Examkin

Tüm alıştırma soruları

1252 soru

Tüm türler1,252Çoktan seçmeli644Çoklu seçim429Doğru / Yanlış47Eşleştirme52Sıralama80
Soru 101Soru →

An administrator is configuring a standard General Purpose v2 (GPv2) storage account named `mystorage` that currently uses locally-redundant storage (LRS). The administrator needs to configure blob lifecycle management rules and plan for replication upgrades.

Which two configurations are valid or represent correct behaviors for this storage account?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The replication configuration can be converted from LRS to Geo-Redundant Storage (GRS) directly in the Azure portal without downtime.; A lifecycle management policy can be configured to filter blobs using blob index tags to transition them to the Archive tier.

Cevap

The replication configuration can be converted from LRS to Geo-Redundant Storage (GRS) directly in the Azure portal without downtime, and a lifecycle management policy can be configured to filter blobs using blob index tags to transition them to the Archive tier.
The correct configurations are converting from LRS to Geo-Redundant Storage (GRS) directly in the Azure portal without downtime, and using blob index tags in a lifecycle management policy to filter blobs transitioning to the Archive tier. Converting standard GPv2 storage accounts from LRS to GRS is fully supported online, and blob index tags provide granular criteria filtering for lifecycle actions.

Adım Adım Çözüm

1
Determine valid replication migration paths.
LRS to GRS conversion can be done online without downtime directly in the portal. However, LRS to ZRS is not direct and requires requesting a live migration from Microsoft Support or performing manual data copy.
Azure allows upgrading standard GPv2 storage accounts from LRS to GRS seamlessly, but converting to ZRS has zone-specific migration requirements.
2
Analyze lifecycle policy capabilities and filtering.
Lifecycle policies support transitioning blobs to Cool, Cold, Archive, or deleting them. Filtering can be done via prefix matches or blob index tags.
Blob index tags allow granular lifecycle rule execution based on key-value attributes associated with the blobs.
3
Review data access and rehydration requirements.
Blobs in the Archive tier are offline and cannot be read directly regardless of the RBAC permissions held by the user; they must first be rehydrated.
Archive tier is an offline tier designed for archival data, and direct read operations are blocked at the storage account data plane.

Anahtar Kavram

Blob Storage Lifecycle Policies and Replication Settings
Tahmini Süre:2m 0s
Soru 102Soru →

An administrator needs to restrict access to an Azure Storage account named storage1 so that it only accepts traffic originating from a specific subnet in a virtual network. What is the correct sequence of steps to configure this network restriction in the Azure portal?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is to first navigate to the storage1 storage account, go to the Networking settings under Security + networking, set the Public network access to 'Enabled from selected virtual networks and IP addresses', add the target virtual network and subnet, and then select Save to apply the changes.
To restrict access to a storage account from a specific subnet, the administrator must navigate to the storage account, access the Networking settings, change Public network access to 'Enabled from selected virtual networks and IP addresses', add the target subnet under Virtual networks, and save the settings.

Adım Adım Çözüm

1
Locate the target storage account resource.
The storage1 account page is opened.
All network settings for the resource are configured within its instance page.
2
Access the Networking blade.
The Networking configuration interface is loaded.
This blade houses firewall and virtual network access rules.
3
Restrict public network access settings.
The firewall rules are opened for configuration.
By default, access is allowed from all networks; this must be restricted to selected networks first.
4
Associate the allowed virtual network and subnet.
The subnet is added to the firewall exceptions list.
This explicitly authorizes traffic coming from that specific subnet.
5
Save the settings.
The updated network configuration is saved and active.
Firewall rules do not take effect until they are explicitly saved in the portal.

Anahtar Kavram

Azure Storage Firewall Configuration
Tahmini Süre:1m 0s
Soru 103Soru →

You manage a Microsoft Entra ID tenant. The tenant contains an administrative unit named HQ-AU and a user named Admin1. Admin1 is assigned the User Administrator role scoped to HQ-AU.

The tenant contains the following two groups:
* Group1: A security group that has the isAssignableToRole property set to Yes and the membership type set to Assigned. Group1 is in the scope of HQ-AU.
* Group2: A security group that has the isAssignableToRole property set to No and the membership type set to Dynamic User. Group2 is in the scope of HQ-AU.

You need to ensure that Admin1 can perform the following tasks:
* Add and remove members in Group1.
* Modify the dynamic membership rule of Group2.

Which two actions should you perform? Each correct answer presents a part of the solution.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Add Admin1 as an owner of Group1.; Assign the Groups Administrator role to Admin1 at the tenant level.

Cevap

Add Admin1 as an owner of Group1, and assign the Groups Administrator role to Admin1 at the tenant level.
Adding the user as an owner of Group1 allows managing its membership despite it being role-assignable. Assigning the Groups Administrator role at the tenant level provides the necessary permissions to edit dynamic membership rules across the tenant, which cannot be done with administrative unit scopes.

Adım Adım Çözüm

1
Analyze permissions for role-assignable groups.
Determine that only Global Administrators, Privileged Role Administrators, or group owners can manage memberships of groups where isAssignableToRole is set to Yes.
To identify how to delegate membership management of Group1 to Admin1.
2
Analyze permissions for dynamic membership rules.
Determine that modifying dynamic membership rules requires tenant-level administrator roles (such as Groups Administrator or User Administrator) and cannot be done with administrative unit scope.
To identify how to delegate dynamic rule modification of Group2 to Admin1.
3
Select configuration actions that meet requirements using the least privilege principle.
Add Admin1 as an owner of Group1 (satisfies task 1) and assign the Groups Administrator role at the tenant level (satisfies task 2).
To correctly select the minimal configuration changes required.

Anahtar Kavram

Delegating Microsoft Entra ID group management under role-assignable and dynamic membership constraints.
Soru 104Soru →

An administrator applies a CanNotDelete lock to an Azure resource group named RG-Prod. A virtual machine named VM1 is deployed inside RG-Prod. Is the following statement true or false: VM1 cannot be deleted because it inherits the CanNotDelete lock from RG-Prod?

Cevabı ve açıklamayı göster

Cevap: True

Cevap

The statement is true. The virtual machine inherits the CanNotDelete lock from the resource group, which prevents it from being deleted.
The statement is correct because resource locks applied at the resource group scope are inherited by all resources inside that resource group, including VM1.

Adım Adım Çözüm

1
Identify the lock type and the level at which it is applied.
A CanNotDelete lock is applied at the resource group scope (RG-Prod).
To determine what resources are affected, we first locate the scope and behavior of the lock.
2
Apply the inheritance rules for Azure resource locks.
The lock is inherited by all resources within RG-Prod, including the virtual machine named VM1.
Azure Resource Manager automatically propagates locks down to all child resources.
3
Evaluate the effect of a CanNotDelete lock on VM1.
VM1 cannot be deleted by any user, including administrators, until the lock is removed.
The CanNotDelete lock restricts delete operations on the resource itself and all inherited child resources.

Anahtar Kavram

Azure Resource Lock Inheritance
Tahmini Süre:45s
Soru 105Soru →

Your company has an Azure environment structured with the following resource hierarchy:
* Management Group: `MG-Finance`
* Subscription: `Sub-Finance-Prod`
* Resource Group: `RG-Treasury`
* Storage Account: `sttreasurydata`
* Key Vault: `kv-treasury-keys`

You configure the following security settings:
1. A user named `User1` is assigned only the Microsoft Entra ID Global Administrator directory role.
2. A user named `User2` is assigned the Contributor role at the `MG-Finance` scope.
3. A user named `User3` is assigned the Reader role at the `Sub-Finance-Prod` scope and the Storage Blob Data Owner role at the `sttreasurydata` scope.
4. A user named `User4` is assigned the User Access Administrator role at the `RG-Treasury` scope.

Which of the following statements correctly describe the permissions and access levels of these users? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: User3 can upload blobs to the containers in sttreasurydata and list the properties of all resources inside RG-Treasury.; User4 can assign the Contributor role to other users for resources inside RG-Treasury, but cannot create or modify resources within RG-Treasury themselves.

Cevap

The statements stating that User3 can upload blobs to sttreasurydata and list resource properties in RG-Treasury, and that User4 can assign Azure RBAC roles at the RG-Treasury scope but cannot create resources themselves, are correct.
The correct options accurately identify the additive and scoped nature of Azure RBAC. The option stating that User3 can upload blobs and list resource properties is correct because the Reader role at the subscription scope inherits down to allow control-plane viewing, while the Storage Blob Data Owner role at the storage account scope provides the required data-plane access. The option stating that User4 can assign roles but cannot create resources is correct because the User Access Administrator role is dedicated to security assignments and does not inherit resource creation privileges.

Adım Adım Çözüm

1
Analyze the Microsoft Entra ID Global Administrator role for User1
Confirm User1 has no immediate access to Sub-Finance-Prod
Microsoft Entra ID directory roles do not automatically inherit permissions to manage Azure resource scopes. This separation prevents directory administrators from managing subscription resources without explicit access elevation.
2
Evaluate the possibility of denying inherited permissions for User2
Confirm that an administrator cannot create a standard Deny assignment
Azure RBAC is strictly additive; custom Deny assignments cannot be created by administrators to restrict permissions inherited from higher scopes.
3
Determine User3's control plane and data plane access
Verify that User3 can list resources and upload blobs
The Reader role at the subscription level provides control-plane read access, and the Storage Blob Data Owner role at the storage account level provides data-plane write access.
4
Examine User4's User Access Administrator permissions
Confirm User4 can manage role assignments but cannot modify resources
The User Access Administrator role is designed exclusively for configuring security permissions and lacks resource modification permissions.

Anahtar Kavram

Azure RBAC scope inheritance, control plane versus data plane authorization, the additive-only nature of standard RBAC, and the separation between Microsoft Entra ID directory roles and Azure resource roles.
Tahmini Süre:3m 0s
Soru 106Soru →

You have a standard General Purpose v2 (GPv2) storage account named storagedatagh in the North Europe region. The storage account is currently configured to use Locally-Redundant Storage (LRS).

You need to change the replication strategy of storagedatagh to Geo-Zone-Redundant Storage (GZRS) to protect against both zonal and regional failures. The solution must minimize administrative effort and avoid any data loss or storage downtime.

Which of the following actions should you perform?

Cevabı ve açıklamayı göster

Cevap: Request a live migration to transition the storage account to Zone-Redundant Storage (ZRS), and then modify the replication setting to Geo-Zone-Redundant Storage (GZRS).

Cevap

Request a live migration to transition the storage account to Zone-Redundant Storage (ZRS), and then modify the replication setting to Geo-Zone-Redundant Storage (GZRS).
To transition a standard GPv2 storage account from Locally-Redundant Storage (LRS) to Geo-Zone-Redundant Storage (GZRS) without downtime or data loss, you must first request a live migration to Zone-Redundant Storage (ZRS). After the live migration is complete, you can then perform a self-service upgrade of the replication configuration from ZRS to GZRS.

Adım Adım Çözüm

1
Request a live migration from Microsoft support.
The storage account replication is updated from Locally-Redundant Storage (LRS) to Zone-Redundant Storage (ZRS) with no downtime.
Direct conversion from LRS to ZRS or GZRS requires a live migration to establish zonal redundancy first.
2
Update the replication setting of the newly migrated ZRS account in the Azure portal or via CLI/PowerShell.
The replication configuration is changed from Zone-Redundant Storage (ZRS) to Geo-Zone-Redundant Storage (GZRS).
Upgrading from ZRS to GZRS is a supported one-way self-service configuration update that does not require Microsoft support.

Anahtar Kavram

Azure Storage replication conversion paths and migration limitations
Tahmini Süre:1m 30s
Soru 107Soru →

An organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:

* Management Group: `MG-Production`
* Azure Subscription: `Sub-App1`
* Resource Group: `RG-Database`
* Azure SQL Database: `db-prod`

A user named User1 is a member of an Entra ID security group named `Group-DataOps`.

The following role assignments are configured:
1. `Group-DataOps` is assigned the Contributor role at the `MG-Production` scope.
2. User1 is assigned the Reader role at the `Sub-App1` scope.
3. User1 is assigned the User Access Administrator role at the `RG-Database` scope.
4. User1 is assigned the Global Administrator directory role in Microsoft Entra ID.

Which statement describes the effective permissions of User1?

Cevabı ve açıklamayı göster

Cevap: User1 has Contributor permissions for all resources in Sub-App1 and can manage Azure role assignments within RG-Database.

Cevap

User1 has Contributor permissions for all resources in Sub-App1 and can manage Azure role assignments within RG-Database.
The correct answer is correct because Azure RBAC role assignments are cumulative (additive). The user inherits the Contributor role from the security group assignment at the management group level, which applies to all resources within the subscription. The direct Reader assignment at the subscription level does not restrict this access. Furthermore, the direct assignment of the User Access Administrator role at the resource group level grants the user the ability to manage role assignments specifically within that resource group.

Adım Adım Çözüm

1
Evaluate the management group role assignment and its inheritance down the hierarchy.
User1 is a member of Group-DataOps, which is assigned the Contributor role at the MG-Production scope. Since permissions inherit downward, User1 inherits Contributor permissions for the entire Sub-App1 subscription, including RG-Database and db-prod.
Azure RBAC roles assigned at a higher scope in the hierarchy (such as a management group) automatically inherit to all child scopes (subscriptions, resource groups, and resources).
2
Evaluate the direct subscription role assignment and check for overrides.
User1 is directly assigned the Reader role at the Sub-App1 scope. However, Azure RBAC roles are additive. The direct Reader assignment does not restrict or override the inherited Contributor permissions.
Standard Azure RBAC is strictly additive. There is no concept of a standard 'deny' or restriction role assignment that overrides an inherited 'allow' permission.
3
Evaluate the resource group role assignment and assess access management capabilities.
User1 is assigned the User Access Administrator role at the RG-Database scope. This grants the Microsoft.Authorization/* permission, allowing User1 to assign and remove roles within RG-Database, while retaining Contributor access from the inherited assignment.
The User Access Administrator role is a built-in role that allows managing access to Azure resources. Assigning it at the resource group level restricts this permission to that resource group and its child resources.
4
Assess the impact of the Microsoft Entra ID directory role.
User1 is assigned the Global Administrator directory role. By default, this does not grant any access to subscriptions or Azure resources within the tenant.
Microsoft Entra ID roles (tenant-level administration) and Azure RBAC roles (subscription-level resource administration) are separate authorization systems. A Global Administrator must explicitly elevate access to manage Azure subscriptions if needed.

Anahtar Kavram

Azure RBAC scopes, inheritance, and the additive nature of role assignments compared to Microsoft Entra ID roles.
Tahmini Süre:2m 0s
Soru 108Soru →

You manage a Microsoft Entra ID tenant. You configure a security group named Dev-Staff that uses a dynamic user membership rule. You need to delegate the ability to modify the dynamic membership rule of Dev-Staff to a user named Admin1. The solution must follow the principle of least privilege. Which role should you assign to Admin1?

Cevabı ve açıklamayı göster

Cevap: Groups Administrator role in Microsoft Entra ID

Cevap

Groups Administrator role in Microsoft Entra ID
The Groups Administrator role is the least privileged Microsoft Entra ID built-in role that allows users to create, update, and manage all aspects of dynamic groups, including their membership query rules.

Adım Adım Çözüm

1
Determine the administrative requirements for modifying dynamic group rules.
Identify that editing dynamic membership rules requires directory-level group management privileges because the rules evaluate all users across the entire tenant.
To select the appropriate role, we must understand the boundaries of dynamic group rule evaluation and group management.
2
Evaluate the capabilities of group owners and administrative unit-scoped roles.
Group owners cannot modify dynamic rules. Administrative unit-scoped roles are restricted and cannot modify dynamic group queries because the queries evaluate directory-wide properties.
This rules out group ownership and administrative unit scope as viable options for modifying dynamic rules.
3
Compare Microsoft Entra ID directory roles with Azure RBAC roles.
Azure RBAC roles (such as User Access Administrator) manage Azure resources, not Entra ID directory groups. The Groups Administrator role is the least privileged Entra ID directory role that can manage dynamic groups.
This confirms that the Groups Administrator role is the correct and least privileged role for the task.

Anahtar Kavram

Microsoft Entra ID group management permissions and dynamic group rules
Soru 109Soru →

NovaApp Corp. plans to deploy two new virtual machines named VM-Web11 and VM-Web12 in the East US region. The deployment must minimize downtime caused by localized hardware failures or scheduled maintenance within the Azure infrastructure.

Which of the following configuration options can you use to achieve this goal? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machines in a single Availability Set.; Deploy the virtual machines across different Availability Zones.

Cevap

Deploying the virtual machines in a single Availability Set, or deploying them across different Availability Zones.
Deploying the virtual machines in a single Availability Set protects them from localized hardware failures and maintenance events by spreading them across different fault and update domains. Alternatively, deploying them across different Availability Zones provides even higher availability by placing the virtual machines in physically separate datacenters within the same region.

Adım Adım Çözüm

1
Evaluate the option to deploy both VMs in a single Availability Set.
This is a valid configuration because Availability Sets group virtual machines to ensure they are isolated from each other across physical infrastructure (fault domains and update domains) within a single Azure datacenter.
To ensure protection against localized hardware failures and planned maintenance.
2
Evaluate the option to deploy the VMs in different Availability Zones.
This is a valid configuration because Availability Zones are physically separate locations within an Azure region, providing higher availability by protecting against datacenter-wide failures.
To ensure protection against datacenter-level power, cooling, or network outages.
3
Evaluate the option to add existing VMs to an Availability Set.
This is invalid because Azure requires virtual machines to be configured in an Availability Set during the initial creation process.
To identify configuration constraints.
4
Evaluate the option to span an Availability Set across multiple zones.
This is invalid because Availability Sets are a single-datacenter local redundancy mechanism and cannot span multiple Availability Zones.
To identify architectural limitations of Availability Sets.

Anahtar Kavram

High availability options for Azure Virtual Machines include Availability Sets (for intra-datacenter redundancy) and Availability Zones (for inter-datacenter redundancy within a region).
Soru 110Soru →

An enterprise administrator configures the following Azure environment hierarchy for a logistics project:

* Management Group: `Logistics-MG`
* Subscription: `Logistics-Prod-Sub`
* Resource Group: `RG-Logistics-Data`
* Storage Account: `salogisticsimages`

User Admin1 is assigned the following roles:
* Microsoft Entra ID role: Global Administrator
* Azure RBAC role: Reader assigned at the `Logistics-MG` scope

Admin1 needs to assign the Contributor role to a developer at the resource group `RG-Logistics-Data` level.

Which role assignment represents the minimum privilege required to enable Admin1 to perform this task?

Cevabı ve açıklamayı göster

Cevap: User Access Administrator assigned to Admin1 at the RG-Logistics-Data scope

Cevap

User Access Administrator assigned to Admin1 at the RG-Logistics-Data scope
The correct answer is User Access Administrator assigned to Admin1 at the RG-Logistics-Data scope. Azure Role-Based Access Control (RBAC) requires the 'Microsoft.Authorization/roleAssignments/write' action to delegate access, which is provided by the User Access Administrator role. To adhere to the principle of least privilege, this role should be assigned at the narrowest scope possible, which is the resource group where the developer needs permissions.

Adım Adım Çözüm

1
Identify the permission needed to perform role assignments in Azure.
Assigning roles requires the Microsoft.Authorization/roleAssignments/write action, which is included in the User Access Administrator and Owner roles.
This determines which roles are capable of assigning permissions.
2
Determine the appropriate scope for the assignment based on the principle of least privilege.
The target scope where the role needs to be assigned is the resource group named RG-Logistics-Data.
Applying the role at the target resource group level ensures the administrator has permissions only where needed, avoiding inheritance from a higher scope like the subscription or management group.
3
Evaluate the existing Microsoft Entra ID Global Administrator role configuration.
Although a Global Administrator can elevate access to obtain the User Access Administrator role at the root scope, doing so is not the least privileged option for a task limited to a single resource group.
This rules out tenant-wide elevation when a localized resource assignment is sufficient.

Anahtar Kavram

Azure RBAC delegation requires the User Access Administrator or Owner role assigned at the most restrictive scope containing the resource where permissions must be modified.
Tahmini Süre:1m 30s
Soru 111Soru →

You have an Azure General Purpose v2 (GPv2) storage account. You need to configure a lifecycle management policy to optimize storage costs. Which two actions can you perform by using lifecycle management rules? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition blobs to a cooler storage tier based on the last modified time.; Delete blobs, blob snapshots, or blob versions after a specified number of days.

Cevap

Transitioning blobs to a cooler storage tier based on the last modified time, and deleting blobs, blob snapshots, or blob versions after a specified number of days.
The actions to transition blobs to a cooler storage tier based on last modified time and to delete blobs, snapshots, or versions are the core capabilities of Blob Storage lifecycle management policies.

Adım Adım Çözüm

1
Identify the capabilities of Azure Blob Storage lifecycle management.
Lifecycle management allows you to transition blobs to cooler tiers and delete blobs, snapshots, or versions.
This determines what operations can be automated.
2
Evaluate the option related to changing replication settings.
Automating storage replication tier changes (e.g., LRS to GRS) is not supported by lifecycle policies; it requires manual action or infrastructure automation.
Replication is an account-level setting, while lifecycle management rules target blobs.
3
Evaluate the option related to granting RBAC roles.
Lifecycle rules cannot assign or revoke access permissions or interact with the Microsoft Entra ID data/control planes.
Lifecycle management only handles data lifecycle states (tiering and deletion).

Anahtar Kavram

Supported actions for Blob Storage lifecycle management rules
Soru 112Soru →

An administrator needs to import 6 TB6\text{ TB} of data from an on-premises Windows Server to an Azure Storage account using the Azure Import/Export service. The administrator has purchased three internal 3.5-inch SATA hard drives to perform the transfer. Which of the following tasks must the administrator perform to prepare the drives and configure the import job? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Format the hard drives with the NTFS file system.; Run the WAImportExport tool to copy the data and generate the journal files.

Cevap

Formatting the hard drives with the NTFS file system and running the WAImportExport tool to copy the data and generate the journal files are correct.
To import data using the Azure Import/Export service, you must first format the drives using the NTFS file system. Then, you run the WAImportExport tool to copy the source data to the drives. The tool automatically encrypts the drives using BitLocker and outputs a journal (.jrn) file for each drive. This journal file contains the drive information and the BitLocker keys needed by Azure to decrypt the drive once it is shipped and received.

Adım Adım Çözüm

1
Format the SATA hard drives using the NTFS file system.
The drives are prepared with the NTFS file system.
Azure Import/Export requires NTFS for Windows-based client data import jobs.
2
Run the WAImportExport tool on a Windows client machine.
Data is copied, BitLocker encryption is applied, and journal files (.jrn) are created.
The WAImportExport tool prepares the drives and bundles metadata and BitLocker keys into the journal file.
3
Create the Import Job in the Azure portal and upload the journal files.
The job is created in Azure with the required BitLocker decryption keys extracted from the journal files.
This allows Microsoft datacenter operators to decrypt the drives and import the data into the target storage account.

Anahtar Kavram

Azure Import/Export drive preparation prerequisites and workflow
Soru 113Soru →

An administrator is managing an Azure subscription that includes a virtual network named VNet1. VNet1 contains two subnets: Subnet1 and Subnet2. The administrator configures a storage account named storageapp2026 with the firewall set to allow access from 'Selected networks'. Subnet1 has the 'Microsoft.Storage' service endpoint enabled, and the storage account firewall explicitly allows access from Subnet1. Subnet2 contains a private endpoint for the blob service of storageapp2026, which is integrated with a private DNS zone named privatelink.blob.core.windows.net. When the administrator configures Azure Backup to protect the blob containers in storageapp2026, the backup jobs fail with network connectivity errors. Which configuration change should the administrator implement to resolve the backup failure while maintaining the highest level of network security?

Cevabı ve açıklamayı göster

Cevap: Enable the 'Allow trusted Microsoft services to access this storage account' exception on the storage account firewall.

Cevap

Enable the 'Allow trusted Microsoft services to access this storage account' exception on the storage account firewall.
The correct option is to enable the exception that allows trusted Microsoft services to access the storage account. Azure Backup is recognized as a trusted Microsoft service, and enabling this bypass allows the service to connect to the secured storage account and perform backup and restore operations securely.

Adım Adım Çözüm

1
Analyze the error context.
The storage account firewall is configured to block public network traffic except from Subnet1, and Azure Backup (a managed service) is unable to connect to the storage account.
Identify why the connection is blocked at the network level.
2
Evaluate the bypass exceptions.
Azure Backup is classified as a trusted Microsoft service.
Enabling the trusted services bypass allows Azure Backup to securely perform backup tasks without exposing the storage account to the public internet.
3
Apply the configuration change.
Check the checkbox for 'Allow trusted Microsoft services to access this storage account' in the Networking settings of the storage account.
This establishes the necessary secure channel for Azure Backup to access storage resources.

Anahtar Kavram

Azure Storage Firewall Bypass for Trusted Microsoft Services
Soru 114Soru →

Veridian Manufacturing manages its Azure resources using the following Management Group (MG) hierarchy:

* Tenant Root Group (Policy assigned: Audit public IP addresses)
* Infrastructure-MG (User1 assigned Reader role)
* Security-MG
* Subscription-A
* Core-Services-MG
* Operations-MG
* Subscription-B

An administrator relocates Subscription-A from Security-MG to Operations-MG.

What is the status of User1's RBAC role assignment and the audit policy for resources inside Subscription-A after the move?

Cevabı ve açıklamayı göster

Cevap: User1 loses the Reader role for Subscription-A, and the audit policy remains active.

Cevap

User1 loses the Reader role for Subscription-A, and the audit policy remains active.
The correct answer is that User1 loses the Reader role for Subscription-A, and the audit policy remains active. In Azure, both RBAC role assignments and Azure Policies inherit down the management group hierarchy. When Subscription-A is relocated, any inherited RBAC permissions originating from Infrastructure-MG are lost because the subscription's new path (Tenant Root Group -> Core-Services-MG -> Operations-MG) no longer includes Infrastructure-MG. However, since the audit policy is assigned at the Tenant Root Group, which remains the root ancestor of the subscription, the policy continues to inherit and apply to resources inside Subscription-A.

Adım Adım Çözüm

1
Determine the impact of the relocation on inherited RBAC assignments.
User1 loses the inherited Reader role for Subscription-A.
The Reader role was assigned at Infrastructure-MG. When Subscription-A is moved to Operations-MG (which is under Core-Services-MG), it is no longer a descendant of Infrastructure-MG, breaking the inheritance path for that role assignment.
2
Determine the impact of the relocation on policies assigned at the Tenant Root Group level.
The public IP audit policy remains active.
The Tenant Root Group is the ultimate parent of all management groups and subscriptions in the directory. Regardless of how Subscription-A is moved between child management groups, it remains under the Tenant Root Group, meaning the policy continues to inherit.
3
Combine the results to select the matching option.
Identify the option stating that User1 loses the Reader role and the audit policy remains active.
This accurately reflects both inheritance rules during a subscription relocation.

Anahtar Kavram

Azure Policy and RBAC inheritance behavior during subscription relocation within a Management Group hierarchy.
Soru 115Soru →

You manage a Microsoft Entra ID tenant that contains a security group named Sales-Group. You need to delegate the management of Sales-Group to a user named User1, allowing them to add and remove members. The solution must minimize the administrative privileges assigned to User1. Which action should you perform?

Cevabı ve açıklamayı göster

Cevap: Add User1 to the owners list of Sales-Group.

Cevap

Add the user to the owners list of the security group.
Adding the user to the owners list of the group allows them to manage the group's membership directly without inheriting any broad directory-level administrative privileges, which aligns with the principle of least privilege.

Adım Adım Çözüm

1
Identify the requirement to delegate group membership management for a single group with the least privilege.
Determine that directory-level roles are too privileged.
Directory-level roles like User Administrator grant scope over the entire tenant, which is unnecessary for a single group.
2
Evaluate the difference between group ownership and subscription-level roles.
Azure RBAC roles do not grant rights to manage Entra ID group memberships.
RBAC roles manage Azure resources, whereas directory group management is handled within Microsoft Entra ID.
3
Select group ownership as the delegation method.
Adding the user as an owner of the target group allows manual membership management of only that group.
Group owners can add and remove members directly without needing any administrative directory roles.

Anahtar Kavram

Delegating group management in Microsoft Entra ID using group ownership.
Soru 116Soru →

Your company is migrating a critical line-of-business application to Azure. You plan to deploy three virtual machines named VM-Prod1, VM-Prod2, and VM-Prod3 to the East US 2 region. The deployment must meet the following requirements:

- Protect the application against localized datacenter outages.
- Provide a 99.99%99.99\% SLA for the virtual machines.
- Automatically distribute incoming traffic across the virtual machines.

You need to configure the high availability and load balancing strategy.

Which two actions should you perform? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy VM-Prod1, VM-Prod2, and VM-Prod3 across three different Availability Zones in the East US 2 region.; Deploy an Azure Standard Load Balancer to distribute traffic to the virtual machines.

Cevap

Deploy the virtual machines across three different Availability Zones in the East US 2 region, and deploy an Azure Standard Load Balancer to distribute traffic to the virtual machines.
Deploying the virtual machines across three different Availability Zones ensures that the VMs are located in separate physical datacenters within the region, providing protection against facility-level outages and meeting the 99.99% SLA requirement. Utilizing an Azure Standard Load Balancer is necessary because it is zone-redundant and supports routing traffic to backend pools that span multiple Availability Zones.

Adım Adım Çözüm

1
Analyze the SLA and high availability requirements.
To achieve a 99.99% SLA and protect against datacenter-wide failures, the virtual machines must be deployed across multiple Availability Zones rather than an Availability Set (which only protects against hardware failures within a single datacenter and offers a 99.95% SLA).
Availability Zones provide isolation against power, cooling, and networking issues at the datacenter level.
2
Determine the load balancing requirements for zone-redundant architectures.
Standard Load Balancer must be selected because Basic Load Balancer does not support backend pools containing VMs in multiple Availability Zones.
Standard SKU resources are zone-redundant and designed to span across multiple zones.
3
Evaluate the VM creation workflow constraints.
Confirm that VMs must be configured for high availability (zones or sets) at creation time, as they cannot be moved into an Availability Set post-deployment.
Azure resource configuration constraints prevent modifying the availability set membership of a deployed VM.

Anahtar Kavram

Azure virtual machines deployed across multiple Availability Zones require a Standard Load Balancer to distribute traffic and achieve a 99.99% SLA.
Tahmini Süre:2m 30s
Soru 117Soru →

You have an Azure General Purpose v2 (GPv2) storage account named logsstore104 in the East US region. The storage account is currently configured to use locally-redundant storage (LRS). You need to configure replication and a blob lifecycle policy to meet the following requirements:
- All data must be replicated to a secondary region and must remain readable even if the primary region experiences an outage.
- Blobs must automatically transition to the Archive storage tier 180 days after they are created.
- Blobs must be deleted automatically 365 days after they are created.

Which two actions should you perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Change the replication setting of the storage account to Read-access geo-redundant storage (RA-GRS).; Configure a lifecycle management policy rule that transitions blobs to the Archive tier 180 days after creation and deletes blobs 365 days after creation.

Cevap

To meet the requirements, you must change the replication setting of the storage account to Read-access geo-redundant storage (RA-GRS) and configure a lifecycle management policy rule that transitions blobs to the Archive tier 180 days after creation and deletes blobs 365 days after creation.
The correct options involve changing the replication setting to Read-access geo-redundant storage (RA-GRS) and configuring a lifecycle policy. Changing the replication to RA-GRS ensures that data is copied to a secondary region and is readable during a primary region failure. Configuring a lifecycle policy rule with transition and deletion actions directly automates moving blobs to the Archive tier after 180 days and deleting them after 365 days.

Adım Adım Çözüm

1
Update storage replication
Changing the replication configuration from LRS to RA-GRS starts asynchronous replication to the secondary region and enables the secondary read-only endpoint.
This guarantees that data remains readable even if the primary region experiences an outage.
2
Configure lifecycle actions
Define a lifecycle rule in the storage account containing two actions: transition to Archive after 180 days, and delete after 365 days.
This automates storage tiering and cleanup without manual intervention or script execution.

Anahtar Kavram

Blob lifecycle management rules and storage replication conversion pathways.
Tahmini Süre:1m 30s
Soru 118Soru →

You plan to configure a new dynamic user group in Microsoft Entra ID. The group must automatically include all users who are members of an existing security group named Marketing-All (which has an Object ID of 11111111-2222-3333-4444-555555555555) and also have their department attribute set to Marketing. You write the following dynamic membership rule for the group:

`user.memberof -any (group.objectId -in ['11111111-2222-3333-4444-555555555555']) -and user.department -eq 'Marketing'`

Will Microsoft Entra ID successfully validate and save this dynamic membership rule?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

False
Microsoft Entra ID does not support combining the `memberOf` property with other user attributes (such as `user.department`) in a single dynamic group membership rule expression. A dynamic group rule using `memberOf` can only reference other groups and cannot include additional user-specific filters.

Adım Adım Çözüm

1
Analyze the proposed dynamic membership rule syntax and properties used.
The rule uses `user.memberof` to check membership in a specific group and combines it with a check on the `user.department` property using the `-and` operator.
To determine if the rule is valid, we must evaluate the constraints of Microsoft Entra ID dynamic group membership rules.
2
Recall the limitations of the `memberOf` attribute in dynamic group rules.
Microsoft Entra ID prohibits combining the `memberOf` attribute with any other attributes or query terms within the same dynamic group rule expression.
This is a platform-enforced limitation of dynamic group evaluation.
3
Evaluate the outcome of saving the rule.
Since the rule attempts to combine `user.memberof` and `user.department` using `-and`, validation will fail, and the portal will not allow the rule to be saved.
The rule violates the structural constraints of dynamic group membership rule configurations.

Anahtar Kavram

Microsoft Entra ID dynamic group membership rules cannot combine the 'memberOf' attribute with other user or device properties in a single rule.
Soru 119Soru →

An organization has an Azure standard General Purpose v2 (GPv2) storage account named corpstoreupload in West US 2. The account currently uses Locally-redundant storage (LRS) and contains a blob container named invoices.

You need to meet the following requirements:
1. Provide read-only access to the data in a secondary region without waiting for a failover to be initiated if the primary region becomes unavailable.
2. Automatically move blobs in the invoices container to the Archive tier if they have not been modified for more than 90 days.
3. Automatically delete blobs in the invoices container if they have not been modified for more than 365 days.

Which of the following statements describe correct configurations or behaviors for this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: You can change the replication setting of the storage account directly from LRS to Read-access geo-redundant storage (RA-GRS) without data migration, but blobs transitioned to the Archive tier cannot be read from the secondary endpoint until they are rehydrated.; You must configure a lifecycle management policy with a rule that filters by the prefix invoices/ and contains actions to transition blobs to the Archive tier after 90 days of modification, and to delete blobs after 365 days of modification.

Cevap

Converting the storage account directly from LRS to RA-GRS (where archived blobs must still be rehydrated to be read) and configuring a lifecycle policy rule with the prefix invoices/ to transition blobs to the Archive tier after 90 days and delete them after 365 days.
Changing replication from LRS to RA-GRS is a direct configuration update that does not require data migration. Archived blobs are offline and cannot be read from the primary or secondary endpoints until they are rehydrated. Additionally, Azure Lifecycle Management policies support prefix-filtered rules with multiple actions, allowing both a transition to the Archive tier after 90 days and deletion after 365 days in a single policy rule.

Adım Adım Çözüm

1
Analyze the replication requirement to provide read access to the secondary region without waiting for failover.
Determine that Read-Access Geo-Redundant Storage (RA-GRS) satisfies this requirement, and that a GPv2 storage account can be directly converted from LRS to RA-GRS without data migration.
RA-GRS replicates data to a secondary region and exposes a secondary read-only endpoint.
2
Analyze the lifecycle management requirement for the invoices container.
Create a lifecycle management rule using the prefix filter invoices/ with two actions: transition to Archive tier after 90 days since modification, and delete after 365 days since modification.
Lifecycle management rules allow targeting specific prefixes and executing multiple tiering/deletion actions sequentially.
3
Evaluate the behavior of archived blobs under RA-GRS replication.
Confirm that archived blobs are replicated to the secondary region but remain offline and unreadable at both endpoints until rehydrated.
The Archive tier is an offline tier, and rehydration is mandatory to access the blob data regardless of the replication setting.

Anahtar Kavram

Configuring storage replication from LRS to RA-GRS and implementing sequential lifecycle management policy rules.
Tahmini Süre:2m 0s
Soru 120Soru →

Your company has an Azure environment with a subscription named sub-logistics. The subscription contains a resource group named rg-shipping, which contains a storage account named stshippinglogs. You need to grant a user named User1 the ability to view the configuration of stshippinglogs in the Azure portal and read blob data stored in its containers. The solution must use the principle of least privilege. Which two role assignments should you configure?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Reader role assigned at the stshippinglogs scope; Storage Blob Data Reader role assigned at the stshippinglogs scope

Cevap

Assign the Reader role and the Storage Blob Data Reader role, both at the stshippinglogs scope.
To satisfy the requirements using the principle of least privilege, the user needs both control plane access and data plane access. The Reader role at the storage account scope provides control plane access to view configurations. The Storage Blob Data Reader role at the storage account scope provides the necessary data plane access to read blobs. Assigning them at the storage account scope restricts access to only this specific resource.

Adım Adım Çözüm

1
Identify the control-plane requirement.
User1 needs to view the configuration of stshippinglogs in the Azure portal. The Reader role at the storage account scope is the minimum permission required.
This allows viewing resource properties without allowing modifications or access to other resources in the resource group.
2
Identify the data-plane requirement.
User1 needs to read blob data within stshippinglogs. The Storage Blob Data Reader role at the storage account scope is the minimum permission required.
Azure RBAC separates control plane management from data plane access for storage accounts, meaning control plane reader or contributor roles do not grant blob data access.

Anahtar Kavram

Azure RBAC separates control plane management (e.g., Reader role) from data plane access (e.g., Storage Blob Data Reader role), and roles must be assigned at the narrowest scope possible to follow least privilege.
ÖncekiSayfa 6 / 63Sonraki
Tüm alıştırma soruları — Microsoft Azure Administrator (AZ-104) | Examkin