Tüm alıştırma soruları

An administrator is deploying an Azure Application Gateway v2 (Standard_v2 SKU) in Subnet-GW within VNet-Hub to host two secure websites: partners.contoso.com and internal.contoso.com. Both sites must share the same public IP address on the gateway. The configuration requirements are:

1. partners.contoso.com requires end-to-end SSL encryption. The backend pool contains virtual machines in VNet-Spoke1 (peered to VNet-Hub) defined by FQDNs registered in a private DNS zone named private.contoso.com. These virtual machines use self-signed certificates.
2. internal.contoso.com requires SSL termination at the gateway. The backend pool consists of Azure App Service instances. Requests to internal.contoso.com/images/* must be routed to an Azure Storage account static website.
3. The gateway subnet must be secured using a Network Security Group (NSG) and allow management traffic.

Which of the following configurations must be implemented to meet these requirements?

An organization requires the deployment of three independent workloads using Azure Container Instances (ACI). Which container restart policy should be matched to each workload scenario to align with the specified operational requirements?

You plan to configure a public Azure Load Balancer named LB1 using the Standard SKU.

You have three virtual machines named VM1, VM2, and VM3 in the same virtual network. The virtual machines are standalone instances and are not configured in any availability set.

The public IP configurations for the virtual machines are as follows:
- VM1 has a Standard SKU public IP address associated with its network interface.
- VM2 has a Basic SKU public IP address associated with its network interface.
- VM3 does not have a public IP address associated with its network interface.

You need to ensure that you can add VM1, VM2, and VM3 to the backend pool of LB1.

Which two actions should you perform? Each correct answer presents a complete solution.

An administrator needs to analyze diagnostic logs for several Azure Key Vaults. The logs are collected in a Log Analytics workspace named LogsWS.

The administrator wants to retrieve the total number of operations for each Key Vault resource over the past 24 hours, grouped by the operation name.

Which Kusto Query Language (KQL) query should the administrator execute to achieve this objective?

An administrator is planning the deployment of a new web application to Azure App Service. The application must meet the following requirements:
- Support scaling out to at least 10 instances.
- Enable integration with an Azure Virtual Network (VNet) to access backend resources securely.
- Support deployment slots to enable staging and testing before production swaps.
- Minimize hosting costs.

Which of the following configurations should the administrator select? (Select TWO.)

An administrator needs to recover specific configuration files from a backup of a Linux virtual machine named `vm-prod-lnx`. The virtual machine's storage layout uses Logical Volume Manager (LVM) across multiple managed disks.

The administrator downloads the Item-Level Recovery (ILR) script from the Recovery Services vault and attempts to execute it directly on `vm-prod-lnx` to mount the recovery point. However, the script fails to mount the logical volumes because of a volume group name and UUID conflict with the active system.

What should the administrator do to retrieve the required configuration files?

An organization is deploying an Azure Application Gateway v2 to load balance traffic across a pool of backend web servers. The security policy requires end-to-end TLS encryption. The backend servers use certificates issued by an internal enterprise Certification Authority (CA). You need to configure the Application Gateway to support this configuration. In which order should you perform the configuration steps?

An administrator is configuring connectivity in an Azure subscription. The environment contains the following resources in the East US region:

* VNet-Hub ($10.150.0.0/16$): Contains a subnet named GatewaySubnet with an active Virtual Network Gateway, and a subnet named Subnet-Hub containing a virtual machine named VM-Hub.
* VNet-SpokeA ($10.160.0.0/16$): Contains a subnet named Subnet-A containing a virtual machine named VM-SpokeA.
* VNet-SpokeB ($10.170.0.0/16$): Contains a subnet named Subnet-B containing a virtual machine named VM-SpokeB.

The administrator configures virtual network peering between VNet-Hub and VNet-SpokeA, and between VNet-Hub and VNet-SpokeB. No direct peering exists between VNet-SpokeA and VNet-SpokeB.

You need to ensure that VM-SpokeA can communicate with an on-premises network connected via the Virtual Network Gateway in VNet-Hub.

Which of the following configuration settings must be enabled on the virtual network peering links to meet this requirement? Select two.

You are configuring a public Azure Load Balancer to distribute traffic to two virtual machines, VM-App1 and VM-App2. The virtual machines are deployed in different Availability Zones (Zone 1 and Zone 2) within the same Azure region. You need to ensure the load balancer can route traffic to both virtual machines. Which two configurations must you select to support this architecture?

You are configuring diagnostic settings for a set of Azure virtual machines and Key Vaults. Match each Azure Monitor diagnostic destination on the left to its corresponding primary administrative use case on the right.

An administrator needs to configure secure data plane access to an Azure Storage Queue named incoming-orders-queue for an application registered as a service principal named OrderProcessorSP. The application must be able to read, peek, and delete messages from the queue during execution, but it must not be able to send new messages or manage the queue structure. Following the principle of least privilege, which Azure role-based access control (RBAC) role should the administrator assign to OrderProcessorSP?

An enterprise cloud infrastructure is configured with the following hierarchy:

- Management Group: `Corp-MG`
- Subscription: `Sub-Production`
- Resource Group: `RG-AppStore`
- Resource Group: `RG-DataStore`

You are tasked with assigning Azure Role-Based Access Control (RBAC) roles to security groups to align with the principle of least privilege. Match each security group to the correct Azure RBAC role and scope assignment based on their technical requirements.

You are planning the IP addressing scheme for a new Azure virtual network named `vnet-logistics` that has an address space of $172.20.0.0/21$. You need to create two subnets to meet the following requirements:

- A subnet for Azure Bastion that supports the minimum required subnet prefix size.
- A subnet named `snet-db` that must support at least $11$ database servers.

You must minimize the number of IP addresses allocated to both subnets to conserve the address space for future expansion.

Which two of the following subnet configurations should you implement? (Select two.)

An organization deploys a new compliance auditing environment. The deployment contains an Azure resource group named rg-audit-compliance. Inside the resource group, the operations team creates an Azure Storage account named saauditlogs and an Azure Key Vault named kvauditkeys.

To meet compliance requirements, the team performs the following actions:
1. Applies a resource tag named RegulatoryCompliance: PCI-DSS to rg-audit-compliance.
2. Applies a CanNotDelete resource lock named lock-rg-delete to rg-audit-compliance.

Which of the following statements regarding the governance and lock behaviors of these resources are correct?

You have an Azure subscription containing a resource group named `rg-analytics` and an Azure Storage account named `streports2026`. Inside the storage account, you have a blob container named `auditlogs`.

A team of internal auditors belongs to a Microsoft Entra ID group named `Audit-Team-Group`. The auditors need to upload and read blobs in the `auditlogs` container. They must also be able to browse to the container using the Azure Portal. The solution must follow the principle of least privilege.

To configure the required access, which of the following role assignments should you perform? (Select two.)

An administrator is configuring access control and monitoring for an Azure subscription. The subscription contains a Log Analytics workspace named Workspace1 that collects logs from virtual machines and Azure SQL databases.

You need to configure Workspace1 and write a Kusto Query Language (KQL) query to meet the following requirements:
- Ensure that database administrators can view diagnostic logs only for their SQL databases. They must not have access to any other logs stored in Workspace1.
- Retrieve SQL database diagnostic logs from the AzureDiagnostics table where the execution duration of a query is greater than 5 seconds.
- Sort the query results to show the longest-running queries first.

Which three options should you select to meet the requirements?

An organization has an Azure virtual network named VNet-Prod ($10.10.0.0/16$) with three subnets: Web-Subnet ($10.10.1.0/24$), App-Subnet ($10.10.2.0/24$), and Sec-Subnet ($10.10.3.0/24$). A Network Virtual Appliance (NVA) named NVA-Sec ($10.10.3.10$) is deployed in Sec-Subnet. A route table named RT-Web is associated with Web-Subnet. Currently, RT-Web contains the following user-defined routes:

- Route A: Destination $10.10.2.0/24$, Next hop type: Virtual appliance, Next hop IP address: $10.10.3.10$
- Route B: Destination $10.10.2.0/25$, Next hop type: Virtual network
- Route C: Destination $0.0.0.0/0$, Next hop type: Internet

You notice that traffic from Web-Subnet destined for servers in App-Subnet with IP addresses from $10.10.2.1$ to $10.10.2.50$ is bypassing NVA-Sec and communicating directly. You need to ensure that all traffic from Web-Subnet to App-Subnet is routed through NVA-Sec and successfully forwarded by the appliance. Which two actions should you perform? (Select two.)

You have an Azure virtual machine named VM1 that is backed up to a Recovery Services vault. A critical operating system corruption occurs, and VM1 fails to boot. You need to restore VM1 from a backup. The restored virtual machine must retain the original resource ID, network interface cards (NICs), and IP configurations of VM1. Which restore option should you select?

An administrator is configuring security for an internal web server named `Server1` (private IP address $10.1.1.4$) using an Azure Firewall. The administrator creates a Destination Network Address Translation (DNAT) rule that translates incoming HTTP traffic from the firewall's public IP address ($40.120.50.10$) on port $80$ to `Server1` on port $80$. The administrator must block traffic from a specific external IP address ($198.51.100.25$) to `Server1` while continuing to allow HTTP traffic from all other internet sources. Which configuration should the administrator add to the Azure Firewall?

You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You need to ensure that Workspace1 stops accepting data and stops incurring charges for the rest of the day if the volume of ingested data in a single day reaches 10 GB. What should you configure in Workspace1?