Tüm alıştırma soruları

52 soru

Soru 1Soru

When implementing governance in Microsoft Azure, you must understand the relationship between different Azure Policy components. Match each Azure Policy component on the left with its correct functional description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Azure Policy Definition
Azure Policy Initiative
Azure Policy Assignment
Azure Policy Exclusion

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Azure Policy Definition matches the JSON file containing specific rules. Azure Policy Initiative matches a group of multiple policy definitions. Azure Policy Assignment matches the implementation at a specific scope. Azure Policy Exclusion matches a configuration that prevents a sub-scope from being evaluated.
Matching the policy definition to the JSON rule file, the initiative to the collection of definitions, the assignment to the application at a scope, and the exclusion to bypassing evaluation correctly maps each concept to its functional role in Azure resource governance.

Adım Adım Çözüm

1
Identify the basic building block of Azure Policy that outlines conditions and effects.
Azure Policy Definition contains the core policy logic, conditions, and effects (such as Deny or Audit) written in JSON format.
This establishes that definitions are the individual rules.
2
Determine how multiple policy definitions are consolidated for simplified tracking.
Azure Policy Initiative groups related definitions (such as compliance controls for a framework like PCI-DSS) to track compliance status collectively.
This clarifies the grouping role of initiatives.
3
Explain how policies or initiatives are activated at a specific scope in the resource hierarchy.
Azure Policy Assignment is the act of applying the policy or initiative to a management group, subscription, or resource group.
This explains the application and enforcement mechanism.
4
Differentiate the mechanism for bypassing policy application on sub-resources.
Azure Policy Exclusion allows administrators to omit specific sub-scopes (like a particular resource group) from the active policy assignment.
This details how scoping exceptions are handled.

Anahtar Kavram

Azure Policy Definitions, Initiatives, and Assignments form the core components of Azure governance, allowing administrators to define compliance standards, group them for easier tracking, apply them to scopes, and exclude sub-scopes.
Soru 2Soru

Your organization is configuring identity features in Microsoft Entra ID to support hybrid identity management and external collaboration. Match each Microsoft Entra feature to its corresponding administrative behavior.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Microsoft Entra B2B collaboration
Microsoft Entra B2B direct connect
Self-Service Password Reset (SSPR) writeback

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Microsoft Entra B2B collaboration matches with creating a guest user account in the host tenant. Microsoft Entra B2B direct connect matches with collaborating without creating guest user accounts. SSPR writeback matches with synchronizing password changes back to an on-premises directory.
The correct matches represent the core features of Microsoft Entra ID. B2B collaboration creates guest accounts for external sharing. B2B direct connect allows direct collaboration without guest account creation. SSPR writeback enables hybrid password synchronization from Entra ID to on-premises Active Directory.

Adım Adım Çözüm

1
Identify the mechanism used by Microsoft Entra B2B collaboration.
It creates a guest user object in the host tenant directory.
This guest account represents the external user and is used to assign permissions.
2
Identify the mechanism used by Microsoft Entra B2B direct connect.
It facilitates collaboration directly using home credentials, without creating any guest user account in the host directory.
Cross-tenant access settings establish a mutual trust between the two organizations.
3
Identify the function of Self-Service Password Reset (SSPR) writeback.
It writes password resets initiated in the cloud back to the on-premises Active Directory.
This ensures that passwords remain synchronized across hybrid environments.

Anahtar Kavram

Microsoft Entra identity features for external access (B2B collaboration vs. B2B direct connect) and hybrid password management (SSPR writeback).
Soru 3Soru

Your organization manages resources across a multi-layered Azure resource hierarchy. An administrator needs to configure permissions for various identities while strictly adhering to the principle of least privilege.

Match each security identity and business requirement to the most restrictive (least privilege) Azure Role-Based Access Control (RBAC) role and scope combination that satisfies the requirement.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A VM system-assigned managed identity (App-VM-MSI) that must retrieve application database connection strings stored as secrets from the vault named kv-prod-01 in App-RG. The key vault is configured to use Azure RBAC for authorization.
A security auditing group (Security-Auditors) that must view the configuration settings of all resources and check Azure Policy compliance states across all subscriptions under the Corp-MG management group, but must not view resource data or credentials.
A deployment service principal (Deploy-Agent) that must deploy virtual machines and storage accounts in Dev-RG, and must also assign required RBAC roles to those resources' managed identities during deployment.
A data synchronization service principal (Data-Sync-SP) that must read, write, and delete blobs inside the storage account sa-prod-data in Data-RG, but must not be allowed to modify the storage account's network firewalls or access keys.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches pair App-VM-MSI with Key Vault Secrets User at the vault scope; Security-Auditors with Reader at the Corp-MG management group scope; Deploy-Agent with Contributor and User Access Administrator at the Dev-RG scope; and Data-Sync-SP with Storage Blob Data Contributor at the sa-prod-data scope.
The correct pairings accurately select roles mapped to the least privilege model and correct scopes. The Reader role at the management group level ensures read-only metadata visibility across all child subscriptions. The Key Vault Secrets User role at the vault scope allows the application VM to read secrets without permitting secrets management. The combination of Contributor and User Access Administrator at the resource group level enables resource deployment and role assignment without granting full subscription ownership. The Storage Blob Data Contributor role at the storage account scope allows blob manipulations without exposing control plane operations.

Adım Adım Çözüm

1
Analyze the VM managed identity requirement.
It needs to read database connection strings (secrets) from a key vault using RBAC authorization.
Identify the minimum role that can read secret values (Key Vault Secrets User) and the narrowest scope (the specific key vault resource).
2
Analyze the security auditing group requirement.
It needs read-only metadata access to all resources and policy compliance across multiple subscriptions under a management group.
Identify the standard Reader role, which does not expose secrets/keys. Determine the inheritance scope at the parent management group (Corp-MG).
3
Analyze the deployment service principal requirement.
It needs to create resources (VMs and storage) and also configure RBAC role assignments for those resources' managed identities.
Recognize that creating resources requires Contributor, and configuring assignments requires User Access Administrator. Scope both to Dev-RG to restrict access to the development environment.
4
Analyze the data synchronization service principal requirement.
It needs read/write/delete operations on blobs (data plane) but must not modify firewalls or read access keys (control plane).
Identify the Storage Blob Data Contributor role, which target data plane access only. Restrict the scope to the specific storage account (sa-prod-data).

Anahtar Kavram

Azure RBAC configurations must separate control plane and data plane permissions, leverage management group and resource group scopes for inheritance, and combine specific built-in roles to meet complex automation requirements without violating the principle of least privilege.
Tahmini Süre:3m 0s
Soru 4Soru

When deploying virtual machines in Azure, you must select the appropriate managed disk type for the OS and data disks based on performance and workload requirements. Match each Azure managed disk type to its primary characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ultra Disk
Premium SSD
Standard SSD
Standard HDD

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ultra Disk matches with the ability to dynamically scale IOPS and throughput with sub-millisecond latency. Premium SSD matches with high-performance production workloads that support host caching. Standard SSD matches with consistent entry-level performance for web servers. Standard HDD matches with low-cost storage for infrequently accessed data.
Each Azure managed disk option is tailored to specific performance tiers. Ultra Disk supports dynamic configuration scaling and ultra-low latency; Premium SSD targets production workloads with host caching; Standard SSD targets entry-level servers with consistent SSD reliability; and Standard HDD offers budget-friendly storage for archival purposes.

Adım Adım Çözüm

1
Examine Ultra Disk characteristics.
Ultra Disk is identified by its unique ability to dynamically modify performance metrics (IOPS and throughput) on-the-fly and deliver sub-millisecond latency.
To align the highest-tier storage option with its distinct flexibility features.
2
Analyze Premium SSD characteristics.
Premium SSD is matched to high-performance production workloads that utilize read-only or read-write host-level caching.
To identify standard enterprise-grade SSD properties.
3
Distinguish between Standard SSD and Standard HDD.
Standard SSD provides consistent, solid-state reliability for light production/dev-test workloads, while Standard HDD provides low-cost magnetic storage for backups and archival data.
To correctly map entry-level SSDs and traditional HDDs based on performance consistency and cost factors.

Anahtar Kavram

Azure Managed Disk Types and Performance Characteristics
Soru 5Soru

You are designing the configuration management and deployment workflows for virtual machines (VMs) in a Microsoft Azure subscription.

Match each administrative requirement to the most appropriate Azure Virtual Machine feature or tool. (To answer, match the appropriate tool on the right to the requirement on the left. Each tool may be used once, more than once, or not at all.)

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Configure automatic post-deployment software installation and OS customization on a newly provisioned Windows VM without maintaining custom images.
Execute a single ad-hoc troubleshooting script on a running VM that has no public network connectivity or open management ports.
Enforce a consistent configuration state across multiple VMs and automatically correct any configuration drift over time.
Create and maintain customized gold images with pre-installed applications and security patches across multiple regions.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Configure automatic post-deployment software installation matches with Custom Script Extension; Execute a single ad-hoc troubleshooting script matches with Run Command; Enforce a consistent configuration state matches with Azure Automation State Configuration (DSC); Create and maintain customized gold images matches with Azure VM Image Builder.
The correct matches align each requirement with the specific capabilities of the Azure VM tools: Custom Script Extension is optimized for initial bootstrapping; Run Command bypasses network barriers via the local VM Agent for ad-hoc execution; Azure Automation State Configuration (DSC) handles continuous drift correction; and Azure VM Image Builder automates gold image pipelines.

Adım Adım Çözüm

1
Analyze the requirement for automatic post-deployment software installation on a newly provisioned VM.
The Custom Script Extension is the ideal native tool to download and run scripts during or immediately after the VM provisioning phase.
This avoids the overhead of managing customized VM images.
2
Analyze the requirement to run an ad-hoc troubleshooting script on an unreachable VM.
The Run Command feature uses the Azure VM Agent to execute PowerShell or Bash scripts on a VM without requiring direct RDP, SSH, or public network access.
This allows troubleshooting when management ports are closed.
3
Analyze the requirement to enforce state and correct configuration drift across multiple VMs.
Azure Automation State Configuration (DSC) is the built-in configuration management service that compiles DSC configurations and periodically audits/enforces the specified state on targets.
Other extension-based scripting tools execute only once and cannot continuously monitor or correct drift.
4
Analyze the requirement to create, customize, and replicate gold VM images.
Azure VM Image Builder is a managed service designed specifically to automate the creation of customized base images and distribute them to multiple target regions.
It replaces manual VM sysprep and capture workflows.

Anahtar Kavram

Azure Virtual Machine configuration management, extensions, and imaging tools.
Tahmini Süre:1m 30s
Soru 6Soru

Your company is deploying several Azure virtual machines (VMs) to support different application workloads. You need to configure various post-deployment configuration and monitoring tasks.

Match each administrative requirement to the correct Azure virtual machine feature or extension.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Execute a custom bash script from a private Azure storage blob on a Linux virtual machine during the provisioning phase.
Enforce a specific system configuration baseline on a Windows virtual machine and automatically correct any unauthorized configuration drift.
Run an administrative script on an active, running Windows virtual machine that does not have a public IP address or active network route from your workstation.
Automatically collect and forward guest-level operating system performance counters to a Log Analytics workspace.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Execute a custom bash script during provisioning matches Custom Script Extension; Enforce a baseline and correct configuration drift matches Azure Automation State Configuration (DSC) extension; Run an administrative script without a public IP on an active VM matches Run Command; Collect and forward guest-level OS performance counters matches Azure Monitor agent.
The correct matches align with Microsoft Azure best practices: Custom Script Extension is used for bootstrapping/provisioning scripts; Azure Automation DSC ensures state compliance and remediates drift; Run Command executes scripts on running VMs via the local VM agent without public IP requirements; and the Azure Monitor agent handles guest-level performance data collection.

Adım Adım Çözüm

1
Analyze the requirement for running a script during provisioning from a private blob.
Identify that the Custom Script Extension is designed specifically to download and execute scripts during VM deployment.
Other extensions either manage configuration state or monitor performance rather than executing one-time bootstrap scripts.
2
Analyze the requirement for maintaining configuration state and correcting drift.
Identify that PowerShell Desired State Configuration (DSC) via Azure Automation enforces a configuration baseline and automatically corrects deviations.
Custom Script Extension and Run Command only execute scripts once and do not monitor or remediate drift continuously.
3
Analyze the requirement for executing a script on a running VM without direct network access or a public IP.
Identify that Run Command utilizes the VM agent to run scripts securely from the Azure portal/CLI without direct network routes.
This bypasses NSG rules and public IP requirements, unlike SSH or RDP which require network access.
4
Analyze the requirement for gathering guest-level performance metrics.
Identify that the Azure Monitor agent is used to collect OS-level diagnostics and send them to Log Analytics.
The Azure Monitor agent is the standard mechanism for data collection at the OS level.

Anahtar Kavram

Selecting the appropriate extension or management feature to configure and manage Azure Virtual Machines post-deployment.
Tahmini Süre:2m 0s
Soru 7Soru

You are configuring Azure Virtual Machines (VMs) to automate various deployment tasks. Match each Azure VM Extension to its primary configuration use case.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Custom Script Extension
PowerShell DSC Extension
Azure Key Vault Extension

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Custom Script Extension matches with automates VM configuration by running scripts; PowerShell DSC Extension matches with maintaining VM environment consistency using declarative configurations; Azure Key Vault Extension matches with automating the installation and renewal of SSL/TLS certificates.
Each extension maps to its unique and intended configuration purpose: Custom Script Extension for running customized OS scripts, PowerShell DSC for enforcing environment consistency, and Azure Key Vault Extension for SSL/TLS certificate lifecycle management.

Adım Adım Çözüm

1
Analyze the function of the Custom Script Extension.
Identify that it downloads and executes custom scripts directly on the VM during or after provisioning.
This directly aligns with the definition of running custom scripts on the operating system.
2
Analyze the function of the PowerShell Desired State Configuration (DSC) Extension.
Identify that it manages VM environment state drift using declarative configuration files.
This aligns with using declarative configurations to enforce target environmental settings.
3
Analyze the function of the Azure Key Vault Extension.
Identify that it monitors certificate stores and automatically refreshes VM certificates from Key Vault.
This aligns with automating installation and renewal of SSL/TLS certificates.

Anahtar Kavram

Azure Virtual Machine Extensions are lightweight utilities that provide post-deployment configuration, automation, and management capabilities on Azure virtual machines.
Tahmini Süre:1m 0s
Soru 8Soru

You are designing the deployment and storage configuration for four Azure Virtual Machines (VMs) to support different application workloads. Match each workload scenario to its correct VM storage or deployment configuration.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A database VM named `VM-DB1` running on a Standard_E16bds_v5 size in East US. You need to configure a new data disk that requires up to 80,00080,000 IOPS and 1,200 MB/s1,200\text{ MB/s} throughput, with the ability to dynamically scale throughput without deallocating the VM.
A stateless web application host named `VM-Web1` that requires extremely fast boot times and zero storage costs for the operating system disk. The OS state does not need to be preserved across VM redeployments.
A business-critical application VM named `VM-App1` running on a Standard_M16s size that hosts a write-intensive database log file. The log write operations must consistently achieve sub-millisecond latency.
A development VM named `VM-Dev1` running on a Standard_D8ds_v5 size. The VM will host containerized Hyper-V development environments, requiring UEFI, Secure Boot, and virtual Trusted Platform Module (vTPM) capabilities.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match VM-DB1 to Ultra Disk configuration, VM-Web1 to Ephemeral OS disk, VM-App1 to Premium SSD with Write Accelerator, and VM-Dev1 to Generation 22 VM with Trusted Launch.
The correct matches align each workload requirement with the specific Azure VM compute and storage features: Ultra Disks for extreme, dynamically scaleable performance; Ephemeral OS disks for stateless, cost-optimized hosting; Write Accelerator on Premium SSDs for sub-millisecond write latency on M-series VMs; and Generation 22 with Trusted Launch for UEFI, Secure Boot, and vTPM security features.

Adım Adım Çözüm

1
Analyze the requirements for VM-DB1.
The workload requires up to 80,00080,000 IOPS and 1,200 MB/s1,200\text{ MB/s} throughput with dynamic scaling without deallocation. This profile exceeds standard Premium SSD performance and fits Ultra Disk capabilities. Ultra Disks require enabling compatibility during VM creation.
Ultra Disk is the only disk type that supports both these throughput/IOPS levels on a single disk and dynamic throughput adjustment without VM deallocation.
2
Analyze the requirements for VM-Web1.
The workload is stateless, needs fast boot times, and requires zero storage costs for the OS disk. This points to Ephemeral OS disks.
Ephemeral OS disks use local SSD storage (cache or temp disk) inside the host, avoiding remote Azure Storage costs and offering faster boot and reset speeds.
3
Analyze the requirements for VM-App1.
The VM is Standard_M16s (M-series) and requires sub-millisecond database log write latency. This fits Write Accelerator on Premium SSD.
Write Accelerator is specifically designed for write-intensive database logs on M-series VMs using Premium SSDs, and it requires Host Caching to be set to None.
4
Analyze the requirements for VM-Dev1.
The VM needs nested virtualization (Hyper-V containers), UEFI, Secure Boot, and vTPM. This requires a Generation 22 VM with Trusted Launch.
Trusted Launch provides the foundation for Secure Boot and vTPM, which are prerequisites for configuring advanced security and Hyper-V guest environments on Gen 22 VMs.

Anahtar Kavram

Selecting the correct Azure Virtual Machine configuration, disk types, and deployment options based on workload performance, cost, and security requirements.
Soru 9Soru

Your organization has an Azure subscription containing a single resource group named RG1. You need to assign the appropriate built-in Azure Role-Based Access Control (RBAC) roles to three administrative users to meet their specific requirements while adhering to the principle of least privilege. Match each user requirement on the left to the correct built-in Azure RBAC role on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Delegate access permissions to other users for all resources within RG1.
Create and manage virtual machines, including restarting them and attaching disks, without managing network settings or assigning permissions.
View the configuration and status of all resources in RG1 without making any modifications.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match the requirement to delegate access permissions to the Owner role; match the requirement to create and manage virtual machines without network or permission privileges to the Virtual Machine Contributor role; and match the requirement to view resource configurations without making modifications to the Reader role.
Matching the requirements to Owner, Virtual Machine Contributor, and Reader aligns with Azure RBAC roles designed for authorization delegation, VM-specific management, and read-only access respectively.

Adım Adım Çözüm

1
Analyze the requirement to delegate permissions.
Delegating permissions requires the Microsoft.Authorization/roleAssignments/write permission. This action is allowed by the Owner role but not by the Contributor role.
We must find a built-in role that allows modifying role assignments.
2
Analyze the requirement to manage virtual machines but not network settings or permissions.
The Virtual Machine Contributor role allows managing virtual machines and their disks without granting permissions on network resources or access management.
We need to identify the built-in role designed for virtual machine administration.
3
Analyze the requirement to view resource configurations without making modifications.
The Reader role provides read-only access to resources without permitting write or delete actions.
We need to find the built-in role that grants read-only access.

Anahtar Kavram

Azure Built-in Roles and Least Privilege
Soru 10Soru

An organization wants to delegate management of Self-Service Password Reset (SSPR) and external collaboration configurations to different administrators using the principle of least privilege.

Which minimum administrative roles must be assigned to perform each of the specified directory and external identity configuration scenarios?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Configure federation with Google or Facebook as external identity providers for B2B collaboration.
Invite external guest users to the tenant when guest invitations are restricted to administrative roles in external collaboration settings.
Configure tenant-wide Self-Service Password Reset (SSPR) authentication methods and registration policies.
Reset the password of a user who is assigned the Helpdesk Administrator role.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Configure federation with Google or Facebook maps to External Identity Provider Administrator; Invite external guest users maps to Guest Inviter; Configure tenant-wide SSPR settings maps to Authentication Policy Administrator; Reset the password of a Helpdesk Administrator maps to User Administrator.
The correct matches pair each directory administration task with its minimum required role based on the principle of least privilege. External Identity Provider Administrator manages federation, Guest Inviter permits B2B invitations under restrictions, Authentication Policy Administrator manages SSPR methods, and User Administrator handles password resets for Helpdesk Administrators.

Adım Adım Çözüm

1
Analyze the role required for external identity provider federation.
Configuring Google or Facebook federation requires managing identity providers, which corresponds to the External Identity Provider Administrator role.
This role is dedicated to setting up external federation options for B2B collaboration without requiring broader Global Administrator privileges.
2
Determine the minimum role required for B2B guest invitations under restricted settings.
Inviting B2B guest users when restrictions are in place maps to the Guest Inviter role.
The Guest Inviter role is specifically scoped to bypass guest invitation restrictions for standard users without granting general directory management capabilities.
3
Identify the minimum administrative role that can modify global SSPR settings.
Managing tenant-wide SSPR authentication methods and policies maps to the Authentication Policy Administrator role.
The Authentication Policy Administrator is the least-privileged directory role that can manage authentication policies, registration policies, and security questions.
4
Determine which role can reset the password of a Helpdesk Administrator.
Resetting the password of a Helpdesk Administrator requires the User Administrator role.
Helpdesk Administrators can only reset passwords for non-administrative users. User Administrators can reset passwords for non-administrators and specific administrative roles including Helpdesk Administrator, but cannot reset passwords for high-privileged roles like Global Administrator.

Anahtar Kavram

Delegating administrative permissions using least privilege for Microsoft Entra ID Self-Service Password Reset (SSPR) and external collaboration settings.
Soru 11Soru

An organization has an Azure environment structured with a Management Group named Corp-MG, a Subscription named Sub-Prod, and a Resource Group named RG-Core. You assign various Azure Policy definitions at these scopes. You need to match the policy effect configured for a Virtual Machine deployment to its corresponding operational behavior when an administrator attempts to deploy a new Virtual Machine resource named VM-App-01 into RG-Core.

Match each Azure Policy effect on the left to its corresponding operational behavior on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Modify
DeployIfNotExists
Deny
AuditIfNotExists

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Modify matches the behavior of altering properties or tags before the request reaches the resource provider and requiring a managed identity. DeployIfNotExists matches triggering a template deployment after successful creation and requiring a managed identity. Deny matches preventing the deployment request from reaching the resource provider if non-compliant. AuditIfNotExists matches checking if a dependency exists and marking the resource non-compliant without blocking if it is missing.
The matching correctly pairs each Azure Policy effect with its precise execution phase, behavior, and managed identity requirements: Modify alters resource tags or properties before creation/update; DeployIfNotExists deploys a resource template after a successful deployment; Deny blocks non-compliant deployment requests pre-evaluation; AuditIfNotExists audits dependent resources post-evaluation without blocking.

Adım Adım Çözüm

1
Analyze the execution timing of each policy effect.
Modify and Deny run before the resource provider is called. DeployIfNotExists and AuditIfNotExists run after the resource provider successfully processes the request.
Understanding execution phases distinguishes between pre-deployment enforcement (blocking or altering requests) and post-deployment auditing or remediation.
2
Evaluate the requirement for managed identities.
Effects that perform write operations (Modify and DeployIfNotExists) require a managed identity to remediate existing resources or deploy new ones.
Remediation tasks require Azure Role-Based Access Control (RBAC) permissions, which are granted to the policy assignment's managed identity.
3
Differentiate between conditional checks (AuditIfNotExists vs DeployIfNotExists) and enforcement checks (Deny vs Modify).
Deny blocks the request. Modify alters the request. AuditIfNotExists only logs compliance status. DeployIfNotExists deploys missing templates.
This matches each specific policy effect to its corresponding scenario behavior for VM-App-01 in RG-Core.

Anahtar Kavram

Azure Policy effects determine how compliance is evaluated and enforced during resource creation or update.
Tahmini Süre:2m 0s
Soru 12Soru

An administrator is planning the deployment of several Azure virtual machines (VMs) to support different enterprise workloads. Each workload has specific performance, placement, or security requirements.

Match each workload requirement to the most appropriate Azure VM configuration feature or option.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A database VM that requires the ability to dynamically scale IOPS and throughput performance limits without restarting the virtual machine or causing downtime.
A stateless web application VM pool that requires faster read/write latency to the OS drive and rapid VM re-imaging by deploying the OS directly onto the local host storage.
A high-performance cluster requiring the lowest possible network latency by ensuring that virtual machines are physically located as close as possible to each other within the same physical data center.
A compliant financial application VM that requires data written to both the OS and temporary disks to be encrypted directly on the physical host hosting the VM before transmission to Azure Storage.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

To meet the requirements, match the dynamic performance scale database to Ultra Disk, the stateless web VM pool to Ephemeral OS Disk, the low-latency cluster to Proximity Placement Group, and the host-level encryption to Encryption at Host.
The correct matches align each workload requirement with its specific Azure VM architectural option:
- Dynamic performance adjustments of IOPS and throughput on the fly are unique to Ultra Disks.
- Storing the OS disk directly on the local VM host's storage to minimize latency and enable rapid re-imaging is the primary use case of Ephemeral OS Disks.
- Grouping VMs in close physical proximity within a single data center to reduce network latency is achieved using Proximity Placement Groups.
- Encrypting data directly at the virtual machine physical host level before sending it over the network to Azure Storage is configured using Encryption at Host.

Adım Adım Çözüm

1
Analyze the database requirement for dynamically adjusting storage performance (IOPS and throughput) without VM downtime.
Identify Ultra Disk as the appropriate storage option.
Ultra Disks allow modifying IOPS and throughput dynamically without detaching the disk or restarting the VM.
2
Evaluate the requirement for stateless VMs requiring low OS disk latency and rapid re-imaging using local host storage.
Identify Ephemeral OS Disk as the correct selection.
Ephemeral OS Disks utilize the local VM host's cache or temp disk instead of remote Azure Storage, enabling faster read/write latency and rapid re-imaging.
3
Analyze the requirement for reducing physical distance and network latency between VMs in a cluster.
Identify Proximity Placement Groups as the correct option.
Proximity Placement Groups group VMs physically close within the same data center to reduce inter-VM latency.
4
Identify the feature that encrypts OS and temp disks at the VM host level before sending data to Azure Storage.
Identify Encryption at Host as the correct option.
Encryption at Host ensures that data stored on the VM host (like temporary disk and OS/data disk caches) is encrypted at rest and encrypted end-to-end as it flows to Azure Storage.

Anahtar Kavram

Azure VM storage, placement, and host security configuration options.
Tahmini Süre:3m 0s
Soru 13Soru

You are planning the deployment of several Azure virtual machines (VMs) for different workloads. Match each workload requirement to the appropriate Azure VM configuration feature.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Deploy application and database VMs physically close to each other to minimize inter-VM network latency.
Run VM workloads on dedicated physical hardware that is not shared with other Azure customer subscriptions.
Provision stateless VMs with high-speed local OS disks that incur no remote storage transaction costs.
Run batch processing jobs that can tolerate sudden VM evictions in exchange for significant cost savings.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each workload requirement matches to a specific Azure VM feature: lowest latency requires a Proximity Placement Group, dedicated hardware requires an Azure Dedicated Host, stateless VMs with no storage cost require an Ephemeral OS disk, and interruptible workloads with cost savings require an Azure Spot Virtual Machine.
Each workload requirement maps to a specific VM configuration: proximity placement groups minimize inter-VM network latency; dedicated hosts satisfy strict hardware isolation requirements; ephemeral OS disks run on local storage for stateless workloads at zero remote storage cost; and spot VMs offer discounted rates for interruptible workloads.

Adım Adım Çözüm

1
Analyze the low-latency workload requirement.
Identify that Proximity Placement Groups are logical groupings used to ensure that Azure compute resources are physically located close to each other to minimize network latency.
This directly aligns the low latency requirement to the Proximity Placement Group feature.
2
Analyze the isolated hardware compliance requirement.
Identify that Azure Dedicated Host provides physical servers dedicated to a single Azure subscription to address compliance and isolation standards.
This links dedicated hardware requirements with the Dedicated Host service.
3
Analyze the stateless VM storage cost requirement.
Identify that Ephemeral OS disks run on the local VM storage (cache or temp disk) and incur no remote storage costs while providing fast local read/write capabilities.
This matches the local OS disk and cost avoidance requirement to Ephemeral OS disks.
4
Analyze the fault-tolerant cost-reduction requirement.
Identify that Azure Spot Virtual Machines allow you to take advantage of unused capacity at a significant cost reduction but can be evicted when Azure needs the capacity back.
This aligns interruptible workloads with Azure Spot VMs.

Anahtar Kavram

Azure Virtual Machine creation and configuration options including Proximity Placement Groups, Dedicated Hosts, Ephemeral OS disks, and Spot VMs.
Soru 14Soru

An organization has an Azure environment structured with the following resource hierarchy:

* MG-Production (Management Group)
* Sub-Prod (Subscription)
* RG-App (Resource Group)
* VM-Web (Virtual Machine)
* RG-Data (Resource Group)
* sa-prod (Storage Account)
* kv-prod (Key Vault)

You are tasked with assigning built-in Azure role-based access control (RBAC) roles to four administrative security groups. Your configurations must strictly adhere to the principle of least privilege.

Match each administrative requirement to the correct Azure RBAC role and scope.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Restart and configure VM-Web, but must not be able to modify the virtual network or other resources in RG-App.
Manage sa-prod configurations and regenerate access keys, but must not be granted direct data plane access to containers via Microsoft Entra ID.
Read secret values inside kv-prod, but must not be able to modify key vault resource properties or management settings.
Assign roles across all resource groups within Sub-Prod, but must not be able to deploy or delete resource groups.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Requirement for VM-Web matches Virtual Machine Contributor at VM-Web scope; requirement for sa-prod matches Storage Account Contributor at sa-prod scope; requirement for kv-prod matches Key Vault Secrets User at kv-prod scope; requirement for Sub-Prod role assignment matches User Access Administrator at Sub-Prod scope.
The correct pairings match the security requirements to the most restricted built-in role and scope. Virtual Machine Contributor at the VM-Web scope limits VM control to only VM-Web. Storage Account Contributor at the sa-prod scope allows control plane settings management (like key regeneration) without granting Entra ID data access. Key Vault Secrets User at the kv-prod scope permits data-plane read access to secrets without administrative control plane capabilities. User Access Administrator at the Sub-Prod scope permits subscription-wide role assignment management without resource modification permissions.

Adım Adım Çözüm

1
Analyze the VM-Web requirement. The group needs to manage configuration and power state on VM-Web but not access networks or other resources. Virtual Machine Contributor is the built-in role that allows virtual machine management. The scope should be restricted to the VM-Web resource itself to satisfy least privilege.
WebAdmins is matched to Virtual Machine Contributor at the scope of VM-Web.
Limits VM management capability to the specific VM resource scope.
2
Analyze the sa-prod requirement. The group needs control plane management of the storage account (including key regeneration) but no Entra ID data plane access. Storage Account Contributor grants control plane access but does not grant data plane roles such as Storage Blob Data Reader or Contributor. The scope must be sa-prod.
AppDeployers is matched to Storage Account Contributor at the scope of sa-prod.
Restricts access to the control plane at the resource scope, denying Entra ID data access.
3
Analyze the kv-prod requirement. The group needs to read secret values but not manage policies or vault properties. Key Vault Secrets User is a data plane role that allows reading secrets without control plane permissions. The scope must be kv-prod.
SecAuditors is matched to Key Vault Secrets User at the scope of kv-prod.
Provides secrets data plane read access without administrative control plane permissions.
4
Analyze the Sub-Prod requirement. The group needs to manage role assignments across all resource groups under Sub-Prod but not modify resources. User Access Administrator is the Azure RBAC role that manages role assignments. The scope must be Sub-Prod so that it inherits to all child resource groups.
SecurityAdmins is matched to User Access Administrator at the scope of Sub-Prod.
Allows subscription-wide role delegation while preventing resource creation/deletion.

Anahtar Kavram

Azure RBAC roles and scopes configuration
Soru 15Soru

An administrator is designing several Azure Virtual Machine (VM) deployments with specific performance, latency, and backup requirements. Match each Azure VM feature or configuration option to its primary technical constraint or characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ephemeral OS Disk
Ultra Disk
Proximity Placement Group
Custom Script Extension

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ephemeral OS Disk matches local storage without Azure Backup support; Ultra Disk matches the requirement to be deployed in an Availability Zone and restricted from OS disk usage; Proximity Placement Group matches physically colocating VM resources to reduce network latency; Custom Script Extension matches post-deployment scripts with a 90-minute timeout.
The correct matches represent standard characteristics and boundaries defined by Azure: Ephemeral OS disks operate on local VM cache/temp disks without Azure Backup support; Ultra Disks are data-only and require an Availability Zone; Proximity Placement Groups physically colocate VMs to minimize latency; and Custom Script Extensions timeout after 90 minutes.

Adım Adım Çözüm

1
Analyze Ephemeral OS Disk requirements.
Confirm Ephemeral OS disks are stored locally on the VM's cache or temp disk and do not support Azure Backup.
Identify the primary storage location and service restrictions of ephemeral storage.
2
Analyze Ultra Disk requirements.
Confirm Ultra Disks are data-only disks and require placement within an Availability Zone.
Identify the architectural placement and OS constraints of Ultra Disks.
3
Analyze Proximity Placement Group purpose.
Determine that PPGs physically colocate VMs within the same region or data center.
Differentiate between geographical separation features and latency minimization tools.
4
Analyze Custom Script Extension constraints.
Identify the 90-minute execution timeout threshold for VM extension scripts.
Examine script execution limits and failure states for Azure VM extensions.

Anahtar Kavram

Azure VM storage, latency optimization, and extension capabilities during deployment.
Soru 16Soru

You are deploying and configuring virtual machines in Azure. Match each Azure Virtual Machine feature to its primary purpose.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Custom Script Extension
Azure VM Agent
Boot Diagnostics

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Custom Script Extension matches with executing post-deployment scripts. Azure VM Agent matches with installing and managing extensions. Boot Diagnostics matches with capturing console logs and screenshots.
Each VM component aligns with its correct administrative purpose: the Custom Script Extension executes scripts inside the VM, the VM Agent hosts extensions and coordinates with the fabric, and Boot Diagnostics monitors startup logs and screenshot outputs.

Adım Adım Çözüm

1
Identify the purpose of Custom Script Extension.
It executes custom scripts inside the virtual machine immediately after deployment to automate setup tasks.
Custom Script Extension is explicitly designed to bootstrap VM configurations.
2
Identify the purpose of the Azure VM Agent.
It facilitates communication with the Azure fabric and manages extensions.
The VM Agent is the mandatory host process that manages all other VM extensions.
3
Identify the purpose of Boot Diagnostics.
It captures serial logs and console screenshots to troubleshoot startup issues.
Boot Diagnostics allows administrators to see why a VM is stuck during the boot sequence.

Anahtar Kavram

Azure Virtual Machine features and configuration options
Soru 17Soru

An administrator is deploying several Azure virtual machines (VMs) and must configure their storage, boot architecture, and encryption capabilities. How should the administrator match each Azure VM feature on the left with its correct description on the right?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ephemeral OS Disk
Trusted Launch
Encryption at Host
Generation 2 VM

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ephemeral OS Disk matches the description of storing the operating system directly on local storage. Trusted Launch matches the description of protecting against boot/kernel malware via Secure Boot and vTPM. Encryption at Host matches the description of encrypting temp/ephemeral disks and caches on the VM host server. Generation 2 VM matches the description of enabling UEFI boot architecture and supporting OS disks larger than 2 TB.
The correct pairings align the specific capabilities of each feature: Ephemeral OS disks place the OS locally on the host node; Trusted Launch uses UEFI Secure Boot and vTPM for boot-path protection; Encryption at Host encrypts local host caches and temporary disks before sending data to Azure Storage; and Generation 2 VMs implement the UEFI boot architecture which supports disks larger than 2 TB.

Adım Adım Çözüm

1
Analyze the Ephemeral OS Disk feature.
Ephemeral OS disks use the local node's SSD/cache storage to host the OS, avoiding remote storage latency and cost, matching the local storage description.
Understanding storage localization and latency benefits of Ephemeral OS disks.
2
Analyze the Trusted Launch feature.
Trusted Launch provides boot-time protection using Secure Boot and vTPM, protecting against bootkits and rootkits, matching the malware protection description.
Identifying VM security features for boot path integrity.
3
Analyze the Encryption at Host setting.
Encryption at Host encrypts caches and temp/ephemeral disks at the physical host level before network transfer to Azure Storage, matching the host-level encryption description.
Distinguishing host-based encryption from storage-service encryption (SSE) or Azure Disk Encryption (ADE).
4
Analyze the Generation 2 VM architecture.
Generation 2 VMs use UEFI instead of BIOS, support larger disks, and are required for Trusted Launch, matching the boot architecture description.
Differentiating VM generation features and boot architecture limitations.

Anahtar Kavram

Azure Virtual Machine creation and configuration settings including storage performance, boot architecture, and security enhancements.
Tahmini Süre:1m 30s
Soru 18Soru

An administrator is designing a virtual machine deployment strategy in Azure to support a high-performance, multi-tier application. You need to map each architectural requirement to the correct Azure Virtual Machine configuration or feature. Match each requirement on the left to its corresponding configuration or feature on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Provision stateless web servers with zero storage cost for the operating system disk by utilizing the virtual machine's local cache or temporary storage.
Host a database workload that requires adjusting storage throughput up to 2000 MB/s2000\text{ MB/s} and 160000 IOPS160000\text{ IOPS} dynamically without rebooting the virtual machine.
Locate application and database virtual machines within the same physical hardware cluster to achieve the lowest possible network latency between the tiers.
Install and configure a web server service immediately after the virtual machine is provisioned, without opening inbound management ports in the Network Security Group.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Stateless web servers with zero OS disk storage cost match with Ephemeral OS disk configured with the Local diff disk setting. Database workload requiring dynamic storage adjustment without reboot matches with Ultra Disk storage capability enabled in the virtual machine additional settings. Locating VMs in the same physical hardware cluster to minimize latency matches with Proximity Placement Group association. Installing and configuring a web server service immediately after provisioning without inbound ports matches with Custom Script Extension deployment using outbound agent communication.
The correct pairings align each workload characteristic to its corresponding Azure design solution. 1. Ephemeral OS disks are hosted on the VM's local SSD cache/temp disk, incurring zero storage fees. 2. Ultra Disks support dynamic performance adjustment (up to 160000 IOPS160000\text{ IOPS} and 2000 MB/s2000\text{ MB/s}) without rebooting, provided the VM has the Ultra SSD capability enabled. 3. Proximity Placement Groups physically cluster VMs together to minimize latency. 4. Custom Script Extensions run via the VM agent, using outbound communication to avoid inbound NSG requirements.

Adım Adım Çözüm

1
Analyze the stateless server requirement with zero storage cost.
Identify that Ephemeral OS disks run on the VM's local SSD cache or temp disk, charging zero storage fees and offering lower latency.
Standard managed disks incur storage costs, whereas Ephemeral OS disks utilize existing VM local resources.
2
Analyze the storage throughput and IOPS scaling requirement without reboot.
Identify that Ultra Disk is the only Azure disk type that allows dynamic adjustment of IOPS and throughput without requiring a VM restart or disk detachment, provided the VM's Ultra SSD capability is enabled.
Premium and Standard SSDs require the VM to be deallocated or the disk to be detached to change sizes/performance tiers in most scenarios.
3
Analyze the requirement for physical co-location to reduce latency.
Identify that Proximity Placement Groups (PPGs) force VMs to be deployed in the same physical datacenter/hardware cluster.
Availability Zones spread VMs out to increase resilience, which can increase latency. PPGs do the opposite by grouping them close together.
4
Analyze the requirement for automatic configuration post-deployment without inbound management ports.
Identify that the Custom Script Extension runs locally via the guest VM agent. The VM agent communicates outbound to retrieve the script from Azure Storage, bypassing the need for inbound NSG rules.
Using remote management tools like WinRM or SSH would require open inbound ports (like TCP 59865986 or 2222), whereas extensions execute internally via the local VM Agent.

Anahtar Kavram

Azure Virtual Machine deployment configurations, including Ephemeral OS disks, Ultra Disks, Proximity Placement Groups, and VM Extensions.
Tahmini Süre:2m 30s
Soru 19Soru

You are deploying different containerized workloads to Azure Container Instances (ACI). Match each workload execution requirement to the most appropriate container restart policy.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A continuous web server that must remain running and restart automatically if it crashes or stops.
A data migration task that runs to completion once, but must retry if the process terminates with an error.
A one-time setup script that should execute only once and must never be restarted under any circumstance.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Continuous web server matches with Always restart policy; data migration task matches with OnFailure restart policy; one-time setup script matches with Never restart policy.
The correct matches align the execution patterns with their corresponding ACI restart policies. A continuous web server aligns with Always to maintain availability. A batch processing migration that should retry only on error aligns with OnFailure. A script that must run once and never rerun under any condition aligns with Never.

Adım Adım Çözüm

1
Determine the restart requirement for the continuous web server.
Since the server must stay online indefinitely and restart if it stops for any reason, the Always restart policy is required.
The Always policy ensures container groups are restarted upon exit regardless of the exit code.
2
Determine the restart requirement for the data migration task.
Since the task runs once but must be retried only if it fails, the OnFailure restart policy is required.
The OnFailure policy restarts containers only if they exit with a non-zero code, indicating a failure.
3
Determine the restart requirement for the one-time setup script.
Since the script must not run again even if it exits with an error or succeeds, the Never restart policy is required.
The Never policy ensures the container group is never restarted after execution stops.

Anahtar Kavram

Azure Container Instances supports restart policies (Always, Never, and OnFailure) that determine whether containers restart when their execution terminates.
Soru 20Soru

You are designing a deployment plan for multiple containerized workloads in Azure Container Instances (ACI). Match each workload's execution requirements to the appropriate ACI restart policy to ensure correct container lifecycle behavior.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An API gateway container that must run continuously to process incoming HTTP requests and restart automatically if it crashes.
A scheduled data import container that runs a single batch task to completion and must restart automatically only if the task exits with an error code.
A one-time database migration container that executes a script to copy data and must not run again under any circumstances, even if it fails.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The API gateway container matches the 'Always' restart policy; the scheduled data import container matches the 'OnFailure' restart policy; and the database migration container matches the 'Never' restart policy.
The correct pairings match the workload characteristics to the standard ACI restart policies: continuous services (API gateway) map to 'Always'; tasks that run once but need a retry on errors (scheduled data import) map to 'OnFailure'; and strict single-execution tasks (database migration) map to 'Never'.

Adım Adım Çözüm

1
Analyze the API gateway container requirements.
The API gateway must run continuously and recover from crashes, meaning its lifecycle is long-running and persistent.
Azure Container Instances supports the 'Always' restart policy for containers that need to be kept running indefinitely.
2
Analyze the scheduled data import container requirements.
The import container runs a single task to completion but must retry if it fails (exits with a non-zero code).
The 'OnFailure' restart policy ensures that ACI restarts the container only when the process exits with a failure status code, preventing restarts on successful completion.
3
Analyze the database migration container requirements.
The migration script must execute exactly once and never retry, regardless of whether it succeeds or fails.
The 'Never' restart policy prevents ACI from restarting the container group under any conditions, ensuring single-execution semantics.

Anahtar Kavram

Azure Container Instances restart policies determine the lifecycle management and automatic recovery behavior of a container group based on its workload type.
Sayfa 1 / 3Sonraki