Examkin

Tüm alıştırma soruları

228 soru

Tüm türler1,186Çoktan seçmeli620Çoklu seçim228Doğru / Yanlış291Eşleştirme47
Soru 1Soru →

An organization is designing a hybrid network architecture to connect its on-premises datacenter to an Azure Virtual Network (VNet). The primary connection must be a private, dedicated, high-speed connection that does not traverse the public internet. For redundancy, the organization requires a cost-effective backup connection that can be routed over the public internet. Which two Azure connectivity options should the organization implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure ExpressRoute to serve as the primary connection; Azure VPN Gateway to serve as the backup connection

Cevap

Azure ExpressRoute for the primary connection and Azure VPN Gateway for the backup connection
The correct options are Azure ExpressRoute as the primary connection and Azure VPN Gateway as the backup connection. ExpressRoute meets the requirement for a private, high-speed connection that bypasses the public internet. VPN Gateway meets the requirement for a cost-effective backup that routes encrypted traffic over the public internet.

Adım Adım Çözüm

1
Identify the requirement for the primary connection
The primary connection must be private, dedicated, high-speed, and not traverse the public internet. This matches the definition and capabilities of Azure ExpressRoute.
ExpressRoute provides dedicated, private connections to Azure via a connectivity provider, bypassing the public internet entirely.
2
Identify the requirement for the backup connection
The backup connection must be cost-effective and route traffic over the public internet. This matches the capabilities of Azure VPN Gateway.
VPN Gateway establishes an encrypted Site-to-Site tunnel over the public internet, providing a cheaper, Internet-based path suitable for redundancy.

Anahtar Kavram

Azure hybrid networking connectivity options, specifically distinguishing between the private nature of ExpressRoute and the internet-based nature of VPN Gateway.
Soru 2Soru →

An IT department is implementing a governance and monitoring strategy for their Azure cloud infrastructure. They need to configure appropriate health monitoring tools to distinguish between global Azure outages, service-level issues affecting their subscriptions, and specific resource failures. Which two of the following statements correctly describe the capabilities of the Azure Service Health suite?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Service Health provides a personalized dashboard that tracks service issues, planned maintenance, and health advisories affecting only the Azure services and regions used by your subscription.; Azure Resource Health provides details about the health of your individual resource instances, such as a specific virtual machine, and helps you diagnose whether an issue is due to a platform outage or a user configuration.

Cevap

Azure Service Health provides a personalized dashboard that tracks service issues, planned maintenance, and health advisories affecting only the Azure services and regions used by your subscription; and Azure Resource Health provides details about the health of your individual resource instances, such as a specific virtual machine, and helps you diagnose whether an issue is due to a platform outage or a user configuration.
The correct options accurately define the functions of the Azure Service Health suite. Specifically, the option describing a personalized dashboard for service issues, planned maintenance, and advisories represents the core capability of Azure Service Health. The option detailing diagnostic information for specific resource instances represents Azure Resource Health. Together, these form the pillars of the Azure Service Health suite along with the global Azure Status page.

Adım Adım Çözüm

1
Identify the component of the Azure Service Health suite that provides personalized notifications for subscription-level impact.
Determine that Azure Service Health provides a filtered, personalized view of issues, planned maintenance, and advisories for the specific services and regions used by the subscription.
This confirms the personalized, service-level nature of Azure Service Health.
2
Identify the component that monitors individual resource instances.
Determine that Azure Resource Health is responsible for diagnosing issues with specific resource instances (like a virtual machine or SQL database) and identifying whether the problem is on the Azure platform side or due to client configuration.
This verifies the function of Azure Resource Health within the suite.
3
Evaluate the incorrect options that refer to global status or resource telemetry.
Identify that global status is handled by Azure Status (which is not personalized), and application/infrastructure metrics/logs are collected by Azure Monitor rather than Azure Service Health.
This filters out distractors based on the target misconception of confusing Azure Service Health with Azure Monitor or Azure Status.

Anahtar Kavram

Azure Service Health suite components (Azure Status, Service Health, Resource Health) vs Azure Monitor functions
Tahmini Süre:1m 30s
Soru 3Soru →

A financial technology startup is designing the cloud infrastructure for its payment processing API. The startup has two main operational requirements:

1. The API must continue to process transactions without interruption even if a localized power outage occurs in one of the physical datacenters within the Azure region.
2. The compute capacity must automatically expand when transaction volume spikes during business hours and contract during the night to minimize operational costs.

Which of the following cloud characteristics or architectural choices directly align with these requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploying the API instances across multiple Availability Zones within the region to ensure high availability.; Implementing autoscale rules on the compute resources to dynamically match CPU capacity with real-time transaction volume to achieve elasticity.

Cevap

Deploying instances across multiple Availability Zones to ensure high availability, and implementing autoscale rules on compute resources to achieve elasticity.
The correct choices are deploying the API instances across multiple Availability Zones and implementing autoscale rules on the compute resources. Distributing resources across multiple Availability Zones provides localized fault tolerance (high availability) to survive a datacenter power outage. Autoscale rules dynamically add and remove instances based on workload, which directly implements cloud elasticity.

Adım Adım Çözüm

1
Analyze the first requirement: ensuring the payment API continues to run without interruption during a localized power outage within the region.
Identify this as a High Availability (HA) requirement, which is achieved by deploying API instances across multiple independent Availability Zones within the same region.
Availability Zones are physically separate datacenters with independent power, cooling, and networking within a region, protecting against localized power failures.
2
Analyze the second requirement: automatically expanding compute capacity during day-time volume spikes and contracting at night to minimize costs.
Identify this as an Elasticity requirement, achieved by configuring autoscale rules on virtual machine resources.
Elasticity is the capability to dynamically scale resources in and out in real-time to match current demand, optimizing cost and performance.

Anahtar Kavram

Understanding the distinction between High Availability (ensuring uptime during local failures) and Elasticity (dynamic scaling to match demand).
Tahmini Süre:2m 0s
Soru 4Soru →

An organization is planning to migrate its legacy enterprise resource planning (ERP) application to Azure. The application has three main requirements:

1. Custom kernel extensions on a specific version of Linux.
2. Full control over the database engine installation to support a legacy version of Oracle Database.
3. Integration with on-premises Active Directory using a site-to-site VPN.

To meet these requirements, the organization deploys Azure Virtual Machines and an Azure VPN Gateway.

Which two of the following tasks are the responsibility of the organization in this setup? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring the guest operating system firewall and patching the Oracle database engine.; Configuring the IP addressing and routing within the Azure Virtual Network (VNet) where the virtual machines are deployed.

Cevap

Configuring the guest operating system firewall and patching the Oracle database engine, and configuring the IP addressing and routing within the Azure Virtual Network (VNet) where the virtual machines are deployed.
Under the Infrastructure as a Service (IaaS) model, the customer is responsible for everything from the guest operating system upward, which includes installing updates, managing databases, and setting up guest-level firewalls. Additionally, customers are responsible for specifying and managing configuration details within their Virtual Networks (VNets), such as routing and IP addresses.

Adım Adım Çözüm

1
Identify the service models of the deployed Azure resources.
Azure Virtual Machines operate under the Infrastructure as a Service (IaaS) model, while the Azure VPN Gateway is a managed Platform as a Service (PaaS) offering.
Correctly identifying the service models is essential to applying the shared responsibility boundaries.
2
Determine the customer's responsibilities for the IaaS Virtual Machines.
The customer is responsible for managing, configuring, and patching the guest operating system, applications, databases, and middleware.
Under IaaS, Microsoft only manages the physical hosts, hypervisor, and physical network infrastructure.
3
Determine the customer's responsibilities for the managed PaaS and networking components.
The customer is responsible for setting up VNet configuration details like IP addressing and routing, but does not manage the operating system or apply software updates to managed appliances like the VPN Gateway.
PaaS offloads OS administration and appliance patching responsibilities to Microsoft, reducing operational overhead.

Anahtar Kavram

IaaS Shared Responsibility Model
Tahmini Süre:2m 0s
Soru 5Soru →

An organization hosts a web application on Microsoft Azure. During an unexpected promotional event, the system automatically deploys additional virtual machine instances to distribute the increased traffic load. Once the traffic decreases, the system automatically removes these instances to reduce costs. Additionally, the instances are distributed across different physical data centers within a single region to ensure the application remains accessible during a localized power failure. Which two statements correctly describe the cloud concepts demonstrated in this scenario?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The dynamic provisioning and deprovisioning of virtual machine instances to match real-time demand is an example of elasticity.; Distributing the virtual machine instances across different physical data centers within the same region to prevent downtime from localized failures achieves high availability.

Cevap

The dynamic provisioning and deprovisioning of virtual machine instances to match real-time demand is an example of elasticity, and distributing the virtual machine instances across different physical data centers within the same region to prevent downtime from localized failures achieves high availability.
The scenario describes two main cloud behaviors: first, the automatic scaling out and scaling in of resources to match current workload demand, which is the definition of elasticity. Second, the deployment of redundant instances across different physical facilities in the same region to prevent downtime during localized failures, which defines high availability.

Adım Adım Çözüm

1
Analyze the automatic scaling out and scaling in of virtual machine instances based on traffic demand.
Identify this behavior as elasticity because it involves automatic, dynamic scaling of resource counts in both directions to match demand.
Elasticity is defined by the auto-scaling capability to adjust resources dynamically based on load, distinguishing it from static scalability.
2
Analyze the distribution of instances across different physical data centers in the same region to survive local failures.
Identify this architectural decision as high availability because it ensures service continuity and redundancy within a region.
High availability aims to maintain system uptime during localized physical failures by using redundant paths within the same region, whereas disaster recovery focuses on failing over to a separate region during a full regional outage.
3
Evaluate the incorrect options to rule out common misconceptions.
Rule out the statement about vertical scalability because instance-count adjustment is horizontal scaling, and rule out the statement about regional disaster recovery because localized data center redundancy does not protect against a full regional outage.
This confirms the correct two options by identifying that vertical scaling modifies instance capacity, and disaster recovery requires multi-region separation.

Anahtar Kavram

High Availability, Scalability, and Elasticity
Tahmini Süre:2m 0s
Soru 6Soru →

A gaming studio is designing the architecture for a new multiplayer game on Azure. The studio has two primary requirements:

* The game backend must automatically increase or decrease the number of virtual machine instances to match fluctuating player traffic in real time.
* The game database must handle a projected long-term increase in player registrations over the next year by upgrading the compute resources of the database server.

Which of the following cloud concepts are described in these requirements? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Elasticity, to dynamically scale the virtual machine instances in response to immediate spikes and drops in player traffic; Scalability, to handle the long-term increase in database workload by upgrading the virtual machine size

Cevap

The correct choices are the options describing elasticity (dynamic scaling of VM instances in response to traffic fluctuations) and scalability (handling long-term database workload increase by upgrading compute capacity).
The correct options are the ones describing elasticity and scalability. Elasticity represents the ability to automatically adjust resources up and down based on immediate demand. Scalability represents the capability to handle increased workload, such as scaling up database resources for long-term growth.

Adım Adım Çözüm

1
Analyze the first requirement: adjusting the number of virtual machine instances automatically in response to real-time fluctuations in traffic.
This matches the definition of elasticity, which is the ability to dynamically scale resources up and down to match demand and minimize consumption-based costs.
Elasticity involves automated, immediate adjustments in response to variable demand.
2
Analyze the second requirement: upgrading the compute resources of the database server to support long-term growth in registrations.
This matches the definition of scalability (specifically vertical scaling, or scaling up), which is the ability of a system to handle a larger workload by increasing capacity.
Scalability is focused on the capability to handle increased load, whether horizontally or vertically.
3
Evaluate the remaining options to identify incorrect concepts.
The option describing regional failover refers to Disaster Recovery rather than High Availability. The option describing Availability Zones incorrectly states that they span across different geographical regions.
High Availability focus is local redundancy/uptime within a region, and Availability Zones are contained entirely within a single region.

Anahtar Kavram

High Availability, Scalability, and Elasticity are core cloud concepts where scalability is the ability to handle increased load, elasticity is the ability to scale dynamically/automatically, and high availability ensures local uptime.
Tahmini Süre:1m 30s
Soru 7Soru →

An Azure resource group contains a virtual machine. A ReadOnly resource lock is applied to this resource group. Which of the following statements describe the effects of this lock on the virtual machine? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Authorized users can view the configuration settings of the virtual machine.; Authorized users are prevented from deleting the virtual machine.

Cevap

Authorized users can view the configuration settings of the virtual machine, and authorized users are prevented from deleting the virtual machine.
The correct options are that authorized users can view the configuration settings and are prevented from deleting the virtual machine. This is because a ReadOnly lock applied at the resource group level is inherited by the virtual machine, allowing only read operations (viewing configurations) and blocking all write or delete operations.

Adım Adım Çözüm

1
Determine lock inheritance.
The ReadOnly lock applied at the resource group level is inherited by all resources within it, including the virtual machine.
Azure Resource Locks are inherited by child resources.
2
Evaluate the permissions allowed by a ReadOnly lock.
ReadOnly locks allow read operations (like viewing configuration) but block write/modify and delete operations.
This is the primary function of a ReadOnly lock.
3
Identify which actions are allowed and which are blocked.
Viewing configuration is allowed. Deleting, resizing, and starting/stopping are blocked because resizing and starting/stopping require write operations.
Starting/stopping a VM modifies its state and is therefore blocked.

Anahtar Kavram

Azure Resource Locks prevent accidental deletion or modification of resources. A ReadOnly lock allows only read operations and blocks all write, modify, and delete operations.
Soru 8Soru →

An Azure administrator configures resource locks in a Microsoft Azure subscription. The administrator applies a ReadOnly lock to a resource group named RG-Production. Within RG-Production, there is an Azure Virtual Machine named VM-App1. The administrator then applies a CanNotDelete lock directly to VM-App1.

Which of the following statements describe the combined effects of these locks on VM-App1? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Authorized users are prevented from deleting VM-App1.; Authorized users are prevented from starting or stopping VM-App1.

Cevap

Authorized users are prevented from deleting the virtual machine, and they are also prevented from starting or stopping the virtual machine.
Resource locks are inherited from parent scopes to child resources. When multiple locks are applied, they are additive, meaning the most restrictive lock settings apply. The ReadOnly lock from the resource group prevents any modifications or control operations (such as starting or stopping the virtual machine), while both locks prevent the deletion of the resource.

Adım Adım Çözüm

1
Analyze lock inheritance rules in Azure.
Resource locks applied at the resource group level are inherited by all resources within that resource group. Therefore, the ReadOnly lock applies to VM-App1.
To determine which locks are active on VM-App1.
2
Determine the combined effect of multiple locks.
Locks are additive. Since VM-App1 has both a ReadOnly lock (inherited) and a CanNotDelete lock (directly applied), the most restrictive lock rules apply. ReadOnly is more restrictive than CanNotDelete.
To evaluate how the two lock types interact.
3
Evaluate the capabilities allowed by the active locks.
The ReadOnly lock prevents deletion and any modifications, including operations like starting and stopping the virtual machine. The CanNotDelete lock also prevents deletion.
To identify the correct statements regarding the effects on the virtual machine.

Anahtar Kavram

Resource locks are inherited, additive, and the ReadOnly lock prevents both deletion and configuration updates (including stopping or starting virtual machines).
Soru 9Soru →

An Azure subscription named Sub-Corp has a CanNotDelete resource lock applied. Within Sub-Corp, there is a resource group named RG-Data that has a ReadOnly resource lock applied. RG-Data contains a storage account named sa-logs and a virtual network named vnet-prod. An administrator with Owner permissions on the subscription attempts to perform various tasks. Which of the following actions are blocked by the resource locks? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Retrieving the access keys for the storage account sa-logs; Deleting the virtual network vnet-prod

Cevap

The actions that are blocked by the resource locks are retrieving the access keys for the storage account sa-logs, and deleting the virtual network vnet-prod.
The correct options are the ones stating that retrieving the access keys for the storage account sa-logs and deleting the virtual network vnet-prod are blocked. Retrieving the access keys is a control plane POST request, which is blocked by the ReadOnly lock on the resource group. Deleting the virtual network is blocked because it is located inside the resource group with the ReadOnly lock and inherits the CanNotDelete lock from the subscription.

Adım Adım Çözüm

1
Analyze the scope and type of the resource locks applied.
The subscription has a CanNotDelete lock (prevents deletion, allows modification). The resource group RG-Data has a ReadOnly lock (prevents modification and deletion).
Understanding lock types is necessary to evaluate which operations are blocked at each scope.
2
Determine the lock status inherited by each resource.
Resources in RG-Data (sa-logs and vnet-prod) inherit the ReadOnly lock. Resources outside RG-Data but inside Sub-Corp (like RG-App) only inherit the CanNotDelete lock.
Resource locks are inherited by child resources, so their effective lock level depends on where they are in the hierarchy.
3
Evaluate the attempted actions against control plane and data plane rules.
Retrieving storage keys is a control plane POST operation, which is blocked by the ReadOnly lock. Deleting the virtual network is blocked by both locks. Modifying tags on RG-App is allowed because CanNotDelete does not block edits. Uploading a blob is a data plane operation and is not blocked by resource locks.
This step distinguishes between management operations and data operations, as well as the specific limitations of each lock type.

Anahtar Kavram

Azure Resource Locks prevent accidental deletion or modification of resources. They are inherited from parent scopes (subscriptions, resource groups) to child resources. CanNotDelete prevents deletion but allows updates, while ReadOnly prevents both deletion and updates (including control plane POST requests like listing storage keys), but does not affect data plane operations.
Tahmini Süre:2m 0s
Soru 10Soru →

An enterprise Azure subscription has a `ReadOnly` lock applied at the subscription level. Within this subscription, a resource group named `RG-CoreServices` contains an Azure Cosmos DB account named `cosmos-orders` and an Azure Storage account named `stbackups`. A `CanNotDelete` lock is applied directly to `RG-CoreServices`.

An administrator with the Owner role at the subscription level needs to perform maintenance. Which two of the following actions can the administrator successfully complete without modifying or removing any resource locks? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Upload a database backup file to an existing blob container in `stbackups` using a pre-existing Shared Access Signature (SAS).; Delete an existing log file stored as a blob in a container within `stbackups` using direct data plane access.

Cevap

The administrator can upload a database backup file to an existing blob container using a pre-existing Shared Access Signature (SAS), and delete an existing log file stored as a blob using direct data plane access.
The correct options are uploading a backup file and deleting a log file. Both operations are data plane tasks interacting directly with the storage container contents rather than modifying the Azure Resource Manager (ARM) configuration of the resource. Resource locks only restrict control plane operations.

Adım Adım Çözüm

1
Determine the scope and inheritance of the applied locks.
The ReadOnly lock applied at the subscription level inherits down to all resource groups and resources in the subscription, making them effectively read-only. The CanNotDelete lock on the resource group prevents deletion of the resource group and its resources.
Resource locks are inherited by all child resources.
2
Distinguish between control plane and data plane operations.
Resource locks apply strictly to the Azure Resource Manager control plane (operations managing resources). They do not restrict data plane operations (reading, writing, or deleting data within the resources).
This determines which operations bypass resource locks.
3
Evaluate each action against the lock restrictions.
Creating a resource group, modifying firewall rules, and listing access keys are all control plane operations blocked by the ReadOnly lock. Uploading a blob and deleting a blob are data plane operations and are permitted.
To identify which actions will succeed without removing the locks.

Anahtar Kavram

Azure Resource Locks restrict control plane operations (such as configuration changes and resource deletion) but do not block data plane operations (such as manipulating data inside a storage account or database). ReadOnly locks also block operations that retrieve keys (like listKeys) because keys grant write access.
Soru 11Soru →

A logistics company is designing its hybrid network architecture. The primary datacenter requires a dedicated connection that bypasses the public internet to ensure predictable latency for real-time data replication. A remote warehouse needs a cost-effective, encrypted connection to manage virtual machines within an Azure Virtual Network. Which of the following Azure networking services should the company implement to meet these requirements? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An Azure ExpressRoute circuit for the primary datacenter connection; An Azure VPN Gateway for the remote warehouse connection

Cevap

The logistics company should configure an Azure ExpressRoute circuit for the primary datacenter and an Azure VPN Gateway for the remote warehouse.
The correct options are the deployment of an Azure ExpressRoute circuit for the primary datacenter and an Azure VPN Gateway for the remote warehouse. Azure ExpressRoute provides a dedicated, private connection to Azure resources that does not traverse the public internet, offering high reliability and predictable latency for real-time replication. Azure VPN Gateway establishes an encrypted tunnel over the public internet, making it a secure and cost-effective solution for management traffic from remote locations.

Adım Adım Çözüm

1
Analyze the requirements for the primary datacenter connection, which calls for a dedicated connection that bypasses the public internet and provides predictable latency.
Identify Azure ExpressRoute as the service designed for private, dedicated connectivity that does not traverse the public internet.
ExpressRoute connects on-premises networks directly to Microsoft services over a private peering connection.
2
Analyze the requirements for the remote warehouse, which asks for a cost-effective, encrypted connection to manage virtual machines.
Identify Azure VPN Gateway as the appropriate service for establishing secure, encrypted IPsec tunnels over the public internet.
VPN Gateways are highly cost-effective and provide secure communication over the public internet, suitable for remote management.

Anahtar Kavram

Azure hybrid connectivity services (VPN Gateway and ExpressRoute)
Soru 12Soru →

An administrator is designing a hybrid cloud connectivity solution for a retail company. The company requires a secure connection for lower-bandwidth workloads, and a separate dedicated, high-speed connection for production database synchronization. Which two of the following statements correctly describe the Azure hybrid networking options for these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A Site-to-Site VPN gateway sends encrypted traffic over the public internet, making it suitable for lower-bandwidth hybrid connectivity.; Azure ExpressRoute provides a dedicated, private connection to Azure resources without routing traffic over the public internet.

Cevap

A Site-to-Site VPN gateway sends encrypted traffic over the public internet, and Azure ExpressRoute provides a dedicated, private connection to Azure resources without routing traffic over the public internet.
The correct options are the statements describing that a Site-to-Site VPN gateway sends encrypted traffic over the public internet, and that Azure ExpressRoute provides a dedicated, private connection to Azure resources without routing traffic over the public internet. These are standard features of Azure hybrid connectivity services.

Adım Adım Çözüm

1
Analyze the requirements for lower-bandwidth and dedicated high-speed connections.
Identify that the lower-bandwidth requirement aligns with VPN Gateway, and the dedicated high-speed requirement aligns with ExpressRoute.
This helps filter the correct service characteristics.
2
Evaluate the connectivity path for both services.
VPN Gateway routes encrypted traffic over the public internet, while ExpressRoute routes traffic over a private dedicated connection, bypassing the public internet.
This distinguishes between the public internet transit of VPN and the private transit of ExpressRoute.

Anahtar Kavram

Azure hybrid networking options, specifically the differences in internet routing and privacy between VPN Gateway and ExpressRoute.
Soru 13Soru →

A company is planning to deploy two different containerized workloads to Azure:

* Workload 1: A simple batch processing task packaged as a single container that runs once daily for 15 minutes.
* Workload 2: A complex application composed of 25 interconnected containerized microservices that require service discovery, horizontal autoscaling, and coordinated rolling updates.

The company wants to minimize both administrative effort and operational costs.

Which two Azure services should the company select to host these workloads?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Container Instances; Azure Kubernetes Service

Cevap

Azure Container Instances and Azure Kubernetes Service
Azure Container Instances is the ideal choice for running a single container for a brief period on demand, as it provides a serverless platform with no virtual machine management overhead and charges only for the execution duration. Azure Kubernetes Service is the correct choice for hosting a large, multi-container microservices application because it provides the required orchestration features, such as automated service discovery, rolling updates, and scale management, while still being a managed service that minimizes infrastructure administration compared to self-managed Kubernetes.

Adım Adım Çözüm

1
Analyze the requirements for Workload 1.
Workload 1 is a single container running for only 15 minutes daily. This is a short-lived, task-based workload that does not require container orchestration. Azure Container Instances is the most cost-effective and low-overhead service for this case.
It runs containers on-demand with per-second billing and zero infrastructure management.
2
Analyze the requirements for Workload 2.
Workload 2 consists of 25 interconnected microservices requiring container orchestration capabilities such as service discovery, load balancing, autoscaling, and coordinated rollouts. Azure Kubernetes Service is the native managed orchestrator in Azure.
It provides full Kubernetes orchestration while reducing management overhead compared to self-managed Kubernetes deployments.
3
Evaluate the distractors against the goal to minimize management effort and operational costs.
Azure Virtual Machines increase administrative effort due to OS patching, and Azure App Service does not natively support complex multi-container orchestration with service discovery for 25 microservices.
This rules out the incorrect options.

Anahtar Kavram

Azure container hosting services comparison
Tahmini Süre:1m 30s
Soru 14Soru →

An administrator assigns User1 the Reader role at the subscription scope. Within this subscription, there is a resource group named Dev-RG. The administrator assigns User2 the Contributor role at the scope of Dev-RG. Which of the following statements about their inherited permissions are correct? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: User1 can view all resources within the subscription, including those inside Dev-RG.; User2 can create and delete resources within Dev-RG, but cannot grant other users access to the resource group.

Cevap

The correct statements are that User1 can view all resources within the subscription, and User2 can manage resources within Dev-RG without being able to grant access to others.
The correct statements are that the user with the Reader role at the subscription scope can view all resources in the subscription, and the user with the Contributor role at the resource group scope can create and delete resources within that resource group. Reader permissions inherit downwards from the subscription to all resource groups. The Contributor role grants full resource management rights but does not permit role assignments.

Adım Adım Çözüm

1
Evaluate the permissions and scope of User1.
User1 is assigned the Reader role at the subscription level. Due to hierarchical inheritance, this permission flows down to all resource groups (like Dev-RG) and resources within the subscription, permitting read-only access to all of them.
To determine what resources User1 can access and what actions they can perform.
2
Evaluate the permissions and scope of User2.
User2 is assigned the Contributor role at the Dev-RG resource group level. This allows User2 to create, manage, and delete resources within Dev-RG, but they cannot assign permissions to others because the Contributor role lacks authorization write privileges.
To determine the capabilities of User2 within their assigned resource group scope.
3
Evaluate the incorrect options regarding nesting and policy enforcement.
Azure does not support nesting resource groups, so nested group creation is invalid. Enforcing configuration compliance is managed by Azure Policy rather than Azure RBAC.
To rule out the distractors by identifying resource group hierarchy limits and the boundary between RBAC and Azure Policy.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) inheritance and scope boundaries, and its distinction from Azure Policy.
Soru 15Soru →

An administrator is configuring access and governance for an Azure subscription. The administrator needs to determine whether to use Azure Role-Based Access Control (RBAC) or Azure Policy for different requirements.

Which of the following scenarios are best addressed by using Azure RBAC? (Select two correct options.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Allowing a database administrator to manage SQL databases but not the virtual machines that host them.; Allowing an external auditor to view the configuration settings of all resources in a resource group without making changes.

Cevap

Azure RBAC is best suited for allowing a database administrator to manage SQL databases but not virtual machines, and allowing an external auditor to view resource configurations without making changes.
Azure RBAC is designed for user access management. Allowing a database administrator to manage SQL databases and allowing an auditor to view resource configurations are access-control permissions managed through RBAC roles (such as SQL DB Contributor and Reader).

Adım Adım Çözüm

1
Analyze the purpose of Azure RBAC.
Azure RBAC focuses on user access management, specifying who (user, group, service principal) has what access (Owner, Contributor, Reader) to which resources.
This establishes the boundary of Azure RBAC capabilities.
2
Analyze the purpose of Azure Policy.
Azure Policy focuses on resource properties and compliance, ensuring that deployed resources adhere to organizational standards (e.g., tags, allowed regions, VM sizes).
This distinguishes Azure Policy from Azure RBAC.
3
Evaluate the scenarios against the capabilities of each tool.
Managing SQL databases (a permissions action) and viewing resource configurations (a read permission) are user access scenarios managed by Azure RBAC. Requiring tags and restricting VM sizes are resource property constraints managed by Azure Policy.
This identifies the correct options.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) vs Azure Policy
Soru 16Soru →

An organization is planning to migrate two application workloads to Azure with the following requirements:

* Workload 1: A containerized event-driven task that runs periodically for less than ten minutes. It must execute immediately upon triggering without requiring the setup or billing of virtual servers when idle.
* Workload 2: A web application hosting multiple containers that share a common lifecycle. It requires built-in deployment slots and automated operating system patching managed entirely by Microsoft.

Which Azure services should you recommend to support these workloads? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Container Instances for Workload 1; Azure App Service for Workload 2

Cevap

The correct recommendations are Azure Container Instances for Workload 1 and Azure App Service for Workload 2.
Azure Container Instances is the correct recommendation for Workload 1 because it provides a serverless container environment that spins up instantly and bills only for the duration of execution. Azure App Service is the correct recommendation for Workload 2 because it is a platform-as-a-service (PaaS) offering that automates operating system patching and includes built-in deployment slots.

Adım Adım Çözüm

1
Analyze the requirements for Workload 1.
Workload 1 is an event-driven container running for less than ten minutes that needs to execute immediately without server management or idle costs.
Azure Container Instances (ACI) is a serverless container hosting service that fits this pattern perfectly by scaling to zero and running containers without VM provisioning.
2
Analyze the requirements for Workload 2.
Workload 2 is a multi-container web application needing deployment slots and automated OS patching managed by Microsoft.
Azure App Service is a PaaS hosting option that automatically manages OS patching, supports multi-container groups sharing a lifecycle, and features native deployment slots.
3
Evaluate the remaining options against the workloads.
Azure Kubernetes Service (AKS) adds complex orchestration management overhead, while Azure Virtual Machines (IaaS) requires manual OS patching and costs money even when idle.
Both AKS and Virtual Machines fail to meet the constraints of minimal operational overhead and automated OS management without idle billing.

Anahtar Kavram

Selecting appropriate Azure compute services (ACI, AKS, and App Service) based on operational overhead, orchestration needs, and billing models.
Tahmini Süre:2m 0s
Soru 17Soru →

An administrator needs to configure permissions and governance rules for an Azure resource group named RG1. The configuration must meet the following requirements:
- A user named Alex must be able to start, stop, and configure virtual machines in RG1, but must be prevented from granting access to other users.
- Only virtual machine resources can be deployed in RG1; all other resource types must be blocked, regardless of any user's permissions.

Which two actions should you perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the Contributor role to Alex for RG1.; Create and assign an Azure Policy to RG1 that restricts the allowed resource types to virtual machines.

Cevap

Assign the Contributor role to the user for the resource group, and create and assign an Azure Policy definition to the resource group that restricts allowed resource types.
Assigning the Contributor role ensures the user has full rights to manage virtual machines but cannot delegate permissions to others. Assigning an Azure Policy ensures that only virtual machines can be deployed, enforcing compliance regardless of any user's access level.

Adım Adım Çözüm

1
Evaluate the access requirements for managing virtual machines without access delegation.
Identify that the Contributor role grants full permissions to manage resources (like starting and stopping VMs) but prevents the user from managing access permissions.
Unlike the Owner role, the Contributor role does not grant User Access Administrator permissions.
2
Evaluate the governance requirement to restrict the types of resources that can be deployed.
Determine that Azure Policy is the correct tool to enforce compliance rules (such as allowed resource types) across a scope.
Azure RBAC only controls user permissions, whereas Azure Policy controls resource properties and compliance rules regardless of user permissions.
3
Assess the applicability of resource locks.
Determine that a ReadOnly lock is inappropriate because it blocks all administrative modification and control actions.
ReadOnly locks block virtual machine management operations such as starting or stopping the machines.

Anahtar Kavram

Azure RBAC vs Azure Policy, Contributor Role, and Resource Locks
Tahmini Süre:2m 0s
Soru 18Soru →

A healthcare provider has virtual machines and Kubernetes clusters hosted on-premises and in a third-party public cloud. The provider wants to use Azure Arc to simplify management. Which of the following capabilities are provided by Azure Arc for these external resources? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforcing compliance guidelines across on-premises and third-party cloud servers using Azure Policy; Consolidating logging and performance tracking for non-Azure virtual machines within Azure Monitor

Cevap

The correct options are: enforcing compliance guidelines across on-premises and third-party cloud servers using Azure Policy, and consolidating logging and performance tracking for non-Azure virtual machines within Azure Monitor.
Azure Arc acts as a bridge that projects resources outside of Azure into Azure Resource Manager. This enables administrators to apply Azure governance tools, such as Azure Policy, and monitoring tools, such as Azure Monitor, directly to on-premises and third-party cloud resources.

Adım Adım Çözüm

1
Identify the primary purpose of Azure Arc.
Azure Arc is designed to extend the Azure Resource Manager (ARM) control plane to resources located outside of Azure (on-premises, edge, and multi-cloud).
This allows administrators to manage external servers, Kubernetes clusters, and databases as if they were running inside Azure.
2
Determine which management capabilities are extended by Azure Arc to external resources.
Capabilities like Azure Policy configuration auditing and Azure Monitor logging are extended, while native Azure migration or restricting management only to Azure-native resources are incorrect.
This confirms the valid options showing governance (Azure Policy) and monitoring (Azure Monitor) capabilities.

Anahtar Kavram

Azure Arc extends Azure management, governance, and monitoring capabilities to resources hosted on-premises, at the edge, or in multi-cloud environments.
Soru 19Soru →

An organization is designing a serverless automated pipeline to process customer feedback. The pipeline must ingest customer comments from an external web portal immediately via HTTP webhooks, coordinate a multi-step workflow that passes the comment to a custom Python data-cleaning script, update a database, and conditionally send an email alert via Office 365. The custom Python script requires specialized open-source libraries. The organization wants to minimize administrative overhead and dynamically scale compute resources with zero cost when there is no traffic. Which of the following statements correctly describe how Azure Serverless services should be implemented for this architecture? (Select two)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Logic Apps should be used to coordinate the end-to-end workflow, using its designer-first interface to manage integration triggers and conditional control paths.; Azure Functions should be used to host and execute the custom Python script, running on a Consumption plan to support serverless scaling and zero-idle cost.

Cevap

The correct implementation is to use Azure Logic Apps to coordinate the workflow and Azure Functions to execute the custom Python script under a Consumption plan.
The workflow requires coordinating multiple endpoints, which is best solved using the designer-first workflow orchestration of Azure Logic Apps. The custom data-cleaning step requires running specialized Python code, which is best suited for Azure Functions under a serverless Consumption plan to allow scaling to zero and cost optimization.

Adım Adım Çözüm

1
Analyze the custom scripting requirement.
The custom Python script requires specialized libraries, pointing to Azure Functions as the code-first serverless compute option.
Azure Functions allows running custom code with custom dependencies in a serverless model.
2
Analyze the orchestration and integration requirement.
The multi-step pipeline connects SaaS tools and databases, pointing to Azure Logic Apps as the designer-first workflow orchestrator.
Azure Logic Apps provides a visual designer and out-of-the-box connectors to orchestrate service integration easily.
3
Evaluate the scaling and cost constraints.
Azure Functions on a Consumption plan satisfies the requirement to scale to zero and minimize costs when idle, unlike WebJobs which runs under App Service plans.
Consumption plans enable serverless scale-to-zero pricing, whereas standard App Service plans charge continuously for reserved compute.
4
Assess service classification.
Both Logic Apps and Functions are Platform as a Service (PaaS) offerings, not Software as a Service (SaaS).
PaaS provides the development platform for building custom logic and workflows, whereas SaaS is end-user application software.

Anahtar Kavram

Differentiating between Azure Functions (code-first serverless compute) and Azure Logic Apps (connector-first workflow orchestrator), and their respective serverless characteristics.
Soru 20Soru →

An organization is designing a hybrid network architecture to connect their on-premises office to two Azure Virtual Networks (VNets). The design must meet the following criteria:

* A primary connection with dedicated, high-speed bandwidth that does not use the public internet.
* A secondary, encrypted backup connection that is cost-effective and routes over the public internet.
* Internal, low-latency communication directly between the two Azure VNets.

Which of the following Azure networking features should the organization implement to meet these requirements? (Select three)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure ExpressRoute to establish the primary dedicated private connection; A Site-to-Site VPN Gateway to establish the encrypted backup connection over the public internet; Virtual Network (VNet) peering to enable direct, low-latency communication between the two VNets

Cevap

To meet the specified criteria, the organization should implement Azure ExpressRoute for the primary private connection, a Site-to-Site VPN Gateway for the backup internet-based connection, and Virtual Network (VNet) peering for direct VNet-to-VNet connectivity.
The correct implementation involves three distinct services: Azure ExpressRoute fulfills the primary connection requirement by offering dedicated, private bandwidth that bypasses the public internet. A Site-to-Site VPN Gateway fulfills the backup connection requirement by encrypting traffic and routing it over the public internet in a cost-effective manner. Virtual Network (VNet) peering enables direct, low-latency connection between the two VNets using the private Microsoft backbone network.

Adım Adım Çözüm

1
Analyze the primary connection requirement.
Azure ExpressRoute must be selected because the requirement specifies a dedicated, high-speed path that bypasses the public internet.
ExpressRoute establishes a private connection via a service provider directly to the Azure backbone.
2
Analyze the backup connection requirement.
A Site-to-Site VPN Gateway must be selected because the requirement specifies a cost-effective, encrypted connection routing over the public internet.
VPN Gateway encrypts traffic and routes it through the public internet, which is less expensive than ExpressRoute.
3
Analyze the VNet-to-VNet communication requirement.
Virtual Network (VNet) peering must be selected to allow direct, low-latency communication.
VNet peering routes traffic through Microsoft's private network without traversing the on-premises datacenter or the public internet.

Anahtar Kavram

Azure hybrid networking components (ExpressRoute, VPN Gateway, and VNet peering) and their transmission medium (private backbone vs. public internet).
Sayfa 1 / 12Sonraki
Tüm alıştırma soruları — Microsoft Azure Fundamentals (AZ-900) | Examkin