Free Microsoft AZ-104 Practice Questions

Correct answer: C. Assign tags to the virtual machines.

Tags are the appropriate mechanism for associating metadata with Azure resources like VMs without restructuring the resource hierarchy. Since all VMs are already in RG1 and the company wants to maintain this structure while simply identifying which department owns each VM, tags provide a lightweight, flexible solution. Tags allow for arbitrary key-value pairs that enable categorization, billing tracking, and automation without moving resources between groups.

Why the other options are wrong

• A. Management Groups are for managing policies and access across multiple subscriptions and resource groups, not for organizing VMs within a single resource group by department.
• B. Creating a resource group per department would fragment the existing RG1 structure and contradict the stated requirement that all VMs are located in RG1.
• D. Modifying VM settings does not provide a systematic way to track and organize VMs by department for reporting or billing purposes.

Correct answer: B. No

Altering user settings on the multi-factor authentication page configures MFA authentication methods but does not create or configure a conditional access policy. Conditional access policies are specifically configured in Azure AD under the Conditional Access blade, not through the MFA user settings page. The solution addresses only MFA enablement, not the policy requirements for device compliance and location-based restrictions.

Why the other options are wrong

• A. The MFA settings page is insufficient for implementing conditional access policies, which require explicit policy configuration in the Conditional Access section of Azure AD.

Correct answer: B. No

Session controls in conditional access policies manage ongoing session behavior (such as sign-in frequency and browser session lifetime) but do not enforce MFA or device compliance requirements. Session controls are insufficient to meet the requirement of mandating MFA and Azure AD-joined devices. Grant controls are the correct setting for requiring MFA and device compliance checks during access.

Why the other options are wrong

• A. Session controls do not enforce authentication method or device requirements; they only manage active session characteristics after initial access decisions are made.

Correct answer: A. Yes

Grant controls in conditional access policies are exactly where MFA and device compliance requirements are configured. By accessing the Azure portal and modifying the grant control settings, an administrator can require that Global Administrators must satisfy both MFA and Azure AD-joined device conditions when accessing from untrusted locations. This directly addresses all stated requirements.

Why the other options are wrong

• B. Grant controls are the proper mechanism for enforcing authentication and device requirements in conditional access policies.

Correct answer: D. The az vm create command.

The az vm create command from Azure CLI is the appropriate tool for creating custom VM deployments with advanced configurations such as adding trusted root certification authorities. Azure CLI provides the flexibility needed for custom deployments and allows passing parameters for certificate configuration. PowerShell cmdlets like New-AzureRmVm and New-AzVM are less suitable for this scenario as they require more complex scripting for custom certificate installation.

Why the other options are wrong

• A. New-AzureRmVm is an older cmdlet that has been superseded and is less flexible for custom deployments.
• B. New-AzVM is a PowerShell cmdlet that requires additional scripting steps to configure custom certificates compared to CLI approaches.
• C. Create-AzVM is not a standard Azure PowerShell cmdlet; the correct cmdlet is New-AzVM.

Correct answer: B. No

The usage model for an existing Multi-Factor Authentication provider cannot be changed once it has been created and configured. The Per Authentication and Per Enabled User settings are selected at the time of MFA provider creation and are immutable through the Azure portal or any other method. To switch usage models, a new MFA provider must be created with the desired setting.

Why the other options are wrong

• A. Usage models cannot be reconfigured on existing MFA providers; they are set during creation and cannot be modified afterward.

Correct answer: B. No

Similar to Question 6, the usage model for Multi-Factor Authentication cannot be reconfigured after the provider is created, regardless of whether the attempt is made via the Azure portal or Azure CLI. The usage model is a fundamental property set at creation time and is immutable. CLI commands do not provide the capability to alter this configuration.

Why the other options are wrong

• A. Azure CLI does not provide the ability to change an MFA provider's usage model; this is a fixed property from creation.

Correct answer: B. No

Creating a new Multi-Factor Authentication provider with a backup from existing data does not change the usage model of the original configuration. While a new provider could be created with the desired Per Enabled User setting, this approach creates duplicate infrastructure and does not actually migrate or consolidate the existing configuration. Additionally, MFA provider data backups and restoration are not straightforward processes for usage model migration.

Why the other options are wrong

• A. Creating a new MFA provider does not automatically solve the usage model problem; it would require careful configuration and does not properly address the need to consolidate existing users into the new model.

Correct answer: B. No

The Start-ADSyncSyncCycle -PolicyType Initial cmdlet performs a full synchronization cycle, but it does not force an immediate sync of newly created user accounts. The -PolicyType Initial parameter is used for initial full sync scenarios, not for immediate replication of new objects. To replicate a user immediately in Azure AD Connect (the successor to DirSync), you would need to use Start-ADSyncSyncCycle -PolicyType Delta or manually trigger a sync through the UI, not the Initial policy type.

Why the other options are wrong

• A. The Initial policy type does not provide immediate replication of new user objects to Azure AD.

Correct answer: B. No

Using Active Directory Sites and Services to force replication of the Global Catalog on a domain controller only replicates data within the on-premises Active Directory environment. It does not trigger synchronization from on-premises AD to Azure AD. The DirSync/Azure AD Connect service is a separate synchronization mechanism that has its own schedule and must be triggered separately to replicate objects to Azure AD.

Why the other options are wrong

• A. Active Directory Sites and Services only handles on-premises AD replication, not Azure AD synchronization.

Correct answer: A, C. a Microsoft 365 group that uses the Assigned membership type; a Microsoft 365 group that uses the Dynamic User membership type

To grant temporary access to a SharePoint library with automatic group deletion after 180 days, you should create a Microsoft 365 group with Assigned membership (option A) to manage the three specific users. Additionally, you can create a Microsoft 365 group with Dynamic User membership (option C) to complement this approach. Microsoft 365 groups support expiration policies that automatically delete the group after a specified period. Security groups do not support automatic expiration policies, and Dynamic Device membership is irrelevant for granting user access to a document library.

Why the other options are wrong

• B. Security groups with Assigned membership do not support automatic expiration.
• D. Security groups do not have auto-expiration capabilities.
• E. Dynamic Device membership is for device-based policies, not user access management.

Correct answer: B. You can recover the files to any VM within the company's subscription.

With Azure Backup Instant Restore, files can be recovered to any VM within the company's subscription, not just the infected VM or a new VM. The Instant Restore feature provides the flexibility to mount the recovery point and browse/copy files to any accessible location, including any VM in the subscription. This allows for flexible recovery scenarios beyond just the original VM.

Why the other options are wrong

• A. Files can be recovered to VMs other than the infected one, providing recovery flexibility.
• C. A new VM is not required; files can be recovered to any existing VM in the subscription.
• D. Files can definitely be recovered when using Azure Backup Instant Restore, even from ransomware-infected VMs if backups were taken before infection.

Correct answer: C. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

To assign policies at the tenant root management group level, a user must have the Global Administrator role in Azure AD and must explicitly enable access management for Azure resources. The Global Administrator role provides the necessary permissions across all management groups, and configuring access management for Azure resources grants the required authorization at the root level.

Why the other options are wrong

• A. Subscription-level Owner role does not grant permissions at the management group level; conditional access policies are unrelated.
• B. Subscription-level Owner role is insufficient for root management group policy assignment.
• D. Creating a new management group and delegating ownership does not provide access to the tenant root management group.

Correct answer: D. Modify the NS records in the DNS domain registrar.

To make records in the Azure DNS zone resolvable from the internet, you must update the NS (Name Server) records at your DNS domain registrar to point to the Azure DNS nameservers. The registrar holds the authoritative delegation information that directs internet traffic to your Azure DNS zone. Simply creating records within the Azure zone is not sufficient; the registrar must know where to find the zone.

Why the other options are wrong

• A. NS records are created automatically in Azure DNS; you cannot create additional ones manually.
• B. The SOA record at the registrar is not what enables zone resolution; the NS records are.
• C. SOA records are automatically created in Azure DNS and do not affect internet resolution.

Correct answer: A. Azure File Storage

Azure Import/Export jobs support importing data into Azure File Storage (Azure Files/File Shares) as a valid destination. The service is designed for bulk data transfer and supports Azure File Storage alongside Blob Storage for import destinations, allowing organizations to efficiently transfer large datasets.

Why the other options are wrong

• B. Azure Cosmos DB is not a supported destination for Import/Export jobs.
• C. Azure Data Factory is a data integration service, not a destination for import operations.
• D. Azure SQL Database cannot be directly populated using Import/Export jobs.

Correct answer: B. No

The problem is that point-to-site VPN clients cannot reach peered networks without proper configuration. Setting 'Allow gateway transit' on VirtualNetworkA (which has the gateway) doesn't solve the issue because gateway transit must be explicitly enabled on the peering connection itself, and the point-to-site VPN client routes must be updated to include VirtualNetworkB's address space. Simply enabling gateway transit on one side of the peering is insufficient; the VPN client configuration package must be downloaded again to receive updated route tables.

Correct answer: B. container1

Azure Import/Export jobs are used to transfer large amounts of data to and from Azure Blob Storage. The service supports exporting data from Blob containers specifically. Container1 is a Blob container and is therefore the only resource type that can be exported using an Azure Import/Export job. The other resources (SQL database DB1, Azure Files share share1, and Azure Table Table1) are not supported data sources for Export/Import jobs, which are designed specifically for Blob Storage operations.

Why the other options are wrong

• A. DB1 is a SQL database, which cannot be exported using Azure Import/Export jobs as they only support Blob Storage.
• C. share1 is an Azure Files share, which cannot be exported using Azure Import/Export jobs; these jobs are specific to Blob containers.
• D. Table1 is an Azure Table, which is not a supported source for Azure Import/Export jobs designed for Blob Storage data transfer.

Correct answer: A, D. Upload a configuration script; Modify the extensionProfile section of the Azure Resource Manager template

To automate web server component installation on scale set VMs, you must upload a configuration script (such as a PowerShell DSC script or custom script) that executes during provisioning, and modify the extensionProfile section of the ARM template to reference and execute this script. This ensures web server components are installed automatically when each VM is provisioned.

Why the other options are wrong

• B. An Automation account is used for runbooks and update management, not for provisioning-time script execution on scale sets.
• C. Azure Policy is for governance and compliance, not for installing software during VM provisioning.
• E. Manual portal creation does not automate the deployment; automation requires ARM template modification and scripts.

Correct answer: B. a shared access signature (SAS)

A Shared Access Signature (SAS) is the correct choice because it provides granular access control that can be configured for read-only access, supports both HTTP and HTTPS protocols, and can be scoped to apply permissions to all content in a container. SAS tokens offer time-limited, delegated access with specific permissions.

Why the other options are wrong

• A. An access policy manages stored access policies for containers but doesn't directly provide the protocol flexibility and read-only restriction as elegantly as SAS.
• C. Azure CDN is for content delivery and caching, not for managing direct access permissions to container contents.
• D. Access keys grant full administrative access to the entire storage account, not read-only access to a specific container.

Correct answer: C. Configure a Point-to-Site (P2S) VPN.

Point-to-Site (P2S) VPN is the correct solution for remote workers who need to access resources in a single Azure virtual network. P2S VPNs establish secure connections from individual client computers to Azure, making it ideal for remote workers. Site-to-Site (S2S) VPN connects two networks together, VNet-to-VNet connects multiple virtual networks, Multi-Site connects multiple on-premises locations, and DirectAccess is for on-premises Windows domain environments.

Why the other options are wrong

• A. Site-to-Site VPN is used to connect entire on-premises networks to Azure, not individual remote workers.
• B. VNet-to-VNet VPN connects multiple Azure virtual networks together, not remote individual users.
• D. DirectAccess is a Windows Server feature for on-premises domain-joined computers, not Azure cloud connectivity.
• E. Multi-Site VPN connects multiple on-premises sites to Azure, not individual remote workers.

Correct answer: C. Deploy the IT Service Management Connector (ITSM)

To create alerts in an on-premises Service Manager when Azure VM conditions are met, you must first deploy the IT Service Management Connector (ITSM). This connector establishes the bridge between Azure Monitor alerts and Service Manager, allowing alerts to be triggered in the on-premises system.

Why the other options are wrong

• A. Creating an automation runbook alone does not establish the connection to Service Manager; the ITSM Connector is the prerequisite.
• B. A function app is not the correct tool for integrating with Service Manager.
• D. Creating a notification in Azure is not sufficient without the ITSM Connector to forward alerts to Service Manager.

Correct answer: A. a role assignment condition

A role assignment condition allows you to restrict access to blobs based on blob index tags. This is the Azure RBAC feature that enables attribute-based access control (ABAC) for Azure Storage, allowing users to view only specific blobs that match the conditions defined in their role assignments based on blob index tags.

Why the other options are wrong

• B. Stored access policies are used for shared access signatures but do not provide tag-based filtering.
• C. JIT VM access is for managing virtual machine access, not blob access.
• D. While SAS can restrict access, it does not natively support blob index tag-based filtering in the way RBAC conditions do.

Correct answer: C. 445

Azure File Shares use the SMB (Server Message Block) protocol, which operates on port 445. This port must be open in outbound firewall rules on client computers to enable mapping and accessing Azure file shares from Windows 10 machines. SMB is the standard protocol for network file sharing in Windows environments.

Why the other options are wrong

• A. Port 80 is used for HTTP web traffic, not file sharing.
• B. Port 443 is used for HTTPS web traffic and some REST APIs, not SMB file sharing.
• D. Port 3389 is used for Remote Desktop Protocol (RDP), not file sharing.

Correct answer: B. No

User3 is a User administrator with scope limited to Azure Active Directory (the contoso.onmicrosoft.com tenant). When User1 creates a new Azure AD tenant named external.contoso.onmicrosoft.com, User3's administrative permissions do not automatically transfer to this new tenant. User3 would need to be explicitly assigned administrative roles in the external.contoso.onmicrosoft.com tenant to create user accounts there. Since User3's current permissions are scoped only to the original Azure AD tenant, instructing User3 to create accounts in the new tenant would not work without first granting User3 the appropriate role in that new tenant.

Why the other options are wrong

• A. User3's administrative scope is limited to the original Azure Active Directory tenant and does not extend to the newly created external tenant.

Correct answer: B. Event | search "error"

The correct syntax for querying an Azure Log Analytics workspace uses Kusto Query Language (KQL). The query 'Event | search "error"' uses the pipe operator to pass the Event table to the search operator, which filters for records containing 'error'. This is the proper KQL syntax. Options A and C use PowerShell and SQL syntax respectively, which are not valid in Log Analytics. Option D has incorrect comparison operator syntax.

Why the other options are wrong

• A. Get-Event and PowerShell syntax are not used in Log Analytics queries.
• C. SQL SELECT syntax is not valid in Log Analytics; KQL is required.
• D. The comparison operator syntax is incorrect for KQL; should use '==' or other valid KQL operators.

Correct answer: B. No

Update Management is used to manage OS patches and updates for VMs, not to migrate them to different hosts. Enabling Update Management does not move a VM to a different physical host. The Redeploy function is the appropriate tool for host migration during maintenance.

Why the other options are wrong

• A. Update Management handles patching schedules and compliance, not physical host migration.

Correct answer: B. The user principal name of each user only

For bulk delete operations in Azure AD, the required attribute is the user principal name (UPN) of each user only. This is the unique identifier that Azure AD uses to identify users in the tenant. While other attributes like display name or usage location may be useful for identification purposes, only the UPN is required and sufficient for the bulk delete operation.

Why the other options are wrong

• A. Usage location is not required for bulk delete; only UPN is mandatory.
• C. Display name alone is not sufficient as it may not be unique; UPN is required.
• D. Usage location is not required for bulk delete operations.
• E. While display name provides context, only UPN is actually required for the bulk delete.

Correct answer: C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public -- recursive

The azcopy copy command with the --recursive flag is the correct tool for copying the contents of a local folder to an Azure blob container. This command recursively copies all files and subdirectories from D:\folder1 to the public container in the Azure Storage account. The syntax is correct and matches the standard AzCopy usage pattern for uploading local data to blob storage.

Why the other options are wrong

• A. This is just a URL and not a command that can be executed.
• B. The azcopy sync command is used for synchronizing data, not for initial bulk copies, and the --snapshot flag is not the appropriate flag for this operation.
• D. The az storage blob copy start-batch command does not exist; the correct Azure CLI command would be different and less efficient than AzCopy for this scenario.

Correct answer: B. Azure File Storage

Azure Import/Export jobs support importing data to Azure File Storage (Azure Files). This is one of the supported destinations along with Azure Blob Storage. Azure Files allows organizations to set up managed file shares that can be accessed over SMB protocol.

Why the other options are wrong

• A. Azure Data Lake Store is not a supported destination for Import/Export jobs.
• C. Azure SQL Database cannot be used as a destination for Import/Export jobs.
• D. The Azure File Sync Storage Sync Service is not a valid destination for Import/Export.

Correct answer: B. one App Service plan

To minimize costs when deploying 10 web apps, you should use one App Service plan shared across all 10 web apps. An App Service plan defines the compute resources, and multiple web apps can share the same plan, reducing costs significantly compared to dedicated plans for each app.

Why the other options are wrong

• A. Application Gateways are load balancers for traffic routing and are unnecessary for this deployment.
• C. Creating 10 App Service plans would maximize costs instead of minimizing them.
• D. Azure Traffic Manager is for global load balancing and would add unnecessary cost.
• E. A single Application Gateway is unnecessary and would increase costs without providing value for web app deployment.

Correct answer: C. You should restore the VM to a new Azure VM.

When restoring a VM infected with ransomware, you must restore to a new Azure VM rather than overwriting the original infected VM. This ensures the malware is not carried forward and allows for a clean recovery. Deleting the infected VM first (option A) is unnecessary since restoration creates a new instance anyway. Restoring to any existing VM (option B) risks infecting other systems. Restoring to on-premises (option D) is not a capability of Azure Backup Instant Restore for Azure VMs.

Why the other options are wrong

• A. Deletion is not required; the restore operation itself creates a new VM instance.
• B. Restoring to an existing VM would overwrite it and potentially spread the infection.
• D. Azure Backup cannot restore Azure VMs to on-premises Windows devices.

Correct answer: D. Assign User1 the User Access Administrator role for VNet1.

User1 needs the User Access Administrator role at the VNet1 scope to assign the Reader role to other users for that specific resource. This role grants permission to manage role assignments without requiring broader permissions. Assigning it at the VNet1 level ensures User1 can delegate the Reader role for that virtual network.

Why the other options are wrong

• A. Assigning Contributor at subscription level is unnecessarily broad and not the most targeted solution.
• B. Network Contributor role does not grant role assignment permissions, and this approach is not focused on VNet1.
• C. Network Contributor does not include permission to assign roles to other users.

Correct answer: B. Assign Group1 the User Access Administrator role for the root management group.

The User Access Administrator role at the root management group level allows Group1 to manage role assignments across all current and future subscriptions while following the principle of least privilege. This role specifically enables RBAC management without granting full administrative capabilities like Owner, and it automatically applies to planned subscriptions.

Why the other options are wrong

• A. Owner role grants excessive permissions beyond what is needed for role assignment management, violating least privilege.
• C. Creating a new management group would require moving subscriptions to it, adding complexity; using root management group minimizes administrative effort.
• D. Creating a new management group with Owner role adds unnecessary complexity and grants excess permissions beyond role assignment management needs.

Correct answer: D. an Azure key vault

Azure Key Vault provides managed storage account features that enable automatic rotation of storage account access keys. Key Vault can manage the lifecycle of storage keys and rotate them automatically on a configured schedule, ensuring security best practices are maintained without manual intervention.

Why the other options are wrong

• A. Backup vaults are used for data backup and recovery, not for key rotation management.
• B. Redundancy configuration does not address key rotation requirements.
• C. Lifecycle management handles blob storage retention policies, not access key rotation.
• E. Recovery Services vaults are designed for backup and disaster recovery, not for key rotation management.

Correct answer: D. Max Value

The platformFaultDomainCount property defines how many fault domains an availability set uses. Setting this to the maximum value (3 in Azure) ensures that VMs are distributed across the maximum number of independent hardware failure domains. This maximizes availability because a single hardware failure will impact the fewest VMs. A higher fault domain count means better isolation from fabric failures.

Why the other options are wrong

• A. 10 exceeds Azure's maximum fault domain count of 3.
• B. 30 exceeds Azure's maximum fault domain count of 3.
• C. Minimum value would concentrate VMs on fewer fault domains, reducing fault tolerance.

Correct answer: A. Yes

The Owner role at the subscription level grants full permissions to manage all resources within the subscription, including the ability to enable Traffic Analytics. Owner is a highly privileged role that includes all necessary permissions for this task. Since Traffic Analytics is a subscription-level feature, assigning Owner at the subscription level meets the requirement.

Correct answer: B. No

An HTTP health probe on port 1433 does not meet the goal. SQL Server Always On uses port 1433 for database connections, but health probes for availability group listeners should use TCP probes on the listener port, not HTTP probes. HTTP probes are application-level checks inappropriate for SQL Server availability groups, which require direct TCP connectivity to verify instance health.

Why the other options are wrong

• A. HTTP probes are not suitable for SQL Server Always On listeners; TCP probes on the correct port are required.

Correct answer: B, D. the az aks command; the Azure portal

Cluster autoscaler for AKS can be configured using the Azure portal (GUI interface) and the 'az aks' command-line tool. The Azure portal provides a UI to enable autoscaling, and the az aks command allows programmatic configuration of autoscaling parameters for the cluster.

Why the other options are wrong

• A. kubectl is for managing workloads within Kubernetes, not configuring cluster autoscaler settings.
• C. Set-AzVm cmdlet is for managing virtual machines, not AKS cluster autoscaling.
• E. Set-AzAks cmdlet does not exist; the correct command is 'az aks' in the Azure CLI.

Correct answer: B. No

The Logic App Operator role allows users to read, enable, and disable logic apps, but does not grant the ability to create new logic apps. To create logic apps, users need the Contributor or Logic App Contributor role, which provides full management capabilities including creation of new resources.

Why the other options are wrong

• A. Logic App Operator only permits reading and managing existing logic apps, not creating new ones.

Correct answer: B. Remove the resource lock from VNET1 and delete all data in Vault1

To delete a resource group in Azure, you must first remove any blocking elements. VNET1 has a Delete resource lock that prevents deletion of the resource group. Additionally, Vault1 contains backup data for VM1, and Azure Recovery Services Vaults cannot be deleted while they contain backup data. Therefore, you must remove the resource lock from VNET1 and delete all data in Vault1 before the resource group can be successfully deleted. Turning off VM1 is not a prerequisite for deletion, nor is modifying backup configurations.

Why the other options are wrong

• A. Modifying backup configurations alone does not remove the backup data from Vault1, and the Delete lock on VNET1 must be removed entirely, not just modified.
• C. Turning off VM1 is unnecessary for resource group deletion; the Delete lock on VNET1 must be removed, but backup data in Vault1 must also be deleted.
• D. Turning off VM1 is not a prerequisite for deletion; the Delete resource lock on VNET1 must be removed before the resource group can be deleted.

Correct answer: B. Assign User1 the User Access Administrator role for VNet1.

The User Access Administrator role at the VNet1 scope is the correct answer for allowing User1 to assign roles to other users with minimum necessary permissions. This role specifically handles role assignment operations without granting broader resource management permissions, adhering to the principle of least privilege.

Why the other options are wrong

• A. Removing Security Reader and assigning Contributor at RG1 is overly broad and grants excessive unrelated permissions.
• C. Simply removing roles without assigning appropriate permissions does not enable the required functionality.
• D. Contributor role does not include the ability to assign roles to other users.

Correct answer: A. Yes

Enabling Floating IP does meet the goal for configuring an Azure internal load balancer as a listener for SQL Server Always On availability groups. Floating IP (Direct Server Return) is a critical requirement for SQL Server Always On listeners because it allows the load balancer to route traffic directly to the backend VM with the same IP address and port that the client connected to, which is essential for the listener's functionality.

Why the other options are wrong

• B. Floating IP is specifically required and essential for SQL Server Always On listener configuration.

Correct answer: B. Read-only geo-redundant storage

Read-access geo-redundant storage (RA-GRS) replicates data three times in the primary region and asynchronously to a paired region far away. Unlike plain GRS, it also allows data to be read from the secondary region at any time. That meets all three requirements, including reads from both locations.

Why the other options are wrong

• A. Plain GRS replicates to a secondary region but does not allow reads from it unless a failover occurs.
• C. Zone-redundant storage keeps data within a single region, so it does not provide separate geographic locations.
• D. Locally redundant storage keeps all copies in one datacenter, so it offers no geographic separation.

Correct answer: B. No

New-MgUser cmdlet creates regular users in Azure AD, not guest users. To create guest user accounts, the New-MgInvitation cmdlet must be used instead, as it specifically handles guest user invitations and account creation. Using New-MgUser would create internal users, not guest accounts.

Why the other options are wrong

• A. This answer is incorrect because New-MgUser does not create guest users.

Correct answer: A. Yes

The New-AzureADMSInvitation cmdlet is the correct PowerShell command for creating guest user accounts in Azure AD. When executed for each external user from the CSV file, it will generate proper guest account invitations and send invitation emails to the external users. This cmdlet properly initializes the guest user type and manages the invitation workflow, making it the correct solution for bulk guest account creation.

Why the other options are wrong

• B. New-AzureADMSInvitation is specifically designed for creating guest accounts.

Correct answer: B. No

The Storage Account Encryption Scope Contributor role is specifically for managing encryption scopes and does not grant permissions to list or regenerate storage account keys. To enable a user to list and regenerate storage account keys, you need the Storage Account Key Operator Service Role or a role with the Microsoft.Storage/storageAccounts/listkeys/action permission.

Why the other options are wrong

• A. The Storage Account Encryption Scope Contributor role does not provide permissions for key management operations.

Correct answer: E. Upgrade the SKU.

Geo-replication is only available in Premium SKU container registries. Since ContReg1 is Standard SKU, it must first be upgraded to Premium SKU (E) before geo-replication can be enabled. This is a prerequisite requirement.

Why the other options are wrong

• A. Enabling Admin user does not enable geo-replication capability.
• B. Adding a scope map is for managing access tokens, not for geo-replication.
• C. Adding an automation task does not enable geo-replication functionality.
• D. Cache rules are for registry content caching, not for geo-replication.

Correct answer: B. an access policy

To prevent new content added to a container from being modified for a specified period, you need to configure an access policy with immutability settings. Azure Storage supports time-based retention policies that lock blobs in a write-once-read-many (WORM) state, preventing any modifications for the specified duration (one year in this case).

Why the other options are wrong

• A. The access tier (hot, cool, archive) controls pricing and performance, not immutability.
• C. Access control (IAM) manages who can access resources, not whether content can be modified after creation.
• D. The access level (public/private) controls visibility, not modification restrictions.

Correct answer: E. Run the Set-AzureStaticVNetIP PowerShell cmdlet.

The Set-AzureStaticVNetIP PowerShell cmdlet is the correct method to configure static internal IP addresses for Azure VMs. This cmdlet specifically assigns static private IP addresses to virtual machines within a virtual network. New-AzureRMVMConfig creates VM configurations but doesn't assign static IPs, Set-AzureSubnet manages subnets not IPs, the Azure Portal doesn't have direct static IP assignment for existing VMs in this context, and Windows Network settings only configure the guest OS network adapter without reserving the IP at the Azure platform level.

Why the other options are wrong

• A. New-AzureRMVMConfig creates VM configurations but does not assign static IP addresses.
• B. Set-AzureSubnet configures subnet properties, not individual VM IP addresses.
• C. The Azure Management Portal requires use of PowerShell cmdlets or the newer portal interface for this task.
• D. Configuring IP properties in Windows only sets the guest OS settings; Azure must reserve the IP at the platform level.

Correct answer: B. No

Traffic Manager Contributor role is for managing Traffic Manager resources, not for enabling Traffic Analytics. Traffic Analytics is a Network Watcher feature that requires monitoring and logging permissions. The correct role would be Network Contributor or a role with permissions to enable Network Watcher diagnostics and configure flow logs, not Traffic Manager-specific permissions.

Why the other options are wrong

• A. Traffic Manager Contributor does not grant the necessary permissions to enable Traffic Analytics, which is a Network Watcher monitoring feature.

Correct answer: B. No

Accessing the Container blade shows properties and contents of the blob container itself, but does not provide access to the ARM template that was used for deployment. The blob container is just one of the deployed resources and does not contain or display the deployment template or deployment history. ARM templates are managed at the Resource Group level, not at the individual container level.

Why the other options are wrong

• A. The Container blade does not provide access to ARM templates or deployment history.

Correct answer: B. No

Simply running 'az aks' from Azure CLI is incomplete and does not deploy a YAML file. To deploy YAML to an AKS cluster, you must use kubectl commands (such as 'kubectl apply -f filename.yaml') after connecting to the cluster. The az aks command alone is insufficient for YAML deployment.

Why the other options are wrong

• A. The command as stated does not complete the deployment process for YAML files.

Correct answer: A. one virtual machine scale set that has 10 virtual machines instances

A virtual machine scale set with 10 instances ensures at least 8 VMs remain available during planned maintenance. Scale sets automatically distribute updates across update domains to minimize downtime. An Availability Set with update domains cannot guarantee the required 8 minimum instances during maintenance, and the number of instances in an Availability Set should align with domain counts, making 12 instances in a scale set unnecessarily excessive when 10 is sufficient.

Why the other options are wrong

• B. An Availability Set does not provide the automatic scaling and update domain management needed; only 3 update domains means at most 7 VMs may run concurrently during maintenance, falling short of 8.
• C. Having 10 update domains with 1 fault domain does not ensure adequate availability; Availability Sets require multiple fault domains for true high availability, and this configuration still does not guarantee 8 running VMs.
• D. While 12 instances could work, it is unnecessarily excessive; 10 instances in a scale set is the optimal solution.

Correct answer: C. Detach the data disk.

Azure supports hot-detaching a data disk from a running VM and hot-attaching it to another running VM. Detaching the disk first therefore avoids stopping either VM, which keeps downtime to a minimum.

Why the other options are wrong

• A. Stopping the source VM is unnecessary because data disks can be detached while the VM is running.
• B. Stopping the target VM is unnecessary because data disks can be attached while the VM is running.
• D. Deleting the source VM is destructive and not required to move a data disk.

Correct answer: B. No

Clicking 'Programmatic deployment' from the Subscriptions blade does not show resource creation dates and times. To view when resources in RG1 were created, you need to access the resource group's Deployments blade or view individual resource properties, which show creation timestamps and deployment history.

Why the other options are wrong

• A. Programmatic deployment is for viewing deployment templates and code, not resource creation dates.

Correct answer: B. 20

The platformUpdateDomainCount property defines how many update domains an availability set uses. In Azure, the maximum value for update domains is 20. Setting this to 20 ensures that during planned maintenance, Azure spreads updates across the maximum number of update domains, so fewer VMs are taken offline simultaneously. This minimizes service disruption during maintenance windows.

Why the other options are wrong

• A. 10 is less than the maximum update domain count of 20.
• C. 30 exceeds Azure's maximum update domain count of 20.
• D. 40 exceeds Azure's maximum update domain count of 20.

Correct answer: B. containers only

Encryption scopes in Azure Storage can only be used to encrypt containers (Blob Storage). File shares, tables, and queues cannot be encrypted using encryption scopes. Encryption scopes provide customer-managed key encryption specifically for blob storage containers.

Why the other options are wrong

• A. File shares cannot be encrypted using encryption scopes.
• C. File shares cannot be encrypted using encryption scopes.
• D. Tables cannot be encrypted using encryption scopes.
• E. File shares, tables, and queues cannot be encrypted using encryption scopes.
• F. File shares, tables, and queues cannot be encrypted using encryption scopes.

Correct answer: A. Azure Blob Storage

Azure Import/Export jobs are specifically designed to transfer large volumes of data into Azure Blob Storage. This is the primary and supported destination for Import/Export operations, making it the correct choice for transferring 5 TB of data.

Why the other options are wrong

• B. Azure Data Lake Store is not a supported destination for Azure Import/Export jobs.
• C. Azure SQL Database is not a supported destination for Azure Import/Export jobs.
• D. A virtual machine is not a direct supported destination for Azure Import/Export jobs.

Correct answer: A. Create a DNS record

Before adding a custom domain to a web app, you must first create a DNS record that points the custom domain to the web app's IP address or domain. This DNS configuration is the prerequisite step. You would then verify the domain ownership in Azure Portal.

Why the other options are wrong

• B. Connection strings are for database connectivity and are unrelated to custom domain setup.
• C. A certificate is needed for HTTPS/SSL but only after the domain is added and verified.
• D. There is no need to stop the web app to add a custom domain.

Correct answer: C, F. Create groups that use the Dynamic User membership type; Create a CSV file that contains user information and the appropriate attributes.

Creating a CSV file with user information and attributes allows bulk import of users efficiently. Dynamic User group membership type automatically assigns users to groups based on their attributes (such as department) defined in the CSV file. This combination minimizes administrative effort by automating the group assignment process based on user attributes specified during import, eliminating the need for manual group assignment or scripting.

Why the other options are wrong

• A. Assigned membership requires manual management of group members, which does not minimize administrative effort.
• B. ARM templates are not the appropriate tool for bulk user import with attribute-based group assignment.
• D. Writing a PowerShell script would increase administrative effort when dynamic groups can automate this task.
• E. XML files are not the standard format for Azure AD user imports; CSV is the standard format.

Correct answer: A. Performance

BlockBlobStorage account kind requires Premium performance tier, not Standard performance. Since the current configuration has Standard performance selected, you must change the Performance setting first to Premium. Only after switching to Premium performance will the BlockBlobStorage option become available for the Account kind setting.

Why the other options are wrong

• B. Replication type does not prevent selecting BlockBlobStorage; you can use ZRS with BlockBlobStorage.
• C. Access tier setting does not restrict BlockBlobStorage selection; the access tier is independent of account kind.
• D. Hierarchical namespace setting does not affect BlockBlobStorage availability; this setting is relevant for Data Lake Storage capabilities.

Correct answer: B. administrative units

Administrative units in Azure AD allow you to delegate user management permissions to local administrators for specific organizational units without granting tenant-wide permissions. Each office can have an administrative unit with its own administrator, enabling granular permission delegation across multiple locations.

Why the other options are wrong

• A. Azure AD roles apply at the tenant level and cannot be scoped to specific offices or organizational units.
• C. Access packages in entitlement management are for managing access to resources and groups, not for delegating administrative permissions.
• D. Azure roles are for managing Azure subscription resources, not for managing Azure AD users.

Correct answer: D. Create an encryption scope.

Encryption scopes allow you to configure different encryption keys for different containers within the same storage account. Before creating a container that requires a different encryption key than the default storage account key, you must first create an encryption scope that specifies the custom key to be used for that container.

Why the other options are wrong

• A. A shared access signature (SAS) is for access control and authentication, not for configuring encryption keys at the container level.
• B. Modifying the TLS version affects transport security, not data encryption at rest or per-container encryption configuration.
• C. Rotating access keys affects all containers uniformly and does not allow different keys for different containers within the same account.

Correct answer: C. Assign User1 the User Access Administrator role for VNet1.

To assign roles to other users, User1 needs the User Access Administrator role at the VNet1 scope. This role includes the ability to manage role assignments without requiring Contributor or Owner roles. The User Access Administrator role is specifically designed for delegation of access control permissions, allowing User1 to assign the Reader role to others at the VNet1 level.

Why the other options are wrong

• A. Contributor role includes resource management but the User Access Administrator role is more appropriate for role assignment delegation.
• B. Network Contributor role manages network resources but does not grant role assignment permissions.
• D. Removing existing roles and assigning Contributor at subscription level is broader than necessary and not the most precise solution.

Correct answer: A. Yes

The Logic App Contributor role grants full permissions to create, manage, and deploy Azure Logic Apps within the assigned scope. Assigning this role to the Developers group at the Dev resource group level provides them the ability to create Logic Apps without additional permissions.

Why the other options are wrong

• B. The Logic App Contributor role is the appropriate built-in role for creating and managing Logic Apps in Azure.

Correct answer: B. Assign User1 the User Access Administrator role for VNet1.

To allow User1 to assign the Reader role to other users for VNet1, User1 must have the User Access Administrator role scoped to VNet1. This role grants the ability to manage role assignments, which the current roles (Reader, Security Admin, Security Reader) do not provide.

Why the other options are wrong

• A. Removing roles would further restrict User1's permissions and prevent role assignment.
• C. Network Contributor allows network resource management but not role assignment authority.
• D. While User Access Administrator at RG1 level could work, the more precise and best-practice approach is to scope it to VNet1 specifically.

Correct answer: A. Device settings from the Devices blade

To configure a user as a local administrator on all computers joined to an Azure AD domain, you must configure Device settings from the Devices blade in Azure AD. This setting controls which users are granted administrative privileges on Azure AD-joined devices.

Why the other options are wrong

• B. The MFA Server blade is for multi-factor authentication configuration, not device administrator assignment.
• C. User settings do not control local device administrator privileges.
• D. Group settings are not the location for configuring device-level administrative access.

Correct answer: B. No

The DevTest Labs User role is designed for DevTest Labs environments specifically and does not grant permissions to create logic apps in a standard resource group. To enable the Developers group to create logic apps in the Dev resource group, they would need a role like Logic App Contributor or at minimum Contributor at the resource group level.

Why the other options are wrong

• A. DevTest Labs User role is scoped to DevTest Labs resources and does not provide the necessary permissions for logic app creation in standard resource groups.

Correct answer: B. No

While installing the Microsoft Monitoring Agent on VM1 is correct, specifying a storage account as the source for an Azure Monitor alert is incorrect. To alert on System event log errors, you need to configure Log Analytics workspace or use Azure Monitor directly to collect and alert on Windows event logs. Storage accounts with SAS tokens are not the appropriate source for event-based alerting in Azure Monitor.

Why the other options are wrong

• A. The storage account and SAS configuration is unnecessary; Azure Monitor should be configured to collect data from the agent and alert based on Log Analytics or diagnostic settings, not directly from storage accounts.

Correct answer: A, B, C, D, E. VMs that run Windows 10; VMs that run Windows Server 2012 or higher; VMs that have NOT been shut down; VMs that run Debian 8.2+; VMs that have been shut down.

Azure Backup supports a wide range of operating systems and VM states. Windows 10 and Windows Server 2012+ are both supported operating systems for Azure Backup. Linux distributions like Debian 8.2+ are also supported. Importantly, Azure Backup can backup both running VMs (option C) and shut down VMs (option E), as the backup service can access stopped VMs in the subscription. The service is flexible regarding the VM's operational state at backup time.

Correct answer: B. Azure File Storage

Azure Import/Export jobs can be used to transfer large amounts of data to Azure File Storage (Azure Files). This service is specifically designed for bulk data transfer scenarios and is a supported destination for Import/Export jobs.

Why the other options are wrong

• A. Azure Cosmos DB is not a supported destination for Azure Import/Export jobs.
• C. Azure SQL Database is not a supported destination for Azure Import/Export jobs; data must be transferred through other means.
• D. A virtual machine is not a direct destination for Azure Import/Export jobs; data would need to be transferred to storage first.

Correct answer: B. Assign User1 the Owner role for VNet1.

To assign roles to other users, User1 needs the Owner role at the resource scope (VNet1). The Owner role includes the ability to manage role-based access control (RBAC) assignments. This is the only role among the options that grants the permission to assign roles to others at a specific resource level.

Why the other options are wrong

• A. While Contributor at RG1 would allow role assignment, removing Security Reader is unnecessary and doesn't align with least privilege principles.
• C. Contributor role allows management but does not specifically grant role assignment permissions; Owner is required for RBAC management.
• D. Network Contributor is limited to network resource management and does not grant RBAC assignment permissions.

Correct answer: B. No

Restarting the NetLogon service on a domain controller does not trigger Azure AD synchronization. The NetLogon service handles authentication and domain controller communication within the on-premises AD environment. To replicate user information to Azure AD immediately, you need to restart or trigger the Azure AD Connect/DirSync synchronization service itself, not infrastructure services like NetLogon.

Why the other options are wrong

• A. Restarting NetLogon does not affect Azure AD Connect synchronization cycles.

Correct answer: B, C, E. the Cool access tire; geo-redundant storage (GRS); hierarchical namespace

To support Azure Data Lake Storage, you need the hierarchical namespace (E). To minimize costs for infrequently accessed data, use the Cool access tier (B). To automatically replicate to a secondary region, use geo-redundant storage (C). Together, these three options create a cost-optimized, geo-redundant Data Lake Storage setup.

Why the other options are wrong

• A. Zone-redundant storage (ZRS) replicates within a single region only, not to a secondary region as required.
• D. The Hot access tier is for frequently accessed data and does not minimize costs for infrequently accessed data.

Correct answer: D. From the Recovery Service vault, stop the backup of each backup item.

Before deleting a Recovery Services vault, you must stop the backup of each protected item (D). The vault cannot be deleted while it contains active backup items with ongoing protection. Deleting backup data alone is insufficient; the protection must be stopped first. Modifying disaster recovery properties or locks does not address the underlying requirement to cease protection. The backup items must have their protection stopped before vault deletion is permitted.

Why the other options are wrong

• A. Deleting backup data does not disable protection; the vault will not delete while backup items remain protected.
• B. Modifying disaster recovery properties does not stop the backup protection required for vault deletion.
• C. Modifying VM locks does not address the backup protection status that prevents vault deletion.

Correct answer: B. No

Setting Session persistence to Client IP does not meet the goal for SQL Server Always On availability group listeners. SQL Server Always On requires Floating IP (Direct Server Return) to be enabled on the load balancer rule to function properly. Session persistence settings are irrelevant to the core requirement of establishing the availability group listener, which depends on Floating IP functionality.

Why the other options are wrong

• A. Session persistence settings do not address the fundamental requirement for Floating IP in SQL Server Always On listener configuration.

Correct answer: B. No

Setting 'Allow gateway transit' on VirtualNetworkB does not solve the problem. VirtualNetworkB does not contain the VPN gateway, VirtualNetworkA does. Gateway transit settings must be configured on the network that has the gateway and its peering partner. Configuring it on VirtualNetworkB, which has no gateway, provides no benefit. The point-to-site client still lacks routes to VirtualNetworkB.

Correct answer: D, E, F. Create an Azure Storage account; Register the Microsoft.Insights resource provider; Enable Azure Network Watcher flow logs.

To record all successful and failed connection attempts to VM1, you need to: Enable Azure Network Watcher in the East US region (D) to activate network monitoring capabilities, Register the Microsoft.Insights resource provider (E) to enable logging and monitoring services, and Enable Azure Network Watcher flow logs (F) to capture network traffic and connection information. These three components work together to provide comprehensive connection logging.

Why the other options are wrong

• A. Network Watcher must be enabled, but this is handled automatically in most regions; the focus should be on flow logs and insights provider.
• B. Connection Monitor is used for monitoring connectivity to specific endpoints, not for recording all connections to the VM.
• C. MicrosoftLogAnalytics is not required; Microsoft.Insights is the correct provider for monitoring and logging.

Correct answer: A. Modify the location in the resources section to westus

The virtual machine resource has its location hard-coded as westeurope in the resources section. It does not read the location parameter or the variables section, so the region chosen at deployment and the variables section have no effect on the VM. Change the location in the resources section to westus.

Why the other options are wrong

• B. The region selected at deployment only stores the deployment metadata. The VM location comes from the resource definition, which is fixed to westeurope.
• C. The resource does not reference the location in the variables section, so changing it does not move the virtual machine.

Correct answer: B. Advisor

Azure Advisor provides personalized recommendations to optimize Azure resources, including identifying underutilized virtual machines that can be resized to lower-cost service tiers. It is specifically designed to help reduce costs and improve performance across subscriptions.

Why the other options are wrong

• A. Monitor is used for tracking metrics and logs but does not provide optimization recommendations.
• C. Metrics shows performance data but does not identify underutilization or provide recommendations.
• D. Customer insights is not a standard Azure blade for resource optimization.

Correct answer: A, C. From the Networking blade of account1, select Selected networks; From the Networking blade of account1, add the 131.107.1.0/24 IP address range.

To upload disk files from on-premises (131.107.1.0/24) and allow attachment to VM1 in VNet1, you must: (A) Select 'Selected networks' to restrict access to only approved networks, and (C) add the on-premises IP address range 131.107.1.0/24 to allow uploads from that location. Adding VNet1 is not necessary because VM1 can access storage through Microsoft's backbone without explicit VNet configuration. Service endpoints are not required here. Trusted Microsoft services applies to specific services like backup, not general VM disk attachment.

Why the other options are wrong

• B. Allowing trusted Microsoft services is not necessary for VM disk attachment and would override the network restrictions.
• D. Adding VNet1 is not required; VM1 can access the storage account through the Azure backbone even when network restrictions are in place.
• E. Service endpoints are not required to enable VM disk attachment to a storage account with network restrictions.

Correct answer: C. Assign User1 the Owner role for VNet1.

User1 needs the Owner role at the VNet1 scope to be able to assign roles to other users. The Owner role is the only built-in role that includes the action to assign roles (Microsoft.Authorization/roleAssignments/write). Currently, User1's roles (Reader, Security Admin, Security Reader) do not permit role assignments at the VNet level, so this elevated permission at the specific resource scope is necessary.

Why the other options are wrong

• A. Network Contributor does not include permissions to assign roles to other users.
• B. Removing security roles and assigning Contributor at RG1 level would grant broader permissions than needed and is not the most precise solution.
• D. Network Contributor does not include role assignment permissions.

Correct answer: B, C. Storage Blob Data Contributor; Reader

To allow Group1 members to upload files via the Azure portal with least privilege, you need: (B) Storage Blob Data Contributor, which grants permissions to read, write, and delete blobs, and (C) Reader, which allows viewing the storage account and navigating the portal interface. Reader provides the minimum permissions to access the portal, while Storage Blob Data Contributor provides the specific data operations needed for uploading. Storage Account Contributor grants too much access (account-level management), and Storage Blob Data Reader only allows reading, not uploading.

Why the other options are wrong

• A. Storage Account Contributor provides excessive permissions for account management, violating least privilege.
• D. Contributor role grants overly broad permissions across all Azure resources, not adhering to least privilege.
• E. Storage Blob Data Reader only allows reading blobs, not uploading/writing new content.

Correct answer: C. Assign User1 the Owner role for VNet1.

The Owner role at VNet1 scope grants User1 full permissions including the ability to assign roles to other users. Owner role includes all permissions that User Access Administrator has, plus full resource management capabilities. This allows User1 to assign the Reader role to other users for VNet1.

Why the other options are wrong

• A. Assigning Contributor at subscription level is broader than necessary and not the most direct solution.
• B. Contributor role includes resource management but does not explicitly grant role assignment permissions at the resource level.
• D. Network Contributor at the resource group level does not provide role assignment capabilities.

Correct answer: D. 1

The minimum number of security groups needed is 1. Since all five VMs have identical inbound and outbound security rules, a single Network Security Group (NSG) can be associated with all five VMs or their network interfaces. There is no requirement to create separate NSGs when the security requirements are identical across all resources.

Why the other options are wrong

• A. Four security groups are more than necessary when all VMs have identical rules.
• B. Three security groups are unnecessary; identical rules can all be in one NSG.
• C. Two security groups are redundant when one NSG can serve all identical rule requirements.

Correct answer: B. No

The New-AzureADUser cmdlet is used to create regular member users in Azure AD, not guest users. To create guest user accounts, you must use the New-AzureADMSInvitation cmdlet, which properly initializes guest accounts with the correct user type and sends invitation emails. Using New-AzureADUser for external users would not create proper guest accounts with the appropriate permissions and invitation workflow.

Why the other options are wrong

• A. New-AzureADUser creates internal member accounts, not guest accounts.

Correct answer: B, E. Create a new key; Select Azure Disk Encryption for volume encryption.

To prepare a Key Vault for Azure Disk Encryption using a Key Encryption Key (KEK), you must create a new key (B) to serve as the KEK that will encrypt the disk encryption keys, and enable the vault for Azure Disk Encryption for volume encryption (E) by setting the appropriate access policy. The Key Vault must be explicitly configured to allow Azure Disk Encryption to access it for encryption operations.

Why the other options are wrong

• A. Selecting Azure Virtual Machines for deployment is a general vault setting not specifically required for disk encryption preparation.
• C. Creating a secret is not necessary; disk encryption requires keys, not secrets.
• D. Configuring a key rotation policy is optional and not required for initial disk encryption setup.

Correct answer: B. No

The Reader role provides only read-only access to resources and cannot perform configuration or management tasks. Enabling Traffic Analytics requires write permissions and configuration capabilities that the Reader role does not provide. Therefore, assigning only the Reader role does not meet the goal.

Why the other options are wrong

• A. Reader role lacks the write permissions needed to enable Traffic Analytics.

Correct answer: C. You should stop all three VMs.

When a VM resize fails due to allocation constraints within an availability set, you must stop all VMs in the availability set before attempting the resize. This deallocates all compute resources and allows the Azure fabric to reallocate them with the new VM size. Stopping all three VMs ensures that the resize operation has sufficient resources and can succeed, as the reallocation can consolidate the resources needed for the resized VM.

Why the other options are wrong

• A. Stopping only one VM does not free sufficient resources for the reallocation to succeed.
• B. Stopping two VMs is insufficient; all VMs in the availability set must be stopped.
• D. Removing the VM from the availability set is unnecessary and removes the resiliency benefits; stopping all VMs is the proper solution.

Correct answer: B. a service tag

Service tags represent Azure service IP ranges and are the best choice for configuring outbound access to Azure Key Vault. The 'KeyVault' service tag automatically includes all IP addresses for the Key Vault service, reducing administrative overhead and following least privilege by allowing only the necessary service traffic. This is more efficient than managing IP ranges or application security groups.

Why the other options are wrong

• A. Application security groups require manual configuration and maintenance of VM membership, creating unnecessary administrative effort.
• C. IP address ranges are difficult to maintain, lack abstraction, and require manual updates when Microsoft changes infrastructure IPs.

Correct answer: D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.

The 'Allow recommended upper limit for shared access signature (SAS) expiry interval' setting, when enabled, displays a warning message to users when they attempt to generate a SAS token with an expiration time exceeding seven days. This is a storage account security feature designed to promote best practices. Read-only locks prevent modifications but don't warn about SAS duration. Alert rules monitor metrics but don't provide generation-time warnings. Lifecycle management rules manage blob retention, not SAS generation.

Why the other options are wrong

• A. A read-only lock prevents modifications to the storage account but does not warn about SAS expiry periods.
• B. An alert rule monitors metrics and can trigger notifications, but it does not warn during SAS generation itself.
• C. Lifecycle management rules control blob retention and deletion policies, not SAS token generation warnings.

Correct answer: A. Yes

The Bulk invite users operation in Azure AD is designed for bulk inviting users but creates them as guest users with invitation emails sent to external addresses. For creating guest accounts from a CSV file with names and email addresses, the bulk invite feature works correctly and does meet the goal of creating 500 guest user accounts in the tenant.

Correct answer: B. Azure Blob storage

Azure Import/Export jobs support importing data into Azure Blob Storage as the primary destination for large data transfers. This service is specifically designed to handle large volumes of data (such as 5 TB) by shipping physical drives to Azure data centers. Blob Storage is the only supported destination for import operations in this service.

Why the other options are wrong

• A. Azure Cosmos DB is not a supported destination for Import/Export jobs.
• C. Azure Data Lake Store is not a supported destination for Import/Export jobs.
• D. Azure File Sync Storage Sync Service is not a destination for Import/Export jobs; it synchronizes data between on-premises and Azure.

Correct answer: A. Yes

The Redeploy blade in Azure Portal provides the ability to redeploy a virtual machine to a different physical host. This operation deallocates the VM, moves it to a new host, and reallocates it. This is the correct method to move a VM to a different host immediately during planned maintenance notifications.

Why the other options are wrong

• B. Redeploy is specifically designed for this scenario and is the recommended solution.

Correct answer: C. Azure Blob storage

Azure Blob Storage is the supported destination for Azure Import/Export jobs. This service enables efficient bulk transfer of large datasets, such as the 5 TB of data described, into blob storage containers within an Azure subscription.

Why the other options are wrong

• A. Azure Cosmos DB is not a supported destination for Azure Import/Export jobs.
• B. Azure Data Lake Store is not a supported destination for Azure Import/Export jobs.
• D. Azure Data Factory is a data integration service, not a destination for Import/Export jobs.

Correct answer: C. Contributor

The Contributor role allows users to create and manage all types of Azure resources, including virtual machines and virtual networks, while explicitly preventing role assignment. This aligns with the principle of least privilege because it grants necessary permissions without the elevated privilege of the Owner role. Virtual Machine Contributor is too narrow (only VMs), Administrator Login is for login access, and Owner violates least privilege.

Why the other options are wrong

• A. Owner grants excessive permissions beyond what is needed.
• B. Virtual Machine Contributor only allows VM management, not virtual network management.
• D. Virtual Machine Administrator Login is for remote access, not resource deployment.

Correct answer: A. 5

The minimum number of network interfaces needed is 5. Each VM requires only one network interface, which can have multiple IP address configurations. A single network interface can be assigned both a private IP address and a public IP address through separate IP configurations, so five VMs need only five network interfaces total. Public IP addresses are associated with private IP configurations on the NIC, not as separate interfaces.

Why the other options are wrong

• B. Ten interfaces are not necessary; each VM needs only one NIC with multiple IP configurations.
• C. Twenty interfaces are far more than required for this configuration.
• D. Forty interfaces are completely unnecessary; this exceeds requirements by an order of magnitude.

Correct answer: A. Create an NS record named research in the adatum.com zone.

To delegate a subdomain to a different DNS server, you create an NS (Name Server) record in the parent zone pointing to the authoritative nameservers of the subdomain. In this case, an NS record named 'research' in the adatum.com zone will delegate research.adatum.com to the specified DNS server. This is the standard method for DNS delegation.

Why the other options are wrong

• B. PTR records are used for reverse DNS lookups, not subdomain delegation.
• C. The SOA record identifies the primary nameserver but does not perform delegation.
• D. An A record creates a host record and cannot delegate a subdomain to another DNS server.

Correct answer: A. Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory.

SetupComplete.cmd is a batch file that runs automatically during Windows Setup after the operating system has been installed and before the user logs in for the first time. For on-premises Hyper-V environments creating new VMs, this approach executes PowerShell scripts reliably during initial VM setup without requiring AD infrastructure or domain membership to be already configured. This is the most reliable method for new VM configuration automation.

Why the other options are wrong

• B. Logon scripts require a user to log in and depend on Group Policy processing; they won't run before user authentication.
• C. Startup scripts require the VM to be domain-joined and GPO processing to be complete, which may not be ready for new VMs.
• D. Placing scripts in a VHD doesn't execute them automatically; they would need to be manually invoked.

Correct answer: A. an Azure Key Vault and an access policy

Azure Key Vault is the proper service for securely storing sensitive values like administrative passwords without exposing them in plain text in Resource Manager templates. Creating an access policy on the Key Vault allows the ARM template to reference the secret securely during deployment of the 100 virtual machines.

Why the other options are wrong

• B. Storage accounts are designed for data storage, not secure credential management; they do not provide the encryption and access control needed for administrative passwords.
• C. Recovery Services vaults are for backup and disaster recovery, not credential storage.
• D. Azure AD Identity Protection is for detecting identity risks, not for storing passwords or secrets.

Correct answer: A. Yes

The Network Contributor role at the subscription level includes permissions required to enable and manage Traffic Analytics, which is a Network Watcher feature. This role grants sufficient access to configure traffic analytics for network monitoring within the subscription.

Why the other options are wrong

• B. Network Contributor role provides the necessary permissions for this task.

Correct answer: A. From the Licenses blade of Azure AD, assign a license

To enable Azure AD Premium P2 features for users, you must assign the purchased licenses to those users. This is done from the Licenses blade in Azure AD, where you can select users and allocate the premium licenses to them.

Why the other options are wrong

• B. Adding users to groups does not grant them premium features; licenses must be explicitly assigned.
• C. Adding enterprise applications is unrelated to assigning premium licenses to users.
• D. Modifying directory roles does not activate premium feature access; licenses must be assigned.

Correct answer: B. No

Clicking 'Resource providers' from the Subscriptions blade shows which resource providers are registered, not the creation dates and times of resources. Resource providers are Azure services available for subscription use, not historical deployment or resource metadata.

Why the other options are wrong

• A. Resource providers does not display resource creation information.

Correct answer: B. No

The Bulk create user operation in Azure AD is designed for creating member users, not guest users. While bulk operations exist in Azure AD, the standard bulk create functionality creates internal member accounts. To bulk-invite external users as guests, you need to use the bulk invite feature (based on New-AzureADMSInvitation), which is different from the standard bulk user creation tool.

Why the other options are wrong

• A. Bulk create user is for member accounts; bulk invite is needed for guest accounts.

Correct answer: B. Linux Diagnostic Extension (LAD) 3.0

Linux Diagnostic Extension (LAD) 3.0 is the correct tool for monitoring metrics and logs on Linux virtual machines in Azure. It collects performance metrics and diagnostic data from the VM and sends it to Azure Monitor or storage accounts for analysis.

Why the other options are wrong

• A. Azure HDInsight is for big data processing and analytics, not for individual VM monitoring.
• C. AzurePerformanceDiagnostics extension is primarily for Windows VMs, not Linux.
• D. Azure Analysis Services is for data analytics and business intelligence, not VM monitoring.

Correct answer: B. No

The Reader and Data Access role does not include permissions to list and regenerate storage account keys. This role allows reading storage content and data access but excludes key management operations. The specific 'Storage Account Key Operator Service Role' is required for key regeneration operations.

Why the other options are wrong

• A. This role does not provide the necessary permissions for listing and regenerating storage account keys.

Correct answer: B. Azure Monitor

Azure Monitor is the primary tool for collecting, analyzing, and acting on metrics and performance data from Azure infrastructure. It provides detailed metrics about VM performance, resource utilization, and infrastructure health. Azure Traffic Analytics monitors network traffic patterns, Azure Activity Log tracks management operations and resource changes, and Azure Advisor provides optimization recommendations, but none of these are the primary tool for real-time infrastructure metrics analysis.

Why the other options are wrong

• A. Azure Traffic Analytics focuses on network traffic analysis, not general infrastructure metrics.
• C. Azure Activity Log tracks management events and changes, not performance metrics.
• D. Azure Advisor provides recommendations but does not directly diagnose performance issues through metrics.

Correct answer: C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

The error message explicitly states that legal terms have not been accepted for the Marketplace item on the subscription. The Set-AzMarketplaceTerms cmdlet is the PowerShell command used to accept programmatic deployment terms for Marketplace items, enabling deployment via ARM templates and automation.

Why the other options are wrong

• A. Set-AzApiManagementSubscription is for configuring API Management subscriptions, not Marketplace terms.
• B. Registering the Microsoft.Marketplace resource provider is not the correct solution; the resource provider is already available.
• D. The Billing administrator role does not grant permission to accept Marketplace terms; the current user context is what matters for term acceptance.

Correct answer: B. Add-AzVhd

The Add-AzVhd cmdlet is used to upload a generalized VHD (Virtual Hard Disk) file from an on-premises environment to Azure storage. Once the VHD is uploaded, it can be used as a source to create managed images or deploy VMs directly. This is the correct cmdlet for the upload operation in a hybrid migration scenario.

Why the other options are wrong

• A. Add-AzVM creates a new VM; it doesn't upload images to Azure storage.
• C. Add-AzImage creates a managed image from an existing resource, but doesn't upload VHDs.
• D. Add-AzImageDataDisk adds a data disk to an existing image; it doesn't upload VHD files.

Correct answer: A. Yes

kubectl is the command-line client used to deploy applications to Kubernetes clusters, including AKS. Running kubectl apply -f <yaml-file> from Azure CLI is the standard method to deploy YAML manifests to an AKS cluster. This directly meets the goal of deploying a YAML file to AKS1.

Why the other options are wrong

• B. kubectl is the correct tool for deploying YAML files to Kubernetes clusters, so this solution does meet the goal.

Correct answer: B. blob and file only

AzCopy supports copying data to and from Blob Storage and File Storage only (B). These are the two storage services with AzCopy compatibility. Table and Queue storage services do not support AzCopy operations. AzCopy is optimized for high-performance bulk data transfer to these object and file storage tiers.

Why the other options are wrong

• A. Table and Queue storage services are not supported by AzCopy; only Blob and File are.
• C. Blob storage is supported, but Queue is not supported by AzCopy.
• D. While File is supported, Blob storage is also supported, making this incomplete.
• E. Table and Queue storage services do not support AzCopy operations.

Correct answer: B. No

The New-MgUser cmdlet creates regular user accounts, not guest user accounts. To create guest accounts in Azure AD, the New-MgInvitation cmdlet must be used, which sends invitation emails and properly provisions guest accounts. Using New-MgUser for 500 external users would create internal user accounts rather than guest accounts with the appropriate guest user type and invitation flow.

Why the other options are wrong

• A. New-MgUser is designed for creating member users, not guest users, so the solution fails to meet the goal of creating guest accounts.

Correct answer: B. From the Directory role blade, modify the directory role

To assign an administrative role such as User administrator to a user account in Azure AD, you must navigate to the Directory role blade within the user's properties and modify the directory role assignment from there.

Why the other options are wrong

• A. The Licenses blade is for assigning product licenses, not administrative roles.
• C. The Groups blade is for managing group membership, not for assigning administrative roles.

Correct answer: C. Change the size to D8s v3

Changing the VM size from D4s v3 to D8s v3 requires the VM to be deallocated and reallocated, which causes downtime. Adding managed disks and extensions can be done without downtime, and Desired State Configuration Management can be enabled without stopping the VM.

Why the other options are wrong

• A. Desired State Configuration Management can be enabled on a running VM without causing downtime.
• B. Adding a managed disk to a VM does not require downtime.
• D. Adding the Puppet Agent extension can be completed without stopping the VM.

Correct answer: E. containers and queues only

RBAC conditions are supported for containers and queues in Azure Storage. These conditions allow fine-grained access control based on attributes like blob index tags and blob properties for containers, and queue message properties for queues. Tables and file shares do not support attribute-based conditions in RBAC role assignments.

Why the other options are wrong

• A. Only containers is incomplete; queues also support conditions.
• B. File shares do not support RBAC conditions.
• C. Tables do not support RBAC conditions.
• D. Queues alone is incomplete; containers also support conditions.
• F. Neither file shares nor tables support RBAC conditions.

Correct answer: B. Azure Blob Storage

Azure Import/Export jobs can only import data into Azure Blob Storage or export data from Azure Blob Storage. This is the only supported destination/source for the Import/Export service. The other options (Cosmos DB, SQL Database, File Sync Service) are not compatible with Import/Export jobs.

Why the other options are wrong

• A. Azure Cosmos DB is not a supported destination for Import/Export jobs.
• C. Azure SQL Database cannot be used as a destination for Import/Export jobs.
• D. The Azure File Sync Storage Sync Service is not a valid destination for Import/Export.

Correct answer: A. Azure Files

Azure Files (A) is the appropriate storage service for Azure Container Instances that require persistent storage, particularly for databases like SQL Server. Azure Files provides SMB-based file shares that can be mounted to containers and persist data across container restarts and instances. Blob Storage is for unstructured data and does not provide the file system semantics needed for database instances. Queue and Table storage are not suitable for persistent file system requirements.

Why the other options are wrong

• B. Azure Blob Storage does not provide file system semantics required for SQL Server persistent storage in containers.
• C. Azure Queue Storage is for message queuing, not persistent storage for applications like SQL Server.
• D. Azure Table Storage provides NoSQL key-value storage, not file system persistence needed for database instances.

Correct answer: B. Assign User1 the Owner role for VNet1.

User1 must be assigned the Owner role at the VNet1 scope to gain the ability to assign the Reader role to other users. Only the Owner role (or User Access Administrator, which is rarely used) includes the permission to assign roles. This must be scoped to VNet1 to follow the principle of least privilege while meeting the stated requirement.

Why the other options are wrong

• A. Assigning Contributor at RG1 scope is overly broad and grants more permissions than needed for the specific task.
• C. Removing the Reader and Security roles and assigning Contributor at subscription scope is excessively broad and violates least privilege.
• D. Contributor role does not include permissions to assign roles to other users.

Correct answer: A. Yes

The Storage Account Key Operator Service Role is specifically designed to allow users to list and regenerate storage account keys. This role grants exactly the permissions needed to meet the stated goal without providing broader access to the storage account.

Why the other options are wrong

• B. This role is the correct assignment for the task, so the answer is not 'No'.

Correct answer: A. From the RSV1 blade, click Backup items and stop the VM2 backup

Before backing up a VM to a different Recovery Services vault, you must first stop the existing backup in the current vault (RSV1). This prevents conflicts between two backup jobs for the same VM running simultaneously. Once the backup is stopped in RSV1, you can then configure and start a new backup to RSV2.

Why the other options are wrong

• B. You cannot initiate a backup to RSV2 while the VM is still actively backed up to RSV1.
• C. Disaster recovery replication settings are separate from backup configuration and do not address the backup vault conflict.
• D. Exporting a backup job does not accomplish the goal of changing backup destinations; you must stop the existing backup first.

Correct answer: B. No

Moving a VM to a different subscription does not move it to a different host. The subscription is just a billing and organizational container. To move a VM to a different host during planned maintenance, you need to use the Redeploy function, which deallocates the VM and redeploys it on a different physical host within Azure infrastructure.

Why the other options are wrong

• A. Moving to a different subscription only changes the billing/management context, not the physical host where the VM runs.

Correct answer: A. Yes

The Contributor role at the resource group level (Dev) grants full permissions to create, modify, and delete resources within that resource group, including Azure logic apps. This meets the requirement to enable the Developers group to create logic apps in the Dev resource group.

Why the other options are wrong

• B. Contributor role provides sufficient permissions for this task, so the answer is yes.

Correct answer: C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public -- recursive

The azcopy copy command with the --recursive flag is the correct and most efficient tool for copying the contents of a local folder to an Azure blob container. This command properly handles bulk transfers from on-premises to Azure blob storage with recursive directory traversal.

Why the other options are wrong

• A. The az storage blob copy start command is less efficient for bulk folder operations and is not the recommended approach for copying an entire folder structure.
• B. The azcopy sync command with --snapshot is designed for synchronization scenarios, not for bulk initial copies, and --snapshot is not the appropriate flag for this use case.
• D. The az storage blob copy start-batch command does not exist as a valid Azure CLI command for this operation.

Correct answer: A. Premium performance with locally-redundant storage (LRS)

SMB Multichannel is only supported on Premium performance tier Azure Files. The redundancy type (LRS, GRS, ZRS) does not affect SMB Multichannel support. While LRS is the minimum redundancy option, the question asks to minimize costs while supporting SMB Multichannel, and Premium with LRS provides this combination.

Why the other options are wrong

• B. Standard performance tier does not support SMB Multichannel; only Premium tier does.
• C. While Premium with GRS would work, it is more expensive than Premium with LRS and does not minimize costs.
• D. Standard performance tier does not support SMB Multichannel regardless of redundancy type.

Correct answer: A. Run the docker push command.

Before deploying App1 to Cluster1, you must first push the container image from your workstation to Registry1 using 'docker push'. This makes the image available in the container registry where AKS can pull it for deployment. The Cluster1 is already created, and an App Service plan is not needed for Kubernetes deployments.

Why the other options are wrong

• B. App Service plan is for Azure App Service, not for AKS deployments.
• C. az acr build is used to build images in the registry, but your image is already built locally.
• D. az aks create is for creating a new cluster; Cluster1 already exists.

Correct answer: A. Yes

The New-MgInvitation cmdlet is the correct PowerShell cmdlet for inviting external users to Azure AD as guest users. It sends invitation emails and creates guest user accounts in a single operation, making it ideal for bulk invitations from a CSV file. Running this cmdlet for each of the 500 external users will successfully create their guest accounts in contoso.com.

Why the other options are wrong

• B. This answer is incorrect because New-MgInvitation is the appropriate cmdlet for this task.

Correct answer: C. Azure File Storage

Azure File Storage (Azure Files) is a supported destination for Azure Import/Export jobs. Organizations can import data directly into Azure file shares using the Import/Export service, making it suitable for transferring large volumes of file data.

Why the other options are wrong

• A. Azure Data Factory is not a supported destination for Import/Export jobs.
• B. The Azure File Sync Storage Sync Service is not a valid destination for Import/Export.
• D. Azure SQL Database cannot be used as a destination for Import/Export jobs.

Correct answer: C. Assign the Website Contributor role to the developers

The Website Contributor role is the principle of least privilege role needed for developers to deploy content to App Service via Web Deploy while using Azure AD credentials. It grants deployment permissions without Owner-level access. This role is specifically designed for web app deployment scenarios and aligns with least privilege by not granting broader subscription-level permissions.

Why the other options are wrong

• A. Owner role grants excessive permissions beyond what is needed for Web Deploy deployment.
• B. App-level FTPS credentials do not leverage Azure AD credentials as required.
• D. User-level FTPS credentials do not leverage Azure AD credentials as required.

Correct answer: B. No

Accessing the Virtual Machine blade will show details about the specific VM that was deployed, but it does not provide access to the ARM template that was used to deploy it. The ARM template is a deployment artifact that is not directly accessible from the individual resource's properties blade. To review the template used during deployment, you need to access the Resource Group blade where deployment history and templates are stored.

Why the other options are wrong

• A. The Virtual Machine blade shows VM properties and settings, not the ARM template used for deployment.

Correct answer: B. Modify the VM size property of VM1.

To increase processor performance of a VM, you must modify its size to one with more vCPUs or better performance characteristics. This is done by changing the VM size property, which requires stopping the VM, resizing it, and then starting it again. This is the appropriate mechanism for increasing computational resources for scheduled workloads.

Why the other options are wrong

• A. Performance Diagnostics agent only monitors and diagnoses performance issues; it does not improve performance.
• C. Scale sets are for managing multiple VMs with load distribution, not for increasing single-instance performance.
• D. vCPU quota is a subscription-level limit; it doesn't increase individual VM performance once within quota.
• E. DSC extensions configure desired state but do not improve hardware performance characteristics.

Correct answer: A. From the Azure portal, modify the Managed Identity settings of VM1

To enable a service running on VM1 to manage resources using the VM's identity, the first step is to enable a managed identity on the VM itself. This creates the identity that the service will use. After the managed identity is enabled, you would then configure IAM permissions on the resource group to grant that identity the necessary access, but enabling the managed identity on the VM must come first.

Why the other options are wrong

• B. While IAM settings of RG1 must be modified eventually, the managed identity must exist first on the VM.
• C. Access control (IAM) settings on the VM itself do not enable managed identity.
• D. Policies on RG1 do not enable managed identity for the VM.

Correct answer: B. No

User4 has the 'Owner' role scoped to the Azure Subscription, not to the Azure Active Directory tenant. The Owner role at the subscription level grants permissions over subscription resources, but does not grant permissions to manage users in an Azure AD tenant. To create user accounts in the external.contoso.onmicrosoft.com tenant, a user must have a Global Administrator or User Administrator role scoped to that specific Azure AD tenant. User4 lacks the necessary Azure AD administrative role in the external tenant, so they cannot create user accounts there.

Why the other options are wrong

• A. User4 is a Subscription Owner, not an Azure AD administrator in the external tenant, so they lack the required permissions to create user accounts in the Azure AD tenant.

Correct answer: B. Event | search "error"

The correct KQL (Kusto Query Language) syntax for querying the Event table in Log Analytics is to use the pipe operator with the search operator. 'Event | search "error"' will search for the string "error" across all columns in the Event table, which is the proper way to find error events.

Why the other options are wrong

• A. This uses SQL SELECT syntax, not KQL, and is incompatible with Log Analytics queries.
• C. KQL does not use 'is' operator for comparison; the correct operator is '==' for equality comparisons.
• D. This is PowerShell cmdlet syntax, not KQL, and cannot be executed in Log Analytics workspace queries.

Correct answer: B. No

azcopy is a tool designed for transferring data to and from Azure Storage accounts, not for deploying applications or YAML files to Kubernetes clusters. To deploy a YAML file to AKS, you need kubectl, not azcopy. This solution does not meet the stated goal.

Why the other options are wrong

• A. azcopy is used for Azure Storage data transfers, not Kubernetes deployments, so it cannot deploy YAML files to AKS.

Correct answer: A. MX

When adding a custom domain to Azure AD, the system requires DNS verification. Azure AD uses an MX record (or TXT record, though MX is the standard answer in this context) to verify domain ownership. You must create the specified DNS record in your public DNS zone so Azure can confirm you control the domain.

Why the other options are wrong

• B. NSEC records are DNSSEC-related security records, not used for domain verification.
• C. PTR records are used for reverse DNS lookups, not domain ownership verification.
• D. RRSIG records are DNSSEC signatures, not used for Azure AD domain verification.

Correct answer: B. search in (Event) "error"

The correct syntax for querying Log Analytics is Kusto Query Language (KQL). The 'search in (Event) "error"' syntax properly searches within the Event table for records containing 'error', which will return error events in the most appropriate format for Log Analytics.

Why the other options are wrong

• A. PowerShell Get-Event syntax is not valid for Log Analytics queries.
• C. SQL-style 'select * from' syntax is not valid KQL for Log Analytics.
• D. While this uses KQL syntax, it is less efficient than the direct search method for finding error events.

Correct answer: C. Azure File Storage

Azure Import/Export jobs can only import data into Azure Blob Storage or Azure File Storage (C). The service is specifically designed for these two storage types. Virtual machines, Azure Cosmos DB, and Azure File Sync Storage Sync Service cannot be direct destinations for Import/Export jobs. Azure File Storage is the appropriate choice for file-based workloads and persistent storage scenarios.

Why the other options are wrong

• A. Virtual machines cannot be a direct destination for Azure Import/Export jobs.
• B. Azure Cosmos DB is not supported as a destination for Import/Export jobs.
• D. Azure File Sync Storage Sync Service is not a valid destination for Import/Export data transfer.

Correct answer: A. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes.

Custom role assignable scopes define where the role can be assigned. By updating the existing custom role to include both Sub1 and Sub2 as assignable scopes and removing RG1, the role becomes available for assignment at the subscription level, covering all resource groups in both subscriptions with minimal administrative effort.

Why the other options are wrong

• B. Creating separate custom roles for each subscription adds administrative overhead when a single role can be configured for both.
• C. Cannot add Sub2 to a custom role's assignable scopes if the role was created in Sub1; the scope must be at the subscription level or parent management group.
• D. Creating a separate custom role for Sub2 introduces unnecessary complexity and additional administrative effort.

Correct answer: B. No

Creating an event subscription on VM1 alone is not sufficient to alert on error events in Azure Monitor. You must configure the Microsoft Monitoring Agent and Log Analytics workspace to collect Windows event log data, then create an alert rule in Azure Monitor based on that log data. Simply creating an event subscription and pointing Azure Monitor to VM1 as a source does not establish the necessary data collection pipeline for alerting on specific event log errors.

Why the other options are wrong

• A. An event subscription on the VM itself does not integrate with Azure Monitor alerting; you need the Monitoring Agent, Log Analytics, and proper alert rules configured in Azure Monitor to achieve this goal.

Correct answer: A. From the Users settings blade, modify the External collaboration settings.

The External collaboration settings blade controls whether external users can be invited to the Azure AD tenant. The error occurs because the default settings may restrict invitations of external Microsoft accounts. Modifying the External collaboration settings to allow invitations will enable Admin1 to invite user1@outlook.com.

Why the other options are wrong

• B. Custom domain names are not related to the ability to invite external users.
• C. Adding an identity provider is unnecessary for inviting Microsoft account users to Azure AD.
• D. The Security administrator role is not required; the User administrator role already has sufficient permissions to invite users when external collaboration settings are configured correctly.

Correct answer: A. Yes

Downloading and reinstalling the VPN client configuration package solves the problem because it provides updated routing information to the point-to-site VPN client. When virtual networks are peered, the VPN gateway's configuration changes, but existing VPN client packages contain cached route information. A fresh configuration package includes the routes to the newly peered VirtualNetworkB, enabling connectivity from the Windows 10 workstation to resources in that network.

Correct answer: B. No

Clicking 'Automation script' (also called Export template) from the RG1 blade exports the ARM template for resources, but does not display creation dates and times. To view resource creation metadata, you need to access the Deployments blade which shows deployment history with timestamps.

Why the other options are wrong

• A. Automation script exports template code, not resource creation dates.

Correct answer: C. each virtual machine in a separate Availability Zone

Deploying each virtual machine in a separate Availability Zone ensures that at least two VMs remain available if a single datacenter becomes unavailable. Availability Zones are physically separated datacenters within an Azure region, providing protection against complete datacenter failure. This is superior to Availability Sets, which only protect against rack-level failures within a single datacenter.

Why the other options are wrong

• A. All VMs in a single Availability Zone would all fail if that zone's datacenter becomes unavailable.
• B. Availability Sets only protect against rack-level failures within a single datacenter, not full datacenter outages.
• D. Each VM in separate Availability Sets still places them in the same datacenter, not protecting against datacenter failure.

Correct answer: D. resource group

When deploying a VM from an ARM template, the template itself defines the OS, VM size, and other infrastructure properties that cannot be changed during deployment. However, the resource group must be specified at deployment time because it determines where the VM will be created. The resource group is a deployment-level parameter that must be selected or created during the deployment process.

Why the other options are wrong

• A. The operating system is defined in the template and cannot be changed during deployment.
• B. Administrator username is typically defined in the template; if parameterized, it would be set before deployment, not during.
• C. Virtual machine size is specified in the template and is not configurable at deployment time.

Correct answer: A. Yes

Clicking 'Deployments' from the RG1 blade displays the deployment history for all resources in that resource group, including deployment dates and times when resources were created. This is the correct location to view when template-deployed resources were provisioned.

Correct answer: B. No

User1 created the new Azure Active Directory tenant named external.contoso.onmicrosoft.com, which means User1 is the Global Administrator of that tenant. User2 is a Global Administrator only in the original contoso.onmicrosoft.com tenant, not in the newly created external.contoso.onmicrosoft.com tenant. User2 would have no permissions in the external tenant unless explicitly granted access by User1. Therefore, User2 cannot create user accounts in external.contoso.onmicrosoft.com without being assigned appropriate permissions in that specific tenant first.

Why the other options are wrong

• A. User2 lacks permissions in the external.contoso.onmicrosoft.com tenant and cannot create accounts there without explicit authorization from User1.

Correct answer: B. Assign User1 the Access Administrator role for VNet1.

The User Access Administrator role (also called Access Administrator) at the VNet1 scope grants User1 the specific permission to assign roles to other users without providing broad Owner-level permissions across all resource types. This role is purpose-built for managing role assignments and represents the principle of least privilege for this scenario.

Why the other options are wrong

• A. Assigning Contributor at RG1 is overly broad and grants excessive permissions beyond role assignment.
• C. Removing Reader and Security roles plus assigning Contributor at subscription level is excessively broad and not least privilege.
• D. Network Contributor does not include permissions to assign roles.

Correct answer: B, E. a dataset CSV file; a driveset CSV file

The Azure Import/Export service requires two CSV files: a dataset CSV file (B) that lists the files and directories to be imported, and a driveset CSV file (E) that contains drive information and mapping details. These files define what data goes on which drives. Manifest XML files are generated during the process, not created beforehand. JSON configuration files and PowerShell scripts are not standard Import/Export requirements.

Why the other options are wrong

• A. An XML manifest file is generated by the WAImportExport tool after drive preparation, not created before preparing drives.
• C. A JSON configuration file is not a standard requirement for Azure Import/Export jobs.
• D. A PowerShell PS1 script is not a mandatory file for preparing Import/Export drives.

Correct answer: D. two update domains

To ensure App1 remains available during planned maintenance, you need multiple update domains. Azure Availability Sets use update domains to stagger maintenance windows so that not all VMs are updated simultaneously. With two VMs, you need at least two update domains to guarantee one VM remains online during maintenance of the other. Fault domains protect against hardware failures, but update domains specifically address planned maintenance scenarios.

Why the other options are wrong

• A. One update domain means both VMs could be updated simultaneously, causing downtime.
• B. Fault domains protect against hardware failures, not planned maintenance windows.
• C. One fault domain provides no redundancy for planned maintenance events.

Correct answer: A. Yes

The Resource Group blade provides access to the deployment history and templates. Within the Resource Group blade, you can navigate to Deployments to view all ARM templates that have been used to deploy resources in that resource group, including the template Jon Ross used to deploy the virtual machine and storage account. This is the correct location to review historical ARM templates.

Why the other options are wrong

• B. The Resource Group blade is the correct location to access ARM template deployment history and review templates.

Correct answer: C. Azure Disk Encryption

Azure Disk Encryption (C) meets all requirements: it stores encryption keys in the Key Vault (KV1), maintains encryption even when the VM is downloaded from Azure (persistent encryption of the disk files themselves), and encrypts both OS and data disks. This is the standard solution for VM-level encryption with key management requirements.

Why the other options are wrong

• A. Customer-managed keys is a broader concept applicable to various services; Azure Disk Encryption specifically is the correct implementation for VM disk encryption.
• B. Confidential disk encryption is for protecting data at rest on confidential VMs but is not the standard disk encryption method being requested.
• D. Encryption at host encrypts data at the physical host level but does not meet the requirement to maintain encryption when the VM is downloaded.

Correct answer: B. From contoso.com, create an OAuth 2.0 authorization endpoint.

To grant access to an AKS cluster to Azure AD users, the cluster must be integrated with Azure AD. The first step is to create an OAuth 2.0 authorization endpoint in Azure AD, which enables AKS to authenticate users against the Azure AD tenant. This establishes the trust relationship between AKS1 and contoso.com, allowing the administrator to subsequently grant access to contoso.com users. The other options do not address the fundamental authentication integration needed.

Why the other options are wrong

• A. Organization relationships settings do not enable AKS-Azure AD integration.
• C. Recreating AKS1 is not the solution; configuration is needed, not recreation.
• D. Creating a namespace in AKS does not enable Azure AD authentication.