Tüm alıştırma soruları

1186 soru

Soru 41Soru

An administrator applies a ReadOnly resource lock to an Azure subscription. A database administrator with Owner permissions at the resource group level attempts to scale up an Azure SQL Database located in a resource group within that subscription. Which of the following describes the outcome of this action?

Cevabı ve açıklamayı göster

Cevap: The operation is blocked because the database inherits the ReadOnly lock from the subscription level, which prevents modifying resource configurations.

Cevap

The operation is blocked because the database inherits the ReadOnly lock from the subscription level, which prevents modifying resource configurations.
The correct option is that the operation is blocked because the database inherits the ReadOnly lock from the subscription level. In Azure, resource locks applied at a parent scope (like a subscription) are inherited by all child resources. Furthermore, a ReadOnly lock prevents any modification to resource configurations, including scaling operations.

Adım Adım Çözüm

1
Identify the scope and inheritance of the resource lock.
The ReadOnly lock is applied at the subscription level, which means all resource groups and resources within that subscription inherit this lock.
Azure resource locks are inherited by child resources from parent scopes.
2
Determine the restriction level of a ReadOnly lock.
A ReadOnly lock prevents all write and delete operations, meaning no configurations can be modified and no resources can be deleted.
A ReadOnly lock is more restrictive than a CanNotDelete lock, which only blocks deletion but allows updates.
3
Evaluate the interaction between RBAC roles (Owner) and resource locks.
The Owner role's permissions are restricted by the resource lock. The lock must be removed before any modification can occur.
Resource locks apply to all users, even those with administrative or owner privileges.

Anahtar Kavram

Resource Locks Inheritance and ReadOnly Restrictions
Soru 42Soru

An organization needs to connect its on-premises datacenter to an Azure virtual network to support a hybrid cloud model. The connection must provide high reliability, support a bandwidth of up to 10 Gbps10\text{ Gbps}, and bypass the public internet entirely for security reasons. Which service should the organization implement?

Cevabı ve açıklamayı göster

Cevap: Azure ExpressRoute

Cevap

Azure ExpressRoute
The correct option is Azure ExpressRoute because it establishes a private, dedicated connection between an on-premises infrastructure and Azure datacenters. Since it does not traverse the public internet, it provides higher reliability, faster speeds, lower latencies, and tighter security than standard internet-based connections, easily supporting bandwidth requirements of 10 Gbps10\text{ Gbps} or more.

Adım Adım Çözüm

1
Analyze the connectivity requirements: hybrid connection to on-premises, bandwidth up to 10 Gbps10\text{ Gbps}, and the necessity to bypass the public internet entirely.
The requirement demands a dedicated private connection rather than an internet-based tunnel.
This filters out solutions that traverse the public internet or are restricted to cloud-only routing.
2
Evaluate the capabilities of the available options: ExpressRoute provides dedicated private circuits bypassing the internet; VPN Gateway encrypts traffic but routes it over the public internet; Virtual Network Peering connects virtual networks within Azure; Bastion provides management access to individual virtual machines.
Only ExpressRoute meets all criteria, including high bandwidth and bypassing the public internet.
Choosing the service that satisfies both the hybrid connectivity and physical routing path constraints.

Anahtar Kavram

Private hybrid cloud connectivity with Azure ExpressRoute
Soru 43Soru

A company is migrating a financial ledger application to Azure. The application requires a database engine that enforces a strict relational schema, supports ACID-compliant transactions, and allows querying via standard SQL. To minimize administrative overhead, Microsoft must manage the operating system patching, database engine updates, and backups. Which service should the company select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Database

Cevap

Azure SQL Database
Azure SQL Database is the correct service because it is a fully managed Platform as a Service (PaaS) relational database. It supports standard SQL queries, enforces relational schemas, guarantees ACID compliance, and offloads infrastructure management—such as backups, OS patching, and database updates—to Microsoft.

Adım Adım Çözüm

1
Analyze the database model requirements from the scenario.
The application requires a strict relational schema, standard SQL support, and ACID-compliant transactions. This points to a relational database engine.
Relational databases are designed for structured ledger data with fixed schemas and strong transactional guarantees.
2
Analyze the management and operational requirements from the scenario.
The company wants Microsoft to handle OS patching, database updates, and backups, indicating a Platform as a Service (PaaS) model.
PaaS database offerings offload physical and software maintenance to the cloud provider, reducing management overhead.
3
Evaluate the database services based on the model and management criteria.
Azure SQL Database is a PaaS relational database. SQL Server on Azure VMs is IaaS (requires customer OS/engine patching). Azure Cosmos DB is NoSQL (not relational). Dynamics 365 is SaaS (an application suite, not a database platform).
Matching both the relational requirements and the fully managed PaaS model selects the correct service.

Anahtar Kavram

Relational database services and management models in Azure
Tahmini Süre:1m 30s
Soru 44Soru

A development team has packaged a data processing task into a single Docker container. This task runs once a week for approximately two hours. The team wants to execute this containerized task without provisioning or managing virtual machines, and they want to avoid the administrative overhead of configuring a container orchestration platform. Which Azure service should the team choose to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure Container Instances (ACI)

Cevap

Azure Container Instances (ACI)
Azure Container Instances (ACI) is the ideal service for running isolated containers on-demand without orchestrator or virtual machine management. It enables launching a container in seconds and only charges for the exact duration of execution.

Adım Adım Çözüm

1
Analyze the application requirements.
The workload consists of a single, short-lived (two hours per week) containerized task that does not require complex routing, scaling, or service discovery.
This rules out complex container orchestrators designed for microservices architectures.
2
Evaluate the management constraints.
The team wants to avoid managing virtual machines (ruling out IaaS options like Azure Virtual Machines) and wants to minimize administrative overhead.
This guides the selection toward serverless or PaaS options that abstract the host infrastructure.
3
Compare the remaining Azure compute services.
Azure Container Instances (ACI) allows running containers on-demand without provisioning VMs or setting up orchestration. Azure App Service is tailored for web hosting, and Azure Kubernetes Service (AKS) is for full-scale orchestration.
ACI is the most cost-effective and low-overhead solution for isolated, short-lived container runs.

Anahtar Kavram

Azure Container Instances provides a serverless, low-overhead environment for running single, isolated containers without managing virtual machines or using a complex orchestrator.
Soru 45Soru

An administrator assigns the Reader role to a user at the Azure subscription level. The subscription contains a resource group named RG1, which contains a virtual machine named VM1. Which of the following describes the user's permissions for VM1?

Cevabı ve açıklamayı göster

Cevap: The user can view VM1 but cannot modify or delete it.

Cevap

The user can view VM1 but cannot modify or delete it.
Assigning the Reader role at the subscription level automatically propagates permissions down the Azure resource hierarchy. This means the user inherits Reader permissions on the resource group and the virtual machine, allowing them to view the virtual machine's configurations but preventing them from modifying or deleting it.

Adım Adım Çözüm

1
Identify the scope where the Azure RBAC role is assigned.
The Reader role is assigned at the subscription level.
Permissions in Azure RBAC propagate down the hierarchy from management groups, to subscriptions, to resource groups, and finally to resources.
2
Determine the inheritance of the Reader role for the resources inside the subscription.
The user inherits the Reader role for all resource groups (like RG1) and resources (like VM1) within that subscription.
Since inheritance is automatic and cannot be blocked at lower levels, the subscription-level Reader role applies to VM1.
3
Evaluate the capabilities of the Reader role on the target resource.
The user has view-only permissions for VM1 and cannot modify or delete it.
The built-in Reader role allows users to view resources but does not grant permissions to make changes or manage access.

Anahtar Kavram

Azure RBAC permissions inherit automatically from higher scopes (such as subscriptions) to lower scopes (such as resource groups and resources).
Soru 46Soru

An administrator manages an Azure subscription that contains a resource group named RG-App. The resource group contains a virtual machine named VM-Web. The administrator applies a ReadOnly lock to the subscription and a CanNotDelete lock to the resource group RG-App. A user who is assigned the Owner role at the subscription level attempts to start VM-Web and then attempts to delete VM-Web. What is the result of these two actions?

Cevabı ve açıklamayı göster

Cevap: Both the attempt to start VM-Web and the attempt to delete VM-Web are blocked.

Cevap

Both the attempt to start VM-Web and the attempt to delete VM-Web are blocked.
The correct answer is correct because Azure Resource Locks are inherited from higher scopes (subscription) to lower scopes (resource group and resource), and they are additive. The subscription-level ReadOnly lock is inherited by the virtual machine and blocks both write operations (like starting the VM) and delete operations. Furthermore, locks apply to all users, including subscription Owners, meaning they cannot perform these actions without removing the locks first.

Adım Adım Çözüm

1
Determine the resource lock inheritance on VM-Web.
VM-Web inherits the ReadOnly lock from the subscription and the CanNotDelete lock from the RG-App resource group.
Azure resource locks are inherited from parent scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective permissions resulting from the combined locks.
The effective state is ReadOnly, which blocks both deletions and modifications/writes.
Locks are additive, meaning the most restrictive combination of all applied and inherited locks is enforced.
3
Evaluate the user's role and the requested operations against the locks.
Both starting the VM (a write/update operation) and deleting the VM are blocked, regardless of the user's Owner role.
Resource locks apply to all users and roles, and cannot be bypassed by RBAC roles like Owner without first removing the lock.

Anahtar Kavram

Azure Resource Locks block operations regardless of RBAC roles, are inherited, and are additive (most restrictive applies). A ReadOnly lock prevents starting or stopping a virtual machine.
Soru 47Soru

An organization is planning to migrate a relational database to Azure. To minimize administrative overhead, the database solution must support automatic operating system patching, database software updates, and automated backups. Additionally, the database administrators require full administrative control over the underlying operating system to install custom third-party monitoring agents. The organization's cloud architect recommends deploying Azure SQL Database. Is this recommendation correct?

Cevabı ve açıklamayı göster

Cevap: False

Cevap

The recommendation is incorrect because Azure SQL Database, as a Platform as a Service (PaaS) offering, does not provide administrative access to the underlying operating system.
The recommendation is incorrect because Azure SQL Database is a fully managed Platform as a Service (PaaS) offering. While it satisfies the need for automatic patching, updates, and backups, it does not provide users with administrative access or control over the underlying operating system. To install custom monitoring agents directly on the OS, the organization would have to deploy their database on an Azure Virtual Machine (IaaS), which would then require them to manually manage OS and database updates.

Adım Adım Çözüm

1
Analyze the requirements for the migrated database.
The database needs automatic patching, updates, and backups (typically provided by PaaS), but also requires full OS administrative control to install custom agents (typically requiring IaaS).
To evaluate if the proposed solution meets all requirements.
2
Evaluate the capabilities of the recommended service, Azure SQL Database.
Azure SQL Database is a PaaS relational database service. It automates patching, updates, and backups, but does not allow administrative access to the underlying operating system.
To compare the service capabilities with the required features.
3
Determine whether the recommendation satisfies the OS-level access requirement.
The requirement for OS administrative control cannot be met by Azure SQL Database, making the recommendation incorrect.
To form the final true/false evaluation.

Anahtar Kavram

Understanding the management responsibilities and administrative boundaries of Azure PaaS relational database services versus IaaS database deployments.
Soru 48Soru

A gaming studio is designing the architecture for a new multiplayer game on Azure. The studio has two primary requirements:

* The game backend must automatically increase or decrease the number of virtual machine instances to match fluctuating player traffic in real time.
* The game database must handle a projected long-term increase in player registrations over the next year by upgrading the compute resources of the database server.

Which of the following cloud concepts are described in these requirements? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Elasticity, to dynamically scale the virtual machine instances in response to immediate spikes and drops in player traffic; Scalability, to handle the long-term increase in database workload by upgrading the virtual machine size

Cevap

The correct choices are the options describing elasticity (dynamic scaling of VM instances in response to traffic fluctuations) and scalability (handling long-term database workload increase by upgrading compute capacity).
The correct options are the ones describing elasticity and scalability. Elasticity represents the ability to automatically adjust resources up and down based on immediate demand. Scalability represents the capability to handle increased workload, such as scaling up database resources for long-term growth.

Adım Adım Çözüm

1
Analyze the first requirement: adjusting the number of virtual machine instances automatically in response to real-time fluctuations in traffic.
This matches the definition of elasticity, which is the ability to dynamically scale resources up and down to match demand and minimize consumption-based costs.
Elasticity involves automated, immediate adjustments in response to variable demand.
2
Analyze the second requirement: upgrading the compute resources of the database server to support long-term growth in registrations.
This matches the definition of scalability (specifically vertical scaling, or scaling up), which is the ability of a system to handle a larger workload by increasing capacity.
Scalability is focused on the capability to handle increased load, whether horizontally or vertically.
3
Evaluate the remaining options to identify incorrect concepts.
The option describing regional failover refers to Disaster Recovery rather than High Availability. The option describing Availability Zones incorrectly states that they span across different geographical regions.
High Availability focus is local redundancy/uptime within a region, and Availability Zones are contained entirely within a single region.

Anahtar Kavram

High Availability, Scalability, and Elasticity are core cloud concepts where scalability is the ability to handle increased load, elasticity is the ability to scale dynamically/automatically, and high availability ensures local uptime.
Tahmini Süre:1m 30s
Soru 49Soru

An organization is designing a migration strategy for a critical application composed of multiple containerized microservices. The architecture requires pod-level co-scheduling of helper containers, internal service discovery, and automated horizontal scaling of container groups. Additionally, the operations team wants to ensure that the operating system patching of the underlying nodes is managed automatically by the cloud provider, while still retaining declarative control over the container deployment configuration. Which Azure service should the organization select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure Kubernetes Service (AKS)

Cevap

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS) is the correct choice because it is a managed service that automates Kubernetes cluster management, including OS patching of worker nodes, while supporting complex container orchestration features like service discovery, auto-scaling, and pod co-scheduling.

Adım Adım Çözüm

1
Analyze the container orchestration requirements.
The application requires pod-level co-scheduling, service discovery, and container auto-scaling, which are standard Kubernetes features.
Identifying the need for these capabilities points to a container orchestrator rather than a basic container hosting solution.
2
Evaluate the administrative and patching constraints.
The operating system of the hosting nodes must be patched automatically by the cloud provider.
This rules out Infrastructure as a Service (IaaS) solutions where the tenant is responsible for OS maintenance.
3
Match the combined requirements to the correct managed service.
Azure Kubernetes Service (AKS) satisfies the orchestration capabilities while offering managed node OS patching.
AKS provides a managed control plane and automated node upgrades, balancing cloud provider management with Kubernetes orchestration control.

Anahtar Kavram

Distinguishing features and responsibilities between Azure Container Instances, Azure Kubernetes Service, and Azure App Service
Tahmini Süre:2m 0s
Soru 50Soru

A company is developing a custom accounting application that requires a relational database with strict schema enforcement and transactional integrity (ACID compliance). The solution must minimize administrative overhead, and Microsoft must be responsible for operating system patching and database engine updates. Which Azure service should the company select?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Database

Cevap

Azure SQL Database
Azure SQL Database is the correct choice because it is a fully managed relational database engine (PaaS) that handles operating system patching, updates, and backups automatically while providing relational features and transactional integrity (ACID compliance).

Adım Adım Çözüm

1
Analyze the application requirements
The application requires a relational database structure with strict schema enforcement and transactional integrity.
This narrows the choices down to relational database options.
2
Analyze the management requirements
The company wants to minimize administrative overhead, and Microsoft must handle OS patching and database engine updates.
This requires a Platform as a Service (PaaS) database service.
3
Match the combined requirements to the correct Azure service
Azure SQL Database fits both the relational database requirement and the fully managed PaaS requirement.
It handles patching automatically and offers full relational capabilities.

Anahtar Kavram

Selecting Azure relational database services and understanding PaaS vs IaaS management responsibilities
Tahmini Süre:1m 0s
Soru 51Soru

An international retail company is designing a hybrid cloud architecture to connect its on-premises headquarters to an Azure virtual network. The company requires a primary connection that guarantees high bandwidth, ultra-low latency, and never traverses the public internet. Additionally, they require a cost-effective, encrypted backup connection that can automatically handle traffic over the public internet if the primary connection fails. Which hybrid networking configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: A primary ExpressRoute connection, with a Site-to-Site VPN connection serving as the backup path.

Cevap

A primary ExpressRoute connection, with a Site-to-Site VPN connection serving as the backup path.
The correct configuration uses ExpressRoute for the primary connection because it provides a private, high-speed, and low-latency path that does not cross the public internet. The backup path uses a Site-to-Site VPN connection because it is a cost-effective, encrypted tunnel that runs over the public internet, ensuring continuity if the primary private circuit fails.

Adım Adım Çözüm

1
Analyze the primary connection requirements.
The requirements are high bandwidth, ultra-low latency, and zero traversal of the public internet. This matches the characteristics of Azure ExpressRoute.
ExpressRoute bypasses the public internet by using a private, dedicated connection through a connectivity provider.
2
Analyze the backup connection requirements.
The backup connection needs to be cost-effective and route encrypted traffic over the public internet. This matches the characteristics of an Azure Site-to-Site VPN.
A Site-to-Site VPN uses a VPN gateway to send encrypted traffic over the public internet, making it cost-effective and suitable for failover.
3
Combine the primary and backup services to find the correct configuration.
The correct configuration is ExpressRoute as the primary connection and Site-to-Site VPN as the backup connection.
This combination ensures that the primary path is high-performing and private, while the secondary path provides a cost-effective fallback over the public internet.

Anahtar Kavram

Azure hybrid networking options including ExpressRoute and VPN Gateways.
Soru 52Soru

A global organization is designing a cloud architecture on Azure. They have two primary database requirements:

1. A database for a real-time recommendation engine that requires horizontal scaling, global distribution with multi-region writes, and support for Cassandra and Graph APIs.
2. A transactional relational database for financial audit logs where the organization requires built-in high availability and automatic operating system patching, without the administrative overhead of managing virtual machines.

Which combination of Azure services and deployment models meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure Cosmos DB (a Platform as a Service multi-model service) for the recommendation engine, and Azure SQL Database (a Platform as a Service relational service) for the financial logs.

Cevap

Azure Cosmos DB (a Platform as a Service multi-model service) for the recommendation engine, and Azure SQL Database (a Platform as a Service relational service) for the financial logs.
The correct option accurately maps the multi-model requirements of the recommendation engine (Cassandra and Gremlin APIs) to Azure Cosmos DB, a PaaS service. It also matches the relational financial database to Azure SQL Database, which automatically manages host OS patching and high availability as a PaaS service.

Adım Adım Çözüm

1
Analyze the requirements for the recommendation engine.
The recommendation engine requires horizontal scale, global multi-region writes, and compatibility with Cassandra and Graph APIs, which points to a NoSQL multi-model service.
Azure Cosmos DB is Azure's premier NoSQL multi-model PaaS database service designed to satisfy these specific API and scalability requirements.
2
Analyze the requirements for the financial logs database.
The financial logs database requires a relational model where Azure automatically manages host operating system patching and high availability, without the customer managing virtual machines.
Azure SQL Database is a fully managed relational PaaS database that satisfies the schema constraints and eliminates OS administration overhead.
3
Map the selected services to their correct cloud deployment models.
Both Azure Cosmos DB and Azure SQL Database are deployed as Platform as a Service (PaaS) database options.
Under the shared responsibility model, PaaS ensures that Microsoft manages OS patching, physical infrastructure, and high availability, while the customer manages database configuration and data.

Anahtar Kavram

Azure relational and non-relational database services and their cloud service models.
Tahmini Süre:2m 0s
Soru 53Soru

An organization is designing a cloud architecture on Azure for a new retail platform. The architecture requires three distinct host environments:
1. A containerized backend service that runs continuously, requires complex orchestration, service discovery, and fine-grained control over pod scheduling.
2. A temporary, event-driven containerized task that executes on demand for less than 10 minutes to process images, requiring rapid startup and no orchestration overhead.
3. A customer-facing web portal that requires automatic OS-level patching, SSL certificate management, and minimal infrastructure management.

To minimize cost and administrative effort while meeting these exact technical requirements, which combination of Azure compute services should the organization choose?

Cevabı ve açıklamayı göster

Cevap: Azure Kubernetes Service (AKS) for the backend service, Azure Container Instances (ACI) for the image processing task, and Azure App Service for the web portal.

Cevap

Azure Kubernetes Service (AKS) for the backend service, Azure Container Instances (ACI) for the image processing task, and Azure App Service for the web portal.
The combination of Azure Kubernetes Service (AKS) for the backend service, Azure Container Instances (ACI) for the image processing task, and Azure App Service for the web portal is correct because it matches each requirement to the appropriate service level. AKS handles orchestration and scheduling for the complex backend; ACI provides low-overhead, serverless execution for the short-running task; and Azure App Service automates patching and SSL management as a PaaS platform.

Adım Adım Çözüm

1
Analyze the requirements for the backend service.
The backend service runs continuously, requires complex orchestration, service discovery, and fine-grained scheduling. This matches Azure Kubernetes Service (AKS) capabilities.
Azure Container Instances (ACI) and App Service do not offer complete Kubernetes orchestration features like custom scheduling and service discovery.
2
Analyze the requirements for the image processing task.
The task is event-driven, short-lived (less than 10 minutes), and requires no orchestration overhead. This matches Azure Container Instances (ACI) capabilities.
ACI is ideal for quick, isolated container tasks without provisioning full virtual machines or managing orchestrators.
3
Analyze the requirements for the customer-facing web portal.
The portal needs a PaaS environment where Microsoft manages OS patching and SSL certificates. This matches Azure App Service capabilities.
Azure App Service is a PaaS solution that handles OS maintenance automatically, unlike IaaS offerings (Virtual Machines) where the customer must manage patching.
4
Synthesize the findings to select the correct combination.
AKS is chosen for the backend, ACI for the image task, and App Service for the web portal.
This combination aligns perfectly with the cloud architecture requirements while minimizing administrative effort and cost.

Anahtar Kavram

Azure Container Instances, Azure Kubernetes Service, and Azure App Service
Soru 54Soru

An Azure subscription contains a resource group named RG-Prod. Inside RG-Prod, there is a logical Azure SQL Database server named SQLServer1 and an Azure SQL database named SQLDB1.

An administrator applies a ReadOnly resource lock to the subscription. Later, the administrator applies a CanNotDelete resource lock directly to the resource group RG-Prod.

Which of the following actions can a user perform on these resources?

Cevabı ve açıklamayı göster

Cevap: Insert new records into a table within SQLDB1.

Cevap

Inserting new records into a table within SQLDB1.
Inserting new records into a table within the database is a data plane operation. Azure Resource Locks only apply to control plane (management) operations managed by Azure Resource Manager (ARM). Therefore, operations like writing data, reading tables, or executing queries inside the database are not blocked by resource locks.

Adım Adım Çözüm

1
Evaluate the inheritance of resource locks across the scopes.
The subscription has a ReadOnly lock, and the resource group has a CanNotDelete lock. Resources inside the resource group (SQLServer1 and SQLDB1) inherit both locks.
Resource locks in Azure are inherited from parent scopes (Subscription -> Resource Group -> Resource).
2
Determine the effective lock restriction on the resources.
The ReadOnly lock is more restrictive than the CanNotDelete lock, so the effective lock applied to the resources inside RG-Prod is ReadOnly.
When multiple locks are inherited or applied, the most restrictive lock takes precedence.
3
Distinguish between control plane and data plane operations.
Control plane operations (managed by Azure Resource Manager, such as scaling, modifying firewalls, or deleting resources/locks) are blocked by the ReadOnly lock. Data plane operations (managed by the database engine, such as inserting or querying data) are not affected by resource locks.
Azure Resource Locks only restrict control plane operations and have no effect on data plane operations.
4
Select the only permitted action.
Inserting new records into a database table is a data plane operation and is allowed, while scaling, editing firewall configurations, or deleting locks are control plane operations and are blocked.
Only data plane operations can bypass the inherited control plane ReadOnly lock restriction.

Anahtar Kavram

Azure resource locks restrict Azure Resource Manager control plane operations but do not affect data plane operations, with inherited locks combining so that the most restrictive lock applies.
Soru 55Soru

An organization has an Azure subscription named Sub1 that contains a resource group named RG-Web. You need to configure the environment to meet the following requirements:

* A security auditor named Taylor must be able to assign roles and manage access permissions for other users on all resources inside RG-Web, but Taylor must not be able to create, modify, or delete any resources.
* All resources deployed within Sub1 must be restricted to a specific list of approved Azure regions.

Which configuration should you implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign an Azure Policy definition at the Sub1 scope.

Cevap

Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign an Azure Policy definition at the Sub1 scope.
Assigning the User Access Administrator role at the RG-Web scope grants the permissions to manage user access and role assignments on all resources inside that resource group, but does not allow creating or deleting the resources themselves. Assigning an Azure Policy at the Sub1 scope ensures that all resources deployed within the subscription comply with the specified regional restrictions, as policies are inherited by child resource groups and resources.

Adım Adım Çözüm

1
Determine the appropriate Azure RBAC role and scope for the security auditor.
Identify the User Access Administrator role assigned at the RG-Web resource group level.
This role grants the required permission to assign roles and manage access for others without granting permissions to write, delete, or modify the underlying resources. Assigning it at the RG-Web scope follows the principle of least privilege.
2
Select the correct mechanism to restrict resource deployment regions.
Identify Azure Policy as the compliance enforcement mechanism.
Azure Policy is designed to enforce compliance and resource properties, such as restricting allowed deployment regions. Azure RBAC controls authorization/access, while resource locks block deletions or modifications entirely.
3
Determine the proper scope for the regional restriction.
Apply the Azure Policy definition at the Sub1 subscription level.
The requirement specifies that all resources deployed within the subscription must be restricted. Assigning the policy at the subscription level ensures that all existing and future resource groups and resources under it inherit and enforce the policy.

Anahtar Kavram

Understanding the difference between Azure RBAC (access control) and Azure Policy (resource compliance/properties), along with resource group hierarchy rules.
Tahmini Süre:2m 0s
Soru 56Soru

A retail company has several physical stores, each running Windows and Linux servers on-premises. The company wants to manage and monitor these on-premises servers alongside their Azure resources using a single control plane.

Statement: The company can use Azure Arc to project these on-premises physical servers into Azure Resource Manager as hybrid machines.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True
Azure Arc allows organizations to project physical and virtual servers running on-premises or in other clouds into Azure Resource Manager, representing them as hybrid machines that can be managed from the Azure portal.

Adım Adım Çözüm

1
Identify the organization's goal to extend Azure's centralized management to physical servers located outside of Azure's cloud infrastructure.
The organization needs a way to bridge non-Azure on-premises servers with Azure Resource Manager.
This establishes the hybrid environment context for the question.
2
Determine if Azure Arc is the service designed to extend Azure Resource Manager to external resources.
Azure Arc functions specifically to project external resources, including on-premises Windows and Linux servers, into Azure Resource Manager as hybrid machines.
This verifies the validity of the statement.

Anahtar Kavram

Azure Arc extends the Azure control plane (Azure Resource Manager) to secure and govern infrastructure and applications outside of Azure, including on-premises and multi-cloud servers.
Soru 57Soru

An enterprise administrator is designing access controls for an Azure environment. A system auditor, User1, needs to inspect all resources across an Azure subscription named 'Subscription1'. Additionally, User1 must be able to perform management operations (such as starting, stopping, and restarting) on virtual machines within a specific resource group named 'RG-Prod'. However, User1 must not be allowed to modify permissions or assign roles to other users in any scope.

Which of the following configurations correctly implements these requirements?

Cevabı ve açıklamayı göster

Cevap: Assign User1 the Reader role at the Subscription1 scope, and assign User1 the Virtual Machine Contributor role at the RG-Prod scope.

Cevap

Assign User1 the Reader role at the Subscription1 scope, and assign User1 the Virtual Machine Contributor role at the RG-Prod scope.
Assigning the Reader role at the Subscription1 scope and the Virtual Machine Contributor role at the RG-Prod scope correctly grants the ability to view all resources in the subscription, while also allowing virtual machine management within the specific resource group. Since neither role includes permissions to write role assignments, the security requirement of not allowing delegation is fully satisfied.

Adım Adım Çözüm

1
Evaluate the requirement to inspect all resources across Subscription1.
Assigning the Reader role at the Subscription1 scope enables User1 to view all resources in the subscription and inherits down to all resource groups.
Ensures complete inspection capability across the target scope.
2
Evaluate the requirement to manage virtual machines within RG-Prod.
Assigning the Virtual Machine Contributor role at the RG-Prod scope grants permissions to perform VM operations (start, stop, restart) within that resource group.
Allows virtual machine management specifically within the required resource group without granting full contributor access to other resource types.
3
Verify the constraint preventing User1 from assigning roles or modifying permissions.
Neither the Reader role nor the Virtual Machine Contributor role has permission to write role assignments (Microsoft.Authorization/roleAssignments/write).
Guarantees that User1 cannot delegate permissions to other users.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) role assignment, inheritance, and separation from Azure Policy and Resource Locks.
Tahmini Süre:3m 0s
Soru 58Soru

An administrator assigns a user the Reader role at the scope of an Azure subscription. Determine if the following statement is true or false: The user will automatically have read access to all resources within that subscription due to role inheritance.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

True
Assigning a role at the subscription level automatically propagates those permissions to all child resource groups and resources due to the hierarchical inheritance model of Azure RBAC.

Adım Adım Çözüm

1
Identify the scope at which the role assignment is made.
The Reader role is assigned at the subscription scope, which sits above resource groups and individual resources in the Azure resource hierarchy.
Understanding where the permission is applied is key to determining how it propagates.
2
Apply the Azure RBAC inheritance rules.
Permissions assigned at a parent scope (like a subscription) are inherited by all child scopes (like resource groups and resources).
This is a fundamental mechanism of Azure's governance structure.
3
Evaluate the user's access to the resources within the subscription.
Because of inheritance, the user automatically receives Reader access to all resources in all resource groups under that subscription.
Determines the truth value of the target statement.

Anahtar Kavram

Azure RBAC scope inheritance
Tahmini Süre:45s
Soru 59Soru

An Azure resource group contains a virtual machine. A ReadOnly resource lock is applied to this resource group. Which of the following statements describe the effects of this lock on the virtual machine? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Authorized users can view the configuration settings of the virtual machine.; Authorized users are prevented from deleting the virtual machine.

Cevap

Authorized users can view the configuration settings of the virtual machine, and authorized users are prevented from deleting the virtual machine.
The correct options are that authorized users can view the configuration settings and are prevented from deleting the virtual machine. This is because a ReadOnly lock applied at the resource group level is inherited by the virtual machine, allowing only read operations (viewing configurations) and blocking all write or delete operations.

Adım Adım Çözüm

1
Determine lock inheritance.
The ReadOnly lock applied at the resource group level is inherited by all resources within it, including the virtual machine.
Azure Resource Locks are inherited by child resources.
2
Evaluate the permissions allowed by a ReadOnly lock.
ReadOnly locks allow read operations (like viewing configuration) but block write/modify and delete operations.
This is the primary function of a ReadOnly lock.
3
Identify which actions are allowed and which are blocked.
Viewing configuration is allowed. Deleting, resizing, and starting/stopping are blocked because resizing and starting/stopping require write operations.
Starting/stopping a VM modifies its state and is therefore blocked.

Anahtar Kavram

Azure Resource Locks prevent accidental deletion or modification of resources. A ReadOnly lock allows only read operations and blocks all write, modify, and delete operations.
Soru 60Soru

Azure SQL Database is a Platform as a Service (PaaS) offering that automatically handles database management tasks such as software patching and backups without user intervention.

Cevabı ve açıklamayı göster

Cevap: True

Cevap

Azure SQL Database is a Platform as a Service (PaaS) offering that automatically handles database management tasks.
Azure SQL Database is a Platform as a Service (PaaS) database where Microsoft automatically manages the underlying database engine, including patching and backups.

Adım Adım Çözüm

1
Identify the service category of Azure SQL Database.
Azure SQL Database is classified as a Platform as a Service (PaaS) offering.
Microsoft manages the underlying infrastructure, operating system, and database software.
2
Determine the management responsibilities of a PaaS database offering.
In a PaaS model, management tasks such as backups, patching, and upgrading are automatically handled by the cloud provider.
The shared responsibility model dictates that database engine management and patching are shifted to Microsoft in a PaaS database solution.

Anahtar Kavram

Azure SQL Database management responsibilities
ÖncekiSayfa 3 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Fundamentals (AZ-900) | Examkin