Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 941Soru →

You are designing deployments for Azure Container Instances (ACI) to host various workloads. You must configure the correct lifecycle management settings for each container group. Match each container workload scenario with the most appropriate container group restart policy.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A containerized API gateway that routes incoming HTTP requests to backend microservices and must be highly available.
A nightly data processing container that processes logs and must retry execution if it terminates with a non-zero exit code.
A one-time database schema migration script container that should never be re-run if it exits, regardless of the exit code, to prevent data corruption.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The API gateway matches the Always restart policy, the nightly log processing container matches the OnFailure restart policy, and the database schema migration script matches the Never restart policy.
The correct matches align with Azure Container Instances lifecycle designs. API gateways are long-running and require 'Always' to ensure continuous availability. Nightly data processors are run-to-completion tasks that should only rerun in the event of an abnormal exit, making 'OnFailure' the ideal configuration. Schema migrations are sensitive, one-time actions that must not restart under any circumstance, mapping to 'Never'.

Adım Adım Çözüm

1
Analyze the execution lifecycle of the workload scenarios.
The API gateway requires continuous runtime, whereas the log processing and migration scripts are run-to-completion tasks.
This helps categorize which workloads require persistent availability versus temporary execution.
2
Determine the required restart behavior in the event of an exit or error.
The API gateway must always be running. The log processor needs to recover only from errors. The migration script must never rerun.
Matching specific failure behaviors ensures cost efficiency and data safety.
3
Map the scenarios to Azure Container Instances restart policies.
Continuous services map to Always. Tasks retrying on error map to OnFailure. Safe one-time runs map to Never.
This satisfies the business and technical requirements using ACI-native configurations.

Anahtar Kavram

Azure Container Instances (ACI) restart policies govern the lifecycle behavior of container groups based on their workload type (Always, Never, or OnFailure).
Tahmini Süre:1m 35s
Soru 942Soru →

A company runs a production server named `vm-prod-east` in the East US region. The server is backed up to a Recovery Services vault that has geo-redundant storage (GRS) and Cross-Region Restore (CRR) enabled. Following a disaster in the primary region, the operations team needs to restore the virtual machine to the paired secondary region (West US).

Which sequence of actions should the operations team perform to complete this restore?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To perform a Cross-Region Restore (CRR) of an Azure Virtual Machine, the administrator must first open the Backup center and choose to restore a virtual machine. Next, select the backup instance and set the recovery region to the secondary region. Then, choose a recovery point, configure the target resource group, virtual network, subnet, and staging storage account in the secondary region, and finally trigger the restore job.
The correct sequence begins by accessing the Backup center and selecting the restore option for Azure Virtual Machines. The administrator then selects the specific backup instance and switches the recovery region to the secondary region. Next, a valid recovery point from the secondary region is chosen. Once the point is selected, the target resources (Resource Group, VNet, subnet, and staging storage account) within the secondary region must be specified. Finally, the restore job is triggered to deploy the VM.

Adım Adım Çözüm

1
Locate and initiate restore in Backup center
The restore wizard starts, targeting Azure Virtual Machines.
Accessing the restore wizard is the entry point for recovery tasks.
2
Select the target backup instance and switch to the secondary region
The wizard switches focus to the geo-replicated backup data in the secondary region.
Cross-Region Restore retrieves data replicated to the paired region.
3
Choose a valid recovery point
The specific backup state to restore is selected.
A restore point must be selected before configuring destination resources, as settings depend on the disk configurations of that point.
4
Define target configuration settings in the secondary region
Resource group, virtual network, subnet, and staging storage account are specified.
The restored VM requires a hosting environment in the secondary region, and a staging account is required to copy the disks.
5
Validate settings and trigger the restore job
The backup service begins restoring the VM to the secondary region.
Finalizing the inputs initiates the automated deployment job.

Anahtar Kavram

Cross-Region Restore (CRR) for Azure Virtual Machines
Tahmini Süre:2m 0s
Soru 943Soru →

A company is migrating an internal reporting application to Azure App Service. The migration team has identified the following requirements for the hosting environment:
- The application must be accessible securely using a custom domain name and a custom SSL certificate.
- The application must be automatically backed up once every 24 hours to prevent data loss.
- The application runs on a single dedicated instance and does not require automatic horizontal scaling.

You need to recommend the most cost-effective App Service plan tier that meets all requirements.

Which App Service plan tier should you recommend?

Cevabı ve açıklamayı göster

Cevap: Standard (S1)

Cevap

Standard (S1) tier
The Standard (S1) tier is correct because it is the most cost-effective dedicated App Service plan tier that supports custom SSL certificates (SNI or IP-based) and the Backup and Restore feature, which allows up to 10 backups per day.

Adım Adım Çözüm

1
Analyze the requirements: custom domain with SSL, automated backups once per 24 hours, and a single dedicated instance.
Identify that the hosting plan must be a dedicated tier that supports SSL bindings and the Backup and Restore feature.
This rules out non-dedicated or basic tiers that lack these features.
2
Evaluate the capabilities of the available pricing tiers against the requirements.
The Shared (D1) tier is ruled out because it lacks SSL bindings, backups, and dedicated compute. The Basic (B1) tier is ruled out because it lacks the built-in backup and restore capability.
Each of these tiers fails to satisfy at least one required capability.
3
Determine the most cost-effective option among the remaining compliant tiers (Standard and Premium V3).
Standard (S1) is the lowest-priced tier that offers dedicated instances, SSL bindings, and automated backups (up to 10 backups per day). Premium V3 (P1v3) also supports these features but at a higher cost.
To minimize cost while meeting all requirements, the lowest-priced compliant tier must be chosen.

Anahtar Kavram

Selecting the most cost-effective App Service plan tier that supports dedicated compute, custom SSL bindings, and automated backups.
Tahmini Süre:1m 30s
Soru 944Soru →

A company has a critical virtual machine named VM-Finance backed up to a Recovery Services vault. To perform a disaster recovery drill, the IT team needs to deploy an exact copy of VM-Finance in a separate resource group while keeping the original virtual machine online and unaffected. Which restore option should they select in the Azure portal?

Cevabı ve açıklamayı göster

Cevap: Create new

Cevap

Create new
The 'Create new' option allows the deployment of a new virtual machine using the configuration and disks from the selected restore point. This meets the requirement of creating a copy in a separate resource group without affecting the original running virtual machine.

Adım Adım Çözüm

1
Identify the goal of the recovery process.
A duplicate virtual machine needs to be created in a separate resource group while the original remains active and untouched.
This requirement determines whether to overwrite the existing virtual machine or deploy a new instance.
2
Evaluate the available Azure VM restore options.
The option to create a new virtual machine provisions a new instance from the backup, whereas replacing the existing VM overwrites it, and restoring disks only copies the disk files.
Understanding the function of each restore option helps select the one that deploys a new VM.
3
Select the option that meets the requirements.
The 'Create new' restore option is chosen.
It successfully deploys a copy of the VM without impacting the original running production VM.

Anahtar Kavram

Azure Virtual Machine Recovery Options
Soru 945Soru →

An administrator needs to analyze subscription activity logs in a Log Analytics workspace. The administrator wants to identify all resource deletion operations that failed within the last 77 days. The results must be grouped by the user or service principal that initiated the operation (the caller) and show the count of failed deletions. Which two of the following Kusto Query Language (KQL) queries will retrieve the required information?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue contains "delete" and ActivityStatusValue == "Failed" | summarize count() by Caller; AzureActivity | where TimeGenerated >= ago(7d) | where OperationNameValue has "delete" | where ActivityStatusValue =~ "failed" | summarize count() by Caller

Cevap

The queries that retrieve the correct results use the where operator to filter records from the last 77 days, filter the operation name and status appropriately, and use the summarize operator to group the counts by caller.
The queries that use the where operator to filter by time, contains or has operators for the deletion operation, and the case-insensitive equality operator =~ or case-sensitive == to check for failed status, followed by the summarize count() by Caller clause are correct. In KQL, contains is a case-insensitive string operator, and has looks for full token matches (also case-insensitive). The =~ operator compares strings in a case-insensitive manner, making it valid for matching 'failed' regardless of its casing.

Adım Adım Çözüm

1
Filter records from the AzureActivity table based on the time range of the last 77 days.
Using where TimeGenerated > ago(7d) or where TimeGenerated >= ago(7d) retrieves only the records created in the target time frame.
This limits the query scope to improve performance and satisfy the time range requirement.
2
Apply filter operators to select only failed delete operations.
Using where OperationNameValue contains "delete" (or has "delete") combined with ActivityStatusValue == "Failed" (or ActivityStatusValue =~ "failed") restricts results to the targeted event types.
This ensures only failed resource deletions are included in the aggregation.
3
Aggregate the filtered results by the caller identity.
Using summarize count() by Caller groups the remaining rows by the Caller column and calculates the count of operations.
KQL requires the summarize operator for aggregations rather than SQL's group by syntax.

Anahtar Kavram

Writing and structure of KQL queries using Azure Activity logs
Soru 946Soru →

An administrator is configuring a single Azure Application Gateway v2 in a hub virtual network named VNet-Hub. The backend pool of the Application Gateway is configured to use the fully qualified domain names (FQDNs) web1.private.contoso.com and web2.private.contoso.com of two web servers.

The web servers are deployed in a spoke virtual network named VNet-Spoke1, which is peered with VNet-Hub using default peering settings. A private DNS zone named private.contoso.com contains the host records for the web servers and is linked to VNet-Spoke1.

The administrator notices that the backend health status for the servers is reported as Unhealthy due to a DNS resolution error.

What should the administrator do to ensure the Application Gateway can successfully resolve the FQDNs of the backend servers?

Cevabı ve açıklamayı göster

Cevap: Link the private DNS zone to the hub virtual network.

Cevap

Link the private DNS zone to the hub virtual network.
The correct answer is correct because Azure Private DNS zones require a Virtual Network Link to each virtual network that needs to resolve records within that zone. Since the private DNS zone is only linked to the spoke virtual network, the Application Gateway in the hub virtual network cannot resolve the fully qualified domain names (FQDNs) of the backend servers. Linking the private DNS zone to the hub virtual network resolves this name resolution issue.

Adım Adım Çözüm

1
Identify the cause of the failure as a DNS resolution error on the Application Gateway backend pool.
The Application Gateway resides in the hub virtual network, which by default cannot resolve records in private DNS zones unless linked.
Azure Application Gateway v2 uses the DNS settings of its virtual network to resolve backend FQDNs.
2
Link the private DNS zone to the hub virtual network where the Application Gateway is deployed.
The hub virtual network becomes associated with the private DNS zone.
This allows the Azure-provided DNS service inside the hub virtual network to resolve records in that private DNS zone.
3
Verify that backend health probes succeed and the status changes to Healthy.
The Application Gateway successfully routes traffic to the backend servers.
Name resolution succeeds, allowing the gateway to reach the backend servers via their FQDNs.

Anahtar Kavram

Azure Private DNS Zone Virtual Network Links
Tahmini Süre:2m 0s
Soru 947Soru →

You plan to configure a Standard SKU public Azure Load Balancer named LB1. LB1 will distribute incoming internet traffic to two virtual machines named VM1 and VM2. VM1 and VM2 are standalone virtual machines deployed in the same virtual network, and they are not part of an Availability Set or Virtual Machine Scale Set. You need to configure the frontend IP address and the backend pool for LB1. Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Standard SKU public IP address and associate it with the frontend IP configuration of LB1.; Add the network interfaces of VM1 and VM2 directly to the backend pool of LB1.

Cevap

To configure a Standard SKU public load balancer for standalone virtual machines, you must create a Standard SKU public IP address for the frontend configuration, and you can add the network interfaces of the virtual machines directly to the backend pool.
For a Standard SKU public load balancer, the frontend IP address configuration must use a Standard SKU public IP address. Additionally, the Standard SKU load balancer allows standalone virtual machines within the same virtual network to be added directly to the backend pool via their network interfaces (NICs). Placing the virtual machines in an availability set or virtual machine scale set is not required.

Adım Adım Çözüm

1
Select the appropriate public IP address SKU for the Standard Load Balancer.
A Standard SKU public IP address is selected, as Standard Load Balancers do not support Basic SKU public IP addresses.
Azure requires matching SKUs between the public IP resource and the load balancer resource.
2
Determine how standalone virtual machines can be added to the backend pool of a Standard Load Balancer.
The network interfaces of VM1 and VM2 can be directly associated with the backend pool.
Standard SKU Load Balancers support adding any virtual machines from the same virtual network to the backend pool, unlike Basic SKU Load Balancers which require the VMs to belong to an Availability Set or Virtual Machine Scale Set.

Anahtar Kavram

SKU compatibility and configuration rules for Standard Azure Load Balancers.
Soru 948Soru →

An enterprise manages cloud resources within a resource group named `rg-analytics`. The resource group contains a storage account named `stdatahub`, which hosts a private blob container named `raw-telemetry`. A Microsoft Entra ID security group named `Data-Auditors` is currently assigned the Reader role at the resource group level. A security policy requires that members of `Data-Auditors` must be able to view and download blobs inside the `raw-telemetry` container using their Microsoft Entra ID credentials. You need to implement the principle of least privilege to grant this access. Which action should you perform?

Cevabı ve açıklamayı göster

Cevap: Assign the Storage Blob Data Reader role to the `Data-Auditors` group at the container level.

Cevap

Assign the Storage Blob Data Reader role to the `Data-Auditors` group at the container level.
Assigning the Storage Blob Data Reader role to the `Data-Auditors` group at the container level is correct because it grants data-plane read permissions for Azure Blob storage. Scoping this assignment to the specific container restricts access only to that container, satisfying the principle of least privilege.

Adım Adım Çözüm

1
Analyze the access requirement type
The requirement is to view and download blobs using Microsoft Entra ID credentials, which represents data plane access.
Control-plane roles (like Reader or Contributor) do not grant access to the underlying blob data when using Microsoft Entra ID authentication.
2
Determine the minimum privilege role for the data plane
The Storage Blob Data Reader role allows reading and downloading blob contents, which is the exact permission needed.
Other roles like Storage Blob Data Contributor or Storage Blob Data Owner grant write or delete permissions, which violates the principle of least privilege.
3
Identify the target scope for the assignment
The target scope is the container level (`raw-telemetry` container).
Assigning the role at the container level limits access to only the specific container, rather than the entire storage account or resource group.

Anahtar Kavram

Azure Storage data plane access requires dedicated Azure RBAC data roles (e.g., Storage Blob Data Reader) and should be scoped to the minimum level required (least privilege).
Soru 949Soru →

An Azure subscription contains a resource group named `RG-Compute` that contains two virtual machines named `VM-Prod1` and `VM-Prod2`. The subscription also contains a resource group named `RG-Ops` that contains a Log Analytics workspace named `LAW-Shared`. Diagnostic settings on both virtual machines are configured to send guest OS performance logs to `LAW-Shared`. The Access Control Mode of `LAW-Shared` is configured to 'Use resource or workspace permissions'. A user named Admin1 is assigned the Reader role on `RG-Compute`, but has no roles assigned on `RG-Ops` or `LAW-Shared`. Admin1 needs to run a single KQL query to compare the CPU performance metrics (`% Processor Time`) of both virtual machines over the last 12 hours. Which administrative action should Admin1 perform to execute this query successfully?

Cevabı ve açıklamayı göster

Cevap: Navigate to the `RG-Compute` blade in the Azure portal, select Logs, and run the query: `Perf | where TimeGenerated > ago(12h) and CounterName == "% Processor Time"`.

Cevap

Navigate to the resource group containing the virtual machines in the Azure portal, open the Logs pane, and execute the performance query.
The correct action is to run the query from the Resource Group's Logs blade. Because the Log Analytics workspace is configured to use resource or workspace permissions, users with read permissions to a resource (or resource group) can query logs for those resources even if they do not have direct access to the workspace. This is known as resource-context log access. When running a query from the Logs blade of a Resource Group, Azure Monitor automatically scopes the query to all resources within that Resource Group, enabling the comparison of performance metrics for both virtual machines without requiring workspace-level permissions.

Adım Adım Çözüm

1
Evaluate the Log Analytics workspace permissions model.
The workspace uses 'Use resource or workspace permissions' (resource-context). This mode allows users with read permissions to a resource to query its logs even if they have no direct access to the workspace.
To determine whether the user can retrieve logs without workspace-level permissions.
2
Determine the required resource scope to compare metrics for both virtual machines.
The scope must encompass both virtual machines, which are located in the same resource group.
To select a portal context that includes both target virtual machines.
3
Identify the portal blade that aligns with the scope and current reader permissions.
Opening Logs from the resource group blade scopes the query to all resources within that resource group.
A resource-context query initiated at the Resource Group level automatically filters and gathers logs for all resources in that group.

Anahtar Kavram

Resource-context log access and scoping in Azure Monitor
Soru 950Soru →

An administrator needs to ensure that the operations team receives an email notification whenever an Azure Virtual Machine's CPU utilization exceeds 90%.

Which Azure Monitor resource must the administrator configure to specify the email recipients for the notification?

Cevabı ve açıklamayı göster

Cevap: An action group

Cevap

An action group
The correct resource is an action group because it holds the configuration for notification methods (such as email, SMS, and push notifications) and actions (such as webhooks and automation) that execute when an alert is fired.

Adım Adım Çözüm

1
Identify the core requirement of the scenario: sending proactive notifications (emails) to a group of recipients.
Determined that the administrator needs to define the notification channels and recipients.
Alert rules determine *when* an alert fires (the condition), but not *who* is notified or *how*.
2
Evaluate the roles of the candidate Azure resources.
An action group is the specific Azure resource designed to bundle notification preferences (emails, SMS) and actions.
This decouples the alert detection logic (CPU > 90%) from the alert notification delivery logic.

Anahtar Kavram

Azure Monitor Alert Rules and Action Groups are separate entities; the rule specifies the alert criteria, whereas the action group defines the recipient list and notification types.
Tahmini Süre:45s
Soru 951Soru →

Your company's security policy requires auditing all read, write, and delete operations on blobs in a production storage account named `storeprod1`. The audit logs must be queryable using KQL and retained for exactly 365 days. You need to configure the monitoring solution while minimizing management overhead and ensuring cost-effectiveness. Which configuration should you implement?

Cevabı ve açıklamayı göster

Cevap: Configure a diagnostic setting on the `storeprod1/blobServices/default` resource to send `StorageRead`, `StorageWrite`, and `StorageDelete` logs to the `law-prod1` Log Analytics workspace, and set the data retention of `law-prod1` to 365 days.

Cevap

Configure a diagnostic setting on the `storeprod1/blobServices/default` resource to send `StorageRead`, `StorageWrite`, and `StorageDelete` logs to the `law-prod1` Log Analytics workspace, and set the data retention of `law-prod1` to 365 days.
To collect blob-level transaction logs (read, write, delete), the diagnostic setting must be configured on the service-specific sub-resource `storeprod1/blobServices/default` rather than the parent storage account. Additionally, since the retention setting in diagnostic settings has been deprecated, the 365-day retention requirement must be configured directly on the destination Log Analytics workspace (`law-prod1`).

Adım Adım Çözüm

1
Identify the correct resource scope for collecting blob storage resource logs.
The scope must be the blob service sub-resource `storeprod1/blobServices/default` rather than the parent storage account `storeprod1`.
Parent storage accounts only support metric collections, while resource logs (such as StorageRead, StorageWrite, StorageDelete) are only available at the service-specific sub-resource level.
2
Identify the correct log categories required to meet the security policy.
Select `StorageRead`, `StorageWrite`, and `StorageDelete` log categories.
These categories contain the logs for data plane read, write, and delete operations on blobs.
3
Determine how to satisfy the 365-day retention requirement.
Set the retention period on the target Log Analytics workspace `law-prod1` to 365 days.
Retention settings in diagnostic settings are deprecated and ignored. Data retention must be managed at the destination workspace level.

Anahtar Kavram

Configuring diagnostic settings for Azure Storage account resource logs and managing log retention at the destination.
Tahmini Süre:3m 0s
Soru 952Soru →

An administrator manages a Linux virtual machine named VM-Prod01 in the East US region. The virtual machine has two managed data disks and is encrypted using Azure Disk Encryption (ADE). VM-Prod01 is backed up to a Recovery Services vault that has Cross-Region Restore (CRR) enabled, with West US designated as the secondary region. Due to an extended outage in East US, the administrator needs to recover VM-Prod01 in West US as quickly as possible. Which recovery strategy should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: Restore the disks of the virtual machine to the secondary region, and then use the template or PowerShell to create the virtual machine from the restored disks.

Cevap

Restore the disks of the virtual machine to the secondary region, and then use the template or PowerShell to create the virtual machine from the restored disks.
For virtual machines encrypted with Azure Disk Encryption (ADE), Azure Backup does not support creating a new virtual machine directly from the recovery point using the portal interface. Instead, the administrator must choose to restore the disks. Once the disks are restored to the target region, the administrator must use the generated Azure Resource Manager (ARM) template or PowerShell to recreate the virtual machine from those disks. This satisfies both the ADE recovery constraint and the Cross-Region Restore (CRR) capabilities.

Adım Adım Çözüm

1
Analyze the virtual machine characteristics and backup configuration to identify restore limitations.
The VM uses Azure Disk Encryption (ADE), and recovery must occur in the secondary region (West US) using Cross-Region Restore (CRR).
ADE-encrypted VMs do not support direct VM restoration via the portal, and CRR does not support the 'Replace existing' VM restore option.
2
Evaluate the permitted recovery methods for the given configuration.
The only supported workflow is to restore the virtual machine's disks to the secondary region.
Restoring disks is the mandatory first step for recovering ADE-encrypted VMs and is fully supported under CRR.
3
Recreate the virtual machine using the restored disks.
The administrator deploys the VM in West US using the templates generated during disk restore or via PowerShell.
This completes the recovery process while maintaining the original encryption parameters.

Anahtar Kavram

Azure Virtual Machine Recovery and Restore
Tahmini Süre:2m 30s
Soru 953Soru →

You plan to deploy a containerized application to Azure Container Instances (ACI). The application is a script that processes transaction logs from an Azure Storage queue, writes the results to an Azure SQL database, and then exits. If the script exits with an error code, it must automatically restart to retry the process. If the script exits successfully, the container must stop and not restart. Which restart policy should you configure for the container group?

Cevabı ve açıklamayı göster

Cevap: OnFailure

Cevap

OnFailure
The correct answer is OnFailure because it ensures that the container will restart only if it exits with an error code (non-zero). If it exits successfully (exit code 0), it remains stopped, matching the scenario requirements.

Adım Adım Çözüm

1
Analyze the workload requirements.
The workload is a batch-like script that runs to completion, exits with code 0 upon success, and should retry (restart) only if it fails (exits with a non-zero code).
Understanding the desired container lifecycle is necessary to select the correct policy.
2
Evaluate the supported Azure Container Instances (ACI) restart policies.
ACI supports three restart policies: Always, Never, and OnFailure.
This filters out unsupported Docker-specific restart policies like UnlessStopped.
3
Select the policy that matches the required behavior.
The OnFailure policy restarts the container group only when the container processes terminate with a non-zero exit code. Always restarts the container regardless of the exit code, and Never never restarts the container. Therefore, OnFailure is the correct choice.
Applying the correct lifecycle configuration prevents continuous loop execution of successful tasks or failure to retry transient errors.

Anahtar Kavram

Azure Container Instances Restart Policies
Tahmini Süre:1m 30s
Soru 954Soru →

An administrator configures virtual network routing in an Azure subscription. The subscription contains a virtual network named `VNet-Enterprise` (172.20.0.0/16172.20.0.0/16) with three subnets:

* `Subnet-Web` (172.20.1.0/24172.20.1.0/24)
* `Subnet-App` (172.20.2.0/24172.20.2.0/24)
* `Subnet-DMZ` (172.20.10.0/24172.20.10.0/24)

A Network Virtual Appliance (NVA) named `NVA-Firewall` is deployed in `Subnet-DMZ` with the private IP address 172.20.10.10172.20.10.10. IP forwarding is enabled on the network interface of `NVA-Firewall`.

You create a user-defined route table named `RT-App` and associate it with `Subnet-App`. You configure the following custom routes in `RT-App`:

* Route 1: Address prefix: 172.20.0.0/16172.20.0.0/16; Next hop type: Virtual Appliance; Next hop IP address: 172.20.10.10172.20.10.10
* Route 2: Address prefix: 172.20.1.0/24172.20.1.0/24; Next hop type: Virtual Network

A virtual machine in `Subnet-App` (172.20.2.15172.20.2.15) attempts to establish connections to a virtual machine in `Subnet-Web` (172.20.1.50172.20.1.50) and a virtual machine in `Subnet-DMZ` (172.20.10.20172.20.10.20).

Which routing behavior will occur?

Cevabı ve açıklamayı göster

Cevap: Traffic to 172.20.1.50172.20.1.50 is routed directly via the Virtual Network; traffic to 172.20.10.20172.20.10.20 is routed through `NVA-Firewall`.

Cevap

Traffic to 172.20.1.50172.20.1.50 is routed directly via the Virtual Network, while traffic to 172.20.10.20172.20.10.20 is routed through `NVA-Firewall`.
The correct answer states that traffic to 172.20.1.50172.20.1.50 is routed directly via the Virtual Network, and traffic to 172.20.10.20172.20.10.20 is routed through `NVA-Firewall`. For the first destination, Route 2 (172.20.1.0/24172.20.1.0/24) is selected over Route 1 (172.20.0.0/16172.20.0.0/16) due to the Longest Prefix Match rule, which dictates that more specific prefixes take precedence. For the second destination, only Route 1 matches, and because it is a user-defined route, it overrides the default system route for the virtual network (172.20.0.0/16172.20.0.0/16 with next hop Virtual Network), sending the traffic to the NVA.

Adım Adım Çözüm

1
Analyze the destination IP addresses and identify matching prefixes in the route table `RT-App`.
Identify that 172.20.1.50172.20.1.50 matches both Route 1 (172.20.0.0/16172.20.0.0/16) and Route 2 (172.20.1.0/24172.20.1.0/24), while 172.20.10.20172.20.10.20 only matches Route 1 (172.20.0.0/16172.20.0.0/16).
Azure route selection evaluates all matching prefixes in the associated route table first.
2
Apply the Longest Prefix Match (LPM) rule for the destination IP 172.20.1.50172.20.1.50.
Route 2 (172.20.1.0/24172.20.1.0/24) has a longer matching prefix than Route 1 (172.20.0.0/16172.20.0.0/16). The next hop of Route 2 is 'Virtual Network', meaning the traffic bypasses the NVA and is routed directly.
When multiple routes match a destination, Azure selects the route with the most specific (longest) prefix.
3
Determine the routing path for the destination IP 172.20.10.20172.20.10.20.
Only Route 1 (172.20.0.0/16172.20.0.0/16) matches. Since Route 1 is a User-Defined Route, it overrides the system route for the virtual network (which also has a prefix of 172.20.0.0/16172.20.0.0/16). Because IP forwarding is enabled on `NVA-Firewall`, the packet is routed through the NVA.
User-Defined Routes (UDRs) override default system routes with the same prefix length when they are associated with the subnet.

Anahtar Kavram

Route selection in Azure follows the Longest Prefix Match (LPM) rule, and User-Defined Routes (UDRs) override default system routes of the same prefix length.
Soru 955Soru →

An administrator needs to copy a local folder from an on-premises workstation to an Azure Storage account named `stdata2026`. The storage account firewall is configured to allow access only from 'Selected networks', and the administrator's public IP address has been added to the allowed firewall rules. The administrator runs `azcopy login` to authenticate using a Microsoft Entra ID user account that has the Owner role on the storage account. When attempting to run `azcopy copy`, the operation fails with a '403 Authorization Failed' error.

What is the most likely cause of this failure?

Cevabı ve açıklamayı göster

Cevap: The user account is not assigned the Storage Blob Data Contributor role on the storage account.

Cevap

The user account is not assigned the Storage Blob Data Contributor role on the storage account.
Azure RBAC distinguishes between control plane operations (such as managing storage accounts) and data plane operations (such as reading or writing blobs). Even with the Owner or Contributor role at the resource scope, a user cannot read or write blob data using Microsoft Entra ID authentication without being explicitly assigned a data-plane role like Storage Blob Data Contributor.

Adım Adım Çözüm

1
Verify that network access from the workstation is allowed by checking the storage account firewall configuration.
Workstation public IP is allowed under 'Selected networks', confirming the issue is not network-level blocking.
Ensure the connection request reaches the storage service endpoints.
2
Analyze the active role assignments for the user account in Azure RBAC.
The user holds the Owner role, which grants full control plane access but does not inherit data plane rights.
Determine if the user's role includes data plane permissions.
3
Identify the missing data-plane role assignment needed for writing blobs.
The Storage Blob Data Contributor role must be assigned to grant the necessary write permissions for data movement.
Resolve the 403 Authorization Failed error by granting appropriate data-plane access.

Anahtar Kavram

Azure RBAC Control Plane vs Data Plane Separation
Soru 956Soru →

An administrator is configuring an Azure Application Gateway v2 named `AppGW1` in a subnet named `AppGWSubnet` within `VNet1`. `AppGW1` must load balance traffic for two internal web applications: `app1.contoso.com` and `app2.contoso.com`.

The backend virtual machines for both applications are deployed in a peered virtual network named `VNet2`. The virtual machines are registered using private Fully Qualified Domain Names (FQDNs) in a private DNS zone named `private.contoso.com`.

You need to ensure that `AppGW1` can resolve the backend FQDNs, route inbound traffic to the correct backend pool based on the requested domain, and maintain communication with Azure management infrastructure.

Which two configurations should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Link the private DNS zone `private.contoso.com` to `VNet1`.; Configure two multi-site listeners for `app1.contoso.com` and `app2.contoso.com`, and associate each listener with a separate basic routing rule.

Cevap

Link the private DNS zone `private.contoso.com` to `VNet1`, and configure two multi-site listeners for `app1.contoso.com` and `app2.contoso.com` with separate basic routing rules.
Linking the private DNS zone to the virtual network containing the Application Gateway ensures proper name resolution of the backend pools. Additionally, configuring multi-site listeners allows the gateway to host multiple unique domain names on a single public IP and route them to their respective backend pools.

Adım Adım Çözüm

1
Examine the DNS requirements for the backend pools.
The Application Gateway must resolve backend pool FQDNs registered in the private DNS zone. Since the gateway resides in VNet1, the private DNS zone must be linked to VNet1.
By default, virtual network peering does not share DNS resolution for Azure Private DNS Zones. A virtual network link is required for any VNet whose resources need to resolve names in that private zone.
2
Determine the type of listener needed for the custom domains.
Create two multi-site listeners: one for `app1.contoso.com` and one for `app2.contoso.com`.
A basic listener accepts traffic for any host header on a single port. Hosting multiple distinct web domains on a single public IP address requires multi-site listeners to differentiate traffic based on the requested host headers.
3
Verify network routing and security group rules for the gateway subnet.
Ensure there are no UDRs routing all outbound traffic (0.0.0.0/00.0.0.0/0) to a virtual appliance, and ensure inbound traffic from the GatewayManager service tag is allowed.
Application Gateway v2 requires direct outbound internet connectivity for health monitoring and backend responses. Blocking GatewayManager inbound traffic or routing all internet traffic via a virtual appliance breaks gateway operations.

Anahtar Kavram

Azure Application Gateway v2 listener configuration, subnet integration, and DNS link requirements for peered VNets.
Soru 957Soru →

An Azure administrator is setting up alerts to monitor resource health and performance. Which Azure Monitor alert type corresponds to each of the trigger scenarios described?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Metric alert rule
Activity log alert rule
Log search alert rule

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Metric alert rule matches the scenario evaluating numerical performance thresholds like CPU Percentage. Activity log alert rule matches the scenario evaluating control-plane resource operations like virtual machine deletions. Log search alert rule matches the scenario evaluating custom log datasets using Kusto Query Language (KQL).
Metric alerts are optimized for numeric threshold checking. Activity log alerts capture management events. Log search alerts run scheduled KQL queries on workspaces.

Adım Adım Çözüm

1
Analyze the telemetry source of the first trigger scenario.
The first scenario monitors a numeric counter over time (CPU Percentage).
Numerical performance counters are classified as metrics in Azure Monitor.
2
Analyze the telemetry source of the second trigger scenario.
The second scenario tracks management operations (deleting a virtual machine).
Administrative events and operations on resources are written to the Azure Activity Log.
3
Analyze the telemetry source of the third trigger scenario.
The third scenario evaluates log records via a KQL query.
KQL is the query language used to search Log Analytics Workspaces in Log Search alerts.

Anahtar Kavram

Azure Monitor Alert Signal Types
Tahmini Süre:1m 0s
Soru 958Soru →

An organization has two standalone virtual machines, VM-App1 and VM-App2, deployed in a single virtual network. The virtual machines are not members of an availability set or a virtual machine scale set. You are tasked with implementing a new public load balancer to distribute internet traffic to both virtual machines. Which load balancer and public IP address configuration should you deploy?

Cevabı ve açıklamayı göster

Cevap: Deploy a Standard SKU load balancer and associate it with a Standard SKU public IP address.

Cevap

Deploy a Standard SKU load balancer and associate it with a Standard SKU public IP address.
Deploying a Standard SKU load balancer associated with a Standard SKU public IP address is correct because the backend pool contains standalone virtual machines that are not part of an availability set. Standard load balancers support any virtual machines in a single virtual network as backend pool members and require Standard SKU public IP addresses.

Adım Adım Çözüm

1
Analyze backend pool members.
The target virtual machines (VM-App1 and VM-App2) are standalone and not part of an availability set or scale set.
This configuration constraint determines which load balancer SKU can support the backend pool.
2
Evaluate load balancer SKU capabilities.
Basic SKU load balancers require backend virtual machines to be in a single availability set or scale set. Standard SKU load balancers support any virtual machines in a single virtual network, including standalone VMs.
To support VM-App1 and VM-App2 as backend members, a Standard SKU load balancer must be selected.
3
Determine the required public IP address SKU.
A Standard SKU public load balancer requires a Standard SKU public IP address for its frontend configuration.
SKUs of the load balancer and the public IP address must match.

Anahtar Kavram

Azure Load Balancer SKU compatibility and backend pool constraints
Soru 959Soru →

Your Azure subscription contains a virtual network named `VNet1` that has two subnets: `Subnet-Web` and `Subnet-App`.

The network contains the following virtual machines and security configurations:
* `VM-Web1` is in `Subnet-Web` and is associated with an Application Security Group (ASG) named `ASG-Web-Front`.
* `VM-App1` is in `Subnet-App` and is associated with an ASG named `ASG-App-Logic`.
* `Subnet-Web` is associated with a Network Security Group (NSG) named `NSG-Subnet-Web`.
* `Subnet-App` is associated with an NSG named `NSG-Subnet-App`.
* The network interface (NIC) of `VM-App1` is associated with an NSG named `NSG-NIC-App1`.

Currently, the NSGs have the following custom rules:

NSG-Subnet-Web (Outbound Rules)
PrioritySourceSource PortDestinationDestination PortProtocolAction
100ASG-Web-Front*ASG-App-Logic80TCPDeny
200*****Allow
NSG-Subnet-App (Inbound Rules)
PrioritySourceSource PortDestinationDestination PortProtocolAction
150***80TCPDeny
250ASG-Web-Front*ASG-App-Logic80TCPAllow
NSG-NIC-App1 (Inbound Rules)
PrioritySourceSource PortDestinationDestination PortProtocolAction
110ASG-Web-Front*ASG-App-Logic80TCPAllow
120VirtualNetwork*Any**Deny

You need to allow `VM-Web1` to initiate outbound HTTP connections to `VM-App1` on port 80. Which two modifications should you perform to establish this connectivity?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In `NSG-Subnet-Web`, create an outbound rule with a priority of 90 that allows TCP traffic on port 80 from `ASG-Web-Front` to `ASG-App-Logic`.; In `NSG-Subnet-App`, change the priority of the inbound rule that allows traffic from `ASG-Web-Front` to 120.

Cevap

To allow the HTTP traffic, you must create a higher priority (lower number) outbound allow rule in `NSG-Subnet-Web` (priority 90) and adjust the priority of the inbound allow rule in `NSG-Subnet-App` to be lower than the inbound deny rule (priority 120).
To allow the HTTP traffic, it must be permitted at all security boundaries. First, the outbound traffic from `VM-Web1` is blocked by the outbound deny rule at priority 100 in `NSG-Subnet-Web`. Creating an outbound allow rule with a priority of 90 overrides this deny rule. Second, the inbound traffic to `VM-App1` is blocked at the subnet level by the inbound deny rule at priority 150 in `NSG-Subnet-App`. Changing the inbound allow rule's priority to 120 ensures it is evaluated first. Third, at the NIC level, the inbound traffic is already permitted because the allow rule at priority 110 takes precedence over the deny rule at priority 120.

Adım Adım Çözüm

1
Analyze the outbound traffic flow from `VM-Web1` at the subnet level.
The traffic is blocked by the custom rule with priority 100 in `NSG-Subnet-Web`. To resolve this, create an outbound allow rule with a priority number less than 100 (such as 90) to take precedence.
Lower priority numbers have higher evaluation precedence.
2
Analyze the inbound traffic flow to `VM-App1` at the subnet level.
The traffic is blocked by the custom deny rule with priority 150 in `NSG-Subnet-App`, because it is evaluated before the allow rule at priority 250. To resolve this, change the allow rule priority number to be less than 150 (such as 120).
The allow rule must be evaluated before the deny rule to permit the traffic.
3
Analyze the inbound traffic flow to `VM-App1` at the network interface (NIC) level.
The traffic is allowed by the custom rule with priority 110 in `NSG-NIC-App1`, which takes precedence over the deny rule at priority 120. No changes are required here.
Traffic is already permitted through the NIC-level NSG.

Anahtar Kavram

NSG rule evaluation order and priority ranking across subnet and network interface scopes
Soru 960Soru →

An administrator is configuring an Azure Firewall instance named `FW-01` in a virtual network named `VNet-Prod` to control outbound traffic.

The firewall has the following rule collections configured:
* Network Rule Collection `Net-Coll01` (Priority: 200): Allows TCP traffic from source `10.0.1.0/24` to any destination on port 80.
* Network Rule Collection `Net-Coll02` (Priority: 150): Denies TCP traffic from source `10.0.1.0/24` to destination `10.0.2.0/24` on all ports.
* Application Rule Collection `App-Coll01` (Priority: 100): Allows HTTP traffic from source `10.0.1.0/24` to target FQDN `*.microsoft.com`.

A virtual machine with the IP address `10.0.1.4` attempts to establish the following outbound connections:
* Connection 1: To `http://www.example.com` (which resolves to 93.184.216.3493.184.216.34 on port 80)
* Connection 2: To a web server at `10.0.2.5` on port 80

Which of the following statements correctly describe the outcome of these connection attempts? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The connection attempt to `http://www.example.com` is allowed because network rules are processed before application rules, and the traffic matches the allow rule in `Net-Coll01`.; The connection attempt to `10.0.2.5` is denied because `Net-Coll02` is processed before `Net-Coll01` due to its lower priority number.

Cevap

The connection to `http://www.example.com` is allowed because network rules take precedence over application rules and match the traffic under the broad TCP rule. The connection to `10.0.2.5` is denied because the rule collection with priority 150 takes precedence over the collection with priority 200.
The connection to `http://www.example.com` is allowed because network rules are processed before application rules. Since the network rule matches any destination on port 80, the traffic is permitted without evaluating the application rules. The connection to `10.0.2.5` is denied because the network rule collection with priority 150 is processed before the collection with priority 200, terminating the traffic before the allow rule can be evaluated.

Adım Adım Çözüm

1
Determine the rule type evaluation order for outbound traffic.
Network rules are evaluated before application rules.
Azure Firewall processes all network rules first. If a match is found in network rules, the application rules are not evaluated.
2
Evaluate the connection to `http://www.example.com` (IP 93.184.216.3493.184.216.34, port 80).
The traffic matches the allow rule in the network rule collection.
The network rule collection allows all TCP traffic on port 80 to any destination. This matches the traffic, permitting the connection and skipping application rule processing entirely.
3
Evaluate the priority of the network rule collections for the connection to `10.0.2.5`.
The network collection with priority 150 is evaluated before the one with priority 200.
Lower priority numbers represent higher precedence in Azure Firewall. The deny rule collection is processed first.
4
Determine the final action for the connection to `10.0.2.5`.
The connection is denied.
Because the deny rule at priority 150 matches the destination IP and port, the traffic is immediately dropped and processing terminates.

Anahtar Kavram

Azure Firewall processes rule collections based on type (Network rules before Application rules) and priority order (lower priority numbers represent higher precedence). Matches are terminating.
ÖncekiSayfa 48 / 63Sonraki
Tüm alıştırma soruları — Microsoft Azure Administrator (AZ-104) | Examkin