Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 61Soru →

An administrator needs to transfer 20 TB20\text{ TB} of data from an on-premises datacenter to Azure storage. The administrator wants to use physical shipping but does not want to purchase or prepare local hard drives, requiring Microsoft to provide the encrypted SSDs for the transfer. Which service should the administrator configure?

Cevabı ve açıklamayı göster

Cevap: Azure Data Box Disk

Cevap

Azure Data Box Disk
The option selecting Azure Data Box Disk is correct because this service provides Microsoft-owned, pre-encrypted solid-state drives (SSDs) to the customer. This meets the requirement of physical shipping without needing the customer to buy or prepare their own hardware.

Adım Adım Çözüm

1
Analyze the size of the dataset (20 TB20\text{ TB}) and physical shipping requirement.
The dataset size fits within the capacity limit of Azure Data Box Disk (up to 35 TB35\text{ TB} usable).
Understanding the scale helps filter out options like Data Box Heavy or standard online transfer if network bandwidth is constrained.
2
Evaluate the hardware ownership constraint.
The requirement states the administrator does not want to purchase or prepare local drives and needs Microsoft-supplied SSDs.
This rules out Azure Import/Export, which requires customer-owned drives prepared via the WAImportExport tool.
3
Select the Azure service that matches both capacity and hardware provision requirements.
Azure Data Box Disk is the only option that fulfills these constraints.
It offers Microsoft-owned, BitLocker-encrypted SSDs for convenient offline data transfer.

Anahtar Kavram

Distinguishing offline migration options based on hardware provisioning and data volume constraints.
Soru 62Soru →

An administrator is configuring a dynamic user group in a Microsoft Entra ID tenant. The group must automatically include all internal employees assigned to the Sales department. The group must exclude guest users and must not include any device objects. Which dynamic membership rule should the administrator use?

Cevabı ve açıklamayı göster

Cevap: (user.department -eq 'Sales') -and (user.userType -eq 'Member')

Cevap

The dynamic membership rule containing '(user.department -eq 'Sales') -and (user.userType -eq 'Member')'
The rule using the format '(user.department -eq 'Sales') -and (user.userType -eq 'Member')' is correct because it uses valid Entra ID user attributes ('user.department' and 'user.userType'), correctly distinguishes internal employees ('Member') from guest users ('Guest'), and follows the required OData query syntax with hyphenated operators ('-eq' and '-and').

Adım Adım Çözüm

1
Identify the target object type and the attributes required for the rule filter.
The group targets user objects. The required filters are the department (Sales) and the account type (internal employee, excluding guests).
Dynamic groups in Microsoft Entra ID must target either users or devices, and the filter conditions must map to valid object attributes.
2
Select the correct Entra ID user attributes for the filters.
The department is represented by 'user.department'. The internal vs. guest distinction is represented by 'user.userType', where 'Member' denotes internal employees and 'Guest' denotes external guests.
Using incorrect or non-existent attributes like 'userRole' will result in validation errors when saving the rule.
3
Apply the correct OData query syntax and structure.
Combine the attributes using the '-eq' and '-and' operators: '(user.department -eq 'Sales') -and (user.userType -eq 'Member')'.
Microsoft Entra ID dynamic group membership rules require OData v3.0 query syntax; using SQL-style operators or mixing user and device attributes is invalid.

Anahtar Kavram

Microsoft Entra ID dynamic group membership rules require valid OData properties and syntax, and cannot mix user and device objects.
Soru 63Soru →

A healthcare company, HealthPulse Diagnostics, uses the following Azure Management Group (MG) hierarchy to organize its subscriptions:

- Tenant Root Group
- HealthPulse-MG (Management Group)
- Clinical-MG (Management Group)
- SubscriptionA
- ResourceGroup1
- Research-MG (Management Group)
- SubscriptionB

The following settings are configured:

1. At HealthPulse-MG, an Azure Policy is assigned that denies the deployment of virtual machines unless they use the 'Standard_D2s_v3' SKU.
2. At Clinical-MG, an Azure Policy is assigned that denies the deployment of virtual machines unless they use the 'Standard_D4s_v3' SKU.
3. At SubscriptionA, User1 is assigned the Contributor role.

User1 attempts to deploy a new virtual machine using the 'Standard_D4s_v3' SKU into ResourceGroup1.

What is the outcome of the deployment attempt?

Cevabı ve açıklamayı göster

Cevap: The deployment fails because the Azure Policy assigned at HealthPulse-MG is inherited and must be satisfied, even though the VM complies with the policy at Clinical-MG.

Cevap

The deployment fails because the Azure Policy assigned at HealthPulse-MG is inherited and must be satisfied, even though the VM complies with the policy at Clinical-MG.
The correct answer is that the deployment fails because Azure Policy assignments are cumulative and inherited down the Management Group hierarchy. A resource must comply with all applied policies. Since the VM SKU is 'Standard_D4s_v3', it violates the policy at HealthPulse-MG which restricts SKUs to 'Standard_D2s_v3'.

Adım Adım Çözüm

1
Trace the inheritance of Azure Policies down the Management Group hierarchy.
ResourceGroup1 inherits the 'Standard_D2s_v3' SKU restriction policy from HealthPulse-MG and the 'Standard_D4s_v3' SKU restriction policy from Clinical-MG.
Azure Policy assignments at parent scopes are inherited by all child resources.
2
Determine the compliance requirements for the virtual machine.
The VM must satisfy all applied policies. Therefore, the VM must simultaneously meet both SKU restrictions, which is impossible.
Azure Policy evaluation is cumulative (logical AND).
3
Evaluate the User1 permissions against the deployment constraints.
Although User1 has the Contributor role on SubscriptionA, this role does not override policy compliance checks. The deployment is blocked.
RBAC defines who can perform actions, whereas Azure Policy defines resource properties. Both must be satisfied for a successful deployment.

Anahtar Kavram

Azure Policy inheritance and cumulative evaluation across Management Group hierarchies
Soru 64Soru →

For a new production deployment, an administrator configures the following Azure resource hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-AppStore`
- Resource Group: `RG-Services`
- App Service: `api-service-01`

A developer named DevUser1 is assigned the Reader role at the `Sub-AppStore` subscription level. DevUser1 is also assigned the Contributor role at the `RG-Services` resource group level.

Which of the following describes the effective permission of DevUser1 for `api-service-01`?

Cevabı ve açıklamayı göster

Cevap: Contributor permissions, because Azure RBAC roles are additive and the Contributor assignment at the resource group level applies.

Cevap

Contributor permissions, because Azure RBAC roles are additive and the Contributor assignment at the resource group level applies.
The correct answer states that DevUser1 has Contributor permissions because Azure RBAC is additive. When a user is assigned multiple roles at different scopes, the effective permission is the sum of those permissions, so the Contributor role at the resource group scope grants full write access to the App Service, overriding the inherited read-only access from the subscription level.

Adım Adım Çözüm

1
Determine the user's role assignment at the highest level of the scope hierarchy.
DevUser1 is assigned the Reader role at the subscription level, which inherits down to the resource group and the App Service.
This establishes the baseline inherited permissions.
2
Determine the user's role assignment at the lower levels of the scope hierarchy.
DevUser1 is assigned the Contributor role at the resource group level, which applies to the resource group and the App Service.
This identifies any additional permissions granted closer to the resource.
3
Combine the permissions using the additive rule of Azure RBAC.
Reader (inherited) + Contributor (explicit) = Contributor permissions on the App Service.
Azure RBAC evaluates the union of all role assignments applicable to the resource.

Anahtar Kavram

Azure RBAC role assignments are additive, meaning a user's effective permissions at a given scope are the union of all roles assigned at that scope and any inherited parent scopes.
Tahmini Süre:1m 0s
Soru 65Soru →

Your company has a Microsoft Entra ID tenant. The tenant contains an Administrative Unit named Sales-AU and a dynamic security group named Sales-Dynamic-Group. Sales-Dynamic-Group is a member of Sales-AU.

You assign a user named Admin1 the Groups Administrator role scoped to Sales-AU.

Admin1 attempts to perform the following tasks:
1. Modify the membership of an assigned security group named Sales-Manual-Group that is a member of Sales-AU.
2. Modify the dynamic membership rule of Sales-Dynamic-Group.

Which tasks can Admin1 successfully perform?

Cevabı ve açıklamayı göster

Cevap: Only task 1

Cevap

Only task 1
The correct answer is the option stating that only task 1 can be performed. An administrator with the Groups Administrator role scoped to an Administrative Unit (AU) can manage the membership of standard assigned groups that are members of that AU. However, they cannot modify dynamic group rules. Modifying dynamic group rules requires directory-level (tenant-wide) Groups Administrator or Global Administrator privileges because dynamic rules are evaluated tenant-wide, and permitting an AU-scoped administrator to modify them would allow them to bypass the administrative boundary.

Adım Adım Çözüm

1
Analyze the administrative role and scope assigned to the user.
Admin1 is assigned the Groups Administrator role scoped to the Sales-AU Administrative Unit.
This defines the security boundary and permissions of Admin1.
2
Evaluate the permissions required to modify the membership of the assigned security group.
Sales-Manual-Group is an assigned security group in Sales-AU. An Administrative Unit-scoped Groups Administrator is authorized to manage memberships of assigned groups within their unit.
Managing assigned groups within the scoped Administrative Unit is a core capability of the scoped Groups Administrator role.
3
Evaluate the permissions required to modify the dynamic group membership rules.
Sales-Dynamic-Group is a dynamic group. Modifying dynamic rules can potentially add any user in the entire tenant to the group if the rule query is adjusted. To prevent privilege escalation, dynamic group rule modifications are restricted to directory-level administrators.
Administrative Unit scoped roles do not permit editing dynamic group membership rules, even if the dynamic group is a member of the Administrative Unit.

Anahtar Kavram

Administrative Unit scope limits for group management and dynamic group rule modification constraints in Microsoft Entra ID
Soru 66Soru →

An administrator manages an Azure storage account named `storage1` that is configured to use Geo-Redundant Storage (GRS). Due to a severe regional outage in the primary region, the administrator decides to initiate a customer-managed failover for `storage1`. Which replication configuration will `storage1` have immediately after the failover completes?

Cevabı ve açıklamayı göster

Cevap: Locally Redundant Storage (LRS) in the secondary region

Cevap

Locally Redundant Storage (LRS) in the secondary region.
When you initiate a failover for a Geo-Redundant Storage (GRS) account, the secondary region becomes the new primary region. During this process, the storage account is automatically converted to Locally Redundant Storage (LRS) in the new primary region. If you want to restore geo-redundancy, you must manually reconfigure the replication settings to GRS or RA-GRS after the failover completes.

Adım Adım Çözüm

1
Analyze the starting replication configuration and the triggered event.
The storage account is configured as Geo-Redundant Storage (GRS) and a customer-managed failover is initiated due to a regional outage.
Determining the initial configuration is essential to predict the post-failover state of the storage account.
2
Determine the automatic replication state transition that occurs during failover.
During the failover process, the secondary region becomes the new primary region, and the replication type is downgraded to Locally Redundant Storage (LRS).
Azure automatically converts GRS and RA-GRS storage accounts to LRS in the target region to complete the failover.
3
Verify if manual intervention is required to restore high availability.
To restore geo-redundant replication, the administrator must manually reconfigure the storage account back to GRS or RA-GRS once the original region is available.
This confirms that the immediate post-failover state is non-redundant (LRS).

Anahtar Kavram

When a customer-managed failover is initiated for an Azure storage account configured with Geo-Redundant Storage (GRS), the secondary region becomes the new primary region, and the storage account's replication configuration is automatically converted to Locally Redundant Storage (LRS).
Soru 67Soru →

A company implements a governance strategy for its Azure resources. The environment includes a user account named Admin-User who is assigned the Global Administrator directory role in Microsoft Entra ID. No Azure Role-Based Access Control (RBAC) assignments have been made for Admin-User at any resource scope.

The resource hierarchy is structured as follows:
- Management Group: MG-Shared
- Subscription: Sub-Development
- Resource Group: RG-Web

Admin-User needs to assign the Virtual Machine Contributor role to a developer at the RG-Web scope.

Which configuration must be completed to enable Admin-User to assign this role?

Cevabı ve açıklamayı göster

Cevap: Elevate access in the Microsoft Entra properties to assign the User Access Administrator role at the root management group scope.

Cevap

Elevate access in the Microsoft Entra properties to assign the User Access Administrator role at the root management group scope.
The correct option is correct because Microsoft Entra ID directory roles and Azure RBAC roles are separated. A Global Administrator has no default permissions on Azure subscriptions. To manage them, the administrator must elevate their access in Microsoft Entra properties, which temporarily assigns the User Access Administrator role at the root management group scope ('/'). This inherited role provides the authorization needed to make role assignments at any sub-scope, including the resource group level.

Adım Adım Çözüm

1
Differentiate between Microsoft Entra ID directory roles and Azure RBAC roles.
Confirm that the Global Administrator directory role does not automatically grant access to subscriptions or resources within the Azure tenant.
Microsoft Entra ID and Azure Resource Manager run on separate identity and access control planes to ensure separation of duties.
2
Determine the mechanism to allow a Global Administrator to manage Azure subscription resources.
Identify that the administrator must toggle the 'Access management for Azure resources' option in the Microsoft Entra properties page.
This toggle explicitly authorizes the directory administrator to gain management access to the Azure resources.
3
Analyze the resulting role assignment and its inheritance scope.
The elevation assigns the User Access Administrator role at the root management group scope ('/'). This permission inherits down to all subscriptions, resource groups (including RG-Web), and resources in the tenant.
Once assigned at the root scope, the User Access Administrator role provides the necessary permissions to assign Azure RBAC roles (like Virtual Machine Contributor) at any level of the hierarchy.

Anahtar Kavram

Separation of planes between Microsoft Entra ID roles and Azure RBAC roles, and the process of elevating access to assign Azure RBAC roles.
Soru 68Soru →

A company has an Azure subscription containing a standard General Purpose v2 (GPv2) storage account named `storeprodwest2` in the West US 2 region. The storage account is configured with locally redundant storage (LRS) and contains a single blob container with 15 TB15\text{ TB} of data. A lifecycle management rule is currently active that transitions blobs older than 180180 days to the Archive tier, resulting in 4 TB4\text{ TB} of archived blobs. The company wants to migrate the storage account to zone-redundant storage (ZRS) with zero data loss and no downtime. You plan to request a live migration from Microsoft support. Which of the following actions must you perform before Microsoft can initiate the live migration?

Cevabı ve açıklamayı göster

Cevap: Disable or modify the lifecycle management policy, rehydrate all archived blobs to the Hot or Cool tier, and then submit the support request for live migration.

Cevap

Disable or modify the lifecycle management policy, rehydrate all archived blobs to the Hot or Cool tier, and then submit the support request for live migration.
Live migration from LRS to ZRS is blocked if the storage account contains any blobs in the Archive tier. To resolve this, the administrator must first stop the lifecycle policy from archiving further blobs, rehydrate all existing archived blobs to Hot or Cool, and then submit the support request.

Adım Adım Çözüm

1
Analyze the migration blocker.
The storage account contains 4 TB4\text{ TB} of archived blobs, which blocks live migration to ZRS.
Microsoft live migration from LRS to ZRS does not support accounts containing blobs in the Archive tier.
2
Disable or modify the lifecycle management policy.
The rule transitioning blobs to the Archive tier is disabled or paused.
This prevents rehydrated blobs from being automatically moved back to the Archive tier by the lifecycle engine before or during the migration.
3
Rehydrate the archived blobs.
All archived blobs are rehydrated to either the Hot or Cool tier.
Bringing the blobs back to an active online tier unblocks the live migration process.
4
Submit the support request.
The live migration request is successfully submitted and processed by Microsoft.
The account now meets the pre-requisites for live migration as all blobs reside in active tiers.

Anahtar Kavram

Replication live migration limitations and lifecycle management coordination
Soru 69Soru →

Your company has an Azure environment structured with the following resource hierarchy:

* Management Group: `MG-Retail`
* Subscription: `Sub-Retail-Prod`
* Resource Group: `RG-Store-Prod`
* Resource: Virtual Machine named `VM-Web-01`

A user named Admin1 is assigned the Microsoft Entra ID Global Administrator role, but currently has no explicit Azure RBAC role assignments. Admin1 needs to assign the Contributor role to a developer named User2 for the Virtual Machine `VM-Web-01`.

What must Admin1 do first to accomplish this?

Cevabı ve açıklamayı göster

Cevap: Configure the Access management for Azure resources setting in the Microsoft Entra admin center to grant Admin1 the User Access Administrator role at the root scope.

Cevap

Configure the Access management for Azure resources setting in the Microsoft Entra admin center to grant the Global Administrator the User Access Administrator role at the root scope.
To manage Azure resource role assignments, a Microsoft Entra ID Global Administrator must first toggle the 'Access management for Azure resources' setting in the Microsoft Entra admin center. This action grants the administrator the built-in User Access Administrator role at the root scope (//), which inherits down the entire hierarchy, permitting them to manage RBAC role assignments at all management group, subscription, resource group, and resource levels.

Adım Adım Çözüm

1
Elevate access for the Microsoft Entra ID Global Administrator in the Microsoft Entra admin center settings.
Admin1 is assigned the User Access Administrator role at the root scope (//).
By default, Microsoft Entra ID tenant administration roles do not inherit permissions to manage Azure subscription resources. Elevating access bridges the identity and resource authorization planes.
2
Access the Access Control (IAM) pane of the target virtual machine, resource group, or subscription.
Role assignment capability becomes active for the administrator due to root-level User Access Administrator permissions.
The User Access Administrator role permits role assignment actions at all child levels in the resource hierarchy.
3
Assign the Contributor role to User2 at the `VM-Web-01` resource scope.
User2 receives the Contributor role on the virtual machine resource.
This completes the requirement of granting User2 the Contributor role for the virtual machine.

Anahtar Kavram

Elevating access for a Microsoft Entra ID Global Administrator to assign Azure RBAC roles
Soru 70Soru →

Your organization needs to import 40 TB40\text{ TB} of on-premises data to an Azure Storage account. You have ordered an Azure Data Box device, and it has just been delivered to your datacenter. Which of the following shows the correct sequence of steps you must perform to configure the device, copy the data, and complete the import process?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with cabling and configuring the IP address of the Data Box, followed by unlocking the device using credentials from the Azure portal. Next, the data is copied to the shares. Afterward, the prepare-to-ship verification is run, the device is shut down, and finally, it is shipped to the Azure datacenter where the upload progress is monitored.
The correct sequence follows the logical lifecycle of a physical Data Box deployment: first, network setup is required to reach the device management interface; second, security credentials from the Azure portal must be used to unlock the storage; third, the data is copied over the local network; fourth, a verification and locking process ('prepare to ship') must be executed before powering down; and finally, the device is shipped and the progress is tracked.

Adım Adım Çözüm

1
Connect the Data Box to the local network and set its IP address.
Access to the Data Box local web user interface is established.
You must establish network connectivity first to manage the device.
2
Unlock the device using credentials retrieved from the Azure portal.
The device is unlocked and storage shares are made available.
The device is locked by default for security during shipping.
3
Copy data to the SMB or NFS shares on the Data Box.
All source files are transferred to the device storage.
This is the primary stage of transferring data onto the physical medium.
4
Execute the 'Prepare to ship' command and shut down the device.
Data integrity is validated, the device is locked, and it is safely powered down.
This verifies the transfer and secures the data before shipment.
5
Ship the device to the Azure datacenter and track its progress.
The physical device is shipped, the data is imported by Azure, and progress is monitored.
This initiates the final ingestion of the data into the target Azure Storage account.

Anahtar Kavram

Azure Data Box deployment and import workflow steps.
Soru 71Soru →

A logistics company, Zenith Freight Services, is migrating a multi-tier workload to the Sweden Central region. The deployment must adhere to the following strict requirements:

- The database layer (22 virtual machines) requires a VM-level compute uptime SLA of at least 99.99%99.99\%.
- The application layer (33 virtual machines) requires protection against localized hardware failures and updates within a single datacenter, while ensuring network latency between the instances is minimized.
- The web layer (22 existing standalone virtual machines: WebVM-Prod1 and WebVM-Prod2) must be integrated into a configuration that guarantees a 99.95%99.95\% compute SLA.

Which configuration strategy should the administrator implement to meet all requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the database VMs across multiple Availability Zones, deploy the application VMs in an Availability Set, and delete the existing web VMs, recreating them from their OS disks within a new Availability Set.

Cevap

Deploy the database VMs across multiple Availability Zones, deploy the application VMs in an Availability Set, and delete the existing web VMs, recreating them from their OS disks within a new Availability Set.
Deploying the database VMs across multiple Availability Zones meets the 99.99%99.99\% SLA constraint. Placing the application VMs in an Availability Set ensures hardware redundancy (fault/update domains) while maintaining low latency. Deleting the existing web VMs and recreating them from their OS disks in a new Availability Set is the only valid method to transition running standalone VMs into an Availability Set to obtain the 99.95%99.95\% SLA.

Adım Adım Çözüm

1
Analyze database high availability requirements.
Database VMs must be deployed across multiple Availability Zones to achieve the required 99.99%99.99\% compute SLA.
Azure offers a 99.99%99.99\% uptime SLA for VMs only when two or more instances are deployed across two or more Availability Zones in the same region.
2
Analyze application tier requirements.
Deploy the application VMs in an Availability Set within a single datacenter.
An Availability Set guarantees a 99.95%99.95\% SLA and distributes the VMs across multiple physical fault and update domains inside one datacenter, keeping inter-VM latency to a minimum.
3
Evaluate integration strategy for existing web VMs.
Plan to delete the existing web VMs and recreate them using their existing OS disks within a new Availability Set.
Azure does not support adding existing standalone VMs to an Availability Set. Recreation is required to change their high availability configuration.

Anahtar Kavram

High Availability Configuration and SLAs (Availability Sets vs. Availability Zones)
Soru 72Soru →

An organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:
* Management Group: MG-Root
* Azure Subscription: Sub-Ops
* Resource Group: RG-Prod-Shared
* Storage Account: sa-prod-logs (contains a blob container named `security-logs`)

The following settings and assignments are configured:
1. A user named User1 is assigned the Security Reader role in Microsoft Entra ID.
2. The tenant-level directory setting Access management for Azure resources is set to No.
3. User1 is assigned the User Access Administrator role at the Sub-Ops subscription scope.
4. User1 is assigned the Reader role at the RG-Prod-Shared scope.
5. A resource lock of type ReadOnly is applied directly to the sa-prod-logs storage account.

Which of the following describes the effective permissions of User1?

Cevabı ve açıklamayı göster

Cevap: User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container.

Cevap

User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container.
The correct option is that User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container. User1 inherits the User Access Administrator role from the subscription level, which is additive and not overridden by the Reader assignment at the resource group level. Because User Access Administrator does not provide data plane permissions, User1 cannot write blobs to the storage container.

Adım Adım Çözüm

1
Analyze the impact of User1's Microsoft Entra ID role and the directory setting.
Since the directory setting 'Access management for Azure resources' is set to 'No', User1's Global Administrator or Security Reader directory roles do not grant User Access Administrator rights on Azure subscription resources.
By default, Microsoft Entra ID administrator roles do not inherit permissions to Azure resources unless access management is explicitly enabled and elevated.
2
Determine the effective Azure RBAC permissions inherited by User1.
User1 has the User Access Administrator role at the subscription scope (Sub-Ops) and the Reader role at the resource group scope (RG-Prod-Shared). Under Azure RBAC, permissions are additive. The User Access Administrator role inherits down to all child scopes, giving User1 role management permissions at both RG-Prod-Shared and sa-prod-logs. The Reader role assignment does not override or deny these inherited permissions.
Azure RBAC roles do not deny permissions; they only add them. An explicit assignment at a lower scope (Reader) does not negate an inherited role from a higher scope (User Access Administrator).
3
Evaluate data plane access to the storage account sa-prod-logs.
Neither User Access Administrator (which only manages authorization) nor Reader (which reads resource configuration) grants data plane write permissions to upload blobs.
Control plane roles do not automatically grant data plane access (such as writing blobs to a container) without specific data plane roles like Storage Blob Data Contributor.
4
Synthesize the final effective permissions.
User1 can perform role assignments (like assigning the Reader role) at the resource group level but cannot upload blobs to the security-logs container.
This aligns with User1's effective control plane role (User Access Administrator) and lack of data plane roles.

Anahtar Kavram

Azure RBAC role inheritance, additive permissions, and the boundary between control plane roles and data plane access.
Tahmini Süre:3m 0s
Soru 73Soru →

An organization has 45 TB45\text{ TB} of data stored on an on-premises network-attached storage (NAS) system. The organization needs to migrate this data to an Azure Blob Storage account. The local network has a restricted outbound internet connection, providing only 10 Mbps10\text{ Mbps} of dedicated bandwidth for the migration. The migration must be completed within 30 days30\text{ days}. The organization's security policy strictly prohibits the shipment of customer-owned physical drives and requires that all data copied to temporary physical transport media be accessible directly via standard network protocols (SMB or NFS) without requiring staging hosts. Which migration solution should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: A single Azure Data Box device

Cevap

A single Azure Data Box device
A single Azure Data Box device is the correct choice because the dataset size (45 TB45\text{ TB}) exceeds the 35 TB35\text{ TB} usable capacity limit of a single Azure Data Box Disk order. Additionally, Data Box supports direct copying over the local network via SMB and NFS protocols directly from the NAS, avoiding the need for staging hosts. Because the hardware is provided by Microsoft, it satisfies the security policy prohibiting customer-owned storage media. Finally, the restricted internet connection makes offline physical transfer the only feasible method within the 30 -day30\text{ -day} window.

Adım Adım Çözüm

1
Calculate the network transfer time to determine if online migration is possible.
A 10 Mbps10\text{ Mbps} connection yields approximately 1.25 MB/s1.25\text{ MB/s}. Transferring 45 TB45\text{ TB} would take over 416 days416\text{ days}, which exceeds the 30 -day30\text{ -day} requirement.
To determine whether to use an online tool (like AzCopy) or an offline physical transfer service.
2
Filter the offline options based on security policies.
The Azure Import/Export service is eliminated because the organization's policy prohibits shipping customer-owned physical drives.
To ensure compliance with the organization's security and hardware ownership requirements.
3
Compare the remaining Microsoft-provided offline shipping solutions based on capacity and connectivity requirements.
Azure Data Box Disk is ruled out because it has a 35 TB35\text{ TB} usable capacity limit and requires staging hosts (no native NFS/SMB shares). Azure Data Box Heavy is ruled out because it is designed for datasets over 100 TB100\text{ TB}.
To identify the most cost-effective and technically compatible device that fits the 45 TB45\text{ TB} dataset and supports direct NFS/SMB access.

Anahtar Kavram

Selecting the appropriate Azure offline data transfer service (Azure Data Box, Data Box Disk, Data Box Heavy, or Azure Import/Export) based on network bandwidth, dataset size, security policies, and protocol compatibility.
Tahmini Süre:2m 0s
Soru 74Soru →

An administrator needs to configure temporary access to a blob container named invoices within an Azure Storage account named corpfinance2026. The configuration must satisfy the following security requirements:

- Prevent exposure of the storage account's primary and secondary access keys.
- Authenticate the client using a Microsoft Entra ID security principal.
- Limit the validity of the temporary access to exactly two hours.
- Enforce the use of the HTTPS protocol only.

Which two actions should the administrator perform to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the Storage Blob Delegator role at the storage account level to the security principal generating the SAS.; Generate a User Delegation SAS token using the Microsoft Entra ID credentials of the authorized security principal.

Cevap

Assign the Storage Blob Delegator role to the security principal generating the SAS at the storage account level, and generate a User Delegation SAS token using the Microsoft Entra ID credentials of the authorized security principal.
To secure access without exposing account access keys and to authenticate via Microsoft Entra ID, a User Delegation SAS should be generated. To generate a User Delegation SAS, the identity requesting the user delegation key must be assigned the Storage Blob Delegator role at the storage account scope.

Adım Adım Çözüm

1
Identify the mechanism to prevent storage account key exposure.
Determine that a User Delegation SAS must be used, which is secured using Microsoft Entra ID credentials instead of storage account access keys.
User Delegation SAS relies on a user delegation key obtained via Microsoft Entra ID credentials, keeping access keys hidden.
2
Determine the RBAC roles required to generate the delegation key.
Select the Storage Blob Delegator role for the generating principal.
Generating a User Delegation SAS requires the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission, which is granted by the Storage Blob Delegator role.
3
Validate the expiration and protocol constraints.
Configure the SAS with a 2-hour duration and HTTPS-only protocol.
This satisfies the security requirements and fits within the 7-day maximum lifespan of a user delegation key.

Anahtar Kavram

User Delegation SAS and the required RBAC roles for generation.
Tahmini Süre:2m 0s
Soru 75Soru →

You have a General Purpose v2 (GPv2) storage account named `storagedata` in the East US region. The storage account is configured with Geo-Redundant Storage (GRS). A lifecycle management policy is active on the account, which automatically transitions block blobs in a container named `logs` to the Archive tier 30 days after they are created.

Due to a disaster in the primary region, you initiate a customer-managed failover for the storage account.

What is the state of the storage account replication and the archived blobs after the failover completes?

Cevabı ve açıklamayı göster

Cevap: The storage account replication changes to Locally Redundant Storage (LRS). The archived blobs remain in the Archive tier and must be rehydrated to an online tier before they can be read.

Cevap

The storage account replication changes to Locally Redundant Storage (LRS). The archived blobs remain in the Archive tier and must be rehydrated to an online tier before they can be read.
When a customer-managed failover is initiated for a Geo-Redundant Storage (GRS) account, the secondary region becomes the new primary region, and the replication configuration changes to Locally Redundant Storage (LRS). Archived blobs are failed over successfully but remain in the Archive tier. They must be rehydrated to an online tier (Hot or Cool) before their data can be accessed.

Adım Adım Çözüm

1
Identify the destination replication state after a customer-managed failover.
The storage account replication is converted to Locally Redundant Storage (LRS) in the new primary region.
Azure Storage failover converts Geo-Redundant Storage (GRS/RA-GRS) to locally redundant storage (LRS) in the secondary region, which becomes the new primary region.
2
Determine the status and access requirements of archived blobs during and after a failover.
Archived blobs remain in the Archive tier and are offline.
Failover does not automatically change the access tier of blobs or rehydrate them. They remain in the Archive tier and require rehydration to Hot or Cool to be accessed.

Anahtar Kavram

Storage Account Failover and Lifecycle Tier Behavior
Soru 76Soru →

An organization named Meridian Vanguard configures the following Azure Management Group (MG) hierarchy:

* Tenant Root Group
* Corporate-MG
* Production-MG
* App-Sub-01 (Subscription)
* Development-MG
* Dev-Sub-01 (Subscription)

An administrator named Alice needs to reorganize the environment by moving the subscription App-Sub-01 from Production-MG to Development-MG.

Alice has the following Azure role assignments:
* Owner role on the App-Sub-01 subscription
* Reader role on both Corporate-MG and Production-MG
* Contributor role on Development-MG

What is the outcome when Alice attempts to move the subscription?

Cevabı ve açıklamayı göster

Cevap: The move fails because Alice lacks the required write permissions on the source management group (Production-MG).

Cevap

The move fails because Alice lacks the required write permissions on the source management group (Production-MG).
To move an Azure subscription to a new parent management group, an administrator must have write permissions at three distinct scopes: the subscription itself, the target management group, and the source management group. While Alice has Owner permissions on the subscription and Contributor permissions on the target (Development-MG), she only has Reader permissions on the source (Production-MG). Because the Reader role does not grant write permissions (specifically Microsoft.Management/managementGroups/subscriptions/write), the operation is blocked.

Adım Adım Çözüm

1
Verify the permission requirements for moving a subscription within a management group hierarchy.
Moving a subscription requires write permissions (Microsoft.Management/managementGroups/subscriptions/write) on both the source and target management groups, as well as write permissions on the subscription itself.
Moving a subscription is an administrative change that modifies the child collections of both management groups and updates the subscription's parent metadata.
2
Evaluate Alice's permissions against the target management group (Development-MG) and the subscription (App-Sub-01).
Alice has Contributor permissions on the target MG (which includes write access) and Owner permissions on the subscription (which includes write access).
These roles satisfy the target-side and resource-side requirements of the move operation.
3
Evaluate Alice's permissions against the source management group (Production-MG).
Alice only has the Reader role on Production-MG, which does not grant write permissions.
Without write permissions on the source management group, Alice cannot authorize the removal of the subscription from that management group, causing the operation to fail.

Anahtar Kavram

Moving subscriptions between management groups requires write permissions at the source management group, the target management group, and on the subscription itself.
Tahmini Süre:2m 0s
Soru 77Soru →

An administrator is reviewing replication options for standard General Purpose v2 (GPv2) storage accounts in an Azure subscription.

Which of the following statements about Azure Storage replication options are correct? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Locally-redundant storage (LRS) replicates data synchronously three times within a single physical location in the primary region.; Read-access geo-redundant storage (RA-GRS) provides read-only access to the data in the secondary region under normal operating conditions.

Cevap

Locally-redundant storage (LRS) replicates data synchronously three times within a single physical location, and Read-access geo-redundant storage (RA-GRS) provides read-only access to the data in the secondary region under normal operating conditions.
Locally-redundant storage (LRS) is designed to replicate data synchronously three times within a single physical location in the primary region, providing cost-effective local redundancy. Read-access geo-redundant storage (RA-GRS) adds read-only access to the secondary region by exposing a secondary endpoint, enabling read capabilities without requiring a failover.

Adım Adım Çözüm

1
Identify the replication mechanism of Locally-redundant storage (LRS).
LRS replicates three copies of the data synchronously within a single facility (data center) in the primary region.
This confirms the statement about LRS is correct.
2
Evaluate the read access capabilities of Geo-redundant storage (GRS) and Read-access geo-redundant storage (RA-GRS).
RA-GRS provides read access to the secondary region at all times, whereas GRS does not allow read access to the secondary region unless a failover is initiated.
This confirms the statement about RA-GRS is correct, and the statement about GRS is incorrect.
3
Verify the synchronization model of Zone-redundant storage (ZRS).
ZRS replicates data synchronously across three availability zones in the primary region.
This disproves the statement claiming ZRS replicates asynchronously.
4
Check the migration requirements for converting LRS to ZRS.
Converting LRS to ZRS cannot be configured as a simple update in the portal; it requires requesting a live migration or performing a manual data copy.
This disproves the statement claiming LRS to ZRS conversion can be done directly in the portal.

Anahtar Kavram

Azure Storage replication types, synchronization models, and migration paths.
Tahmini Süre:1m 0s
Soru 78Soru →

An administrator configures the network firewall for an Azure Storage account named storagedata1 that contains a blob container named container1 and an Azure file share named share1.

The firewall settings for storagedata1 are configured as follows:
- Public network access: Enabled from selected virtual networks and IP addresses
- Virtual networks: None
- Firewall (IP ranges): None
- Exceptions: "Allow Azure services on the trusted services list to access this storage account" is enabled

The administrator needs to support the following administrative tasks:
- Task 1: Backup share1 using Azure Backup.
- Task 2: Allow a developer named User1 to upload blobs to container1 using the Azure CLI from an on-premises computer with the public IP address 203.0.113.5. User1 is assigned the Owner role at the subscription level.
- Task 3: Allow an Azure Data Factory instance named ADF1 to copy data from container1. ADF1 has been assigned the Storage Blob Data Contributor role on storagedata1.

Which of the tasks will succeed under the current configuration without any further modifications?

Cevabı ve açıklamayı göster

Cevap: Task 1 only

Cevap

Task 1 only
The task to backup the file share using Azure Backup succeeds because Azure Backup is a trusted Microsoft service that natively utilizes the firewall bypass exception for Azure Files backup. The other tasks fail because the network firewall blocks the user's public IP address (and Owner does not grant data-plane access), and Azure Data Factory requires a resource instance rule to bypass the firewall.

Adım Adım Çözüm

1
Evaluate Task 1 (Azure Backup of Azure Files share1).
Task 1 succeeds.
Azure Backup is a trusted Microsoft service that can bypass the storage firewall to backup Azure File shares when the 'Allow trusted Microsoft services...' exception is enabled.
2
Evaluate Task 2 (User1 uploading blobs from public IP 203.0.113.5).
Task 2 fails.
The storage firewall is set to selected networks and does not have User1's public IP address listed in the firewall rules. Additionally, the Owner role is a control-plane role and does not grant data-plane access to blobs via Entra ID authentication.
3
Evaluate Task 3 (Azure Data Factory ADF1 copying data from container1).
Task 3 fails.
For Azure Data Factory to bypass the storage firewall over public endpoints, a resource instance rule matching the specific ADF instance must be configured. Enabling the general trusted Microsoft services exception alone is insufficient.

Anahtar Kavram

Azure Storage Account network security exceptions and resource instance rules.
Tahmini Süre:3m 0s
Soru 79Soru →

An administrator is configuring network security for an Azure storage account named `mystorage2026`. The storage account must allow traffic from `Subnet-A` of `VNet-A`, but block all other public internet traffic. Additionally, Azure Virtual Machine backup operations must continue to succeed.

Which two settings must be configured on the firewalls and virtual networks blade of the storage account to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the public network access to 'Enabled from selected virtual networks and IP addresses' and add Subnet-A of VNet-A; Select 'Allow trusted Microsoft services to access this storage account' as an exception

Cevap

Configure the public network access to allow selected virtual networks and add the target subnet, and enable the bypass exception for trusted Microsoft services.
To limit access to a specific subnet while blocking general public traffic, the storage account firewall must be set to 'Enabled from selected virtual networks and IP addresses' and configured with the target subnet. Additionally, to allow Azure Backup to function, the 'Allow trusted Microsoft services to access this storage account' bypass option must be enabled.

Adım Adım Çözüm

1
Configure the storage account firewall to restrict public access.
Changing the public network access setting from 'Enabled from all networks' to 'Enabled from selected virtual networks and IP addresses' blocks unauthorized public internet traffic.
This establishes the default deny rule for all traffic not originating from approved networks.
2
Associate the target virtual network and subnet with the storage account firewall.
Traffic originating from Subnet-A of VNet-A is allowed through the firewall.
This permits the required subnet to communicate with the storage account's public endpoint.
3
Enable the firewall bypass for trusted Microsoft services.
Azure Backup is permitted to bypass the firewall.
This ensures critical management and backup operations succeed despite the restricted network rule.

Anahtar Kavram

Azure Storage firewalls allow restricting public access to specific subnets while permitting trusted Microsoft services to bypass these restrictions.
Soru 80Soru →

An administrator is planning the deployment of two Azure virtual machines named VM-Web1 and VM-Web2 in the North Europe region. To meet high availability requirements, the administrator decides to deploy both virtual machines in a single Availability Set. Which of the following statements describe the features or configuration requirements of Azure Availability Sets? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Virtual machines are automatically distributed across multiple physical fault domains to protect against localized hardware failures.; Virtual machines are automatically distributed across multiple update domains to prevent simultaneous downtime during scheduled Azure platform updates.

Cevap

The correct options are that virtual machines in an Availability Set are automatically distributed across physical fault domains to protect against hardware failures, and distributed across update domains to prevent simultaneous downtime during updates.
Availability Sets provide redundancy within a single datacenter. The option describing distribution across fault domains is correct because fault domains represent physical hardware racks that isolate hardware failures. The option describing distribution across update domains is correct because update domains ensure that only a portion of the VMs are rebooted at any given time during Azure host maintenance.

Adım Adım Çözüm

1
Analyze the high availability capabilities of Azure Availability Sets.
Identify that Availability Sets protect virtual machines from localized hardware failures and platform updates within a single datacenter.
This establishes the scope of Availability Sets vs Availability Zones.
2
Determine how Availability Sets achieve localized redundancy.
Confirm that they automatically place VMs in separate fault domains (racks) and update domains (groups for platform updates).
This matches the core capabilities of Availability Sets.
3
Evaluate the configuration and deployment constraints of Availability Sets.
Understand that Availability Sets cannot span datacenters and VMs cannot be added post-creation.
This filters out invalid choices.

Anahtar Kavram

Azure Availability Sets provide redundancy within a single datacenter by distributing VMs across separate fault domains (racks) and update domains (logical groups for updates).
Tahmini Süre:1m 0s
ÖncekiSayfa 4 / 63Sonraki
Tüm alıştırma soruları — Microsoft Azure Administrator (AZ-104) | Examkin