Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 1161Soru →

An organization deploys a hub-and-spoke network topology in Azure. The hub network (`VNet-Hub`) hosts an Azure Firewall in the subnet `AzureFirewallSubnet` with the private IP address 10.1.0.410.1.0.4. A peered spoke network (`VNet-Spoke`) hosts a workload subnet named `Subnet-App` (10.2.1.0/2410.2.1.0/24).

To comply with security guidelines, all outbound internet traffic from `Subnet-App` must be inspected by the firewall in the hub.

Which two configurations are required to meet this requirement? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a route table, add a route for 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual appliance and the next hop address set to 10.1.0.410.1.0.4, and associate the route table with `Subnet-App`.; Configure a Network rule or Application rule in the Azure Firewall to allow traffic from the source IP address range 10.2.1.0/2410.2.1.0/24 to the internet.

Cevap

To route and permit internet traffic through the firewall, you must create a route table associated with the application subnet containing a route for 0.0.0.0/0 with a next hop type of Virtual appliance pointing to the firewall's private IP, and configure a Network or Application rule in the Azure Firewall to permit the traffic.
To route outbound traffic from a subnet through an Azure Firewall, you must create a User-Defined Route (UDR) in a route table associated with the subnet. The route must specify a destination of 0.0.0.0/0 (all internet-bound traffic), a next hop type of Virtual appliance, and the private IP address of the Azure Firewall as the next hop address. Additionally, because Azure Firewall is a stateful firewall with a default-deny policy, you must configure a Network rule or an Application rule to explicitly allow the outbound traffic from the subnet to the internet.

Adım Adım Çözüm

1
Associate a custom route table with the workload subnet.
System routes for the subnet can now be overridden by User-Defined Routes (UDRs).
By default, Azure subnets route internet traffic directly. A custom route table is required to redirect this traffic.
2
Add a route to the route table with destination 0.0.0.0/0, next hop type Virtual appliance, and the firewall's private IP as the next hop address.
All outbound internet-bound traffic from the subnet is forwarded to the Azure Firewall.
The Virtual appliance next hop type tells Azure routing to send the traffic to the specified firewall IP instead of direct internet routing.
3
Add an Allow rule (Network or Application) to the Azure Firewall configuration matching the source subnet and destination.
The firewall evaluates the rule and allows the outbound traffic rather than dropping it by default.
Azure Firewall operates on a zero-trust model and drops all traffic unless an explicit allow rule is configured.

Anahtar Kavram

Configuring routing via User-Defined Routes (UDRs) and configuring rules in Azure Firewall to control traffic flow.
Tahmini Süre:1m 30s
Soru 1162Soru →

An administrator is configuring the backup and recovery strategy for an Azure virtual machine named vm-finance-prod. The virtual machine configuration is as follows:
- Region: North Europe
- OS: Windows Server 2025
- Disks: One OS disk (Premium SSD) and one data disk (Premium SSD v2)
- Vault: A Recovery Services Vault named rsv-finance is deployed in the West Europe region.

The administrator must configure the backup policy and prepare a recovery plan. The recovery plan requires that, in the event of corruption, the virtual machine should be restored by overwriting the existing virtual machine disks while maintaining the original virtual machine's resource ID and network configuration.

Which configuration changes and restore options should the administrator select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a new Recovery Services Vault in the North Europe region, configure the backup using an Enhanced policy, and select the 'Replace existing' option during recovery.

Cevap

Create a new Recovery Services Vault in the North Europe region, configure the backup using an Enhanced policy, and select the 'Replace existing' option during recovery.
The correct option addresses all three constraints of the scenario: it aligns the Recovery Services Vault to the same region as the virtual machine (North Europe), utilizes the Enhanced policy to support the Premium SSD v2 disks, and selects 'Replace existing' to overwrite the VM while keeping its network configuration and resource ID.

Adım Adım Çözüm

1
Verify region alignment.
Identify that the Recovery Services Vault must be in the same region as the source VM (North Europe).
Azure Backup requires the Recovery Services Vault and the target virtual machine to be deployed in the same region.
2
Determine backup policy type.
Select the Enhanced backup policy type.
Premium SSD v2 disks require the Enhanced backup policy, as the Standard policy only supports Standard HDD, Standard SSD, and Premium SSD (v1) disks.
3
Select recovery option.
Choose 'Replace existing' to overwrite the virtual machine.
The 'Replace existing' restore option replaces the disks of the current VM, keeping the original resource ID, NICs, and network settings intact.

Anahtar Kavram

Azure VM backup configurations require regional alignment, appropriate policy tiering for advanced disk types (Premium SSD v2), and specific restore configurations (Replace existing vs. Create new) depending on the desired recovery state.
Tahmini Süre:2m 30s
Soru 1163Soru →

You manage an Azure environment containing a Standard storage account named sa-logistics-prod in the West Europe region. The storage account hosts an SMB file share named shipments and has its firewall configured to restrict access to 'Selected networks'. Backups of the shipments file share are configured using a Recovery Services vault named rsv-logistics. An administrator named Admin1 is assigned the Backup Operator role at the resource group level. Admin1 attempts to restore files to the original location using Azure Backup but receives an access denied error. Which of the following configuration changes is required to allow the restore operation to succeed?

Cevabı ve açıklamayı göster

Cevap: Enable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of sa-logistics-prod.

Cevap

Enable the 'Allow trusted Microsoft services to access this storage account' setting on the firewall of sa-logistics-prod.
To restore files to an Azure file share where the hosting storage account restricts access to selected networks, the Azure Backup service must be allowed to bypass the firewall. Enabling the 'Allow trusted Microsoft services to access this storage account' exception on the storage account firewall grants the Azure Backup service the necessary network-level access to perform the restore. Because the administrator already holds the Backup Operator role, they have sufficient control plane rights to start the restore, but the network boundary blocks the data plane operations.

Adım Adım Çözüm

1
Analyze the error context.
The restore operation to the original location is failing with an access denied error because the Standard storage account has its firewall enabled, blocking inbound traffic from unauthorized networks.
You need to determine whether the issue is caused by insufficient RBAC permissions or network-level restrictions.
2
Evaluate Admin1's RBAC role permissions.
Admin1 has the Backup Operator role at the resource group level, which is sufficient to trigger backup and restore operations in the vault. Thus, control plane authorization is not the bottleneck.
This rules out the need to assign higher control plane privileges (like Owner) or data plane privileges to the user identity.
3
Resolve the storage account firewall block for the backup service.
By enabling the 'Allow trusted Microsoft services to access this storage account' exception on the storage account's firewall, the Azure Backup service principal can bypass the firewall to write restored data to the SMB file share.
Azure Backup acts as a trusted service to write files during restore operations, requiring this network bypass configuration.

Anahtar Kavram

Configuring firewall bypass exceptions for trusted Microsoft services to perform Azure Files restore operations.
Soru 1164Soru →

An administrator is configuring connectivity between an on-premises network and Azure resources. The environment includes the following virtual networks in the West US region:
* `VNet-Hub` (10.50.0.0/1610.50.0.0/16) contains a virtual network gateway and a virtual machine named `VM-Hub` deployed in a subnet.
* `VNet-Spoke1` (10.60.0.0/1610.60.0.0/16) contains a virtual machine named `VM-Spoke1` deployed in a subnet.

The on-premises network is connected to the virtual network gateway in `VNet-Hub` via a Site-to-Site VPN. Virtual network peering is established between `VNet-Hub` and `VNet-Spoke1`.

You need to ensure that `VM-Spoke1` can access the on-premises network through the gateway in `VNet-Hub`.

Which of the following configuration settings must be enabled to meet this requirement? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke1.; Configure 'Use remote gateways' on the peering link from VNet-Spoke1 to VNet-Hub.

Cevap

To enable spoke-to-on-premises connectivity through the hub's gateway, you must enable 'Allow gateway transit' on the peering link from the hub virtual network to the spoke, and enable 'Use remote gateways' on the peering link from the spoke virtual network to the hub.
To establish connectivity from the spoke virtual network to the on-premises network via the hub's virtual network gateway, you must configure gateway transit on the peering connection. This requires configuring 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke1 (so the hub shares its gateway) and configuring 'Use remote gateways' on the peering link from VNet-Spoke1 to VNet-Hub (so the spoke uses the hub's gateway).

Adım Adım Çözüm

1
Configure the hub-side peering link configuration
Enable 'Allow gateway transit' on the peering from VNet-Hub to VNet-Spoke1.
This allows the hub virtual network to share its virtual network gateway with the peered spoke virtual network.
2
Configure the spoke-side peering link configuration
Enable 'Use remote gateways' on the peering from VNet-Spoke1 to VNet-Hub.
This configuration allows resources in the spoke virtual network to route traffic through the hub's remote virtual network gateway to reach the on-premises network.

Anahtar Kavram

Gateway transit in virtual network peering allows peered virtual networks to share a gateway and get connectivity to on-premises networks.
Tahmini Süre:1m 30s
Soru 1165Soru →

You have an Azure subscription named Sub1 that contains a resource group named RG1.

You configure the following user role assignments in Sub1:
- User1 is assigned the Contributor role for Sub1.
- User2 is assigned the Contributor role for RG1 only.

You create an Azure Monitor action group named ActionGroup1 in RG1. You add an action to ActionGroup1 that uses the Email Azure Resource Manager Role configuration to notify the Contributor role.

You configure a metric alert rule for a virtual machine in RG1 and associate the rule with ActionGroup1.

When the metric alert triggers, which of the users will receive the email notification?

Cevabı ve açıklamayı göster

Cevap: Only User1

Cevap

Only User1
The Email Azure Resource Manager Role action in Azure Monitor action groups only sends emails to users who are assigned the selected role at the subscription scope. Since User1 has the Contributor role assigned for the entire subscription (Sub1), User1 will receive the email notification. User2's assignment is restricted to the resource group (RG1) scope and is not evaluated by this action, so User2 will not be notified.

Adım Adım Çözüm

1
Identify the scope requirements for the 'Email Azure Resource Manager Role' feature in Azure Monitor action groups.
The feature specifically requires that the selected Azure RBAC role (such as Contributor) must be assigned at the subscription scope.
Understanding this limitation is necessary to determine which users are eligible to receive emails through this action group configuration.
2
Analyze the role assignments for the two users relative to the subscription scope.
User1 is assigned the Contributor role at the subscription level (Sub1), while User2 is assigned the Contributor role at the resource group level (RG1).
This distinguishes which user's assignment meets the subscription-level scope requirement.
3
Determine which user will be notified based on their assignment scope.
Only User1 meets the criteria of holding the Contributor role at the subscription level, while User2 is excluded because their assignment is at the resource group level.
To identify the correct final list of recipients for the alert email.

Anahtar Kavram

Azure Monitor Action Groups support notifying users based on subscription-level Azure Resource Manager (ARM) roles. When using the 'Email Azure Resource Manager Role' action, emails are only sent to users who have the specified role explicitly assigned at the subscription scope. Inherited assignments or assignments made at the resource group or resource level are not evaluated.
Soru 1166Soru →

You have an Azure App Service named App1. You need to configure a diagnostic setting for App1 to meet the following requirements:
- Retain App Service HTTP logs for a minimum of 365 days at the lowest possible cost.
- Perform interactive analysis of performance metrics using Kusto Query Language (KQL) queries.
Which two destinations should you configure in the diagnostic setting? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A Log Analytics workspace; An Azure Storage account

Cevap

Configure a Log Analytics workspace for KQL query capabilities, and an Azure Storage account for low-cost, long-term 365-day retention.
Configuring a Log Analytics workspace allows you to run interactive Kusto Query Language (KQL) queries on diagnostic data. Configuring an Azure Storage account allows you to store the diagnostic logs for long-term archiving (such as 365 days) at a lower cost than active Log Analytics retention.

Adım Adım Çözüm

1
Analyze the requirement for running KQL queries.
Identify that a Log Analytics workspace is the destination that supports interactive querying using Kusto Query Language (KQL).
Log Analytics workspaces natively support Azure Monitor Logs and the KQL query engine.
2
Analyze the requirement for retaining logs for a minimum of 365 days at the lowest cost.
Identify that an Azure Storage account is the standard, most cost-effective destination for archiving diagnostic logs long-term.
Storage accounts offer the lowest cost tier (cool or archive) for storing large volumes of static log files over long periods compared to Log Analytics active retention or Event Hubs.
3
Evaluate the distractors against the requirements.
Eliminate the Event Hub (used for streaming to external SIEMs) and Recovery Services vault (used for backups, not diagnostic settings).
Neither Event Hubs nor Recovery Services vaults satisfy the requirements for direct KQL analysis and low-cost long-term log retention.

Anahtar Kavram

Azure Monitor diagnostic settings support sending platform logs and metrics to a Log Analytics workspace (for querying and analysis), an Azure Storage account (for archiving), an Event Hub (for streaming), or Azure Monitor Metrics.
Tahmini Süre:1m 30s
Soru 1167Soru →

An administrator deploys an Azure Private DNS zone named `private.contoso.com`. The zone is linked to a virtual network named `VNet1` with auto-registration enabled. The administrator then configures virtual network peering between `VNet1` and a second virtual network named `VNet2`.

Virtual machines in `VNet2` are unable to resolve the DNS records of virtual machines in `VNet1`.

Which action should the administrator perform to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Add a virtual network link from the private.contoso.com DNS zone to VNet2.

Cevap

Add a virtual network link from the private.contoso.com DNS zone to VNet2.
The correct answer is to add a virtual network link from the private DNS zone to the second virtual network. Azure Private DNS zones require a virtual network link for any virtual network that needs to resolve records within that zone. Although the two virtual networks are peered, name resolution configuration is not shared across peering links automatically.

Adım Adım Çözüm

1
Analyze the name resolution requirements for VNet2.
Identify that resources in VNet2 need to resolve records in the private.contoso.com DNS zone.
VNet2 is currently peered with VNet1 but cannot resolve records because virtual network peering does not inherit private DNS zone linkages.
2
Determine the necessary configuration to grant VNet2 access to the private DNS zone.
Recognize that a dedicated virtual network link must be established between the private DNS zone and VNet2.
Azure Private DNS zones require explicit virtual network links for resolution, even if the querying virtual network is peered with a network that is already linked.
3
Select the correct action from the choices.
Adding a virtual network link from the zone to VNet2 is the direct and native way to solve this issue.
This allows Azure's default recursive resolver (168.63.129.16) in VNet2 to query the private DNS zone directly.

Anahtar Kavram

Azure Private DNS virtual network links are required for resolution of private DNS zones, and this capability is not transitive over virtual network peering.
Soru 1168Soru →

An administrator needs to configure a diagnostic setting for an Azure Standard Load Balancer named `lb-prod-web` to analyze health probe logs. The configuration must meet the following requirements:

* Allow the team to run Kusto Query Language (KQL) queries to troubleshoot probe failures.
* Retain the log data for 180180 days.
* Minimize administrative effort and cost.

Which configuration should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: Configure the diagnostic setting to send logs to a Log Analytics workspace, and set the data retention period on the workspace to 180180 days.

Cevap

Configure the diagnostic setting to send logs to a Log Analytics workspace, and set the data retention period on the workspace to 180180 days.
To analyze logs using KQL queries, the logs must be sent to a Log Analytics workspace. Because retention settings within the diagnostic setting resource itself are deprecated and not applied to Log Analytics workspace destinations, the retention period of 180180 days must be configured on the Log Analytics workspace itself.

Adım Adım Çözüm

1
Determine the destination that supports Kusto Query Language (KQL).
A Log Analytics workspace must be used, as Azure Storage accounts and Event Hubs do not support running KQL queries directly.
The scenario requires the team to troubleshoot probe failures using KQL queries.
2
Identify where to configure data retention for the selected destination.
The retention policy must be configured on the Log Analytics workspace itself rather than the diagnostic setting.
Retention settings (the slider) within diagnostic settings are deprecated and have no effect when streaming to a Log Analytics workspace.

Anahtar Kavram

Azure Monitor Diagnostic Settings Destinations and Retention Policies
Soru 1169Soru →

An organization implements virtual machine encryption using Server-Side Encryption with Customer-Managed Keys (SSE with CMK). You are configuring backups for `vm-secops-prd01`, a virtual machine running Windows Server 2022 Datacenter in the North Europe region. The disk encryption keys for this VM reside in an Azure Key Vault named `kv-secops-vault`. You have deployed a Recovery Services Vault named `rsv-secops-backups` in the same region. To enable successful backup operations for this encrypted virtual machine, which two configurations must you apply? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a system-assigned managed identity for the Recovery Services Vault.; Grant the Recovery Services Vault's managed identity the Key Vault Crypto Service Encryption User role on the Key Vault.

Cevap

Configure a system-assigned managed identity for the Recovery Services Vault, and grant the Recovery Services Vault's managed identity the Key Vault Crypto Service Encryption User role on the Key Vault.
For virtual machines using Server-Side Encryption with Customer-Managed Keys (SSE with CMK), the backup process requires the Recovery Services Vault to access the Key Vault containing the disk encryption keys. This is achieved by enabling a system-assigned managed identity on the Recovery Services Vault and assigning it the Key Vault Crypto Service Encryption User role on the Key Vault, which grants the required wrap and unwrap key permissions.

Adım Adım Çözüm

1
Ensure the Recovery Services Vault is in the same region as the virtual machine.
The vault must be in North Europe to perform backups for the VM in North Europe.
Cross-region backups of virtual machines are not supported for standard vault backup operations.
2
Enable system-assigned managed identity on the Recovery Services Vault.
An identity is registered for the Recovery Services Vault in Microsoft Entra ID.
Azure Backup needs an identity to authenticate to Key Vault and access key encryption keys.
3
Assign the Key Vault Crypto Service Encryption User role on the Key Vault to the Recovery Services Vault's managed identity.
The vault is authorized to read, wrap, and unwrap keys in the Key Vault.
This permission allows Azure Backup to run backup and restore operations on disks encrypted with SSE with CMK.

Anahtar Kavram

Backup configuration for VMs encrypted with Server-Side Encryption using Customer-Managed Keys (SSE with CMK).
Tahmini Süre:2m 0s
Soru 1170Soru →

An administrator is designing a monitoring and alerting solution in Azure. The administrator configures an Azure Monitor metric alert rule that evaluates a metric every 11 minute and associates it with an Azure Monitor action group. The action group contains both an SMS receiver and an Email receiver to notify an engineer.

During an incident, the alert triggers and resolves repeatedly, firing exactly once every minute for a total duration of 11 hour (6060 minutes).

Which two of the following statements accurately describe the notification delivery behavior during this 11-hour period?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The engineer will receive a maximum of 1212 SMS notifications due to the rate limit of one SMS every 55 minutes.; The engineer will receive all 6060 email notifications because the volume is below the rate limit of 100100 emails per hour.

Cevap

The correct statements are that the engineer will receive a maximum of 1212 SMS notifications due to the rate limit of one SMS every 55 minutes, and they will receive all 6060 email notifications because the email volume is below the limit of 100100 emails per hour.
The correct options identify that SMS notifications are restricted by a rate limit of one SMS every 55 minutes, leading to a maximum of 1212 delivered messages in an hour. Additionally, the email limit is 100100 per hour, meaning all 6060 emails will be successfully delivered.

Adım Adım Çözüm

1
Analyze the rate limit for SMS notifications in Azure Monitor Action Groups.
SMS notifications are limited to a maximum of 11 SMS message every 55 minutes.
This is a hard rate limit imposed by Azure Monitor to prevent excessive messaging costs and spamming.
2
Calculate the maximum number of SMS notifications delivered in a 6060-minute period.
At a limit of 11 SMS per 55 minutes, the maximum delivered is 1212 SMS messages (60/5=1260 / 5 = 12).
Any additional SMS notifications triggered within the 55-minute window are dropped by the rate limiter.
3
Analyze the rate limit for email notifications and compare it with the alert frequency.
Email notifications are limited to 100100 emails per hour. Since 6060 alerts are fired in 6060 minutes, all 6060 email notifications will be delivered.
6060 emails per hour is well within the 100100 emails per hour limit.

Anahtar Kavram

Azure Monitor Action Group Rate Limits
Tahmini Süre:1m 30s
Soru 1171Soru →

An organization has a virtual network named `VNet-A` and a peered virtual network named `VNet-B`. To facilitate internal name resolution of resources, a private DNS zone named `corp.internal` has been created. The virtual machines in `VNet-A` require their DNS records to be updated automatically when they are provisioned or deleted. Virtual machines in `VNet-B` must be able to resolve names within `corp.internal`, but their records must not be automatically added to the zone. Which two configuration steps are required to achieve this goal? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Link the `corp.internal` private DNS zone to `VNet-A` with the auto-registration option enabled.; Link the `corp.internal` private DNS zone to `VNet-B` with the auto-registration option disabled.

Cevap

Link the private DNS zone to the first virtual network with auto-registration enabled, and link the private DNS zone to the second virtual network with auto-registration disabled.
To satisfy the requirements, the private DNS zone must be linked to both virtual networks because name resolution is not transitive across peered networks. Enabling auto-registration on the link to the first virtual network allows automated lifecycle tracking of its VM hostnames. Leaving auto-registration disabled on the link to the second virtual network allows name resolution from that network without registering its VM records in the zone.

Adım Adım Çözüm

1
Analyze the requirements for the first virtual network.
The first virtual network requires both name resolution and automatic registration of its virtual machines' hostnames.
This necessitates creating a virtual network link from the private DNS zone to the first virtual network with the auto-registration checkbox enabled.
2
Analyze the requirements for the second virtual network.
The second virtual network requires name resolution only, without automatic registration.
This requires creating a virtual network link from the private DNS zone to the second virtual network with the auto-registration checkbox disabled.
3
Evaluate the role of virtual network peering in private DNS resolution.
Peering does not automatically share or forward DNS resolution capabilities of linked zones to unlinked networks.
Each virtual network must have its own link to the private DNS zone to perform name resolution.

Anahtar Kavram

Azure Private DNS Zone virtual network links and auto-registration behavior
Soru 1172Soru →

You have an Azure Storage account named `storeprodlogs`. You need to configure diagnostic logging to collect read, write, and delete transaction logs for the Blob service. The configuration must meet the following requirements:

- Allow operations teams to analyze the transaction logs using Kusto Query Language (KQL) queries.
- Archive the logs to a separate storage account named `storearchive` for long-term retention.

Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create the diagnostic setting at the Blob service level (`storeprodlogs/blobServices/default`).; Select both a Log Analytics workspace and the `storearchive` storage account as destinations in the diagnostic setting.

Cevap

To meet the requirements, you must create the diagnostic setting at the Blob service level (`storeprodlogs/blobServices/default`) and select both a Log Analytics workspace and the `storearchive` storage account as the export destinations.
To capture Blob transaction logs, the diagnostic setting must be created on the Blob service sub-resource (`storeprodlogs/blobServices/default`). Additionally, to allow KQL analysis and long-term archiving, both a Log Analytics workspace and a storage account must be specified as export destinations.

Adım Adım Çözüm

1
Navigate to the Blob service sub-resource of the storage account (`storeprodlogs/blobServices/default`) in Azure.
Accessed the correct service-level resource scope for data-plane logging.
Blob, Queue, Table, and File transaction logs must be configured on their respective sub-resources, not the parent storage account.
2
Add a new diagnostic setting, select the transaction log categories (e.g., StorageRead, StorageWrite, StorageDelete), and check the boxes for Log Analytics workspace and Archive to a storage account.
Configured multiple destinations to receive the transaction logs.
A Log Analytics workspace enables KQL queries, while the target storage account (`storearchive`) archives logs for long-term retention.

Anahtar Kavram

Configuring service-level diagnostic settings for Azure Storage and routing logs to multiple diagnostic destinations.
Soru 1173Soru →

An administrator is configuring backup and restore solutions for Azure Files. The environment contains a Recovery Services vault named Vault-EastUS in the East US region, and the following three storage accounts in the same region:

* `sa-prod-smb-std`: A Standard performance storage account hosting an SMB file share named `files-smb-std`. The firewall is configured to allow access from all networks.
* `sa-prod-smb-prem`: A Premium performance storage account hosting an SMB file share named `files-smb-prem`. The firewall is configured to allow access only from selected networks.
* `sa-prod-nfs-prem`: A Premium performance storage account hosting an NFS file share named `files-nfs-prem`. The firewall is configured to allow access only from selected networks.

Which two actions must the administrator perform to successfully configure backups for the supported file shares using Vault-EastUS?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings of sa-prod-smb-prem.; Configure backups only for files-smb-std and files-smb-prem, as Azure Backup does not support backing up NFS file shares.

Cevap

Enable the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings of sa-prod-smb-prem, and configure backups only for files-smb-std and files-smb-prem as NFS file shares are not supported.
The correct actions are enabling the firewall bypass for trusted Microsoft services on the premium SMB storage account and backing up only the SMB shares. Azure Backup for Azure Files is snapshot-based and supports standard and premium SMB file shares, but it does not support NFS file shares. When a storage account firewall restricts access to selected networks, the Azure Backup service requires the 'Allow trusted Microsoft services to access this storage account' exception to be enabled to access and manage the share snapshots.

Adım Adım Çözüm

1
Identify which file shares can be backed up using Azure Backup.
Only SMB file shares (files-smb-std and files-smb-prem) are supported by Azure Backup; the NFS file share (files-nfs-prem) is unsupported.
Azure Backup for Azure Files only supports SMB file shares. NFS file shares cannot be registered or backed up using Recovery Services Vaults.
2
Determine firewall requirements for the supported SMB storage accounts.
For sa-prod-smb-prem, which has firewall rules restricting access to selected networks, the 'Allow trusted Microsoft services to access this storage account' exception must be enabled.
This allows the Azure Backup service to bypass the firewall and manage the file share snapshots. sa-prod-smb-std allows all networks, so no firewall bypass is required.
3
Verify administrator permissions for storage account registration.
Ensure the registering administrator has Contributor or Owner role on the storage accounts, not just Backup Operator.
Registering a storage account with a Recovery Services vault requires write access (control plane permissions) to configure the backup settings on the storage account itself.

Anahtar Kavram

Azure Files Backup supports SMB file shares in standard or premium storage accounts. For storage accounts with firewalls enabled, the 'Allow trusted Microsoft services to access this storage account' setting must be checked to permit Azure Backup access.
Soru 1174Soru →

Your company has three virtual networks named VNet-East (10.51.0.0/1610.51.0.0/16), VNet-Central (10.52.0.0/1610.52.0.0/16), and VNet-West (10.53.0.0/1610.53.0.0/16). Virtual machines are deployed in subnets within each of the three virtual networks. VNet-Central contains a virtual network gateway. You establish virtual network peering between VNet-East and VNet-Central, and between VNet-West and VNet-Central. The peerings are configured to allow gateway transit on VNet-Central and use remote gateways on VNet-East and VNet-West. A junior administrator reports that the virtual machines in VNet-East cannot communicate with the virtual machines in VNet-West. You need to allow virtual machines in VNet-East to communicate directly with virtual machines in VNet-West without routing through any virtual appliances or gateways. What should you do?

Cevabı ve açıklamayı göster

Cevap: Create a virtual network peering connection between VNet-East and VNet-West.

Cevap

Create a virtual network peering connection between VNet-East and VNet-West.
The correct action is to create a virtual network peering connection directly between VNet-East and VNet-West. Because Azure virtual network peering is non-transitive, VNet-East and VNet-West cannot communicate through VNet-Central, even if both are peered to it. Since the scenario specifies that no virtual appliances should be used for routing, establishing a direct peering connection is the only valid way to allow communication.

Adım Adım Çözüm

1
Analyze the virtual network architecture and current configuration.
VNet-East and VNet-West are both peered to VNet-Central (a hub-and-spoke topology), but they are not peered directly to each other.
Understanding the current topology helps identify the lack of direct or transit routing pathways.
2
Evaluate the transitivity properties of Azure Virtual Network Peering.
By default, Azure virtual network peering is non-transitive. Traffic from VNet-East cannot transit through VNet-Central to reach VNet-West, even with gateway transit settings enabled, unless a transit routing appliance (like a Network Virtual Appliance) is deployed.
This identifies why the current configuration fails to allow communication between the two spokes.
3
Determine the solution that avoids virtual appliances or gateways.
Creating a direct virtual network peering connection between VNet-East and VNet-West establishes direct VM-to-VM communication without traversing the hub or using gateways.
This satisfies the requirement to enable direct communication without using virtual appliances or gateways.

Anahtar Kavram

Azure Virtual Network Peering is non-transitive by default. To establish communication between two spoke virtual networks without a transit routing appliance in the hub, a direct virtual network peering connection must be configured between them.
Soru 1175Soru →

You manage an Azure subscription containing a Recovery Services vault named rsv-prod-east and a Premium storage account named sa-finance-east in the East US region. The storage account hosts an SMB file share named accounting-records. The firewall of sa-finance-east is configured to restrict access to selected virtual networks. You attempt to configure backup for the accounting-records file share using the rsv-prod-east vault, but the storage account is not discovered during the configuration process. What should you configure to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: In the Firewalls and virtual networks settings of sa-finance-east, select 'Allow Azure services on the trusted services list to access this storage account'.

Cevap

In the Firewalls and virtual networks settings of sa-finance-east, select 'Allow Azure services on the trusted services list to access this storage account'.
The correct option is to enable the 'Allow Azure services on the trusted services list to access this storage account' setting under the Firewalls and virtual networks configuration of the storage account. Azure Backup is a trusted service, and enabling this exception allows the Recovery Services vault to bypass the firewall rules and successfully communicate with the storage account to discover and back up the SMB file share.

Adım Adım Çözüm

1
Analyze the problem scenario
The Premium SMB file share backup configuration fails because the storage account has its firewall enabled, blocking the vault's access.
Before configuring backup, the Recovery Services vault must be able to communicate with the storage account to discover file shares.
2
Determine the firewall bypass mechanism
Identify that Azure Backup is categorized as a trusted Microsoft service.
By enabling the trusted services exception on the storage account firewall, Azure Backup can securely access the storage account over the network.
3
Select the correct configuration option
Selecting the option to allow trusted Microsoft services to access the storage account resolves the network communication issue.
This allows the vault to discover and successfully back up the SMB file share.

Anahtar Kavram

Bypassing Azure Storage firewall using trusted Microsoft services exception for backup operations
Tahmini Süre:1m 30s
Soru 1176Soru →

Your company implements a split-horizon DNS configuration in Azure. You have a public Azure DNS zone named `adventure-works.com` and an Azure Private DNS zone also named `adventure-works.com`. The Private DNS zone is linked to a virtual network named `VNet-App`.

The public DNS zone contains a CNAME record named `portal` that points to an external SaaS application.

Users on virtual machines in `VNet-App` report that they cannot resolve the name `portal.adventure-works.com`.

Which of the following actions should you perform to resolve the name resolution issue for the virtual machines in `VNet-App`?

Cevabı ve açıklamayı göster

Cevap: Create a CNAME record named portal in the Private DNS zone adventure-works.com that points to the external SaaS application.

Cevap

Create a CNAME record named portal in the Private DNS zone adventure-works.com that points to the external SaaS application.
When a virtual network is linked to an Azure Private DNS zone, all name resolution requests for that namespace from within the virtual network are handled by the Private DNS zone. If a requested record does not exist in the Private DNS zone, Azure DNS does not query the public DNS zone of the same name. Therefore, to resolve the record from the virtual network, a corresponding record must be manually created in the Private DNS zone.

Adım Adım Çözüm

1
Analyze how DNS resolution works in a split-horizon layout with Azure Private DNS.
When a virtual network is linked to an Azure Private DNS zone, all DNS queries originating from that virtual network for that namespace (e.g., adventure-works.com) are resolved exclusively by the Private DNS zone.
Azure DNS does not fall back to the public DNS zone for queries that fail to resolve in the private zone with the same name.
2
Identify where the missing DNS record needs to be created.
The CNAME record for portal must be created within the Private DNS zone adventure-works.com.
Because the private zone is the authoritative source for name resolution within VNet-App, adding the record to the private zone allows the internal VMs to resolve it.

Anahtar Kavram

In a split-horizon DNS setup, an Azure Private DNS zone is authoritative for its namespace within any linked virtual networks. Azure DNS does not query the public DNS zone of the same name if a record is not found in the private zone. Therefore, any record in the public zone that needs to be resolved from a linked virtual network must also be created in the private DNS zone.
Soru 1177Soru →

An administrator is configuring the backup and replication strategy for an Azure virtual machine named `vm-db-prod01` that runs Red Hat Enterprise Linux 8.6 in the East US region. The virtual machine has three disks: a 128 GiB Standard SSD OS disk, a 1 TiB Premium SSD data disk, and a 512 GiB Ultra Disk data disk.

The administrator must ensure that all disks are backed up and that the backups are replicated to a secondary region to support disaster recovery.

Which configuration should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: Configure a Recovery Services Vault in the East US region with Geo-redundant storage (GRS) and Cross-Region Restore enabled, and associate the virtual machine with an Enhanced backup policy.

Cevap

Configure a Recovery Services Vault in the East US region with Geo-redundant storage (GRS) and Cross-Region Restore enabled, and associate the virtual machine with an Enhanced backup policy.
The correct configuration involves deploying the Recovery Services Vault in the same region as the virtual machine (East US), enabling Geo-redundant storage (GRS) along with Cross-Region Restore (CRR) to support secondary region disaster recovery, and selecting the Enhanced backup policy tier because the virtual machine contains an Ultra Disk, which is unsupported under the Standard policy tier.

Adım Adım Çözüm

1
Determine the required region for the Recovery Services Vault.
The vault must be deployed in the East US region, matching the region of the virtual machine.
Azure Backup requires that the Recovery Services Vault resides in the same region as the virtual machines being backed up.
2
Determine the backup policy type needed to support the virtual machine's disk configurations.
Choose the Enhanced backup policy type.
The virtual machine contains an Ultra Disk. While Standard backup policies support Standard HDD, Standard SSD, and Premium SSD, they do not support Ultra Disks. The Enhanced backup policy is required to protect VMs with Ultra Disks.
3
Determine the storage replication and restore settings for the vault to support disaster recovery to a secondary region.
Configure the vault storage to use Geo-redundant storage (GRS) and enable Cross-Region Restore (CRR).
GRS replicates the backup data to a paired region, and CRR allows the administrator to perform restores in the secondary region even if the primary region is fully available.

Anahtar Kavram

Azure Virtual Machine backup configuration requires region alignment, correct storage redundancy (GRS/CRR) for cross-region disaster recovery, and policy tier selection (Enhanced vs Standard) based on disk types such as Ultra Disks.
Soru 1178Soru →

An administrator is configuring connectivity between two virtual networks named `VNet-Core` (172.16.0.0/16172.16.0.0/16) and `VNet-Branch` (172.17.0.0/16172.17.0.0/16). `VNet-Core` contains a Virtual Network Gateway that connects to an on-premises network. To allow virtual machines in `VNet-Branch` to route traffic to the on-premises network via the Virtual Network Gateway in `VNet-Core`, the administrator must enable 'Use remote gateways' on the peering link in `VNet-Core` and enable 'Allow gateway transit' on the peering link in `VNet-Branch`. Is this statement true or false?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false.
The statement is incorrect because the configuration settings must be applied relative to where the gateway is located. 'Allow gateway transit' must be enabled on the hub network containing the gateway (`VNet-Core`), while 'Use remote gateways' must be enabled on the spoke network utilizing the remote gateway (`VNet-Branch`).

Adım Adım Çözüm

1
Identify which virtual network hosts the Virtual Network Gateway.
`VNet-Core` contains the Virtual Network Gateway connected to the on-premises network.
The network that possesses the physical gateway resource is the one that must transit traffic for other networks.
2
Determine the setting required on the gateway-hosting virtual network.
The peering link from `VNet-Core` to `VNet-Branch` must have 'Allow gateway transit' enabled.
This permission allows the gateway to be shared with and utilized by the peered network.
3
Determine the setting required on the remote virtual network without a gateway.
The peering link from `VNet-Branch` to `VNet-Core` must have 'Use remote gateways' enabled.
This configuration instructs the remote network to route its egress traffic via the peer's gateway.

Anahtar Kavram

Virtual network peering gateway transit configuration
Soru 1179Soru →

Your company has an Azure subscription named Sub-Enterprise-Ops that contains the resources shown in the following table:

Resource NameResource TypeRegionResource Group
vm-orders-01Virtual MachineWest USrg-ops-01
sa-records-01Storage Account (Blobs)East USrg-data-01
rsv-west-01Recovery Services VaultWest USrg-ops-01
bv-east-01Backup VaultEast USrg-data-01
rsv-east-01Recovery Services VaultEast USrg-data-01

You need to configure backup for vm-orders-01 and the blob containers in sa-records-01. Which configuration should you use?

Cevabı ve açıklamayı göster

Cevap: Back up vm-orders-01 to rsv-west-01, assign the Storage Blob Data Contributor role to the managed identity of bv-east-01, and back up the blob containers in sa-records-01 to bv-east-01.

Cevap

Back up vm-orders-01 to the Recovery Services Vault in West US, assign the Storage Blob Data Contributor role to the managed identity of the Backup Vault in East US, and back up the blob containers in sa-records-01 to that Backup Vault.
The correct configuration respects both regional and vault type requirements. Virtual machines must be backed up to a Recovery Services Vault in the same region, meaning the VM in West US must use the Recovery Services Vault in West US. Storage account blob backups are managed via Backup Vaults, requiring the Backup Vault and the storage account to be in the same region (East US). Additionally, because Azure Backup requires data-plane access to target storage accounts, the Backup Vault's managed identity must be granted the Storage Blob Data Contributor role.

Adım Adım Çözüm

1
Determine the vault type and regional requirements for the virtual machine backup.
Azure Virtual Machines require a Recovery Services Vault, and the vault must reside in the same region as the VM. Therefore, vm-orders-01 (West US) must use rsv-west-01.
Azure Backup enforces regional boundaries for VM protection to prevent cross-region network latency and compliance issues during backup operations.
2
Determine the vault type and regional requirements for the blob container backup.
Azure Storage Blobs require a Backup Vault, and the vault must reside in the same region as the storage account. Therefore, sa-records-01 (East US) must use bv-east-01.
Operational backup for blobs is managed through Backup Vaults, which must align regionally with the target storage account.
3
Configure the required data-plane access permissions on the storage account.
Assign the Storage Blob Data Contributor role to the system-assigned managed identity of bv-east-01.
Azure Backup requires explicit data-plane access to read and write blob data. Control-plane permissions (such as Owner or Contributor at the subscription or resource group level) do not inherently grant these data-plane rights.

Anahtar Kavram

Azure Backup regional alignment and vault compatibility constraints
Soru 1180Soru →

An administrator is configuring inbound access from the internet to a web server named Server1 (private IP address 10.1.1.4) using Azure Firewall. The firewall is deployed in the same virtual network and has a public IP address of 40.121.20.15 and a private IP address of 10.1.0.4. The administrator wants internet clients to access Server1 by sending requests to http://40.121.20.15:8080. Which IP address must the administrator specify as the Destination Address in the DNAT rule to ensure traffic is correctly forwarded to Server1 on port 80?

Cevabı ve açıklamayı göster

Cevap: 40.121.20.15

Cevap

40.121.20.15
To configure inbound DNAT (Destination Network Address Translation) on an Azure Firewall, the Destination Address field in the rule must contain the firewall's public IP address (40.121.20.15). When internet traffic arrives at this IP on port 8080, the DNAT rule translates the destination to the internal web server's private IP (10.1.1.4) on port 80, allowing the connection to succeed.

Adım Adım Çözüm

1
Determine the external entry point for internet client traffic targeting the internal web server.
Internet clients must target the public IP address of the Azure Firewall (40.121.20.15).
Internal resources have private IP addresses that are not routable from the public internet, requiring the firewall's public IP as the entry point.
2
Identify the proper parameters for an Azure Firewall DNAT rule.
The Destination Address must be the firewall's public IP, and the Translated Address must be the web server's private IP.
DNAT works by matching packets arriving at the firewall's public IP (Destination Address) and translating them to the internal server's private IP (Translated Address).
3
Select the correct IP address that matches the Destination Address parameter.
The correct IP address is 40.121.20.15.
Specifying the firewall's public IP ensures the firewall listens on this address for incoming client requests on port 8080.

Anahtar Kavram

Azure Firewall Destination NAT (DNAT) rule configuration
Tahmini Süre:1m 30s
ÖncekiSayfa 59 / 63Sonraki
Tüm alıştırma soruları — Microsoft Azure Administrator (AZ-104) | Examkin