Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 681Soru →

An enterprise Azure environment is configured with three virtual networks in the East US region: VNet-Hub, VNet-Prod, and VNet-Dev. VNet-Hub is peered directly with both VNet-Prod and VNet-Dev using default peering configurations. No peering exists between VNet-Prod and VNet-Dev. An administrator creates a Private DNS zone named internal.contoso.com and configures the following:

- A virtual network link from VNet-Hub to internal.contoso.com with auto-registration enabled.
- A virtual network link from VNet-Prod to internal.contoso.com with auto-registration disabled.
- No virtual network links are created for VNet-Dev.

Virtual machines VM-Hub, VM-Prod, and VM-Dev are deployed into their respective virtual networks, all configured to use the default Azure-provided DNS service. Which virtual machines will be able to resolve the name vm-hub.internal.contoso.com, and which virtual machines will have their DNS records automatically created in the private DNS zone?

Cevabı ve açıklamayı göster

Cevap: VM-Hub and VM-Prod can resolve the name; only VM-Hub has an auto-registered record.

Cevap

VM-Hub and VM-Prod can resolve the name; only VM-Hub has an auto-registered record.
To resolve records in an Azure Private DNS zone, a virtual network must be linked to that zone. Because VNet-Hub and VNet-Prod are linked, both VM-Hub and VM-Prod can resolve names in internal.contoso.com. VNet-Dev is not linked, and DNS resolution does not transit across virtual network peering connections, so VM-Dev cannot resolve the names. Auto-registration is only enabled on the link for VNet-Hub, which means only VM-Hub's hostname is registered automatically. VM-Prod's network link has auto-registration disabled, preventing its hostname from being registered.

Adım Adım Çözüm

1
Determine which virtual networks have active links to the Private DNS zone.
VNet-Hub and VNet-Prod are linked; VNet-Dev is not linked.
A virtual network link is required for VMs within a virtual network to resolve DNS queries against an Azure Private DNS zone.
2
Evaluate the transitiveness of Azure-provided DNS over peered networks.
VM-Dev cannot resolve internal.contoso.com names.
VNet peering does not provide transitive DNS resolution capability for Azure-provided DNS. Because VNet-Dev lacks a direct link to the zone, its VMs cannot query the zone.
3
Identify which links have auto-registration enabled.
VNet-Hub has auto-registration enabled; VNet-Prod has auto-registration disabled.
Auto-registration dictates whether the hostname of virtual machines in the linked network are automatically registered as A records in the private zone.
4
Combine resolution capabilities and registration status for the final state.
VM-Hub auto-registers and resolves; VM-Prod resolves but does not auto-register; VM-Dev neither registers nor resolves.
This matches the specific link configurations and registration states applied to each network link.

Anahtar Kavram

Azure Private DNS Zone Linking and Auto-Registration behavior across peered Virtual Networks
Soru 682Soru →

An administrator is configuring security rules for an Azure virtual network named `VNet1`. `VNet1` contains two subnets: `Subnet-Front` (10.10.1.0/2410.10.1.0/24) and `Subnet-Back` (10.10.2.0/2410.10.2.0/24).

The virtual machines are configured as follows:
* `VM-Web` is in `Subnet-Front` and is associated with the Application Security Group (ASG) `ASG-Web`.
* `VM-Admin` is in `Subnet-Front` and is associated with the ASG `ASG-Admin`.
* `VM-App` is in `Subnet-Back` and is associated with the ASG `ASG-App`.

The Network Security Group (NSG) associations are:
* `NSG-Front` is associated with `Subnet-Front`. It contains only default rules.
* `NSG-Back` is associated with `Subnet-Back`.
* `NSG-NIC-App` is associated with the network interface (NIC) of `VM-App`.

The custom inbound security rules for `NSG-Back` are configured as follows:
PrioritySourceDestinationPortProtocolAction
100ASG-AdminASG-App443TCPAllow
200ASG-WebASG-App443TCPDeny
The custom inbound security rules for `NSG-NIC-App` are configured as follows:
PrioritySourceDestinationPortProtocolAction
150AnyASG-App443TCPAllow
250ASG-WebASG-App443TCPDeny

You need to allow HTTPS (TCP port 443) traffic from `VM-Web` to `VM-App`, while explicitly blocking HTTPS traffic from `VM-Admin` to `VM-App`.

Which two changes should you perform? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In NSG-Back, change the action of the rule with priority 200 to Allow.; In NSG-Back, change the action of the rule with priority 100 to Deny.

Cevap

To allow VM-Web to VM-App traffic and block VM-Admin to VM-App traffic, you should change the action of the rule with priority 200 to Allow in NSG-Back, and change the action of the rule with priority 100 to Deny in NSG-Back.
To establish the required flow, VM-Web traffic must pass both NSGs. Changing the action of the rule with priority 200 in NSG-Back to Allow enables VM-Web traffic to pass the subnet-level NSG. At the NIC level (NSG-NIC-App), VM-Web traffic is allowed by the priority 150 rule (Allow for Any) because it has higher precedence than the priority 250 rule (Deny for ASG-Web). To block VM-Admin traffic, changing the action of the rule with priority 100 in NSG-Back to Deny blocks the traffic at the subnet level.

Adım Adım Çözüm

1
Analyze the current flow of VM-Web to VM-App traffic.
VM-Web traffic is blocked at the Subnet-Back inbound level by the rule in NSG-Back with priority 200 (Action: Deny).
Before reaching the VM, inbound traffic is first evaluated by the subnet-level NSG, where it matches the specific rule denying ASG-Web.
2
Determine the change needed to allow VM-Web to VM-App traffic.
Changing the action of the rule with priority 200 in NSG-Back to Allow permits VM-Web traffic to pass the subnet NSG.
At the NIC level (NSG-NIC-App), VM-Web traffic matches the rule with priority 150 (Allow for Any) because 150 has higher precedence than 250, so no changes are needed at the NIC level for VM-Web.
3
Analyze the current flow of VM-Admin to VM-App traffic and determine how to block it.
Changing the action of the rule with priority 100 in NSG-Back to Deny blocks VM-Admin traffic.
VM-Admin traffic currently passes NSG-Back (priority 100 Allow) and NSG-NIC-App (priority 150 Allow). Changing the priority 100 rule to Deny blocks the traffic at the subnet-level NSG.

Anahtar Kavram

NSG rules are processed in priority order (lower numbers first). When NSGs are applied at both the subnet and network interface (NIC) levels, inbound traffic is evaluated by the subnet NSG first, then the NIC NSG. Both must permit the traffic for it to be allowed.
Soru 683Soru →

An administrator configures two virtual network peerings: one between VNet-Core and VNet-App1, and another between VNet-Core and VNet-App2. Virtual machines are deployed in subnets across all three virtual networks. The administrator enables 'Allow forwarded traffic' on both peerings, but does not configure 'Use remote gateways' or 'Allow gateway transit'. Which of the following describes the default connectivity between VNet-App1 and VNet-App2?

Cevabı ve açıklamayı göster

Cevap: Virtual machines in VNet-App1 cannot communicate with virtual machines in VNet-App2 because virtual network peering is non-transitive.

Cevap

Virtual machines in VNet-App1 cannot communicate with virtual machines in VNet-App2 because virtual network peering is non-transitive.
Virtual network peering in Azure is non-transitive. This means that if VNet-App1 is peered with VNet-Core, and VNet-App2 is peered with VNet-Core, there is no automatic path for traffic to travel from VNet-App1 to VNet-App2 through VNet-Core. Enabling 'Allow forwarded traffic' only allows virtual machines in the peered network to receive traffic that did not originate from the peered network itself (such as from a virtual appliance), but it does not enable transitive routing between the two spokes.

Adım Adım Çözüm

1
Analyze the topology and peering configuration.
We have VNet-App1 peered to VNet-Core, and VNet-App2 peered to VNet-Core. The two spokes (VNet-App1 and VNet-App2) are not directly peered with each other.
Understanding the direct peering relationships determines which paths are configured.
2
Evaluate the transit capabilities of standard VNet peering.
VNet peering is non-transitive. Traffic originating in VNet-App1 cannot transit through VNet-Core to reach VNet-App2 by default.
This is a fundamental behavior of Azure Virtual Network peering.
3
Determine the impact of the configured peering settings ('Allow forwarded traffic', 'Use remote gateways', 'Allow gateway transit').
Enabling 'Allow forwarded traffic' permits forwarding of traffic from network virtual appliances, but does not provide transit routing. 'Use remote gateways' and 'Allow gateway transit' are gateway-related settings and do not enable spoke-to-spoke routing without a gateway present.
Verifying configuration properties ensures that no special transit bypasses are active.

Anahtar Kavram

Azure Virtual Network Peering is non-transitive by default, meaning that spoke-to-spoke communication through a hub requires a router or virtual network gateway.
Soru 684Soru →

An administrator is configuring a virtual machine named VM-Mgmt. The virtual machine has a single network interface named nic-mgmt. The primary IP configuration (ipconfig1) of nic-mgmt is configured with a dynamic private IP address. The administrator adds a secondary IP configuration named ipconfig2 to nic-mgmt. The administrator needs to associate a public IP address with ipconfig2 to allow direct management access. However, when configuring ipconfig2 in the Azure portal, the option to associate a public IP address is unavailable. What is the primary configuration change required to resolve this issue and allow the association of the public IP address?

Cevabı ve açıklamayı göster

Cevap: Change the private IP address allocation method of the secondary configuration (ipconfig2) to Static.

Cevap

Change the private IP address allocation method of the secondary configuration (ipconfig2) to Static.
The correct answer is to change the private IP address allocation method of the secondary configuration (ipconfig2) to Static. Azure enforces a rule that a public IP address can only be associated with a secondary IP configuration of a network interface if that secondary configuration uses a Static private IP address. If it is set to Dynamic, the public IP association option is disabled in the portal.

Adım Adım Çözüm

1
Navigate to the network interface nic-mgmt in the Azure portal and select IP configurations.
The list of IP configurations (ipconfig1 and ipconfig2) is displayed.
To modify the settings of the secondary IP configuration where the public IP needs to be associated.
2
Select the secondary configuration ipconfig2, change the Private IP address settings allocation from Dynamic to Static, and specify a valid private IP address within the subnet range.
The private IP allocation is updated to Static, and the option to associate a public IP address becomes active and configurable.
Azure requires that any secondary IP configuration on a network interface must have a static private IP address before a public IP address can be associated with it.
3
Associate the desired public IP address to ipconfig2 and save the configuration.
The public IP address is successfully associated with the secondary IP configuration.
To complete the requirement of enabling public access on the secondary IP configuration.

Anahtar Kavram

In Azure, associating a public IP address with a secondary IP configuration on a network interface (NIC) requires that the private IP address allocation method for that specific configuration be set to Static.
Tahmini Süre:1m 30s
Soru 685Soru →

An administrator manages an Azure App Service web app named WebApp1 that currently runs on a Basic (B1) App Service plan. The administrator needs to configure WebApp1 to scale out automatically based on CPU utilization. The configuration must prevent instance thrashing, where the system frequently and repeatedly adds and removes instances. Which of the following actions should the administrator perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Scale up the App Service plan to the Standard (S1) pricing tier.; Configure autoscale rules with a scale-out threshold of 80% CPU and a scale-in threshold of 30% CPU.

Cevap

Scale up the App Service plan to the Standard (S1) pricing tier, and configure autoscale rules with a scale-out threshold of 80% CPU and a scale-in threshold of 30% CPU.
To support autoscale, the App Service plan must be scaled up to at least the Standard (S1) tier since the Basic (B1) tier only supports manual scaling. Additionally, to prevent instance thrashing, the scale-in threshold must be set significantly lower than the scale-out threshold (e.g., 30% CPU for scale-in and 80% CPU for scale-out) so that the addition of an instance does not immediately trigger a scale-in.

Adım Adım Çözüm

1
Determine the required App Service plan tier.
Identify that the current Basic (B1) plan only supports manual scaling up to 3 instances and does not support autoscale rules. To enable autoscale, the plan must be scaled up to at least the Standard (S1) tier.
Azure App Service autoscale rules require the Standard, Premium, or Isolated pricing tier.
2
Determine the correct autoscale threshold configuration to prevent thrashing.
Select thresholds that have a wide margin between scale-out (80% CPU) and scale-in (30% CPU) metrics.
If the scale-in and scale-out thresholds are too close (such as 80% and 75%), the decrease in average CPU load after scaling out will immediately trigger a scale-in, causing continuous, inefficient scaling cycles.

Anahtar Kavram

Configuring App Service autoscale rules and pricing tier capabilities.
Soru 686Soru →

An organization has an Azure Storage account named `medicalrecords2026` containing a blob container named `scans`. An on-premises clinical analysis application needs to upload files directly to the `scans` container. The connection must be secure, restricted to the on-premises public IP address range of 198.51.100.0/24198.51.100.0/24, and valid only for 4848 hours. You need to create a Shared Access Signature (SAS) that adheres to the principle of least privilege. Which two configurations should you apply to meet the security requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Generate a Service SAS scoped to the scans container rather than an Account SAS.; Configure the allowed IP address range to 198.51.100.0/24198.51.100.0/24 and set the allowed protocol to HTTPS only.

Cevap

To secure the data transmission and apply the principle of least privilege, you must generate a Service SAS scoped to the scans container, and restrict the allowed IP range to 198.51.100.0/24 while enforcing HTTPS only.
Generating a Service SAS is the correct approach to scope permissions specifically to the scans container without exposing other services or resources in the storage account. Restricting the SAS to the public IP subnet and requiring HTTPS ensures that data is transmitted securely and only from the authorized corporate network.

Adım Adım Çözüm

1
Determine the type of Shared Access Signature (SAS) required for container-level scoping.
Select a Service SAS instead of an Account SAS.
A Service SAS can be scoped directly to the scans container, whereas an Account SAS grants access to services and resources across the entire storage account.
2
Apply the network and transport layer security constraints.
Set the Allowed IP addresses to 198.51.100.0/24 and Allowed protocols to HTTPS only.
This satisfies the requirements to secure the connection and limit access to the corporate network's public IP range.
3
Configure the token's lifetime constraint.
Define the start and end times to span exactly 48 hours.
This limits the validity period according to the application's temporary access window.

Anahtar Kavram

Configuring Shared Access Signatures (SAS) with constrained scope, secure network/protocol parameters, and minimum lifetime to enforce least privilege.
Tahmini Süre:2m 0s
Soru 687Soru →

You are managing a Network Security Group (NSG) named NSG-Production. Currently, NSG-Production contains an inbound security rule named Deny-HTTP with a priority of 250 that blocks all inbound TCP traffic on port 80. You need to allow inbound HTTP traffic specifically from a partner's IP address of 198.51.100.15, while continuing to block port 80 traffic from all other sources. Which priority should you assign to the new inbound rule that allows HTTP traffic from 198.51.100.15?

Cevabı ve açıklamayı göster

Cevap: 150

Cevap

A priority of 150
In Azure Network Security Groups, rules are processed in order of priority from the lowest number to the highest number. To allow traffic that would otherwise be blocked by a rule with priority 250, the new allow rule must have a lower priority number (higher precedence), such as 150. This ensures that the traffic from the partner's IP address matches the allow rule first and is permitted before the deny rule is evaluated.

Adım Adım Çözüm

1
Identify the priority of the existing rule that blocks traffic.
The existing rule Deny-HTTP has a priority of 250.
This establishes the baseline priority that must be bypassed.
2
Determine the required precedence relation for the new rule to override the existing rule.
The new rule must have a lower priority number than the existing rule to have higher precedence.
Azure NSG rules are evaluated in order of priority from lowest numerical value to highest.
3
Select a unique priority number less than 250.
A priority of 150 is lower than 250, while 250, 350, and 65000 are equal to or greater than 250.
A priority of 150 ensures the allow rule is evaluated first, allowing HTTP traffic from the partner IP address.

Anahtar Kavram

Azure Network Security Group (NSG) rule evaluation order is based on priority numbers, where lower numbers have higher precedence.
Tahmini Süre:45s
Soru 688Soru →

You have an Azure Private DNS zone named private.contoso.com. You need to ensure that virtual machines in a virtual network named VNet1 can resolve names in private.contoso.com, and that their DNS records are automatically registered in the zone. Which two configuration steps should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a virtual network link from the private DNS zone to VNet1.; Enable the auto-registration setting on the virtual network link.

Cevap

To resolve names and auto-register virtual machines in an Azure Private DNS zone, you must create a virtual network link to the virtual network and enable the auto-registration option on that link.
To enable name resolution and auto-registration, a virtual network link must be established between the Azure Private DNS zone and the virtual network. Enabling the auto-registration setting on this link ensures that virtual machines in the virtual network automatically register their hostnames as A records in the private DNS zone.

Adım Adım Çözüm

1
Link the private DNS zone to the virtual network.
Virtual machines in VNet1 are now able to resolve DNS names hosted in the private DNS zone.
Azure Private DNS zones require an explicit virtual network link to make the zone's records resolvable within a specific VNet.
2
Enable auto-registration on the virtual network link.
Azure automatically manages A records in the private DNS zone for VMs in VNet1.
Auto-registration is an optional setting on the virtual network link that automatically registers and updates the DNS records of VMs in that virtual network.

Anahtar Kavram

Azure Private DNS virtual network links and auto-registration
Tahmini Süre:1m 0s
Soru 689Soru →

An administrator is managing an Azure subscription with a virtual network named `VNet1`. The virtual network contains two subnets: `Subnet-Web` (10.200.1.0/2410.200.1.0/24) and `Subnet-DB` (10.200.2.0/2410.200.2.0/24).

`Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Subnet-Web`.
`Subnet-DB` is associated with an NSG named `NSG-Subnet-DB`.

Two virtual machines are deployed in `Subnet-Web`:
- `VM-Web1` (10.200.1.410.200.1.4), whose network interface is associated with an Application Security Group (ASG) named `ASG-Web`.
- `VM-Web2` (10.200.1.510.200.1.5), whose network interface has no ASG association.

One virtual machine is deployed in `Subnet-DB`:
- `VM-DB1` (10.200.2.410.200.2.4), whose network interface is associated with an ASG named `ASG-Database` and an NSG named `NSG-NIC-DB`.

The Network Security Groups have the following security rules configured:

NSG-Subnet-Web (Outbound Rules):
- Priority 100: Port TCP 1433, Source: `*`, Destination: `ASG-Database`, Action: Allow

NSG-Subnet-DB (Inbound Rules):
- Priority 110: Port TCP 1433, Source: `ASG-Web`, Destination: `*`, Action: Allow
- Priority 120: Port TCP 1433, Source: `10.200.1.0/24`, Destination: `*`, Action: Deny

NSG-NIC-DB (Inbound Rules):
- Priority 130: Port TCP 1433, Source: `10.200.1.0/24`, Destination: `*`, Action: Allow
- Priority 140: Port TCP 1433, Source: `ASG-Web`, Destination: `*`, Action: Deny

Default rules apply to all NSGs.

An application on `VM-Web1` and an application on `VM-Web2` both attempt to establish a connection to a database running on `VM-DB1` over TCP port 1433.

Which statement correctly describes the outcome of these connection attempts?

Cevabı ve açıklamayı göster

Cevap: The connection from VM-Web1 is allowed, and the connection from VM-Web2 is blocked by the subnet-level NSG (NSG-Subnet-DB).

Cevap

The connection from VM-Web1 is allowed, and the connection from VM-Web2 is blocked by the subnet-level NSG (NSG-Subnet-DB).
The connection from VM-Web1 is successfully established because it satisfies all outbound and inbound security rule checks. For outbound traffic from VM-Web1, the subnet-level NSG allows TCP 1433 to the destination ASG-Database, and default NIC-level rules allow the traffic. For inbound traffic to VM-DB1, the subnet-level NSG evaluates Rule 110 (priority 110) first, matching VM-Web1's ASG membership and allowing it. Then, the NIC-level NSG evaluates Rule 130 (priority 130) first, matching VM-Web1's IP address range and allowing the connection. The priority 140 deny rule is ignored since Rule 130 already matched. The connection from VM-Web2 is blocked because it is not in the ASG-Web group, meaning Rule 110 in the subnet-level NSG does not apply. Instead, it matches the priority 120 deny rule for the subnet CIDR block, blocking the connection at the subnet level.

Adım Adım Çözüm

1
Evaluate the outbound traffic flow from the source virtual machines in Subnet-Web.
Both VM-Web1 and VM-Web2 have their outbound TCP 1433 traffic allowed.
NSG-Subnet-Web has a rule with priority 100 allowing TCP 1433 traffic to ASG-Database (which includes VM-DB1). Since neither source VM has a NIC-level NSG, default outbound rules permit the traffic within the VNet.
2
Evaluate the inbound traffic flow for VM-Web1 at the subnet level of the destination (Subnet-DB).
The traffic from VM-Web1 is allowed by NSG-Subnet-DB.
For inbound traffic, the subnet-level NSG is evaluated first. NSG-Subnet-DB has Rule 110 (priority 110) allowing traffic from ASG-Web. Since VM-Web1's network interface is in ASG-Web, it matches this rule. Evaluation terminates here, allowing the traffic past the subnet level.
3
Evaluate the inbound traffic flow for VM-Web1 at the NIC level of the destination (VM-DB1).
The traffic from VM-Web1 is allowed by NSG-NIC-DB.
Next, the NIC-level NSG is evaluated. NSG-NIC-DB has Rule 130 (priority 130) allowing traffic from the source subnet CIDR block (10.200.1.0/24). Since VM-Web1's IP is 10.200.1.4, it matches this rule and is allowed. The priority 140 deny rule for ASG-Web is not evaluated because rule 130 has a lower priority number (higher precedence).
4
Evaluate the inbound traffic flow for VM-Web2 at the subnet level of the destination (Subnet-DB).
The traffic from VM-Web2 is blocked by NSG-Subnet-DB.
VM-Web2 is not associated with ASG-Web, so Rule 110 does not match. Rule 120 (priority 120) denies traffic from 10.200.1.0/24. Since VM-Web2's IP is 10.200.1.5, it matches Rule 120 and is blocked. Inbound evaluation terminates here, preventing the traffic from reaching the VM's network interface.

Anahtar Kavram

Azure Network Security Group rules are evaluated sequentially by priority number (lower values have higher precedence). For inbound traffic, subnet-level NSGs are evaluated first, followed by NIC-level NSGs, and both levels must permit the traffic.
Tahmini Süre:3m 0s
Soru 690Soru →

Synergy Cloud Solutions has an Azure subscription named sub-synergy-prod. You deploy an Azure Storage account named sasynergydata and an Azure Key Vault named kvsynergykeys to implement customer-managed keys (CMK) for storage encryption.

The storage account is configured to use a system-assigned managed identity. The Key Vault has soft-delete enabled, purge protection disabled, and is configured to use the Azure RBAC permission model for data plane authorization.

Which of the following configuration changes must you perform to successfully enable customer-managed keys for the storage account? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable purge protection on kvsynergykeys.; Assign the Key Vault Crypto Service Encryption User role to the storage account's system-assigned managed identity on kvsynergykeys.

Cevap

Enable purge protection on the Key Vault, and assign the Key Vault Crypto Service Encryption User role to the storage account's system-assigned managed identity on the Key Vault.
To configure customer-managed keys (CMK) for Azure Storage encryption: 1) The Key Vault must have both soft-delete and purge protection enabled to safeguard the encryption keys from accidental or malicious deletion. Since purge protection was disabled, it must be enabled. 2) Because the Key Vault is configured with the Azure RBAC permission model, the storage account's system-assigned managed identity requires data plane permissions to read and utilize the key. Assigning the Key Vault Crypto Service Encryption User role to the identity grants the necessary data plane permissions (wrap, unwrap, and get key) on the Key Vault.

Adım Adım Çözüm

1
Enable Key Vault Purge Protection
Purge protection is enabled on the Key Vault, satisfying the requirement that Azure Storage encryption keys are protected against permanent deletion.
Azure Storage requires both soft-delete and purge protection to be enabled on the Key Vault referencing the encryption key.
2
Assign RBAC Data Plane Role to Storage Managed Identity
The Key Vault Crypto Service Encryption User role is assigned to the storage account's system-assigned managed identity on the Key Vault.
Since the Key Vault uses Azure RBAC for data plane authorization, the storage identity must be granted data plane permissions (wrap, unwrap, and get key) to use the key for encryption.

Anahtar Kavram

Azure Storage customer-managed key encryption prerequisites and data plane RBAC permissions.
Soru 691Soru →

An administrator is configuring a public load balancer in Azure. The backend pool must include three virtual machines that are currently deployed across three different Availability Zones in the East US region. The administrator has already created a Basic SKU public IP address for the frontend. When configuring the load balancer, the administrator is unable to select the virtual machines for the backend pool. Which of the following configuration adjustments is required to successfully configure the load balancer to distribute traffic to these virtual machines?

Cevabı ve açıklamayı göster

Cevap: Deploy a Standard SKU load balancer and associate a new Standard SKU public IP address with it.

Cevap

Deploy a Standard SKU load balancer and associate a new Standard SKU public IP address with it.
Deploying a Standard SKU load balancer and associating a new Standard SKU public IP address with it is correct because Standard SKU load balancers are required to support backend resources distributed across multiple Availability Zones. Additionally, Standard SKU load balancers require Standard SKU public IP addresses for their frontend configurations.

Adım Adım Çözüm

1
Analyze backend virtual machine placement constraints.
The virtual machines are distributed across multiple Availability Zones, which requires a Standard SKU load balancer since Basic SKU load balancers do not support zone-redundant or cross-zone backend pools.
To identify which Load Balancer SKU supports backend instances in multiple Availability Zones.
2
Identify frontend IP configuration SKU requirements based on the load balancer SKU.
A Standard SKU load balancer requires a Standard SKU public IP address for its frontend IP configuration. Basic SKU public IP addresses are incompatible with Standard SKU load balancers.
To ensure SKU alignment between the frontend IP configuration and the load balancer resource.
3
Select the correct combination of load balancer SKU and public IP SKU.
Deploying a Standard SKU load balancer with a Standard SKU public IP address meets all architectural requirements.
To successfully configure the load balancer and resolve the backend pool association issue.

Anahtar Kavram

Azure Load Balancer SKU compatibility and Availability Zone support
Soru 692Soru →

The IT infrastructure of your company is organized under the following Azure resource structure:

- Tenant Root Group (Management Group)
- MG-Production (Management Group)
- Sub-Analytics (Subscription)
- RG-DataStore (Resource Group)
- storagedata1 (Storage Account)

You need to grant access to a user named Liam. Liam must be able to perform the following tasks:
1. Read blob data inside the containers of storagedata1.
2. Configure diagnostic settings on storagedata1 to stream resource logs to a Log Analytics workspace.

The solution must follow the principle of least privilege.

Which two roles should you assign to Liam?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Storage Blob Data Reader assigned at the storagedata1 scope; Monitoring Contributor assigned at the storagedata1 scope

Cevap

Storage Blob Data Reader assigned at the storagedata1 scope and Monitoring Contributor assigned at the storagedata1 scope
To satisfy the requirements with least privilege, two distinct roles must be assigned at the storage account level. Reading blob data requires a data-plane role, and Storage Blob Data Reader is the least privileged role for this. Configuring diagnostic settings requires writing to the diagnostic settings path, which is a control-plane action covered by the Monitoring Contributor role. Assigning both roles at the storagedata1 scope ensures the user has exactly the permissions needed without access to other resources.

Adım Adım Çözüm

1
Identify the role needed to read blob data.
Storage Blob Data Reader is the least privileged built-in role that allows reading blob data using Microsoft Entra ID authorization.
Control-plane roles like Contributor or Storage Account Contributor do not automatically grant data-plane access to blobs.
2
Identify the role needed to write diagnostic settings.
Monitoring Contributor is the least privileged built-in role that grants the 'Microsoft.Insights/DiagnosticSettings/Write' permission.
Reader permissions are insufficient to create diagnostic settings, while full Contributor or Owner roles would grant excessive administrative rights.
3
Determine the appropriate scope for role assignments.
Assign both roles at the specific storage account (storagedata1) scope.
Assigning roles at the storage account level instead of the resource group or subscription level aligns with the principle of least privilege.

Anahtar Kavram

Azure RBAC separates control-plane management (such as configuring monitoring) from data-plane access (such as reading blobs). A combination of specific built-in roles assigned at the narrowest possible scope is required to meet the requirements under least privilege.
Tahmini Süre:2m 0s
Soru 693Soru →

An organization has an Azure virtual network named `VNet-Prod` containing two subnets: `Subnet-Web` (10.50.1.0/2410.50.1.0/24) and `Subnet-DB` (10.50.2.0/2410.50.2.0/24). A virtual machine named `VM-Web` is deployed in `Subnet-Web` and is associated with an Application Security Group (ASG) named `ASG-Web`. A virtual machine named `VM-DB` is deployed in `Subnet-DB` and is associated with an ASG named `ASG-DB`.

The network security groups (NSGs) are configured as follows:
- `NSG-Web` is associated with `Subnet-Web`.
- `NSG-DB` is associated with `Subnet-DB`.

`NSG-DB` contains the following inbound security rules:
- Rule1: Priority 120120, Source: `VirtualNetwork`, Port: `Any`, Destination: `Any`, Protocol: `Any`, Action: `Deny`
- Rule2: Priority 210210, Source: `ASG-Web`, Port: `1433`, Destination: `ASG-DB`, Protocol: `TCP`, Action: `Allow`

When testing, TCP port 14331433 traffic from `VM-Web` to `VM-DB` is blocked. Which change should you make to `NSG-DB` to allow TCP port 14331433 traffic from `VM-Web` to `VM-DB`?

Cevabı ve açıklamayı göster

Cevap: Change the priority of Rule2 to 100.

Cevap

Change the priority of Rule2 to 100.
The correct action is to change the priority of Rule2 to a number lower than 120 (such as 100). In Azure, Network Security Group (NSG) rules are processed in order of priority, where lower numbers have higher precedence. Currently, Rule1 has a priority of 120 and Rule2 has a priority of 210. Because Rule1 has a lower priority number, it is evaluated first. Since VM-Web is part of the virtual network, its traffic falls under the 'VirtualNetwork' source tag, matching Rule1's criteria, and is therefore denied. Lowering the priority number of Rule2 to 100 ensures that the allow rule is evaluated first, allowing the SQL traffic to pass through to the database virtual machine.

Adım Adım Çözüm

1
Analyze the current NSG rule execution order for inbound traffic on NSG-DB.
Rule1 (priority 120) is processed before Rule2 (priority 210) because lower priority numbers have higher precedence in Azure NSGs.
We need to determine why the SQL traffic is currently blocked despite the presence of Rule2.
2
Identify the rule that matches the incoming TCP port 1433 traffic from VM-Web.
The traffic matches Rule1 first (Source: VirtualNetwork, Destination: Any, Action: Deny), causing it to be blocked.
Since both subnets are part of the same virtual network, VM-Web's IP address is within the VirtualNetwork service tag range.
3
Determine the configuration change required to process the Allow rule (Rule2) before the Deny rule (Rule1).
Assign Rule2 a priority value lower than 120, such as 100.
This ensures that the specific Allow rule for TCP port 1433 is matched and applied before the generic Deny rule is evaluated.

Anahtar Kavram

Azure NSG rules are processed in priority order from lowest number to highest number. Once a match is found, no further rules are processed.
Soru 694Soru →

An administrator is establishing a hybrid network connection in Azure. The infrastructure consists of two virtual networks in the North Europe region:

* `VNet-Hub` (192.168.50.0/24192.168.50.0/24) has a virtual network gateway named `GW-Hub` and virtual machines running in `Subnet-Hub`.
* `VNet-Spoke` (10.120.0.0/1610.120.0.0/16) has virtual machines running in `Subnet-Spoke` but does not contain a virtual network gateway.

The administrator configures virtual network peering between `VNet-Hub` and `VNet-Spoke`.

To enable the virtual machines in `VNet-Spoke` to access the on-premises resources by routing through `GW-Hub`, which two Peering configurations must be set? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke.; Configure 'Use remote gateways' on the peering link from VNet-Spoke to VNet-Hub.

Cevap

To allow virtual machines in VNet-Spoke to route through the virtual network gateway in VNet-Hub, you must configure 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke, and configure 'Use remote gateways' on the peering link from VNet-Spoke to VNet-Hub.
The correct configurations allow VNet-Spoke to leverage the gateway in VNet-Hub. To establish gateway transit, the peering link from VNet-Hub to VNet-Spoke must have 'Allow gateway transit' enabled, which permits VNet-Hub to share its gateway. Simultaneously, the peering link from VNet-Spoke to VNet-Hub must have 'Use remote gateways' enabled, allowing VNet-Spoke to route its traffic through the remote gateway.

Adım Adım Çözüm

1
Identify the hosting location of the Virtual Network Gateway.
The Virtual Network Gateway GW-Hub is located in VNet-Hub.
Determining where the gateway resides specifies which VNet acts as the transit provider and which acts as the consumer.
2
Configure the hub-side peering link (from VNet-Hub to VNet-Spoke).
Enable 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke.
This allows VNet-Hub to act as a transit hub and share its gateway with VNet-Spoke.
3
Configure the spoke-side peering link (from VNet-Spoke to VNet-Hub).
Enable 'Use remote gateways' on the peering link from VNet-Spoke to VNet-Hub.
This configures the virtual machines in VNet-Spoke to route on-premises-bound traffic to GW-Hub.

Anahtar Kavram

Gateway transit in virtual network peering allows peered virtual networks to share a gateway and obtain connectivity to on-premises resources.
Soru 695Soru →

An administrator is configuring a new virtual network named `vnet-retail` with an address space of 192.168.1.0/24192.168.1.0/24. The administrator needs to configure two subnets within this virtual network:

1. A workload subnet that must support exactly 2727 virtual machines, each requiring a dynamic private IP address. The subnet must be configured with the minimum possible address space to satisfy this requirement.
2. A subnet named `AzureBastionSubnet` to deploy Azure Bastion.

What is the maximum number of usable IP addresses that can be allocated to `AzureBastionSubnet`?

Cevabı ve açıklamayı göster

Cevap: 123

Cevap

123 usable IP addresses
To support exactly 27 virtual machines, the workload subnet requires 32 total IP addresses because Azure reserves 5 IP addresses in every subnet (the first four and the last one). A /27 prefix provides exactly 32 IP addresses, which is the minimum size that satisfies this requirement. The virtual network has a /24 address space (256 IP addresses). Subtracting the 32 addresses used by the workload subnet leaves 224 IP addresses. Azure Bastion requires a subnet named AzureBastionSubnet with a prefix of at least /26. To maximize the usable addresses, we can allocate a /25 subnet (128 IP addresses) from the remaining space, as a /24 subnet would require 256 addresses and cause an overlap. Subtracting the 5 Azure-reserved IP addresses from the 128 addresses in a /25 subnet yields 123 usable IP addresses.

Adım Adım Çözüm

1
Calculate the minimum prefix size for the workload subnet
A /27 subnet containing 32 IP addresses
The workload subnet requires 27 usable IP addresses. Since Azure reserves 5 IP addresses in every subnet, the subnet must have a total capacity of at least 32 IP addresses (27+5=3227 + 5 = 32). The minimum CIDR block that fits this is a /27.
2
Determine the maximum prefix size for the Azure Bastion subnet
A /25 subnet containing 128 IP addresses
The virtual network has a /24 prefix (256 addresses). After allocating 32 addresses for the workload subnet, 224 addresses remain. Azure Bastion requires a /26 prefix or larger. The largest power-of-two subnet that fits within the remaining 224 addresses without overlapping the workload subnet is a /25 (128 addresses).
3
Calculate the usable IP addresses in the /25 Azure Bastion subnet
123 usable IP addresses
Subtract the 5 Azure-reserved IP addresses from the total of 128 IP addresses provided by the /25 subnet (128−5=123128 - 5 = 123).

Anahtar Kavram

Azure Virtual Network subnet sizing constraints and reserved IP addresses
Soru 696Soru →

A logistics company runs a batch delivery processing application on an Azure Virtual Machine Scale Set named `vmss-logistics` that is configured with a manual upgrade policy. You need to configure the scale set to execute a setup script stored in a secured Azure Storage blob container. The script must be downloaded and executed securely using a system-assigned managed identity. Which sequence of actions should you perform to configure the scale set and apply the script to the instances?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

First, enable the system-assigned managed identity on the scale set. Second, assign the Storage Blob Data Reader role to the scale set's identity. Third, add the Custom Script Extension to the scale set configuration. Finally, manually upgrade the existing instances to apply the updated model.
The correct sequence establishes the identity first, grants the required access permissions, adds the extension configuration to the scale set model, and then forces an upgrade on the existing instances to pull the model update.

Adım Adım Çözüm

1
Enable the system-assigned managed identity on the scale set.
A service principal is created in Microsoft Entra ID for the scale set.
You must establish the identity principal before assigning Azure role-based access control (RBAC) permissions to it.
2
Assign the Storage Blob Data Reader role to the scale set's managed identity.
The identity principal is granted read access to the storage account blob data.
Without this role, the scale set instances will not have permission to download the script from the secured storage account.
3
Add the Custom Script Extension to the scale set model.
The scale set's configuration model is updated with instructions to run the script.
The extension configuration must be saved in the model and configured to use the managed identity client ID for authentication.
4
Manually upgrade the scale set instances.
The existing virtual machines are updated to the latest scale set model and execute the script.
Because the upgrade policy is set to manual, the instances will continue to run the old configuration until they are explicitly upgraded.

Anahtar Kavram

Configuring Virtual Machine Scale Set extensions and managed identities under a manual upgrade policy.
Soru 697Soru →

An administrator is deploying a new Azure Kubernetes Service (AKS) cluster named `aks-prod` to host a microservices application. The corporate network security team requires that all pods must be able to communicate directly with on-premises databases over an existing ExpressRoute connection without using Network Address Translation (NAT). The virtual network `VNet1` has the address space 10.200.0.0/1610.200.0.0/16 and contains a subnet named `Subnet-AKS` (10.200.1.0/2410.200.1.0/24). The cluster is expected to scale up to 1515 nodes, and each node must support a maximum of 3030 pods. Which of the following configuration settings must be selected during the deployment of `aks-prod` to satisfy the requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the cluster to use the Azure CNI network plugin.; Deploy the cluster to a new subnet configured with an address prefix of 10.200.2.0/2310.200.2.0/23 or larger.

Cevap

Configure the cluster to use the Azure CNI network plugin and deploy the cluster to a new subnet configured with an address prefix of 10.200.2.0/2310.200.2.0/23 or larger.
To satisfy the requirement of direct communication without NAT, the Azure CNI network plugin must be configured because it assigns IP addresses directly from the virtual network to the pods. To prevent IP exhaustion in the subnet, the cluster must be deployed to a subnet with an address prefix of 10.200.2.0/2310.200.2.0/23 or larger, which accommodates the 470470 IP addresses required (15 nodes+450 pods+5 reserved IPs15 \text{ nodes} + 450 \text{ pods} + 5 \text{ reserved IPs}).

Adım Adım Çözüm

1
Determine the required network plugin model.
Azure CNI must be used.
The corporate policy requires direct, NAT-less communication from the pods to the on-premises database. Kubenet routes pod traffic outside the VNet using SNAT on the node's IP address. Azure CNI integrates pods directly into the virtual network, assigning them routable IPs.
2
Calculate the total number of IP addresses required for the cluster under Azure CNI.
At least 470470 IP addresses are required.
Using Azure CNI, the IP requirement formula is: Nodes + (Nodes * Max Pods per Node) + 55 Azure-reserved IPs. Calculating for 1515 nodes and 3030 pods per node: 15+(15×30)+5=15+450+5=47015 + (15 \times 30) + 5 = 15 + 450 + 5 = 470 IP addresses.
3
Select the correct subnet sizing to accommodate the IP addresses.
A new subnet of size /23/23 or larger is required.
The existing `Subnet-AKS` is a /24/24 subnet, which yields 232−24−5=2512^{32-24} - 5 = 251 usable IP addresses, leading to IP exhaustion. A /23/23 subnet provides 232−23−5=5072^{32-23} - 5 = 507 usable IP addresses, which satisfies the 470470 IP address requirement.

Anahtar Kavram

Azure Kubernetes Service (AKS) network plugin selection and IP address planning.
Tahmini Süre:2m 0s
Soru 698Soru →

You have an Azure subscription that contains a virtual machine named VM-App1 in the East US region. VM-App1 has a single network interface named nic-app1, whose primary IP configuration is assigned to a subnet named Subnet1. VM-App1 is configured as a backend pool member of an East US Standard Load Balancer named LB1.

You need to configure nic-app1 to support a secondary web application. The configuration must allow the secondary application to be accessed from the internet using a dedicated public IP address.

Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a secondary IP configuration on nic-app1 within Subnet1.; Associate a Standard SKU public IP address in the East US region with the secondary IP configuration.

Cevap

Create a secondary IP configuration on the network interface within the same subnet (Subnet1) and associate a Standard SKU public IP address in the same region with that secondary configuration.
To host a second website with its own public IP, you must configure a secondary IP configuration on the existing network interface. All IP configurations on a single network interface must be in the same subnet, meaning the secondary IP configuration must be assigned to Subnet1. Furthermore, because the virtual machine is in the backend pool of a Standard Load Balancer, any public IP address assigned to its network interface must use the Standard SKU to avoid a SKU mismatch.

Adım Adım Çözüm

1
Determine the subnet requirement for the secondary IP configuration on the network interface.
Since all IP configurations on a single network interface (NIC) must belong to the same subnet, the secondary configuration must be created in Subnet1.
Azure enforces that multiple IP configurations on a single NIC cannot cross subnet boundaries.
2
Determine the SKU requirement for the public IP address based on the backend pool association.
The virtual machine is associated with a Standard Load Balancer backend pool, which dictates that any public IP address directly assigned to the network interface must be of the Standard SKU.
Standard Load Balancers do not support backend resources that have Basic SKU public IP addresses associated with their network interfaces.

Anahtar Kavram

Configuring multiple IP configurations on a network interface and ensuring Public IP SKU alignment with a Standard Load Balancer.
Soru 699Soru →

You have an Azure virtual network named `VNet1` that contains two subnets: `Subnet-A` (10.0.1.0/2410.0.1.0/24) and `Subnet-B` (10.0.2.0/2410.0.2.0/24).

You deploy three virtual machines with network interfaces (NICs):
* `VM1` is in `Subnet-A` with IP address 10.0.1.410.0.1.4
* `VM2` is in `Subnet-B` with IP address 10.0.2.410.0.2.4
* `VM3` is in `Subnet-B` with IP address 10.0.2.510.0.2.5

You configure two Application Security Groups (ASGs):
* `ASG-App`: Contains the NIC of `VM1` and the NIC of `VM2`
* `ASG-Data`: Contains the NIC of `VM3`

You associate Network Security Groups (NSGs) as follows:
* `NSG-SubnetB` is associated with `Subnet-B`
* `NSG-NIC-VM3` is associated with the NIC of `VM3`

`NSG-SubnetB` contains the following inbound security rules:
* Priority: 120120, Source: `ASG-App`, Destination: `ASG-Data`, Destination Port: 14331433, Protocol: TCP, Action: Allow
* Priority: 180180, Source: 10.0.1.0/2410.0.1.0/24, Destination: Any, Destination Port: Any, Protocol: Any, Action: Deny

`NSG-NIC-VM3` contains the following inbound security rules:
* Priority: 110110, Source: 10.0.1.410.0.1.4, Destination: Any, Destination Port: 14331433, Protocol: TCP, Action: Deny
* Priority: 200200, Source: VirtualNetwork, Destination: Any, Destination Port: 14331433, Protocol: TCP, Action: Allow

All other NSGs use default configurations.

What is the outcome when `VM1` and `VM2` attempt to establish a TCP connection to `VM3` on port 14331433?

Cevabı ve açıklamayı göster

Cevap: The connection from VM1 is denied, and the connection from VM2 is allowed.

Cevap

The connection from VM1 is denied, and the connection from VM2 is allowed.
For the connection from VM1 to VM3: Inbound traffic is first evaluated by the subnet NSG (NSG-SubnetB). Rule 120 (Allow) has higher precedence than Rule 180 (Deny), so the subnet NSG allows the traffic. Next, the NIC NSG (NSG-NIC-VM3) is evaluated. Rule 110 (Deny) has higher precedence than Rule 200 (Allow), so the NIC NSG blocks the traffic. Since the traffic must pass both NSGs, the connection from VM1 is denied. For the connection from VM2 to VM3: The subnet NSG allows the traffic via Rule 120 (VM2 is in ASG-App and VM3 is in ASG-Data), and Rule 180 does not apply as VM2 is not in Subnet-A. The NIC NSG allows the traffic via Rule 200 (Allow VirtualNetwork), as the specific Deny rule (Rule 110) only applies to VM1. Therefore, the connection from VM2 is allowed.

Adım Adım Çözüm

1
Evaluate the inbound traffic from VM1 (10.0.1.4) to VM3 (10.0.2.5) on port 1433 through the subnet-level NSG (NSG-SubnetB).
The traffic matches the ASG-App to ASG-Data rule (priority 120, Allow) and the Subnet-A IP rule (priority 180, Deny). Since 120 is lower than 180, priority 120 takes precedence and the subnet NSG allows the traffic.
Lower priority numbers in Azure NSG rules represent higher precedence.
2
Evaluate the inbound traffic from VM1 to VM3 through the NIC-level NSG (NSG-NIC-VM3).
The traffic matches the host-specific rule (priority 110, Deny) and the VirtualNetwork rule (priority 200, Allow). Since 110 is lower than 200, priority 110 takes precedence and the NIC-level NSG denies the traffic. Therefore, the connection from VM1 is blocked.
For inbound traffic to be allowed, both the subnet-level NSG and the NIC-level NSG must permit the traffic.
3
Evaluate the inbound traffic from VM2 (10.0.2.4) to VM3 (10.0.2.5) on port 1433 through the subnet-level NSG (NSG-SubnetB).
The traffic matches the ASG-App to ASG-Data rule (priority 120, Allow). It does not match the Subnet-A IP rule (priority 180) because VM2 is in Subnet-B. Thus, the subnet NSG allows the traffic.
ASGs can span multiple subnets within the same virtual network, allowing VM2 to be evaluated under the ASG-App source group.
4
Evaluate the inbound traffic from VM2 to VM3 through the NIC-level NSG (NSG-NIC-VM3).
The traffic matches the VirtualNetwork rule (priority 200, Allow). It does not match the Deny rule (priority 110) because that rule is scoped specifically to VM1's IP address (10.0.1.4). Thus, the NIC NSG allows the traffic. Therefore, the connection from VM2 is allowed.
No other custom rule blocks VM2 at the NIC level, and the priority 200 rule allows VirtualNetwork traffic.

Anahtar Kavram

Azure NSG rule evaluation flow and ASG cross-subnet routing
Soru 700Soru →

An administrator is configuring a custom domain named `www.contoso.com` for an Azure App Service web app named `app-contoso`. The web app currently runs on a Standard (S1) App Service plan.

The administrator needs to verify domain ownership to bind the custom domain to the web app, but must ensure that no live user traffic is routed to the web app during the initial configuration phase.

Which DNS record should the administrator create in the `contoso.com` DNS zone to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: A TXT record named `asuid.www` containing the Custom Domain Verification ID of the web app.

Cevap

A TXT record named `asuid.www` containing the Custom Domain Verification ID of the web app.
The correct answer is the TXT record named `asuid.www` containing the Custom Domain Verification ID of the web app. This record is checked by Azure to confirm ownership of the subdomain without altering HTTP/HTTPS routing. This allows the administrator to successfully verify and bind the domain to the App Service in a staging manner before actually routing client traffic.

Adım Adım Çözüm

1
Retrieve the Custom Domain Verification ID from the Custom Domains settings blade of the App Service in the Azure Portal.
Obtained the unique verification string required for domain validation.
This verification ID proves domain ownership to Azure before the domain is bound.
2
Create a TXT record in the DNS zone for `contoso.com` with the hostname `asuid.www` and the verification ID as the value.
The TXT record is published in public DNS.
Creating a TXT record does not route any live HTTP traffic, fulfilling the requirement of preventing traffic routing during configuration.
3
Validate the domain inside the Azure App Service portal and complete the custom domain configuration.
The custom domain is successfully added to the App Service without routing traffic until the CNAME or A record is created later.
The Standard (S1) App Service plan supports custom domains, allowing the configuration to be saved.

Anahtar Kavram

Azure App Service Custom Domain Verification using TXT records to prevent premature traffic routing.
Tahmini Süre:1m 30s
ÖncekiSayfa 35 / 63Sonraki
Tüm alıştırma soruları — Microsoft Azure Administrator (AZ-104) | Examkin