Tüm alıştırma soruları

1252 soru

Tüm türler1,252 Çoktan seçmeli644 Çoklu seçim429 Doğru / Yanlış47 Eşleştirme52 Sıralama80

An administrator manages an Azure virtual machine named vm-db-02 that runs Ubuntu Server. The virtual machine has one OS disk and one data disk, both configured as managed disks. The virtual machine is backed up daily to a Recovery Services vault named rsv-db-02.

A database configuration error corrupts the OS disk. The data disk contains critical transaction logs written after the last backup was taken, and these logs must be preserved.

You need to restore the virtual machine's OS disk to the state of the last backup while ensuring that the current data on the data disk is not modified or lost.

Which restore option should you select in the Recovery Services vault?

Replace existing

Create new

Restore disks

File Recovery

Cevabı ve açıklamayı göster

Cevap: Restore disks

Cevap

Select the option to restore disks from the Recovery Services vault, then swap the OS disk of the virtual machine.

The correct restore option is to restore disks. This option recovers the VM's disks as templates and VHD files to a storage account. You can then swap the OS disk of the existing VM with the restored OS disk, leaving the current data disk (and the critical transaction logs written after the backup) fully intact and attached to the VM.

Adım Adım Çözüm

Analyze the recovery requirements and constraints.

The OS disk is corrupted and must be restored to the last backup state, but the current data disk contains post-backup modifications that must be preserved.

Choosing a restore method that recreates or replaces the entire VM (such as replacing the existing VM or creating a new one) would restore the data disk to the backup time, losing all data written after the backup.

Select the Restore Disks option in the Recovery Services vault restore blade.

The OS disk file from the backup is restored to a designated Azure Storage account.

Restoring disks allows you to recover individual disk files without altering the active virtual machine configuration or overwriting active disks.

Swap the corrupted OS disk with the restored OS disk.

The virtual machine's OS disk is updated to the healthy backup state, while the existing data disk remains attached and unmodified.

This target swap operation repairs the operating system configuration while preserving the critical transaction logs written to the data disk after the backup.

Anahtar Kavram

Azure Virtual Machine Restore Options

Soru 1022Soru →

An organization deploys a two-tier application within a single Azure Virtual Network named VNet-Prod. The virtual network contains two subnets: Subnet-Frontend and Subnet-Backend.

The following resources are configured:
* VM-App is deployed in Subnet-Frontend and its network interface is associated with an Application Security Group (ASG) named ASG-App.
* VM-Data is deployed in Subnet-Backend and its network interface is associated with an ASG named ASG-Data.
* NSG-Subnet-Front is associated with Subnet-Frontend and contains the following outbound security rule:
* Priority: 150, Source: ASG-App, Destination: ASG-Data, Port: 5432, Protocol: TCP, Action: Allow
* NSG-Nic-Data is associated with the network interface of VM-Data and contains the following inbound security rules:
* Rule A: Priority 110, Source: ASG-App, Destination: Any, Port: 5432, Protocol: TCP, Action: Deny
* Rule B: Priority 120, Source: Any, Destination: ASG-Data, Port: 5432, Protocol: TCP, Action: Allow

No other custom network security group (NSG) rules are configured. Subnet-Backend has no associated NSG, and VM-App has no network interface-level NSG.

VM-App attempts to establish a TCP connection to VM-Data on port 5432.

What is the outcome of this connection attempt?

The connection is denied because the inbound Rule A in NSG-Nic-Data has a lower priority number, representing higher precedence, and matches the traffic from VM-App.

The connection is allowed because the inbound Rule B in NSG-Nic-Data has a higher priority number and specifically targets ASG-Data, overriding the more general Rule A.

The connection is allowed because the outbound rule in NSG-Subnet-Front has a higher priority value than Rule A in NSG-Nic-Data, which overrides the inbound block.

The connection is denied because the default outbound security rules in NSG-Subnet-Front block all cross-subnet traffic within the same virtual network by default.

Cevabı ve açıklamayı göster

Cevap: The connection is denied because the inbound Rule A in NSG-Nic-Data has a lower priority number, representing higher precedence, and matches the traffic from VM-App.

Cevap

The connection is denied because the inbound Rule A in NSG-Nic-Data has a lower priority number, representing higher precedence, and matches the traffic from VM-App.

The connection attempt is denied at the destination network interface level. When traffic flows from VM-App to VM-Data, it first passes through the subnet-level NSG of the source subnet (NSG-Subnet-Front), where the custom outbound rule allows it. Upon reaching the destination subnet, there is no subnet-level NSG. However, at the destination network interface level, NSG-Nic-Data is evaluated. The rules in NSG-Nic-Data are processed in priority order, where a lower priority number represents higher precedence. Rule A has a priority of 110 and Rule B has a priority of 120. Since Rule A is processed first and matches the inbound traffic (source is VM-App within ASG-App, destination port is 5432), the traffic is denied and rule evaluation stops immediately.

Adım Adım Çözüm

Evaluate the outbound traffic from VM-App.

The traffic is allowed outbound.

There is no NIC-level NSG on VM-App. The subnet-level NSG (NSG-Subnet-Front) contains a custom outbound rule with priority 150 that explicitly allows TCP traffic from ASG-App to ASG-Data on port 5432.

Evaluate the inbound traffic arriving at VM-Data.

The traffic is evaluated by NSG-Nic-Data.

The destination subnet (Subnet-Backend) has no NSG, so the traffic passes to the network interface of VM-Data, which is associated with NSG-Nic-Data.

Determine which rule in NSG-Nic-Data applies to the inbound traffic.

Rule A (Priority 110) is matched and denies the traffic.

Rules are processed in order of priority (lowest number first). Rule A (Priority 110) is evaluated before Rule B (Priority 120). Since VM-App belongs to ASG-App, Rule A matches the incoming traffic and denies it, preventing Rule B from being evaluated.

Anahtar Kavram

Network Security Group (NSG) rule evaluation flow and rule priority processing.

Soru 1023Soru →

An administrator is planning the deployment of two new web applications to Azure App Service:

* App1 is a development web app that requires custom domain support, custom SSL bindings, and must be able to scale manually to 3 instances.
* App2 is a production web app that requires up to 5 deployment slots and automated daily backups.

You need to select the most cost-effective App Service plan pricing tier for each application.

Which two pricing tiers should you select?

Geçerli olan tümünü seçin

Basic B1 for App1

Shared D1 for App1

Standard S1 for App2

Premium P1v3 for App2

Cevabı ve açıklamayı göster

Cevap: Basic B1 for App1; Standard S1 for App2

Cevap

Basic B1 for App1 and Standard S1 for App2

The correct selections are Basic B1 for App1 and Standard S1 for App2. Basic B1 is the minimum tier that supports custom SSL bindings and manual scaling up to 3 instances. Standard S1 is the minimum tier that supports deployment slots (up to 5) and daily backups, making both choices the most cost-effective options for their respective workloads.

Adım Adım Çözüm

Analyze requirements for App1.

App1 requires custom domains, custom SSL, and manual scale-out up to 3 instances. Shared D1 does not support SSL or scaling. Basic B1 supports custom domains, SSL bindings, and manual scaling up to 3 instances.

Identify the minimum tier that satisfies all requirements for App1.

Analyze requirements for App2.

App2 requires up to 5 deployment slots and daily backups. Standard S1 is the lowest tier that offers staging slots (up to 5) and daily backups (up to 10 backups per day). Premium P1v3 also supports these features but is more expensive.

Identify the minimum tier that satisfies all requirements for App2.

Select the correct combination.

Basic B1 is selected for App1, and Standard S1 is selected for App2.

Combine the two correct, cost-effective options.

Anahtar Kavram

Selecting the most cost-effective Azure App Service plan tier based on specific features like custom domains, SSL, scaling, deployment slots, and backups.

Tahmini Süre:1m 30s

Soru 1024Soru →

You have an Azure Key Vault named `Vault1` in a production environment.

You need to implement a logging solution for `Vault1` that meets the following requirements:
1. All access attempts and operations on keys, secrets, and certificates must be recorded.
2. The collected logs must be queryable using Kusto Query Language (KQL).
3. The logs must be retained for 365 days.
4. Administrative effort and costs must be minimized.

Which two configurations should you select? (Choose two.)

Geçerli olan tümünü seçin

A diagnostic setting on `Vault1` that routes the `AuditEvent` logs to a Log Analytics workspace

A data retention period of 365 days configured on the destination Log Analytics workspace

A diagnostic setting on `Vault1` with the retention policy (days) setting configured to 365 days

A diagnostic setting on `Vault1` that routes the `AuditEvent` logs to an Azure Storage account configured with a lifecycle management policy

A diagnostic setting on `Vault1` that routes all metrics to an Azure Event Hub

Cevabı ve açıklamayı göster

Cevap: A diagnostic setting on `Vault1` that routes the `AuditEvent` logs to a Log Analytics workspace; A data retention period of 365 days configured on the destination Log Analytics workspace

Cevap

To meet the requirements, you must create a diagnostic setting on the Key Vault that routes the `AuditEvent` logs to a Log Analytics workspace, and then configure the data retention period of that destination Log Analytics workspace to 365 days.

To record operations on Key Vault assets, you must select the `AuditEvent` category. To query these logs with KQL, they must be sent to a Log Analytics workspace. Because Azure has retired the retention setting in diagnostic settings, you must configure the 365-day retention directly on the Log Analytics workspace destination.

Adım Adım Çözüm

Determine the log category needed to track Key Vault operations.

Identify the `AuditEvent` log category.

Key Vault data-plane operations on secrets, keys, and certificates are recorded under the `AuditEvent` category, not general metrics.

Identify the destination that supports Kusto Query Language (KQL).

Select a Log Analytics workspace.

Log Analytics workspaces natively support KQL querying, unlike Storage Accounts (which require external tools) or Event Hubs (which are for streaming).

Configure the 365-day retention policy in accordance with modern Azure architecture.

Set the data retention period to 365 days directly on the destination Log Analytics workspace settings.

Azure has retired the legacy retention slider within individual diagnostic settings. Retention must be managed on the target workspace.

Anahtar Kavram

Azure Monitor diagnostic settings send logs to supported destinations. When using a Log Analytics workspace for KQL analysis, log retention must be managed at the workspace level because the diagnostic setting's internal retention policy is retired.

Soru 1025Soru →

An administrator manages an Azure virtual network named VNet-Secure ( $172.16.0.0/16$ ). The virtual network contains the following subnets:

* Subnet-Web ( $172.16.1.0/24$ )
* Subnet-App ( $172.16.2.0/24$ )
* Subnet-DMZ ( $172.16.3.0/24$ )

A Network Virtual Appliance (NVA) is deployed in Subnet-DMZ and is assigned the private IP address $172.16.3.100$ .

A route table named RT-Web is associated with Subnet-Web. RT-Web contains the following user-defined routes:

* Route1: Destination prefix $172.16.2.0/24$ , Next hop type: Virtual appliance, Next hop address: $172.16.3.100$
* Route2: Destination prefix $172.16.0.0/16$ , Next hop type: Virtual network
* Route3: Destination prefix $0.0.0.0/0$ , Next hop type: Internet

A virtual machine in Subnet-Web with the IP address $172.16.1.4$ attempts to establish a connection to a database server in Subnet-App with the IP address $172.16.2.50$ .

How is the traffic from the virtual machine to the database server routed?

The traffic is routed to the Network Virtual Appliance (NVA) at 172.16.3.100 in Subnet-DMZ.

The traffic is routed directly to the database server in Subnet-App via the local virtual network routing.

The traffic is dropped because of a routing conflict between the VNet-wide local route and the specific subnet route.

The traffic is routed to the Internet gateway because the default route is processed first.

Cevabı ve açıklamayı göster

Cevap: The traffic is routed to the Network Virtual Appliance (NVA) at 172.16.3.100 in Subnet-DMZ.

Cevap

The traffic is routed to the Network Virtual Appliance (NVA) at 172.16.3.100 in Subnet-DMZ.

The correct option is the one stating the traffic is routed to the Network Virtual Appliance (NVA) at 172.16.3.100. When Azure determines how to route traffic, it evaluates all routes in the associated route table and selects the route that matches the destination IP address using the Longest Prefix Match (LPM) algorithm. In this case, the destination IP address 172.16.2.50 matches the destination prefix 172.16.2.0/24 (Route1), 172.16.0.0/16 (Route2), and 0.0.0.0/0 (Route3). Because the prefix length of Route1 (/24) is longer and more specific than the others, it is chosen, and the next hop is set to the virtual appliance at 172.16.3.100.

Adım Adım Çözüm

Identify the destination IP address of the traffic.

The destination IP address is 172.16.2.50.

Routing decisions are evaluated based on the destination IP address of the packet.

Compare the destination IP against all matching prefixes in the route table associated with Subnet-Web.

The matching routes are 172.16.2.0/24 (Route1), 172.16.0.0/16 (Route2), and 0.0.0.0/0 (Route3).

All three routes cover the destination address 172.16.2.50, so their prefix lengths must be compared.

Apply the Longest Prefix Match (LPM) rule to select the active route.

172.16.2.0/24 has a prefix length of 24, which is longer (more specific) than 16 (for 172.16.0.0/16) and 0 (for 0.0.0.0/0). Route1 is selected.

Azure routing selects the route with the longest prefix match among the matching routes.

Anahtar Kavram

Azure Longest Prefix Match (LPM) and User-Defined Route Precedence

Tahmini Süre:1m 30s

Soru 1026Soru →

An administrator is troubleshooting a web application hosted on an Azure App Service plan. The Web Server logging feature is enabled and configured to send logs to a Log Analytics workspace. The administrator needs to identify the client IP addresses that experienced server-side errors (HTTP status codes $500$ through $599$ ) over the past $24$ hours. The results must show each client IP address and the total number of failed requests, sorted in descending order of the request count. Which Kusto Query Language (KQL) query should the administrator run?

AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where ScStatus >= 500 and ScStatus < 600
| summarize RequestCount = count() by CiIP
| sort by RequestCount desc

AppServiceHTTPLogs
| summarize RequestCount = count() by CiIP, ScStatus
| sort by RequestCount desc
| where TimeGenerated > ago(24h) and ScStatus >= 500 and ScStatus < 600

AppServiceHTTPLogs
| where TimeGenerated > ago(24h) and ScStatus between (500 .. 599)
| group by CiIP
| order by count() desc

AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where ScStatus == "5*"
| summarize RequestCount = count() by CiIP
| sort by RequestCount desc

Cevabı ve açıklamayı göster

Cevap: AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where ScStatus >= 500 and ScStatus < 600
| summarize RequestCount = count() by CiIP
| sort by RequestCount desc

Cevap

The query that filters AppServiceHTTPLogs by TimeGenerated and ScStatus, summarizes by client IP, and then sorts by count in descending order.

The correct query follows the KQL pipeline structure. It first filters the AppServiceHTTPLogs table to the specified time window of

24

hours and HTTP status range (

500

599

). Next, it uses the summarize operator to group by the client IP address and calculate the total count of matching logs. Finally, it sorts the results in descending order by the aggregated request count.

Adım Adım Çözüm

Apply initial time filtering to reduce the dataset.

Filtered the AppServiceHTTPLogs table to include only records from the last

24

hours using `where TimeGenerated > ago(24h)`.

Filtering early in the query pipeline is a best practice in KQL to optimize performance and resource utilization.

Filter for HTTP status codes in the range

500

599

Added a filter using `where ScStatus >= 500 and ScStatus < 600`.

This captures all server-side error status codes (

5\text{xx}

) required by the scenario.

Group by the client IP address and calculate the request count.

Used the summarize operator: `summarize RequestCount = count() by CiIP`.

This groups the remaining records by the Client IP (`CiIP`) column and assigns the count to a new column named `RequestCount`.

Sort the aggregated results.

Added the final pipeline stage: `sort by RequestCount desc`.

This organizes the output in descending order of the calculated request count as specified.

Anahtar Kavram

KQL Query Construction and Table Schema Filtering

Soru 1027Soru →

An enterprise administrator is designing a backup strategy for several workloads deployed within a single subscription. The resources are distributed as follows:

* East US Region:
* An Azure Virtual Machine named `VM-East-Prod` with an attached managed OS disk named `Disk-OS-East`
* A storage account named `saeastfiles` hosting legacy application file shares
* A Recovery Services Vault named `RSV-East-02` configured with Locally Redundant Storage (LRS)

* West US Region:
* A Recovery Services Vault named `RSV-West-02` configured with Geo-Redundant Storage (GRS) and Cross-Region Restore (CRR) enabled

The administrator needs to implement the following backup requirements:
1. Protect the entire `VM-East-Prod` virtual machine.
2. Back up `Disk-OS-East` independently of the virtual machine lifecycle to retain dedicated disk snapshots.
3. Protect the file shares hosted in `saeastfiles`.

Which two actions should the administrator perform to achieve these goals?

Geçerli olan tümünü seçin

Configure the backup of VM-East-Prod using RSV-East-02.

Create a Backup Vault in the East US region and configure a backup policy for Disk-OS-East.

Configure the backup of VM-East-Prod using RSV-West-02.

Configure the backup of the file shares in saeastfiles using RSV-West-02.

Create a Backup Vault in the East US region, assign the Storage Blob Data Contributor role to the vault's managed identity, and configure a backup policy for the file shares in saeastfiles.

Cevabı ve açıklamayı göster

Cevap: Configure the backup of VM-East-Prod using RSV-East-02.; Create a Backup Vault in the East US region and configure a backup policy for Disk-OS-East.

Cevap

Configure the backup of VM-East-Prod using RSV-East-02, and create a Backup Vault in the East US region to configure a backup policy for Disk-OS-East.

The correct options state that VM-East-Prod should be backed up using RSV-East-02, and a Backup Vault should be created in the East US region to back up Disk-OS-East. Virtual machine backups must reside in a Recovery Services Vault within the same region (East US). In contrast, individual disk-level backups are supported by Backup Vaults, which also must reside in the same region (East US) as the disk.

Adım Adım Çözüm

Determine the vault type and regional requirements for Azure Virtual Machine backups.

Azure Virtual Machines must be backed up to a Recovery Services Vault located in the same region as the virtual machine.

VM-East-Prod resides in the East US region, meaning it must be registered with RSV-East-02. It cannot be registered directly with RSV-West-02, even if that vault is configured with Cross-Region Restore.

Determine the vault type and regional requirements for individual Azure Disk backups.

Azure Disk backup is supported by Backup Vaults, and the vault must reside in the same region as the target disks.

To back up Disk-OS-East independently of the VM lifecycle, a Backup Vault must be deployed in the East US region.

Determine the vault type and regional requirements for Azure File shares.

Azure Files backup is supported by Recovery Services Vaults in the same region as the storage account.

The file shares hosted in saeastfiles (East US) must be backed up to a Recovery Services Vault in East US (such as RSV-East-02). Backup Vaults do not support Azure Files backups.

Anahtar Kavram

Recovery Services Vault vs. Backup Vault workload compatibility and regional alignment constraints

Soru 1028Soru →

Your company has an Azure subscription containing a production resource group named RG-Prod. A web application in RG-Prod undergoes scheduled maintenance every Thursday between 03:00 and 05:00 UTC. During this maintenance window, application restarts trigger several metric-based CPU alerts. You need to ensure that these alerts are still recorded in Azure Monitor for reporting purposes, but no email or SMS notifications are sent to the operations team during the maintenance window. The solution must minimize administrative effort. Which of the following configurations should you implement?

Modify the action group configuration to include a recurring maintenance window schedule that suppresses notifications.

Configure a weekly scheduled Azure Automation runbook that disables the alert rules at 03:00 UTC and enables them at 05:00 UTC.

Create an alert processing rule scoped to RG-Prod, configure a weekly schedule for Thursday between 03:00 and 05:00 UTC, and set the action to suppress notifications.

Create an alert processing rule scoped to the action group, configure a weekly schedule for Thursday between 03:00 and 05:00 UTC, and set the action to disable the action group.

Cevabı ve açıklamayı göster

Cevap: Create an alert processing rule scoped to RG-Prod, configure a weekly schedule for Thursday between 03:00 and 05:00 UTC, and set the action to suppress notifications.

Cevap

Create an alert processing rule scoped to the resource group, configure the weekly recurrence schedule, and set the action to suppress notifications.

Creating an alert processing rule scoped to the resource group (RG-Prod) with a weekly schedule and the action set to 'Suppress notifications' is the correct solution. Alert processing rules allow you to suppress notifications on fired alerts at a specific scope during a specified time window without disabling the alert rules themselves. This ensures that the alerts are still generated and recorded in Azure Monitor history for reporting, while preventing the action groups from sending emails or SMS notifications.

Adım Adım Çözüm

Analyze the requirements to suppress notifications while ensuring alerts are still recorded.

Identify that disabling the alert rules or the action group is incorrect because alerts must still fire and be logged for reporting.

Disabling an alert rule prevents the alert from being generated at all, which fails the recording requirement.

Identify the appropriate Azure Monitor feature for post-processing alert notifications.

Determine that Alert Processing Rules (formerly Action Rules) can modify or suppress notifications for alerts after they are fired.

Alert processing rules are specifically designed to apply suppression or add action groups to fired alerts at a specific scope.

Define the scope, schedule, and action of the Alert Processing Rule.

Set the scope to the resource group (RG-Prod), configure the recurring schedule for Thursday from 03:00 to 05:00 UTC, and select 'Suppress notifications' as the action.

This satisfies the requirement of preventing notifications during the maintenance window with minimal administrative overhead and no custom automation.

Anahtar Kavram

Alert Processing Rules

Tahmini Süre:2m 0s

Soru 1029Soru →

You manage an Azure subscription that contains a Recovery Services vault named Vault1. You need to enable Azure Backup Reports to analyze historical backup storage usage and job success rates across your environment. What should you configure as the destination for the diagnostic settings of Vault1 to support these reports?

An Azure Storage account

A Log Analytics workspace

An Azure Event Hub

An Application Insights resource

Cevabı ve açıklamayı göster

Cevap: A Log Analytics workspace

Cevap

A Log Analytics workspace

Azure Backup Reports use Azure Workbooks to visualize historical backup data. This visualization requires the Recovery Services vault logs to be sent to a Log Analytics workspace.

Adım Adım Çözüm

Navigate to the Recovery Services vault in the Azure portal and open Diagnostic settings.

You access the logs configuration page.

This is where log forwarding is configured for Azure resources.

Add a diagnostic setting, select the core backup log categories, and select a Log Analytics workspace as the destination.

Diagnostic data starts streaming to the workspace.

Azure Backup Reports require data to be centralized in a Log Analytics workspace for visualization.

Anahtar Kavram

Azure Backup Reports require routing diagnostic logs from the Recovery Services vault to a Log Analytics workspace.

Tahmini Süre:1m 0s

Soru 1030Soru →

An administrator is planning the network configuration for a new Azure Kubernetes Service (AKS) cluster named aks-retail. The cluster will be deployed into an existing virtual network with an address space of $10.100.0.0/16$ . The virtual network is peered with an on-premises network that uses the $172.16.0.0/12$ address space. Due to limited available IP addresses in the $10.100.0.0/16$ range, the administrator decides to configure the cluster using Azure CNI Overlay. Which two network configuration requirements must the administrator meet when deploying this cluster?

Geçerli olan tümünü seçin

The Pod CIDR range used for the overlay network must not overlap with

10.100.0.0/16

172.16.0.0/12

The DNS service IP address must be an IP address within the Service CIDR range configured for the cluster.

The Service CIDR range must be a subnet within the

10.100.0.0/16

address space of the virtual network.

The network plugin mode must be configured as kubenet to enable the overlay network behavior.

The virtual network subnets must be configured with User-Defined Routes (UDRs) to manually route pod traffic between the nodes.

Cevabı ve açıklamayı göster

Cevap: The Pod CIDR range used for the overlay network must not overlap with $10.100.0.0/16$ or $172.16.0.0/12$ .; The DNS service IP address must be an IP address within the Service CIDR range configured for the cluster.

Cevap

The administrator must ensure that the Pod CIDR range used for the overlay network does not overlap with the virtual network or the on-premises network, and that the DNS service IP address is within the Service CIDR range configured for the cluster.

Azure CNI Overlay routes pod traffic using a private overlay network. The Pod CIDR range must be unique and must not overlap with the virtual network (

10.100.0.0/16

) or the connected on-premises network (

172.16.0.0/12

) to avoid routing errors. Additionally, the DNS service IP address must reside within the configured Service CIDR range to enable internal cluster name resolution.

Adım Adım Çözüm

Determine the network model requirements for Azure CNI Overlay.

Identify that Azure CNI Overlay requires the network plugin to be set to 'azure' and the plugin mode to 'overlay'. Nodes receive IPs from the VNet subnet, while pods receive IPs from a private Pod CIDR range.

This establishes how IP address allocation behaves and why the Pod CIDR must be distinct from the VNet and peered ranges.

Evaluate the IP overlapping rules for Pod and Service CIDRs.

Confirm that the Pod CIDR and Service CIDR ranges must not overlap with each other, the virtual network's address space (

10.100.0.0/16

), or any peered/on-premises ranges (

172.16.0.0/12

Routing conflicts will occur if pod or service IPs overlap with reachable addresses in the peered VNet or on-premises networks.

Verify DNS service IP requirements.

Ensure that the DNS service IP is configured as a single IP address located inside the Service CIDR block (usually ending in .10, but cannot be the first or last IP of the range).

CoreDNS requires an IP address within the Service CIDR to route service resolution requests inside the cluster.

Anahtar Kavram

Azure CNI Overlay network configuration in Azure Kubernetes Service (AKS)

Soru 1031Soru →

You have an Azure virtual machine named VM-AppHub that runs Windows Server 2022. VM-AppHub is configured with two network interface cards (NICs) and is backed up to a Recovery Services vault named RSV-Prod.

Due to an administrative error, VM-AppHub is deleted.

You need to restore VM-AppHub to its original state, including both NICs.

Which two actions should you perform? (Each correct answer presents part of the solution.)

Geçerli olan tümünü seçin

Restore the virtual machine disks to a storage account.

Deploy a new virtual machine from the restored disks and associate both NICs.

Use the Create virtual machine restore option in the Azure portal.

Use the Replace existing restore option in the Azure portal.

Cevabı ve açıklamayı göster

Cevap: Restore the virtual machine disks to a storage account.; Deploy a new virtual machine from the restored disks and associate both NICs.

Cevap

To restore the deleted multi-NIC virtual machine, you must restore the virtual machine disks to a storage account, and then deploy a new virtual machine from the restored disks and associate both NICs.

When restoring an Azure virtual machine that has multiple network interface cards (NICs), the standard 'Create virtual machine' option in the Azure portal is not supported because it only configures a single NIC. Additionally, because the VM has been deleted, the 'Replace existing' option cannot be used since it requires the target VM to exist. The correct procedure is to first restore the disks to a storage account. Once the disks are restored, you must deploy a new virtual machine from those disks and associate both NICs using PowerShell, Azure CLI, or a custom Resource Manager template.

Adım Adım Çözüm

Select the restore point in the Recovery Services vault and initiate the restore process.

You are presented with restore options: Create virtual machine, Replace existing, or Restore disks.

This starts the recovery workflow for the deleted virtual machine.

Select the 'Restore disks' option and specify a target storage account.

The virtual machine's disks and a deployment template are restored to the storage account.

Direct VM creation is not supported for multi-NIC VMs from the portal, so the disks must be extracted first.

Deploy a new VM using the restored disks and attach both network interfaces.

The VM is successfully recreated with its original disks and both NICs.

This completes the restoration of the VM while preserving its multi-NIC network architecture.

Anahtar Kavram

Restoring an Azure virtual machine with complex configurations (such as multiple NICs) requires restoring the disks first and then recreating the VM using templates or scripts.

Tahmini Süre:2m 0s

Soru 1032Soru →

Your company has an Azure environment with two virtual networks in the East US region:

* VNet-Core ( $10.200.0.0/16$ ), which contains a subnet named GatewaySubnet ( $10.200.1.0/24$ ) with an active Virtual Network Gateway connected to an on-premises network.
* VNet-App1 ( $10.201.0.0/16$ ), which contains a subnet named Subnet-App1 ( $10.201.2.0/24$ ) with an active virtual machine named VM1.

You establish a virtual network peering connection between VNet-Core and VNet-App1. You need to allow VM1 in VNet-App1 to access resources in the on-premises network by routing traffic through the Virtual Network Gateway in VNet-Core.

Which two configurations should you enable to meet this requirement? (Select two.)

Geçerli olan tümünü seçin

On the peering link from VNet-Core to VNet-App1, select Allow gateway transit.

On the peering link from VNet-App1 to VNet-Core, select Use the remote virtual network's gateway.

On the peering link from VNet-App1 to VNet-Core, select Allow gateway transit.

On the peering link from VNet-Core to VNet-App1, select Use the remote virtual network's gateway.

Cevabı ve açıklamayı göster

Cevap: On the peering link from VNet-Core to VNet-App1, select Allow gateway transit.; On the peering link from VNet-App1 to VNet-Core, select Use the remote virtual network's gateway.

Cevap

Enable 'Allow gateway transit' on the peering link from VNet-Core to VNet-App1, and enable 'Use the remote virtual network's gateway' on the peering link from VNet-App1 to VNet-Core.

To route traffic from a spoke virtual network through a gateway in a hub virtual network, you must enable 'Allow gateway transit' on the peering link originating from the hub virtual network (VNet-Core to VNet-App1) and enable 'Use the remote virtual network's gateway' on the peering link originating from the spoke virtual network (VNet-App1 to VNet-Core).

Adım Adım Çözüm

Identify the VNet containing the VPN gateway.

VNet-Core hosts the Virtual Network Gateway.

Gateway transit settings are directional and depend on which VNet actually possesses the physical gateway resource.

Configure the hub virtual network peering properties.

Enable 'Allow gateway transit' on the peering link from VNet-Core to VNet-App1.

This configuration allows the hub VNet to share its gateway with the peered spoke VNet.

Configure the spoke virtual network peering properties.

Enable 'Use the remote virtual network's gateway' on the peering link from VNet-App1 to VNet-Core.

This configuration instructs the spoke VNet to route external traffic through the hub's gateway.

Anahtar Kavram

Virtual Network Gateway Transit in Peered Networks

Soru 1033Soru →

An organization is deploying a new Azure Kubernetes Service (AKS) cluster to host a critical application. The corporate security policy requires that all pods receive IP addresses directly from the virtual network (`VNet1`) to facilitate direct firewall auditing of pod traffic to on-premises databases. However, the primary subnet designated for the cluster nodes, ` $10.200.1.0/24$ `, has a limited number of available IP addresses. To prevent IP address exhaustion on the node subnet while satisfying the security policy, which two configurations should the administrator implement? (Select two.)

Geçerli olan tümünü seçin

Configure the cluster to use the Azure CNI network plugin.

Specify a separate subnet in the virtual network for dynamic pod IP allocation.

Configure the cluster to use the Kubenet network plugin and set the pod CIDR to match the node subnet.

Configure the cluster to use the Azure CNI Overlay network plugin.

Cevabı ve açıklamayı göster

Cevap: Configure the cluster to use the Azure CNI network plugin.; Specify a separate subnet in the virtual network for dynamic pod IP allocation.

Cevap

Configure the cluster to use the Azure CNI network plugin and specify a separate subnet in the virtual network for dynamic pod IP allocation.

To allow firewalls to audit individual pod traffic directly, pods must have IP addresses from the Azure Virtual Network, which requires the Azure CNI plugin. To avoid IP exhaustion on the node subnet, the administrator can configure dynamic pod IP allocation. This feature allows nodes to be deployed in one subnet while pods are allocated IPs from a completely separate subnet, saving IP space on the node subnet.

Adım Adım Çözüm

Analyze the networking requirements to determine the correct network plugin.

Since the security policy requires pods to have direct, auditable virtual network IP addresses, Azure CNI must be selected. Kubenet and Azure CNI Overlay are ruled out because they use internal or private CIDR spaces that NAT or encapsulate pod traffic.

Azure CNI is required to assign pods IP addresses directly from the Azure Virtual Network.

Address the node subnet IP address limitation.

Standard Azure CNI assigns IPs from the same subnet as the nodes, leading to rapid IP exhaustion. To prevent this, dynamic pod IP allocation must be configured.

Dynamic pod IP allocation allows the deployment of nodes in one subnet and the allocation of pod IPs from a separate subnet.

Configure the dedicated pod subnet during deployment.

By specifying a separate subnet for pod allocation, nodes only consume IPs for the host VMs, preserving the node subnet's IP addresses.

Assigning a separate subnet for pod allocation optimizes IP address usage and satisfies the security policy.

Anahtar Kavram

Azure Kubernetes Service (AKS) network models and dynamic pod IP allocation configuration.

Tahmini Süre:2m 0s

Soru 1034Soru →

An administrator is configuring network security for a virtual network named VNet1 in an Azure subscription. VNet1 contains two subnets:
- Subnet-Client (IP address space: $10.100.1.0/24$ )
- Subnet-Service (IP address space: $10.100.2.0/24$ )

Subnet-Client contains VM-Client1 and VM-Client2.
Subnet-Service contains VM-App1 and VM-App2.

You create and configure the following Application Security Groups (ASGs):
- ASG-TrustedClient: Associated with the network interface of VM-Client1.
- ASG-App: Associated with the network interfaces of VM-App1 and VM-App2.

You associate a Network Security Group (NSG) named NSG-Service with Subnet-Service.

You need to configure NSG-Service to meet the following requirements:
1. Allow VM-Client1 to access VM-App1 and VM-App2 using HTTPS (TCP port $443$ ).
2. Deny all other network traffic from Subnet-Client to Subnet-Service.
3. Minimize administrative effort and adhere to the principle of least privilege.

Which of the following inbound security rules should you configure in NSG-Service? (Select two.)

Geçerli olan tümünü seçin

An inbound rule with Priority:

100

, Source: ASG-TrustedClient, Destination: ASG-App, Port:

443

, Protocol: TCP, Action: Allow

An inbound rule with Priority:

200

, Source:

10.100.1.0/24

, Destination:

10.100.2.0/24

, Port: *, Protocol: Any, Action: Deny

An inbound rule with Priority:

50

, Source:

10.100.1.0/24

, Destination:

10.100.2.0/24

, Port: *, Protocol: Any, Action: Deny

An inbound rule with Priority:

300

, Source: ASG-TrustedClient, Destination: ASG-App, Port:

443

, Protocol: TCP, Action: Allow

Cevabı ve açıklamayı göster

Cevap: An inbound rule with Priority: $100$ , Source: ASG-TrustedClient, Destination: ASG-App, Port: $443$ , Protocol: TCP, Action: Allow; An inbound rule with Priority: $200$ , Source: $10.100.1.0/24$ , Destination: $10.100.2.0/24$ , Port: *, Protocol: Any, Action: Deny

Cevap

Configure an inbound rule allowing TCP port

443

traffic from ASG-TrustedClient to ASG-App with a priority of

100

, and configure an inbound rule denying all traffic from the client subnet (

10.100.1.0/24

) to the service subnet (

10.100.2.0/24

) with a priority of

200

To allow HTTPS traffic from VM-Client1 to VM-App1/VM-App2 while blocking all other traffic from the client subnet, the allow rule must be evaluated before the deny rule. Azure NSG rules are processed in priority order, where lower numbers have higher precedence. Creating an allow rule for ASG-TrustedClient to ASG-App on port

443

with a priority of

100

, combined with a deny rule for the entire client subnet to the service subnet with a priority of

200

, ensures HTTPS traffic is allowed first and all other traffic is subsequently blocked.

Adım Adım Çözüm

Identify the traffic flow and target security groups.

The target source VM-Client1 is associated with ASG-TrustedClient, and the destination VMs (VM-App1 and VM-App2) are associated with ASG-App. Inbound HTTPS traffic uses TCP port

443

This allows using Application Security Groups (ASGs) instead of explicit IP addresses, simplifying management and following security best practices.

Define the rule allowing the required traffic.

Create an inbound rule allowing TCP port

443

traffic from ASG-TrustedClient to ASG-App, assigned with a lower priority number (e.g.,

100

Lower priority numbers have higher precedence in Azure NSG evaluation, ensuring the allow rule is evaluated first.

Define the rule blocking all other traffic from the source subnet.

Create an inbound rule denying all traffic from the source subnet (

10.100.1.0/24

) to the destination subnet (

10.100.2.0/24

) on all ports (*), assigned with a higher priority number (e.g.,

200

This blocks all remaining traffic from Subnet-Client to Subnet-Service while allowing the HTTPS traffic to pass because the allow rule is evaluated first.

Anahtar Kavram

Azure Network Security Group (NSG) rule evaluation order is based on priority numbers (lower numbers have higher precedence). Application Security Groups (ASGs) allow grouping virtual machines to simplify security rule management.

Soru 1035Soru →

You have an Azure subscription that contains a Log Analytics workspace named Workspace1 and two Recovery Services vaults named Vault1 and Vault2.

You configure diagnostic settings for both vaults to send logs to Workspace1. The configurations are as follows:
* For Vault1, you select the Azure diagnostics (legacy) option.
* For Vault2, you select the Resource specific option.

For both vaults, you enable the AddonAzureBackupJobs log category.

You need to write a Kusto Query Language (KQL) query that returns a consolidated list of all failed backup jobs from both vaults.

Which KQL query should you run?

union
(AzureDiagnostics
| where Category == "AddonAzureBackupJobs" and JobStatus_s == "Failed"
| project TimeGenerated, VaultName = VaultName_s, JobStatus = JobStatus_s),
(AddonAzureBackupJobs
| where JobStatus == "Failed"
| project TimeGenerated, VaultName, JobStatus)

union
(AzureDiagnostics
| where Category == "AddonAzureBackupJobs" and JobStatus == "Failed"
| project TimeGenerated, VaultName, JobStatus),
(AddonAzureBackupJobs
| where JobStatus == "Failed"
| project TimeGenerated, VaultName, JobStatus)

AddonAzureBackupJobs
| where JobStatus == "Failed"
| project TimeGenerated, VaultName, JobStatus

AzureDiagnostics
| where Category == "AddonAzureBackupJobs" and JobStatus_s == "Failed"
| project TimeGenerated, VaultName = VaultName_s, JobStatus = JobStatus_s

Cevabı ve açıklamayı göster

Cevap: union
(AzureDiagnostics
| where Category == "AddonAzureBackupJobs" and JobStatus_s == "Failed"
| project TimeGenerated, VaultName = VaultName_s, JobStatus = JobStatus_s),
(AddonAzureBackupJobs
| where JobStatus == "Failed"
| project TimeGenerated, VaultName, JobStatus)

Cevap

The correct query combines the legacy AzureDiagnostics table (using suffixed columns like JobStatus_s and VaultName_s for Vault1) and the dedicated AddonAzureBackupJobs table (using standard column names for Vault2) using a union operator.

The correct answer accurately queries both tables where the logs reside. Vault1 logs are stored in the AzureDiagnostics table because it uses the legacy diagnostics setting. Within this table, the columns have suffixes (JobStatus_s and VaultName_s). Vault2 logs are stored in the AddonAzureBackupJobs table because it uses the Resource-specific setting, and its columns are unsuffixed. The query merges them using a union and projects the columns to align their schemas.

Adım Adım Çözüm

Determine the destination table for Vault1 logs

Vault1 uses legacy Azure diagnostics, so its diagnostic logs are sent to the central AzureDiagnostics table. Within this table, the logs are filtered by Category == "AddonAzureBackupJobs".

Legacy mode routes all diagnostic categories to the single AzureDiagnostics table.

Identify the column naming convention for Vault1 logs in AzureDiagnostics

Fields in the legacy AzureDiagnostics table are appended with data type suffixes. The string fields JobStatus and VaultName become JobStatus_s and VaultName_s respectively.

Azure Diagnostics dynamically types and suffixes columns during ingestion.

Determine the destination table and schema for Vault2 logs

Vault2 uses Resource specific destination, so its logs are sent directly to the dedicated AddonAzureBackupJobs table. The schema columns do not have type suffixes (JobStatus and VaultName are used).

Resource-specific mode creates structured, dedicated tables for each log category.

Merge and align schemas using KQL operators

Use the union operator to combine both tables. Use the project operator on the legacy dataset to rename VaultName_s to VaultName and JobStatus_s to JobStatus so the schemas match.

Aligning schemas ensures a clean, unified dataset output for reporting.

Anahtar Kavram

Azure Backup diagnostic logging modes (Azure diagnostics vs Resource specific) and their impact on Log Analytics table routing and column schemas.

Tahmini Süre:3m 0s

Soru 1036Soru →

You have an Azure subscription that contains an Azure Virtual Network Gateway named `VNetGW1` and an Azure Storage account named `storeaudit1`.

You need to configure diagnostic logging for `VNetGW1` to meet the following requirements:
1. Stream VPN tunnel connectivity logs (`TunnelDiagnosticLog`) to an Azure Event Hub to be consumed by a third-party security information and event management (SIEM) tool.
2. Archive gateway routing logs (`RouteDiagnosticLog`) to `storeaudit1` for long-term audit compliance.
3. Minimize ingestion and storage costs by ensuring that no log data is sent to a destination where it is not required.

Which configuration should you implement to meet the requirements?

Create two diagnostic settings: one that sends TunnelDiagnosticLog to the Event Hub, and another that sends RouteDiagnosticLog to storeaudit1.

Create a single diagnostic setting that sends both TunnelDiagnosticLog and RouteDiagnosticLog to both the Event Hub and storeaudit1.

Create a single diagnostic setting that sends TunnelDiagnosticLog to the Event Hub, and configure an Azure Storage Lifecycle Management policy on storeaudit1 to import the RouteDiagnosticLog from the gateway.

Create a single diagnostic setting that sends both TunnelDiagnosticLog and RouteDiagnosticLog to storeaudit1, and assign the Storage Blob Data Reader role to the Event Hub.

Cevabı ve açıklamayı göster

Cevap: Create two diagnostic settings: one that sends TunnelDiagnosticLog to the Event Hub, and another that sends RouteDiagnosticLog to storeaudit1.

Cevap

Create two separate diagnostic settings: one to send TunnelDiagnosticLog to the Event Hub, and a second to send RouteDiagnosticLog to the storage account.

The correct configuration is to create two separate diagnostic settings. In Azure Monitor, diagnostic settings apply all selected log categories to all configured destinations. If a single diagnostic setting were used to target both the Event Hub and the storage account while selecting both log categories, both types of logs would be duplicated across both destinations. To avoid data duplication and minimize costs, each log category must be routed to its respective destination via its own dedicated diagnostic setting.

Adım Adım Çözüm

Analyze the destination and category requirements.

TunnelDiagnosticLog must be sent to the Event Hub, and RouteDiagnosticLog must be sent to the storage account.

This separation is necessary to satisfy the distinct targets required for the SIEM integration and archiving compliance.

Determine the limitation of a single diagnostic setting.

A single diagnostic setting routes all enabled log categories to all configured destinations.

Understanding this default routing behavior is critical to evaluating how data is distributed across the destinations.

Evaluate the impact of combining destinations in a single setting on the cost requirement.

Combining them would duplicate both log categories across both destinations, violating the requirement to minimize cost and avoid sending unnecessary data.

This step validates that a single setting cannot satisfy the cost-minimization constraint.

Determine the correct multi-setting configuration.

Two distinct diagnostic settings must be created, each selecting a single category and routing it to its respective destination.

Creating separate settings prevents cross-duplication of logs, ensuring cost efficiency.

Anahtar Kavram

Diagnostic settings routing behavior and multi-destination configuration

Soru 1037Soru →

An administrator is configuring access control for a Log Analytics workspace named Workspace1. The workspace collects diagnostic and performance logs from multiple Azure Virtual Machines deployed across different resource groups.

You need to ensure that application owners can run KQL queries to view log data only for their respective virtual machines. The application owners must not be able to view logs for virtual machines they do not own.

Which two actions should you perform? (Select TWO.)

Geçerli olan tümünü seçin

Configure the access control mode of Workspace1 to Use resource or workspace permissions.

Assign the Reader role to the application owners on their respective virtual machines.

Configure the access control mode of Workspace1 to Require workspace permissions.

Assign the Log Analytics Reader role to the application owners on Workspace1.

Cevabı ve açıklamayı göster

Cevap: Configure the access control mode of Workspace1 to Use resource or workspace permissions.; Assign the Reader role to the application owners on their respective virtual machines.

Cevap

Configure the access control mode of Workspace1 to 'Use resource or workspace permissions' and assign the 'Reader' role to the application owners on their respective virtual machines.

To restrict users to viewing logs only for the virtual machines they own, the workspace must be configured for resource-context access. This is done by selecting the 'Use resource or workspace permissions' access control mode. Additionally, users must be granted read access to the specific resources, which can be accomplished by assigning the Reader role at the scope of their respective virtual machines.

Adım Adım Çözüm

Determine the required access control mode for the Log Analytics workspace to support resource-specific queries.

The workspace access control mode must be set to 'Use resource or workspace permissions' (resource-context access).

This mode allows users to view logs for resources they have read access to, without needing access to the workspace itself.

Define the target scope and role for the application owners to authorize access to their logs.

Assign the Reader role to the users on the scope of their respective virtual machines.

Resource-context authorization validates the user's permissions on the actual Azure resource before returning its logs from the workspace.

Anahtar Kavram

Log Analytics Workspace Access Control Modes (resource-context vs workspace-context)

Tahmini Süre:2m 0s

Soru 1038Soru →

You support an Azure infrastructure with a hub-and-spoke virtual network topology. The hub virtual network is named `Hub-VNet` ( $10.200.0.0/16$ ) and contains a firewall appliance in subnet `FirewallSubnet` ( $10.200.1.0/24$ ) with a private IP address of $10.200.1.4$ . A spoke virtual network named `Spoke1-VNet` ( $10.1.0.0/16$ ) contains a backend processing subnet named `BackendSubnet` ( $10.1.2.0/24$ ). `Hub-VNet` and `Spoke1-VNet` are connected using virtual network peering with transit settings configured.

You must direct all outbound internet traffic from virtual machines located in `BackendSubnet` through the firewall appliance in the hub.

Which two configuration actions are required to achieve this routing behavior? (Select two.)

Geçerli olan tümünü seçin

Associate a route table with `BackendSubnet` that contains a route with the destination prefix

0.0.0.0/0

, a next hop type of Virtual appliance, and a next hop IP address of

10.200.1.4

Enable IP forwarding on the network interface of the firewall appliance in the hub.

Associate a route table with `BackendSubnet` that contains a route with the destination prefix

0.0.0.0/0

, a next hop type of Virtual Network Gateway, and a next hop IP address of

10.200.1.4

Enable IP forwarding within the subnet properties of `BackendSubnet` and `FirewallSubnet`.

Cevabı ve açıklamayı göster

Cevap: Associate a route table with `BackendSubnet` that contains a route with the destination prefix $0.0.0.0/0$ , a next hop type of Virtual appliance, and a next hop IP address of $10.200.1.4$ .; Enable IP forwarding on the network interface of the firewall appliance in the hub.

Cevap

Associate a route table with the backend subnet containing a route with the destination prefix

0.0.0.0/0

and a next hop type of Virtual appliance pointing to the firewall IP address, and enable IP forwarding on the firewall's network interface.

To route outbound internet traffic from a spoke subnet through a firewall appliance in the hub, you must create a User-Defined Route (UDR) for

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the firewall's IP address and associate it with the spoke subnet. Additionally, the firewall's network interface must have IP forwarding enabled so it can process and forward traffic intended for other destinations.

Adım Adım Çözüm

Define the custom route for outbound internet traffic.

A route table is configured with a route for destination prefix

0.0.0.0/0

pointing to the firewall appliance's private IP (

10.200.1.4

) as a Virtual appliance.

This overrides the Azure default system route for internet access (

0.0.0.0/0

) which normally routes directly to the Internet.

Associate the route table with the spoke subnet.

The route table is associated with `BackendSubnet`.

Routing tables only apply to subnets with which they are explicitly associated.

Enable IP forwarding on the network virtual appliance (NVA) network interface.

IP forwarding is enabled on the network interface (NIC) of the firewall VM.

By default, Azure VMs discard traffic they receive that is not addressed to their own IP. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Anahtar Kavram

Routing spoke traffic through a hub NVA requires a route table with a Virtual appliance next hop associated with the spoke subnet, along with enabling IP forwarding on the NVA's NIC.

Soru 1039Soru →

Your company is deploying a web application to Azure. You need to configure an Azure App Service plan that supports the following requirements:
- Configure a custom domain with a custom SSL certificate.
- Scale out the instances automatically based on CPU usage.
- Support deployment slots to perform staging testing before swapping to production.

Which of the following App Service plan pricing tiers can be used to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Standard S1

Premium P1v3

Basic B1

Shared D1

Cevabı ve açıklamayı göster

Cevap: Standard S1; Premium P1v3

Cevap

The Standard S1 and Premium P1v3 pricing tiers support custom domains, SSL certificates, autoscaling, and deployment slots.

Both the Standard S1 and Premium P1v3 pricing tiers support all three requirements: custom domains with SSL certificates, automatic scaling (autoscale) based on metrics like CPU usage, and deployment slots for staging.

Adım Adım Çözüm

Analyze the requirement for custom domains and SSL bindings.

Basic, Standard, Premium, and Isolated tiers support custom domains and SSL bindings. The Shared tier supports custom domains but does not support SSL bindings.

This rules out the Shared tier for SSL requirements.

Analyze the requirement for automatic scaling (autoscaling).

Standard, Premium, and Isolated tiers support automatic scaling based on metrics like CPU utilization. The Basic tier only supports manual scaling.

This rules out the Basic tier.

Analyze the requirement for deployment slots.

Standard (up to 5 slots), Premium (up to 20 slots), and Isolated (up to 20 slots) tiers support deployment slots. The Basic and Shared tiers do not support deployment slots.

Standard S1 and Premium P1v3 meet all requirements, including deployment slots.

Anahtar Kavram

Azure App Service pricing tier feature availability (Autoscaling, Deployment Slots, and SSL)

Soru 1040Soru →

An organization has deployed several resources across two Azure regions to support a distributed application. The current resource topology is configured as follows:

Resource Name	Resource Type	Azure Region	Resource Group
`vm-frontend`	Virtual machine	North Europe	`rg-prod-ne`
`disk-frontend-data`	Managed disk	North Europe	`rg-prod-ne`
`rsv-prod-ne`	Recovery Services vault	North Europe	`rg-prod-ne`
`stg-ne-files`	Storage account (File Share)	North Europe	`rg-data-ne`
`vm-backend`	Virtual machine	West Europe	`rg-prod-we`
`bv-prod-we`	Backup vault	West Europe	`rg-prod-we`
`db-postgres-we`	Azure Database for PostgreSQL	West Europe	`rg-data-we`

You need to configure backup for these resources. Which backup configuration is supported and will complete successfully?

Back up the virtual machine `vm-backend` to the Recovery Services vault `rsv-prod-ne` by enabling Cross-Region Restore (CRR).

Back up the managed disk `disk-frontend-data` to the Recovery Services vault `rsv-prod-ne` by assigning the Storage Blob Data Contributor role to the vault's managed identity.

Back up the virtual machine `vm-frontend` to the Recovery Services vault `rsv-prod-ne`.

Back up the Azure file share in `stg-ne-files` to the Recovery Services vault `rsv-prod-ne` while the storage account firewall is set to 'Enabled from selected networks' and the 'Allow trusted Microsoft services' exception is disabled.

Cevabı ve açıklamayı göster

Cevap: Back up the virtual machine `vm-frontend` to the Recovery Services vault `rsv-prod-ne`.

Cevap

Back up the virtual machine `vm-frontend` to the Recovery Services vault `rsv-prod-ne`.

The correct configuration is to back up the virtual machine `vm-frontend` to the Recovery Services vault `rsv-prod-ne` because both resources are in the North Europe region, and Recovery Services Vaults are the designated vault type for Azure Virtual Machine backups.

Adım Adım Çözüm

Analyze regional requirements for Azure Virtual Machine backups.

A virtual machine can only be backed up to a Recovery Services Vault that resides in the same region. `vm-frontend` and `rsv-prod-ne` are both in North Europe, which meets the regional constraint. `vm-backend` is in West Europe and cannot be backed up to `rsv-prod-ne` even if Cross-Region Restore is enabled, as CRR only governs the restore target, not the backup source.

Ensures that the initial backup copy is written locally to maintain performance and lower latency.

Determine the support matrix for Recovery Services Vaults versus Backup Vaults.

Azure Managed Disks can only be backed up to Backup Vaults. They are not supported by Recovery Services Vaults. Therefore, backing up `disk-frontend-data` to `rsv-prod-ne` is invalid regardless of RBAC permissions.

Separates legacy and VM-centric backup workloads (Recovery Services Vaults) from newer cloud-native workload types (Backup Vaults).

Evaluate network access requirements for backing up Azure File Shares.

Azure File Share backup is supported by Recovery Services Vaults in the same region. However, if the storage account hosting the file share (`stg-ne-files`) restricts network access via a firewall, the 'Allow trusted Microsoft services' exception must be checked. If disabled, the backup fails due to network authorization blocking.

Ensures that the internal Azure Backup service has data-plane access to mount the share and capture the snapshot.

Anahtar Kavram

Identifying regional constraints, vault capability matrices (Recovery Services Vault vs. Backup Vault), and storage firewall bypass configurations in Azure Backup.

Tahmini Süre:3m 0s

ÖncekiSayfa 52 / 63Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram