Tüm alıştırma soruları

You plan to deploy an Azure Firewall to secure outbound traffic from a subnet named Subnet-App in a virtual network named VNet-Prod. You need to configure the networking environment to allow the firewall deployment and force all outbound internet traffic from Subnet-App through the firewall. Which of the following configuration actions must you perform? (Select TWO.)

You have an Azure subscription that contains a Recovery Services vault named rsv-hr-backup in the East US 2 region. You also have a Premium storage account named sa-hr-records in the East US 2 region that hosts an SMB file share named fileshare-hr-smb.

The firewall of sa-hr-records is configured to allow access only from selected networks, and the 'Allow trusted Microsoft services to access this storage account' setting is disabled.

An administrator named Admin1 is assigned the Backup Operator role for rsv-hr-backup and has no other role assignments.

You need to ensure that Admin1 can configure backup for fileshare-hr-smb using rsv-hr-backup. Which two actions should you perform? (Select two.)

You manage three Azure virtual networks in the West US region:
* `VNet-Transit` ($172.20.0.0/16$) contains a Virtual Network Gateway configured for an ExpressRoute connection to your on-premises datacenter.
* `VNet-App` ($172.21.0.0/16$) contains virtual machines running web applications.
* `VNet-Database` ($172.22.0.0/16$) contains virtual machines running database instances.

You configure virtual network peering between `VNet-Transit` and `VNet-App`, and between `VNet-Transit` and `VNet-Database`.

You need to ensure that the virtual machines in both `VNet-App` and `VNet-Database` can connect to the on-premises datacenter through the Virtual Network Gateway in `VNet-Transit`.

Which configuration must you apply to the peering links?

An administrator is configuring the initial backup for an Azure virtual machine named `vm-prod-app01`. The virtual machine is configured as follows:

* Operating System: Red Hat Enterprise Linux 9.4
* Location: West US 3 region
* Disks: One $128\text{ GB}$ OS disk (Premium SSD v1), and two $2\text{ TB}$ data disks (Premium SSD v2)
* Virtual Network: Associated with a Network Security Group (NSG) that blocks all outbound internet access via a rule at priority $1000$

You have already deployed a Recovery Services Vault named `rsv-backup-prod01` in the West US 3 region.

You need to configure Azure Backup for `vm-prod-app01` to meet these requirements. The solution must follow the principle of least privilege and minimize administrative overhead.

Which configuration should you implement?

An administrator is configuring monitoring for an Azure Firewall named `fw-corp-prod`. The organization's security policy requires:

* Streaming all firewall activity logs to a third-party Security Information and Event Management (SIEM) system in real-time.
* Archiving the logs for $365$ days for regulatory compliance at the lowest possible storage cost.

Which configuration in the diagnostic settings of `fw-corp-prod` meets these requirements?

A company implements security policies that require all egress internet traffic from a database subnet named `DB-Subnet` to be inspected by a firewall. You deploy an Azure Firewall to the same virtual network in a subnet named `AzureFirewallSubnet`. The private IP address of the firewall is $172.16.0.4$. You need to direct all outbound internet traffic from the databases to the firewall. Which configuration should you apply to the route table associated with `DB-Subnet`?

An administrator configures virtual network peering between VNet-Hub ($10.50.0.0/16$), which contains a virtual network gateway and a deployed virtual machine, and VNet-Spoke ($10.60.0.0/16$), which has a deployed virtual machine but no gateway. The peering link from VNet-Hub to VNet-Spoke has 'Allow forwarded traffic' and 'Allow gateway transit' enabled. The peering link from VNet-Spoke to VNet-Hub has 'Allow forwarded traffic' enabled. To allow the virtual machine in VNet-Spoke to route transit traffic through the virtual network gateway in VNet-Hub, the administrator does not need to configure any additional peering settings.

You manage an Azure environment that contains a Premium storage account named sa-hr-files in the East US region. The storage account hosts an SMB file share named employeerecords. The firewall of sa-hr-files is enabled and configured to allow access only from selected virtual networks and IP addresses.

You have a Recovery Services vault named rsv-hr-backup in the East US region.

An administrator named Admin1, who has the Backup Operator role on rsv-hr-backup and the Contributor role on sa-hr-files, attempts to configure Azure Backup for the employeerecords file share. During configuration, the vault cannot discover the file share.

What configuration change should you make to ensure that the file share can be successfully backed up?

An administrator is configuring name resolution in Azure. The infrastructure includes a Private DNS zone named `corp.local` and two peered virtual networks named `VNet-Hub` and `VNet-Spoke1`. The virtual network `VNet-Hub` is linked to `corp.local` with auto-registration enabled. A virtual machine named `VM-Spoke1` is deployed in `VNet-Spoke1`. Currently, `VM-Spoke1` is unable to resolve names registered within `corp.local`. Which action should the administrator take to allow `VM-Spoke1` to resolve the DNS records?

An administrator needs to configure diagnostic settings across several Azure resources to meet specific security and troubleshooting requirements. Match each monitoring requirement to its correct Azure Monitor diagnostic log category.

You are configuring outbound internet access for virtual machines in a subnet named `Subnet-Workload`. You deploy an Azure Firewall to the same virtual network in a subnet named `AzureFirewallSubnet`. You need to ensure that all egress traffic to the internet from `Subnet-Workload` is routed through and filtered by the Azure Firewall.

Which two actions should you perform? (Select two.)

An administrator is troubleshooting traffic filtering through an Azure Firewall. The firewall is configured with the following rule collections:

- A Network rule collection named `Net-Coll1` (Priority $200$) with a rule that allows outbound TCP traffic on port $443$ from any source to any destination.
- An Application rule collection named `App-Coll1` (Priority $300$) with a rule that allows HTTPS traffic from any source to `*.microsoft.com`.

An internal virtual machine attempts to access `www.example.com` over HTTPS (TCP port $443$).

Which of the following describes how the Azure Firewall will handle this traffic request?

An administrator is configuring an Azure Monitor action group to send alert notifications to a backend API. The API is protected by Microsoft Entra ID. The administrator must ensure that the action group can authenticate securely against the API when alerts are triggered.

Which configuration must the administrator perform to support this secure notification flow?

An administrator needs to configure diagnostic settings for multiple Azure resources. Match each business monitoring requirement to its correct destination target.

An administrator needs to automate the backup configuration of a new virtual machine named `vm-hr-prod` running Windows Server 2025 in the `South Central US` region. The administrator has already installed the Azure PowerShell `Az` module.

The administrator must meet the following requirements:
1. Create a new Recovery Services Vault named `rsv-hr-prod` in the same region.
2. Set the vault context for the current PowerShell session.
3. Enable backup protection for `vm-hr-prod` using the default backup policy named `DefaultPolicy`.
4. Trigger an immediate, ad-hoc backup of `vm-hr-prod`.

Which sequence of PowerShell commands should the administrator execute? To answer, arrange the actions in the correct order.

An administrator is configuring connectivity for three virtual networks in the East US region:

* `VNet-Hub` ($10.240.0.0/16$) contains a subnet with deployed virtual machines and a Virtual Network Gateway configured for site-to-site VPN connectivity.
* `VNet-Spoke1` ($10.241.0.0/16$) contains a subnet with deployed virtual machines.
* `VNet-Spoke2` ($10.242.0.0/16$) contains a subnet with deployed virtual machines.

A virtual network peering link is established between `VNet-Hub` and `VNet-Spoke1` with 'Allow gateway transit' enabled on `VNet-Hub` and 'Use remote gateways' enabled on `VNet-Spoke1`.

A second virtual network peering link is established between `VNet-Spoke1` and `VNet-Spoke2` with 'Allow forwarded traffic' enabled on both sides.

Which of the following actions must the administrator perform to allow the virtual machines in `VNet-Spoke2` to communicate with the on-premises network via the Virtual Network Gateway in `VNet-Hub`?

You manage an Azure subscription that contains a Recovery Services vault named rsv-finance-backup and a Premium storage account named sa-finance-prod in the East US region. The storage account hosts an SMB file share named shares-finance-01. You need to protect the SMB file share by using Azure Backup. Which sequence of steps should you perform to configure the backup for this Premium SMB file share using the Recovery Services vault?

You are configuring alerts in Azure Monitor to manage and automate responses to subscription and resource events. You need to map each operational monitoring requirement to its correct Azure Monitor Action Group action type. Match each operational requirement on the left with the correct action type on the right.

You have registered a custom domain name named tailspintoys.com with a third-party domain registrar. You plan to host the DNS records for the domain in Azure DNS. You need to configure the domain delegation to Azure DNS and verify that name resolution works. Which sequence of steps should you perform?

A company deploys a Network Security Group (NSG) named `NSG-Secure`. You are tasked with configuring a diagnostic setting on `NSG-Secure` to meet the following requirements:
- Route NSG rule evaluation events to a storage account named `storeauditprod`.
- Avoid routing any performance metrics or flow logs to the storage account.
- Ensure that the configuration uses the minimum required log categories.

Which configuration should you apply to the diagnostic setting?