Tüm alıştırma soruları

An administrator deploys the Azure Monitor agent to a virtual machine named VM-Prod1. The administrator needs to write a Kusto Query Language (KQL) query to retrieve all heartbeat events recorded for VM-Prod1 within the last hour. Which KQL query should you run?

An administrator is planning the deployment of two web applications to Azure App Service. You need to configure a separate App Service plan for each application. The hosting requirements for the applications are as follows:

* App1: Requires a minimum of $3$ deployment slots, automatic scaling up to $10$ instances, and daily automated backups.
* App2: Requires a custom domain name with SSL binding and manual scaling up to $3$ instances. It does not require deployment slots, automatic scaling, or backups.

You must minimize hosting costs.

Which two pricing tiers should you select? (Select two.)

You are planning the deployment of a new workload in Azure. You have an Azure virtual network named `vnet-manufacturing` with an address space of $10.150.0.0/16$. You create a subnet named `snet-assembly` with an address prefix of $10.150.10.0/29$. You need to deploy $4$ virtual machines in `snet-assembly` that each require a dedicated private IP address.

Statement: The $10.150.10.0/29$ subnet address space is sufficient to host the $4$ virtual machines.

You have an Azure Virtual Network Gateway named VNetGW1. You need to ensure that the platform metrics and resource logs for VNetGW1 are collected and routed to a Log Analytics workspace. What should you configure on VNetGW1?

An administrator needs to deploy a containerized application to Azure Container Instances (ACI) to run a one-time data migration script. The application will perform the migration and then exit. The container group must be deployed into an Azure virtual network to access a private database. Which configuration should the administrator use for the deployment?

You manage an Azure subscription that contains an Azure Key Vault named `KeyVault1` and an Azure App Service web app named `WebApp1` in the East US region. You must configure diagnostic settings to meet the following logging requirements:
- Audit logs for all cryptographic key operations in `KeyVault1` must be retained for exactly 365 days.
- HTTP server logs from `WebApp1` must be streamed to a non-Azure security information and event management (SIEM) system in near real-time.

Which of the following configuration actions should you perform? (Select TWO.)

An administrator is troubleshooting performance and connectivity issues for an Azure Application Gateway named AppGW1. Diagnostic settings are configured to send logs to a Log Analytics workspace.

The administrator needs to write a KQL query to find the total count of requests that resulted in an HTTP status code of $502$ (Bad Gateway) over the last $24$ hours, grouped by the requested URI.

Which KQL query should the administrator run?

Your organization uses an Azure Application Gateway v2 to route traffic for a web application. You enable diagnostic logging for the Application Gateway and route the logs to a Log Analytics workspace. The logs are collected in the resource-specific AGWAccessLogs table.

You need to write a Kusto Query Language (KQL) query to identify the top $5$ request URIs that experienced the highest average backend response time for requests resulting in server-side errors (HTTP status codes in the $5\text{xx}$ range) over the last $24$ hours.

Which of the following KQL queries will return the correct results? (Select two.)

An administrator manages an Azure virtual machine named VM-App01 that is backed up to a Recovery Services vault. VM-App01 is configured with two network interface cards (NICs), and its primary network interface is associated with the backend pool of an internal Azure Load Balancer. Following a guest operating system corruption, the administrator needs to restore VM-App01 from a backup recovery point. The restored virtual machine must retain both network interfaces and its load balancer association. Which restore option should the administrator use?

Your company has an Azure subscription containing a resource group named rg-prod-data. The resource group contains an Azure Storage account named stdataexchange.

You have a Microsoft Entra ID group named Finance-Analysts. A business analyst named Pat is a member of the Finance-Analysts group.

To comply with corporate security standards, access key authentication is disabled on stdataexchange.

You need to configure permissions so that the members of the Finance-Analysts group can perform the following actions:
- Search for and open the stdataexchange storage account in the Azure portal.
- View the networking and firewall settings of stdataexchange.
- Browse and download files from a blob container named incoming-transmissions within the storage account using the Azure portal.

The solution must follow the principle of least privilege.

Which two Azure Role-Based Access Control (RBAC) roles should you assign to the Finance-Analysts group?

Your organization's Azure infrastructure is structured as follows:
- Management Group: `MG-Core`
- Subscription: `Sub-Production`
- Resource Group: `RG-Networking` (contains a Virtual Network named `VNet-Prod` and three Network Security Groups)
- Resource Group: `RG-SecOps` (contains an Azure Key Vault and an Azure Firewall)

You have a Microsoft Entra ID group named `Net-Auditors`.

You need to assign Azure RBAC roles to `Net-Auditors` to meet the following requirements:
1. Members of `Net-Auditors` must be able to view all resource configurations and metrics across the entire `Sub-Production` subscription.
2. Members of `Net-Auditors` must be able to associate the existing Network Security Groups in `RG-Networking` to subnets in `VNet-Prod`.
3. The solution must minimize permissions (least privilege).

Which two role assignments should you configure? (Select two.)

A production virtual machine in your Azure environment is experiencing severe operating system corruption after a patch installation. You must restore the virtual machine from a recent backup point. The recovery process must preserve the virtual machine's existing network interface card (NIC), internal IP address configurations, and resource identifiers to avoid breaking connections with other services.

Which of the following steps are required to achieve this goal using the most direct restore method? (Select two.)

An Azure administrator is configuring virtual network routing. The environment contains a virtual network named `VNet-Frontier` ($10.80.0.0/16$) with three subnets:
- `Subnet-Web` ($10.80.1.0/24$)
- `Subnet-App` ($10.80.2.0/24$)
- `Subnet-Security` ($10.80.100.0/24$)

A Network Virtual Appliance (NVA) named `NVA-01` is deployed in `Subnet-Security` and is assigned the private IP address $10.80.100.4$. You need to ensure that all traffic from `Subnet-Web` to `Subnet-App` is routed through `NVA-01`. All other traffic from `Subnet-Web` must route normally using the default system routes.

Which two actions should you perform to meet the requirements? (Select TWO.)

An administrator is designing a public Azure Load Balancer named LB1 to distribute internet traffic to two virtual machines named VM1 and VM2. VM1 and VM2 are standalone virtual machines deployed in the same virtual network and are not associated with any availability set or virtual machine scale set. The administrator creates a Standard SKU public IP address named PIP1 to serve as the frontend IP configuration for the load balancer. Which configuration must the administrator choose for LB1 to successfully implement this solution?

An administrator is configuring a new Azure Monitor Action Group to notify the operations team. Which of the following notification types are supported directly within an Azure Monitor Action Group? (Select TWO).

An administrator configures an Azure Firewall Policy to secure outbound traffic from a virtual network subnet. A virtual machine named VM1 is deployed in the subnet and is routed to the firewall using a user-defined route (UDR) for $0.0.0.0/0$.

The administrator wants to allow outbound HTTPS traffic from VM1 to `*.github.com` while blocking all other outbound HTTPS traffic.

The Firewall Policy currently contains the following rule collections:
* A network rule collection named Net-RC (Priority 200) containing a rule that allows outbound TCP traffic on port 443 from VM1 to any destination ($*$).
* An application rule collection named App-RC (Priority 100) containing a rule that allows outbound HTTPS traffic from VM1 to the target FQDN `*.github.com`.

During testing, the administrator observes that VM1 can successfully establish HTTPS connections to both `https://github.com` and `https://example.com`.

Which configuration change should the administrator implement to ensure that VM1 can only access `*.github.com` over HTTPS?

An administrator needs to monitor access requests to an Azure Key Vault named KV1. The administrator must write a Kusto Query Language (KQL) query in a Log Analytics workspace to identify all key retrieval operations that resulted in an HTTP status code of 401 (Unauthorized) within the past 24 hours. The administrator also needs to ensure that KV1 is configured to send the necessary log data to the workspace.

Which of the following actions or query fragments must be implemented to achieve this goal? (Select TWO)

An administrator manages an Azure subscription that includes a resource group named rg-ecommerce-prod. The resource group contains an Azure Container Registry named acrprodregistry and an Azure Key Vault named kvecommerceprod. The administrator applies a tag named 'CostCenter: Finance' and a CanNotDelete resource lock to rg-ecommerce-prod. Additionally, the administrator applies a ReadOnly resource lock directly to kvecommerceprod. The administrator attempts to delete acrprodregistry, add a new secret to kvecommerceprod, and query the container registry's cost by filtering for the 'CostCenter: Finance' tag. Which of the following describes the outcomes of these actions?

An administrator needs to use Azure Storage Explorer from an on-premises workstation to download files from a blob container named `securedocs`. The host storage account `stproddata` is configured with public network access restricted to 'Enabled from selected virtual networks and IP addresses'. The administrator must connect to the specific blob container with minimum required permissions. Move the steps to the active area and arrange them in the correct sequence to achieve this goal.

You need to configure diagnostic settings for several Azure resources to meet specific logging and compliance requirements. Match each administrative requirement to its correct Azure Monitor diagnostic destination. Which diagnostic destination matches each requirement?