Tüm alıştırma soruları

1252 soru

Tüm türler1,252 Çoktan seçmeli644 Çoklu seçim429 Doğru / Yanlış47 Eşleştirme52 Sıralama80

Your company has an Azure environment with a management group hierarchy. The environment includes an Azure subscription named Sub-Prod that contains a resource group named RG-Core.

A resource lock of type ReadOnly is applied to the Sub-Prod subscription.

A budget named Budget-Prod is configured at the Sub-Prod subscription scope. The budget has an alert threshold set to 90% of the budgeted amount, which is configured to trigger an Azure Monitor action group that executes an Azure Automation Runbook. The runbook is designed to automatically deallocate all virtual machines in RG-Core to minimize costs.

A user named User1 is assigned the Contributor role at the Sub-Prod subscription scope and the User Access Administrator role at the RG-Core resource group scope.

The actual cost of Sub-Prod reaches 95% of the budgeted amount.

When the budget alert triggers, what is the status of the virtual machines in RG-Core, and what action can User1 take regarding the resource lock to resolve any issues?

The virtual machines are successfully deallocated because the ReadOnly lock only prevents resource deletion. User1 can delete the lock at the subscription scope using their Contributor permissions.

The budget alert fails to trigger because Azure Budgets at the subscription scope cannot execute runbooks via action groups. User1 must delete the lock at the resource group level to manually stop the virtual machines.

The virtual machines remain running because the ReadOnly lock prevents deallocation. User1 cannot delete the lock because their User Access Administrator role is scoped to the resource group, not the subscription.

The virtual machines remain running because the ReadOnly lock prevents deallocation. User1 can delete the lock because the User Access Administrator role at the resource group scope inherits upward to allow management of subscription-level locks.

Cevabı ve açıklamayı göster

Cevap: The virtual machines remain running because the ReadOnly lock prevents deallocation. User1 cannot delete the lock because their User Access Administrator role is scoped to the resource group, not the subscription.

Cevap

The virtual machines remain running because the ReadOnly lock prevents deallocation, and User1 cannot delete the lock because their User Access Administrator role is scoped to the resource group, not the subscription.

The correct answer is correct because a ReadOnly lock prevents write operations, which includes stopping or deallocating a virtual machine. Since the lock is applied at the subscription scope, it is inherited by all resources within it, including the virtual machines in the resource group. Furthermore, to delete a lock, a user must have lock deletion permissions at the scope where the lock is applied or higher. The User Access Administrator role grants lock management permissions, but because User1's assignment of this role is scoped only to the resource group, they cannot manage locks at the subscription level. The Contributor role at the subscription level does not include permissions to delete locks.

Adım Adım Çözüm

Determine the impact of the ReadOnly lock on the virtual machines.

The virtual machines cannot be deallocated (stopped).

A ReadOnly lock prevents all write operations, which includes VM state changes like starting, stopping, or deallocating.

Identify the scope at which the ReadOnly lock is applied.

The lock is applied at the Sub-Prod subscription scope and inherited by RG-Core.

Because the lock is applied to the subscription, it is inherited downward by all nested resource groups and resources.

Evaluate if User1 can delete the subscription-scope lock.

User1 is blocked from deleting the lock.

To delete a lock, a user needs Microsoft.Authorization/locks/delete permissions at or above the lock's scope. User1's Contributor role lacks authorization permissions, and their User Access Administrator role is scoped only to RG-Core, which does not inherit upward.

Anahtar Kavram

Interaction of Azure Resource Locks (ReadOnly), Azure Budgets with Action Groups, and Azure RBAC scope boundaries.

Tahmini Süre:3m 0s

Soru 122Soru →

An administrator needs to configure a lifecycle management policy for a standard General Purpose v2 (GPv2) storage account to minimize storage costs. Which of the following actions is supported by Azure Blob Lifecycle Management rules?

Automatically transitioning blobs from the Archive tier to the Hot tier when they are accessed by a client application

Transitioning page blobs on a premium storage account to the Cool tier

Transitioning block blobs from the Hot tier to the Archive tier based on the time since the blobs were last modified

Moving files from an Azure File share to an Azure Blob container when they have not been modified for ninety days

Cevabı ve açıklamayı göster

Cevap: Transitioning block blobs from the Hot tier to the Archive tier based on the time since the blobs were last modified

Cevap

Transitioning block blobs from the Hot tier to the Archive tier based on the time since the blobs were last modified

Transitioning block blobs from the Hot tier to the Archive tier is a supported action in Azure Storage Lifecycle Management, allowing users to move older, infrequently accessed data to a lower-cost tier automatically.

Adım Adım Çözüm

Identify the storage account type and blob type in the scenario.

The scenario uses a standard General Purpose v2 (GPv2) storage account and block blobs.

Lifecycle management rules are fully supported on GPv2 storage accounts for block blobs.

Evaluate the supported actions for Lifecycle Management rules.

Supported actions include transitioning block blobs to cooler tiers (Cool, Cold, Archive) and deleting them based on age.

This allows administrators to define policies that automatically transition blobs to lower-cost tiers over time.

Determine which option describes a supported action.

Transitioning block blobs from the Hot tier to the Archive tier is supported, whereas automating rehydration (Archive to Hot), tiering premium page blobs, or syncing Azure Files are not supported.

Selecting the supported action completes the policy configuration.

Anahtar Kavram

Azure Blob Lifecycle Management supports transitioning block blobs to cooler storage tiers (Cool, Cold, Archive) and deleting them based on modification or creation time.

Tahmini Süre:45s

Soru 123Soru →

An administrator manages a Microsoft Entra ID tenant. A user named User1 is configured as the owner of an assigned security group named Group1. User1 is not assigned any Microsoft Entra ID directory roles.

Statement: User1 can delete Group1 from the Microsoft Entra admin center.

Is this statement true or false?

Doğru

Yanlış

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false. Group owners cannot delete the group they own unless they are assigned a directory role with group deletion permissions, such as Groups Administrator or Global Administrator.

The statement is false because group owners are only authorized to manage members and other owners. They cannot delete the group itself. Deleting a security group requires directory roles such as Groups Administrator, User Administrator, or Global Administrator.

Adım Adım Çözüm

Analyze the permissions of a group owner in Microsoft Entra ID.

A group owner can add or remove members, add or remove other owners, and edit group settings (like description or name, depending on tenant settings), but cannot delete the group.

Group ownership is a delegated administrative feature designed for membership management, not full lifecycle control of the resource object.

Determine the role required to delete a group in Microsoft Entra ID.

Deleting a group requires directory-level administrative privileges, which are granted via roles like Groups Administrator, User Administrator, or Global Administrator.

Deleting a directory object is a high-privilege action that affects the entire tenant's directory structure.

Evaluate the statement against the analyzed permissions.

Since User1 is only a group owner and has no directory roles, User1 cannot delete Group1.

User1 lacks the required directory role permissions to delete a group object.

Anahtar Kavram

Delegated group management vs directory roles in Microsoft Entra ID

Soru 124Soru →

Vanguard Renewable Systems manages its Azure environment using a Management Group (MG) hierarchy. The hierarchy and configuration are set up as follows:

* Tenant Root Group
* Retail-MG: An Azure Policy restricting virtual machine sizes to `Standard_D2s_v3` and `Standard_D4s_v3` is assigned here. User1 is assigned the Reader role.
* Online-MG: User2 is assigned the Contributor role.
* Online-Prod-Sub (Subscription)
* Web-RG (Resource Group): A `CanNotDelete` resource lock is applied to this resource group.
* Offline-MG
* Offline-Prod-Sub (Subscription)
* POS-RG (Resource Group): User1 is assigned the Owner role.

Which two statements are correct regarding the effective policies, permissions, and locks in this hierarchy?

Geçerli olan tümünü seçin

A virtual machine of size Standard_F4s_v2 cannot be deployed in the Web-RG resource group.

User2 cannot delete resources within the Web-RG resource group.

User1 can only perform read actions in POS-RG because the Reader role inherited from Retail-MG overrides the Owner role assigned at the resource group level.

The VM size restriction policy does not apply to resources in Online-Prod-Sub because policies assigned at a management group level must be explicitly activated at the subscription level.

Cevabı ve açıklamayı göster

Cevap: A virtual machine of size Standard_F4s_v2 cannot be deployed in the Web-RG resource group.; User2 cannot delete resources within the Web-RG resource group.

Cevap

A virtual machine of size Standard_F4s_v2 cannot be deployed in the Web-RG resource group, and User2 cannot delete resources within the Web-RG resource group.

The correct statements are that the Standard_F4s_v2 virtual machine cannot be deployed because the policy restricting VM sizes is inherited from the parent Management Group, and that User2 cannot delete resources in the Web-RG resource group because the CanNotDelete lock is active and applies to all users regardless of their RBAC roles.

Adım Adım Çözüm

Analyze Azure Policy inheritance down the Management Group hierarchy.

The VM size restriction policy is applied at the Retail-MG level. Since Online-Prod-Sub and Web-RG are descendants of Retail-MG, they inherit this policy, meaning only Standard_D2s_v3 and Standard_D4s_v3 VMs can be deployed.

Azure Policies apply to the scope at which they are assigned and are inherited by all child scopes down the management group and resource hierarchy.

Analyze the impact of the resource lock on Web-RG.

A CanNotDelete resource lock is applied to Web-RG. User2 has Contributor permissions, but the lock overrides RBAC delete permissions.

Resource locks apply to all users and roles, preventing the deletion of resources regardless of the user's RBAC role.

Evaluate the additive nature of Azure RBAC roles.

User1 has Reader at Retail-MG and Owner at POS-RG. User1's effective access in POS-RG is Owner because roles are cumulative (additive).

Azure RBAC does not support explicit 'deny' assignments via custom roles, and roles assigned at lower scopes do not get overridden by less privileged roles at higher scopes.

Anahtar Kavram

Azure Management Groups allow governance (Policies, RBAC, and Locks) to be applied at scale and inherited down the resource hierarchy.

Soru 125Soru →

CloudSpire Solutions plans to deploy three virtual machines named VM-Auth1, VM-Auth2, and VM-Auth3 in the UK South region. The company has a deployment constraint requiring protection against a complete datacenter outage in the region. Which configuration should you use?

Deploy the virtual machines across multiple Availability Zones

Deploy the virtual machines in a single Availability Set

Deploy the virtual machines in a Proximity Placement Group

Deploy the virtual machines to different Resource Groups

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machines across multiple Availability Zones

Cevap

Deploy the virtual machines across multiple Availability Zones

Deploying the virtual machines across multiple Availability Zones locates each VM in a physically separate datacenter with independent power, cooling, and network infrastructure. This design protects the application from datacenter-wide outages within the region.

Adım Adım Çözüm

Analyze the high availability requirement

The requirement specifies protection against a complete datacenter-wide failure (power or cooling outage) in the region.

Identifying the failure domain scale (datacenter-level vs. rack-level) is necessary to choose between Availability Sets and Availability Zones.

Evaluate Availability Zones against the requirement

Availability Zones locate VMs in physically separate datacenters with independent power, cooling, and networking within the region.

This physical separation directly satisfies the requirement to survive a datacenter-wide outage.

Evaluate the distractors

Availability Sets protect only against rack-level (fault domain) or host-level (update domain) failures within one datacenter. Proximity Placement Groups group VMs close together, increasing risk. Resource groups are logical boundaries.

Confirming why alternative configurations do not meet the datacenter-wide outage requirement ensures the selection is correct.

Anahtar Kavram

Availability Zones provide physical isolation and redundancy by deploying resources across separate datacenters within a region, protecting against datacenter-wide failures.

Soru 126Soru →

An organization uses Azure File Sync to synchronize local file shares from an on-premises server named Server1 to Azure. Server1 has a single volume E: with a total capacity of $2\text{ TB}$ ( $2,000\text{ GB}$ ). The volume contains $200\text{ GB}$ of local, non-sync data that cannot be tiered.

The administrator configures two server endpoints on volume E: as follows:
- The folder E:\\DepartmentA ( $800\text{ GB}$ of files, with only $50\text{ GB}$ of files older than $30\text{ days}$ ) is added to SyncGroup1. The cloud tiering volume free space policy is set to $15\%$ and the date policy is set to $30\text{ days}$ .
- The folder E:\\DepartmentB ( $600\text{ GB}$ of files, with only $50\text{ GB}$ of files older than $14\text{ days}$ ) is added to SyncGroup2. The cloud tiering volume free space policy is set to $35\%$ and the date policy is set to $14\text{ days}$ .

What will be the final amount of free space on volume E: after the initial synchronization and cloud tiering processes complete?

500\text{ GB}

300\text{ GB}

700\text{ GB}

900\text{ GB}

Cevabı ve açıklamayı göster

Cevap: $700\text{ GB}$

Cevap

The correct answer is

700\text{ GB}

because the effective volume free space target of

35\%

on the

2,000\text{ GB}

volume must be satisfied, which requires maintaining

700\text{ GB}

of free space. Since date-based tiering only frees up space to

500\text{ GB}

, the volume free space policy overrides the date constraint to tier more files until the

700\text{ GB}

target is met.

The correct option is the one stating that the final free space is

700\text{ GB}

. When multiple server endpoints reside on the same volume, the effective volume free space policy is the maximum value configured among all server endpoints on that volume, which is

35\%

. For a

2,000\text{ GB}

volume, this translates to maintaining a minimum of

700\text{ GB}

of free space. Although evaluating the individual date policies first tiers

100\text{ GB}

of data, leaving the volume with

500\text{ GB}

of free space, this is still less than the

700\text{ GB}

target. Because the volume free space policy takes precedence over the date-based policy, Azure File Sync will override the date constraints and tier an additional

200\text{ GB}

of the coldest files across both server endpoints to achieve the required

700\text{ GB}

of free space.

Adım Adım Çözüm

Determine the effective volume free space policy for volume E:.

The effective policy is

35\%

When multiple server endpoints reside on the same volume, Azure File Sync applies the maximum of the configured volume free space policies on that volume (

\\max(15\%, 35\%) = 35\%

Calculate the target volume free space to be maintained on volume E:.

Target free space is

700\text{ GB}

The total capacity of volume E: is

2,000\text{ GB}

. The target free space is calculated as

35\% \\times 2,000\text{ GB} = 700\text{ GB}

Calculate the initial free space on volume E: and apply the date-based tiering policies.

Free space after date-based tiering is

500\text{ GB}

Initial used space is

200\text{ GB} \\text{ (non-sync)} + 800\text{ GB} \\text{ (Endpoint A)} + 600\text{ GB} \\text{ (Endpoint B)} = 1,600\text{ GB}

, leaving

400\text{ GB}

free. Applying the date policies tiers

50\text{ GB}

from Endpoint A and

50\text{ GB}

from Endpoint B, totaling

100\text{ GB}

tiered, which increases the free space to

500\text{ GB}

Determine the final cloud tiering action based on policy precedence.

Final free space is

700\text{ GB}

Since the free space of

500\text{ GB}

is less than the target of

700\text{ GB}

, the volume free space policy takes precedence. The system overrides the date policy constraints and tiers an additional

200\text{ GB}

of the coldest files across both endpoints to achieve the required

700\text{ GB}

of free space.

Anahtar Kavram

Azure File Sync cloud tiering behavior when multiple server endpoints reside on the same volume.

Tahmini Süre:3m 0s

Soru 127Soru →

An administrator configures the following Azure resource hierarchy:

* Management Group: `MG-Enterprise`
* Subscription: `Sub-Dev`
* Resource Group: `rg-testing`

A user named Developer1 is assigned the Contributor role at the `Sub-Dev` subscription scope. No other role assignments are configured.

What is Developer1's effective permission for resources within the `rg-testing` resource group?

Developer1 has Contributor permissions on all resources within the resource group due to scope inheritance.

Developer1 has no permissions within the resource group because role assignments do not inherit downward from a subscription to a resource group.

Developer1 has Reader permissions within the resource group by default and must be explicitly assigned the Contributor role at the resource group scope to modify resources.

Developer1 only has Contributor permissions if they are also assigned an administrator role at the Microsoft Entra ID tenant level.

Cevabı ve açıklamayı göster

Cevap: Developer1 has Contributor permissions on all resources within the resource group due to scope inheritance.

Cevap

Developer1 has Contributor permissions on all resources within the resource group due to scope inheritance.

The correct answer is that Developer1 has Contributor permissions on all resources within the resource group due to scope inheritance. In Azure, role assignments are inherited down the resource hierarchy: Management Group -> Subscription -> Resource Group -> Resource. Since the Contributor role was assigned at the subscription scope, it automatically applies to the child resource group.

Adım Adım Çözüm

Identify the scope at which the Contributor role is assigned.

The Contributor role is assigned at the subscription scope (Sub-Dev).

Understanding the point of assignment is necessary to trace permission flow.

Apply the Azure RBAC inheritance rules to the resource hierarchy.

The resource group (rg-testing) is a child of the subscription (Sub-Dev), so it inherits the Contributor assignment.

Azure RBAC propagates permissions from parent scopes down to child scopes.

Determine the final effective permissions on resources in the resource group.

Developer1 has Contributor permissions on all resources in rg-testing.

Inherited permissions provide the same level of access as if they were assigned directly at the child scope.

Anahtar Kavram

Azure RBAC role assignments inherit down the resource hierarchy from management groups to subscriptions, resource groups, and individual resources.

Soru 128Soru →

A cloud engineering team is designing a security model for a multi-tier application. The resource structure is configured as follows:

* Management Group: `MG-Finance-Core`
* Subscription: `Sub-Banking-Prod`
* Resource Group: `RG-Payment-Gateways`
* Key Vault: `kv-payment-prod`

The following security assignments are made:
* UserA is assigned the Reader role at the `MG-Finance-Core` scope.
* UserA is also assigned the Contributor role at the `RG-Payment-Gateways` scope.
* UserB is a Microsoft Entra ID Global Administrator, with no explicit Azure RBAC roles assigned to any Azure resource.
* UserC is assigned the User Access Administrator role at the `Sub-Banking-Prod` scope.

Which of the following statements describe the effective permissions of the users? (Select two.)

Geçerli olan tümünü seçin

UserA can deploy a new Virtual Network within the resource group RG-Payment-Gateways.

UserC can delegate the Virtual Machine Contributor role to a developer at the RG-Payment-Gateways level.

UserB has full administrative access to manage all resources in the Sub-Banking-Prod subscription by default.

UserA is blocked from creating resources in RG-Payment-Gateways because the Reader role from MG-Finance-Core is inherited as a restriction.

Cevabı ve açıklamayı göster

Cevap: UserA can deploy a new Virtual Network within the resource group RG-Payment-Gateways.; UserC can delegate the Virtual Machine Contributor role to a developer at the RG-Payment-Gateways level.

Cevap

UserA can deploy a new Virtual Network within the resource group RG-Payment-Gateways, and UserC can delegate the Virtual Machine Contributor role to a developer at the RG-Payment-Gateways level.

The correct options are that UserA can deploy a new Virtual Network in the resource group, and UserC can delegate the Virtual Machine Contributor role at the resource group level. UserA is a Contributor at the resource group level, and since RBAC is additive, this allows full resource creation capabilities. UserC has the User Access Administrator role at the subscription level, which inherits downward and provides the necessary permissions to assign roles on the resource group.

Adım Adım Çözüm

Analyze UserA's effective permissions by combining the Reader role at the Management Group scope and the Contributor role at the Resource Group scope.

Since Azure RBAC is additive, UserA's effective permission in the resource group is Contributor, allowing resource creation (such as Virtual Networks) inside the resource group.

Permissions are accumulated across all scopes, and a more permissive assignment at a child scope is not restricted by a less permissive parent scope assignment.

Evaluate UserC's ability to manage role assignments inside the resource group.

UserC has the User Access Administrator role at the subscription scope, which inherits downward. This permits them to delegate roles at the subscription and child resource group scopes.

Role assignments are inherited, and the User Access Administrator role controls authorization settings (role assignments) within its scope.

Evaluate UserB's default access to subscription resources as a Global Administrator.

UserB has no resource permissions because directory-level roles do not automatically map to resource-level roles.

Microsoft Entra ID roles and Azure RBAC resource roles are separate systems; direct elevation is required to bridge the gap.

Anahtar Kavram

Azure RBAC uses an additive inheritance model where permissions propagate down the resource hierarchy (Management Group > Subscription > Resource Group > Resource). Direct directory roles like Global Administrator do not grant resource control plane permissions automatically.

Soru 129Soru →

You have an Azure Storage account named prodstorage. You configure the firewall on prodstorage to restrict network access to selected virtual networks only. After applying this configuration, a scheduled Azure Backup job fails to back up the blob containers in prodstorage due to network access restrictions. Which configuration change should you make to allow Azure Backup to access the storage account?

Create a Network Security Group (NSG) rule that allows inbound traffic from the AzureBackup service tag to the subnet containing the storage account.

Select the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings.

Assign the Storage Blob Data Reader role to the Azure Backup service principal.

Create a Private DNS Zone link between the storage account's private endpoint and the Azure Backup virtual network.

Cevabı ve açıklamayı göster

Cevap: Select the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings.

Cevap

Select the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings.

Selecting the 'Allow trusted Microsoft services to access this storage account' exception allows services such as Azure Backup to access the storage account even if the firewall is set to deny public network access. This is a built-in exception designed to facilitate operational tasks by trusted Azure services.

Adım Adım Çözüm

Analyze the access error.

The backup job fails because the storage account firewall blocks traffic originating outside the allowed virtual networks.

Azure Backup runs as a multi-tenant Microsoft service and its traffic does not originate from the configured virtual networks.

Modify the storage account network security configurations.

Navigate to the networking blade of the storage account and configure firewall exceptions.

Exceptions allow specific trusted traffic types to bypass the default deny rule.

Enable the trusted Microsoft services exception.

Checking 'Allow trusted Microsoft services to access this storage account' permits Azure Backup to connect securely.

This is the standard mechanism to grant secure administrative bypass to native Azure services.

Anahtar Kavram

Azure Storage Firewall Exceptions

Tahmini Süre:1m 0s

Soru 130Soru →

You need to export $15\text{ TB}$ of data from an Azure Storage account to an on-premises datacenter by using the Azure Import/Export service. You plan to ship empty hard drives to an Azure datacenter.

What is a requirement for preparing the hard drives before they are shipped?

Ensure the drives are formatted using the NTFS file system.

Ensure the drives are formatted using the FAT32 file system.

Encrypt the drives using BitLocker Drive Encryption.

Use the WAImportExport tool to pre-stage the export journal files on the drives.

Cevabı ve açıklamayı göster

Cevap: Ensure the drives are formatted using the NTFS file system.

Cevap

Ensure the drives are formatted using the NTFS file system.

For an export job using the Azure Import/Export service, you must format the drives using the NTFS file system. You do not pre-encrypt them or run the WAImportExport tool. Azure copies the data to the drives, encrypts them with BitLocker, and provides the encryption keys in your Azure storage account configuration.

Adım Adım Çözüm

Identify the type of Azure Import/Export job.

The scenario describes an export job where data is moved from Azure to on-premises.

Different rules apply to drive preparation for import versus export jobs.

Determine the formatting and encryption requirements for export drives.

Export drives must be formatted with NTFS and shipped unencrypted.

Azure automatically handles BitLocker encryption on the target datacenter side for export jobs after copying the data.

Verify if the WAImportExport tool is required.

The WAImportExport tool is only used to prepare drives for import jobs.

Since this is an export job, running the WAImportExport tool is unnecessary and incorrect.

Anahtar Kavram

Azure Import/Export export job drive preparation requirements

Tahmini Süre:1m 30s

Soru 131Soru →

An administrator is configuring temporary access to a blob container named compliance in an Azure Storage account named corpstorage. The administrator must generate a Shared Access Signature (SAS) that meets the following criteria:
- Avoids using storage account access keys for signing to prevent credential exposure.
- Allows read-only access to the blobs for an external auditing application.
- Remains valid for $48$ hours.
- Restricts access to HTTPS traffic originating from the IP range $203.0.113.0/24$ .

The administrator, who holds the 'Contributor' role on the storage account, generates a User Delegation SAS and provides it to the auditing team. However, the auditing application receives an 'Authorization Failure' (HTTP $403$ ) error when attempting to read the blobs, even though the application's traffic originates from $203.0.113.50$ over HTTPS.

Which of the following describes the root cause of this failure and the correct resolution?

A User Delegation SAS has a maximum validity period of

1

hour. Create a stored access policy on the container and generate a Service SAS linked to that policy to support the

48

-hour duration.

The storage account firewall blocks the Entra ID token validation requests. Enable the 'Allow trusted Microsoft services to access this storage account' setting in the storage account networking configuration.

The external auditing application's security principal must be assigned the 'Storage Blob Data Reader' role in Microsoft Entra ID, as User Delegation SAS permissions are evaluated against the client's identity.

The administrator lacks data-plane permissions to read the blobs. Assign the 'Storage Blob Data Reader' role to the administrator on the storage account or container.

Cevabı ve açıklamayı göster

Cevap: The administrator lacks data-plane permissions to read the blobs. Assign the 'Storage Blob Data Reader' role to the administrator on the storage account or container.

Cevap

The administrator lacks data-plane permissions to read the blobs. Assign the 'Storage Blob Data Reader' role to the administrator on the storage account or container.

The correct option is that the administrator lacks data-plane permissions. A User Delegation SAS is signed using a user delegation key acquired via Microsoft Entra ID. When a client accesses Azure Storage using a User Delegation SAS, Azure evaluates the request based on the active Azure RBAC roles of the security principal who created the SAS. The 'Contributor' role only grants control-plane access (e.g., managing keys, configuring settings) and does not grant data-plane access to blob contents. Therefore, the administrator must be assigned a data-plane role like 'Storage Blob Data Reader'.

Adım Adım Çözüm

Analyze the signature method of the SAS token.

The SAS is a User Delegation SAS, meaning it is signed using a user delegation key obtained from Microsoft Entra ID rather than the storage account access keys.

Understanding how the SAS is signed determines how authorization is evaluated by Azure Storage.

Evaluate the permissions of the security principal who created the SAS.

The administrator has the 'Contributor' role, which provides control-plane access but lacks data-plane permissions like 'Storage Blob Data Reader'.

Azure Storage evaluates User Delegation SAS requests using the active RBAC roles of the creator at the time of the request.

Identify the cause of the HTTP

403

error.

Because the creator (administrator) does not have data-plane read permissions, the intersection of permissions between the SAS token and the creator's RBAC roles is empty, leading to an authorization failure.

A User Delegation SAS cannot grant more permissions than the creator currently possesses.

Determine the resolution.

Assign the 'Storage Blob Data Reader' role to the administrator so they have the required data-plane permissions when the SAS is evaluated.

Adding the data-plane role to the creator resolves the authorization issue without violating the requirement to avoid storage account keys.

Anahtar Kavram

User Delegation SAS Authorization and RBAC Roles

Soru 132Soru →

An administrator is configuring network access for an Azure Storage account named `corpstorage99` to meet the following requirements:
- Allow access from a subnet named `Subnet1` in a virtual network named `VNet1`.
- Block all other traffic from the public internet.
- Allow Azure Backup to back up the storage account.

To support this, `Subnet1` has the `Microsoft.Storage` service endpoint enabled.

Which configuration should the administrator apply to the firewalls and virtual networks settings of `corpstorage99`?

Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and select the exception to allow trusted Microsoft services.

Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and clear all exceptions while assigning the Backup Contributor role to the Backup Vault's managed identity.

Set public network access to 'Disabled', add VNet1 and Subnet1 to the virtual networks list, and select the exception to allow trusted Microsoft services.

Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and assign the Storage Blob Data Contributor role to the Backup Vault's managed identity without enabling firewall exceptions.

Cevabı ve açıklamayı göster

Cevap: Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and select the exception to allow trusted Microsoft services.

Cevap

The correct configuration is to set the public network access to 'Enabled from selected virtual networks and IP addresses', configure the allowed subnet, and check the option to allow trusted Microsoft services. This setup enforces the firewall to block general internet traffic, permits traffic from the authorized Subnet1 using the service endpoint, and allows Azure Backup (a trusted service) to bypass the firewall to perform backups.

Adım Adım Çözüm

Select the correct public network access mode on the storage account.

Setting the public network access to 'Enabled from selected virtual networks and IP addresses' activates the Azure Storage firewall, which is required to restrict access to specific subnets while still maintaining the public endpoint active for authorized traffic and exceptions.

This allows granular firewall rules to be defined instead of completely disabling public access or allowing all traffic.

Bind the virtual network and subnet to the storage firewall.

Adding VNet1 and Subnet1 to the allowed virtual networks list allows traffic originating from Subnet1 (leveraging the Microsoft.Storage service endpoint) to reach the storage account.

This satisfies the requirement to allow access from Subnet1 while blocking other public internet traffic.

Configure the trusted Microsoft services bypass exception.

Enabling the 'Allow Azure services on the trusted services list to access this storage account' setting permits services like Azure Backup to bypass the network rules.

This ensures the backup service can connect to and back up the storage account resources without being blocked by the IP/VNet restrictions.

Anahtar Kavram

Azure Storage Account Network Firewalls and Trusted Microsoft Services Bypass

Soru 133Soru →

An administrator plans to perform a live migration of a standard General Purpose v2 (GPv2) storage account named `stbackup2026` from Locally-redundant storage (LRS) to Zone-redundant storage (ZRS). The storage account contains some older database backup files that are currently stored in the Archive access tier. Which action must the administrator perform before initiating the live migration request?

Rehydrate the archived blobs to either the Hot or Cool access tier.

Temporarily disable all active lifecycle management policies on the storage account.

Change the default access tier of the storage account from Hot to Cool.

Assign the Storage Blob Data Owner role to the Microsoft support service principal.

Cevabı ve açıklamayı göster

Cevap: Rehydrate the archived blobs to either the Hot or Cool access tier.

Cevap

Rehydrate the archived blobs to either the Hot or Cool access tier.

The correct answer is to rehydrate the archived blobs to either the Hot or Cool access tier. Azure Storage live migration from LRS to ZRS (or GRS to GZRS) does not support accounts containing archived data. Therefore, all blobs in the Archive tier must be transitioned back to an online tier (Hot or Cool) before requesting the live migration.

Adım Adım Çözüm

Check the storage account configuration and identify all blobs currently residing in the Archive access tier.

A list of archived blobs is identified.

Azure Storage live migration from LRS to ZRS does not support storage accounts that contain archived data.

Rehydrate the archived blobs by changing their access tier to Hot or Cool.

The blobs are transitioned to an online tier (Hot or Cool), which may take several hours depending on the rehydration priority selected.

Transitioning the blobs back to an online tier satisfies the prerequisite that no archived data exists in the storage account during migration.

Submit the live migration request to Azure support after the rehydration completes and all blobs are online.

The replication conversion from LRS to ZRS begins.

Microsoft Support can perform the live migration without downtime only when all account prerequisites are met.

Anahtar Kavram

Live migration from Locally-redundant storage (LRS) to Zone-redundant storage (ZRS) requires that the source storage account contains no blobs in the Archive tier. Any archived data must be rehydrated to an online tier (Hot or Cool) before the migration can proceed.

Tahmini Süre:1m 30s

Soru 134Soru →

You have an Azure subscription containing a virtual network named VNet1. VNet1 has a subnet named Subnet-Internal.

You deploy an Azure Storage account named sa-data-prod. You configure the storage account firewall to restrict access to 'Selected networks' and add Subnet-Internal to the allowed virtual networks.

You configure Azure Backup to back up the files in sa-data-prod. You discover that the backup jobs fail because the backup service cannot access the storage account.

Which configuration change should you make to resolve the backup failure?

Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.

Assign the Storage Account Contributor role to the Azure Backup service instance at the resource group level.

Add a Network Security Group (NSG) rule in Subnet-Internal that allows outbound traffic to the Storage service tag with a priority of 2000, below an existing deny-all rule at priority 1000.

Configure a Microsoft.Storage service endpoint on the subnet used by the Azure Backup service.

Cevabı ve açıklamayı göster

Cevap: Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.

Cevap

Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.

The correct action is to enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings. This configures the storage account firewall to permit trusted Azure services, such as Azure Backup, to bypass the network restrictions and successfully perform data protection tasks.

Adım Adım Çözüm

Identify the root cause of the connection failure between Azure Backup and the storage account.

The storage account is configured to restrict access to 'Selected networks' (Subnet-Internal only), which blocks external network access by default.

By default, when public access is restricted to specific subnets, all other public IP addresses and Microsoft services are blocked unless explicitly allowed.

Evaluate the role of Azure Backup in accessing restricted storage accounts.

Azure Backup is classified as a trusted Microsoft service.

Microsoft provides a built-in firewall bypass mechanism for specific trusted services to allow them to perform management and data protection tasks.

Apply the firewall bypass configuration in the Azure portal or CLI.

Under the 'Firewalls and virtual networks' configuration of the storage account, enable the checkbox 'Allow trusted Microsoft services to access this storage account'.

This allows Azure Backup to successfully authenticate and transfer backup data despite the restrictive network firewall.

Anahtar Kavram

Azure Storage Firewall Bypass for Trusted Microsoft Services

Tahmini Süre:1m 30s

Soru 135Soru →

You need to secure network access to an Azure Storage account named `saoperations` from a virtual network named `VNet-Prod`. The storage account contains blob data. The security requirements are:

1. Public network access to `saoperations` must be disabled.
2. VMs in `VNet-Prod` must access `saoperations` using a private IP address.
3. VMs in `VNet-Prod` must resolve the storage account's fully qualified domain name (FQDN) to its private IP address.

In which sequence should you perform the configuration steps to minimize service disruption and ensure correct name resolution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps starts with creating the Private DNS Zone, followed by linking the zone to the virtual network. Next, the private endpoint is created, followed by configuring the Private DNS zone group. Finally, public network access to the storage account is disabled.

The correct sequence ensures that the DNS infrastructure and private connection are completely configured and linked to the virtual network before public access is disabled, preventing connection dropouts. Creating the Private DNS Zone first allows the subsequent virtual network link and zone group auto-registration to reference the zone. The zone group automatically updates the Private DNS Zone with the private endpoint's IP. Once the endpoint is functional, disabling public network access completes the lockdown.

Adım Adım Çözüm

Create the Private DNS Zone.

A Private DNS Zone named `privatelink.blob.core.windows.net` is provisioned.

The Private DNS Zone acts as the authoritative source for the private endpoint IP addresses and must exist before linking or auto-registration can be configured.

Link the Private DNS Zone to `VNet-Prod`.

The Private DNS Zone is linked to the virtual network.

This link allows virtual machines inside the virtual network to perform DNS resolution against the zone.

Create the private endpoint.

A private endpoint is deployed in `VNet-Prod` with a private IP address mapped to the `blob` sub-resource of `saoperations`.

The private endpoint establishes private connectivity to the storage account.

Configure the Private DNS zone group.

The private IP address of the private endpoint is registered to the Private DNS Zone.

This automates the creation of the DNS A record mapping `saoperations.privatelink.blob.core.windows.net` to the private IP address.

Disable public network access on the storage account.

The storage account firewall is configured to block public network traffic.

This secures the storage account by ensuring that traffic is only allowed via the private endpoint, avoiding disruption by doing this after private connectivity is operational.

Anahtar Kavram

Azure Storage private endpoint configuration requires a specific sequence starting with Private DNS Zone creation, Virtual Network linking, Private Endpoint provisioning, Private DNS zone group integration, and finally disabling public network access to prevent service downtime.

Soru 136Soru →

Your company has a Microsoft Entra ID tenant containing a user named Admin1 and a user named User1. You configure the following:

1. An administrative unit named HQ-AU with a dynamic membership rule: `user.department -eq "Finance"`.
2. A security group named Finance-Group with assigned (static) membership. You add User1 as a member of Finance-Group.
3. You add Finance-Group to HQ-AU. User1 is not manually added to HQ-AU.
4. You assign Admin1 the User Administrator role scoped to HQ-AU.
5. You assign a Microsoft 365 E5 license to Finance-Group.

User1's department attribute is currently set to "Finance". You update User1's department attribute to "Sales". Immediately after updating the attribute, Admin1 attempts to reset the password of User1.

What is the result of Admin1's password reset attempt?

The password reset will succeed immediately because dynamic membership changes are processed asynchronously, but a subsequent attempt after the membership is updated will fail due to the non-transitive nature of administrative unit scopes.

The password reset will fail immediately because Entra ID evaluates dynamic membership rules in real-time, instantly removing the user from the scope of the administrative unit.

The password reset will succeed immediately and will continue to succeed indefinitely because the user remains within the scope of the administrative unit by virtue of their membership in the security group.

The password reset will fail immediately because the administrator requires an Azure subscription RBAC role, such as Owner or User Access Administrator, to manage users who have group-assigned licenses.

Cevabı ve açıklamayı göster

Cevap: The password reset will succeed immediately because dynamic membership changes are processed asynchronously, but a subsequent attempt after the membership is updated will fail due to the non-transitive nature of administrative unit scopes.

Cevap

The correct answer is correct because Microsoft Entra ID evaluates dynamic membership rules asynchronously. Immediately after the department attribute update, the rule has not yet processed, leaving the user within the administrative unit (AU). Consequently, the scoped administrator retains management permissions. Once the system processes the change and removes the user from the AU, subsequent management attempts will fail because AU scope is non-transitive; having a group inside an AU does not extend the administrator's authority to the members of that group.

Adım Adım Çözüm

Determine the initial membership of User1 in the administrative unit (HQ-AU).

Since User1's department is 'Finance', the dynamic rule 'user.department -eq "Finance"' evaluates to true, making User1 a direct member of HQ-AU.

To evaluate the administrator's permission scope, we must first establish if the target user is a member of the administrative unit.

Analyze the impact of updating User1's department to 'Sales' on the dynamic rule processing time.

Microsoft Entra ID dynamic rules are processed asynchronously. Immediately after the update, the rule has not yet re-evaluated, so User1 remains a member of HQ-AU.

Dynamic membership changes do not occur in real-time, resulting in a temporary window where old membership persists.

Evaluate the result of the immediate password reset attempt by Admin1.

The attempt succeeds because Admin1 is a User Administrator scoped to HQ-AU, and User1 is still dynamically a member of HQ-AU.

Scoped role permissions apply to all current members of the administrative unit.

Analyze the long-term permission state after the dynamic rule processes and removes User1 from HQ-AU.

User1 is removed from HQ-AU. Although User1 is a member of Finance-Group (which is in HQ-AU), AU scopes are non-transitive, meaning Admin1 cannot manage members of Finance-Group.

Administrative unit delegation does not transitively extend permissions to members of groups contained within the unit.

Anahtar Kavram

Administrative Unit scoping and dynamic membership processing behavior

Tahmini Süre:3m 0s

Soru 137Soru →

VeloTransit Solutions has two virtual machines named VM-AppSource1 and VM-AppSource2 deployed in the South Central US region. Currently, both virtual machines are configured as standalone instances with no high availability options selected.

A new corporate compliance policy requires that these virtual machines be configured to guarantee a minimum virtual machine uptime SLA of 99.95% against localized hardware failures.

You need to configure the virtual machines to meet the compliance policy while preserving their existing data and configurations.

Which action should you perform?

Create a new Availability Set. In the Azure portal, navigate to the properties of VM-AppSource1 and VM-AppSource2, change the Availability Set setting to the new Availability Set, and restart the virtual machines.

Create a new Availability Set. Configure the Availability Set to span across multiple Availability Zones in the South Central US region, and redeploy VM-AppSource1 and VM-AppSource2 into the Availability Set.

Delete VM-AppSource1 and VM-AppSource2 while preserving their OS disks. Create a new Availability Set, and then recreate the virtual machines from the preserved OS disks, assigning them to the new Availability Set.

Create a Proximity Placement Group. Associate VM-AppSource1 and VM-AppSource2 with the Proximity Placement Group to automatically assign them to a system-managed Availability Set.

Cevabı ve açıklamayı göster

Cevap: Delete VM-AppSource1 and VM-AppSource2 while preserving their OS disks. Create a new Availability Set, and then recreate the virtual machines from the preserved OS disks, assigning them to the new Availability Set.

Cevap

The correct action is to delete the virtual machines while preserving their OS disks, create a new Availability Set, and recreate the VMs using those disks. Azure virtual machines cannot be added to an Availability Set once they are deployed. Deleting only the VM resource leaves the managed OS disk intact, which can then be used as the source for recreating the VM. Specifying the Availability Set during this recreation process allows the configuration to take effect, satisfying the 99.95% SLA requirement.

Adım Adım Çözüm

Determine the high availability requirements to meet the 99.95% SLA.

Identify that placing the virtual machines into an Availability Set is required to guarantee a 99.95% SLA for multi-instance VM deployments.

An Availability Set distributes VMs across multiple physical hardware nodes (fault and update domains) to prevent concurrent downtime from localized failures.

Assess whether existing running VMs can be directly placed into an Availability Set.

Acknowledge that Azure does not allow associating an existing standalone VM with an Availability Set; the configuration must be specified at VM creation.

The association with an Availability Set must be defined during the initial provisioning phase of the virtual machine resource.

Formulate a redeployment strategy that preserves existing data.

Decide to delete the existing virtual machine resources while ensuring that the underlying managed OS disks are preserved (not deleted).

Preserving the OS disks ensures that all installed software, configuration settings, and data remain intact for the new VMs.

Recreate the virtual machines and associate them with the new Availability Set.

Create a new Availability Set, and then provision new virtual machines using the preserved OS disks, assigning them to the newly created Availability Set.

This achieves the desired high availability status and compliance SLA while maintaining the data and state of the original VMs.

Anahtar Kavram

You cannot add an existing Azure Virtual Machine to an Availability Set after creation. The VM must be recreated from its preserved OS disk and assigned to the Availability Set during provisioning.

Soru 138Soru →

An organization hosts application logs in an Azure Storage account named logdata99 located in the East US region. The storage account is configured as a standard General Purpose v2 (GPv2) account with Geo-redundant storage (GRS) replication. A lifecycle management policy is active on logdata99 to transition blobs in the applogs container to the Archive tier after 30 days of inactivity. Due to a primary region outage, an administrator initiates a customer-managed failover to the secondary region (East US 2). After the failover completes, how does the lifecycle management policy behave?

The lifecycle management policy is automatically deleted during the failover, as lifecycle policy definitions do not replicate to the secondary region.

The lifecycle management policy is paused until an administrator assigns the Storage Blob Data Contributor role to the lifecycle service principal in the new primary region.

The lifecycle management policy remains active and will execute on the new primary endpoint in the secondary region.

The lifecycle management policy continues to execute, but it will only transition blobs to the Cool tier because the Archive tier is not supported on geo-replicated secondary endpoints.

Cevabı ve açıklamayı göster

Cevap: The lifecycle management policy remains active and will execute on the new primary endpoint in the secondary region.

Cevap

The lifecycle management policy remains active and will execute on the new primary endpoint in the secondary region.

The correct answer is that the lifecycle management policy remains active and will execute on the new primary endpoint in the secondary region. Lifecycle management policies are metadata-level configurations of the storage account. When a storage account is configured with GRS, this metadata replicates to the secondary region. While the policy only runs on the active primary endpoint, performing a failover changes the secondary region into the new primary region. Consequently, the lifecycle management rules will resume running on the new primary endpoint.

Adım Adım Çözüm

Analyze how lifecycle management policies are stored.

Lifecycle policies are stored as metadata configurations on the storage account.

This configuration is automatically replicated to the secondary region when GRS is enabled.

Determine where lifecycle management policies execute.

Lifecycle management policies execute only on the active primary endpoint of the storage account.

During normal operations, they run in the primary region; they do not run on the read-only secondary endpoint.

Evaluate the state of the storage account after customer-managed failover.

The secondary region (East US 2) becomes the new primary region, and the endpoint becomes writeable.

Since the lifecycle policy is replicated, it resumes execution on the new primary endpoint.

Anahtar Kavram

Lifecycle management policy replication and execution behavior during a storage account failover

Soru 139Soru →

An organization manages an Azure environment with a subscription named Sub-ECommerce. The subscription contains a resource group named rg-payment.

A user named User1 is assigned the following roles:
- The Reader role at the Sub-ECommerce subscription scope
- The Contributor role at the rg-payment resource group scope
- The Global Reader role in Microsoft Entra ID

User1 attempts to create a new storage account inside the rg-payment resource group.

What is the outcome of User1's attempt?

The storage account is created successfully, because Azure RBAC roles are additive and the Contributor role at the resource group level grants the required permissions.

The creation fails, because the Reader role assigned at the subscription level is more restrictive and inherits down to override the Contributor role at the resource group level.

The creation fails, because the Microsoft Entra ID Global Reader role is a directory-level role that enforces read-only access on all Azure resources across the tenant.

The creation fails, because User1 must be assigned a role within an Administrative Unit that contains the rg-payment resource group.

Cevabı ve açıklamayı göster

Cevap: The storage account is created successfully, because Azure RBAC roles are additive and the Contributor role at the resource group level grants the required permissions.

Cevap

The storage account is created successfully, because Azure RBAC roles are additive and the Contributor role at the resource group level grants the required permissions.

The correct answer is correct because Azure Role-Based Access Control (RBAC) is additive. When a user has multiple role assignments, the effective permission is the sum of those role assignments. In this scenario, the Reader role at the subscription level provides read access, while the Contributor role at the resource group level provides read/write access. Since the permissions are additive, the Contributor permissions apply to the resource group, allowing the user to create the storage account. The Microsoft Entra ID Global Reader role operates in the directory plane and does not restrict Azure resource access.

Adım Adım Çözüm

Evaluate the Azure RBAC inheritance hierarchy and determine which roles apply to User1 at the resource group scope.

User1 inherits the Reader role from the subscription scope and has an explicit Contributor role assigned at the resource group scope.

Permissions are inherited down the resource hierarchy: Management Group -> Subscription -> Resource Group -> Resource.

Apply the additive principle of Azure RBAC roles to determine the effective permissions.

The effective permission of User1 on the resource group is Contributor, since Azure RBAC roles are additive (

\text{Reader} + \text{Contributor} = \text{Contributor}

An assignment of a less restrictive role at a lower scope grants those permissions; it is not overridden by a more restrictive role inherited from a higher scope.

Assess the impact of the Microsoft Entra ID Global Reader role on the Azure subscription resource permissions.

The Microsoft Entra ID Global Reader role does not restrict or override Azure RBAC permissions.

Microsoft Entra ID roles and Azure RBAC roles are managed in separate control planes. Directory roles do not automatically override or block subscription data or resource plane access.

Anahtar Kavram

Azure RBAC roles are additive. Scope-specific assignments grant permissions that are not blocked by inherited roles at a higher scope.

Soru 140Soru →

You plan to implement Azure File Sync to synchronize files from an on-premises Windows Server to Azure. Which two of the following resources must you create in Azure before you can register the server and configure synchronization? (Select two.)

Geçerli olan tümünü seçin

A Storage Sync Service resource

An Azure file share in a Storage account

A Shared Access Signature (SAS) token with no expiration date

A Blob container with a lifecycle management policy

Cevabı ve açıklamayı göster

Cevap: A Storage Sync Service resource; An Azure file share in a Storage account

Cevap

A Storage Sync Service resource and an Azure file share in a Storage account

To deploy Azure File Sync, you must create a Storage Sync Service, which manages sync topology, and a standard Azure file share, which functions as the cloud endpoint. The on-premises server registered with the Storage Sync Service then syncs its folders to the file share.

Adım Adım Çözüm

Identify the target storage service in Azure used by Azure File Sync.

Azure File Sync only synchronizes with Azure Files (file shares), not Blob containers or other storage resources.

This establishes that an Azure file share within a standard or premium Storage account is a mandatory prerequisite.

Determine the control plane orchestration resource required for synchronization.

The Storage Sync Service is the control plane resource in Azure that coordinates synchronization across registered servers.

The Windows Server agent registers directly with the Storage Sync Service to receive sync configurations, making it the second required resource.

Anahtar Kavram

Azure File Sync deployment requirements and topology

Tahmini Süre:1m 0s

ÖncekiSayfa 7 / 63Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram