Examkin

Tüm alıştırma soruları

1186 soru

Tüm türler1,186Çoktan seçmeli620Çoklu seçim228Doğru / Yanlış291Eşleştirme47
Soru 181Soru →

An organization has an Azure management group named Enterprise-MG. A subscription named Subscription-A is grouped under Enterprise-MG. Within Subscription-A, there is a resource group named App-RG.

An administrator assigns a developer the Reader role at the Enterprise-MG scope.

The administrator must configure the environment to meet the following additional requirements:
- The developer must be able to create and manage all resources within App-RG.
- The developer must be prevented from deploying any resources to any other location in Subscription-A.
- All deployments in Subscription-A must be restricted to the West US region only.

Which of the following configurations should the administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Assign the Contributor role to the developer at the App-RG scope, and assign an Azure Policy definition enforcing the allowed locations to the Subscription-A scope.

Cevap

Assign the Contributor role to the developer at the App-RG scope, and assign an Azure Policy definition enforcing the allowed locations to the Subscription-A scope.
To allow the developer to manage resources in App-RG while keeping view-only access elsewhere, the Contributor role must be assigned at the App-RG scope. Because Azure RBAC permissions are additive, the developer inherits the Reader role from the management group and gains Contributor permissions inside the resource group. Outside App-RG, they only have Reader access, which prevents them from deploying resources in other parts of the subscription. To enforce the region restriction across the entire subscription, an Azure Policy definition must be assigned to the Subscription-A scope, as Azure Policy is designed to enforce resource compliance rules like allowed deployment locations.

Adım Adım Çözüm

1
Analyze the baseline inherited permissions of the developer.
The developer inherits the Reader role at the Subscription-A and App-RG scopes from the assignment at Enterprise-MG.
Azure RBAC roles assigned at a higher scope (Management Group) automatically inherit down to all child scopes (Subscriptions and Resource Groups).
2
Determine the necessary role assignment to allow resource creation and management in App-RG only.
Assign the Contributor role to the developer at the App-RG scope.
Azure RBAC permissions are additive. Assigning Contributor at the App-RG scope grants write permissions locally. Because the developer only has the inherited Reader role at the subscription scope, they cannot create or modify resources outside of App-RG.
3
Identify the governance mechanism required to restrict deployment regions.
Assign an Azure Policy definition that enforces allowed locations to the Subscription-A scope.
Azure Policy is designed to enforce resource compliance rules, such as restricting deployments to approved regions. Unlike RBAC, which governs identity permissions, Azure Policy governs resource properties across the specified scope.

Anahtar Kavram

Azure RBAC permissions are additive and inherit down the resource hierarchy, while Azure Policy enforces compliance and resource properties at specified scopes.
Tahmini Süre:2m 0s
Soru 182Soru →

When connecting two Azure Virtual Networks (VNets) across different regions using global virtual network peering, the network traffic traverses the public internet.

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false. Traffic between peered Virtual Networks, even across different regions, routes over Microsoft's private global backbone network, not the public internet.
The statement is false because Azure virtual network peering routes all traffic internally over the Microsoft private backbone network rather than the public internet, even when connecting networks across different geographic regions.

Adım Adım Çözüm

1
Analyze the statement regarding global virtual network peering between Azure regions.
Identify that the statement asserts traffic traverses the public internet.
To evaluate the correctness of the network pathway.
2
Determine how Azure routes traffic for global virtual network peering.
Recall that all peering traffic is routed internally through Microsoft's private backbone network.
To determine whether the traffic is exposed to the public internet.

Anahtar Kavram

Global virtual network peering routes traffic privately within Microsoft's global network backbone.
Soru 183Soru →

A company is preparing for a security audit of its hybrid network connection between an on-premises office and an Azure Virtual Network. The network architect states that because the company uses an Azure ExpressRoute connection, all data in transit is encrypted by default and is completely isolated from the public internet. Is the architect's statement correct?

Cevabı ve açıklamayı göster

Cevap: No, because ExpressRoute does not encrypt traffic by default, although it does bypass the public internet.

Cevap

No, because ExpressRoute does not encrypt traffic by default, although it does bypass the public internet.
The correct option is correct because ExpressRoute traffic is routed over a dedicated, private connection that bypasses the public internet. However, this private connection does not provide encryption by default. Customers must configure their own encryption (e.g., using IPsec VPN over ExpressRoute) if they require data encryption in transit.

Adım Adım Çözüm

1
Analyze the privacy characteristic of ExpressRoute.
ExpressRoute routes traffic through a private, dedicated connection (facilitated by a connectivity provider) and completely bypasses the public internet.
This verifies the 'isolated from the public internet' portion of the statement is correct.
2
Analyze the encryption characteristic of ExpressRoute.
ExpressRoute does not encrypt network traffic by default as it traverses the private connection.
This verifies the 'encrypted by default' portion of the statement is incorrect, rendering the overall statement false.

Anahtar Kavram

Azure ExpressRoute provides a private, high-speed connection to Azure services that bypasses the public internet, but it does not encrypt traffic by default.
Tahmini Süre:2m 0s
Soru 184Soru →

A CanNotDelete lock is configured on an Azure subscription. A resource group named rg-sales within the subscription contains a virtual machine named vm-sales. What is the impact of this lock on the virtual machine?

Cevabı ve açıklamayı göster

Cevap: Authorized users can modify the configuration of the virtual machine, but they cannot delete the virtual machine.

Cevap

Authorized users can modify the configuration of the virtual machine, but they cannot delete the virtual machine.
The correct answer is correct because Azure resource locks applied at a parent scope (such as a subscription) are inherited by all child resources. The CanNotDelete lock type allows authorized users to read and modify resource configurations, but prevents them from deleting the resource.

Adım Adım Çözüm

1
Determine the scope and inheritance of the resource lock.
The lock is applied at the subscription level, which means it is inherited by all child resource groups and resources, including the virtual machine.
Azure resource locks automatically inherit down the resource hierarchy (Subscription -> Resource Group -> Resource).
2
Identify the behavior of the CanNotDelete lock type.
A CanNotDelete lock prevents deletion of the resource, but allows all modify and read operations.
The CanNotDelete lock restricts only the delete operations, unlike the ReadOnly lock which restricts both delete and update operations.
3
Combine the inheritance rule and lock type behavior to evaluate the outcome.
The virtual machine inherits the CanNotDelete lock, meaning users can modify its settings but cannot delete it.
Since the lock is inherited from the parent subscription, its deletion restriction applies to the virtual machine while still allowing configuration changes.

Anahtar Kavram

Resource Lock Inheritance and CanNotDelete Behavior
Tahmini Süre:45s
Soru 185Soru →

An Azure administrator applies a ReadOnly resource lock directly to an Azure SQL database. Which two actions can users still perform on this database? (Select two)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Query data stored within the database tables; View the database resource settings and configuration in the Azure portal

Cevap

Users can query data stored within the database tables and view the database resource settings and configuration in the Azure portal.
A ReadOnly lock prevents configuration modifications (write actions) and deletions on the management plane, but allows read operations. Thus, viewing settings in the Azure portal is permitted. Additionally, resource locks only apply to management plane operations, so data plane operations like querying database tables are not restricted.

Adım Adım Çözüm

1
Determine the impact of a ReadOnly resource lock.
A ReadOnly lock prevents all write and delete operations on the resource's configuration (management plane), but allows read operations.
This establishes the boundary of what operations are blocked at the Azure Resource Manager level.
2
Differentiate between management plane and data plane operations.
Resource locks only apply to management plane operations (actions done via Azure Resource Manager). They do not affect data plane operations, which are managed within the resource itself.
This explains why querying database tables is unaffected.
3
Evaluate each action against these rules.
Querying tables (data plane) and viewing portal settings (management plane read) are allowed. Modifying the pricing tier (management plane write) and deleting the resource (management plane delete) are blocked.
This identifies the two correct allowed actions.

Anahtar Kavram

Azure Resource Locks (ReadOnly)
Soru 186Soru →

A company is planning to deploy a complex application composed of twelve individual containerized microservices. The architecture requires automated service discovery, coordinated rolling updates, and dynamic horizontal scaling across all containers. The company wants to minimize the administrative effort required to manage the container orchestration control plane, while still retaining control over node network configurations. Which Azure compute service should the company use to host this application?

Cevabı ve açıklamayı göster

Cevap: Azure Kubernetes Service (AKS)

Cevap

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS) is the correct service because it provides a managed Kubernetes control plane, which offloads the operational overhead of orchestrator maintenance to Microsoft. It naturally supports orchestration features like automated service discovery, rolling updates, and scaling, while allowing the user to configure and manage the underlying node pools and networking within their virtual network.

Adım Adım Çözüm

1
Analyze the hosting requirements of the application.
The application requires hosting twelve containerized microservices, automated service discovery, rolling updates, and dynamic horizontal scaling. This points to the need for a container orchestrator.
Identifying the architectural pattern helps narrow down the compute options to container-focused services.
2
Evaluate the management and administrative constraints.
The organization wants to minimize the overhead of managing the container orchestration control plane while maintaining control over the networking configurations of the nodes.
This requirement rules out Infrastructure as a Service (IaaS) options like standard Virtual Machines (which require full OS and cluster setup) and serverless containers like Azure Container Instances (which do not provide a configurable node network or orchestrator).
3
Select the Azure service that fits all constraints.
Azure Kubernetes Service (AKS) is a managed Kubernetes service where Microsoft handles control plane management, while the customer retains control over agent nodes, scaling, and integration with Azure Virtual Networks.
AKS provides the necessary orchestrator capabilities and control plane management to satisfy the requirements.

Anahtar Kavram

Azure Kubernetes Service (AKS) as a managed container orchestration solution
Tahmini Süre:2m 0s
Soru 187Soru →

An Azure administrator assigns a user named Alex the Reader role at the subscription level. The subscription contains a resource group named Security-RG. The administrator needs to grant Alex the ability to manage all resources within Security-RG, while also enforcing a rule that prevents any user from deploying resources outside of the East US region within Security-RG. Which configuration should the administrator implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Assign Alex the Contributor role at the Security-RG level, and assign an Azure policy at the Security-RG level to restrict the allowed deployment regions.

Cevap

Assign Alex the Contributor role at the Security-RG level, and assign an Azure policy at the Security-RG level to restrict the allowed deployment regions.
Assigning Alex the Contributor role at the Security-RG level grants write, read, and delete permissions for all resources within that resource group. Since RBAC permissions are additive, this extends his Reader role from the subscription level for this specific resource group. Additionally, enforcing a resource compliance rule like limiting deployment regions requires Azure Policy, which governs resource properties.

Adım Adım Çözüm

1
Evaluate the current permissions and the access requirement for Security-RG.
Alex has Reader access inherited from the subscription level, but needs Contributor access on Security-RG.
Since RBAC permissions are additive, assigning Contributor at the resource group level grants the necessary write/delete permissions for Security-RG without elevating permissions across the rest of the subscription.
2
Evaluate the requirement to restrict deployment regions.
Identify that restricting resource properties (like region) cannot be done via RBAC.
Azure Policy is the service specifically designed to enforce compliance rules and restrict resource properties such as allowed regions.
3
Combine the access assignment and compliance enforcement.
Assign the Contributor role to Alex on Security-RG, and assign the appropriate Azure Policy allowed locations rule to Security-RG.
This configuration satisfies both the authorization requirement for Alex and the resource property restriction for all deployments in the resource group.

Anahtar Kavram

Azure RBAC controls authorization (who can do what), while Azure Policy controls resource compliance (what properties resources can have).
Tahmini Süre:1m 30s
Soru 188Soru →

An e-commerce company operates its primary workloads across an on-premises datacenter and Amazon Web Services (AWS) using a combination of virtual machines and Kubernetes clusters. The IT department wants to apply Azure Policy definitions, enforce compliance, and aggregate monitoring data in Azure Monitor for all these external resources, without migrating the workloads or infrastructure to the Azure cloud.

Which Azure service should the company implement to project these external resources into Azure Resource Manager (ARM) for centralized governance?

Cevabı ve açıklamayı göster

Cevap: Azure Arc

Cevap

Azure Arc
The correct option is Azure Arc because it allows organizations to project non-Azure resources—including physical servers, virtual machines, and Kubernetes clusters running on-premises or in other clouds—into the Azure Resource Manager (ARM) control plane. Once registered, these resources can be organized, tagged, monitored, and governed using native Azure tools like Azure Policy and Azure Monitor just like native Azure resources, satisfying the requirement to manage external workloads without migrating them.

Adım Adım Çözüm

1
Identify the organizational goal
The company needs to apply Azure Policy and Azure Monitor to virtual machines and Kubernetes clusters running in on-premises and AWS environments without migrating them.
This establishes that the solution must support hybrid and multi-cloud environments while leaving the workloads in their original locations.
2
Evaluate the requirement for Azure Policy integration
Azure Policy requires resources to be managed under the Azure Resource Manager (ARM) control plane.
ARM is the central management and deployment service for Azure, and policy compliance is evaluated at the ARM layer.
3
Select the service that extends the ARM control plane
Azure Arc is identified as the service that projects external resources as ARM objects.
By projecting these resources into ARM, Azure Arc allows administrators to use standard Azure governance tools like Azure Policy and Azure Monitor on non-Azure infrastructure.

Anahtar Kavram

Azure Arc extends Azure Resource Manager (ARM) governance to hybrid and multi-cloud resources.
Soru 189Soru →

An Azure administrator applies a ReadOnly resource lock to a resource group named RG-Web. The resource group contains an Azure App Service plan named ASP-Web. An administrator who is assigned the Owner role at the subscription level attempts to scale up ASP-Web by increasing the instance size. Which of the following describes the outcome of this attempt?

Cevabı ve açıklamayı göster

Cevap: The scaling operation fails because the ReadOnly lock is inherited by the App Service plan and prevents configuration updates.

Cevap

The scaling operation fails because the ReadOnly lock is inherited by the App Service plan and prevents configuration updates.
The scaling operation fails because the ReadOnly lock is inherited by the App Service plan and prevents configuration updates. Azure resource locks applied at the resource group level are inherited by all resources inside that resource group. A ReadOnly lock restricts all actions that write or modify the resource's configuration, which includes scaling operations. Resource locks apply to all users, meaning even an administrator with Owner permissions is blocked until the lock is removed.

Adım Adım Çözüm

1
Analyze the lock type and its target scope.
A ReadOnly lock is applied to the resource group RG-Web.
To determine what operations are restricted at the parent level.
2
Determine the lock inheritance rule for child resources.
The App Service plan ASP-Web inherits the ReadOnly lock from its resource group.
Resource locks in Azure are inherited by all child resources under the parent scope.
3
Evaluate the permissions of the ReadOnly lock against the scale-up action and the user's role.
The scale-up action is blocked, and the Owner role cannot bypass this restriction.
ReadOnly locks block all modification operations for all users, including Owners.

Anahtar Kavram

Azure resource locks enforce boundaries at subscription, resource group, or resource levels, inheriting down to all child resources. ReadOnly locks block both deletion and modification operations for all users, regardless of RBAC permissions.
Soru 190Soru →

An administrator is reviewing recommendations in Azure Advisor to optimize their cloud environment. Match each Azure Advisor recommendation to its corresponding category.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Shut down or right-size virtual machines that have low CPU utilization.
Enable virtual machine backups to protect against data loss.
Resolve security vulnerabilities identified by Microsoft Defender for Cloud.
Configure Azure Policy to enforce tagging rules across your resource groups.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The recommendation to right-size virtual machines matches Cost; configuring backups matches Reliability; resolving vulnerabilities matches Security; and implementing Azure Policy rules matches Operational Excellence.
The Cost category includes recommendations like right-sizing virtual machines to optimize spending. The Reliability category covers business continuity, such as setting up backups to prevent data loss. The Security category includes resolving vulnerability recommendations from Defender for Cloud to protect resources. The Operational Excellence category encompasses process and compliance recommendations, such as enforcing tagging with Azure Policy.

Adım Adım Çözüm

1
Analyze the recommendation regarding low CPU utilization.
This recommendation focuses on reducing waste and saving money.
Reducing resource cost is categorized under the Cost category in Azure Advisor.
2
Analyze the recommendation regarding virtual machine backups.
This recommendation focuses on avoiding data loss and ensuring high availability.
Ensuring business continuity and service uptime falls under the Reliability category in Azure Advisor.
3
Analyze the recommendation regarding Defender for Cloud vulnerabilities.
This recommendation focuses on protecting resources from unauthorized access and attacks.
Threat prevention and resource protection are aligned with the Security category in Azure Advisor.
4
Analyze the recommendation regarding Azure Policy and tagging rules.
This recommendation focuses on governance, compliance, and operational efficiency.
Enforcing organization rules and streamlining environment management aligns with the Operational Excellence category in Azure Advisor.

Anahtar Kavram

Azure Advisor categories and recommendations.
Soru 191Soru →

A company plans to migrate its on-premises Microsoft SQL Server database to Microsoft Azure. The database uses instance-level features, including SQL Server Agent jobs and Linked Servers. The IT department wants to migrate to a fully managed Platform as a Service (PaaS) database service to eliminate operating system patching and VM management. Which Azure service should they select?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance

Cevap

Azure SQL Managed Instance
Azure SQL Managed Instance is the correct choice because it is a Platform as a Service (PaaS) database service that provides near 100% compatibility with SQL Server enterprise features, including instance-scoped features like SQL Server Agent and Linked Servers, while removing the administrative overhead of managing the underlying virtual machine and operating system.

Adım Adım Çözüm

1
Identify the migration source and features required.
The source is an on-premises Microsoft SQL Server database requiring instance-level features like SQL Server Agent jobs and Linked Servers.
This establishes compatibility requirements for the target database service.
2
Identify the management model requested.
The company wants a fully managed Platform as a Service (PaaS) option to eliminate VM management and OS patching.
This rules out Infrastructure as a Service (IaaS) options like SQL Server on Azure Virtual Machines.
3
Select the service that satisfies both the relational/instance-level compatibility and the PaaS requirements.
Azure SQL Managed Instance provides the required SQL Server instance-level features in a fully managed PaaS offering, whereas Azure SQL Database lacks support for these instance-scoped features.
This identifies the correct service that matches all constraints.

Anahtar Kavram

Azure SQL Managed Instance vs Azure SQL Database vs SQL Server on Azure VMs
Soru 192Soru →

An Azure subscription contains a resource group named RG1. RG1 contains a virtual machine named VM1. A CanNotDelete lock is applied to the subscription, and a ReadOnly lock is applied to RG1. Which of the following describes the effective restrictions on VM1?

Cevabı ve açıklamayı göster

Cevap: VM1 cannot be modified and cannot be deleted.

Cevap

VM1 cannot be modified and cannot be deleted.
The correct option is that the virtual machine cannot be modified and cannot be deleted. Azure resource locks are inherited by all resources in the scope. When multiple locks are applied, the most restrictive lock applies. A ReadOnly lock is more restrictive than a CanNotDelete lock, meaning that the virtual machine inherits the ReadOnly lock from its resource group, which blocks both configuration changes (modifications) and deletion.

Adım Adım Çözüm

1
Evaluate the inheritance of resource locks from parent scopes.
The CanNotDelete lock from the subscription and the ReadOnly lock from the resource group (RG1) both inherit down to the virtual machine (VM1).
Azure resource locks are inherited by all resources within the scope of the parent where they are applied.
2
Determine the effective lock by applying the rule of the most restrictive lock.
The ReadOnly lock is more restrictive than the CanNotDelete lock, so the effective lock on VM1 is ReadOnly.
When multiple locks are applied at different scopes, the most restrictive lock takes precedence and applies to the resource.
3
Identify the operations blocked by the effective ReadOnly lock.
Both modifications (write operations) and deletions are blocked on VM1.
A ReadOnly lock prevents users from deleting or modifying a resource, whereas a CanNotDelete lock only prevents deletion but allows modifications.

Anahtar Kavram

Azure resource locks inheritance and precedence rules, specifically how ReadOnly and CanNotDelete locks interact when applied at different scopes.
Soru 193Soru →

A company needs to store transaction records for a financial ledger. The data must be stored in tables with fixed schemas, and the system must enforce referential integrity using foreign keys.

Which Azure database service is best suited for these relational requirements?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Database

Cevap

Azure SQL Database
Azure SQL Database is the correct choice because it is a fully managed relational database engine (PaaS) that supports relational schemas, tables, and foreign keys while automating infrastructure management tasks like patching and backups.

Adım Adım Çözüm

1
Analyze the requirements in the scenario.
The requirements demand storing relational data with fixed schemas and foreign key constraints.
This helps identify whether a relational or non-relational database service is needed.
2
Evaluate the database options based on the relational requirements.
Azure SQL Database natively supports relational schemas and constraints, while Azure Cosmos DB is a NoSQL service.
Choosing the correct model type is necessary to meet the application's structure needs.

Anahtar Kavram

Relational databases in Azure
Soru 194Soru →

An organization plans to migrate a legacy web application to Azure. The application must be deployed as a containerized workload. The deployment must support custom domain mapping, automatically scale based on HTTP request queues, and require no management of underlying virtual machines or container orchestration clusters. Additionally, Microsoft must handle all operating system patching for the hosting platform. Which Azure service should the organization use to host the web application?

Cevabı ve açıklamayı göster

Cevap: Azure App Service

Cevap

Azure App Service
Azure App Service is a fully managed Platform as a Service (PaaS) that supports hosting containerized web applications. It provides built-in capabilities for custom domain configuration, automatic horizontal scaling based on web traffic, and fully offloads host infrastructure management and operating system patching to Microsoft.

Adım Adım Çözüm

1
Analyze the application requirements.
The application is a containerized web application that needs custom domain mapping, auto-scaling based on HTTP request queues, no virtual machine/cluster management, and Microsoft-managed OS patching.
This establishes the criteria for selecting the correct Azure compute service.
2
Evaluate the hosting model and responsibility requirements.
The requirement for Microsoft to manage all OS patching indicates a Platform as a Service (PaaS) model, which rules out Infrastructure as a Service (IaaS) options like Azure Virtual Machines.
Eliminating IaaS services narrows down the choice to fully managed PaaS offerings.
3
Compare container-hosting options in Azure based on web hosting and management requirements.
Azure App Service (specifically Web App for Containers) is a fully managed PaaS that supports containerized apps with built-in HTTP autoscaling and custom domains. Azure Container Instances is for isolated containers without native HTTP routing/scaling, and Azure Kubernetes Service requires cluster management. Microsoft 365 is a SaaS product and cannot host custom containers.
Azure App Service perfectly matches all the technical and operational constraints.

Anahtar Kavram

Azure hosting options for containerized workloads and their management responsibilities
Tahmini Süre:1m 0s
Soru 195Soru →

A company is setting up a hybrid network to link their local office to resources in Azure. Is the statement 'Azure ExpressRoute sends network traffic over the public internet' true or false?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The statement is false because Azure ExpressRoute utilizes a private, dedicated connection that does not traverse the public internet.
The statement is false. Azure ExpressRoute provides a dedicated, private connection to Microsoft services that bypasses the public internet entirely. This provides higher reliability, faster speeds, and lower latencies than typical connections over the internet.

Adım Adım Çözüm

1
Identify the primary transmission path used by Azure ExpressRoute.
Azure ExpressRoute connects on-premises networks to Microsoft cloud services over a private connection facilitated by a connectivity provider.
To determine whether the traffic traverses the public internet, we must look at how the physical and logical connection is established.
2
Compare the identified path with the public internet.
The connection is private and explicitly bypasses the public internet, unlike a VPN which encrypts traffic over the public internet.
This confirms that the statement 'Azure ExpressRoute sends network traffic over the public internet' is incorrect.

Anahtar Kavram

Azure ExpressRoute provides a private, dedicated connection to Azure that does not traverse the public internet.
Soru 196Soru →

A DevOps team is setting up self-hosted build agents to deploy resources to Azure. The build agents run on a mix of Windows Server, Ubuntu Linux, and macOS. The deployment pipelines include scripts that utilize both Azure CLI commands and Azure PowerShell cmdlets. Which of the following statements is correct regarding where these scripts can be executed?

Cevabı ve açıklamayı göster

Cevap: Both the Azure CLI and Azure PowerShell scripts can be executed locally on all three operating systems (Windows Server, Ubuntu Linux, and macOS).

Cevap

Both the Azure CLI and Azure PowerShell scripts can be executed locally on all three operating systems (Windows Server, Ubuntu Linux, and macOS).
Both Azure CLI and Azure PowerShell are designed to be cross-platform. Azure CLI has installers for Windows, macOS, and Linux. Azure PowerShell utilizes PowerShell Core, which is also cross-platform, allowing the same Az module cmdlets to run on Windows, macOS, and Linux systems. This means both types of scripts can be executed locally on all three agent operating systems.

Adım Adım Çözüm

1
Analyze the requirements for executing Azure CLI commands on self-hosted build agents running Windows Server, Ubuntu Linux, and macOS.
Confirm that Azure CLI is a cross-platform command-line tool that can be installed locally on Windows, macOS, and various Linux distributions.
To verify if Azure CLI is supported across all targeted environments.
2
Analyze the requirements for executing Azure PowerShell cmdlets on the same mix of operating systems.
Confirm that Azure PowerShell, when using the modern Az module, runs on PowerShell Core (PowerShell 7.x or later), which is fully supported on Windows, macOS, and Linux.
To verify if Azure PowerShell is supported across all targeted environments.
3
Synthesize the cross-platform capabilities of both tools to determine which environments support execution.
Both tools are fully compatible and can run locally on all three operating systems (Windows Server, Ubuntu Linux, and macOS).
To find the correct statement that matches these compatibility facts.

Anahtar Kavram

Azure CLI and Azure PowerShell cross-platform compatibility
Soru 197Soru →

An organization employs a financial auditor who needs to view the configuration details of all resources in an Azure resource group named billing-rg. The auditor must not be allowed to edit any resources or modify any user permissions. Which action should you perform to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Assign the Reader role to the auditor for the billing-rg resource group.

Cevap

Assign the Reader role to the auditor for the billing-rg resource group.
Assigning the Reader role to the auditor for the resource group allows them to view all resources but prevents them from editing resources or modifying permissions. Azure RBAC is the correct tool for managing user permissions.

Adım Adım Çözüm

1
Identify the user's requirements: read-only access to resources within a specific resource group without permission to modify resources or access control.
The target scope is the billing-rg resource group, and the required access level is read-only.
This establishes the scope and permission level needed for the solution.
2
Evaluate the built-in Azure RBAC roles that match the required access level.
The Reader role allows viewing resources but not modifying them or their permissions, which perfectly matches the requirements.
Understanding built-in roles ensures the principle of least privilege is applied correctly.
3
Select the correct role assignment at the appropriate scope.
Assigning the Reader role at the resource group scope grants the necessary read-only access to all resources within that group.
Assigning roles at the resource group level ensures the permissions inherit down to all resources inside it.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) is used to manage user access and permissions to Azure resources.
Tahmini Süre:45s
Soru 198Soru →

An organization's operations team is designing a governance framework for their Azure environment. They need to meet the following three requirements:

1. Receive proactive best-practice recommendations regarding resource manageability, such as identifying existing workloads that lack tags or resource locks.
2. Prevent any user, including administrators, from accidentally deleting critical production virtual machines while still allowing the virtual machines to be started, stopped, and updated.
3. Ensure that all newly created resources automatically receive specific resource tags at the time of deployment.

Which combination of Azure features or services should the team use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure Advisor for recommendations, Delete (CanNotDelete) resource locks to prevent deletion, and Azure Policy to enforce tags on new resources

Cevap

Azure Advisor for recommendations, Delete (CanNotDelete) resource locks to prevent deletion, and Azure Policy to enforce tags on new resources
The correct option correctly identifies Azure Advisor for providing governance and manageability best practices, a Delete lock to block deletion while keeping the virtual machine operational, and Azure Policy to automate tag enforcement during deployment.

Adım Adım Çözüm

1
Identify the service that provides proactive governance best-practice recommendations.
Azure Advisor provides recommendations across five categories (including Operational Excellence, which covers tags and locks).
This matches the first requirement of identifying resources lacking tags or locks.
2
Determine the correct type of lock to prevent deletion without blocking updates or power states.
A Delete (CanNotDelete) resource lock allows starting, stopping, and updating resources, but blocks deletion.
This satisfies the second requirement, whereas a ReadOnly lock would block normal operations.
3
Identify the governance service that automatically enforces compliance rules during resource deployment.
Azure Policy can evaluate resource properties during deployment and apply tags dynamically.
This satisfies the third requirement, as Azure resource tags are not inherited automatically.

Anahtar Kavram

Azure governance tools boundary and capabilities (Azure Advisor, Azure Policy, Resource Locks)
Soru 199Soru →

A logistics enterprise manages a fleet of delivery hubs containing physical Linux servers, VMware virtual machines, and self-hosted Kubernetes clusters. The IT department wants to simplify operations by using Azure Arc to manage these assets alongside their existing cloud resources.

Which of the following governance and management actions can the enterprise perform on these external resources by using Azure Arc? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign Azure Policy definitions to evaluate compliance and enforce configuration settings on the physical Linux servers.; Monitor the health and performance of the self-hosted Kubernetes clusters centrally using Azure Monitor.

Cevap

The enterprise can assign Azure Policy definitions to evaluate compliance and enforce configuration settings on the physical Linux servers, and monitor the health and performance of the self-hosted Kubernetes clusters centrally using Azure Monitor.
Azure Arc extends the Azure control plane (Azure Resource Manager) to non-Azure resources. This allows organizations to apply Azure Policy definitions to evaluate compliance and enforce configurations on physical Linux and Windows servers, and to collect metrics and log data using Azure Monitor for centralized visibility into self-hosted Kubernetes clusters.

Adım Adım Çözüm

1
Identify the primary purpose of Azure Arc.
Azure Arc extends Azure management, governance, and services (such as Azure Resource Manager, Azure Policy, and Azure Monitor) to resources located outside of Azure (on-premises, edge, or multi-cloud).
This establishes the scope of Azure Arc capabilities.
2
Evaluate the management and governance capabilities offered by Azure Arc for servers and Kubernetes clusters.
Azure Policy can be applied to Arc-enabled servers for configuration enforcement, and Azure Monitor can collect metrics/logs from Arc-enabled Kubernetes clusters.
This directly maps the capabilities to the correct options.
3
Differentiate Azure Arc from migration tools and hybrid cloud hardware solutions like Azure Stack Hub.
Azure Arc does not migrate VMs to Azure or deploy Azure Stack Hub hardware.
This helps rule out the distractors.

Anahtar Kavram

Azure Arc acts as a bridge that extends Azure governance, management, and monitoring tools to resources running outside of Azure, such as on-premises physical servers, virtual machines, and external Kubernetes clusters.
Soru 200Soru →

An organization is planning to migrate and build new database workloads in Azure. You need to match each architectural requirement to the appropriate Azure database service.

To answer, match the requirement on the left to the correct Azure database service on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Migrate an on-premises SQL Server database that requires SQL Server Agent and cross-database queries with minimal code changes.
Deploy a globally distributed, non-relational database for semi-structured data with guaranteed single-digit millisecond read/write latency.
Run an open-source relational workload while ensuring that OS patching, backups, and high availability are managed by Azure.
Implement a relational database that automatically scales compute resources based on workload demand and pauses during inactive periods.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The requirement for SQL Server Agent and cross-database queries matches Azure SQL Managed Instance. The requirement for a globally distributed, non-relational database with single-digit millisecond latency matches Azure Cosmos DB. The requirement for an open-source relational workload with managed patching matches Azure Database for PostgreSQL. The requirement for a relational database with automatic compute scaling and pausing matches Azure SQL Database.
Matching the workloads requires mapping specific database capabilities to the appropriate Azure service. The requirement for SQL Server Agent and cross-database queries matches Azure SQL Managed Instance. The requirement for a globally distributed, non-relational database with single-digit millisecond latency matches Azure Cosmos DB. The requirement for an open-source relational workload with managed patching matches Azure Database for PostgreSQL. The requirement for a relational database with automatic compute scaling and pausing matches Azure SQL Database.

Adım Adım Çözüm

1
Analyze the requirement for migrating SQL Server features like SQL Server Agent and cross-database queries.
This requires Azure SQL Managed Instance, which provides near-complete compatibility with SQL Server enterprise features.
Azure SQL Database (single database) does not support features like SQL Server Agent or cross-database queries directly, making SQL Managed Instance the correct target for this scenario.
2
Analyze the requirement for a globally distributed, non-relational database with single-digit millisecond latency.
This requires Azure Cosmos DB.
Azure Cosmos DB is Azure's flagship non-relational (NoSQL) database that features global distribution and guaranteed low latency.
3
Analyze the requirement for open-source relational databases with fully managed operations.
This requires Azure Database for PostgreSQL.
Azure Database for PostgreSQL is a managed PaaS offering that provides the community version of PostgreSQL without VM management overhead.
4
Analyze the requirement for relational automatic compute scaling and pausing.
This requires Azure SQL Database.
Azure SQL Database has a serverless tier that features automatic compute scaling and auto-pausing/resuming, billing only for compute used.

Anahtar Kavram

Azure Database Services (Relational, Non-Relational, and Cosmos DB)
ÖncekiSayfa 10 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Fundamentals (AZ-900) | Examkin