Tüm alıştırma soruları

1252 soru

Tüm türler1,252 Çoktan seçmeli644 Çoklu seçim429 Doğru / Yanlış47 Eşleştirme52 Sıralama80

Luminary Media Group organizes its Azure resources using the following management group hierarchy:

* Tenant Root Group
* Luminary-MG (An administrator assigns User1 the Reader role here)
* Content-MG (An Azure Policy is assigned here that denies resource creation if the 'Department' tag is missing)
* Sub-Production (Subscription) (An administrator assigns User1 the Contributor role here)
* RG-Video (Resource Group) (A CanNotDelete resource lock is applied here)
* Marketing-MG
* Sub-Marketing (Subscription)

Which two of the following statements are correct regarding the permissions and governance applied to User1 in this hierarchy?

Geçerli olan tümünü seçin

User1 can view resources within the Sub-Marketing subscription, but cannot delete resources in the RG-Video resource group.

User1 can create new resources in the RG-Video resource group, provided they include the 'Department' tag.

User1 can delete resources in the RG-Video resource group because the Contributor role at the subscription level overrides the CanNotDelete lock.

User1 is blocked from reading resources in the Sub-Marketing subscription because the Contributor assignment at Sub-Production restricts User1 to that scope only.

Cevabı ve açıklamayı göster

Cevap: User1 can view resources within the Sub-Marketing subscription, but cannot delete resources in the RG-Video resource group.; User1 can create new resources in the RG-Video resource group, provided they include the 'Department' tag.

Cevap

User1 can view resources within the Sub-Marketing subscription but cannot delete resources in the RG-Video resource group, and User1 can create new resources in the RG-Video resource group provided they include the 'Department' tag.

The correct options accurately identify that the Reader role assigned at the parent management group inherits down to the Sub-Marketing subscription, enabling read access. Furthermore, they correctly state that User1 has Contributor rights in RG-Video but cannot delete resources due to the CanNotDelete lock, and that new creations require the 'Department' tag due to the inherited Azure Policy from Content-MG.

Adım Adım Çözüm

Evaluate Reader role inheritance

User1 is assigned the Reader role at Luminary-MG, which propagates down to all child scopes, including Marketing-MG and the Sub-Marketing subscription.

Permissions assigned at a parent management group are inherited by all child management groups, subscriptions, and resources.

Evaluate Contributor role and resource lock on RG-Video

User1 has Contributor permissions on Sub-Production and RG-Video, but the CanNotDelete lock on RG-Video prevents resource deletion.

Contributor rights allow creation and modification, but a CanNotDelete lock blocks delete operations for all users regardless of their RBAC roles.

Evaluate Azure Policy inheritance

Any resource creation in RG-Video must include the 'Department' tag to comply with the policy set at Content-MG.

Azure Policies applied at a management group level are inherited and enforced on all resources within that hierarchy.

Anahtar Kavram

Azure Management Groups allow for the hierarchical inheritance of RBAC roles, Azure Policies, and resource locks down to child subscriptions and resource groups.

Tahmini Süre:1m 30s

Soru 162Soru →

AeroSpace Dynamics is planning the deployment of a new line-of-business application in the East US region. To support the application, you must deploy two virtual machines named VM-App1 and VM-App2. The deployment must protect the application against datacenter-wide failures in the region and must guarantee a 99.99% virtual machine uptime SLA. Which deployment configuration meets the requirements?

Deploy both virtual machines to a new Availability Set configured with three fault domains.

Deploy both virtual machines to a single Availability Zone and associate them with a new Availability Set.

Deploy VM-App1 to Availability Zone 1 and VM-App2 to Availability Zone 2.

Deploy VM-App1 to Availability Zone 1 and VM-App2 to Availability Zone 2, and associate both virtual machines with a single Availability Set.

Cevabı ve açıklamayı göster

Cevap: Deploy VM-App1 to Availability Zone 1 and VM-App2 to Availability Zone 2.

Cevap

Deploy VM-App1 to Availability Zone 1 and VM-App2 to Availability Zone 2.

Deploying virtual machines across different Availability Zones distributes the workloads across physically separate datacenters within an Azure region. This protects against datacenter-wide outages (such as power or cooling failures) and qualifies the deployment for a 99.99% virtual machine uptime SLA.

Adım Adım Çözüm

Analyze the high availability requirements.

The application requires protection against datacenter-wide outages and a 99.99% virtual machine uptime SLA.

This establishes the target metrics and failure scope (datacenter-wide vs. hardware rack-level).

Evaluate Availability Sets against the requirements.

Availability Sets protect against rack-level failures (fault domains) and patching (update domains) inside a single datacenter, providing a 99.95% SLA.

This determines if Availability Sets are sufficient, which they are not since they do not protect against datacenter-wide failures.

Evaluate Availability Zones against the requirements.

Availability Zones deploy resources into physically separate datacenters with independent power, cooling, and networking within a region, providing a 99.99% SLA.

This matches the business constraints of datacenter-wide protection and a 99.99% SLA.

Verify configuration rules and select the correct option.

Deploying VMs to separate Availability Zones is valid. However, trying to combine zonal deployments with an Availability Set is invalid.

This eliminates configurations that try to combine Availability Zones and Availability Sets for the same VM instances.

Anahtar Kavram

Azure Availability Zones vs. Availability Sets configuration and SLAs

Soru 163Soru →

You need to synchronize a local folder on a Windows Server to an Azure file share using Azure File Sync. Which sequence of actions should you perform to configure the synchronization?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To configure Azure File Sync, you must first create a Storage Sync Service, install the Azure File Sync agent on the Windows Server, register the server with the Storage Sync Service, create a sync group with a cloud endpoint, and finally create a server endpoint on the registered Windows Server.

Establishing synchronization via Azure File Sync follows a sequential topology construction: configure the cloud control plane (Storage Sync Service), deploy the local agent on the server, establish trust via server registration, set up the sync topology and cloud storage (sync group and cloud endpoint), and then target the local folder (server endpoint).

Adım Adım Çözüm

Deploy the Storage Sync Service resource in the Azure portal.

A Storage Sync Service resource is successfully created in your resource group.

This resource is the management and orchestration hub for Azure File Sync.

Download and install the Azure File Sync agent on the local Windows Server.

The agent and its associated background services are active on the server.

The server requires the local agent to orchestrate file sync and cloud tiering metadata transfers.

Run the server registration wizard and authenticate using your Azure credentials.

The Windows Server is registered and appears in the list of registered servers in the Storage Sync Service.

This registration authorizes the server to sync folders through this specific service.

Create a sync group inside the Storage Sync Service and associate an Azure file share as the cloud endpoint.

A sync group is initialized with a cloud endpoint linked to an Azure storage account.

The sync group defines the logical boundary for file sync, while the cloud endpoint designates the central cloud copy.

Add a server endpoint by specifying a path on the registered Windows Server to the sync group.

A server endpoint is active, and data begins syncing between the local directory and the cloud endpoint.

The server endpoint determines which local folder is mapped into the sync group.

Anahtar Kavram

Azure File Sync Deployment Workflow

Soru 164Soru →

You are configuring an autoscale policy for an Azure Virtual Machine Scale Set (VMSS) named `vmss1` that currently has a capacity of $3$ instances. The scale set uses the Uniform orchestration mode. You define the following autoscale rules within a single profile:

* Scale-out rule: Increase the instance count by $1$ when the average CPU percentage of the scale set is greater than $70\%$ for a duration of $10$ minutes.
* Scale-in rule: Decrease the instance count by $1$ when the average CPU percentage of the scale set is less than $55\%$ for a duration of $10$ minutes.
* Both rules have a cool-down period of $10$ minutes.

A sustained, constant workload requiring a total of $215\%$ CPU capacity (distributed evenly across all active instances) is applied to `vmss1`.

What is the behavior of the scale set under this workload, and how can you resolve any potential issues?

The scale set will experience transient CPU spikes and remain at

3

instances because the average CPU load must exceed the scale-out threshold by at least

15\%

before scaling triggers. To resolve this, you should increase the scale-out threshold to

85\%

The scale set will scale out to

4

instances and remain stable because the cool-down period prevents any scale-in events once the scale-out event completes under a sustained load. To resolve the performance latency, you must decrease the cool-down period to

5

minutes.

The scale set will enter an infinite loop of scaling out to

4

instances and scaling in to

3

instances (thrashing). To resolve this, you should decrease the scale-in threshold to

50\%

The scale set will scale in to

2

instances and remain stable because the scale-in rule takes precedence over the scale-out rule when metrics conflict. To resolve this, you must delete the scale-in rule and rely on manual scaling.

Cevabı ve açıklamayı göster

Cevap: The scale set will enter an infinite loop of scaling out to $4$ instances and scaling in to $3$ instances (thrashing). To resolve this, you should decrease the scale-in threshold to $50\%$ .

Cevap

The scale set will enter an infinite loop of scaling out to 4 instances and scaling in to 3 instances (thrashing). To resolve this, you should decrease the scale-in threshold to 50%.

The correct option is the one describing that the scale set will enter an infinite loop (thrashing) and suggesting lowering the scale-in threshold. At

3

instances, a load of

215\%

results in an average CPU of

71.67\%

, which exceeds the

70\%

scale-out threshold. After the duration is met, the scale set adds

1

instance, making the capacity

4

instances. At

4

instances, the average CPU load drops to

53.75\%

, which is below the

55\%

scale-in threshold, triggering a scale-in back to

3

instances. This cycle repeats indefinitely. Decreasing the scale-in threshold to

50\%

prevents the scale-in rule from triggering when the instance count is

4

, stabilizing the scale set.

Adım Adım Çözüm

Calculate the average CPU utilization per instance at the starting capacity of

3

instances under the total workload demand of

215\%

Each instance runs at approximately

71.67\%

CPU utilization (

215\% / 3

To determine whether the initial conditions will trigger a scale-out rule (

> 70\%

Analyze the scaling action and the resulting instance count.

The average CPU utilization (

71.67\%

) exceeds the scale-out threshold (

70\%

), causing the scale set to add

1

instance, bringing the total capacity to

4

instances.

To trace the first state transition of the scale set.

Calculate the average CPU utilization per instance at the new capacity of

4

instances under the same workload of

215\%

Each instance runs at

53.75\%

CPU utilization (

215\% / 4

To evaluate the scale set state against the scale-in threshold (

< 55\%

) once the new instances are active.

Identify the stability of the new state and determine the resolution.

The new CPU utilization (

53.75\%

) falls below the scale-in threshold (

55\%

), triggering a scale-in back to

3

instances. This creates an infinite loop of scaling (thrashing). To resolve it, the scale-in threshold must be set below

53.75\%

(e.g.,

50\%

) so that the scale-in rule does not trigger at

4

instances.

To resolve the thrashing by ensuring the scale-in threshold accounts for the capacity increase from scaling out.

Anahtar Kavram

Avoiding autoscale flapping (thrashing) by correctly spacing metric thresholds to account for capacity changes.

Tahmini Süre:3m 0s

Soru 165Soru →

An administrator needs to create a new security group named IT-Admins in a Microsoft Entra ID tenant. The group will be assigned the Helpdesk Administrator role. Which of the following configurations must the administrator select during the group creation process? (Select TWO.)

Geçerli olan tümünü seçin

Set 'Membership type' to Assigned

Set 'Microsoft Entra roles can be assigned to the group' to Yes

Set 'Membership type' to Dynamic User and define a query for the IT department

Assign the Helpdesk Administrator role to the group using an Azure RBAC subscription-level assignment

Cevabı ve açıklamayı göster

Cevap: Set 'Membership type' to Assigned; Set 'Microsoft Entra roles can be assigned to the group' to Yes

Cevap

Setting the 'Membership type' to 'Assigned' and setting 'Microsoft Entra roles can be assigned to the group' to 'Yes' are both required configurations.

To assign Microsoft Entra roles directly to a security group, the group must be configured as a role-assignable group. This requires setting the 'Microsoft Entra roles can be assigned to the group' option to 'Yes' during the group creation process, which in turn forces the 'Membership type' to 'Assigned' because dynamic groups cannot be assigned to Microsoft Entra roles.

Adım Adım Çözüm

Determine the type of role to be assigned.

The Helpdesk Administrator role is a Microsoft Entra ID role.

Microsoft Entra ID roles require specific group configurations for direct assignment, unlike Azure RBAC roles.

Evaluate the membership type constraint for role-assignable groups.

Dynamic membership types (Dynamic User or Dynamic Device) are not allowed for role-assignable groups.

Microsoft Entra ID requires role-assignable groups to have their membership type set to 'Assigned'.

Identify the creation-time configuration required for role assignment.

The option 'Microsoft Entra roles can be assigned to the group' must be set to 'Yes' during creation.

This switch is only available during the creation phase of the group and cannot be enabled later.

Anahtar Kavram

Microsoft Entra ID Role-Assignable Groups

Soru 166Soru →

Krypton Labs is planning to deploy a new application in the East US 2 region. The application architecture consists of a web tier with two virtual machines (VM-Web1 and VM-Web2) and a database tier with two virtual machines (VM-Db1 and VM-Db2).

The deployment must satisfy the following requirements:
- The web tier must be protected against datacenter-wide outages.
- The database tier VMs must be located in the same physical datacenter to maintain minimal network latency.
- Traffic must be distributed across the web tier VMs.

Which of the following configurations should you select to meet these requirements?

Deploy VM-Web1 and VM-Web2 across different Availability Zones and associate them with a Basic Load Balancer. Deploy VM-Db1 and VM-Db2 within an Availability Set.

Deploy VM-Web1 and VM-Web2 across different Availability Zones and associate them with a Standard Load Balancer. Deploy VM-Db1 and VM-Db2 within an Availability Set.

Deploy VM-Web1 and VM-Web2 within an Availability Set and associate them with a Standard Load Balancer. Deploy VM-Db1 and VM-Db2 across different Availability Zones.

Deploy VM-Web1, VM-Web2, VM-Db1, and VM-Db2 within a single Availability Set and associate all virtual machines with a Standard Load Balancer.

Cevabı ve açıklamayı göster

Cevap: Deploy VM-Web1 and VM-Web2 across different Availability Zones and associate them with a Standard Load Balancer. Deploy VM-Db1 and VM-Db2 within an Availability Set.

Cevap

Deploy the web tier virtual machines (VM-Web1 and VM-Web2) across different Availability Zones using a Standard Load Balancer, and deploy the database tier virtual machines (VM-Db1 and VM-Db2) within an Availability Set.

Deploying the web tier virtual machines across different Availability Zones protects them from datacenter-wide outages because Availability Zones are physically separate datacenters within an Azure region. Since the web tier virtual machines span different Availability Zones, a Standard Load Balancer must be used, as the Basic SKU does not support zone-spanning configurations. Placing the database tier virtual machines within a single Availability Set keeps them within the same physical datacenter to minimize network latency while protecting them against hardware failures through fault and update domains.

Adım Adım Çözüm

Analyze the high availability requirements for the web tier.

The web tier requires protection against datacenter-wide outages, which necessitates the use of Availability Zones (physically separate datacenters within a region) rather than Availability Sets (logical groupings within a single datacenter).

Availability Zones offer protection from datacenter-level failures, whereas Availability Sets only protect against localized hardware failures within a single datacenter.

Select the correct Load Balancer SKU for the web tier.

A Standard Load Balancer must be chosen to distribute traffic to the web tier VMs across different Availability Zones.

A Basic Load Balancer does not support zone-redundant backend pools or spanning across Availability Zones.

Analyze the network latency requirements for the database tier.

The database tier VMs must be in the same datacenter to minimize network latency, which is achieved by deploying them in an Availability Set.

An Availability Set ensures the VMs are kept within the same physical datacenter to avoid cross-zone latency while still providing protection against hardware failures via fault and update domains.

Anahtar Kavram

Configuring VMs for high availability involves choosing between Availability Zones for zone-level resilience and Availability Sets for rack-level resilience within a single datacenter, along with matching supporting resources like the Standard Load Balancer SKU.

Tahmini Süre:2m 0s

Soru 167Soru →

An administrator is managing a standard General Purpose v2 (GPv2) storage account named `corpdatafiles` in the East US region. The storage account is currently configured to use locally redundant storage (LRS).

You need to implement the following requirements:
1. Replicate all data to a secondary region while ensuring that read access to the replicated data is available at all times, even without initiating a failover.
2. Automate the transition of block blobs in a container named `billing` to the Archive tier if the blobs have not been modified for more than 90 days.

Which two actions should you perform to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the replication setting of `corpdatafiles` to Read-access geo-redundant storage (RA-GRS).

Initiate a live migration request to convert the replication setting of `corpdatafiles` to Geo-zone-redundant storage (GZRS).

Create a lifecycle management rule that uses the prefix filter `billing/` and includes an action to transition the blobs to the Archive tier 90 days after last modification.

Assign the Storage Blob Data Contributor role to the storage account's system-assigned managed identity to authorize lifecycle and replication operations.

Cevabı ve açıklamayı göster

Cevap: Configure the replication setting of `corpdatafiles` to Read-access geo-redundant storage (RA-GRS).; Create a lifecycle management rule that uses the prefix filter `billing/` and includes an action to transition the blobs to the Archive tier 90 days after last modification.

Cevap

To satisfy the requirements, the replication settings must be configured to Read-access geo-redundant storage (RA-GRS) and a lifecycle management rule must be created using the prefix filter `billing/` to transition the blobs to the Archive tier after 90 days.

The correct actions are to update the replication of the storage account to Read-access geo-redundant storage (RA-GRS) and to implement a lifecycle management rule with a prefix filter matching the target container. Upgrading the replication from LRS to RA-GRS can be performed directly through a configuration change, which automatically enables read access to the secondary region. Creating a lifecycle rule with the prefix `billing/` correctly targets blobs within the `billing` container, allowing them to transition to the Archive tier 90 days after modification.

Adım Adım Çözüm

Update the storage account replication from LRS to RA-GRS.

The storage account is configured to replicate data to the paired secondary region, and the secondary endpoint becomes available for read access.

Converting LRS to RA-GRS is a supported direct conversion path that satisfies the geo-redundancy and read-access requirements without requiring a failover or live migration request.

Define a lifecycle management policy rule with a prefix filter for `billing/`.

The policy is scoped to target only the blobs within the `billing` container.

Specifying the container name followed by a slash matches all blobs inside that container.

Add a transition action to the lifecycle rule targeting block blobs.

Blobs are automatically moved to the Archive tier 90 days after their last modification date.

Lifecycle management executes transitions based on the days since last modification, helping optimize storage costs for inactive data.

Anahtar Kavram

Configuring replication settings to enable read access in the secondary region and setting up lifecycle management rules with prefix filters to transition block blobs to cheaper tiers.

Soru 168Soru →

A company plans to use Azure File Sync to synchronize files between an on-premises server named Server1 and an Azure file share named share1. The company has an established ExpressRoute connection between the on-premises network and Azure. To comply with security policies, all synchronization traffic must be routed over the private connection. An administrator performs the following configurations:
1. Deploys a Storage Sync Service named Sync1.
2. Creates a sync group named SyncGroup1 in Sync1, and configures share1 as the cloud endpoint.
3. Restricts network access to the storage account hosting share1 by setting public network access to disabled.
4. Creates a private endpoint for Sync1 in the Azure virtual network and configures DNS resolution for the Storage Sync Service.
5. Installs the Azure File Sync agent on Server1 and registers Server1 with Sync1.
6. Adds Server1 as a server endpoint in SyncGroup1.

After these configurations are applied, the synchronization health status for Server1 shows an error, and files fail to sync. Which action must the administrator perform to resolve this issue?

Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.

Enable the 'Allow Azure services on the trusted services list to access this storage account' setting on the storage account firewall.

Assign the Storage File Data SMB Share Reader RBAC role to the Server1 computer object in Microsoft Entra ID.

Enable Cloud Tiering on the Server1 endpoint and configure a date policy to sync only files accessed within the last 14 days.

Cevabı ve açıklamayı göster

Cevap: Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.

Cevap

Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.

The correct answer is correct because Azure File Sync requires connectivity to both the Storage Sync Service and the storage account hosting the target file share. When public access to the storage account is disabled, the local sync agent on Server1 cannot transfer data. Since the sync agent runs on-premises, its traffic is not covered by internal Azure bypasses. Therefore, a private endpoint for the 'file' sub-resource must be configured in the virtual network, allowing the agent to resolve the storage account's FQDN to a private IP and route the sync traffic over the ExpressRoute link.

Adım Adım Çözüm

Identify the communication pathways required by the Azure File Sync agent.

The agent on Server1 must communicate with the Storage Sync Service (management plane) and the Storage Account (data plane).

Without connectivity to both endpoints, metadata and file data cannot be synchronized.

Evaluate the network connectivity settings of the storage account.

Public network access is disabled on the storage account, meaning the agent cannot connect to the default public endpoint over the Internet.

This restriction blocks all inbound traffic to the file share from the on-premises server.

Examine if the 'trusted services list' setting can bypass this block for the on-premises agent.

The traffic originates from the on-premises server (Server1), which does not qualify as an internal Azure trusted service.

The firewall bypass rule only applies to direct requests from internal Azure services, not to on-premises agents.

Determine the necessary network configuration for private routing.

Create a private endpoint for the storage account using the 'file' sub-resource on the virtual network and configure appropriate DNS resolution.

This establishes a private IP address for the storage account on the virtual network, which is reachable from Server1 over the ExpressRoute connection.

Anahtar Kavram

Azure File Sync Private Endpoint Configuration

Soru 169Soru →

A company has an Azure Storage account that is configured to allow network access only from 'Selected virtual networks and IP addresses'. An administrator needs to ensure that the Azure Backup service can successfully access the storage account to perform backup operations. Which network configuration change should the administrator apply to the storage account?

Assign the Storage Blob Data Owner role to the Azure Backup service principal.

Create a Network Security Group (NSG) rule to allow inbound traffic from the Azure Backup service tag.

Enable the exception that allows trusted Microsoft services to access the storage account.

Enable a service endpoint for Microsoft.Storage on the subnet containing the Azure Backup vault.

Cevabı ve açıklamayı göster

Cevap: Enable the exception that allows trusted Microsoft services to access the storage account.

Cevap

Enable the exception that allows trusted Microsoft services to access the storage account.

Enabling the exception to allow trusted Microsoft services to access the storage account is the correct configuration. When a storage account firewall is enabled, Azure services that are defined as trusted, such as Azure Backup, can bypass the firewall restrictions if this exception is checked.

Adım Adım Çözüm

Navigate to the Azure Storage account in the Azure Portal.

The storage account management blade is displayed.

To modify storage account network settings, you must navigate to the specific storage account resource.

Under the Security + networking section, select Networking.

The Firewalls and virtual networks configuration tab is opened.

This is where public network access limits, virtual network rules, IP firewalls, and resource exceptions are managed.

Under Exceptions, check the box for 'Allow Azure services on the trusted services list to access this storage account'.

The firewall bypass rule for trusted Microsoft services is enabled.

This exception allows services like Azure Backup to bypass the firewall and access storage resources securely.

Anahtar Kavram

Bypassing Azure Storage firewall rules for trusted Microsoft services to ensure managed platform services can access the storage data.

Tahmini Süre:45s

Soru 170Soru →

Determine whether the following statement is true or false:

In Azure Cost Management, budget alerts can be configured to trigger when forecasted costs exceed a specified threshold percentage of the budget.

Doğru

Yanlış

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True

Budget alerts in Azure Cost Management support triggering based on both actual costs and forecasted costs, allowing for proactive cost management.

Adım Adım Çözüm

Analyze the capabilities of Azure Cost Management budget alerts.

Azure budget alerts can monitor spending and notify administrators when thresholds are met.

To evaluate the statement, we must understand what parameters can trigger a budget alert.

Determine if budget alerts support both actual and forecasted cost evaluations.

Azure supports 'Actual' triggers (based on accumulated cost) and 'Forecasted' triggers (based on predicted trend).

This confirms whether forecasted costs are a valid alert trigger.

Confirm the truth value of the statement.

Since forecasted costs can trigger budget alerts, the statement is True.

To complete the evaluation of the statement.

Anahtar Kavram

Azure Budget Alert Triggers

Soru 171Soru →

A company's Azure environment contains the following resource hierarchy:
- Management Group: `MG-Finance`
- Subscription: `Sub-Treasury`
- Resource Group: `rg-vault`

A security principal named `AppService-SP` is assigned the Reader role at the `MG-Finance` management group level. An administrator also assigns the Contributor role to `AppService-SP` at the `rg-vault` resource group level.
A developer needs to determine the effective permissions of `AppService-SP` for a key vault named `kv-secrets` located inside `rg-vault`.
Which permissions does `AppService-SP` have for `kv-secrets`?

Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.

Reader permissions only, because the Reader assignment at the management group level takes precedence.

Contributor permissions only, because role assignments at a lower scope override assignments at a higher scope.

No permissions, because conflicting role assignments at different scopes result in access being denied.

Cevabı ve açıklamayı göster

Cevap: Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.

Cevap

Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.

The correct answer is correct because Azure RBAC role assignments are additive. A security principal's effective permissions are the sum of all roles assigned at the current scope and any inherited parent scopes. In this scenario, the Contributor role assigned at the resource group scope provides broader access than the Reader role inherited from the management group, granting Contributor-level permissions on the key vault.

Adım Adım Çözüm

Analyze the role assignments and their respective scopes in the resource hierarchy.

Identify that the Reader role is assigned at the Management Group scope and the Contributor role is assigned at the Resource Group scope.

To evaluate how permissions propagate down the resource hierarchy.

Determine how permissions inherit down to the child resource.

The key vault (`kv-secrets`) inherits the Reader role from the Management Group and the Contributor role from the Resource Group.

To map all active role assignments applying to the target resource.

Apply the Azure RBAC additive permission model to calculate the effective permissions.

The security principal receives the combined permissions of both roles, where the broader Contributor role includes all operations, resulting in effective Contributor access.

Azure RBAC roles do not override or block each other; they accumulate to form the effective permissions.

Anahtar Kavram

Azure RBAC inheritance and additive permission model

Soru 172Soru →

An organization has a standard General Purpose v2 (GPv2) storage account named proddatastore configured with Geo-Redundant Storage (GRS). A lifecycle management policy is applied to proddatastore to transition logs from the Hot tier to the Archive tier after 30 days, and delete them after 90 days. An administrator is preparing a disaster recovery plan and needs to determine the behavior of the lifecycle management policy and data replication during normal operations and after a potential customer-managed failover. Which of the following statements correctly describes how Azure handles the lifecycle management policy and replication for this storage account?

The lifecycle management policy executes on the primary region and replicates tier changes to the secondary; however, initiating a customer-managed failover permanently deletes the lifecycle policy definition, requiring the administrator to recreate the rules on the new primary region.

The lifecycle management policy runs independently on both the primary and secondary regions to ensure policy consistency; however, blobs cannot be transitioned to the Archive tier while GRS is enabled, causing the policy to fail.

The lifecycle management policy runs only in the primary region, with all tier transitions and deletions replicated asynchronously to the secondary region; if a customer-managed failover is initiated, the lifecycle policy definition is preserved and executes in the new primary region.

The lifecycle management policy executes on the primary region, but all policy actions will fail unless the administrator explicitly assigns the Storage Blob Data Contributor role to the Azure Lifecycle Management service principal at the storage account scope.

Cevabı ve açıklamayı göster

Cevap: The lifecycle management policy runs only in the primary region, with all tier transitions and deletions replicated asynchronously to the secondary region; if a customer-managed failover is initiated, the lifecycle policy definition is preserved and executes in the new primary region.

Cevap

The correct option stating that the policy runs only in the primary region and is preserved after failover is correct because lifecycle management execution is a data plane activity that occurs on the primary endpoint, and any resulting tier changes or deletions are replicated asynchronously to the secondary region via GRS. Because the lifecycle policy definition is stored as part of the storage account's control plane configuration, it is replicated to the secondary region and remains active to execute on the new primary region after a failover.

Adım Adım Çözüm

Analyze how lifecycle policies execute in replicated storage accounts.

Identify that lifecycle policies run on the primary endpoint, and the resulting tier updates or deletions are replicated asynchronously to the secondary region.

Lifecycle policies modify blob properties and state, which are data plane changes subject to GRS replication.

Evaluate the replication behavior of control plane configurations.

Determine that the policy definition is metadata stored in the storage account configuration, which is replicated to the secondary region.

Control plane metadata is synced to ensure parity between regions in the event of a failover.

Assess the state of the lifecycle policy post-failover.

Confirm that after a customer-managed failover, the secondary region becomes the new primary and the preserved policy continues to execute.

Because the policy configuration is replicated, no administrator action is needed to re-apply the lifecycle rules.

Anahtar Kavram

Azure Storage lifecycle policies execute on the primary region and replicate data state changes to the secondary region, while the policy configuration is preserved during failover.

Soru 173Soru →

AeroSpace Dynamics has a business requirement to deploy three new virtual machines, VM-Flight1, VM-Flight2, and VM-Flight3, in the West US 2 region. The deployment must protect the application from localized hardware failures within a single datacenter while minimizing latency. Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

Create a new availability set.

Associate all three virtual machines with the availability set during their deployment.

Associate the virtual machines with the availability set after they have been fully provisioned.

Configure the availability set to span across three availability zones in the West US 2 region.

Cevabı ve açıklamayı göster

Cevap: Create a new availability set.; Associate all three virtual machines with the availability set during their deployment.

Cevap

Create a new availability set and associate all three virtual machines with the availability set during their deployment.

To protect the virtual machines from localized hardware failures within a single datacenter, the VMs must be grouped into an availability set. The availability set must be created, and the virtual machines must be associated with the availability set during their initial deployment. This ensures that the VMs are distributed across separate physical hardware racks (fault domains) and power/cooling infrastructures.

Adım Adım Çözüm

Determine the high availability option that protects against localized hardware failures within a single datacenter.

Identify that an availability set is the appropriate solution for localized hardware failures within a single datacenter, whereas availability zones protect against datacenter-wide failures.

An availability set automatically distributes VMs across fault and update domains within a single datacenter to provide

99.95\%

availability SLA.

Identify the creation and association rules for availability sets.

Confirm that the availability set must exist first and VMs must be assigned to it during their creation phase.

Azure does not support moving an already deployed VM into an availability set; the VM must be configured with the availability set at launch time.

Anahtar Kavram

Azure Availability Sets configuration and constraints

Soru 174Soru →

You need to delegate password reset permissions for a specific subset of users in your Microsoft Entra ID tenant by using an administrative unit. Which sequence of steps should you perform to complete the delegation? To answer, arrange the actions in the correct order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is to first create the administrative unit in the Microsoft Entra admin center, then add the target users to the administrative unit, and finally assign the Helpdesk Administrator role to the delegated administrator scoped to the administrative unit.

To delegate management of a specific subset of users, you must first establish the scope boundary by creating an administrative unit. Next, you populate the administrative unit by adding the target users. Finally, you assign the administrative role to the delegated administrator with the scope restricted to that administrative unit. This ensures the administrator's capabilities are limited to the members of the administrative unit.

Adım Adım Çözüm

Create the administrative unit in Microsoft Entra ID.

An administrative unit is created to act as the boundary for delegated permissions.

The container must exist before members can be added or roles can be scoped to it.

Add the target users to the administrative unit.

The target users are members of the administrative unit.

Members must be in the administrative unit so that the delegated administrator's scoped permissions apply to them.

Assign the Helpdesk Administrator role to the delegated administrator with the administrative unit as the scope.

The delegated administrator receives helpdesk permissions only for the members of the administrative unit.

This step applies the role assignment to the delegated admin, restricting their authority to the defined administrative unit scope.

Anahtar Kavram

Delegation of administrative roles using administrative units as scopes

Soru 175Soru →

Your company has an Azure environment with a management group named `MG-Corp` and two subscriptions named `Sub-App` and `Sub-Shared`. `Sub-Shared` contains a resource group named `RG-Monitoring` which hosts a storage account named `saexportdata`.

You need to configure Azure Cost Management to meet the following requirements:
- Automatically export daily cost data of `Sub-App` to the `saexportdata` storage account.
- Trigger an automated runbook located in `Sub-Shared` to stop non-production workloads when the monthly costs of `Sub-App` exceed $10,000$ USD.

Which two actions should you perform? (Select two.)

Geçerli olan tümünü seçin

In `Sub-App`, create a budget and configure an alert threshold associated with an action group that targets the runbook.

In `Sub-App`, create a budget with a limit of

10,000

USD and associate the action group directly to the budget scope without defining alert thresholds.

In `Sub-App`, configure a Cost Management export that targets the `saexportdata` storage account.

Apply a `ReadOnly` lock to `RG-Monitoring` to prevent accidental deletion of `saexportdata` while permitting the daily export.

Cevabı ve açıklamayı göster

Cevap: In `Sub-App`, create a budget and configure an alert threshold associated with an action group that targets the runbook.; In `Sub-App`, configure a Cost Management export that targets the `saexportdata` storage account.

Cevap

The correct actions are: (1) In the source subscription, create a budget and configure an alert threshold associated with an action group that targets the runbook; and (2) In the source subscription, configure a Cost Management export that targets the storage account.

To meet the requirements, you must perform two actions. First, to automatically export daily cost data of one subscription to a storage account in another subscription within the same tenant, you can configure a Cost Management export in the source subscription pointing to the target storage account. Second, to trigger an automated runbook when the monthly cost exceeds a threshold, you must create a budget in the source subscription and configure an alert threshold (such as

100\%

) linked to an action group that targets the runbook.

Adım Adım Çözüm

Identify the mechanism to automate actions based on cost limits.

Determine that Azure Budgets can trigger Action Groups, which can execute Automation runbooks.

This is necessary to satisfy the requirement of stopping non-production workloads when costs exceed a threshold.

Determine the configuration requirements for budget alerts.

Confirm that an alert threshold must be defined to associate the budget with an Action Group.

Simply creating a budget limit without alert thresholds will not trigger any automated action.

Analyze how to export daily cost data to a storage account in a different subscription.

Verify that Azure Cost Management exports support cross-subscription destinations within the same Microsoft Entra tenant.

This allows exporting `Sub-App` cost data directly to `saexportdata` in `Sub-Shared`.

Evaluate the effect of resource locks on the storage account's resource group.

Recognize that a `ReadOnly` lock blocks `listKeys` (a POST operation) which is required for the export to write data.

This shows that applying a `ReadOnly` lock on the destination resource group will cause the export to fail.

Anahtar Kavram

Azure Cost Management budgets require alert thresholds to trigger action groups. Cost exports can target storage accounts in different subscriptions within the same tenant, but control-plane blocking configurations like `ReadOnly` locks will prevent the export from writing data by blocking key retrieval.

Soru 176Soru →

You configure Azure File Sync to synchronize files between an on-premises Windows Server and an Azure file share. You need to minimize local storage usage on the Windows Server by keeping only recently accessed files on the local disk. What should you configure?

Enable cloud tiering on the server endpoint.

Disable the trusted Microsoft services exception on the storage account firewall.

Assign the Storage Blob Data Contributor role to the Windows Server.

Configure a Shared Access Signature (SAS) token with no expiration date for the file share.

Cevabı ve açıklamayı göster

Cevap: Enable cloud tiering on the server endpoint.

Cevap

Enable cloud tiering on the server endpoint.

Enabling cloud tiering on the server endpoint ensures that infrequently accessed files are replaced with pointer files (stubs) locally, while the full file content is safely stored in the Azure file share, thereby reducing the local server's storage consumption.

Adım Adım Çözüm

Analyze the technical requirement to keep only active, recently accessed files on the local Windows Server while storing the rest in the cloud.

Identify that Cloud Tiering is the specific Azure File Sync feature designed to optimize local server storage in this manner.

Cloud tiering allows the local server to act as a cache of the full dataset stored in the cloud.

Identify the resource configuration location where cloud tiering is enabled.

Cloud tiering must be enabled on the server endpoint within the sync group.

The server endpoint represents the specific path on the registered server where syncing occurs.

Anahtar Kavram

Azure File Sync Cloud Tiering

Soru 177Soru →

Your company has a Microsoft Entra ID tenant named contoso.com that has Microsoft Entra ID P1 licenses assigned to all users. You configure Self-Service Password Reset (SSPR) for the tenant with the following settings:

* Self-service password reset enabled: Selected
* Select group: Group1
* Number of methods required to reset: 1
* Methods available to users: Email, Security questions

`Group1` contains the following users:
* User1: A standard member user who is not assigned any administrator roles.
* User2: A member user assigned the Helpdesk Administrator role.
* User4: A B2B guest user whose identity is managed in an external Microsoft Entra ID tenant.

`User3` is a member user assigned the User Administrator role. `User3` is not a member of `Group1`.

All four users have registered their corporate email address and security questions as authentication methods in contoso.com.

Which users can successfully reset their password by using the SSPR portal of contoso.com?

User1 and User2 only

User1 only

User1 and User3 only

User1, User2, and User4 only

Cevabı ve açıklamayı göster

Cevap: User1 only

Cevap

Only User1 can successfully reset their password.

The correct option is the one stating that only User1 can reset their password. User1 is a standard user scoped to the SSPR policy who has registered the one required method (email). Administrators (User2 and User3) bypass group scoping but are restricted by the default administrator policy requiring two gates, which also excludes security questions. B2B guest users (User4) cannot reset their credentials in the host tenant.

Adım Adım Çözüm

Evaluate SSPR scope and requirements for the standard user (User1).

User1 is a member of Group1 and holds no admin roles. The scoped SSPR policy applies, requiring 1 method. Since User1 has registered their email (which is an enabled method), User1 can successfully reset their password.

Standard users are governed by the tenant's scoped SSPR policy.

Evaluate SSPR requirements for the administrator users (User2 and User3).

Both User2 (Helpdesk Administrator) and User3 (User Administrator) are governed by the default Microsoft Entra ID administrator SSPR policy. This policy automatically applies to administrators, requires two gates (authentication methods), and explicitly excludes security questions as a valid gate. Since both users only have email and security questions registered, they only possess one valid gate (email) and cannot reset their passwords.

Administrators require a two-gate reset process and cannot use security questions.

Evaluate SSPR requirements for the B2B guest user (User4).

User4 is an external B2B guest user whose source of authority is an external Microsoft Entra ID tenant. They cannot reset their password in the host tenant's SSPR portal and must do so at their home identity provider.

SSPR in a host tenant is not supported for B2B collaboration users whose credentials are managed by an external identity provider.

Anahtar Kavram

Microsoft Entra ID enforces a default two-gate SSPR policy for administrator roles that bypasses group scoping, requires two valid methods, and excludes security questions. Additionally, external B2B guest users cannot use the host tenant's SSPR portal if their credentials are managed by an external identity provider.

Soru 178Soru →

You manage a Microsoft Entra ID tenant. You have the following users configured in the tenant:

User	Department	UserType
User1	Sales	Member
User2	sales	Member
User3	Marketing	Member
User4	Sales	Guest

You create a dynamic user group named SalesGroup and configure the dynamic membership rule for SalesGroup as follows:

`(user.department -eq "Sales") -and (user.userType -ne "Guest")`

Which users are members of SalesGroup?

User1 only

User1 and User2 only

User1, User2, and User4 only

User1, User2, User3, and User4

Cevabı ve açıklamayı göster

Cevap: User1 and User2 only

Cevap

User1 and User2 only

The correct answer is the option stating 'User1 and User2 only'. In Microsoft Entra ID, dynamic membership rules evaluate string attributes without case sensitivity, so 'Sales' matches both 'Sales' and 'sales'. Since both User1 and User2 are members, and User4 is a guest, they are the only users matching both conditions of the rule.

Adım Adım Çözüm

Evaluate the department condition: `user.department -eq "Sales"`.

User1, User2, and User4 match.

Microsoft Entra ID dynamic group membership rules perform case-insensitive string comparisons. Therefore, both 'Sales' and 'sales' satisfy this condition, while 'Marketing' does not.

Evaluate the user type condition: `user.userType -ne "Guest"`.

User1 and User2 match.

The `-ne` operator means 'not equal'. User1 and User2 have a UserType of 'Member', which satisfies this condition. User4 has a UserType of 'Guest', so they are excluded.

Combine the results of both conditions using the logical `-and` operator.

Only User1 and User2 satisfy both conditions.

The logical `-and` operator requires both parts of the rule to evaluate to true for a user to be included.

Anahtar Kavram

Microsoft Entra ID dynamic group membership rules use case-insensitive string comparisons and logical operators to determine group membership.

Tahmini Süre:1m 30s

Soru 179Soru →

An organization's Microsoft Entra ID tenant contains the following resources:
- An administrative unit named Office-AU
- A user named Admin1 who is assigned the User Administrator role scoped to Office-AU
- A user named User1 who is a member of Office-AU
- A dynamic user group named Group1 with the membership rule: (user.jobTitle -eq "Specialist")
- A group-based licensing configuration on Group1 that assigns a Microsoft 365 E5 license

User1 has the Job Title set to Specialist, but the Usage Location property is blank. As a result, User1 is automatically added as a member of Group1, but has a licensing assignment state of UsageLocationRequired.

You need to resolve the licensing error and ensure that User1 receives the Microsoft 365 E5 license.

Which action should you perform?

Have Admin1 update the Usage Location property of User1.

Have Admin1 manually remove User1 from Group1 and assign the Microsoft 365 E5 license directly.

Assign the User Access Administrator RBAC role for the Azure subscription to Admin1, and then have Admin1 update the license assignment on Group1.

Have Admin1 assign an Azure RBAC Contributor role to User1 at the Office-AU scope to bypass the license requirement.

Cevabı ve açıklamayı göster

Cevap: Have Admin1 update the Usage Location property of User1.

Cevap

Have Admin1 update the Usage Location property of User1.

The correct action is to update the Usage Location property of the user. Because the user is a member of the administrative unit, the delegated User Administrator has the required directory permissions to edit the user's properties. Once the Usage Location is set, Microsoft Entra ID automatically processes the pending license assignment.

Adım Adım Çözüm

Identify the cause of the licensing failure.

The licensing failure is caused by a missing Usage Location on User1, which is a prerequisite for assigning Microsoft 365 licenses.

Microsoft 365 licenses cannot be assigned to users who do not have a Usage Location configured.

Determine the administrative permissions required to update the user's properties.

Admin1 is a User Administrator scoped to the Office-AU administrative unit, and User1 is a member of Office-AU.

An administrative unit scopes directory permissions, allowing the delegated administrator to manage properties of users within that unit.

Verify if the administrator can update the user's profile.

Admin1 can update User1's Usage Location to a valid country code.

Once the Usage Location is set, Microsoft Entra ID automatically processes the group-based license assignment for the user.

Anahtar Kavram

Administrative Unit scoping and Group-based licensing troubleshooting

Tahmini Süre:2m 0s

Soru 180Soru →

Aether Financial plans to deploy a new transaction application in the Australia East region. The application will run on two virtual machines named VM-Tx1 and VM-Tx2. The application architecture must meet the following requirements:

- Protect the virtual machines from datacenter-wide failures.
- Guarantee a virtual machine SLA of at least $99.99\%$ .

Which two options should you select to meet the requirements? (Select two.)

Geçerli olan tümünü seçin

Deploy VM-Tx1 in Availability Zone

1

and VM-Tx2 in Availability Zone

2

Configure a Standard SKU Load Balancer to distribute traffic across the virtual machines.

Deploy both virtual machines in a single Availability Set configured with

3

fault domains.

Associate both virtual machines with a Basic SKU Load Balancer to route traffic across the zones.

Cevabı ve açıklamayı göster

Cevap: Deploy VM-Tx1 in Availability Zone $1$ and VM-Tx2 in Availability Zone $2$ .; Configure a Standard SKU Load Balancer to distribute traffic across the virtual machines.

Cevap

Deploy the virtual machines in separate Availability Zones and configure a Standard SKU Load Balancer to distribute traffic across them.

To satisfy the requirements of protecting the virtual machines from datacenter-wide failures and achieving a

99.99\%

SLA, you must deploy the virtual machines across different Availability Zones. Furthermore, because the virtual machines reside in different Availability Zones, a Standard SKU Load Balancer must be configured to distribute incoming traffic, as a Basic SKU Load Balancer does not support routing to backend resources across multiple zones.

Adım Adım Çözüm

Analyze the high availability and SLA constraints.

The requirements dictate protection against datacenter-wide failures and a minimum virtual machine SLA of

99.99\%

Availability Zones provide

99.99\%

SLA by isolating virtual machines in physically separate datacenters within a region, whereas Availability Sets only protect against failures inside a single datacenter (

99.95\%

SLA).

Select the correct deployment model for the virtual machines.

VM-Tx1 must be deployed in one Availability Zone (such as Zone

1

) and VM-Tx2 in another Availability Zone (such as Zone

2

Distributing the virtual machines across different Availability Zones satisfies the datacenter-wide failure protection and the

99.99\%

SLA requirements.

Identify the required load balancer SKU to distribute traffic across the zones.

Use a Standard SKU Load Balancer.

Only a Standard SKU Load Balancer supports backend pools containing virtual machines distributed across different Availability Zones. A Basic SKU Load Balancer is restricted to virtual machines in the same availability set or VMSS.

Anahtar Kavram

Azure Availability Zones and Load Balancer SKU Requirements for High Availability

ÖncekiSayfa 9 / 63Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram