groups (ASGs) to control multi-tier traffic.

Soru 597Soru →

You are designing the hosting infrastructure for a critical web application in Azure. The web application has the following requirements:
- Must be able to scale out to 15 instances automatically during peak traffic.
- Must support deployment slots to enable zero-downtime deployments.
- Must support regional virtual network integration.

You need to identify the App Service plan pricing tiers that support all of these requirements.

Which two pricing tiers should you recommend? (Select TWO.)

Geçerli olan tümünü seçin

Premium v2 (P1v2)

Premium v3 (P1v3)

Standard (S1)

Basic (B1)

Cevabı ve açıklamayı göster

Cevap: Premium v2 (P1v2); Premium v3 (P1v3)

Cevap

Premium v2 (P1v2) and Premium v3 (P1v3) are the correct pricing tiers that meet all requirements.

The correct options are Premium v2 (P1v2) and Premium v3 (P1v3). Premium v2 supports up to 20 scale-out instances, up to 20 deployment slots, and regional virtual network integration. Premium v3 supports up to 30 scale-out instances, up to 20 deployment slots, and regional virtual network integration. Both tiers meet all specified requirements.

Adım Adım Çözüm

Analyze the scale-out instance requirement.

The application requires scaling out to 15 instances. Basic (B1) supports up to 3 instances (manual only). Standard (S1) supports up to 10 instances. Premium v2 (P1v2) supports up to 20 instances, and Premium v3 (P1v3) supports up to 30 instances.

This requirement eliminates Basic (B1) and Standard (S1) because they do not support scaling to 15 instances.

Verify support for deployment slots.

Standard, Premium v2, and Premium v3 tiers support deployment slots (Standard up to 5, Premium up to 20). Basic (B1) does not support deployment slots.

This confirms that Basic (B1) is ineligible.

Verify support for regional virtual network integration.

Standard, Premium v2, and Premium v3 tiers all support regional virtual network integration.

All remaining candidate tiers (Standard, Premium v2, Premium v3) satisfy the networking requirement.

Select the tiers that satisfy all requirements.

Only Premium v2 (P1v2) and Premium v3 (P1v3) meet all criteria.

Standard (S1) is capped at 10 instances, while Basic (B1) is capped at 3 and has no slot support.

Anahtar Kavram

Azure App Service plan tier feature differences, including scale-out limits, staging slots, and networking support.

Soru 598Soru →

An administrator configures three virtual networks in the same Azure region: VNet A ( $10.1.0.0/16$ ), VNet B ( $10.2.0.0/16$ ), and VNet C ( $10.3.0.0/16$ ). Virtual machines are deployed in subnets within all three virtual networks.

Virtual network peering is configured between VNet A and VNet B, and between VNet B and VNet C. All peering connections use the default settings: 'Allow virtual network access' is enabled, while 'Allow forwarded traffic', 'Allow gateway transit', and 'Use remote gateways' are disabled. No user-defined routes (UDRs) or virtual network gateways exist.

Which of the following statements about network connectivity are correct? (Select two.)

Geçerli olan tümünü seçin

Virtual machines in VNet A can communicate directly with virtual machines in VNet B.

Virtual machines in VNet B can communicate directly with virtual machines in VNet C.

Virtual machines in VNet A can communicate directly with virtual machines in VNet C.

Virtual machines in VNet A can resolve the private DNS hostnames of virtual machines in VNet C by default.

Cevabı ve açıklamayı göster

Cevap: Virtual machines in VNet A can communicate directly with virtual machines in VNet B.; Virtual machines in VNet B can communicate directly with virtual machines in VNet C.

Cevap

Virtual machines in VNet A can communicate directly with virtual machines in VNet B, and virtual machines in VNet B can communicate directly with virtual machines in VNet C.

Direct peering links are configured between VNet A and VNet B, and between VNet B and VNet C. Since virtual network access is allowed, communication between these directly peered networks is fully established. However, because virtual network peering is non-transitive, traffic cannot flow between VNet A and VNet C.

Adım Adım Çözüm

Identify the direct peering connections established in the network topology.

Direct peering links exist between VNet A and VNet B, and between VNet B and VNet C.

To determine which networks can communicate directly based on virtual network access permissions.

Evaluate transit routing capabilities between VNet A and VNet C.

No direct peering or routing mechanism (such as an NVA or VPN Gateway) exists between VNet A and VNet C.

Virtual network peering is non-transitive by default, meaning traffic cannot automatically route through VNet B.

Anahtar Kavram

Virtual network peering is non-transitive, meaning direct peering links must be established between each pair of virtual networks that require communication, unless a transit gateway or NVA is configured.

Tahmini Süre:45s

Soru 599Soru →

You are deploying a new Azure virtual machine named VM1 to a subnet named Subnet1 in a virtual network named VNet1. You plan to use the Custom Script Extension to run a post-deployment configuration script on VM1 during provisioning.

The script is stored in a private container in an Azure storage account named storage1. The firewall of storage1 is configured to restrict access to 'Selected networks'.

You need to ensure that VM1 can download and execute the script during the provisioning phase.

What should you configure?

Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.

Enable the 'Allow trusted Microsoft services to access this storage account' setting in the firewall configuration of storage1.

Assign a system-assigned managed identity to VM1, and grant the identity the Storage Blob Data Reader role on storage1.

Configure a private DNS zone for storage1 and link it to VNet1 without creating a private endpoint.

Cevabı ve açıklamayı göster

Cevap: Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.

Cevap

Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.

The correct configuration is to enable the Microsoft.Storage service endpoint on the subnet where the VM resides and add a corresponding virtual network rule on the storage account. Because the Custom Script Extension runs inside the guest operating system of the virtual machine, the download request is initiated directly from the VM's network interface using its subnet configuration. Enabling the service endpoint and allowing the subnet through the storage firewall grants the VM secure access to retrieve the script.

Adım Adım Çözüm

Identify the source of the network traffic.

The Custom Script Extension executes within the operating system of VM1, which is deployed in Subnet1 of VNet1. The traffic to download the script originates from the VM's network interface in Subnet1.

This determines which source network needs to be permitted through the storage account firewall.

Select the appropriate network integration method.

Enable the Microsoft.Storage service endpoint on Subnet1 to optimize and secure the route to Azure Storage.

Service endpoints allow virtual network resources to access Azure services via private IP addresses over the Azure backbone.

Configure the storage firewall rule.

Add Subnet1 of VNet1 as an allowed network in the firewall settings of storage1.

This allows the storage account firewall to accept traffic originating from Subnet1, enabling VM1 to download the script during provisioning.

Anahtar Kavram

Configuring network access to Azure Storage for Virtual Machine extensions during deployment

Tahmini Süre:1m 30s

Soru 600Soru →

A company runs a web application on an Azure Virtual Machine Scale Set named `vmss-web`. The scale-out rule for `vmss-web` is configured to add one instance when the average Percentage CPU exceeds 80% for 10 minutes.

To optimize costs, you must define a scale-in rule that decreases the instance count by one.

Which scale-in rule configuration should you implement to prevent instance thrashing?

Metric: Percentage CPU; Threshold: Less than 30%; Action: Decrease count by 1

Metric: Percentage CPU; Threshold: Less than 75%; Action: Decrease count by 1

Metric: Available Memory Bytes; Threshold: Less than 1 GB; Action: Decrease count by 1

Metric: Disk Write Operations/Sec; Threshold: Less than 100; Action: Decrease count by 1

Cevabı ve açıklamayı göster

Cevap: Metric: Percentage CPU; Threshold: Less than 30%; Action: Decrease count by 1

Cevap

The scale-in rule must use the same metric (Percentage CPU) as the scale-out rule, with a threshold set to less than 30% and a scale-in action of decreasing the count by 1.

The correct configuration is to use the same metric (Percentage CPU) as the scale-out rule, with a threshold (30%) that is significantly lower than the scale-out threshold (80%). This difference prevents instance thrashing, where the workload redistributed to the remaining instances after a scale-in immediately triggers a scale-out.

Adım Adım Çözüm

Identify the scale-out metric and threshold.

The scale-out rule triggers when Percentage CPU exceeds 80%. When this happens, a new instance is added to distribute and reduce the average load.

Understanding the baseline metric and threshold is essential to design a non-conflicting scale-in rule.

Ensure the scale-in metric matches the scale-out metric.

The scale-in rule must also be configured to monitor the Percentage CPU metric.

Using mismatched metrics (such as Memory or Disk write operations) leads to conflicting scaling decisions, causing the scale set to scale out for one metric and scale in for another.

Determine the scale-in threshold margin.

A scale-in threshold of less than 30% provides a safe operational margin.

When an instance is removed, the average load on the remaining instances increases. If the scale-in threshold is set too high (e.g., 75%), the post-scale-in load spike will immediately cross the 80% scale-out threshold, causing instance thrashing.

Anahtar Kavram

Virtual Machine Scale Set autoscale rule design to prevent thrashing

Tahmini Süre:1m 30s

ÖncekiSayfa 30 / 63Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram