Tüm alıştırma soruları

An administrator manages an Azure subscription that contains a resource group named `rg-dev-sandbox`. The resource group contains a virtual machine named `vm-sandbox` and a storage account named `stdevsandbox`.

The administrator applies a tag named `Dept: Engineering` and a `CanNotDelete` lock to `rg-dev-sandbox`.

Which statement describes the resulting governance state of the resources in `rg-dev-sandbox`?

An administrator deploys three virtual networks in the Azure environment:
* VNet-Hub ($10.80.0.0/16$): Contains a subnet named GatewaySubnet ($10.80.0.0/24$) with an active Virtual Network Gateway connected to an on-premises network ($172.16.0.0/16$), and a subnet named Subnet-Hub ($10.80.1.0/24$) with a virtual machine named VM-Hub.
* VNet-SpokeA ($10.81.0.0/16$): Contains a subnet named Subnet-A ($10.81.1.0/24$) with a virtual machine named VM-A.
* VNet-SpokeB ($10.82.0.0/16$): Contains a subnet named Subnet-B ($10.82.1.0/24$) with a virtual machine named VM-B.

The administrator configures virtual network peering between VNet-Hub and VNet-SpokeA, and between VNet-Hub and VNet-SpokeB with the following settings:
* For both peerings, Allow virtual network access is set to Enabled and Allow forwarded traffic is set to Enabled.
* On the peering connections from VNet-Hub to both spokes, Allow gateway transit is set to Enabled.
* On the peering connections from both spokes to VNet-Hub, Use remote gateways is set to Enabled.

No user-defined routes (UDRs) or network security groups (NSGs) are configured.

Which statement correctly describes the connectivity established by this configuration?

An administrator is configuring a public load balancer to distribute traffic to three virtual machines:

* VM1 and VM2, which are in an Availability Set named AS1
* VM3, which is a standalone virtual machine

All virtual machines are located in the same virtual network and subnet.

The administrator has created a Standard SKU public IP address named Pub-IP1 and a Basic SKU load balancer named LB1.

You need to identify the configuration changes required to load balance incoming internet traffic across VM1, VM2, and VM3 using Pub-IP1.

Which two actions should you perform? (Choose two.)

Your company has an Azure subscription named sub-apexion-prod. You plan to configure customer-managed keys (CMK) to encrypt an Azure Storage account named saapexionpatient. You deploy an Azure Key Vault named kv-apexion-keys. The Key Vault has both soft-delete and purge protection enabled and is configured to use Azure role-based access control (RBAC) for authorization. The storage account is configured with a system-assigned managed identity. You need to grant the storage account the minimum required permissions to the key vault to enable CMK encryption. Which role should you assign to the system-assigned managed identity of the storage account?

An administrator is configuring an Azure Application Gateway to host two distinct websites: sales.contoso.com and marketing.contoso.com. Both sites must be accessed using the same public IP address of the gateway but must route to different backend pools. Which listener type should be configured on the Application Gateway?

An organization is configuring access control for its Azure resources. You need to assign the appropriate built-in Azure RBAC roles to meet specific administrative requirements based on the principle of least privilege. Match each administrative requirement to the correct built-in Azure RBAC role.

Your company is deploying a new Azure Kubernetes Service (AKS) cluster to host a microservices application. The Azure environment includes a virtual network named `VNet1` with the address space $172.20.0.0/16$. The AKS cluster will be deployed into a subnet named `aks-subnet` ($172.20.8.0/24$). The cluster is required to scale up to $15$ nodes, with each node supporting a maximum of $80$ pods. The pods must be able to communicate with on-premises database servers over an existing ExpressRoute connection. To prevent virtual network IP address exhaustion, the network security team mandates that pod IP addresses must not be allocated from the $172.20.0.0/16$ address space. Additionally, the solution must not require the configuration or management of user-defined routes (UDRs) or route tables for pod routing. Which network configuration should you use for the AKS cluster?

An organization has an Azure subscription containing two subnets named Subnet-Web ($10.1.1.0/24$) and Subnet-App ($10.1.2.0/24$). A virtual machine named VM-Web is deployed in Subnet-Web, and its network interface is associated with an Application Security Group named ASG-Web. A virtual machine named VM-App is deployed in Subnet-App, and its network interface is associated with an Application Security Group named ASG-App.

A network security group named NSG-Subnet is associated with Subnet-App and contains the following inbound security rules:
* Priority $110$: Source: ASG-Web, Destination: ASG-App, Port: $443$, Protocol: TCP, Action: Deny
* Priority $120$: Source: $10.1.1.0/24$, Destination: Any, Port: $443$, Protocol: TCP, Action: Allow

A network security group named NSG-NIC is associated with the network interface of VM-App and contains the following inbound security rule:
* Priority $100$: Source: ASG-Web, Destination: ASG-App, Port: $443$, Protocol: TCP, Action: Allow

What is the outcome when VM-Web attempts to connect to VM-App on TCP port $443$?

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains two subnets:
- `Subnet-Web` ($10.0.1.0/24$)
- `Subnet-DB` ($10.0.2.0/24$)

The following virtual machines are deployed in `VNet1`:
- `VM-Web1` is in `Subnet-Web` and its network interface is associated with an Application Security Group named `ASG-Web`.
- `VM-DB1` is in `Subnet-DB` and its network interface is associated with an Application Security Group named `ASG-DB`.

The following Network Security Groups (NSGs) are configured and associated:
- `NSG-Subnet` is associated with `Subnet-Web` and contains the following outbound security rule:
- Priority: $150$
- Source: `*`
- Destination: $10.0.2.0/24$
- Port: `*`
- Protocol: `Any`
- Action: `Deny`
- `NSG-NIC-DB` is associated with the network interface of `VM-DB1` and contains the following inbound security rule:
- Priority: $200$
- Source: $10.0.1.0/24$
- Destination: `*`
- Port: `*`
- Protocol: `Any`
- Action: `Deny`

All other NSG settings and rules are at their default values.

You need to allow SSH (TCP port $22$) and HTTPS (TCP port $443$) connections from `VM-Web1` to `VM-DB1`. The solution must follow the principle of least privilege.

Which two actions should you perform? (Select two.)

Your company is deploying application servers in a new Azure virtual network named CorpVNet. You need to configure Azure Bastion in CorpVNet to enable secure RDP and SSH connections to the virtual machines. Which subnet configuration meets the requirements for the Azure Bastion deployment?

You are preparing a virtual network in Azure for the deployment of a new Application Gateway instance to distribute incoming web traffic. When preparing the target subnet for the gateway, which rule or constraint must you follow?

You need to write a Kusto Query Language (KQL) query in Azure Log Analytics to find all heartbeat records from the last 24 hours for a virtual machine named VM1. Which KQL query should you use?

An organization manages its cloud resources using the following Azure hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-AppStore`
- Resource Groups: `RG-Services` and `RG-Database`

You need to delegate the ability to manage Azure Role-Based Access Control (RBAC) role assignments for all current and future resource groups inside `Sub-AppStore` to a security group named `Group-SecurityAdmins`. Members of `Group-SecurityAdmins` must not be able to create, delete, or modify any actual resources within the subscription.

Which role and scope should you assign to `Group-SecurityAdmins` to meet the requirements while adhering to the principle of least privilege?

An administrator is configuring network security for a two-tier application in an Azure subscription. The subscription contains a virtual network named $VNet1$ with two subnets: $Subnet-Web$ and $Subnet-Database$.

- $VM-Web$ is deployed in $Subnet-Web$ and has its network interface associated with an Application Security Group named $ASG-Web$.
- $VM-Database$ is deployed in $Subnet-Database$ and has its network interface associated with an Application Security Group named $ASG-Database$.
- A Network Security Group named $NSG-Subnet$ is associated with $Subnet-Database$.
- A Network Security Group named $NSG-NIC$ is associated with the network interface of $VM-Database$.

You need to allow database traffic on TCP port $1433$ from $VM-Web$ to $VM-Database$ while maintaining the principle of least privilege.

Which of the following actions should you perform? (Select two.)

An administrator is deploying an Azure Virtual Machine Scale Set named `vmss-worker`. The scale set will run a containerized background processing application. The startup script of the application registers each virtual machine instance with an external monitoring service. You need to ensure that the scale set does not provision temporary, excess virtual machine instances during scale-out events, as this leads to orphaned registrations in the monitoring service. What should you do?

Your company has an Azure subscription containing an Azure Private DNS zone named corp.contoso.com. You have two virtual networks named VNet1 and VNet2 in the same Azure region. You need to configure Azure Private DNS so that virtual machines in VNet1 can resolve names in corp.contoso.com and automatically register their own DNS records. Virtual machines in VNet2 must be able to resolve names in corp.contoso.com but must not automatically register their DNS records. Which two configurations should you implement? (Select two.)

An administrator is configuring inbound internet access to an internal web server through an Azure Firewall. The administrator needs to allow HTTP traffic on port 80 to the web server while ensuring all other inbound traffic is blocked.

Which of the following configurations are required to meet these requirements? (Select two)

You plan to deploy a public Standard Load Balancer named $LB1$. $LB1$ will have a backend pool named $Pool1$. You have a virtual network named $VNet1$ that contains a subnet named $Subnet1$. $Subnet1$ contains three virtual machines:

- $VM1$: Configured with a Basic SKU public IP address directly assigned to its network interface ($NIC1$).
- $VM2$: Configured with a Standard SKU public IP address directly assigned to its network interface ($NIC2$).
- $VM3$: Configured with no public IP address.

Currently, no Network Security Groups (NSGs) are associated with $Subnet1$ or any of the virtual machine network interfaces. Which of the following sets of actions must you perform to successfully add all three virtual machines to $Pool1$ and ensure that health probes succeed?

An administrator is configuring a public Azure Load Balancer. The administrator first deploys a Standard SKU public IP address named Pub-IP1.

The backend pool of the load balancer will contain two virtual machines, VM1 and VM2, which are deployed in a single Availability Set.

Which of the following configurations must be used to ensure the load balancer and its backend pool can be successfully deployed? (Select two.)

An administrator manages a virtual network named `VNet-Sales` with the address space $172.20.0.0/16$. The virtual network contains the following subnets:

* `Subnet-Web`: $172.20.10.0/24$
* `Subnet-App`: $172.20.20.0/24$
* `Subnet-Security`: $172.20.30.0/24$

A custom security appliance named `NVA-Firewall` is deployed in `Subnet-Security` with the IP address $172.20.30.4$. IP forwarding is enabled on the network interface of `NVA-Firewall`.

The administrator wants to ensure that all traffic from `Subnet-Web` destined for `Subnet-App` is routed through `NVA-Firewall` for inspection.

Which route table configuration and association should the administrator apply to achieve this goal?