Tüm alıştırma soruları

Your company has an Azure environment containing three virtual networks:
- `VNet-Hub` ($172.30.0.0/16$): Contains an Azure Firewall with a private IP address of $172.30.0.4$ in a subnet named `AzureFirewallSubnet`.
- `VNet-Prod` ($10.100.0.0/16$): Contains `VM-Prod` deployed in `ProdSubnet` ($10.100.1.0/24$).
- `VNet-Dev` ($10.200.0.0/16$): Contains `VM-Dev` deployed in `DevSubnet` ($10.200.1.0/24$).

Bidirectional peering connections are established between `VNet-Hub` and `VNet-Prod`, and between `VNet-Hub` and `VNet-Dev`.

To comply with security policies, all traffic between `VNet-Prod` and `VNet-Dev` must transit through the Azure Firewall in `VNet-Hub`.

You associate a route table with `ProdSubnet` that contains a route for address prefix $10.200.0.0/16$ with a next hop of $172.30.0.4$ (Virtual appliance).
You associate a route table with `DevSubnet` that contains a route for address prefix $10.100.0.0/16$ with a next hop of $172.30.0.4$ (Virtual appliance).

Azure Firewall rules are configured to permit all traffic between the two spoke networks.
However, `VM-Prod` and `VM-Dev` are unable to communicate.

Which peering configuration must you enable on the virtual network peering connections to allow communication between the virtual networks?

You have two Azure virtual networks named VNet1 and VNet2. VNet1 is configured with the address space $10.1.0.0/16$, and VNet2 is configured with the address space $10.1.100.0/24$. Is the statement true or false that you can configure virtual network peering between VNet1 and VNet2?

An administrator manages an Azure subscription named Sub-Core that contains two resource groups named RG-Shared and RG-Secure.

The administrator must implement Azure Policy to enforce the following governance requirements:
1. All resources created within the subscription must include a tag named CostCenter. If the tag is missing, the resource deployment must be blocked.
2. Virtual machines deployed in RG-Secure must only use the Standard_D2s_v3 size. Virtual machines in RG-Shared must be allowed to use any size.

To meet the governance requirements with the minimum number of policy assignments, which two actions should the administrator perform?

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains two subnets: `SubnetA` ($10.0.1.0/24$) and `SubnetB` ($10.0.2.0/24$).

The virtual machines are configured as follows:
* `VM1` is in `SubnetA` and has a network interface named `NIC1`. `NIC1` is associated with an Application Security Group named `ASG-Web`.
* `VM2` is in `SubnetB` and has a network interface named `NIC2`. `NIC2` is associated with an Application Security Group named `ASG-DB`.
* `VM3` is in `SubnetB` and has a network interface named `NIC3`. `NIC3` is not associated with any Application Security Group.

The Network Security Groups (NSGs) are configured as follows:
* `NSG-SubnetA` is associated with `SubnetA`.
* `NSG-NIC1` is associated with `NIC1`.
* `NSG-NIC2` is associated with `NIC2`.
* `SubnetB` and `NIC3` have no associated NSGs.

The NSGs contain the following custom rules:

Which of the following statements correctly describe the connectivity when `VM1` attempts to establish a TCP connection to `VM2` and `VM3` on port $1433$? (Select TWO.)

You host a web application on an Azure App Service web app named WebApp1 that runs on a Basic B1 App Service plan. You deploy a continuous background processing task to WebApp1 using Azure WebJobs. You observe that the WebJob stops executing shortly after you close your browser or when there is no active traffic to the web app. What should you do to ensure that the WebJob runs continuously without interruption?

You have three virtual networks in the East US region: VNet1 ($10.1.0.0/16$), VNet2 ($10.2.0.0/16$), and VNet3 ($10.3.0.0/16$). Virtual machines are deployed in the subnets of all three virtual networks. You configure a virtual network peering between VNet1 and VNet2, and another virtual network peering between VNet2 and VNet3. No virtual network gateways or network virtual appliances (NVAs) are deployed in any of the virtual networks.

Which of the following statements about the connectivity and configuration options in this setup are correct? (Select two.)

A company needs to grant a partner application temporary read-only access to a specific queue named incoming-orders in an Azure Storage account. The access configuration must meet the following security requirements:
- The partner application must only be able to read messages from the incoming-orders queue.
- Access must be restricted to the partner's IP address range of 198.51.100.0/24.
- The access credentials must automatically expire after 24 hours.
- Access to all other queues, blob containers, and tables in the storage account must be prevented.
- The connection protocol must be restricted to HTTPS.
Which configuration should you use to meet these requirements with the least privilege?

Your company has an Azure environment with three virtual networks: `VNet-Hub` ($172.16.0.0/16$), `VNet-SpokeA` ($172.17.0.0/16$), and `VNet-SpokeB` ($172.18.0.0/16$). Both spoke virtual networks are peered directly with `VNet-Hub`.

In `VNet-Hub`, a Network Virtual Appliance (NVA) named `NVA-1` is deployed in a subnet named `Subnet-DMZ` ($172.16.1.0/24$). The NVA has a private IP address of $172.16.1.4$ assigned to its network interface `nic1`.

You need to ensure that all network traffic originating from `Subnet-App` ($172.17.1.0/24$) in `VNet-SpokeA` and destined for `Subnet-DB` ($172.18.1.0/24$) in `VNet-SpokeB` is routed through `NVA-1`.

Which two actions should you perform? (Each correct answer presents part of the solution.)

You are managing a web application hosted on an Azure virtual machine named VM-AdminPortal in the West US 3 region. This virtual machine is currently configured as a backend pool member of an active Standard Load Balancer named lb-webportal. VM-AdminPortal connects to the virtual network using a single network interface named nic-admin.

To perform direct administrative tasks, you need to assign a public IP address directly to VM-AdminPortal while keeping the virtual machine in the backend pool of lb-webportal.

Which of the following configuration steps must you perform to meet these requirements? (Select TWO.)

An administrator is configuring network security for an Azure virtual network named `VNet1`. `VNet1` contains a subnet named `Subnet1`.

The subnet contains two virtual machines: `VM-Web` and `VM-DB`.
- `VM-Web` is associated with an Application Security Group (ASG) named `ASG-Web`.
- `VM-DB` is associated with an ASG named `ASG-DB`.

A Network Security Group (NSG) named `NSG-Subnet` is associated with `Subnet1`.
An NSG named `NSG-NIC-DB` is associated with the network interface of `VM-DB`.

The inbound rules for `NSG-Subnet` are configured as shown in the following table:

The inbound rules for `NSG-NIC-DB` are configured as shown in the following table:

Currently, SQL database traffic from `VM-Web` to `VM-DB` is blocked.

Which two configuration changes should you perform to allow SQL traffic from `VM-Web` to `VM-DB`? (Select two.)

Your company has an Azure subscription containing a resource group named `rg-network-prod`. You are designing a virtual network named `vnet-shared-hub` within this resource group. The virtual network is allocated the address space $10.10.0.0/22$.

You must configure the virtual network to support the following infrastructure requirements:
- A subnet named `GatewaySubnet` to enable a VPN gateway connection to your on-premises datacenter.
- A subnet named `AzureBastionSubnet` to allow secure administrative access to your resources.
- A subnet named `subnet-compute` to host a workload of 60 virtual machines.

You need to select a subnet configuration that supports all requirements, avoids overlapping address ranges, fits within the virtual network address space, and minimizes IP address waste.

Which subnet configuration should you use?

An administrator manages an Azure virtual network named `vnet-corp-infra` with the address space $172.20.0.0/20$. The administrator creates a subnet named `subnet-shared-services` with the address range $172.20.15.0/29$. The administrator states that a maximum of three virtual machine instances can be simultaneously assigned private IP addresses in `subnet-shared-services`. Is this statement true?

Helios Logistics has an Azure subscription named sub-helios-prod containing a resource group named rg-helios-storage. The resource group contains an Azure Storage account named saheliosdata and an Azure Key Vault named kvhelioskeys.

To meet regulatory compliance, you must configure saheliosdata to use customer-managed keys (CMK) stored in kvhelioskeys for double encryption of data at rest. You apply the following configurations:
- kvhelioskeys has soft-delete and purge protection enabled.
- kvhelioskeys is configured to use the Azure role-based access control (Azure RBAC) permission model.
- kvhelioskeys has its firewall enabled, restricting access to select networks, and has 'Allow trusted Microsoft services to bypass this firewall' set to Yes.
- saheliosdata is configured to use a system-assigned managed identity.
- You assign the Key Vault Contributor role to the storage account's managed identity at the key vault scope.

When you attempt to enable customer-managed keys on saheliosdata using a key from kvhelioskeys, the operation fails.

What is the primary reason for this configuration failure?

An administrator manages an Azure Virtual Machine Scale Set named `vmss-compute` that uses Uniform orchestration. The scale set currently has 8 instances, and its upgrade policy is set to Manual. The administrator needs to update the scale set to use a new version of a custom virtual machine image. The update must meet the following requirements:
- The instances must be updated automatically in batches.
- The application must maintain service availability during the update process.
- The update process must pause if an instance fails to return to a healthy state after being updated.
Which upgrade policy should the administrator configure?

An administrator configures a Network Security Group (NSG) with the following inbound security rules:

Which two statements correctly describe how inbound HTTP traffic (port 80) to the virtual machines associated with ASG-Web is processed? (Select two.)

An administrator is deploying a new virtual machine named VM1 to host a database. The database workload requires high-performance storage with low latency. The administrator deploys VM1 using the Standard_D2_v3 size. When attempting to attach a Premium SSD managed disk as a data disk to VM1, the administrator finds that Premium SSD is not available. What should the administrator do to enable Premium SSD support for VM1?

A company deploys a virtual network named `ProductionVNet` ($172.16.0.0/16$). The virtual network has two subnets named `FrontendSubnet` ($172.16.1.0/24$) and `SecuritySubnet` ($172.16.2.0/24$). A firewall virtual machine is deployed as a Network Virtual Appliance (NVA) in `SecuritySubnet` with the private IP address $172.16.2.4$. By default, system routes allow direct traffic from `FrontendSubnet` to the internet. You want to modify the routing so that all outbound traffic from `FrontendSubnet` destined for the internet is inspected by the NVA. You generate a route table and configure a route with the address prefix $0.0.0.0/0$ to redirect the traffic. Which next hop type must you specify for this route?

An administrator is deploying a containerized analytics application to Azure Container Instances (ACI). The application consists of a single container that must run a batch-processing script daily.

The deployment must meet the following requirements:
- The container must access an Azure SQL database over a private endpoint located in a subnet named SQLSubnet within a virtual network named VNet1.
- The container must retrieve database credentials securely from Azure Key Vault without storing them in the container image or deployment configuration files.
- The container must terminate and stop consuming compute resources once the script completes successfully, but must restart if the script fails.

You create a new subnet named AppSubnet in VNet1 for the container group.

Which configuration settings should you apply to the container group and AppSubnet?

You manage the following Azure resource hierarchy:

* A management group named `MG-Production`
* A subscription named `Sub-App` that is a child of `MG-Production`
* Two resource groups in `Sub-App` named `RG-Web` and `RG-Data`

You assign an Azure Policy definition named `Allow-SKUs` (which uses a `Deny` effect to restrict VM SKUs to `Standard_D2s_v5` or `Standard_D4s_v5`) to `MG-Production`. You configure the assignment with an exclusion for `RG-Data`.

You also assign an Azure Policy initiative named `Audit-Compliance` (which contains a policy definition that audits resources missing the `Project` tag using the `Audit` effect) to `Sub-App`.

You attempt to deploy the following virtual machines:

* `VM1`: A `Standard_D8s_v5` VM without the `Project` tag in `RG-Web`
* `VM2`: A `Standard_D8s_v5` VM without the `Project` tag in `RG-Data`

What is the outcome of these deployment attempts?

An administrator needs to configure permissions within the following Azure resource structure:
* Management Group: Tenant-Corporate-MG
* Subscription: Operations-Prod-Sub
* Resource Group: Ops-Data-RG
* Storage Account: opsdatafiles

A cloud engineer named Sam is a member of the Microsoft Entra ID Global Administrator role. Sam requires access to upload and read blobs within the containers of the opsdatafiles storage account using Microsoft Entra ID authentication. To comply with security policies, Sam must not be allowed to modify the configuration of the storage account itself, delete the storage account, or modify permissions for other users.

Which configuration represents the most secure method to grant Sam the required access while adhering to the principle of least privilege?