100 Free AZ-104 Practice Questions and Answers
100 questions for the AZ-104 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Backup vaults are used for data backup and recovery, not for key rotation management.
Not this one. Try another answer.
Why B is wrong
Redundancy configuration does not address key rotation requirements.
Not this one. Try another answer.
Why C is wrong
Lifecycle management handles blob storage retention policies, not access key rotation.
Right, D is the answer.
Why D is right
Azure Key Vault provides managed storage account features that enable automatic rotation of storage account access keys. Key Vault can manage the lifecycle of storage keys and rotate them automatically on a configured schedule, ensuring security best practices are maintained without manual intervention.
Not this one. Try another answer.
Why E is wrong
Recovery Services vaults are designed for backup and disaster recovery, not for key rotation management.
Question 2 Play from 01:44
• Create files on drive C.
• Create files on drive D.
• Modify the screen saver timeout.
• Change the desktop background. You plan to redeploy VM1. Which changes will be lost after you redeploy VM1?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Screen saver timeout is a user setting stored in the Windows profile on the C drive, which persists.
Not this one. Try another answer.
Why B is wrong
Desktop background is stored in the user profile on the C drive and persists across redeployment.
Right, C is the answer.
Why C is right
In Azure VMs with default settings, drive D is the temporary storage drive (resource disk) which is wiped when the VM is redeployed or shut down. Drive C is the OS disk which persists across redeployments, and user settings like screen saver and desktop background are stored on the OS disk. Only files on the temporary drive D will be lost after redeployment.
Not this one. Try another answer.
Why D is wrong
Files on drive C (the OS disk) are persistent and survive redeployment.
Question 3 Play from 03:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure AD roles apply at the tenant level and cannot be scoped to specific offices or organizational units.
Right, B is the answer.
Why B is right
Administrative units in Azure AD allow you to delegate user management permissions to local administrators for specific organizational units without granting tenant-wide permissions. Each office can have an administrative unit with its own administrator, enabling granular permission delegation across multiple locations.
Not this one. Try another answer.
Why C is wrong
Access packages in entitlement management are for managing access to resources and groups, not for delegating administrative permissions.
Not this one. Try another answer.
Why D is wrong
Azure roles are for managing Azure subscription resources, not for managing Azure AD users.
Question 4 Play from 05:30
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Before adding a custom domain to a web app, you must first create a DNS record that points the custom domain to the web app's IP address or domain. This DNS configuration is the prerequisite step. You would then verify the domain ownership in Azure Portal.
Not this one. Try another answer.
Why B is wrong
Connection strings are for database connectivity and are unrelated to custom domain setup.
Not this one. Try another answer.
Why C is wrong
A certificate is needed for HTTPS/SSL but only after the domain is added and verified.
Not this one. Try another answer.
Why D is wrong
There is no need to stop the web app to add a custom domain.
Question 5 Play from 06:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Owner role grants excessive permissions beyond what is needed for Web Deploy deployment.
Not this one. Try another answer.
Why B is wrong
App-level FTPS credentials do not leverage Azure AD credentials as required.
Right, C is the answer.
Why C is right
The Website Contributor role is the principle of least privilege role needed for developers to deploy content to App Service via Web Deploy while using Azure AD credentials. It grants deployment permissions without Owner-level access. This role is specifically designed for web app deployment scenarios and aligns with least privilege by not granting broader subscription-level permissions.
Not this one. Try another answer.
Why D is wrong
User-level FTPS credentials do not leverage Azure AD credentials as required.
Question 6 Play from 08:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Administrative units are used for Azure AD management and role delegation, not for Recovery Services vault authorization.
Not this one. Try another answer.
Why B is wrong
Managed identities are used for Azure resource authentication, not for implementing multi-user authorization on vaults.
Right, C is the answer.
Why C is right
Multi-user authorization (MAU) for Azure Recovery Services vaults requires a Resource Guard to be created first. The Resource Guard is a separate Azure resource that acts as a gatekeeper for critical operations on the vault, enabling multi-user authorization by requiring approval from designated users before sensitive operations can be performed.
Not this one. Try another answer.
Why D is wrong
Custom Azure roles define permissions but do not enable the multi-user authorization mechanism itself; a Resource Guard is the foundational requirement.
Question 7 Play from 10:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
You do not need to deallocate VM1 before using Replace existing; Azure handles the necessary steps.
Right, B is the answer.
Why B is right
The backup policy retains daily backups for 14 days, and the website was last updated 8 days ago, which falls within the retention window. Using the Replace existing restore option will restore VM1 in-place, replacing the current disks with the backup from 8 days ago, which minimizes downtime compared to creating a new VM. You do not need to deallocate or delete VM1 first when using Replace existing, as the operation handles this automatically.
Not this one. Try another answer.
Why C is wrong
Deleting VM1 is not necessary and would cause additional downtime.
Not this one. Try another answer.
Why D is wrong
Creating new would result in longer downtime and requires additional configuration; Replace existing is faster.
Question 8 Play from 12:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Traffic Analytics focuses on network traffic analysis, not general infrastructure metrics.
Right, B is the answer.
Why B is right
Azure Monitor is the primary tool for collecting, analyzing, and acting on metrics and performance data from Azure infrastructure. It provides detailed metrics about VM performance, resource utilization, and infrastructure health. Azure Traffic Analytics monitors network traffic patterns, Azure Activity Log tracks management operations and resource changes, and Azure Advisor provides optimization recommendations, but none of these are the primary tool for real-time infrastructure metrics analysis.
Not this one. Try another answer.
Why C is wrong
Azure Activity Log tracks management events and changes, not performance metrics.
Not this one. Try another answer.
Why D is wrong
Azure Advisor provides recommendations but does not directly diagnose performance issues through metrics.
Question 9 Play from 14:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Deploying five individual VMs and then modifying Availability Zones for each is time-consuming and not the intended use of scale sets.
Not this one. Try another answer.
Why B is wrong
Deploying five individual VMs and modifying sizes manually is slower than using a scale set.
Not this one. Try another answer.
Why C is wrong
VM orchestration mode is less efficient for scale sets than ScaleSetVM mode.
Right, D is the answer.
Why D is right
Deploying a virtual machine scale set with ScaleSetVM orchestration mode is the quickest way to deploy five instances. ScaleSetVM mode provides optimized deployment for scale sets and is faster than deploying individual VMs and manually configuring them. This approach also automatically manages the instances as a unified scale set.
Question 10 Play from 16:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Creating a new storage account adds administrative overhead and is not the first step; upgrading is simpler.
Not this one. Try another answer.
Why B is wrong
Object replication does not protect against zone failures; it replicates objects between accounts.
Right, C is the answer.
Why C is right
To protect data against zone failures while minimizing cost and effort, you must first upgrade the storage account from general-purpose v1 to general-purpose v2. Only general-purpose v2 accounts support zone-redundant storage (ZRS) and geo-zone-redundant storage (GZRS), which provide zone-failure protection. This is a prerequisite before you can change the replication settings from LRS to a zone-redundant option.
Not this one. Try another answer.
Why D is wrong
You cannot modify the replication setting to a zone-redundant option without first upgrading to general-purpose v2.
Show all 100 questionsShow fewer questions
Question 11 Play from 18:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Stopping the source VM is unnecessary because data disks can be detached while the VM is running.
Not this one. Try another answer.
Why B is wrong
Stopping the target VM is unnecessary because data disks can be attached while the VM is running.
Right, C is the answer.
Why C is right
Azure supports hot-detaching a data disk from a running VM and hot-attaching it to another running VM. Detaching the disk first therefore avoids stopping either VM, which keeps downtime to a minimum.
Not this one. Try another answer.
Why D is wrong
Deleting the source VM is destructive and not required to move a data disk.
Question 12 Play from 20:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To capture HTTP error details for web app connection errors, you should enable Web server logging on webapp1. Web server logging records detailed HTTP requests and responses including status codes, headers, and error information. This logging is written to storage and can be accessed in real-time by developers. This is the first step to diagnose HTTP 500 errors.
Not this one. Try another answer.
Why B is wrong
Creating a workbook in Azure Monitor is useful for visualization but does not capture the underlying error details without logging first.
Not this one. Try another answer.
Why C is wrong
Service Health alerts notify about Azure platform status, not application-specific connection errors.
Not this one. Try another answer.
Why D is wrong
Application Logging logs application-level events but may not capture all HTTP server-level details that Web server logging provides.
Question 13 Play from 22:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure network policy is not the standard solution for pod-to-pod traffic restriction in AKS.
Right, B is the answer.
Why B is right
Calico network policy is the correct solution for restricting network traffic between pods in an AKS cluster. Calico provides fine-grained network segmentation and policy enforcement at the pod level, allowing you to define which pods can communicate with each other. Azure network policy is not a standard AKS feature, pod security policies control pod execution constraints rather than network traffic, and application security groups operate at the VM level, not the pod level.
Not this one. Try another answer.
Why C is wrong
Pod security policies control pod execution contexts and permissions, not network traffic between pods.
Not this one. Try another answer.
Why D is wrong
Application security groups operate at the virtual machine level, not at the Kubernetes pod level.
Question 14 Play from 24:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Kubenet does not assign IPs directly from the subnet; pods receive internal IPs that require NAT, preventing direct on-premises access to pod IPs.
Right, B is the answer.
Why B is right
Azure Container Networking Interface (CNI) assigns IP addresses from the subnet address space directly to pods, making pods routable from on-premises networks via VPN or ExpressRoute. This allows on-premises clients to connect directly to pod IPs. Kubenet uses NAT and internal IP addressing, which would require additional routing configuration or service exposure.
Not this one. Try another answer.
Why C is wrong
Hybrid Connection endpoints are for App Service hybrid connections, not for AKS pod networking.
Not this one. Try another answer.
Why D is wrong
Azure Private Link is for private endpoint access to Azure services, not for AKS pod-level networking.
Question 15 Play from 26:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption with customer-managed keys protects data at rest but does not enable image signing
Not this one. Try another answer.
Why B is wrong
A connected registry is for hybrid scenarios and does not directly enable content trust
Not this one. Try another answer.
Why C is wrong
Adding a token provides authentication credentials but does not enable image signing functionality
Right, D is the answer.
Why D is right
Content trust in Azure Container Registry enables Docker Content Trust, which allows you to sign images when pushing them and verify signatures when pulling them. This is the feature specifically designed to ensure you can push and pull signed images.
Question 16 Play from 28:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
root is not a valid username for ACR authentication
Not this one. Try another answer.
Why B is wrong
admin is not the correct username format for ACR
Not this one. Try another answer.
Why C is wrong
administrator is not a valid ACR username
Right, D is the answer.
Why D is right
When you enable the Admin user for an Azure Container Registry, the username is the registry name itself. In this case, with a registry named ContReg1, you would use 'ContReg1' as the username to sign in.
Question 17 Play from 29:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IKEv1 is an older protocol primarily used for policy-based VPNs, not route-based VPNs.
Not this one. Try another answer.
Why B is wrong
PPTP is a legacy protocol with known security vulnerabilities and is not recommended for modern Azure VPN deployments.
Right, C is the answer.
Why C is right
IKEv2 is the correct tunneling protocol for route-based Site-to-Site VPN connections. IKEv2 is the modern IPsec protocol version that supports route-based VPN, provides better mobility support, faster reconnection, and is the recommended protocol for production VPN gateways in Azure. IKEv1 is older and primarily used with policy-based VPNs. PPTP and L2TP are legacy protocols with security limitations and are not recommended for modern VPN implementations in Azure.
Not this one. Try another answer.
Why D is wrong
L2TP is a legacy protocol that lacks the modern security features and performance benefits of IKEv2 for route-based VPNs.
Question 18 Play from 31:26
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To delegate a subdomain to a different DNS server, you create an NS (Name Server) record in the parent zone pointing to the authoritative nameservers of the subdomain. In this case, an NS record named 'research' in the adatum.com zone will delegate research.adatum.com to the specified DNS server. This is the standard method for DNS delegation.
Not this one. Try another answer.
Why B is wrong
PTR records are used for reverse DNS lookups, not subdomain delegation.
Not this one. Try another answer.
Why C is wrong
The SOA record identifies the primary nameserver but does not perform delegation.
Not this one. Try another answer.
Why D is wrong
An A record creates a host record and cannot delegate a subdomain to another DNS server.
Question 19 Play from 33:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Adding a private endpoint would work but is more complex and requires more administrative effort than simply modifying public network access settings.
Right, B is the answer.
Why B is right
Modifying the Public network access settings is the first step to restrict access to storage1 from selected networks and specific locations. This allows you to configure the storage account firewall to allow access only from specified virtual networks, IP addresses (including your home office), and services while blocking all other public access. This minimizes administrative overhead compared to managing individual private endpoints. Private endpoints are an advanced option for complete network isolation but require more infrastructure. IAM settings control authentication and authorization, not network access. Internet routing is not relevant to this scenario.
Not this one. Try another answer.
Why C is wrong
Internet routing selection does not address the requirement to restrict access from selected networks.
Not this one. Try another answer.
Why D is wrong
IAM settings control identity and access management permissions, not network-level access restrictions.
Question 20 Play from 35:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
New-AzureRmVm is an older cmdlet that has been superseded and is less flexible for custom deployments.
Not this one. Try another answer.
Why B is wrong
New-AzVM is a PowerShell cmdlet that requires additional scripting steps to configure custom certificates compared to CLI approaches.
Not this one. Try another answer.
Why C is wrong
Create-AzVM is not a standard Azure PowerShell cmdlet; the correct cmdlet is New-AzVM.
Right, D is the answer.
Why D is right
The az vm create command from Azure CLI is the appropriate tool for creating custom VM deployments with advanced configurations such as adding trusted root certification authorities. Azure CLI provides the flexibility needed for custom deployments and allows passing parameters for certificate configuration. PowerShell cmdlets like New-AzureRmVm and New-AzVM are less suitable for this scenario as they require more complex scripting for custom certificate installation.
Question 21 Play from 37:40
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Staging slots are only available in the Standard tier or higher of App Service plans. If the staging slot option is unavailable, the plan is likely in the Free or Basic tier. Scaling up the App Service plan to Standard or Premium will enable the staging slot feature.
Not this one. Try another answer.
Why B is wrong
Application settings modifications do not affect staging slot availability, which is determined by the pricing tier.
Not this one. Try another answer.
Why C is wrong
Custom domains do not enable staging slots; tier level is the controlling factor.
Not this one. Try another answer.
Why D is wrong
Scaling out (adding more instances) does not change the pricing tier; you must scale up to a higher tier.
Question 22 Play from 39:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Owner grants excessive permissions beyond what is needed.
Not this one. Try another answer.
Why B is wrong
Virtual Machine Contributor only allows VM management, not virtual network management.
Right, C is the answer.
Why C is right
The Contributor role allows users to create and manage all types of Azure resources, including virtual machines and virtual networks, while explicitly preventing role assignment. This aligns with the principle of least privilege because it grants necessary permissions without the elevated privilege of the Owner role. Virtual Machine Contributor is too narrow (only VMs), Administrator Login is for login access, and Owner violates least privilege.
Not this one. Try another answer.
Why D is wrong
Virtual Machine Administrator Login is for remote access, not resource deployment.
Question 23 Play from 41:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Internet as a next hop type routes traffic to the internet, not to a specific IP address.
Not this one. Try another answer.
Why B is wrong
Virtual network gateway is used for VPN or ExpressRoute connections, not for specifying arbitrary IP addresses.
Not this one. Try another answer.
Why C is wrong
Virtual network as a next hop type routes to destinations within the virtual network, not to a specific external IP address.
Right, D is the answer.
Why D is right
When you need to specify an explicit next hop IP address in a routing table, you must select 'Virtual appliance' as the next hop type. This allows you to define a specific IP address (such as a firewall or network virtual appliance) as the destination for traffic matching that route.
Question 24 Play from 42:56
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To configure a user as a local administrator on all computers joined to an Azure AD domain, you must configure Device settings from the Devices blade in Azure AD. This setting controls which users are granted administrative privileges on Azure AD-joined devices.
Not this one. Try another answer.
Why B is wrong
The MFA Server blade is for multi-factor authentication configuration, not device administrator assignment.
Not this one. Try another answer.
Why C is wrong
User settings do not control local device administrator privileges.
Not this one. Try another answer.
Why D is wrong
Group settings are not the location for configuring device-level administrative access.
Question 25 Play from 44:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Service Health monitors Azure platform service status, not application availability.
Right, B is the answer.
Why B is right
Azure Application Insights is the correct tool for monitoring web app availability using multi-step web tests. Multi-step web tests allow you to record and simulate user workflows across multiple steps, and Application Insights will monitor availability and performance from multiple geographic locations. This feature is a core part of Application Insights.
Not this one. Try another answer.
Why C is wrong
Diagnostic settings are used to configure where logs and metrics are sent, not to create tests.
Not this one. Try another answer.
Why D is wrong
Metrics provide performance data but do not provide the multi-step web testing capability.
Question 26 Play from 46:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A stopped VM can still be backed up; this would not typically produce a Warning status.
Right, B is the answer.
Why B is right
A Warning status in Backup Pre-Check typically indicates a condition that does not prevent backup but should be remedied for optimal backup operation. The absence of the latest Azure VM Agent version is a common cause of Warning status, as the agent is required for backup functionality and older versions may have compatibility or feature issues.
Not this one. Try another answer.
Why C is wrong
Unmanaged disks can be backed up and would not specifically cause a Warning status for this scenario.
Not this one. Try another answer.
Why D is wrong
An unavailable Recovery Services vault would produce an Error status, not a Warning.
Question 27 Play from 48:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
User-defined routes require manual route table creation and management, which increases administrative effort compared to the automatic connectivity provided by peering.
Not this one. Try another answer.
Why B is wrong
NSGs control traffic filtering but do not establish connectivity between VMs in different VNets; connectivity must exist first before NSGs can filter it.
Not this one. Try another answer.
Why C is wrong
Reassigning VM4's IP address does not create connectivity between VNets; IP address assignment is independent of inter-VNet communication requirements.
Right, D is the answer.
Why D is right
VNet peering is the solution that minimizes administrative effort to enable communication between VM1 in VNET1 and VM4 in VNET3. Peering establishes direct, low-latency connectivity between virtual networks through Azure's backbone infrastructure without requiring user-defined routes or manual route management, and it requires minimal configuration overhead.
Question 28 Play from 50:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Creating a proximity placement group does not help when a specific VM size is unavailable.
Right, B is the answer.
Why B is right
Before resizing a VM to a larger size in an availability set, you must deallocate it first. Deallocation releases the VM's current hardware resources, which may allow Azure to move it to a cluster where the larger size is available. Creating a proximity placement group, converting to managed availability sets, or shutting down other VMs does not address the core issue of hardware availability for the new size.
Not this one. Try another answer.
Why C is wrong
Converting to managed availability sets is not necessary to resize a VM.
Not this one. Try another answer.
Why D is wrong
Shutting down other VMs does not make the intended size available for VM1.
Question 29 Play from 52:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Stopping only one VM does not free sufficient resources for the reallocation to succeed.
Not this one. Try another answer.
Why B is wrong
Stopping two VMs is insufficient; all VMs in the availability set must be stopped.
Right, C is the answer.
Why C is right
When a VM resize fails due to allocation constraints within an availability set, you must stop all VMs in the availability set before attempting the resize. This deallocates all compute resources and allows the Azure fabric to reallocate them with the new VM size. Stopping all three VMs ensures that the resize operation has sufficient resources and can succeed, as the reallocation can consolidate the resources needed for the resized VM.
Not this one. Try another answer.
Why D is wrong
Removing the VM from the availability set is unnecessary and removes the resiliency benefits; stopping all VMs is the proper solution.
Question 30 Play from 54:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Private endpoints provide private connectivity but do not optimize routing to the geographically closest POP.
Not this one. Try another answer.
Why B is wrong
Azure Firewall rules control traffic filtering, not routing preferences to closest locations.
Right, C is the answer.
Why C is right
Routing preference allows you to choose how traffic is routed to Azure Storage. When configured to use Microsoft network routing, traffic is directed through Microsoft's global network infrastructure to the closest point of presence (POP), optimizing latency and performance for geographically distributed users.
Not this one. Try another answer.
Why D is wrong
Load balancing distributes traffic across multiple targets but does not select the closest geographic POP.
Question 31 Play from 55:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Creating an automation runbook alone does not establish the connection to Service Manager; the ITSM Connector is the prerequisite.
Not this one. Try another answer.
Why B is wrong
A function app is not the correct tool for integrating with Service Manager.
Right, C is the answer.
Why C is right
To create alerts in an on-premises Service Manager when Azure VM conditions are met, you must first deploy the IT Service Management Connector (ITSM). This connector establishes the bridge between Azure Monitor alerts and Service Manager, allowing alerts to be triggered in the on-premises system.
Not this one. Try another answer.
Why D is wrong
Creating a notification in Azure is not sufficient without the ITSM Connector to forward alerts to Service Manager.
Question 32 Play from 57:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Selecting Azure Virtual Machines for deployment is a general vault setting not specifically required for disk encryption preparation.
Right, B is one of the answers.
Why B is right
To prepare a Key Vault for Azure Disk Encryption using a Key Encryption Key (KEK), you must create a new key (B) to serve as the KEK that will encrypt the disk encryption keys, and enable the vault for Azure Disk Encryption for volume encryption (E) by setting the appropriate access policy. The Key Vault must be explicitly configured to allow Azure Disk Encryption to access it for encryption operations.
Not this one. Try another answer.
Why C is wrong
Creating a secret is not necessary; disk encryption requires keys, not secrets.
Not this one. Try another answer.
Why D is wrong
Configuring a key rotation policy is optional and not required for initial disk encryption setup.
Right, E is one of the answers.
Why E is right
To prepare a Key Vault for Azure Disk Encryption using a Key Encryption Key (KEK), you must create a new key (B) to serve as the KEK that will encrypt the disk encryption keys, and enable the vault for Azure Disk Encryption for volume encryption (E) by setting the appropriate access policy. The Key Vault must be explicitly configured to allow Azure Disk Encryption to access it for encryption operations.
Question 33 Play from 1:00:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While Container Apps can auto-scale, App Service also supports this capability
Not this one. Try another answer.
Why B is wrong
Container Instances does not support automatic scaling
Right, C is the answer.
Why C is right
Azure Container Apps and Azure App Service both support automatic scaling. Container Instances does not have built-in auto-scaling capabilities, so the correct answer includes only Container Apps and App Service.
Not this one. Try another answer.
Why D is wrong
Container Instances does not have auto-scaling; App Service does but Container Instances does not
Not this one. Try another answer.
Why E is wrong
Container Instances cannot auto-scale automatically
Question 34 Play from 1:02:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Private networking type does not support DNS name label scope reuse configuration.
Right, B is the answer.
Why B is right
DNS name label scope reuse is a feature available only for container instances deployed with public networking type. This setting allows you to reuse DNS labels across resource groups when using public networking, which is not available with private networking.
Not this one. Try another answer.
Why C is wrong
Creating a new subnet on VNet1 is related to private networking and does not enable DNS name label scope reuse.
Not this one. Try another answer.
Why D is wrong
Confidential SKU is unrelated to DNS naming configuration capabilities.
Question 35 Play from 1:03:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data collection endpoint is configured after determining what to collect, not before.
Not this one. Try another answer.
Why B is wrong
AMPLS is for network isolation and access control, not the initial log collection setup.
Right, C is the answer.
Why C is right
To collect IIS logs from virtual machines with Azure Monitor Agent and store them in Log Analytics, you must first configure Diagnostic settings. Diagnostic settings define what data sources (including IIS logs) are collected and where they are sent. A data collection endpoint is created after deciding what to collect, AMPLS and private endpoints are for network isolation, VM insights focuses on performance, and these don't address log collection configuration.
Not this one. Try another answer.
Why D is wrong
VM Insights focuses on performance metrics, not IIS log collection.
Not this one. Try another answer.
Why E is wrong
Private endpoints are for network connectivity, not the initial log collection configuration.
Question 36 Play from 1:05:50
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
To create a load balancing rule in Azure Load Balancer, you must first configure a frontend IP address (which receives incoming traffic) and a backend pool (which contains the VMs to receive the load-balanced traffic). The frontend IP address is the entry point for client requests, while the backend pool defines which resources (VM1 and VM2 in this case) will handle the distributed traffic. Both resources are mandatory prerequisites before a load balancing rule can be created.
Not this one. Try another answer.
Why B is wrong
An inbound NAT rule is optional and used for port forwarding to specific VMs, not required for basic load balancing rules.
Not this one. Try another answer.
Why C is wrong
A virtual network already exists as a prerequisite for the VMs themselves; it is not created as part of load balancer configuration.
Right, D is one of the answers.
Why D is right
To create a load balancing rule in Azure Load Balancer, you must first configure a frontend IP address (which receives incoming traffic) and a backend pool (which contains the VMs to receive the load-balanced traffic). The frontend IP address is the entry point for client requests, while the backend pool defines which resources (VM1 and VM2 in this case) will handle the distributed traffic. Both resources are mandatory prerequisites before a load balancing rule can be created.
Not this one. Try another answer.
Why E is wrong
A health probe is optional and used to monitor VM availability, but load balancing rules can be created without one (though not recommended for production).
Question 37 Play from 1:08:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An internal load balancer is not necessary for simple application-to-database connectivity.
Not this one. Try another answer.
Why B is wrong
Peering another virtual network does not help webapp1 access VNET1 unless webapp1 is itself connected to a peered network.
Right, C is the answer.
Why C is right
To enable webapp1 to access the MySQL database on VM1 in VNET1, you must connect webapp1 to VNET1. Azure Web Apps support VNet integration, which allows them to access resources within a virtual network, including VMs hosting databases.
Not this one. Try another answer.
Why D is wrong
Application Gateway is a load balancing and WAF solution, not a tool for enabling web app connectivity to database resources.
Question 38 Play from 1:10:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Out-of-Order Events tracks events that arrive in an unexpected sequence, not unprocessed events.
Not this one. Try another answer.
Why B is wrong
Output Events counts successfully processed and outputted events, the opposite of what needs to be measured.
Not this one. Try another answer.
Why C is wrong
Late Input Events tracks events arriving after the late arrival window, not the total of unprocessed events.
Right, D is the answer.
Why D is right
Backlogged Input Events metric indicates the number of input events that have been received but not yet processed by the Stream Analytics job. This directly measures events that were NOT processed, making it the appropriate metric to identify unprocessed events.
Question 39 Play from 1:11:43
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An inbound NAT (Network Address Translation) rule is the correct configuration for directing specific traffic (RDP connections on port 3389) to a single virtual machine (VM3) while other traffic is load-balanced across multiple VMs. NAT rules map external ports to internal resources on individual machines, making this ideal for RDP access to a specific VM. This differs from load balancing rules which distribute traffic across multiple backends.
Not this one. Try another answer.
Why B is wrong
Creating a new public load balancer is unnecessary and would complicate the infrastructure; NAT rules handle this within the existing load balancer.
Not this one. Try another answer.
Why C is wrong
A frontend IP configuration defines where traffic is received but does not control routing to specific VMs.
Not this one. Try another answer.
Why D is wrong
Load balancing rules distribute traffic across multiple VMs, not to a single VM as required for RDP to VM3 only.
Question 40 Play from 1:13:51
• Performance: Standard
• Replication: Zone-redundant storage (ZRS)
• Access tier (default): Cool
• Hierarchical namespace: Disabled You need to ensure that you can set Account kind for storage1 to BlockBlobStorage. Which setting should you modify first?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
BlockBlobStorage account kind requires Premium performance tier, not Standard performance. Since the current configuration has Standard performance selected, you must change the Performance setting first to Premium. Only after switching to Premium performance will the BlockBlobStorage option become available for the Account kind setting.
Not this one. Try another answer.
Why B is wrong
Replication type does not prevent selecting BlockBlobStorage; you can use ZRS with BlockBlobStorage.
Not this one. Try another answer.
Why C is wrong
Access tier setting does not restrict BlockBlobStorage selection; the access tier is independent of account kind.
Not this one. Try another answer.
Why D is wrong
Hierarchical namespace setting does not affect BlockBlobStorage availability; this setting is relevant for Data Lake Storage capabilities.
Question 41 Play from 1:15:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Service Map shows dependencies and connections between machines but does not specifically monitor latency metrics.
Not this one. Try another answer.
Why B is wrong
Connection troubleshoot is a diagnostic tool for troubleshooting specific connection issues, not for continuous latency monitoring.
Right, C is the answer.
Why C is right
Network Performance Monitor (NPM) is specifically designed to monitor latency, packet loss, and other network performance metrics between on-premises networks and Azure resources. It provides end-to-end network performance monitoring and can measure latency between your on-premises network and virtual machines in Azure. This is exactly what the requirement asks for.
Not this one. Try another answer.
Why D is wrong
Effective routes shows the routing configuration but does not measure or monitor actual latency.
Question 42 Play from 1:17:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The kind property specifies storage account type (e.g., StorageV2), not deployment destination.
Right, B is the answer.
Why B is right
In a Bicep file, the 'scope' property determines the target resource group or subscription where resources will be deployed. To deploy storage1 to RG1 specifically, you must set the scope property to target that resource group. The kind property relates to storage account type, sku relates to performance tier, and location specifies the Azure region-none of these control which resource group receives the deployment.
Not this one. Try another answer.
Why C is wrong
The sku property specifies performance and redundancy settings, not deployment target.
Not this one. Try another answer.
Why D is wrong
The location property specifies the Azure region, not which resource group receives the deployment.
Question 43 Play from 1:19:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An application security group is used for network security rule scoping, not for alert actions.
Not this one. Try another answer.
Why B is wrong
A security group with dynamic device membership is an Azure AD/Entra ID concept for identity management, not alert automation.
Right, C is the answer.
Why C is right
An action group is the Azure resource that defines what action to take when an alert rule is triggered. In this case, the action group would be configured to invoke the Azure Function App1 when the alert rule detects that VM1 has stopped.
Not this one. Try another answer.
Why D is wrong
An application group is used in Azure Virtual Desktop contexts, not for alert rule actions.
Question 44 Play from 1:21:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The access tier (hot, cool, archive) controls pricing and performance, not immutability.
Right, B is the answer.
Why B is right
To prevent new content added to a container from being modified for a specified period, you need to configure an access policy with immutability settings. Azure Storage supports time-based retention policies that lock blobs in a write-once-read-many (WORM) state, preventing any modifications for the specified duration (one year in this case).
Not this one. Try another answer.
Why C is wrong
Access control (IAM) manages who can access resources, not whether content can be modified after creation.
Not this one. Try another answer.
Why D is wrong
The access level (public/private) controls visibility, not modification restrictions.
Question 45 Play from 1:22:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cost Analysis shows spending patterns but does not specifically identify unattached resources.
Not this one. Try another answer.
Why B is wrong
Modifying Advisor configuration does not help identify unattached disks; you need to view recommendations.
Not this one. Try another answer.
Why C is wrong
Azure Storage Explorer is used for managing storage accounts and blobs, not for identifying unattached VM disks.
Right, D is the answer.
Why D is right
Azure Advisor provides Advisor Recommendations that include identification of unattached disks and other cost optimization opportunities. By viewing Advisor Recommendations in Azure Cost Management, you can get specific recommendations about which disks are unattached and can be deleted to reduce costs. This is a built-in feature designed exactly for this use case.
Question 46 Play from 1:24:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The operating system is defined in the template and cannot be changed during deployment.
Not this one. Try another answer.
Why B is wrong
Administrator username is typically defined in the template; if parameterized, it would be set before deployment, not during.
Not this one. Try another answer.
Why C is wrong
Virtual machine size is specified in the template and is not configurable at deployment time.
Right, D is the answer.
Why D is right
When deploying a VM from an ARM template, the template itself defines the OS, VM size, and other infrastructure properties that cannot be changed during deployment. However, the resource group must be specified at deployment time because it determines where the VM will be created. The resource group is a deployment-level parameter that must be selected or created during the deployment process.
Question 47 Play from 1:26:38
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An action group is the Azure Monitor resource that manages notifications and actions for alert rules. It enables you to define email recipients, SMS recipients, webhook endpoints, and other notification channels. Alert rules reference action groups to determine who receives notifications when an alert is triggered.
Not this one. Try another answer.
Why B is wrong
Mail-enabled security groups are Active Directory/Exchange objects not integrated with Azure Monitor alert mechanisms.
Not this one. Try another answer.
Why C is wrong
Distribution groups are Exchange/Microsoft 365 objects for email distribution, not Azure Monitor's native alert notification mechanism.
Not this one. Try another answer.
Why D is wrong
Microsoft 365 groups are collaboration tools; they are not the mechanism Azure Monitor uses for alert notifications.
Question 48 Play from 1:28:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A shared access signature (SAS) is for access control and authentication, not for configuring encryption keys at the container level.
Not this one. Try another answer.
Why B is wrong
Modifying the TLS version affects transport security, not data encryption at rest or per-container encryption configuration.
Not this one. Try another answer.
Why C is wrong
Rotating access keys affects all containers uniformly and does not allow different keys for different containers within the same account.
Right, D is the answer.
Why D is right
Encryption scopes allow you to configure different encryption keys for different containers within the same storage account. Before creating a container that requires a different encryption key than the default storage account key, you must first create an encryption scope that specifies the custom key to be used for that container.
Question 49 Play from 1:30:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
All VMs in a single Availability Zone would all fail if that zone's datacenter becomes unavailable.
Not this one. Try another answer.
Why B is wrong
Availability Sets only protect against rack-level failures within a single datacenter, not full datacenter outages.
Right, C is the answer.
Why C is right
Deploying each virtual machine in a separate Availability Zone ensures that at least two VMs remain available if a single datacenter becomes unavailable. Availability Zones are physically separated datacenters within an Azure region, providing protection against complete datacenter failure. This is superior to Availability Sets, which only protect against rack-level failures within a single datacenter.
Not this one. Try another answer.
Why D is wrong
Each VM in separate Availability Sets still places them in the same datacenter, not protecting against datacenter failure.
Question 50 Play from 1:32:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Elliptic Curve (EC) keys with P-384 curve are not supported for Azure Storage customer-managed encryption.
Not this one. Try another answer.
Why B is wrong
Elliptic Curve (EC) keys with P-521 curve are not supported for Azure Storage customer-managed encryption.
Not this one. Try another answer.
Why C is wrong
EC keys with either P-384 or P-521 curves are not supported; Azure Storage requires RSA keys for customer-managed encryption.
Not this one. Try another answer.
Why D is wrong
While RSA-4096 is supported, RSA keys must support multiple key sizes (2048, 3072, or 4096), not just 4096 alone.
Right, E is the answer.
Why E is right
Azure Storage customer-managed key encryption using Azure Key Vault supports RSA keys with key sizes of 2048, 3072, or 4096 bits. These are the only supported RSA key configurations for encrypting blob containers with customer-managed keys.
Question 51 Play from 1:34:53
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Traffic Analytics requires two primary resources: a Log Analytics workspace to store and analyze the flow log data, and a storage account to temporarily store the network flow logs before they are processed and sent to the workspace. These are the foundational requirements for Traffic Analytics in Network Watcher.
Not this one. Try another answer.
Why B is wrong
Azure Monitor workbooks are visualization tools but not required prerequisites for Traffic Analytics setup.
Right, C is one of the answers.
Why C is right
Traffic Analytics requires two primary resources: a Log Analytics workspace to store and analyze the flow log data, and a storage account to temporarily store the network flow logs before they are processed and sent to the workspace. These are the foundational requirements for Traffic Analytics in Network Watcher.
Not this one. Try another answer.
Why D is wrong
Microsoft Sentinel is a security information and event management solution, not a required component for Traffic Analytics.
Not this one. Try another answer.
Why E is wrong
Data Collection Rules are used for Azure Monitor agent data collection, not for Traffic Analytics configuration in Network Watcher.
Question 52 Play from 1:36:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SMB Multichannel is only supported on Premium performance tier Azure Files. The redundancy type (LRS, GRS, ZRS) does not affect SMB Multichannel support. While LRS is the minimum redundancy option, the question asks to minimize costs while supporting SMB Multichannel, and Premium with LRS provides this combination.
Not this one. Try another answer.
Why B is wrong
Standard performance tier does not support SMB Multichannel; only Premium tier does.
Not this one. Try another answer.
Why C is wrong
While Premium with GRS would work, it is more expensive than Premium with LRS and does not minimize costs.
Not this one. Try another answer.
Why D is wrong
Standard performance tier does not support SMB Multichannel regardless of redundancy type.
Question 53 Play from 1:38:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Files (A) is the appropriate storage service for Azure Container Instances that require persistent storage, particularly for databases like SQL Server. Azure Files provides SMB-based file shares that can be mounted to containers and persist data across container restarts and instances. Blob Storage is for unstructured data and does not provide the file system semantics needed for database instances. Queue and Table storage are not suitable for persistent file system requirements.
Not this one. Try another answer.
Why B is wrong
Azure Blob Storage does not provide file system semantics required for SQL Server persistent storage in containers.
Not this one. Try another answer.
Why C is wrong
Azure Queue Storage is for message queuing, not persistent storage for applications like SQL Server.
Not this one. Try another answer.
Why D is wrong
Azure Table Storage provides NoSQL key-value storage, not file system persistence needed for database instances.
Question 54 Play from 1:40:55
• IPv4 address space: 172.16.10.0/24
• Subnet name: Subnet1
• Subnet address range: 172.16.10.0/25 What is the maximum number of virtual machines that can connect to Subnet1?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
24 addresses is too small and does not correctly calculate the /25 subnet size.
Not this one. Try another answer.
Why B is wrong
25 addresses does not account for the correct subnet calculation or Azure's reserved addresses.
Right, C is the answer.
Why C is right
Subnet1 has an address range of 172.16.10.0/25, which provides 2^(32-25) = 128 total addresses. In Azure, the first address is the network address and the last address is the broadcast address, leaving 128 - 5 = 123 usable addresses (Azure also reserves 4 addresses for gateway, DNS, and Azure services).
Not this one. Try another answer.
Why D is wrong
128 is the total number of addresses in a /25 subnet, but does not account for Azure's reserved addresses.
Not this one. Try another answer.
Why E is wrong
251 addresses exceeds the /25 subnet capacity and is incorrect.
Question 55 Play from 1:43:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
kubectl is for managing workloads within Kubernetes, not configuring cluster autoscaler settings.
Right, B is one of the answers.
Why B is right
Cluster autoscaler for AKS can be configured using the Azure portal (GUI interface) and the 'az aks' command-line tool. The Azure portal provides a UI to enable autoscaling, and the az aks command allows programmatic configuration of autoscaling parameters for the cluster.
Not this one. Try another answer.
Why C is wrong
Set-AzVm cmdlet is for managing virtual machines, not AKS cluster autoscaling.
Right, D is one of the answers.
Why D is right
Cluster autoscaler for AKS can be configured using the Azure portal (GUI interface) and the 'az aks' command-line tool. The Azure portal provides a UI to enable autoscaling, and the az aks command allows programmatic configuration of autoscaling parameters for the cluster.
Not this one. Try another answer.
Why E is wrong
Set-AzAks cmdlet does not exist; the correct command is 'az aks' in the Azure CLI.
Question 56 Play from 1:44:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Application Insights Profiler is specifically designed to collect detailed performance traces and CPU profiling data from running applications. It captures call stacks and timing information to help identify performance bottlenecks in App Service web apps.
Not this one. Try another answer.
Why B is wrong
The Activity log tracks management operations on Azure resources, not application performance metrics or traces.
Not this one. Try another answer.
Why C is wrong
The Deployment center manages code deployments and source control integration, not performance monitoring.
Not this one. Try another answer.
Why D is wrong
Diagnose and solve problems provides troubleshooting guides and diagnostics, but is not the tool for continuous performance trace collection.
Question 57 Play from 1:46:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A data collection rule defines what data to collect but does not establish private connectivity to Azure Monitor.
Not this one. Try another answer.
Why B is wrong
A Log Analytics workspace is a destination for data but does not provide private link connectivity on its own.
Right, C is the answer.
Why C is right
An Azure Monitor Private Link Scope (AMPLS) must be created first to establish private connectivity between the virtual network and Azure Monitor services. This ensures all communication from VMs to Azure Monitor occurs through the private VNet connection rather than over the public internet.
Not this one. Try another answer.
Why D is wrong
A private endpoint is created as part of the AMPLS setup, but AMPLS must be created first to configure the private link scope.
Question 58 Play from 1:48:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Deleting backup data does not disable protection; the vault will not delete while backup items remain protected.
Not this one. Try another answer.
Why B is wrong
Modifying disaster recovery properties does not stop the backup protection required for vault deletion.
Not this one. Try another answer.
Why C is wrong
Modifying VM locks does not address the backup protection status that prevents vault deletion.
Right, D is the answer.
Why D is right
Before deleting a Recovery Services vault, you must stop the backup of each protected item (D). The vault cannot be deleted while it contains active backup items with ongoing protection. Deleting backup data alone is insufficient; the protection must be stopped first. Modifying disaster recovery properties or locks does not address the underlying requirement to cease protection. The backup items must have their protection stopped before vault deletion is permitted.
Question 59 Play from 1:50:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application Gateways are load balancers for traffic routing and are unnecessary for this deployment.
Right, B is the answer.
Why B is right
To minimize costs when deploying 10 web apps, you should use one App Service plan shared across all 10 web apps. An App Service plan defines the compute resources, and multiple web apps can share the same plan, reducing costs significantly compared to dedicated plans for each app.
Not this one. Try another answer.
Why C is wrong
Creating 10 App Service plans would maximize costs instead of minimizing them.
Not this one. Try another answer.
Why D is wrong
Azure Traffic Manager is for global load balancing and would add unnecessary cost.
Not this one. Try another answer.
Why E is wrong
A single Application Gateway is unnecessary and would increase costs without providing value for web app deployment.
Question 60 Play from 1:52:21
• Support up to 10 Gbps of traffic.
• Support availability zones.
• Support FastPath.
• Minimize costs. Which SKU should you deploy?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ERGw1AZ only supports up to 1 Gbps, which does not meet the 10 Gbps requirement.
Not this one. Try another answer.
Why B is wrong
ERGw2 does not support availability zones, which is a stated requirement.
Not this one. Try another answer.
Why C is wrong
ErGw3 lacks availability zone support despite supporting 10 Gbps and FastPath.
Right, D is the answer.
Why D is right
ERGw3AZ is the correct choice because it supports all requirements: it handles up to 10 Gbps traffic, supports availability zones (the AZ suffix indicates zone redundancy), supports FastPath for direct data plane connectivity, and represents the minimum cost option meeting all criteria. ERGw1AZ only supports up to 1 Gbps, ERGw2 does not support availability zones (no AZ suffix), and ErGw3 lacks availability zone support. The AZ designation is critical for the multi-availability-zone requirement.
Question 61 Play from 1:54:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application Insights Profiler is used for application performance profiling of specific apps, not for centralized user activity monitoring across subscriptions.
Not this one. Try another answer.
Why B is wrong
Access reviews are used for auditing access rights to resources, not for centrally monitoring all user activity.
Not this one. Try another answer.
Why C is wrong
Activity log filters allow you to view activity within a single subscription or context, not to centrally monitor across multiple subscriptions.
Right, D is the answer.
Why D is right
A Log Analytics workspace is the central repository for collecting and analyzing logs and activity data across multiple Azure subscriptions. By configuring the workspace to aggregate activity logs from all 10 subscriptions linked to the Azure AD tenant, you can centrally monitor user activity across the entire environment.
Question 62 Play from 1:56:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
One update domain means both VMs could be updated simultaneously, causing downtime.
Not this one. Try another answer.
Why B is wrong
Fault domains protect against hardware failures, not planned maintenance windows.
Not this one. Try another answer.
Why C is wrong
One fault domain provides no redundancy for planned maintenance events.
Right, D is the answer.
Why D is right
To ensure App1 remains available during planned maintenance, you need multiple update domains. Azure Availability Sets use update domains to stagger maintenance windows so that not all VMs are updated simultaneously. With two VMs, you need at least two update domains to guarantee one VM remains online during maintenance of the other. Fault domains protect against hardware failures, but update domains specifically address planned maintenance scenarios.
Question 63 Play from 1:58:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An activity log alert in Azure Monitor requires three components: a resource (or resource group) to monitor, a condition that specifies which events to alert on (such as 'resource lock removed'), and an action group that defines the notification action (sending an email).
Not this one. Try another answer.
Why B is wrong
Microsoft 365 groups are not used in Azure Monitor alert configuration; action groups are the correct construct.
Not this one. Try another answer.
Why C is wrong
A Log Analytics workspace is not a required component for activity log alerts; only resource, condition, and action group are needed.
Not this one. Try another answer.
Why D is wrong
Data collection endpoints and application security groups are not relevant to activity log alert creation.
Question 64 Play from 1:59:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Virtual machine extensions are not the target resource for event log monitoring in this context.
Not this one. Try another answer.
Why B is wrong
While the VM is the source, the alert rule itself targets the Log Analytics workspace where the events are stored.
Not this one. Try another answer.
Why C is wrong
Metric alert is a type of alert, not a target resource to monitor.
Right, D is the answer.
Why D is right
To create an alert rule that monitors System event log entries from a VM, you need to use Azure Log Analytics workspace as the target resource. Events from the VM are collected into a Log Analytics workspace, and alert rules are created against the data stored in that workspace using Kusto Query Language (KQL). The alert rule queries the Log Analytics workspace to detect when errors are logged.
Question 65 Play from 2:01:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
File shares cannot be encrypted using encryption scopes.
Right, B is the answer.
Why B is right
Encryption scopes in Azure Storage can only be used to encrypt containers (Blob Storage). File shares, tables, and queues cannot be encrypted using encryption scopes. Encryption scopes provide customer-managed key encryption specifically for blob storage containers.
Not this one. Try another answer.
Why C is wrong
File shares cannot be encrypted using encryption scopes.
Not this one. Try another answer.
Why D is wrong
Tables cannot be encrypted using encryption scopes.
Not this one. Try another answer.
Why E is wrong
File shares, tables, and queues cannot be encrypted using encryption scopes.
Not this one. Try another answer.
Why F is wrong
File shares, tables, and queues cannot be encrypted using encryption scopes.
Question 66 Play from 2:03:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
When adding a custom domain to Azure AD, the system requires DNS verification. Azure AD uses an MX record (or TXT record, though MX is the standard answer in this context) to verify domain ownership. You must create the specified DNS record in your public DNS zone so Azure can confirm you control the domain.
Not this one. Try another answer.
Why B is wrong
NSEC records are DNSSEC-related security records, not used for domain verification.
Not this one. Try another answer.
Why C is wrong
PTR records are used for reverse DNS lookups, not domain ownership verification.
Not this one. Try another answer.
Why D is wrong
RRSIG records are DNSSEC signatures, not used for Azure AD domain verification.
Question 67 Play from 2:05:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IP flow verify only checks if traffic is allowed or denied by NSG rules, not RTT measurements.
Not this one. Try another answer.
Why B is wrong
Connection troubleshoot performs a one-time diagnostic check but doesn't provide continuous RTT monitoring over time.
Right, C is the answer.
Why C is right
Connection Monitor is the Azure Network Watcher feature designed to monitor connectivity and measure network performance metrics including round-trip time (RTT) between two endpoints over time. It provides continuous monitoring and historical data about latency, packet loss, and other performance metrics, making it ideal for diagnosing slowness issues between VM1 and VM2.
Not this one. Try another answer.
Why D is wrong
NSG flow logs record traffic allowed/denied by network security groups but don't measure RTT or performance metrics.
Question 68 Play from 2:07:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Local network gateways are used for site-to-site VPN connections, not for routing between peered VNets through an NVA.
Right, B is the answer.
Why B is right
A route table with custom routes is the standard mechanism for directing traffic through a Network Virtual Appliance. By creating user-defined routes in VNet1 that specify the NVA as the next hop for traffic destined to VNet2's subnet, all traffic between the two networks will be forced through NetVA1 for inspection.
Not this one. Try another answer.
Why C is wrong
Service endpoints are used to restrict access to Azure services to specific subnets; they do not enable traffic inspection through an NVA.
Not this one. Try another answer.
Why D is wrong
IP address reservations are used to ensure specific IPs remain assigned to resources; they do not control traffic routing or inspection.
Question 69 Play from 2:09:29
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To enable Azure AD Premium P2 features for users, you must assign the purchased licenses to those users. This is done from the Licenses blade in Azure AD, where you can select users and allocate the premium licenses to them.
Not this one. Try another answer.
Why B is wrong
Adding users to groups does not grant them premium features; licenses must be explicitly assigned.
Not this one. Try another answer.
Why C is wrong
Adding enterprise applications is unrelated to assigning premium licenses to users.
Not this one. Try another answer.
Why D is wrong
Modifying directory roles does not activate premium feature access; licenses must be assigned.
Question 70 Play from 2:11:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Operational backup is for backup and recovery of blobs, not for creating secondary regional copies.
Not this one. Try another answer.
Why B is wrong
Object replication requires manual configuration and policy setup for each object, increasing administrative effort.
Right, C is the answer.
Why C is right
Geo-redundant storage (GRS) automatically creates a secondary copy of blob data in a different Azure region (East US in this case) whenever data is added to the primary region (North Europe). This meets the requirement of minimizing administrative effort by providing automatic, managed replication without manual configuration of object-level replication policies.
Not this one. Try another answer.
Why D is wrong
Lifecycle management rules manage blob transitions between storage tiers or deletion, not geographic replication.
Question 71 Play from 2:13:18
• Store and use the encryption key in KV1.
• Maintain encryption if VM1 is downloaded from Azure.
• Encrypt both the operating system disk and the data disks. Which encryption method should you use?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Customer-managed keys is a broader concept applicable to various services; Azure Disk Encryption specifically is the correct implementation for VM disk encryption.
Not this one. Try another answer.
Why B is wrong
Confidential disk encryption is for protecting data at rest on confidential VMs but is not the standard disk encryption method being requested.
Right, C is the answer.
Why C is right
Azure Disk Encryption (C) meets all requirements: it stores encryption keys in the Key Vault (KV1), maintains encryption even when the VM is downloaded from Azure (persistent encryption of the disk files themselves), and encrypts both OS and data disks. This is the standard solution for VM-level encryption with key management requirements.
Not this one. Try another answer.
Why D is wrong
Encryption at host encrypts data at the physical host level but does not meet the requirement to maintain encryption when the VM is downloaded.
Question 72 Play from 2:15:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Enabling Admin user does not enable geo-replication capability.
Not this one. Try another answer.
Why B is wrong
Adding a scope map is for managing access tokens, not for geo-replication.
Not this one. Try another answer.
Why C is wrong
Adding an automation task does not enable geo-replication functionality.
Not this one. Try another answer.
Why D is wrong
Cache rules are for registry content caching, not for geo-replication.
Right, E is the answer.
Why E is right
Geo-replication is only available in Premium SKU container registries. Since ContReg1 is Standard SKU, it must first be upgraded to Premium SKU (E) before geo-replication can be enabled. This is a prerequisite requirement.
Question 73 Play from 2:17:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Monitor is used for tracking metrics and logs but does not provide optimization recommendations.
Right, B is the answer.
Why B is right
Azure Advisor provides personalized recommendations to optimize Azure resources, including identifying underutilized virtual machines that can be resized to lower-cost service tiers. It is specifically designed to help reduce costs and improve performance across subscriptions.
Not this one. Try another answer.
Why C is wrong
Metrics shows performance data but does not identify underutilization or provide recommendations.
Not this one. Try another answer.
Why D is wrong
Customer insights is not a standard Azure blade for resource optimization.
Question 74 Play from 2:18:45
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Monitor Network Insights provides detailed metrics and visual representation of network topology, including connections between resources like ExpressRoute circuits, virtual networks, and subnets. It is specifically designed for comprehensive network monitoring and topology visualization.
Not this one. Try another answer.
Why B is wrong
A Data Collection Rule (DCR) is used to define what data to collect from resources, not to display dashboards or topology.
Not this one. Try another answer.
Why C is wrong
Azure Virtual Network Watcher provides network diagnostics and monitoring but is not the primary tool for topology visualization dashboards.
Not this one. Try another answer.
Why D is wrong
Log Analytics is a query and analysis platform; while it can display data, Network Insights is the dedicated tool for network topology and metrics dashboards.
Question 75 Play from 2:20:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Arc is for hybrid machine management but is not required for Connection Monitor functionality.
Not this one. Try another answer.
Why B is wrong
Network Watcher Agent extension is used for packet capture and network diagnostics, not Connection Monitor.
Not this one. Try another answer.
Why C is wrong
Log Analytics agent is deprecated and not the correct agent for Connection Monitor.
Right, D is the answer.
Why D is right
To use Connection Monitor to measure network latency between Azure VM1 and on-premises DC1, you need to install the Azure Monitor agent extension on DC1. The Azure Monitor agent is the current standard agent that enables monitoring capabilities and communication with Connection Monitor. While Azure Arc can manage on-premises machines, Arc is not required for Connection Monitor; the Log Analytics agent is deprecated; and the Network Watcher extension serves a different purpose.
Question 76 Play from 2:22:48
• An Azure Container Registry instance named Registry1
• An Azure Kubernetes Service (AKS) cluster named Cluster1 You create a container image named App1 on your administrative workstation. You need to deploy App1 to Cluster1. What should you do first?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Before deploying App1 to Cluster1, you must first push the container image from your workstation to Registry1 using 'docker push'. This makes the image available in the container registry where AKS can pull it for deployment. The Cluster1 is already created, and an App Service plan is not needed for Kubernetes deployments.
Not this one. Try another answer.
Why B is wrong
App Service plan is for Azure App Service, not for AKS deployments.
Not this one. Try another answer.
Why C is wrong
az acr build is used to build images in the registry, but your image is already built locally.
Not this one. Try another answer.
Why D is wrong
az aks create is for creating a new cluster; Cluster1 already exists.
Question 77 Play from 2:24:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Site-to-Site VPN is used to connect entire on-premises networks to Azure, not individual remote workers.
Not this one. Try another answer.
Why B is wrong
VNet-to-VNet VPN connects multiple Azure virtual networks together, not remote individual users.
Right, C is the answer.
Why C is right
Point-to-Site (P2S) VPN is the correct solution for remote workers who need to access resources in a single Azure virtual network. P2S VPNs establish secure connections from individual client computers to Azure, making it ideal for remote workers. Site-to-Site (S2S) VPN connects two networks together, VNet-to-VNet connects multiple virtual networks, Multi-Site connects multiple on-premises locations, and DirectAccess is for on-premises Windows domain environments.
Not this one. Try another answer.
Why D is wrong
DirectAccess is a Windows Server feature for on-premises domain-joined computers, not Azure cloud connectivity.
Not this one. Try another answer.
Why E is wrong
Multi-Site VPN connects multiple on-premises sites to Azure, not individual remote workers.
Question 78 Play from 2:27:16
• Support Azure Data Lake Storage.
• Minimize costs for infrequently accessed data.
• Automatically replicate data to a secondary Azure region. Which three options should you configure for storage1? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Zone-redundant storage (ZRS) replicates within a single region only, not to a secondary region as required.
Right, B is one of the answers.
Why B is right
To support Azure Data Lake Storage, you need the hierarchical namespace (E). To minimize costs for infrequently accessed data, use the Cool access tier (B). To automatically replicate to a secondary region, use geo-redundant storage (C). Together, these three options create a cost-optimized, geo-redundant Data Lake Storage setup.
Right, C is one of the answers.
Why C is right
To support Azure Data Lake Storage, you need the hierarchical namespace (E). To minimize costs for infrequently accessed data, use the Cool access tier (B). To automatically replicate to a secondary region, use geo-redundant storage (C). Together, these three options create a cost-optimized, geo-redundant Data Lake Storage setup.
Not this one. Try another answer.
Why D is wrong
The Hot access tier is for frequently accessed data and does not minimize costs for infrequently accessed data.
Right, E is one of the answers.
Why E is right
To support Azure Data Lake Storage, you need the hierarchical namespace (E). To minimize costs for infrequently accessed data, use the Cool access tier (B). To automatically replicate to a secondary region, use geo-redundant storage (C). Together, these three options create a cost-optimized, geo-redundant Data Lake Storage setup.
Question 79 Play from 2:29:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Connection Monitor is used for monitoring connectivity between resources, not for detecting suspicious network traffic patterns.
Not this one. Try another answer.
Why B is wrong
Data collection endpoints are used for Azure Monitor agent configuration, not specifically for NSG-based suspicious traffic detection.
Not this one. Try another answer.
Why C is wrong
Private links are for private connectivity to Azure services, not for configuring network traffic monitoring and alerting.
Right, D is the answer.
Why D is right
NSG flow logs are the foundational requirement for Azure Monitor Network Insights to function. These logs capture network traffic information flowing through the NSGs. Without enabling NSG flow logs, Network Insights cannot analyze traffic patterns and cannot trigger alerts for suspicious network activity.
Question 80 Play from 2:31:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Storage Account Contributor provides excessive permissions for account management, violating least privilege.
Right, B is one of the answers.
Why B is right
To allow Group1 members to upload files via the Azure portal with least privilege, you need: (B) Storage Blob Data Contributor, which grants permissions to read, write, and delete blobs, and (C) Reader, which allows viewing the storage account and navigating the portal interface. Reader provides the minimum permissions to access the portal, while Storage Blob Data Contributor provides the specific data operations needed for uploading. Storage Account Contributor grants too much access (account-level management), and Storage Blob Data Reader only allows reading, not uploading.
Right, C is one of the answers.
Why C is right
To allow Group1 members to upload files via the Azure portal with least privilege, you need: (B) Storage Blob Data Contributor, which grants permissions to read, write, and delete blobs, and (C) Reader, which allows viewing the storage account and navigating the portal interface. Reader provides the minimum permissions to access the portal, while Storage Blob Data Contributor provides the specific data operations needed for uploading. Storage Account Contributor grants too much access (account-level management), and Storage Blob Data Reader only allows reading, not uploading.
Not this one. Try another answer.
Why D is wrong
Contributor role grants overly broad permissions across all Azure resources, not adhering to least privilege.
Not this one. Try another answer.
Why E is wrong
Storage Blob Data Reader only allows reading blobs, not uploading/writing new content.
Question 81 Play from 2:33:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application security groups are used for logical grouping of resources within your network, not for identifying external Azure services like the portal.
Not this one. Try another answer.
Why B is wrong
IP Addresses would require manually identifying and maintaining all IP addresses used by Azure portal, which is impractical and maintenance-heavy.
Right, C is the answer.
Why C is right
Service Tags represent groups of IP addresses that Microsoft maintains for Azure services. The 'AzurePortal' service tag specifically identifies IP ranges used by the Azure portal. By setting the Destination to this service tag, you can create a deny rule that blocks access to the Azure portal while allowing access to other internet hosts.
Not this one. Try another answer.
Why D is wrong
Setting Destination to 'Any' would block all outbound connectivity, not just the portal.
Question 82 Play from 2:35:23
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A role assignment condition allows you to restrict access to blobs based on blob index tags. This is the Azure RBAC feature that enables attribute-based access control (ABAC) for Azure Storage, allowing users to view only specific blobs that match the conditions defined in their role assignments based on blob index tags.
Not this one. Try another answer.
Why B is wrong
Stored access policies are used for shared access signatures but do not provide tag-based filtering.
Not this one. Try another answer.
Why C is wrong
JIT VM access is for managing virtual machine access, not blob access.
Not this one. Try another answer.
Why D is wrong
While SAS can restrict access, it does not natively support blob index tag-based filtering in the way RBAC conditions do.
Question 83 Play from 2:37:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Only containers is incomplete; queues also support conditions.
Not this one. Try another answer.
Why B is wrong
File shares do not support RBAC conditions.
Not this one. Try another answer.
Why C is wrong
Tables do not support RBAC conditions.
Not this one. Try another answer.
Why D is wrong
Queues alone is incomplete; containers also support conditions.
Right, E is the answer.
Why E is right
RBAC conditions are supported for containers and queues in Azure Storage. These conditions allow fine-grained access control based on attributes like blob index tags and blob properties for containers, and queue message properties for queues. Tables and file shares do not support attribute-based conditions in RBAC role assignments.
Not this one. Try another answer.
Why F is wrong
Neither file shares nor tables support RBAC conditions.
Question 84 Play from 2:39:04
• Only allow read access.
• Allow both HTTP and HTTPS protocols.
• Apply access permissions to all the content in the container. What should you use?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An access policy manages stored access policies for containers but doesn't directly provide the protocol flexibility and read-only restriction as elegantly as SAS.
Right, B is the answer.
Why B is right
A Shared Access Signature (SAS) is the correct choice because it provides granular access control that can be configured for read-only access, supports both HTTP and HTTPS protocols, and can be scoped to apply permissions to all content in a container. SAS tokens offer time-limited, delegated access with specific permissions.
Not this one. Try another answer.
Why C is wrong
Azure CDN is for content delivery and caching, not for managing direct access permissions to container contents.
Not this one. Try another answer.
Why D is wrong
Access keys grant full administrative access to the entire storage account, not read-only access to a specific container.
Question 85 Play from 2:41:10
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Before backing up a VM to a different Recovery Services vault, you must first stop the existing backup in the current vault (RSV1). This prevents conflicts between two backup jobs for the same VM running simultaneously. Once the backup is stopped in RSV1, you can then configure and start a new backup to RSV2.
Not this one. Try another answer.
Why B is wrong
You cannot initiate a backup to RSV2 while the VM is still actively backed up to RSV1.
Not this one. Try another answer.
Why C is wrong
Disaster recovery replication settings are separate from backup configuration and do not address the backup vault conflict.
Not this one. Try another answer.
Why D is wrong
Exporting a backup job does not accomplish the goal of changing backup destinations; you must stop the existing backup first.
Question 86 Play from 2:43:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Table and Queue storage services are not supported by AzCopy; only Blob and File are.
Right, B is the answer.
Why B is right
AzCopy supports copying data to and from Blob Storage and File Storage only (B). These are the two storage services with AzCopy compatibility. Table and Queue storage services do not support AzCopy operations. AzCopy is optimized for high-performance bulk data transfer to these object and file storage tiers.
Not this one. Try another answer.
Why C is wrong
Blob storage is supported, but Queue is not supported by AzCopy.
Not this one. Try another answer.
Why D is wrong
While File is supported, Blob storage is also supported, making this incomplete.
Not this one. Try another answer.
Why E is wrong
Table and Queue storage services do not support AzCopy operations.
Question 87 Play from 2:45:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An XML manifest file is generated by the WAImportExport tool after drive preparation, not created before preparing drives.
Right, B is one of the answers.
Why B is right
The Azure Import/Export service requires two CSV files: a dataset CSV file (B) that lists the files and directories to be imported, and a driveset CSV file (E) that contains drive information and mapping details. These files define what data goes on which drives. Manifest XML files are generated during the process, not created beforehand. JSON configuration files and PowerShell scripts are not standard Import/Export requirements.
Not this one. Try another answer.
Why C is wrong
A JSON configuration file is not a standard requirement for Azure Import/Export jobs.
Not this one. Try another answer.
Why D is wrong
A PowerShell PS1 script is not a mandatory file for preparing Import/Export drives.
Right, E is one of the answers.
Why E is right
The Azure Import/Export service requires two CSV files: a dataset CSV file (B) that lists the files and directories to be imported, and a driveset CSV file (E) that contains drive information and mapping details. These files define what data goes on which drives. Manifest XML files are generated during the process, not created beforehand. JSON configuration files and PowerShell scripts are not standard Import/Export requirements.
Question 88 Play from 2:47:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port 80 is used for HTTP web traffic, not file sharing.
Not this one. Try another answer.
Why B is wrong
Port 443 is used for HTTPS web traffic and some REST APIs, not SMB file sharing.
Right, C is the answer.
Why C is right
Azure File Shares use the SMB (Server Message Block) protocol, which operates on port 445. This port must be open in outbound firewall rules on client computers to enable mapping and accessing Azure file shares from Windows 10 machines. SMB is the standard protocol for network file sharing in Windows environments.
Not this one. Try another answer.
Why D is wrong
Port 3389 is used for Remote Desktop Protocol (RDP), not file sharing.
Question 89 Play from 2:48:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Service endpoints are for accessing Azure services, not related to point-to-site VPN configuration.
Not this one. Try another answer.
Why B is wrong
Resetting GW1 will not change its policy-based nature to route-based, which is the fundamental requirement.
Right, C is one of the answers.
Why C is right
A policy-based gateway cannot support point-to-site connections; only route-based gateways support P2S. Therefore, you must delete the existing policy-based gateway (GW1) and create a new route-based virtual network gateway. These are the two required actions to enable point-to-site VPN functionality from an on-premises computer to VNet1.
Not this one. Try another answer.
Why D is wrong
Adding a connection to a policy-based gateway does not enable point-to-site capability.
Right, E is one of the answers.
Why E is right
A policy-based gateway cannot support point-to-site connections; only route-based gateways support P2S. Therefore, you must delete the existing policy-based gateway (GW1) and create a new route-based virtual network gateway. These are the two required actions to enable point-to-site VPN functionality from an on-premises computer to VNet1.
Not this one. Try another answer.
Why F is wrong
Adding public IP address space to VNet1 is not relevant to point-to-site VPN configuration.
Question 90 Play from 2:51:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Organization relationships settings do not enable AKS-Azure AD integration.
Right, B is the answer.
Why B is right
To grant access to an AKS cluster to Azure AD users, the cluster must be integrated with Azure AD. The first step is to create an OAuth 2.0 authorization endpoint in Azure AD, which enables AKS to authenticate users against the Azure AD tenant. This establishes the trust relationship between AKS1 and contoso.com, allowing the administrator to subsequently grant access to contoso.com users. The other options do not address the fundamental authentication integration needed.
Not this one. Try another answer.
Why C is wrong
Recreating AKS1 is not the solution; configuration is needed, not recreation.
Not this one. Try another answer.
Why D is wrong
Creating a namespace in AKS does not enable Azure AD authentication.
Question 91 Play from 2:53:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure HDInsight is for big data processing and analytics, not for individual VM monitoring.
Right, B is the answer.
Why B is right
Linux Diagnostic Extension (LAD) 3.0 is the correct tool for monitoring metrics and logs on Linux virtual machines in Azure. It collects performance metrics and diagnostic data from the VM and sends it to Azure Monitor or storage accounts for analysis.
Not this one. Try another answer.
Why C is wrong
AzurePerformanceDiagnostics extension is primarily for Windows VMs, not Linux.
Not this one. Try another answer.
Why D is wrong
Azure Analysis Services is for data analytics and business intelligence, not VM monitoring.
Question 92 Play from 2:55:06
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Key Vault is the proper service for securely storing sensitive values like administrative passwords without exposing them in plain text in Resource Manager templates. Creating an access policy on the Key Vault allows the ARM template to reference the secret securely during deployment of the 100 virtual machines.
Not this one. Try another answer.
Why B is wrong
Storage accounts are designed for data storage, not secure credential management; they do not provide the encryption and access control needed for administrative passwords.
Not this one. Try another answer.
Why C is wrong
Recovery Services vaults are for backup and disaster recovery, not credential storage.
Not this one. Try another answer.
Why D is wrong
Azure AD Identity Protection is for detecting identity risks, not for storing passwords or secrets.
Question 93 Play from 2:57:09
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Azure Custom Script Extension allows you to run scripts on virtual machines after deployment, making it the appropriate choice to install NGINX on all VMs in a scale set during or after provisioning via an ARM template.
Not this one. Try another answer.
Why B is wrong
Deployment Center is used for App Service deployments, not virtual machine scale sets
Not this one. Try another answer.
Why C is wrong
Microsoft Entra Application Proxy is for hybrid access scenarios, not for installing software on VMs
Not this one. Try another answer.
Why D is wrong
The Publish-AzVMDscConfiguration cmdlet is for PowerShell DSC but Custom Script Extension is more straightforward for this scenario
Question 94 Play from 2:59:02
• Container name: cont1
• SKU: Standard
• OS type: Windows
• Networking type: Public
• Memory (GiB): 2.5
• Number of CPU cores: 2 You discover that the Private setting for Networking type is unavailable. You need to ensure that cont1 can be configured to use private networking. Which setting should you change?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Memory allocation does not restrict private networking availability.
Not this one. Try another answer.
Why B is wrong
Networking type cannot be changed to enable private networking; the underlying OS type is the limiting factor.
Not this one. Try another answer.
Why C is wrong
CPU cores do not affect private networking availability.
Right, D is the answer.
Why D is right
Private networking for Azure Container Instances is only available with Linux container instances, not Windows. Since the configuration specifies OS type: Windows, the Private networking option is unavailable. Changing the OS type to Linux would enable the Private networking option.
Not this one. Try another answer.
Why E is wrong
SKU does not determine whether private networking is available for the OS type selected.
Question 95 Play from 3:00:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port 22 is for SSH, which is not the primary communication port for Azure Bastion.
Right, B is the answer.
Why B is right
Azure Bastion uses HTTPS (port 443) to securely communicate with the backend virtual machines. When configuring an NSG to allow inbound access through Bastion, port 443 must be permitted to enable the Bastion host to establish secure connections to the managed VMs.
Not this one. Try another answer.
Why C is wrong
Port 389 is for LDAP and is not used by Azure Bastion.
Not this one. Try another answer.
Why D is wrong
Port 8080 is a non-standard HTTP port and is not used by Azure Bastion for management connections.
Question 96 Play from 3:02:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A read-only lock prevents modifications to the storage account but does not warn about SAS expiry periods.
Not this one. Try another answer.
Why B is wrong
An alert rule monitors metrics and can trigger notifications, but it does not warn during SAS generation itself.
Not this one. Try another answer.
Why C is wrong
Lifecycle management rules control blob retention and deletion policies, not SAS token generation warnings.
Right, D is the answer.
Why D is right
The 'Allow recommended upper limit for shared access signature (SAS) expiry interval' setting, when enabled, displays a warning message to users when they attempt to generate a SAS token with an expiration time exceeding seven days. This is a storage account security feature designed to promote best practices. Read-only locks prevent modifications but don't warn about SAS duration. Alert rules monitor metrics but don't provide generation-time warnings. Lifecycle management rules manage blob retention, not SAS generation.
Question 97 Play from 3:05:15
• Region: East US
• Virtual network: VNet1
• NIC network security group: NSG1 You need to monitor VM1 traffic by using Traffic Analytics. Which settings should you configure?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Diagnostic settings for VM1 do not enable traffic monitoring; NSG flow logs are required.
Right, B is the answer.
Why B is right
To monitor VM1 traffic using Traffic Analytics, you must enable NSG flow logs on NSG1, which is the network security group attached to VM1's NIC. Traffic Analytics analyzes NSG flow log data to provide network traffic insights. Diagnostic settings for VMs, diagnostic settings for NSGs directly, and VM Insights do not enable Traffic Analytics; NSG flow logs are the specific requirement.
Not this one. Try another answer.
Why C is wrong
Diagnostic settings for NSG1 are not the correct configuration; NSG flow logs must be enabled.
Not this one. Try another answer.
Why D is wrong
VM Insights provides performance metrics but does not enable Traffic Analytics.
Question 98 Play from 3:07:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A records point to IP addresses and are used after verification; asuid does not use A records for verification.
Right, B is the answer.
Why B is right
When configuring a custom domain for an Azure App Service, you must first verify ownership of the domain. This is done by creating a TXT record named 'asuid' (or 'asuid.[subdomain]') containing the domain verification ID provided by Azure. This proves you control the domain before binding it to the web app.
Not this one. Try another answer.
Why C is wrong
CNAME records are used for the actual domain binding (like www.contoso.com pointing to contoso.azurewebsites.net), not for the asuid verification record.
Not this one. Try another answer.
Why D is wrong
A TXT record named www.contoso.com is not the correct verification method; the verification TXT record must be named asuid.
Question 99 Play from 3:09:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Automatic scaling is a simpler option but does not provide the ability to set specific CPU threshold conditions
Right, B is the answer.
Why B is right
Rules Based scaling in the Scale out method settings allows you to create custom metrics-based rules, such as automatically scaling when CPU usage exceeds a specified threshold like 80 percent. This is the correct configuration method for conditional auto-scaling.
Not this one. Try another answer.
Why C is wrong
Premium P1 is a scale-up option (changing plan tier), not a scale-out method for auto-scaling instances
Not this one. Try another answer.
Why D is wrong
Standard S1 is a scale-up option, not related to auto-scaling configuration
Not this one. Try another answer.
Why E is wrong
Manual scaling requires human intervention and does not provide automatic scaling based on CPU metrics
Question 100 Play from 3:11:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Management Groups are for managing policies and access across multiple subscriptions and resource groups, not for organizing VMs within a single resource group by department.
Not this one. Try another answer.
Why B is wrong
Creating a resource group per department would fragment the existing RG1 structure and contradict the stated requirement that all VMs are located in RG1.
Right, C is the answer.
Why C is right
Tags are the appropriate mechanism for associating metadata with Azure resources like VMs without restructuring the resource hierarchy. Since all VMs are already in RG1 and the company wants to maintain this structure while simply identifying which department owns each VM, tags provide a lightweight, flexible solution. Tags allow for arbitrary key-value pairs that enable categorization, billing tracking, and automation without moving resources between groups.
Not this one. Try another answer.
Why D is wrong
Modifying VM settings does not provide a systematic way to track and organize VMs by department for reporting or billing purposes.
Transcript
Play from 00:00 Question 1. You have an Azure subscription that contains a storage account named storage1. You need to ensure that the access keys for storage1 rotate automatically. What should you configure? Here are the options. Option A. a backup vault. Option B. redundancy for storage1. Option C. lifecycle management for storage1. Option D. an Azure key vault. Option E. a Recovery Services vault. Pause the video now if you want time to think about the answer.
The correct answer is D. an Azure key vault. Azure Key Vault provides managed storage account features that enable automatic rotation of storage account access keys. Key Vault can manage the lifecycle of storage keys and rotate them automatically on a configured schedule, ensuring security best practices are maintained without manual intervention. Now, why are the other options incorrect? Option A is incorrect. Backup vaults are used for data backup and recovery, not for key rotation management. Option B is incorrect. Redundancy configuration does not address key rotation requirements. Option C is incorrect. Lifecycle management handles blob storage retention policies, not access key rotation. Option E is incorrect. Recovery Services vaults are designed for backup and disaster recovery, not for key rotation management. Therefore, D, an Azure key vault, is the correct answer.
Play from 01:44 Question 2. You have an Azure virtual machine named VM1 that runs Windows Server 2019. The VM was deployed using default drive settings. You sign in to VM1 as a user named User1 and perform the following actions: • Create files on drive C. • Create files on drive D. • Modify the screen saver timeout. • Change the desktop background. You plan to redeploy VM1. Which changes will be lost after you redeploy VM1? Here are the options. Option A. the modified screen saver timeout. Option B. the new desktop background. Option C. the new files on drive D. Option D. the new files on drive C. Pause the video now if you want time to think about the answer.
The correct answer is C. the new files on drive D. In Azure VMs with default settings, drive D is the temporary storage drive (resource disk) which is wiped when the VM is redeployed or shut down. Drive C is the OS disk which persists across redeployments, and user settings like screen saver and desktop background are stored on the OS disk. Only files on the temporary drive D will be lost after redeployment. Now, why are the other options incorrect? Option A is incorrect. Screen saver timeout is a user setting stored in the Windows profile on the C drive, which persists. Option B is incorrect. Desktop background is stored in the user profile on the C drive and persists across redeployment. Option D is incorrect. Files on drive C (the OS disk) are persistent and survive redeployment. Therefore, C, the new files on drive D, is the correct answer.
Play from 03:47 Question 3. You have three offices and an Azure subscription that contains an Azure Active Directory (Azure AD) tenant. You need to grant user management permissions to a local administrator in each office. What should you use? Here are the options. Option A. Azure AD roles. Option B. administrative units. Option C. access packages in Azure AD entitlement management. Option D. Azure roles. Pause the video now if you want time to think about the answer.
The correct answer is B. administrative units. Administrative units in Azure AD allow you to delegate user management permissions to local administrators for specific organizational units without granting tenant-wide permissions. Each office can have an administrative unit with its own administrator, enabling granular permission delegation across multiple locations. Now, why are the other options incorrect? Option A is incorrect. Azure AD roles apply at the tenant level and cannot be scoped to specific offices or organizational units. Option C is incorrect. Access packages in entitlement management are for managing access to resources and groups, not for delegating administrative permissions. Option D is incorrect. Azure roles are for managing Azure subscription resources, not for managing Azure AD users. Therefore, B, administrative units, is the correct answer.
Show full transcriptShow less
Play from 05:30 Question 4. You have an Azure subscription that contains a web app named webapp1. You need to add a custom domain named www.contoso.com to webapp1. What should you do first? Here are the options. Option A. Create a DNS record. Option B. Add a connection string. Option C. Upload a certificate. Option D. Stop webapp1. Pause the video now if you want time to think about the answer.
The correct answer is A. Create a DNS record. Before adding a custom domain to a web app, you must first create a DNS record that points the custom domain to the web app's IP address or domain. This DNS configuration is the prerequisite step. You would then verify the domain ownership in Azure Portal. Now, why are the other options incorrect? Option B is incorrect. Connection strings are for database connectivity and are unrelated to custom domain setup. Option C is incorrect. A certificate is needed for HTTPS/SSL but only after the domain is added and verified. Option D is incorrect. There is no need to stop the web app to add a custom domain. Therefore, A, Create a DNS record, is the correct answer.
Play from 06:59 Question 5. You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege. What should you do? Here are the options. Option A. Assign the Owner role to the developers. Option B. Configure app-level credentials for FTPS. Option C. Assign the Website Contributor role to the developers. Option D. Configure user-level credentials for FTPS. Pause the video now if you want time to think about the answer.
The correct answer is C. Assign the Website Contributor role to the developers. The Website Contributor role is the principle of least privilege role needed for developers to deploy content to App Service via Web Deploy while using Azure AD credentials. It grants deployment permissions without Owner-level access. This role is specifically designed for web app deployment scenarios and aligns with least privilege by not granting broader subscription-level permissions. Now, why are the other options incorrect? Option A is incorrect. Owner role grants excessive permissions beyond what is needed for Web Deploy deployment. Option B is incorrect. App-level FTPS credentials do not leverage Azure AD credentials as required. Option D is incorrect. User-level FTPS credentials do not leverage Azure AD credentials as required. Therefore, C, Assign the Website Contributor role to the developers, is the correct answer.
Play from 08:52 Question 6. You have an Azure subscription that contains a Recovery Services vault named Vault1. You need to enable multi-user authorization (MAU) for Vault1. Which resource should you create first? Here are the options. Option A. an administrative unit. Option B. a managed identity. Option C. a resource guard. Option D. a custom Azure role. Pause the video now if you want time to think about the answer.
The correct answer is C. a resource guard. Multi-user authorization (MAU) for Azure Recovery Services vaults requires a Resource Guard to be created first. The Resource Guard is a separate Azure resource that acts as a gatekeeper for critical operations on the vault, enabling multi-user authorization by requiring approval from designated users before sensitive operations can be performed. Now, why are the other options incorrect? Option A is incorrect. Administrative units are used for Azure AD management and role delegation, not for Recovery Services vault authorization. Option B is incorrect. Managed identities are used for Azure resource authentication, not for implementing multi-user authorization on vaults. Option D is incorrect. Custom Azure roles define permissions but do not enable the multi-user authorization mechanism itself; a Resource Guard is the foundational requirement. Therefore, C, a resource guard, is the correct answer.
Play from 10:37 Question 7. You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five days and daily backup for 14 days. RSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago. You need to recover VM1 to a point eight days ago. The solution must minimize downtime. What should you do first? Here are the options. Option A. Deallocate VM1. Option B. Restore VM1 by using the Replace existing restore configuration option. Option C. Delete VM1. Option D. Restore VM1 by using the Create new restore configuration option. Pause the video now if you want time to think about the answer.
The correct answer is B. Restore VM1 by using the Replace existing restore configuration option. The backup policy retains daily backups for 14 days, and the website was last updated 8 days ago, which falls within the retention window. Using the Replace existing restore option will restore VM1 in-place, replacing the current disks with the backup from 8 days ago, which minimizes downtime compared to creating a new VM. You do not need to deallocate or delete VM1 first when using Replace existing, as the operation handles this automatically. Now, why are the other options incorrect? Option A is incorrect. You do not need to deallocate VM1 before using Replace existing; Azure handles the necessary steps. Option C is incorrect. Deleting VM1 is not necessary and would cause additional downtime. Option D is incorrect. Creating new would result in longer downtime and requires additional configuration; Replace existing is faster. Therefore, B, Restore VM1 by using the Replace existing restore configuration option, is the correct answer.
Play from 12:54 Question 8. You administer a solution in Azure that is currently having performance issues. You need to find the cause of the performance issues pertaining to metrics on the Azure infrastructure. Which of the following is the tool you should use? Here are the options. Option A. Azure Traffic Analytics. Option B. Azure Monitor. Option C. Azure Activity Log. Option D. Azure Advisor. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Monitor. Azure Monitor is the primary tool for collecting, analyzing, and acting on metrics and performance data from Azure infrastructure. It provides detailed metrics about VM performance, resource utilization, and infrastructure health. Azure Traffic Analytics monitors network traffic patterns, Azure Activity Log tracks management operations and resource changes, and Azure Advisor provides optimization recommendations, but none of these are the primary tool for real-time infrastructure metrics analysis. Now, why are the other options incorrect? Option A is incorrect. Azure Traffic Analytics focuses on network traffic analysis, not general infrastructure metrics. Option C is incorrect. Azure Activity Log tracks management events and changes, not performance metrics. Option D is incorrect. Azure Advisor provides recommendations but does not directly diagnose performance issues through metrics. Therefore, B, Azure Monitor, is the correct answer.
Play from 14:43 Question 9. You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible. What should you do? Here are the options. Option A. Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine. Option B. Deploy five virtual machines. Modify the Size setting for each virtual machine. Option C. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode. Option D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode. Pause the video now if you want time to think about the answer.
The correct answer is D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode. Deploying a virtual machine scale set with ScaleSetVM orchestration mode is the quickest way to deploy five instances. ScaleSetVM mode provides optimized deployment for scale sets and is faster than deploying individual VMs and manually configuring them. This approach also automatically manages the instances as a unified scale set. Now, why are the other options incorrect? Option A is incorrect. Deploying five individual VMs and then modifying Availability Zones for each is time-consuming and not the intended use of scale sets. Option B is incorrect. Deploying five individual VMs and modifying sizes manually is slower than using a scale set. Option C is incorrect. VM orchestration mode is less efficient for scale sets than ScaleSetVM mode. Therefore, D, Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode, is the correct answer.
Play from 16:46 Question 10. You have a general-purpose v1 Azure Storage account named storage1 that uses locally-redundant storage (LRS). You need to ensure that the data in the storage account is protected if a zone fails. The solution must minimize costs and administrative effort. What should you do first? Here are the options. Option A. Create a new storage account. Option B. Configure object replication rules. Option C. Upgrade the account to general-purpose v2. Option D. Modify the Replication setting of storage1. Pause the video now if you want time to think about the answer.
The correct answer is C. Upgrade the account to general-purpose v2. To protect data against zone failures while minimizing cost and effort, you must first upgrade the storage account from general-purpose v1 to general-purpose v2. Only general-purpose v2 accounts support zone-redundant storage (ZRS) and geo-zone-redundant storage (GZRS), which provide zone-failure protection. This is a prerequisite before you can change the replication settings from LRS to a zone-redundant option. Now, why are the other options incorrect? Option A is incorrect. Creating a new storage account adds administrative overhead and is not the first step; upgrading is simpler. Option B is incorrect. Object replication does not protect against zone failures; it replicates objects between accounts. Option D is incorrect. You cannot modify the replication setting to a zone-redundant option without first upgrading to general-purpose v2. Therefore, C, Upgrade the account to general-purpose v2, is the correct answer.
Play from 18:52 Question 11. You have an Azure virtual machine (VM) that has a single data disk. You have been tasked with attaching this data disk to another Azure VM. You need to make sure that your strategy allows for the virtual machines to be offline for the least amount of time possible. Which of the following is the action you should take FIRST? Here are the options. Option A. Stop the VM that includes the data disk. Option B. Stop the VM that the data disk must be attached to. Option C. Detach the data disk. Option D. Delete the VM that includes the data disk. Pause the video now if you want time to think about the answer.
The correct answer is C. Detach the data disk. Azure supports hot-detaching a data disk from a running VM and hot-attaching it to another running VM. Detaching the disk first therefore avoids stopping either VM, which keeps downtime to a minimum. Now, why are the other options incorrect? Option A is incorrect. Stopping the source VM is unnecessary because data disks can be detached while the VM is running. Option B is incorrect. Stopping the target VM is unnecessary because data disks can be attached while the VM is running. Option D is incorrect. Deleting the source VM is destructive and not required to move a data disk. Therefore, C, Detach the data disk, is the correct answer.
Play from 20:34 Question 12. You have an Azure web app named webapp1. Users report that they often experience HTTP 500 errors when they connect to webapp1. You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details. What should you do first? Here are the options. Option A. From webapp1, enable Web server logging. Option B. From Azure Monitor, create a workbook. Option C. From Azure Monitor, create a Service Health alert. Option D. From webapp1, turn on Application Logging. Pause the video now if you want time to think about the answer.
The correct answer is A. From webapp1, enable Web server logging. To capture HTTP error details for web app connection errors, you should enable Web server logging on webapp1. Web server logging records detailed HTTP requests and responses including status codes, headers, and error information. This logging is written to storage and can be accessed in real-time by developers. This is the first step to diagnose HTTP 500 errors. Now, why are the other options incorrect? Option B is incorrect. Creating a workbook in Azure Monitor is useful for visualization but does not capture the underlying error details without logging first. Option C is incorrect. Service Health alerts notify about Azure platform status, not application-specific connection errors. Option D is incorrect. Application Logging logs application-level events but may not capture all HTTP server-level details that Web server logging provides. Therefore, A, From webapp1, enable Web server logging, is the correct answer.
Play from 22:42 Question 13. You have an Azure subscription. You are deploying an Azure Kubernetes Service (AKS) cluster that will contain multiple pods. The pods will use kubernet networking. You need to restrict network traffic between the pods. What should you configure on the AKS cluster? Here are the options. Option A. the Azure network policy. Option B. the Calico network policy. Option C. pod security policies. Option D. an application security group. Pause the video now if you want time to think about the answer.
The correct answer is B. the Calico network policy. Calico network policy is the correct solution for restricting network traffic between pods in an AKS cluster. Calico provides fine-grained network segmentation and policy enforcement at the pod level, allowing you to define which pods can communicate with each other. Azure network policy is not a standard AKS feature, pod security policies control pod execution constraints rather than network traffic, and application security groups operate at the VM level, not the pod level. Now, why are the other options incorrect? Option A is incorrect. Azure network policy is not the standard solution for pod-to-pod traffic restriction in AKS. Option C is incorrect. Pod security policies control pod execution contexts and permissions, not network traffic between pods. Option D is incorrect. Application security groups operate at the virtual machine level, not at the Kubernetes pod level. Therefore, B, the Calico network policy, is the correct answer.
Play from 24:34 Question 14. You have an Azure subscription. You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients connect to App1 by using the IP address of the pod. For the AKS cluster, you need to choose a network type that will support App1. What should you choose? Here are the options. Option A. kubenet. Option B. Azure Container Networking Interface (CNI). Option C. Hybrid Connection endpoints. Option D. Azure Private Link. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Container Networking Interface (CNI). Azure Container Networking Interface (CNI) assigns IP addresses from the subnet address space directly to pods, making pods routable from on-premises networks via VPN or ExpressRoute. This allows on-premises clients to connect directly to pod IPs. Kubenet uses NAT and internal IP addressing, which would require additional routing configuration or service exposure. Now, why are the other options incorrect? Option A is incorrect. Kubenet does not assign IPs directly from the subnet; pods receive internal IPs that require NAT, preventing direct on-premises access to pod IPs. Option C is incorrect. Hybrid Connection endpoints are for App Service hybrid connections, not for AKS pod networking. Option D is incorrect. Azure Private Link is for private endpoint access to Azure services, not for AKS pod-level networking. Therefore, B, Azure Container Networking Interface (CNI), is the correct answer.
Play from 26:35 Question 15. You have an Azure subscription. You plan to create an Azure container registry named ContReg1. You need to ensure that you can push and pull signed images for ContReg1. What should you do for ContReg1? Here are the options. Option A. Enable encryption by using a customer-managed key. Option B. Create a connected registry. Option C. Add a token. Option D. Enable content trust. Pause the video now if you want time to think about the answer.
The correct answer is D. Enable content trust. Content trust in Azure Container Registry enables Docker Content Trust, which allows you to sign images when pushing them and verify signatures when pulling them. This is the feature specifically designed to ensure you can push and pull signed images. Now, why are the other options incorrect? Option A is incorrect. Encryption with customer-managed keys protects data at rest but does not enable image signing Option B is incorrect. A connected registry is for hybrid scenarios and does not directly enable content trust Option C is incorrect. Adding a token provides authentication credentials but does not enable image signing functionality Therefore, D, Enable content trust, is the correct answer.
Play from 28:15 Question 16. You have an Azure subscription that contains an Azure container registry named ContReg1. You enable the Admin user for ContReg1. Which username can you use to sign in to ContReg1? Here are the options. Option A. root. Option B. admin. Option C. administrator. Option D. ContReg1. Pause the video now if you want time to think about the answer.
The correct answer is D. ContReg1. When you enable the Admin user for an Azure Container Registry, the username is the registry name itself. In this case, with a registry named ContReg1, you would use 'ContReg1' as the username to sign in. Now, why are the other options incorrect? Option A is incorrect. root is not a valid username for ACR authentication Option B is incorrect. admin is not the correct username format for ACR Option C is incorrect. administrator is not a valid ACR username Therefore, D, ContReg1, is the correct answer.
Play from 29:35 Question 17. You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network. Which tunneling protocol should you use? Here are the options. Option A. IKEv1. Option B. PPTP. Option C. IKEv2. Option D. L2TP. Pause the video now if you want time to think about the answer.
The correct answer is C. IKEv2. IKEv2 is the correct tunneling protocol for route-based Site-to-Site VPN connections. IKEv2 is the modern IPsec protocol version that supports route-based VPN, provides better mobility support, faster reconnection, and is the recommended protocol for production VPN gateways in Azure. IKEv1 is older and primarily used with policy-based VPNs. PPTP and L2TP are legacy protocols with security limitations and are not recommended for modern VPN implementations in Azure. Now, why are the other options incorrect? Option A is incorrect. IKEv1 is an older protocol primarily used for policy-based VPNs, not route-based VPNs. Option B is incorrect. PPTP is a legacy protocol with known security vulnerabilities and is not recommended for modern Azure VPN deployments. Option D is incorrect. L2TP is a legacy protocol that lacks the modern security features and performance benefits of IKEv2 for route-based VPNs. Therefore, C, IKEv2, is the correct answer.
Play from 31:26 Question 18. You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do? Here are the options. Option A. Create an NS record named research in the adatum.com zone. Option B. Create a PTR record named research in the adatum.com zone. Option C. Modify the SOA record of adatum.com. Option D. Create an A record named *.research in the adatum.com zone. Pause the video now if you want time to think about the answer.
The correct answer is A. Create an NS record named research in the adatum.com zone. To delegate a subdomain to a different DNS server, you create an NS (Name Server) record in the parent zone pointing to the authoritative nameservers of the subdomain. In this case, an NS record named 'research' in the adatum.com zone will delegate research.adatum.com to the specified DNS server. This is the standard method for DNS delegation. Now, why are the other options incorrect? Option B is incorrect. PTR records are used for reverse DNS lookups, not subdomain delegation. Option C is incorrect. The SOA record identifies the primary nameserver but does not perform delegation. Option D is incorrect. An A record creates a host record and cannot delegate a subdomain to another DNS server. Therefore, A, Create an NS record named research in the adatum.com zone, is the correct answer.
Play from 33:26 Question 19. You have an Azure subscription that contains a storage account named storage1. You need to allow access to storage1 from selected networks and your home office. The solution must minimize administrative effort. What should you do first for storage1? Here are the options. Option A. Add a private endpoint. Option B. Modify the Public network access settings. Option C. Select Internet routing. Option D. Modify the Access Control (IAM) settings. Pause the video now if you want time to think about the answer.
The correct answer is B. Modify the Public network access settings. Modifying the Public network access settings is the first step to restrict access to storage1 from selected networks and specific locations. This allows you to configure the storage account firewall to allow access only from specified virtual networks, IP addresses (including your home office), and services while blocking all other public access. This minimizes administrative overhead compared to managing individual private endpoints. Private endpoints are an advanced option for complete network isolation but require more infrastructure. IAM settings control authentication and authorization, not network access. Internet routing is not relevant to this scenario. Now, why are the other options incorrect? Option A is incorrect. Adding a private endpoint would work but is more complex and requires more administrative effort than simply modifying public network access settings. Option C is incorrect. Internet routing selection does not address the requirement to restrict access from selected networks. Option D is incorrect. IAM settings control identity and access management permissions, not network-level access restrictions. Therefore, B, Modify the Public network access settings, is the correct answer.
Play from 35:39 Question 20. You are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription. You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA). Which of the following should you use to create the virtual machine? Here are the options. Option A. The New-AzureRmVm cmdlet. Option B. The New-AzVM cmdlet. Option C. The Create-AzVM cmdlet. Option D. The az vm create command. Pause the video now if you want time to think about the answer.
The correct answer is D. The az vm create command. The az vm create command from Azure CLI is the appropriate tool for creating custom VM deployments with advanced configurations such as adding trusted root certification authorities. Azure CLI provides the flexibility needed for custom deployments and allows passing parameters for certificate configuration. PowerShell cmdlets like New-AzureRmVm and New-AzVM are less suitable for this scenario as they require more complex scripting for custom certificate installation. Now, why are the other options incorrect? Option A is incorrect. New-AzureRmVm is an older cmdlet that has been superseded and is less flexible for custom deployments. Option B is incorrect. New-AzVM is a PowerShell cmdlet that requires additional scripting steps to configure custom certificates compared to CLI approaches. Option C is incorrect. Create-AzVM is not a standard Azure PowerShell cmdlet; the correct cmdlet is New-AzVM. Therefore, D, The az vm create command, is the correct answer.
Play from 37:40 Question 21. You create an App Service plan named Plan1 and an Azure web app named webapp1. You discover that the option to create a staging slot is unavailable. You need to create a staging slot for Plan1. What should you do first? Here are the options. Option A. From Plan1, scale up the App Service plan. Option B. From webapp1, modify the Application settings. Option C. From webapp1, add a custom domain. Option D. From Plan1, scale out the App Service plan. Pause the video now if you want time to think about the answer.
The correct answer is A. From Plan1, scale up the App Service plan. Staging slots are only available in the Standard tier or higher of App Service plans. If the staging slot option is unavailable, the plan is likely in the Free or Basic tier. Scaling up the App Service plan to Standard or Premium will enable the staging slot feature. Now, why are the other options incorrect? Option B is incorrect. Application settings modifications do not affect staging slot availability, which is determined by the pricing tier. Option C is incorrect. Custom domains do not enable staging slots; tier level is the controlling factor. Option D is incorrect. Scaling out (adding more instances) does not change the pricing tier; you must scale up to a higher tier. Therefore, A, From Plan1, scale up the App Service plan, is the correct answer.
Play from 39:26 Question 22. You have an Azure subscription that contains a user named User1. You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege. Which role-based access control (RBAC) role should you assign to User1? Here are the options. Option A. Owner. Option B. Virtual Machine Contributor. Option C. Contributor. Option D. Virtual Machine Administrator Login. Pause the video now if you want time to think about the answer.
The correct answer is C. Contributor. The Contributor role allows users to create and manage all types of Azure resources, including virtual machines and virtual networks, while explicitly preventing role assignment. This aligns with the principle of least privilege because it grants necessary permissions without the elevated privilege of the Owner role. Virtual Machine Contributor is too narrow (only VMs), Administrator Login is for login access, and Owner violates least privilege. Now, why are the other options incorrect? Option A is incorrect. Owner grants excessive permissions beyond what is needed. Option B is incorrect. Virtual Machine Contributor only allows VM management, not virtual network management. Option D is incorrect. Virtual Machine Administrator Login is for remote access, not resource deployment. Therefore, C, Contributor, is the correct answer.
Play from 41:12 Question 23. You have an Azure subscription. You create a routing table named RT1. You need to add a route to RT1 that specifies the next hop IP address. Which next hop type should you select? Here are the options. Option A. Internet. Option B. Virtual network gateway. Option C. Virtual network. Option D. Virtual appliance. Pause the video now if you want time to think about the answer.
The correct answer is D. Virtual appliance. When you need to specify an explicit next hop IP address in a routing table, you must select 'Virtual appliance' as the next hop type. This allows you to define a specific IP address (such as a firewall or network virtual appliance) as the destination for traffic matching that route. Now, why are the other options incorrect? Option A is incorrect. Internet as a next hop type routes traffic to the internet, not to a specific IP address. Option B is incorrect. Virtual network gateway is used for VPN or ExpressRoute connections, not for specifying arbitrary IP addresses. Option C is incorrect. Virtual network as a next hop type routes to destinations within the virtual network, not to a specific external IP address. Therefore, D, Virtual appliance, is the correct answer.
Play from 42:56 Question 24. You sign up for Azure Active Directory (Azure AD) Premium P2. You need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain. What should you configure in Azure AD? Here are the options. Option A. Device settings from the Devices blade. Option B. Providers from the MFA Server blade. Option C. User settings from the Users blade. Option D. General settings from the Groups blade. Pause the video now if you want time to think about the answer.
The correct answer is A. Device settings from the Devices blade. To configure a user as a local administrator on all computers joined to an Azure AD domain, you must configure Device settings from the Devices blade in Azure AD. This setting controls which users are granted administrative privileges on Azure AD-joined devices. Now, why are the other options incorrect? Option B is incorrect. The MFA Server blade is for multi-factor authentication configuration, not device administrator assignment. Option C is incorrect. User settings do not control local device administrator privileges. Option D is incorrect. Group settings are not the location for configuring device-level administrative access. Therefore, A, Device settings from the Devices blade, is the correct answer.
Play from 44:38 Question 25. You have an Azure web app named App1. You need to monitor the availability of App1 by using a multi-step web test. What should you use in Azure Monitor? Here are the options. Option A. Azure Service Health. Option B. Azure Application Insights. Option C. the Diagnostic settings. Option D. metrics. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Application Insights. Azure Application Insights is the correct tool for monitoring web app availability using multi-step web tests. Multi-step web tests allow you to record and simulate user workflows across multiple steps, and Application Insights will monitor availability and performance from multiple geographic locations. This feature is a core part of Application Insights. Now, why are the other options incorrect? Option A is incorrect. Azure Service Health monitors Azure platform service status, not application availability. Option C is incorrect. Diagnostic settings are used to configure where logs and metrics are sent, not to create tests. Option D is incorrect. Metrics provide performance data but do not provide the multi-step web testing capability. Therefore, B, Azure Application Insights, is the correct answer.
Play from 46:15 Question 26. You plan to back up an Azure virtual machine named VM1. You discover that the Backup Pre-Check status displays a status of Warning. What is a possible cause of the Warning status? Here are the options. Option A. VM1 is stopped. Option B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed. Option C. VM1 has an unmanaged disk. Option D. A Recovery Services vault is unavailable. Pause the video now if you want time to think about the answer.
The correct answer is B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed. A Warning status in Backup Pre-Check typically indicates a condition that does not prevent backup but should be remedied for optimal backup operation. The absence of the latest Azure VM Agent version is a common cause of Warning status, as the agent is required for backup functionality and older versions may have compatibility or feature issues. Now, why are the other options incorrect? Option A is incorrect. A stopped VM can still be backed up; this would not typically produce a Warning status. Option C is incorrect. Unmanaged disks can be backed up and would not specifically cause a Warning status for this scenario. Option D is incorrect. An unavailable Recovery Services vault would produce an Error status, not a Warning. Therefore, B, VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed, is the correct answer.
Play from 48:06 Question 27. You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort. What should you do? Here are the options. Option A. Create a user-defined route from VNET1 to VNET3. Option B. Create an NSG and associate the NSG to VM1 and VM4. Option C. Assign VM4 an IP address of 10.0.1.5/24. Option D. Establish peering between VNET1 and VNET3. Pause the video now if you want time to think about the answer.
The correct answer is D. Establish peering between VNET1 and VNET3. VNet peering is the solution that minimizes administrative effort to enable communication between VM1 in VNET1 and VM4 in VNET3. Peering establishes direct, low-latency connectivity between virtual networks through Azure's backbone infrastructure without requiring user-defined routes or manual route management, and it requires minimal configuration overhead. Now, why are the other options incorrect? Option A is incorrect. User-defined routes require manual route table creation and management, which increases administrative effort compared to the automatic connectivity provided by peering. Option B is incorrect. NSGs control traffic filtering but do not establish connectivity between VMs in different VNets; connectivity must exist first before NSGs can filter it. Option C is incorrect. Reassigning VM4's IP address does not create connectivity between VNets; IP address assignment is independent of inter-VNet communication requirements. Therefore, D, Establish peering between VNET1 and VNET3, is the correct answer.
Play from 50:17 Question 28. You have an Azure subscription that contains three virtual machines named VM1, VM2, and VM3. All the virtual machines are in an availability set named AVSet1. You need to scale up VM1 to a new virtual machine size, but the intended size is unavailable. What should you do first? Here are the options. Option A. Create a proximity placement group. Option B. Deallocate VM1. Option C. Convert AvSet1 into a managed availability set. Option D. Shut down VM3 and VM3. Pause the video now if you want time to think about the answer.
The correct answer is B. Deallocate VM1. Before resizing a VM to a larger size in an availability set, you must deallocate it first. Deallocation releases the VM's current hardware resources, which may allow Azure to move it to a cluster where the larger size is available. Creating a proximity placement group, converting to managed availability sets, or shutting down other VMs does not address the core issue of hardware availability for the new size. Now, why are the other options incorrect? Option A is incorrect. Creating a proximity placement group does not help when a specific VM size is unavailable. Option C is incorrect. Converting to managed availability sets is not necessary to resize a VM. Option D is incorrect. Shutting down other VMs does not make the intended size available for VM1. Therefore, B, Deallocate VM1, is the correct answer.
Play from 52:12 Question 29. Your company has three virtual machines (VMs) that are included in an availability set. You try to resize one of the VMs, which returns an allocation failure message. It is imperative that the VM is resized. Which of the following actions should you take? Here are the options. Option A. You should only stop one of the VMs. Option B. You should stop two of the VMs. Option C. You should stop all three VMs. Option D. You should remove the necessary VM from the availability set. Pause the video now if you want time to think about the answer.
The correct answer is C. You should stop all three VMs. When a VM resize fails due to allocation constraints within an availability set, you must stop all VMs in the availability set before attempting the resize. This deallocates all compute resources and allows the Azure fabric to reallocate them with the new VM size. Stopping all three VMs ensures that the resize operation has sufficient resources and can succeed, as the reallocation can consolidate the resources needed for the resized VM. Now, why are the other options incorrect? Option A is incorrect. Stopping only one VM does not free sufficient resources for the reallocation to succeed. Option B is incorrect. Stopping two VMs is insufficient; all VMs in the availability set must be stopped. Option D is incorrect. Removing the VM from the availability set is unnecessary and removes the resiliency benefits; stopping all VMs is the proper solution. Therefore, C, You should stop all three VMs, is the correct answer.
Play from 54:18 Question 30. You have an Azure subscription that contains a storage account. The account stores website data. You need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location. What should you configure? Here are the options. Option A. private endpoints. Option B. Azure Firewall rules. Option C. Routing preference. Option D. load balancing. Pause the video now if you want time to think about the answer.
The correct answer is C. Routing preference. Routing preference allows you to choose how traffic is routed to Azure Storage. When configured to use Microsoft network routing, traffic is directed through Microsoft's global network infrastructure to the closest point of presence (POP), optimizing latency and performance for geographically distributed users. Now, why are the other options incorrect? Option A is incorrect. Private endpoints provide private connectivity but do not optimize routing to the geographically closest POP. Option B is incorrect. Azure Firewall rules control traffic filtering, not routing preferences to closest locations. Option D is incorrect. Load balancing distributes traffic across multiple targets but does not select the closest geographic POP. Therefore, C, Routing preference, is the correct answer.
Play from 55:53 Question 31. You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System Center Service Manager. Subscription1 contains a virtual machine named VM1. You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent. What should you do first? Here are the options. Option A. Create an automation runbook. Option B. Deploy a function app. Option C. Deploy the IT Service Management Connector (ITSM). Option D. Create a notification. Pause the video now if you want time to think about the answer.
The correct answer is C. Deploy the IT Service Management Connector (ITSM). To create alerts in an on-premises Service Manager when Azure VM conditions are met, you must first deploy the IT Service Management Connector (ITSM). This connector establishes the bridge between Azure Monitor alerts and Service Manager, allowing alerts to be triggered in the on-premises system. Now, why are the other options incorrect? Option A is incorrect. Creating an automation runbook alone does not establish the connection to Service Manager; the ITSM Connector is the prerequisite. Option B is incorrect. A function app is not the correct tool for integrating with Service Manager. Option D is incorrect. Creating a notification in Azure is not sufficient without the ITSM Connector to forward alerts to Service Manager. Therefore, C, Deploy the IT Service Management Connector (ITSM), is the correct answer.
Play from 57:56 Question 32. You have an Azure virtual machine named VM1 and an Azure key vault named Vault1. On VM1, you plan to configure Azure Disk Encryption to use a key encryption key (KEK). You need to prepare Vault1 for Azure Disk Encryption. Which two actions should you perform on Vault1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Select Azure Virtual machines for deployment. Option B. Create a new key. Option C. Create a new secret. Option D. Configure a key rotation policy. Option E. Select Azure Disk Encryption for volume encryption. Pause the video now if you want time to think about the answer.
The correct answers are B. Create a new key, and E. Select Azure Disk Encryption for volume encryption. To prepare a Key Vault for Azure Disk Encryption using a Key Encryption Key (KEK), you must create a new key (B) to serve as the KEK that will encrypt the disk encryption keys, and enable the vault for Azure Disk Encryption for volume encryption (E) by setting the appropriate access policy. The Key Vault must be explicitly configured to allow Azure Disk Encryption to access it for encryption operations. Now, why are the other options incorrect? Option A is incorrect. Selecting Azure Virtual Machines for deployment is a general vault setting not specifically required for disk encryption preparation. Option C is incorrect. Creating a secret is not necessary; disk encryption requires keys, not secrets. Option D is incorrect. Configuring a key rotation policy is optional and not required for initial disk encryption setup. Therefore, B and E are the correct answers.
Play from 1:00:14 Question 33. You have an Azure subscription. You plan to deploy a container. You need to recommend which Azure services can scale the container automatically. What should you recommend? Here are the options. Option A. Azure Container Apps only. Option B. Azure Container Instances only. Option C. Azure Container Apps or Azure App Service only. Option D. Azure Container Instances or Azure App Service only. Option E. Azure Container Apps, Azure Container Instances, or Azure App Service. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Container Apps or Azure App Service only. Azure Container Apps and Azure App Service both support automatic scaling. Container Instances does not have built-in auto-scaling capabilities, so the correct answer includes only Container Apps and App Service. Now, why are the other options incorrect? Option A is incorrect. While Container Apps can auto-scale, App Service also supports this capability Option B is incorrect. Container Instances does not support automatic scaling Option D is incorrect. Container Instances does not have auto-scaling; App Service does but Container Instances does not Option E is incorrect. Container Instances cannot auto-scale automatically Therefore, C, Azure Container Apps or Azure App Service only, is the correct answer.
Play from 1:02:00 Question 34. You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1. You plan to create an Azure container instance named container1. You need to be able to configure DNS name label scope reuse for container1. What should you configure for container1? Here are the options. Option A. the private networking type. Option B. the public networking type. Option C. a new subnet on VNet1. Option D. a confidential SKU. Pause the video now if you want time to think about the answer.
The correct answer is B. the public networking type. DNS name label scope reuse is a feature available only for container instances deployed with public networking type. This setting allows you to reuse DNS labels across resource groups when using public networking, which is not available with private networking. Now, why are the other options incorrect? Option A is incorrect. Private networking type does not support DNS name label scope reuse configuration. Option C is incorrect. Creating a new subnet on VNet1 is related to private networking and does not enable DNS name label scope reuse. Option D is incorrect. Confidential SKU is unrelated to DNS naming configuration capabilities. Therefore, B, the public networking type, is the correct answer.
Play from 1:03:42 Question 35. You have an Azure subscription. The subscription contains 10 virtual machines that run Windows Server. Each virtual machine hosts a website in IIS and has the Azure Monitor Agent installed. You need to collect the IIS logs from each virtual machine and store them in a Log Analytics workspace. What should you configure first? Here are the options. Option A. a data collection endpoint. Option B. an Azure Monitor Private Link Scope (AMPLS). Option C. Diagnostic settings. Option D. VM insights. Option E. a private endpoint. Pause the video now if you want time to think about the answer.
The correct answer is C. Diagnostic settings. To collect IIS logs from virtual machines with Azure Monitor Agent and store them in Log Analytics, you must first configure Diagnostic settings. Diagnostic settings define what data sources (including IIS logs) are collected and where they are sent. A data collection endpoint is created after deciding what to collect, AMPLS and private endpoints are for network isolation, VM insights focuses on performance, and these don't address log collection configuration. Now, why are the other options incorrect? Option A is incorrect. Data collection endpoint is configured after determining what to collect, not before. Option B is incorrect. AMPLS is for network isolation and access control, not the initial log collection setup. Option D is incorrect. VM Insights focuses on performance metrics, not IIS log collection. Option E is incorrect. Private endpoints are for network connectivity, not the initial log collection configuration. Therefore, C, Diagnostic settings, is the correct answer.
Play from 1:05:50 Question 36. You have an Azure subscription that contains two virtual machines named VM1 and VM2. You create an Azure load balancer. You plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2. Which two additional load balancer resources should you create before you can create the load balancing rule? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. a frontend IP address. Option B. an inbound NAT rule. Option C. a virtual network. Option D. a backend pool. Option E. a health probe. Pause the video now if you want time to think about the answer.
The correct answers are A. a frontend IP address, and D. a backend pool. To create a load balancing rule in Azure Load Balancer, you must first configure a frontend IP address (which receives incoming traffic) and a backend pool (which contains the VMs to receive the load-balanced traffic). The frontend IP address is the entry point for client requests, while the backend pool defines which resources (VM1 and VM2 in this case) will handle the distributed traffic. Both resources are mandatory prerequisites before a load balancing rule can be created. Now, why are the other options incorrect? Option B is incorrect. An inbound NAT rule is optional and used for port forwarding to specific VMs, not required for basic load balancing rules. Option C is incorrect. A virtual network already exists as a prerequisite for the VMs themselves; it is not created as part of load balancer configuration. Option E is incorrect. A health probe is optional and used to monitor VM availability, but load balancing rules can be created without one (though not recommended for production). Therefore, A and D are the correct answers.
Play from 1:08:07 Question 37. You have an Azure web app named webapp1. You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1. You need to ensure that webapp1 can access the data hosted on VM1. What should you do? Here are the options. Option A. Deploy an internal load balancer. Option B. Peer VNET1 to another virtual network. Option C. Connect webapp1 to VNET1. Option D. Deploy an Azure Application Gateway. Pause the video now if you want time to think about the answer.
The correct answer is C. Connect webapp1 to VNET1. To enable webapp1 to access the MySQL database on VM1 in VNET1, you must connect webapp1 to VNET1. Azure Web Apps support VNet integration, which allows them to access resources within a virtual network, including VMs hosting databases. Now, why are the other options incorrect? Option A is incorrect. An internal load balancer is not necessary for simple application-to-database connectivity. Option B is incorrect. Peering another virtual network does not help webapp1 access VNET1 unless webapp1 is itself connected to a peered network. Option D is incorrect. Application Gateway is a load balancing and WAF solution, not a tool for enabling web app connectivity to database resources. Therefore, C, Connect webapp1 to VNET1, is the correct answer.
Play from 1:10:06 Question 38. You have an Azure subscription that contains an Azure Stream Analytics job named Job1. You need to monitor input events for Job1 to identify the number of events that were NOT processed. Which metric should you use? Here are the options. Option A. Out-of-Order Events. Option B. Output Events. Option C. Late Input Events. Option D. Backlogged Input Events. Pause the video now if you want time to think about the answer.
The correct answer is D. Backlogged Input Events. Backlogged Input Events metric indicates the number of input events that have been received but not yet processed by the Stream Analytics job. This directly measures events that were NOT processed, making it the appropriate metric to identify unprocessed events. Now, why are the other options incorrect? Option A is incorrect. Out-of-Order Events tracks events that arrive in an unexpected sequence, not unprocessed events. Option B is incorrect. Output Events counts successfully processed and outputted events, the opposite of what needs to be measured. Option C is incorrect. Late Input Events tracks events arriving after the late arrival window, not the total of unprocessed events. Therefore, D, Backlogged Input Events, is the correct answer.
Play from 1:11:43 Question 39. You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3. You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only. What should you configure? Here are the options. Option A. an inbound NAT rule. Option B. a new public load balancer for VM3. Option C. a frontend IP configuration. Option D. a load balancing rule. Pause the video now if you want time to think about the answer.
The correct answer is A. an inbound NAT rule. An inbound NAT (Network Address Translation) rule is the correct configuration for directing specific traffic (RDP connections on port 3389) to a single virtual machine (VM3) while other traffic is load-balanced across multiple VMs. NAT rules map external ports to internal resources on individual machines, making this ideal for RDP access to a specific VM. This differs from load balancing rules which distribute traffic across multiple backends. Now, why are the other options incorrect? Option B is incorrect. Creating a new public load balancer is unnecessary and would complicate the infrastructure; NAT rules handle this within the existing load balancer. Option C is incorrect. A frontend IP configuration defines where traffic is received but does not control routing to specific VMs. Option D is incorrect. Load balancing rules distribute traffic across multiple VMs, not to a single VM as required for RDP to VM3 only. Therefore, A, an inbound NAT rule, is the correct answer.
Play from 1:13:51 Question 40. You have an Azure subscription. In the Azure portal, you plan to create a storage account named storage1 that will have the following settings: • Performance: Standard • Replication: Zone-redundant storage (ZRS) • Access tier (default): Cool • Hierarchical namespace: Disabled You need to ensure that you can set Account kind for storage1 to BlockBlobStorage. Which setting should you modify first? Here are the options. Option A. Performance. Option B. Replication. Option C. Access tier (default). Option D. Hierarchical namespace. Pause the video now if you want time to think about the answer.
The correct answer is A. Performance. BlockBlobStorage account kind requires Premium performance tier, not Standard performance. Since the current configuration has Standard performance selected, you must change the Performance setting first to Premium. Only after switching to Premium performance will the BlockBlobStorage option become available for the Account kind setting. Now, why are the other options incorrect? Option B is incorrect. Replication type does not prevent selecting BlockBlobStorage; you can use ZRS with BlockBlobStorage. Option C is incorrect. Access tier setting does not restrict BlockBlobStorage selection; the access tier is independent of account kind. Option D is incorrect. Hierarchical namespace setting does not affect BlockBlobStorage availability; this setting is relevant for Data Lake Storage capabilities. Therefore, A, Performance, is the correct answer.
Play from 1:15:57 Question 41. You have an existing Azure subscription that contains 10 virtual machines. You need to monitor the latency between your on-premises network and the virtual machines. What should you use? Here are the options. Option A. Service Map. Option B. Connection troubleshoot. Option C. Network Performance Monitor. Option D. Effective routes. Pause the video now if you want time to think about the answer.
The correct answer is C. Network Performance Monitor. Network Performance Monitor (NPM) is specifically designed to monitor latency, packet loss, and other network performance metrics between on-premises networks and Azure resources. It provides end-to-end network performance monitoring and can measure latency between your on-premises network and virtual machines in Azure. This is exactly what the requirement asks for. Now, why are the other options incorrect? Option A is incorrect. Service Map shows dependencies and connections between machines but does not specifically monitor latency metrics. Option B is incorrect. Connection troubleshoot is a diagnostic tool for troubleshooting specific connection issues, not for continuous latency monitoring. Option D is incorrect. Effective routes shows the routing configuration but does not measure or monitor actual latency. Therefore, C, Network Performance Monitor, is the correct answer.
Play from 1:17:43 Question 42. You have an Azure subscription that contains a resource group named RG1. You plan to create a storage account named storage1. You have a Bicep file named File1. You need to modify File1 so that it can be used to automate the deployment of storage1 to RG1. Which property should you modify? Here are the options. Option A. kind. Option B. scope. Option C. sku. Option D. location. Pause the video now if you want time to think about the answer.
The correct answer is B. scope. In a Bicep file, the 'scope' property determines the target resource group or subscription where resources will be deployed. To deploy storage1 to RG1 specifically, you must set the scope property to target that resource group. The kind property relates to storage account type, sku relates to performance tier, and location specifies the Azure region-none of these control which resource group receives the deployment. Now, why are the other options incorrect? Option A is incorrect. The kind property specifies storage account type (e.g., StorageV2), not deployment destination. Option C is incorrect. The sku property specifies performance and redundancy settings, not deployment target. Option D is incorrect. The location property specifies the Azure region, not which resource group receives the deployment. Therefore, B, scope, is the correct answer.
Play from 1:19:37 Question 43. You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1. You need to create an alert rule that will run App1 if VM1 stops. What should you create for the alert rule? Here are the options. Option A. an application security group. Option B. a security group that has dynamic device membership. Option C. an action group. Option D. an application group. Pause the video now if you want time to think about the answer.
The correct answer is C. an action group. An action group is the Azure resource that defines what action to take when an alert rule is triggered. In this case, the action group would be configured to invoke the Azure Function App1 when the alert rule detects that VM1 has stopped. Now, why are the other options incorrect? Option A is incorrect. An application security group is used for network security rule scoping, not for alert actions. Option B is incorrect. A security group with dynamic device membership is an Azure AD/Entra ID concept for identity management, not alert automation. Option D is incorrect. An application group is used in Azure Virtual Desktop contexts, not for alert rule actions. Therefore, C, an action group, is the correct answer.
Play from 1:21:14 Question 44. You have an Azure Storage account named storage1 that contains a blob container named container1. You need to prevent new content added to container1 from being modified for one year. What should you configure? Here are the options. Option A. the access tier. Option B. an access policy. Option C. the Access control (IAM) settings. Option D. the access level. Pause the video now if you want time to think about the answer.
The correct answer is B. an access policy. To prevent new content added to a container from being modified for a specified period, you need to configure an access policy with immutability settings. Azure Storage supports time-based retention policies that lock blobs in a write-once-read-many (WORM) state, preventing any modifications for the specified duration (one year in this case). Now, why are the other options incorrect? Option A is incorrect. The access tier (hot, cool, archive) controls pricing and performance, not immutability. Option C is incorrect. Access control (IAM) manages who can access resources, not whether content can be modified after creation. Option D is incorrect. The access level (public/private) controls visibility, not modification restrictions. Therefore, B, an access policy, is the correct answer.
Play from 1:22:53 Question 45. You have an Azure subscription that contains 100 virtual machines. You regularly create and delete virtual machines. You need to identify unattached disks that can be deleted. What should you do? Here are the options. Option A. From Azure Cost Management, view Cost Analysis. Option B. From Azure Advisor, modify the Advisor configuration. Option C. From Microsoft Azure Storage Explorer, view the Account Management properties. Option D. From Azure Cost Management, view Advisor Recommendations. Pause the video now if you want time to think about the answer.
The correct answer is D. From Azure Cost Management, view Advisor Recommendations. Azure Advisor provides Advisor Recommendations that include identification of unattached disks and other cost optimization opportunities. By viewing Advisor Recommendations in Azure Cost Management, you can get specific recommendations about which disks are unattached and can be deleted to reduce costs. This is a built-in feature designed exactly for this use case. Now, why are the other options incorrect? Option A is incorrect. Cost Analysis shows spending patterns but does not specifically identify unattached resources. Option B is incorrect. Modifying Advisor configuration does not help identify unattached disks; you need to view recommendations. Option C is incorrect. Azure Storage Explorer is used for managing storage accounts and blobs, not for identifying unattached VM disks. Therefore, D, From Azure Cost Management, view Advisor Recommendations, is the correct answer.
Play from 1:24:49 Question 46. You have an Azure virtual machine named VM1 that runs Windows Server 2019. You save VM1 as a template named Template1 to the Azure Resource Manager library. You plan to deploy a virtual machine named VM2 from Template1. What can you configure during the deployment of VM2? Here are the options. Option A. operating system. Option B. administrator username. Option C. virtual machine size. Option D. resource group. Pause the video now if you want time to think about the answer.
The correct answer is D. resource group. When deploying a VM from an ARM template, the template itself defines the OS, VM size, and other infrastructure properties that cannot be changed during deployment. However, the resource group must be specified at deployment time because it determines where the VM will be created. The resource group is a deployment-level parameter that must be selected or created during the deployment process. Now, why are the other options incorrect? Option A is incorrect. The operating system is defined in the template and cannot be changed during deployment. Option B is incorrect. Administrator username is typically defined in the template; if parameterized, it would be set before deployment, not during. Option C is incorrect. Virtual machine size is specified in the template and is not configurable at deployment time. Therefore, D, resource group, is the correct answer.
Play from 1:26:38 Question 47. You have an Azure subscription that contains a virtual machine named VM1. You plan to deploy an Azure Monitor alert rule that will trigger an alert when CPU usage on VM1 exceeds 80 percent. You need to ensure that the alert rule sends an email message to two users named User1 and User2. What should you create for Azure Monitor? Here are the options. Option A. an action group. Option B. a mail-enabled security group. Option C. a distribution group. Option D. a Microsoft 365 group. Pause the video now if you want time to think about the answer.
The correct answer is A. an action group. An action group is the Azure Monitor resource that manages notifications and actions for alert rules. It enables you to define email recipients, SMS recipients, webhook endpoints, and other notification channels. Alert rules reference action groups to determine who receives notifications when an alert is triggered. Now, why are the other options incorrect? Option B is incorrect. Mail-enabled security groups are Active Directory/Exchange objects not integrated with Azure Monitor alert mechanisms. Option C is incorrect. Distribution groups are Exchange/Microsoft 365 objects for email distribution, not Azure Monitor's native alert notification mechanism. Option D is incorrect. Microsoft 365 groups are collaboration tools; they are not the mechanism Azure Monitor uses for alert notifications. Therefore, A, an action group, is the correct answer.
Play from 1:28:27 Question 48. You create an Azure Storage account. You plan to add 10 blob containers to the storage account. For one of the containers, you need to use a different key to encrypt data at rest. What should you do before you create the container? Here are the options. Option A. Generate a shared access signature (SAS). Option B. Modify the minimum TLS version. Option C. Rotate the access keys. Option D. Create an encryption scope. Pause the video now if you want time to think about the answer.
The correct answer is D. Create an encryption scope. Encryption scopes allow you to configure different encryption keys for different containers within the same storage account. Before creating a container that requires a different encryption key than the default storage account key, you must first create an encryption scope that specifies the custom key to be used for that container. Now, why are the other options incorrect? Option A is incorrect. A shared access signature (SAS) is for access control and authentication, not for configuring encryption keys at the container level. Option B is incorrect. Modifying the TLS version affects transport security, not data encryption at rest or per-container encryption configuration. Option C is incorrect. Rotating access keys affects all containers uniformly and does not allow different keys for different containers within the same account. Therefore, D, Create an encryption scope, is the correct answer.
Play from 1:30:20 Question 49. You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1. You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable. What should you deploy? Here are the options. Option A. all three virtual machines in a single Availability Zone. Option B. all virtual machines in a single Availability Set. Option C. each virtual machine in a separate Availability Zone. Option D. each virtual machine in a separate Availability Set. Pause the video now if you want time to think about the answer.
The correct answer is C. each virtual machine in a separate Availability Zone. Deploying each virtual machine in a separate Availability Zone ensures that at least two VMs remain available if a single datacenter becomes unavailable. Availability Zones are physically separated datacenters within an Azure region, providing protection against complete datacenter failure. This is superior to Availability Sets, which only protect against rack-level failures within a single datacenter. Now, why are the other options incorrect? Option A is incorrect. All VMs in a single Availability Zone would all fail if that zone's datacenter becomes unavailable. Option B is incorrect. Availability Sets only protect against rack-level failures within a single datacenter, not full datacenter outages. Option D is incorrect. Each VM in separate Availability Sets still places them in the same datacenter, not protecting against datacenter failure. Therefore, C, each virtual machine in a separate Availability Zone, is the correct answer.
Play from 1:32:23 Question 50. You have an Azure subscription that contains a storage account named storage1. You plan to create a blob container named container1. You need to use customer-managed key encryption for container1. Which key should you use? Here are the options. Option A. an EC key that uses the P-384 curve only. Option B. an EC key that uses the P-521 curve only. Option C. an EC key that uses the P-384 curve or P-521 curve only. Option D. an RSA key with a key size of 4096 only. Option E. an RSA key type with a key size of 2048, 3072, or 4096 only. Pause the video now if you want time to think about the answer.
The correct answer is E. an RSA key type with a key size of 2048, 3072, or 4096 only. Azure Storage customer-managed key encryption using Azure Key Vault supports RSA keys with key sizes of 2048, 3072, or 4096 bits. These are the only supported RSA key configurations for encrypting blob containers with customer-managed keys. Now, why are the other options incorrect? Option A is incorrect. Elliptic Curve (EC) keys with P-384 curve are not supported for Azure Storage customer-managed encryption. Option B is incorrect. Elliptic Curve (EC) keys with P-521 curve are not supported for Azure Storage customer-managed encryption. Option C is incorrect. EC keys with either P-384 or P-521 curves are not supported; Azure Storage requires RSA keys for customer-managed encryption. Option D is incorrect. While RSA-4096 is supported, RSA keys must support multiple key sizes (2048, 3072, or 4096), not just 4096 alone. Therefore, E, an RSA key type with a key size of 2048, 3072, or 4096 only, is the correct answer.
Play from 1:34:53 Question 51. You have an Azure subscription that contains multiple virtual machines in the West US Azure region. You need to use Traffic Analytics in Azure Network Watcher to monitor virtual machine traffic. Which two resources should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. a Log Analytics workspace. Option B. an Azure Monitor workbook. Option C. a storage account. Option D. a Microsoft Sentinel workspace. Option E. a Data Collection Rule (DCR) in Azure Monitor. Pause the video now if you want time to think about the answer.
The correct answers are A. a Log Analytics workspace, and C. a storage account. Traffic Analytics requires two primary resources: a Log Analytics workspace to store and analyze the flow log data, and a storage account to temporarily store the network flow logs before they are processed and sent to the workspace. These are the foundational requirements for Traffic Analytics in Network Watcher. Now, why are the other options incorrect? Option B is incorrect. Azure Monitor workbooks are visualization tools but not required prerequisites for Traffic Analytics setup. Option D is incorrect. Microsoft Sentinel is a security information and event management solution, not a required component for Traffic Analytics. Option E is incorrect. Data Collection Rules are used for Azure Monitor agent data collection, not for Traffic Analytics configuration in Network Watcher. Therefore, A and C are the correct answers.
Play from 1:36:53 Question 52. You plan to create an Azure Storage account named storage1 that will contain a file share named share1. You need to ensure that share1 can support SMB Multichannel. The solution must minimize costs. How should you configure storage? Here are the options. Option A. Premium performance with locally-redundant storage (LRS). Option B. Standard performance with zone-redundant storage (ZRS). Option C. Premium performance with geo-redundant storage (GRS). Option D. Standard performance with locally-redundant storage (LRS). Pause the video now if you want time to think about the answer.
The correct answer is A. Premium performance with locally-redundant storage (LRS). SMB Multichannel is only supported on Premium performance tier Azure Files. The redundancy type (LRS, GRS, ZRS) does not affect SMB Multichannel support. While LRS is the minimum redundancy option, the question asks to minimize costs while supporting SMB Multichannel, and Premium with LRS provides this combination. Now, why are the other options incorrect? Option B is incorrect. Standard performance tier does not support SMB Multichannel; only Premium tier does. Option C is incorrect. While Premium with GRS would work, it is more expensive than Premium with LRS and does not minimize costs. Option D is incorrect. Standard performance tier does not support SMB Multichannel regardless of redundancy type. Therefore, A, Premium performance with locally-redundant storage (LRS), is the correct answer.
Play from 1:38:52 Question 53. You have an Azure subscription that contains an Azure Storage account. You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent storage. You need to configure a storage service for Container1. What should you use? Here are the options. Option A. Azure Files. Option B. Azure Blob storage. Option C. Azure Queue storage. Option D. Azure Table storage. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Files. Azure Files (A) is the appropriate storage service for Azure Container Instances that require persistent storage, particularly for databases like SQL Server. Azure Files provides SMB-based file shares that can be mounted to containers and persist data across container restarts and instances. Blob Storage is for unstructured data and does not provide the file system semantics needed for database instances. Queue and Table storage are not suitable for persistent file system requirements. Now, why are the other options incorrect? Option B is incorrect. Azure Blob Storage does not provide file system semantics required for SQL Server persistent storage in containers. Option C is incorrect. Azure Queue Storage is for message queuing, not persistent storage for applications like SQL Server. Option D is incorrect. Azure Table Storage provides NoSQL key-value storage, not file system persistence needed for database instances. Therefore, A, Azure Files, is the correct answer.
Play from 1:40:55 Question 54. You have an Azure virtual network named VNet1 that contains the following settings: • IPv4 address space: 172.16.10.0/24 • Subnet name: Subnet1 • Subnet address range: 172.16.10.0/25 What is the maximum number of virtual machines that can connect to Subnet1? Here are the options. Option A. 24. Option B. 25. Option C. 123. Option D. 128. Option E. 251. Pause the video now if you want time to think about the answer.
The correct answer is C. 123. Subnet1 has an address range of 172.16.10.0/25, which provides 2^(32-25) = 128 total addresses. In Azure, the first address is the network address and the last address is the broadcast address, leaving 128 - 5 = 123 usable addresses (Azure also reserves 4 addresses for gateway, DNS, and Azure services). Now, why are the other options incorrect? Option A is incorrect. 24 addresses is too small and does not correctly calculate the /25 subnet size. Option B is incorrect. 25 addresses does not account for the correct subnet calculation or Azure's reserved addresses. Option D is incorrect. 128 is the total number of addresses in a /25 subnet, but does not account for Azure's reserved addresses. Option E is incorrect. 251 addresses exceeds the /25 subnet capacity and is incorrect. Therefore, C, 123, is the correct answer.
Play from 1:43:10 Question 55. You have an Azure Kubernetes Service (AKS) cluster named AKS1. You need to configure cluster autoscaler for AKS1. Which two tools should you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. the kubectl command. Option B. the az aks command. Option C. the Set-AzVm cmdlet. Option D. the Azure portal. Option E. the Set-AzAks cmdlet. Pause the video now if you want time to think about the answer.
The correct answers are B. the az aks command, and D. the Azure portal. Cluster autoscaler for AKS can be configured using the Azure portal (GUI interface) and the 'az aks' command-line tool. The Azure portal provides a UI to enable autoscaling, and the az aks command allows programmatic configuration of autoscaling parameters for the cluster. Now, why are the other options incorrect? Option A is incorrect. kubectl is for managing workloads within Kubernetes, not configuring cluster autoscaler settings. Option C is incorrect. Set-AzVm cmdlet is for managing virtual machines, not AKS cluster autoscaling. Option E is incorrect. Set-AzAks cmdlet does not exist; the correct command is 'az aks' in the Azure CLI. Therefore, B and D are the correct answers.
Play from 1:44:52 Question 56. You have an Azure App Service web app named App1. You need to collect performance traces for App1. What should you use? Here are the options. Option A. Azure Application Insights Profiler. Option B. the Activity log. Option C. the Deployment center. Option D. the Diagnose and solve problems settings. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Application Insights Profiler. Application Insights Profiler is specifically designed to collect detailed performance traces and CPU profiling data from running applications. It captures call stacks and timing information to help identify performance bottlenecks in App Service web apps. Now, why are the other options incorrect? Option B is incorrect. The Activity log tracks management operations on Azure resources, not application performance metrics or traces. Option C is incorrect. The Deployment center manages code deployments and source control integration, not performance monitoring. Option D is incorrect. Diagnose and solve problems provides troubleshooting guides and diagnostics, but is not the tool for continuous performance trace collection. Therefore, A, Azure Application Insights Profiler, is the correct answer.
Play from 1:46:32 Question 57. You have an Azure subscription. The subscription contains virtual machines that connect to a virtual network named VNet1. You plan to configure Azure Monitor for VM Insights. You need to ensure that all the virtual machines only communicate with Azure Monitor through VNet1. What should you create first? Here are the options. Option A. a data collection rule (DCR). Option B. a Log Analytics workspace. Option C. an Azure Monitor Private Link Scope (AMPLS). Option D. a private endpoint. Pause the video now if you want time to think about the answer.
The correct answer is C. an Azure Monitor Private Link Scope (AMPLS). An Azure Monitor Private Link Scope (AMPLS) must be created first to establish private connectivity between the virtual network and Azure Monitor services. This ensures all communication from VMs to Azure Monitor occurs through the private VNet connection rather than over the public internet. Now, why are the other options incorrect? Option A is incorrect. A data collection rule defines what data to collect but does not establish private connectivity to Azure Monitor. Option B is incorrect. A Log Analytics workspace is a destination for data but does not provide private link connectivity on its own. Option D is incorrect. A private endpoint is created as part of the AMPLS setup, but AMPLS must be created first to configure the private link scope. Therefore, C, an Azure Monitor Private Link Scope (AMPLS), is the correct answer.
Play from 1:48:31 Question 58. You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines. You need to delete the Recovery Services vault. What should you do first? Here are the options. Option A. From the Recovery Service vault, delete the backup data. Option B. Modify the disaster recovery properties of each virtual machine. Option C. Modify the locks of each virtual machine. Option D. From the Recovery Service vault, stop the backup of each backup item. Pause the video now if you want time to think about the answer.
The correct answer is D. From the Recovery Service vault, stop the backup of each backup item. Before deleting a Recovery Services vault, you must stop the backup of each protected item (D). The vault cannot be deleted while it contains active backup items with ongoing protection. Deleting backup data alone is insufficient; the protection must be stopped first. Modifying disaster recovery properties or locks does not address the underlying requirement to cease protection. The backup items must have their protection stopped before vault deletion is permitted. Now, why are the other options incorrect? Option A is incorrect. Deleting backup data does not disable protection; the vault will not delete while backup items remain protected. Option B is incorrect. Modifying disaster recovery properties does not stop the backup protection required for vault deletion. Option C is incorrect. Modifying VM locks does not address the backup protection status that prevents vault deletion. Therefore, D, From the Recovery Service vault, stop the backup of each backup item, is the correct answer.
Play from 1:50:33 Question 59. You have a deployment template named Template1 that is used to deploy 10 Azure web apps. You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs. What should you identify? Here are the options. Option A. five Azure Application Gateways. Option B. one App Service plan. Option C. 10 App Service plans. Option D. one Azure Traffic Manager. Option E. one Azure Application Gateway. Pause the video now if you want time to think about the answer.
The correct answer is B. one App Service plan. To minimize costs when deploying 10 web apps, you should use one App Service plan shared across all 10 web apps. An App Service plan defines the compute resources, and multiple web apps can share the same plan, reducing costs significantly compared to dedicated plans for each app. Now, why are the other options incorrect? Option A is incorrect. Application Gateways are load balancers for traffic routing and are unnecessary for this deployment. Option C is incorrect. Creating 10 App Service plans would maximize costs instead of minimizing them. Option D is incorrect. Azure Traffic Manager is for global load balancing and would add unnecessary cost. Option E is incorrect. A single Application Gateway is unnecessary and would increase costs without providing value for web app deployment. Therefore, B, one App Service plan, is the correct answer.
Play from 1:52:21 Question 60. You have an on-premises datacenter and an Azure subscription. You plan to connect the datacenter to Azure by using ExpressRoute. You need to deploy an ExpressRoute gateway. The solution must meet the following requirements: • Support up to 10 Gbps of traffic. • Support availability zones. • Support FastPath. • Minimize costs. Which SKU should you deploy? Here are the options. Option A. ERGw1AZ. Option B. ERGw2. Option C. ErGw3. Option D. ErGw3AZ. Pause the video now if you want time to think about the answer.
The correct answer is D. ErGw3AZ. ERGw3AZ is the correct choice because it supports all requirements: it handles up to 10 Gbps traffic, supports availability zones (the AZ suffix indicates zone redundancy), supports FastPath for direct data plane connectivity, and represents the minimum cost option meeting all criteria. ERGw1AZ only supports up to 1 Gbps, ERGw2 does not support availability zones (no AZ suffix), and ErGw3 lacks availability zone support. The AZ designation is critical for the multi-availability-zone requirement. Now, why are the other options incorrect? Option A is incorrect. ERGw1AZ only supports up to 1 Gbps, which does not meet the 10 Gbps requirement. Option B is incorrect. ERGw2 does not support availability zones, which is a stated requirement. Option C is incorrect. ErGw3 lacks availability zone support despite supporting 10 Gbps and FastPath. Therefore, D, ErGw3AZ, is the correct answer.
Play from 1:54:26 Question 61. You have an Azure Active Directory (Azure AD) tenant that is linked to 10 Azure subscriptions. You need to centrally monitor user activity across all the subscriptions. What should you use? Here are the options. Option A. Azure Application Insights Profiler. Option B. access reviews. Option C. Activity log filters. Option D. a Log Analytics workspace. Pause the video now if you want time to think about the answer.
The correct answer is D. a Log Analytics workspace. A Log Analytics workspace is the central repository for collecting and analyzing logs and activity data across multiple Azure subscriptions. By configuring the workspace to aggregate activity logs from all 10 subscriptions linked to the Azure AD tenant, you can centrally monitor user activity across the entire environment. Now, why are the other options incorrect? Option A is incorrect. Application Insights Profiler is used for application performance profiling of specific apps, not for centralized user activity monitoring across subscriptions. Option B is incorrect. Access reviews are used for auditing access rights to resources, not for centrally monitoring all user activity. Option C is incorrect. Activity log filters allow you to view activity within a single subscription or context, not to centrally monitor across multiple subscriptions. Therefore, D, a Log Analytics workspace, is the correct answer.
Play from 1:56:12 Question 62. You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2. You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hosting VM1 and VM2. What should you include in the Availability Set? Here are the options. Option A. one update domain. Option B. two fault domains. Option C. one fault domain. Option D. two update domains. Pause the video now if you want time to think about the answer.
The correct answer is D. two update domains. To ensure App1 remains available during planned maintenance, you need multiple update domains. Azure Availability Sets use update domains to stagger maintenance windows so that not all VMs are updated simultaneously. With two VMs, you need at least two update domains to guarantee one VM remains online during maintenance of the other. Fault domains protect against hardware failures, but update domains specifically address planned maintenance scenarios. Now, why are the other options incorrect? Option A is incorrect. One update domain means both VMs could be updated simultaneously, causing downtime. Option B is incorrect. Fault domains protect against hardware failures, not planned maintenance windows. Option C is incorrect. One fault domain provides no redundancy for planned maintenance events. Therefore, D, two update domains, is the correct answer.
Play from 1:58:01 Question 63. You have an Azure subscription. You need to receive an email alert when a resource lock is removed from any resource in the subscription. What should you use to create an activity log alert in Azure Monitor? Here are the options. Option A. a resource, a condition, and an action group. Option B. a resource, a condition, and a Microsoft 365 group. Option C. a Log Analytics workspace, a resource, and an action group. Option D. a data collection endpoint, an application security group, and a resource group. Pause the video now if you want time to think about the answer.
The correct answer is A. a resource, a condition, and an action group. An activity log alert in Azure Monitor requires three components: a resource (or resource group) to monitor, a condition that specifies which events to alert on (such as 'resource lock removed'), and an action group that defines the notification action (sending an email). Now, why are the other options incorrect? Option B is incorrect. Microsoft 365 groups are not used in Azure Monitor alert configuration; action groups are the correct construct. Option C is incorrect. A Log Analytics workspace is not a required component for activity log alerts; only resource, condition, and action group are needed. Option D is incorrect. Data collection endpoints and application security groups are not relevant to activity log alert creation. Therefore, A, a resource, a condition, and an action group, is the correct answer.
Play from 1:59:54 Question 64. You have an Azure virtual machine named VM1. Azure collects events from VM1. You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1. Which target resource should you monitor in the alert rule? Here are the options. Option A. virtual machine extension. Option B. virtual machine. Option C. metric alert. Option D. Azure Log Analytics workspace. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Log Analytics workspace. To create an alert rule that monitors System event log entries from a VM, you need to use Azure Log Analytics workspace as the target resource. Events from the VM are collected into a Log Analytics workspace, and alert rules are created against the data stored in that workspace using Kusto Query Language (KQL). The alert rule queries the Log Analytics workspace to detect when errors are logged. Now, why are the other options incorrect? Option A is incorrect. Virtual machine extensions are not the target resource for event log monitoring in this context. Option B is incorrect. While the VM is the source, the alert rule itself targets the Log Analytics workspace where the events are stored. Option C is incorrect. Metric alert is a type of alert, not a target resource to monitor. Therefore, D, Azure Log Analytics workspace, is the correct answer.
Play from 2:01:42 Question 65. You have an Azure Storage account named storage1. For storage1, you create an encryption scope named Scope1. Which storage types can you encrypt by using Scope? Here are the options. Option A. file shares only. Option B. containers only. Option C. file shares and containers only. Option D. containers and tables only. Option E. file shares, containers, and tables only. Option F. file shares, containers, tables, and queues. Pause the video now if you want time to think about the answer.
The correct answer is B. containers only. Encryption scopes in Azure Storage can only be used to encrypt containers (Blob Storage). File shares, tables, and queues cannot be encrypted using encryption scopes. Encryption scopes provide customer-managed key encryption specifically for blob storage containers. Now, why are the other options incorrect? Option A is incorrect. File shares cannot be encrypted using encryption scopes. Option C is incorrect. File shares cannot be encrypted using encryption scopes. Option D is incorrect. Tables cannot be encrypted using encryption scopes. Option E is incorrect. File shares, tables, and queues cannot be encrypted using encryption scopes. Option F is incorrect. File shares, tables, and queues cannot be encrypted using encryption scopes. Therefore, B, containers only, is the correct answer.
Play from 2:03:34 Question 66. You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com. Your company has a public DNS zone for contoso.com. You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name. Which type of DNS record should you create? Here are the options. Option A. MX. Option B. NSEC. Option C. PTR. Option D. RRSIG. Pause the video now if you want time to think about the answer.
The correct answer is A. MX. When adding a custom domain to Azure AD, the system requires DNS verification. Azure AD uses an MX record (or TXT record, though MX is the standard answer in this context) to verify domain ownership. You must create the specified DNS record in your public DNS zone so Azure can confirm you control the domain. Now, why are the other options incorrect? Option B is incorrect. NSEC records are DNSSEC-related security records, not used for domain verification. Option C is incorrect. PTR records are used for reverse DNS lookups, not domain ownership verification. Option D is incorrect. RRSIG records are DNSSEC signatures, not used for Azure AD domain verification. Therefore, A, MX, is the correct answer.
Play from 2:05:22 Question 67. You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual. You need to view the average round-trip time (RTT) of the packets from VM1 to VM2. Which Azure Network Watcher feature should you use? Here are the options. Option A. IP flow verify. Option B. Connection troubleshoot. Option C. Connection monitor. Option D. NSG flow logs. Pause the video now if you want time to think about the answer.
The correct answer is C. Connection monitor. Connection Monitor is the Azure Network Watcher feature designed to monitor connectivity and measure network performance metrics including round-trip time (RTT) between two endpoints over time. It provides continuous monitoring and historical data about latency, packet loss, and other performance metrics, making it ideal for diagnosing slowness issues between VM1 and VM2. Now, why are the other options incorrect? Option A is incorrect. IP flow verify only checks if traffic is allowed or denied by NSG rules, not RTT measurements. Option B is incorrect. Connection troubleshoot performs a one-time diagnostic check but doesn't provide continuous RTT monitoring over time. Option D is incorrect. NSG flow logs record traffic allowed/denied by network security groups but don't measure RTT or performance metrics. Therefore, C, Connection monitor, is the correct answer.
Play from 2:07:33 Question 68. You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2. You have a Network Virtual Appliance (NVA) named NetVA1. You need to ensure that the traffic from VNet1 to VNet2 is inspected by using NetVA1. What should you use? Here are the options. Option A. a local network gateway. Option B. a route table that has custom routes. Option C. a service endpoint. Option D. IP address reservations. Pause the video now if you want time to think about the answer.
The correct answer is B. a route table that has custom routes. A route table with custom routes is the standard mechanism for directing traffic through a Network Virtual Appliance. By creating user-defined routes in VNet1 that specify the NVA as the next hop for traffic destined to VNet2's subnet, all traffic between the two networks will be forced through NetVA1 for inspection. Now, why are the other options incorrect? Option A is incorrect. Local network gateways are used for site-to-site VPN connections, not for routing between peered VNets through an NVA. Option C is incorrect. Service endpoints are used to restrict access to Azure services to specific subnets; they do not enable traffic inspection through an NVA. Option D is incorrect. IP address reservations are used to ensure specific IPs remain assigned to resources; they do not control traffic routing or inspection. Therefore, B, a route table that has custom routes, is the correct answer.
Play from 2:09:29 Question 69. You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10 users can use all the Azure AD Premium features. What should you do? Here are the options. Option A. From the Licenses blade of Azure AD, assign a license. Option B. From the Groups blade of each user, invite the users to a group. Option C. From the Azure AD domain, add an enterprise application. Option D. From the Directory role blade of each user, modify the directory role. Pause the video now if you want time to think about the answer.
The correct answer is A. From the Licenses blade of Azure AD, assign a license. To enable Azure AD Premium P2 features for users, you must assign the purchased licenses to those users. This is done from the Licenses blade in Azure AD, where you can select users and allocate the premium licenses to them. Now, why are the other options incorrect? Option B is incorrect. Adding users to groups does not grant them premium features; licenses must be explicitly assigned. Option C is incorrect. Adding enterprise applications is unrelated to assigning premium licenses to users. Option D is incorrect. Modifying directory roles does not activate premium feature access; licenses must be assigned. Therefore, A, From the Licenses blade of Azure AD, assign a license, is the correct answer.
Play from 2:11:23 Question 70. You have an Azure subscription that contains a storage account named storage1 in the North Europe Azure region. You need to ensure that when blob data is added to storage1, a secondary copy is created in the East US region. The solution must minimize administrative effort. What should you configure? Here are the options. Option A. operational backup. Option B. object replication. Option C. geo-redundant storage (GRS). Option D. a lifecycle management rule. Pause the video now if you want time to think about the answer.
The correct answer is C. geo-redundant storage (GRS). Geo-redundant storage (GRS) automatically creates a secondary copy of blob data in a different Azure region (East US in this case) whenever data is added to the primary region (North Europe). This meets the requirement of minimizing administrative effort by providing automatic, managed replication without manual configuration of object-level replication policies. Now, why are the other options incorrect? Option A is incorrect. Operational backup is for backup and recovery of blobs, not for creating secondary regional copies. Option B is incorrect. Object replication requires manual configuration and policy setup for each object, increasing administrative effort. Option D is incorrect. Lifecycle management rules manage blob transitions between storage tiers or deletion, not geographic replication. Therefore, C, geo-redundant storage (GRS), is the correct answer.
Play from 2:13:18 Question 71. You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1. You need to configure encryption for VM1. The solution must meet the following requirements: • Store and use the encryption key in KV1. • Maintain encryption if VM1 is downloaded from Azure. • Encrypt both the operating system disk and the data disks. Which encryption method should you use? Here are the options. Option A. customer-managed keys. Option B. Confidential disk encryption. Option C. Azure Disk Encryption. Option D. encryption at host. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Disk Encryption. Azure Disk Encryption (C) meets all requirements: it stores encryption keys in the Key Vault (KV1), maintains encryption even when the VM is downloaded from Azure (persistent encryption of the disk files themselves), and encrypts both OS and data disks. This is the standard solution for VM-level encryption with key management requirements. Now, why are the other options incorrect? Option A is incorrect. Customer-managed keys is a broader concept applicable to various services; Azure Disk Encryption specifically is the correct implementation for VM disk encryption. Option B is incorrect. Confidential disk encryption is for protecting data at rest on confidential VMs but is not the standard disk encryption method being requested. Option D is incorrect. Encryption at host encrypts data at the physical host level but does not meet the requirement to maintain encryption when the VM is downloaded. Therefore, C, Azure Disk Encryption, is the correct answer.
Play from 2:15:26 Question 72. You have an Azure subscription that contains a Standard SKU Azure container registry named ContReg1. You need to ensure that ContReg1 supports geo-replication. What should you do first for ContReg1? Here are the options. Option A. Enable Admin user. Option B. Add a scope map. Option C. Add an automation task. Option D. Create a cache rule. Option E. Upgrade the SKU. Pause the video now if you want time to think about the answer.
The correct answer is E. Upgrade the SKU. Geo-replication is only available in Premium SKU container registries. Since ContReg1 is Standard SKU, it must first be upgraded to Premium SKU (E) before geo-replication can be enabled. This is a prerequisite requirement. Now, why are the other options incorrect? Option A is incorrect. Enabling Admin user does not enable geo-replication capability. Option B is incorrect. Adding a scope map is for managing access tokens, not for geo-replication. Option C is incorrect. Adding an automation task does not enable geo-replication functionality. Option D is incorrect. Cache rules are for registry content caching, not for geo-replication. Therefore, E, Upgrade the SKU, is the correct answer.
Play from 2:17:11 Question 73. You have an Azure subscription. You have 100 Azure virtual machines. You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering. Which blade should you use? Here are the options. Option A. Monitor. Option B. Advisor. Option C. Metrics. Option D. Customer insights. Pause the video now if you want time to think about the answer.
The correct answer is B. Advisor. Azure Advisor provides personalized recommendations to optimize Azure resources, including identifying underutilized virtual machines that can be resized to lower-cost service tiers. It is specifically designed to help reduce costs and improve performance across subscriptions. Now, why are the other options incorrect? Option A is incorrect. Monitor is used for tracking metrics and logs but does not provide optimization recommendations. Option C is incorrect. Metrics shows performance data but does not identify underutilization or provide recommendations. Option D is incorrect. Customer insights is not a standard Azure blade for resource optimization. Therefore, B, Advisor, is the correct answer.
Play from 2:18:45 Question 74. You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses two ExpressRoute circuits that connect to two separate on-premises datacenters. You need to create a dashboard to display detailed metrics and a visual representation of the network topology. What should you use? Here are the options. Option A. Azure Monitor Network Insights. Option B. a Data Collection Rule (DCR). Option C. Azure Virtual Network Watcher. Option D. Log Analytics. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Monitor Network Insights. Azure Monitor Network Insights provides detailed metrics and visual representation of network topology, including connections between resources like ExpressRoute circuits, virtual networks, and subnets. It is specifically designed for comprehensive network monitoring and topology visualization. Now, why are the other options incorrect? Option B is incorrect. A Data Collection Rule (DCR) is used to define what data to collect from resources, not to display dashboards or topology. Option C is incorrect. Azure Virtual Network Watcher provides network diagnostics and monitoring but is not the primary tool for topology visualization dashboards. Option D is incorrect. Log Analytics is a query and analysis platform; while it can display data, Network Insights is the dedicated tool for network topology and metrics dashboards. Therefore, A, Azure Monitor Network Insights, is the correct answer.
Play from 2:20:42 Question 75. You have an Azure subscription that contains a virtual machine named VM1. You have an on-premises datacenter that contains a domain controller named DC1. ExpressRoute is used to connect the on-premises datacenter to Azure. You need to use Connection Monitor to identify network latency between VM1 and DC1. What should you install on DC1? Here are the options. Option A. the Azure Connected Machine agent for Azure Arc-enabled servers. Option B. the Azure Network Watcher Agent virtual machine extension. Option C. the Log Analytics agent. Option D. an Azure Monitor agent extension. Pause the video now if you want time to think about the answer.
The correct answer is D. an Azure Monitor agent extension. To use Connection Monitor to measure network latency between Azure VM1 and on-premises DC1, you need to install the Azure Monitor agent extension on DC1. The Azure Monitor agent is the current standard agent that enables monitoring capabilities and communication with Connection Monitor. While Azure Arc can manage on-premises machines, Arc is not required for Connection Monitor; the Log Analytics agent is deprecated; and the Network Watcher extension serves a different purpose. Now, why are the other options incorrect? Option A is incorrect. Azure Arc is for hybrid machine management but is not required for Connection Monitor functionality. Option B is incorrect. Network Watcher Agent extension is used for packet capture and network diagnostics, not Connection Monitor. Option C is incorrect. Log Analytics agent is deprecated and not the correct agent for Connection Monitor. Therefore, D, an Azure Monitor agent extension, is the correct answer.
Play from 2:22:48 Question 76. You create the following resources in an Azure subscription: • An Azure Container Registry instance named Registry1 • An Azure Kubernetes Service (AKS) cluster named Cluster1 You create a container image named App1 on your administrative workstation. You need to deploy App1 to Cluster1. What should you do first? Here are the options. Option A. Run the docker push command. Option B. Create an App Service plan. Option C. Run the az acr build command. Option D. Run the az aks create command. Pause the video now if you want time to think about the answer.
The correct answer is A. Run the docker push command. Before deploying App1 to Cluster1, you must first push the container image from your workstation to Registry1 using 'docker push'. This makes the image available in the container registry where AKS can pull it for deployment. The Cluster1 is already created, and an App Service plan is not needed for Kubernetes deployments. Now, why are the other options incorrect? Option B is incorrect. App Service plan is for Azure App Service, not for AKS deployments. Option C is incorrect. az acr build is used to build images in the registry, but your image is already built locally. Option D is incorrect. az aks create is for creating a new cluster; Cluster1 already exists. Therefore, A, Run the docker push command, is the correct answer.
Play from 2:24:46 Question 77. Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1. The company has users that work remotely. The remote workers require access to the VMs on VNet1. You need to provide access for the remote workers. What should you do? Here are the options. Option A. Configure a Site-to-Site (S2S) VPN. Option B. Configure a VNet-toVNet VPN. Option C. Configure a Point-to-Site (P2S) VPN. Option D. Configure DirectAccess on a Windows Server 2012 server VM. Option E. Configure a Multi-Site VPN. Pause the video now if you want time to think about the answer.
The correct answer is C. Configure a Point-to-Site (P2S) VPN. Point-to-Site (P2S) VPN is the correct solution for remote workers who need to access resources in a single Azure virtual network. P2S VPNs establish secure connections from individual client computers to Azure, making it ideal for remote workers. Site-to-Site (S2S) VPN connects two networks together, VNet-to-VNet connects multiple virtual networks, Multi-Site connects multiple on-premises locations, and DirectAccess is for on-premises Windows domain environments. Now, why are the other options incorrect? Option A is incorrect. Site-to-Site VPN is used to connect entire on-premises networks to Azure, not individual remote workers. Option B is incorrect. VNet-to-VNet VPN connects multiple Azure virtual networks together, not remote individual users. Option D is incorrect. DirectAccess is a Windows Server feature for on-premises domain-joined computers, not Azure cloud connectivity. Option E is incorrect. Multi-Site VPN connects multiple on-premises sites to Azure, not individual remote workers. Therefore, C, Configure a Point-to-Site (P2S) VPN, is the correct answer.
Play from 2:27:16 Question 78. You need to create an Azure Storage account named storage1. The solution must meet the following requirements: • Support Azure Data Lake Storage. • Minimize costs for infrequently accessed data. • Automatically replicate data to a secondary Azure region. Which three options should you configure for storage1? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point. Here are the options. Option A. zone-redundant storage (ZRS). Option B. the Cool access tire. Option C. geo-redundant storage (GRS). Option D. the Hot access tier. Option E. hierarchical namespace. Pause the video now if you want time to think about the answer.
The correct answers are B. the Cool access tire, and C. geo-redundant storage (GRS), and E. hierarchical namespace. To support Azure Data Lake Storage, you need the hierarchical namespace (E). To minimize costs for infrequently accessed data, use the Cool access tier (B). To automatically replicate to a secondary region, use geo-redundant storage (C). Together, these three options create a cost-optimized, geo-redundant Data Lake Storage setup. Now, why are the other options incorrect? Option A is incorrect. Zone-redundant storage (ZRS) replicates within a single region only, not to a secondary region as required. Option D is incorrect. The Hot access tier is for frequently accessed data and does not minimize costs for infrequently accessed data. Therefore, B and C and E are the correct answers.
Play from 2:29:15 Question 79. You have an Azure subscription that contains 10 network security groups (NSGs), 10 virtual machines, and a Log Analytics workspace named Workspace1. Each NSG is connected to a virtual machine. You need to configure an Azure Monitor Network Insights alert that will be triggered when suspicious network traffic is detected. What should you do first? Here are the options. Option A. Deploy Connection Monitor. Option B. Configure data collection endpoints. Option C. Configure a private link. Option D. Configure NSG flow logs. Pause the video now if you want time to think about the answer.
The correct answer is D. Configure NSG flow logs. NSG flow logs are the foundational requirement for Azure Monitor Network Insights to function. These logs capture network traffic information flowing through the NSGs. Without enabling NSG flow logs, Network Insights cannot analyze traffic patterns and cannot trigger alerts for suspicious network activity. Now, why are the other options incorrect? Option A is incorrect. Connection Monitor is used for monitoring connectivity between resources, not for detecting suspicious network traffic patterns. Option B is incorrect. Data collection endpoints are used for Azure Monitor agent configuration, not specifically for NSG-based suspicious traffic detection. Option C is incorrect. Private links are for private connectivity to Azure services, not for configuring network traffic monitoring and alerting. Therefore, D, Configure NSG flow logs, is the correct answer.
Play from 2:31:07 Question 80. You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1. You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege. Which two roles should you configure for storage1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Storage Account Contributor. Option B. Storage Blob Data Contributor. Option C. Reader. Option D. Contributor. Option E. Storage Blob Data Reader. Pause the video now if you want time to think about the answer.
The correct answers are B. Storage Blob Data Contributor, and C. Reader. To allow Group1 members to upload files via the Azure portal with least privilege, you need: (B) Storage Blob Data Contributor, which grants permissions to read, write, and delete blobs, and (C) Reader, which allows viewing the storage account and navigating the portal interface. Reader provides the minimum permissions to access the portal, while Storage Blob Data Contributor provides the specific data operations needed for uploading. Storage Account Contributor grants too much access (account-level management), and Storage Blob Data Reader only allows reading, not uploading. Now, why are the other options incorrect? Option A is incorrect. Storage Account Contributor provides excessive permissions for account management, violating least privilege. Option D is incorrect. Contributor role grants overly broad permissions across all Azure resources, not adhering to least privilege. Option E is incorrect. Storage Blob Data Reader only allows reading blobs, not uploading/writing new content. Therefore, B and C are the correct answers.
Play from 2:33:19 Question 81. You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1. NSG1 only contains the default rules. You need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts must be able to connect to other internet hosts. To what should you set Destination in the rule? Here are the options. Option A. Application security group. Option B. IP Addresses. Option C. Service Tag. Option D. Any. Pause the video now if you want time to think about the answer.
The correct answer is C. Service Tag. Service Tags represent groups of IP addresses that Microsoft maintains for Azure services. The 'AzurePortal' service tag specifically identifies IP ranges used by the Azure portal. By setting the Destination to this service tag, you can create a deny rule that blocks access to the Azure portal while allowing access to other internet hosts. Now, why are the other options incorrect? Option A is incorrect. Application security groups are used for logical grouping of resources within your network, not for identifying external Azure services like the portal. Option B is incorrect. IP Addresses would require manually identifying and maintaining all IP addresses used by Azure portal, which is impractical and maintenance-heavy. Option D is incorrect. Setting Destination to 'Any' would block all outbound connectivity, not just the portal. Therefore, C, Service Tag, is the correct answer.
Play from 2:35:23 Question 82. You have an Azure Storage account that contains 5,000 blobs accessed by multiple users. You need to ensure that the users can view only specific blobs based on blob index tags. What should you include in the solution? Here are the options. Option A. a role assignment condition. Option B. a stored access policy. Option C. just-in-time (JIT) VM access. Option D. a shared access signature (SAS). Pause the video now if you want time to think about the answer.
The correct answer is A. a role assignment condition. A role assignment condition allows you to restrict access to blobs based on blob index tags. This is the Azure RBAC feature that enables attribute-based access control (ABAC) for Azure Storage, allowing users to view only specific blobs that match the conditions defined in their role assignments based on blob index tags. Now, why are the other options incorrect? Option B is incorrect. Stored access policies are used for shared access signatures but do not provide tag-based filtering. Option C is incorrect. JIT VM access is for managing virtual machine access, not blob access. Option D is incorrect. While SAS can restrict access, it does not natively support blob index tag-based filtering in the way RBAC conditions do. Therefore, A, a role assignment condition, is the correct answer.
Play from 2:37:13 Question 83. You have an Azure subscription that contains a storage account named storage1. You plan to use conditions when assigning role-based access control (RBAC) roles to storage1. Which storage1 services support conditions when assigning roles? Here are the options. Option A. containers only. Option B. file shares only. Option C. tables only. Option D. queues only. Option E. containers and queues only. Option F. files shares and tables only. Pause the video now if you want time to think about the answer.
The correct answer is E. containers and queues only. RBAC conditions are supported for containers and queues in Azure Storage. These conditions allow fine-grained access control based on attributes like blob index tags and blob properties for containers, and queue message properties for queues. Tables and file shares do not support attribute-based conditions in RBAC role assignments. Now, why are the other options incorrect? Option A is incorrect. Only containers is incomplete; queues also support conditions. Option B is incorrect. File shares do not support RBAC conditions. Option C is incorrect. Tables do not support RBAC conditions. Option D is incorrect. Queues alone is incomplete; containers also support conditions. Option F is incorrect. Neither file shares nor tables support RBAC conditions. Therefore, E, containers and queues only, is the correct answer.
Play from 2:39:04 Question 84. You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1. You need to configure access to container1. The solution must meet the following requirements: • Only allow read access. • Allow both HTTP and HTTPS protocols. • Apply access permissions to all the content in the container. What should you use? Here are the options. Option A. an access policy. Option B. a shared access signature (SAS). Option C. Azure Content Delivery Network (CDN). Option D. access keys. Pause the video now if you want time to think about the answer.
The correct answer is B. a shared access signature (SAS). A Shared Access Signature (SAS) is the correct choice because it provides granular access control that can be configured for read-only access, supports both HTTP and HTTPS protocols, and can be scoped to apply permissions to all content in a container. SAS tokens offer time-limited, delegated access with specific permissions. Now, why are the other options incorrect? Option A is incorrect. An access policy manages stored access policies for containers but doesn't directly provide the protocol flexibility and read-only restriction as elegantly as SAS. Option C is incorrect. Azure CDN is for content delivery and caching, not for managing direct access permissions to container contents. Option D is incorrect. Access keys grant full administrative access to the entire storage account, not read-only access to a specific container. Therefore, B, a shared access signature (SAS), is the correct answer.
Play from 2:41:10 Question 85. You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2. VM2 is backed up to RSV1. You need to back up VM2 to RSV2. What should you do first? Here are the options. Option A. From the RSV1 blade, click Backup items and stop the VM2 backup. Option B. From the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup. Option C. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault. Option D. From the RSV1 blade, click Backup Jobs and export the VM2 job. Pause the video now if you want time to think about the answer.
The correct answer is A. From the RSV1 blade, click Backup items and stop the VM2 backup. Before backing up a VM to a different Recovery Services vault, you must first stop the existing backup in the current vault (RSV1). This prevents conflicts between two backup jobs for the same VM running simultaneously. Once the backup is stopped in RSV1, you can then configure and start a new backup to RSV2. Now, why are the other options incorrect? Option B is incorrect. You cannot initiate a backup to RSV2 while the VM is still actively backed up to RSV1. Option C is incorrect. Disaster recovery replication settings are separate from backup configuration and do not address the backup vault conflict. Option D is incorrect. Exporting a backup job does not accomplish the goal of changing backup destinations; you must stop the existing backup first. Therefore, A, From the RSV1 blade, click Backup items and stop the VM2 backup, is the correct answer.
Play from 2:43:30 Question 86. You have an Azure Storage account named storage1. You plan to use AzCopy to copy data to storage1. You need to identify the storage services in storage1 to which you can copy the data. Which storage services should you identify? Here are the options. Option A. blob, file, table, and queue. Option B. blob and file only. Option C. file and table only. Option D. file only. Option E. blob, table, and queue only. Pause the video now if you want time to think about the answer.
The correct answer is B. blob and file only. AzCopy supports copying data to and from Blob Storage and File Storage only (B). These are the two storage services with AzCopy compatibility. Table and Queue storage services do not support AzCopy operations. AzCopy is optimized for high-performance bulk data transfer to these object and file storage tiers. Now, why are the other options incorrect? Option A is incorrect. Table and Queue storage services are not supported by AzCopy; only Blob and File are. Option C is incorrect. Blob storage is supported, but Queue is not supported by AzCopy. Option D is incorrect. While File is supported, Blob storage is also supported, making this incomplete. Option E is incorrect. Table and Queue storage services do not support AzCopy operations. Therefore, B, blob and file only, is the correct answer.
Play from 2:45:16 Question 87. You plan to use the Azure Import/Export service to copy files to a storage account. Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. an XML manifest file. Option B. a dataset CSV file. Option C. a JSON configuration file. Option D. a PowerShell PS1 file. Option E. a driveset CSV file. Pause the video now if you want time to think about the answer.
The correct answers are B. a dataset CSV file, and E. a driveset CSV file. The Azure Import/Export service requires two CSV files: a dataset CSV file (B) that lists the files and directories to be imported, and a driveset CSV file (E) that contains drive information and mapping details. These files define what data goes on which drives. Manifest XML files are generated during the process, not created beforehand. JSON configuration files and PowerShell scripts are not standard Import/Export requirements. Now, why are the other options incorrect? Option A is incorrect. An XML manifest file is generated by the WAImportExport tool after drive preparation, not created before preparing drives. Option C is incorrect. A JSON configuration file is not a standard requirement for Azure Import/Export jobs. Option D is incorrect. A PowerShell PS1 script is not a mandatory file for preparing Import/Export drives. Therefore, B and E are the correct answers.
Play from 2:47:15 Question 88. You create an Azure Storage account named contosostorage. You plan to create a file share named data. Users need to map a drive to the data file share from home computers that run Windows 10. Which outbound port should you open between the home computers and the data file share? Here are the options. Option A. 80. Option B. 443. Option C. 445. Option D. 3389. Pause the video now if you want time to think about the answer.
The correct answer is C. 445. Azure File Shares use the SMB (Server Message Block) protocol, which operates on port 445. This port must be open in outbound firewall rules on client computers to enable mapping and accessing Azure file shares from Windows 10 machines. SMB is the standard protocol for network file sharing in Windows environments. Now, why are the other options incorrect? Option A is incorrect. Port 80 is used for HTTP web traffic, not file sharing. Option B is incorrect. Port 443 is used for HTTPS web traffic and some REST APIs, not SMB file sharing. Option D is incorrect. Port 3389 is used for Remote Desktop Protocol (RDP), not file sharing. Therefore, C, 445, is the correct answer.
Play from 2:48:57 Question 89. You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1. You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Add a service endpoint to VNet1. Option B. Reset GW1. Option C. Create a route-based virtual network gateway. Option D. Add a connection to GW1. Option E. Delete GW1. Option F. Add a public IP address space to VNet1. Pause the video now if you want time to think about the answer.
The correct answers are C. Create a route-based virtual network gateway, and E. Delete GW1. A policy-based gateway cannot support point-to-site connections; only route-based gateways support P2S. Therefore, you must delete the existing policy-based gateway (GW1) and create a new route-based virtual network gateway. These are the two required actions to enable point-to-site VPN functionality from an on-premises computer to VNet1. Now, why are the other options incorrect? Option A is incorrect. Service endpoints are for accessing Azure services, not related to point-to-site VPN configuration. Option B is incorrect. Resetting GW1 will not change its policy-based nature to route-based, which is the fundamental requirement. Option D is incorrect. Adding a connection to a policy-based gateway does not enable point-to-site capability. Option F is incorrect. Adding public IP address space to VNet1 is not relevant to point-to-site VPN configuration. Therefore, C and E are the correct answers.
Play from 2:51:03 Question 90. You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1. An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com. You need to ensure that access to AKS1 can be granted to the contoso.com users. What should you do first? Here are the options. Option A. From contoso.com, modify the Organization relationships settings. Option B. From contoso.com, create an OAuth 2.0 authorization endpoint. Option C. Recreate AKS1. Option D. From AKS1, create a namespace. Pause the video now if you want time to think about the answer.
The correct answer is B. From contoso.com, create an OAuth 2.0 authorization endpoint. To grant access to an AKS cluster to Azure AD users, the cluster must be integrated with Azure AD. The first step is to create an OAuth 2.0 authorization endpoint in Azure AD, which enables AKS to authenticate users against the Azure AD tenant. This establishes the trust relationship between AKS1 and contoso.com, allowing the administrator to subsequently grant access to contoso.com users. The other options do not address the fundamental authentication integration needed. Now, why are the other options incorrect? Option A is incorrect. Organization relationships settings do not enable AKS-Azure AD integration. Option C is incorrect. Recreating AKS1 is not the solution; configuration is needed, not recreation. Option D is incorrect. Creating a namespace in AKS does not enable Azure AD authentication. Therefore, B, From contoso.com, create an OAuth 2.0 authorization endpoint, is the correct answer.
Play from 2:53:20 Question 91. You have an Azure subscription named Subscription1. You deploy a Linux virtual machine named VM1 to Subscription1. You need to monitor the metrics and the logs of VM1. What should you use? Here are the options. Option A. Azure HDInsight. Option B. Linux Diagnostic Extension (LAD) 3.0. Option C. the AzurePerformanceDiagnostics extension. Option D. Azure Analysis Services. Pause the video now if you want time to think about the answer.
The correct answer is B. Linux Diagnostic Extension (LAD) 3.0. Linux Diagnostic Extension (LAD) 3.0 is the correct tool for monitoring metrics and logs on Linux virtual machines in Azure. It collects performance metrics and diagnostic data from the VM and sends it to Azure Monitor or storage accounts for analysis. Now, why are the other options incorrect? Option A is incorrect. Azure HDInsight is for big data processing and analytics, not for individual VM monitoring. Option C is incorrect. AzurePerformanceDiagnostics extension is primarily for Windows VMs, not Linux. Option D is incorrect. Azure Analysis Services is for data analytics and business intelligence, not VM monitoring. Therefore, B, Linux Diagnostic Extension (LAD) 3.0, is the correct answer.
Play from 2:55:06 Question 92. You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines. You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text. What should you create to store the password? Here are the options. Option A. an Azure Key Vault and an access policy. Option B. an Azure Storage account and an access policy. Option C. a Recovery Services vault and a backup policy. Option D. Azure Active Directory (AD) Identity Protection and an Azure policy. Pause the video now if you want time to think about the answer.
The correct answer is A. an Azure Key Vault and an access policy. Azure Key Vault is the proper service for securely storing sensitive values like administrative passwords without exposing them in plain text in Resource Manager templates. Creating an access policy on the Key Vault allows the ARM template to reference the secret securely during deployment of the 100 virtual machines. Now, why are the other options incorrect? Option B is incorrect. Storage accounts are designed for data storage, not secure credential management; they do not provide the encryption and access control needed for administrative passwords. Option C is incorrect. Recovery Services vaults are for backup and disaster recovery, not credential storage. Option D is incorrect. Azure AD Identity Protection is for detecting identity risks, not for storing passwords or secrets. Therefore, A, an Azure Key Vault and an access policy, is the correct answer.
Play from 2:57:09 Question 93. You plan to deploy several Azure virtual machines that will run Windows Server 2022 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use? Here are the options. Option A. Azure Custom Script Extension. Option B. Deployment Center in Azure App Service. Option C. Microsoft Entra Application Proxy. Option D. the Publish-AzVMDscConfiguration cmdlet. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Custom Script Extension. The Azure Custom Script Extension allows you to run scripts on virtual machines after deployment, making it the appropriate choice to install NGINX on all VMs in a scale set during or after provisioning via an ARM template. Now, why are the other options incorrect? Option B is incorrect. Deployment Center is used for App Service deployments, not virtual machine scale sets Option C is incorrect. Microsoft Entra Application Proxy is for hybrid access scenarios, not for installing software on VMs Option D is incorrect. The Publish-AzVMDscConfiguration cmdlet is for PowerShell DSC but Custom Script Extension is more straightforward for this scenario Therefore, A, Azure Custom Script Extension, is the correct answer.
Play from 2:59:02 Question 94. You have an Azure subscription. You are creating a new Azure container instance that will have the following settings: • Container name: cont1 • SKU: Standard • OS type: Windows • Networking type: Public • Memory (GiB): 2.5 • Number of CPU cores: 2 You discover that the Private setting for Networking type is unavailable. You need to ensure that cont1 can be configured to use private networking. Which setting should you change? Here are the options. Option A. Memory (GiB). Option B. Networking type. Option C. Number of CPU cores. Option D. OS type. Option E. SKU. Pause the video now if you want time to think about the answer.
The correct answer is D. OS type. Private networking for Azure Container Instances is only available with Linux container instances, not Windows. Since the configuration specifies OS type: Windows, the Private networking option is unavailable. Changing the OS type to Linux would enable the Private networking option. Now, why are the other options incorrect? Option A is incorrect. Memory allocation does not restrict private networking availability. Option B is incorrect. Networking type cannot be changed to enable private networking; the underlying OS type is the limiting factor. Option C is incorrect. CPU cores do not affect private networking availability. Option E is incorrect. SKU does not determine whether private networking is available for the OS type selected. Therefore, D, OS type, is the correct answer.
Play from 3:00:59 Question 95. You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1. You need to configure NSG1 to allow inbound access to the virtual machines via Bastion1. Which port should you configure for the inbound security rule? Here are the options. Option A. 22. Option B. 443. Option C. 389. Option D. 8080. Pause the video now if you want time to think about the answer.
The correct answer is B. 443. Azure Bastion uses HTTPS (port 443) to securely communicate with the backend virtual machines. When configuring an NSG to allow inbound access through Bastion, port 443 must be permitted to enable the Bastion host to establish secure connections to the managed VMs. Now, why are the other options incorrect? Option A is incorrect. Port 22 is for SSH, which is not the primary communication port for Azure Bastion. Option C is incorrect. Port 389 is for LDAP and is not used by Azure Bastion. Option D is incorrect. Port 8080 is a non-standard HTTP port and is not used by Azure Bastion for management connections. Therefore, B, 443, is the correct answer.
Play from 3:02:54 Question 96. You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images. Client access to storage1 is granted by using a shared access signature (SAS). You need to ensure that users receive a warning message when they generate a SAS that exceeds a seven-day time period. What should you do for storage? Here are the options. Option A. Enable a read-only lock. Option B. Configure an alert rule. Option C. Add a lifecycle management rule. Option D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled. Pause the video now if you want time to think about the answer.
The correct answer is D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled. The 'Allow recommended upper limit for shared access signature (SAS) expiry interval' setting, when enabled, displays a warning message to users when they attempt to generate a SAS token with an expiration time exceeding seven days. This is a storage account security feature designed to promote best practices. Read-only locks prevent modifications but don't warn about SAS duration. Alert rules monitor metrics but don't provide generation-time warnings. Lifecycle management rules manage blob retention, not SAS generation. Now, why are the other options incorrect? Option A is incorrect. A read-only lock prevents modifications to the storage account but does not warn about SAS expiry periods. Option B is incorrect. An alert rule monitors metrics and can trigger notifications, but it does not warn during SAS generation itself. Option C is incorrect. Lifecycle management rules control blob retention and deletion policies, not SAS token generation warnings. Therefore, D, Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled, is the correct answer.
Play from 3:05:15 Question 97. You have an Azure subscription that has Traffic Analytics configured. You deploy a new virtual machine named VM1 that has the following settings: • Region: East US • Virtual network: VNet1 • NIC network security group: NSG1 You need to monitor VM1 traffic by using Traffic Analytics. Which settings should you configure? Here are the options. Option A. Diagnostic settings for VM1. Option B. NSG flow logs for NSG1. Option C. Diagnostic settings for NSG1. Option D. Insights for VM1. Pause the video now if you want time to think about the answer.
The correct answer is B. NSG flow logs for NSG1. To monitor VM1 traffic using Traffic Analytics, you must enable NSG flow logs on NSG1, which is the network security group attached to VM1's NIC. Traffic Analytics analyzes NSG flow log data to provide network traffic insights. Diagnostic settings for VMs, diagnostic settings for NSGs directly, and VM Insights do not enable Traffic Analytics; NSG flow logs are the specific requirement. Now, why are the other options incorrect? Option A is incorrect. Diagnostic settings for VM1 do not enable traffic monitoring; NSG flow logs are required. Option C is incorrect. Diagnostic settings for NSG1 are not the correct configuration; NSG flow logs must be enabled. Option D is incorrect. VM Insights provides performance metrics but does not enable Traffic Analytics. Therefore, B, NSG flow logs for NSG1, is the correct answer.
Play from 3:07:25 Question 98. You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com. What should you do first? Here are the options. Option A. Create A records named www.contoso.com and asuid.contoso.com. Option B. Create a TXT record named asuid that contains the domain verification ID. Option C. Create a CNAME record named asuid that contains the domain verification ID. Option D. Create a TXT record named www.contoso.com that has a value of contoso.azurewebsites.net. Pause the video now if you want time to think about the answer.
The correct answer is B. Create a TXT record named asuid that contains the domain verification ID. When configuring a custom domain for an Azure App Service, you must first verify ownership of the domain. This is done by creating a TXT record named 'asuid' (or 'asuid.[subdomain]') containing the domain verification ID provided by Azure. This proves you control the domain before binding it to the web app. Now, why are the other options incorrect? Option A is incorrect. A records point to IP addresses and are used after verification; asuid does not use A records for verification. Option C is incorrect. CNAME records are used for the actual domain binding (like www.contoso.com pointing to contoso.azurewebsites.net), not for the asuid verification record. Option D is incorrect. A TXT record named www.contoso.com is not the correct verification method; the verification TXT record must be named asuid. Therefore, B, Create a TXT record named asuid that contains the domain verification ID, is the correct answer.
Play from 3:09:43 Question 99. You have a Standard Azure App Service plan named Plan1. You need to ensure that Plan1 will scale automatically when the CPU usage of the web app exceeds 80 percent. What should you select for Plan1? Here are the options. Option A. Automatic in the Scale out method settings. Option B. Rules Based in the Scale out method settings. Option C. Premium P1 in the Scale up (App Service plan) settings. Option D. Standard S1 in the Scale up (App Service plan) settings. Option E. Manual in the Scale out method settings. Pause the video now if you want time to think about the answer.
The correct answer is B. Rules Based in the Scale out method settings. Rules Based scaling in the Scale out method settings allows you to create custom metrics-based rules, such as automatically scaling when CPU usage exceeds a specified threshold like 80 percent. This is the correct configuration method for conditional auto-scaling. Now, why are the other options incorrect? Option A is incorrect. Automatic scaling is a simpler option but does not provide the ability to set specific CPU threshold conditions Option C is incorrect. Premium P1 is a scale-up option (changing plan tier), not a scale-out method for auto-scaling instances Option D is incorrect. Standard S1 is a scale-up option, not related to auto-scaling configuration Option E is incorrect. Manual scaling requires human intervention and does not provide automatic scaling based on CPU metrics Therefore, B, Rules Based in the Scale out method settings, is the correct answer.
Play from 3:11:44 Question 100. Your company has serval departments. Each department has a number of virtual machines (VMs). The company has an Azure subscription that contains a resource group named RG1. All VMs are located in RG1. You want to associate each VM with its respective department. What should you do? Here are the options. Option A. Create Azure Management Groups for each department. Option B. Create a resource group for each department. Option C. Assign tags to the virtual machines. Option D. Modify the settings of the virtual machines. Pause the video now if you want time to think about the answer.
The correct answer is C. Assign tags to the virtual machines. Tags are the appropriate mechanism for associating metadata with Azure resources like VMs without restructuring the resource hierarchy. Since all VMs are already in RG1 and the company wants to maintain this structure while simply identifying which department owns each VM, tags provide a lightweight, flexible solution. Tags allow for arbitrary key-value pairs that enable categorization, billing tracking, and automation without moving resources between groups. Now, why are the other options incorrect? Option A is incorrect. Management Groups are for managing policies and access across multiple subscriptions and resource groups, not for organizing VMs within a single resource group by department. Option B is incorrect. Creating a resource group per department would fragment the existing RG1 structure and contradict the stated requirement that all VMs are located in RG1. Option D is incorrect. Modifying VM settings does not provide a systematic way to track and organize VMs by department for reporting or billing purposes. Therefore, C, Assign tags to the virtual machines, is the correct answer.
