AZ 104 Renewal Exam Questions and Answers (2022/2023) (Verified Answers)

QUESTION 1
You have an Azure subscription named Subscription1.
You deploy a Linux virtual machine named VM1 to Subscription1.
You need to monitor the metrics and the logs of VM1.
What should you use?
A. Azure HDInsight
B. Linux Diagnostic Extension (LAD) 3.0
C. the AzurePerformanceDiagnostics extension
D. Azure Analysis Services
B

QUESTION 2
You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual
machines will host a web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter
becomes unavailable.
What should you deploy?
A. all three virtual machines in a single Availability Zone
B. all virtual machines in a single Availability Set
C. each virtual machine in a separate Availability Zone
D. each virtual machine in a separate Availability Set
B

QUESTION 3
You have an Azure virtual machine named VM1 that runs Windows Server 2019.
You save VM1 as a template named Template1 to the Azure Resource Manager library.
You plan to deploy a virtual machine named VM2 from Template1.

What can you configure during the deployment of VM2?
A. operating system
B. administrator username
C. virtual machine size
D. resource group
B

QUESTION 4
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a
financial reporting app named App1 that does not support multiple active instances.
At the end of each month, CPU usage for VM1 peaks when App1 runs.
You need to create a scheduled runbook to increase the processor performance of VM1 at the
end of each month.
What task should you include in the runbook?
A. Add the Azure Performance Diagnostics agent to VM1.
B. Modify the VM size property of VM1.
C. Add VM1 to a scale set.
D. Increase the vCPU quota for the subscription.
E. Add a Desired State Configuration (DSC) extension to VM1.
E

QUESTION 5
Note: This question is part of a series of questions
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted
in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
Solution: You configure a custom policy definition, and then you assign the policy to the
subscription.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 6
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual
machine named VM1. VNet2 contains an Azure virtual machine named VM2.
VM1 hosts a frontend application that connects to VM2 to retrieve data.
Users report that the frontend application is slower than usual.
You need to view the average round-trip time (RTT) of the packets from VM1 to VM2.
Which Azure Network Watcher feature should you use?
A. IP flow verify
B. Connection troubleshoot
C. Connection monitor
D. NSG flow logs
C

QUESTION 7
You have an Azure subscription that has a Recovery Services vault named Vault1. The
subscription contains the virtual machines shown in the following table:
NAME—Operating System—Auto-Shutdown
VM1—WIndows Server 2012 R2—Off
VM2—WIndows Server 2016—19:00
VM3—Ubuntu Server 18.04LTS—Off
VM4—WIndows 10—19:00
You plan to schedule backups to occur every night at 23:00.
Which virtual machines can you back up by using Azure Backup?
A. VM1 and VM3 only
B. VM1, VM2, VM3 and VM4
C. VM1 and VM2 only
D. VM1 only
B

QUESTION 8
You have the Azure virtual machines shown in the following table:
NAME—Azure Region
VM1—West Europe
VM2—West Europe
VM3—North Europe
VM4—North Europe
You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?
A. Create a new Recovery Services vault
B. Create a storage account
C. Configure the extensions for VM3 and VM4
D. Create a new backup policy
A

QUESTION 9
Note: This question is part of a series of questions
You have an Azure subscription that contains the following users in an Azure Active Directory
tenant named contoso.onmicrosoft.com:
NAME—Role—Scope
User1—Global Administrator—Azure Active Directory
User2–Global Administrator—Azure Active Directory
User3—User Administrator—Azure Active Directory
User4—Owner—Azure Subscription
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User2 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
A

QUESTION 10
Note: This question is part of a series of questions
You have an Azure subscription that contains the following users in an Azure Active Directory
tenant named contoso.onmicrosoft.com:
NAME—Role—Scope
User1—Global Administrator—Azure Active Directory
User2–Global Administrator—Azure Active Directory
User3—User Administrator—Azure Active Directory
User4—Owner—Azure Subscription
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User4 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
B

QUESTION 11
Note: This question is part of a series of questions
You have an Azure subscription that contains the following users in an Azure Active Directory
tenant named contoso.onmicrosoft.com:
NAME—Role—Scope
User1—Global Administrator—Azure Active Directory
User2–Global Administrator—Azure Active Directory
User3—User Administrator—Azure Active Directory
User4—Owner—Azure Subscription
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User3 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
B

QUESTION 12
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant
named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.
An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.
You need to ensure that access to AKS1 can be granted to the contoso.com users.
What should you do first?
A. From contoso.com, modify the Organization relationships settings.
B. From contoso.com, create an OAuth 2.0 authorization endpoint.
C. Recreate AKS1.
D. From AKS1, create a namespace.
B

QUESTION 13
You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named
contoso.com.
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft
SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted after 180 days.
Which two groups should you create? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. an Office 365 group that uses the Assigned membership type
B. a Security group that uses the Assigned membership type
C. an Office 365 group that uses the Dynamic User membership type
D. a Security group that uses the Dynamic User membership type
E. a Security group that uses the Dynamic Device membership type
AC

QUESTION 14
You have an Azure policy as shown in the following exhibit: (see pdf)
What is the effect of the policy?
A. You are prevented from creating Azure SQL servers anywhere in Subscription 1.
B. You can create Azure SQL servers in ContosoRG1 only.
C. You are prevented from creating Azure SQL Servers in ContosoRG1 only.
D. You can create Azure SQL servers in any resource group within Subscription 1.
B

QUESTION 15
You have an Azure subscription named AZPT1 that contains the resources shown in the following
table:
NAME—TYPE
storage1—Azure Storage Account
VNET1—Virtual network
VM1—Azure virtual machine
VM1Managed—Managed disk for VM1
RVAULT1—Recovery Services vault for the site recovery of VM1

You create a new Azure subscription named AZPT2.
You need to identify which resources can be moved to AZPT2.
Which resources should you identify?
A. VM1, storage1, VNET1, and VM1Managed only
B. VM1 and VM1Managed only
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
D. RVAULT1 only
C

QUESTION 16
You recently created a new Azure subscription that contains a user named Admin1. Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: “User failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http:// go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.” You need to ensure that Admin1 can deploy the Marketplace resource successfully.
What should you do?
A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet
B. From the Azure portal, register the Microsoft.Marketplace resource provider
C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet
D. From the Azure portal, assign the Billing administrator role to Admin1
C

QUESTION 17
You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1.
You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Add a service endpoint to VNet1
B. Reset GW1
C. Create a route-based virtual network gateway
D. Add a connection to GW1
E. Delete GW1
F. Add a public IP address space to VNet1
CE

QUESTION 18
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Floating IP (direct server return) to Enabled
B. Idle Time-out (minutes) to 20
C. Protocol to UDP
D. Session persistence to Client IP and Protocol
D

QUESTION 19
Your on-premises network contains an SMB share named Share1.
You have an Azure subscription that contains the following resources:

A web app named webapp1
A virtual network named VNET1
You need to ensure that webapp1 can connect to Share1.
What should you deploy?
A. an Azure Application Gateway
B. an Azure Active Directory (Azure AD) Application Proxy
C. an Azure Virtual Network Gateway
C

QUESTION 20
You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual
machine scale set by using an Azure Resource Manager template.
You need to ensure that NGINX is available on all the virtual machines after they are deployed.
What should you use?
A. Azure Active Directory (Azure AD) Application Proxy
B. Azure Application Insights
C. Azure Custom Script Extension
D. the New-AzConfigurationAssignement cmdlet
C

QUESTION 21
You have an Azure web app named webapp1.
Users report that they often experience HTTP 500 errors when they connect to webapp1.
You need to provide the developers of webapp1 with real-time access to the connection errors.
The solution must provide all the connection error details.
What should you do first?
A. From webapp1, enable Web server logging
B. From Azure Monitor, create a workbook
C. From Azure Monitor, create a Service Health alert
D. From webapp1, turn on Application Logging
A

QUESTION 22
You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts.
You create a new user account named AdminUser1.
You need to assign the User administrator administrative role to AdminUser1.
What should you do from the user account properties?
A. From the Licenses blade, assign a new license
B. From the Directory role blade, modify the directory role
C. From the Groups blade, invite the user account to a new group
B

QUESTION 23
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that
contains 100 user accounts.
You purchase 10 Azure AD Premium P2 licenses for the tenant.
You need to ensure that 10 users can use all the Azure AD Premium features.
What should you do?
A. From the Licenses blade of Azure AD, assign a license
B. From the Groups blade of each user, invite the users to a group
C. From the Azure AD domain, add an enterprise application
D. From the Directory role blade of each user, modify the directory role
A

QUESTION 24
You have an Azure subscription named Subscription1 and an on-premises deployment of
Microsoft System Center Service Manager.
Subscription1 contains a virtual machine named VM1.
You need to ensure that an alert is set in Service Manager when the amount of available memory
on VM1 is below 10 percent.
What should you do first?
A. Create an automation runbook
B. Deploy a function app
C. Deploy the IT Service Management Connector (ITSM)
D. Create a notification
C

QUESTION 25
You have an on-premises server that contains a folder named D:\Folder1. You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata. Which command should you run?
A. https://contosodata.blob.core.windows.net/public
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public — snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public — recursive
D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
C

QUESTION 26
You have an Azure subscription named Subscription1 that contains the storage accounts shown
in the following table:
NAME—Account Kind—Azure service that contains data
storage1—Storage—File
storage2—StorageV2 (general purpose v2)—File,Table
storage3—StorageV2 (general purpose v2)—Queue
storage4—BlobStorage—Blob

You plan to use the Azure Import/Export service to export data from Subscription1.
You need to identify which storage account can be used to export the data.
What should you identify?
A. storage1
B. storage2
C. storage3
D. storage4
D

QUESTION 27
You have an Azure Storage account named storage1.
You plan to use AzCopy to copy data to storage1.
You need to identify the storage services in storage1 to which you can copy the data.
What should you identify?
A. blob, file, table, and queue
B. blob and file only
C. file and table only
D. file only
E. blob, table, and queue only
B

QUESTION 28
You have an Azure subscription that contains an Azure Storage account.
You plan to create an Azure container instance named container1 that will use a Docker image
named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent
storage.
You need to configure a storage service for Container1.
What should you use?
A. Azure Files
B. Azure Blob storage
C. Azure Queue storage
D. Azure Table storage
D

QUESTION 29
You have an Azure virtual machine named VM1 that runs Windows Server 2019.
You sign in to VM1 as a user named User1 and perform the following actions:

Create files on drive C.
Create files on drive D.
Modify the screen saver timeout.
Change the desktop background.
You plan to redeploy VM1.
Which changes will be lost after you redeploy VM1?
A. the modified screen saver timeout
B. the new desktop background
C. the new files on drive D
D. the new files on drive C
A

QUESTION 30
You have an Azure subscription.
You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the
exhibit.
(Click the Exhibit tab.)
You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual
machines.
What should you modify on VM1?
A. the memory
B. the network adapters
C. the hard drive
D. the processor
E. Integration Services
C

QUESTION 31
You have an Azure subscription named Subscription1 that is used by several departments at your company. Subscription1 contains the resources in the following table:
NAME—Type
Storage1—storage account
RG1—Resource group
container1—Blob container
share1—File share

Another administrator deploys a virtual machine named VM1 and an Azure Storage account
named storage2 by using a single Azure Resource Manager template.
You need to view the template used for the deployment.
From which blade can you view the template that was used for the deployment?
A. VM1
B. RG1
C. storage2
D. container1
B

QUESTION 32
You have an Azure web app named App1. App1 has the deployment slots shown in the following table:
NAME—Function
webapp1-prod—Production
webapp1-test—Staging

In webapp1-test, you test several changes to App1.
You back up App1.
You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance
issues. You need to revert to the previous version of App1 as quickly as possible.
What should you do?
A. Redeploy App1
B. Swap the slots
C. Clone App1
D. Restore the backup of App1
B

QUESTION 33
Note: This question is part of a series of questions
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
the virtual networks.
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork
provider.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 34
Note: This question is part of a series of questions
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
the virtual networks.
Solution: You assign a built-in policy definition to the subscription.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 35
You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is
available during planned maintenance of the hardware hosting VM1 and VM2.
What should you include in the Availability Set?
A. one update domain
B. two fault domains
C. one fault domain
D. two update domains
D

QUESTION 36
Note: This question is part of a series of questions
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1.
Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 37
Note: This question is part of a series of questions that
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Automation script.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 38
Note: This question is part of a series of questions that
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Deployments.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 39
Hotspot Question
You have an Azure subscription named Subscription1 that contains a resource group named RG1.In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

To add a backend pool to LB1
A. Contributor on LB1
B. Network Contributor on LB1
C. Network Contributor on RG1
D. Owner on LB1

To add a health probe to LB2:
A. Contributor on LB2
B. Network Contributor on LB2
C. Network Contributor on RG1
D. Owner on LB2
BB

QUESTION 40
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table:
(see pdf)

User3 is the owner of Group1.
Group2 is a member of Group1.
You configure an access review named Review1 as shown in the following exhibit: (see pdf)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

STATEMENTS
User3 can perform access review of User1
User3 can perform access review of UserA
User3 can perform access review of UserB

A. Yes to All
B. Yes No Yes
C. No to all
D. No Yes Yes
A

QUESTION 41
Hotspot Question
You have the Azure management groups shown in the following table: (see pdf)

You add Azure subscriptions to the management groups as shown in the following table: (see pdf)

You create the Azure policies shown in the following table: (see pdf)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

STATEMENTS
You can create a virtual network in Subscription1
You can create a virtual machine in Subscription2
You can add Subscription1 to ManagementGroup11

A. Yes to All
B. Yes No Yes
C. No to all
D. No Yes Yes
D

QUESTION 42
Hotspot Question
You have an Azure subscription that contains the resources shown in the following table: (see pdf)
You assign a policy to RG6 as shown in the following table: (see pdf)
To RG6, you apply the tag: RGroup: RG6.
You deploy a virtual network named VNET2 to RG6.
Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer
area.
NOTE: Each correct selection is worth one point.

VNET1
A. None
B. Department: D1 only
C. Department: d1 and Rgroup: RG6 only
D. Department: d1 and Label: Value1 only
E. Department: D1, RGroup: RG6, and Label: Value1

VNET2
A. None
B. RGroup: RG6 only
C. Label: Value1 only
D. Rgroup: RG6 and Label: Value1
DC

QUESTION 43
Hotspot Question
You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure file share named share1.
You create a shared access signature (SAS) named SAS1 as shown in the following exhibit: (see pdf)
To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

If on Sept. 2, 2018, you run Microsoft Azure Storage Explorer on a computer that has an IP address of 193.77.134.1, and you use SAS1 to connect to the storage account you [answer choice]
A. will be prompted for credentials
B. Will have no access
C. will have read, write, and list access
D. will have read-only access

If on Sept. 10, 2018, you run the net use command on a computer that has an IP address of 193.77.134.50, and you use SAS1 as the password to connect to share1, you [answer choice]
A. will be prompted for credentials
B. Will have no access
C. will have read, write, and list access
D. will have read-only access
BC

QUESTION 44
Hotspot Question
You have Azure subscription that includes following Azure file shares: (see pdf)
You have the following on-premises servers: (see pdf)
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 in Sync1. You add D:\Folder1 on Server1 as a server endpoint of Group1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
share2can be added as a cloud endpoint for group1
E:\Folder2 on Server1 can be added as a server endpoint for Group1
D:\Data on Server2 can be added as a server endpoint for Group1

A. Yes to all
B. Yes Yes No
C. No to all
D. No Yes Yes
D

QUESTION 45
Drag and Drop Question
You have an Azure subscription named Subscription1.
You create an Azure Storage account named contosostorage, and then you create a file share named data. Which UNC path should you include in a script that references files from the data file share? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point. (Select 3 in the correct order)

A. blob
B. contosostorage
C. file
D. portal.azure.com
E. blob.core.windows.net
F. data
G. file.core.windows.net
H. subscription1
BGF

QUESTION 46
Drag and Drop Question
You have an on-premises file server named Server1 that runs Windows Server 2016.
You have an Azure subscription that contains an Azure file share.
You deploy an Azure File Sync Storage Sync Service, and you create a sync group.
You need to synchronize files from Server1 to Azure.
Which three actions should you perform in sequence? To answer, move the appropriate actions
from the list of actions to the answer area and arrange them in the correct order.

A. Install the Azure File Sync agent on Server 1
B. Create an Azure on-premises data gateway
C. Create a Recovery Services vault
D. Register Server 1
E. Add a server endpoint
F. Install the DFS Replication server role on Server1
ADE

Hotspot Question
You plan to create an Azure Storage account in the Azure region of East US 2.
You need to create a storage account that meets the following requirements:

Replicates synchronously.
Remains available if a single data center in the region fails.
How should you configure the storage account? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.

Replication
A. Geo-redundant storage (GRS)
B. Locally-redundant storage (LRS)
C. Read-access geo-redundant storage (RA GRS)
D. Zone-redundant storage (ZRS)

Account type:
A. Blob storage
B. Storage (general purpose v1)
C. StorageV2 (general purpose v2)
DC

QUESTION 48
Hotspot Question
You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage.
You need to use AzCopy to copy data to the blob storage and file storage in storage1.
Which authentication method should you use for each type of storage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Blob storage:
A. Azure Active Directory (Azure AD) only
B. Shared access signatures (SAS) only
C. Access keys and shared access signatures (SAS) only
D. Azure AD and SAS only
E. Azure AD, access keys, and SAS

File storage:
A. Azure Active Directory (Azure AD) only
B. Shared access signatures (SAS) only
C. Access keys and shared access signatures (SAS) only
D. Azure AD and SAS only
E. Azure AD, access keys, and SAS
DB

QUESTION 49
Hotspot Question
You have an Azure subscription named Subscription1 that contains the resources shown in the
following table: (see pdf)
You plan to configure Azure Backup reports for Vault1.
You are configuring the Diagnostics settings for the AzureBackupReports log.
Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of Vault1? To answer, select the appropriate options in the answer area.

Storage accounts:
A. storage1 only
B. storage2 only
C. storage3 only
D. storage1, storage2, storage3

Log Analytics workspaces:
A. Analytics1 only
B. Analytics2 only
C. Analytics3 only
D. Analytics1, Analytics2, Analytics3
CC

QUESTION 50
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine
named VM1.
You install and configure a web server and a DNS server on VM1.
VM1 has the effective network security rules shown in the following exhibit: (see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on
the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Internet users…
A. can connect to only the DNS server on VM1
B. can connect to only the web server on VM1
C. can connect to the web server and the DNS server on VM1
D. cannot connect to the web server and the DNS server on VM1

If you delete Rule2 Internet users…
A. can connect to only the DNS server on VM1
B. can connect to only the web server on VM1
C. can connect to the web server and the DNS server on VM1
D. cannot connect to the web server and the DNS server on VM1
BC

QUESTION 51
Hotspot Question
You have an Azure subscription that contains a virtual machine scale set. The scale set contains
four instances that have the following configurations:

Operating system: Windows Server 2016
Size: Standard_D1_v2
You run the get-azvmss cmdlet as shown in the following exhibit: (see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on
the information presented in the graphic.
NOTE: Each correct selection is worth one point.

When an administrator changes the virtual machine size, the size will be changed on up to [answer choice] virtual machines simultaneously.
A. 0
B. 1
C. 2
D. 4

When a new build of the Windows Server 2016 image is released, the new build will be deployed up to [answer choice] virtual machines simultaneously.
A. 0
B. 1
C. 2
D. 4
AD

QUESTION 52
Hotspot Question
You have an Azure subscription that contains the resources in the following table: (see pdf)
In Azure, you create a private DNS zone named adatum.com. You set the registration virtual network to VNet2. The adatum.com zone is configured as shown in the following exhibit: (see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
The A record fo VM5 will be registered automatically in the adatum.com zone.
VM5 can resolve VM9.adadum.com
VM6 can resolve VM9.adatum.com

A. No No Yes
B. No to all
C. Yes to all
D. Yes No Yes
A

QUESTION 53
Hotspot Question
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 10.0.0.0/16 and contains the subnets in the following table: (see table)
Subnet1 contains a virtual appliance named VM1 that operates as a router. You create a routing table named RT1.
You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.
How should you configure RT1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Address prefix:
A. 10.0.0.0/16
B. 10.0.1.0/24
C. 10.0.254.0/24

Next hop type:
A. Virtual appliance
B. Virtual network
C. Virtual network gateway

Assigned to:
A. GatewaySubnet
B. Subnet0
C. Subnet1 and Subnet2
AAA

QUESTION 54
Hotspot Question
You have an Azure subscription that contains the virtual machines shown in the following table: (see pdf)
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow
inbound Remote Desktop connections.
Subnet1 and Subnet2 are in a virtual network named VNET1.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1
uses only the default rules.
NSG2 uses the default rules and the following custom incoming rule:

Priority: 100
Name: Rule1
Port: 3389
Protocol: TCP
Source: Any
Destination: Any
Action: Allow
NSG1 is associated to Subnet1. NSG2 is associated to the network interface of VM2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
From the Internet, you can connect to VM1 using Remote Desktop
From the internet, you can connect to VM2 using Remote Desktop
From VM1, you can connect to VM2 using Remote Desktop

A. Yes No Yes
B. No Yes Yes
C. Yes to all
D. Yes No No
B

QUESTION 55
Hotspot Question
You have a virtual network named VNET1 that contains the subnets shown in the following table: (see pdf)
You have two Azure virtual machines that have the network configurations shown in the following
table: (see pdf)
For NSG1, you create the inbound security rule shown in the following table: (see pdf)
For NSG2, you create the inbound security rule shown in the following table: (see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
VM2 can connect to the TCP port 1433 services on VM1
VM1 can connect to the TCP port 1433 services on VM2
VM2 can connect to the TCP port 1433 services on VM3

A. Yes No Yes
B. No Yes Yes
C. Yes to all
D. Yes No No
C

QUESTION 56
Hotspot Question
You have an Azure subscription named Subscription1.
Subscription1 contains the virtual machines in the following table:
(see pdf)
Subscription1 contains a virtual network named VNet1 that has the subnets in the following table: (see pdf)
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3.
You create a route table named RT1 that contains the routes in the following table: (see pdf)
You apply RT1 to Subnet1 and Subnet2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
VM3 can establish a network connection to VM1
If VM3 is turned off, VM2 can establish a network connection to VM1
VM1 can establish a network connection to VM2

A. Yes No Yes
B. No Yes Yes
C. Yes to all
D. Yes No No
A

QUESTION 57
Hotspot Question
You create a Recovery Services vault backup policy named Policy1 as shown in the following
exhibit: (see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

The backup that occurs on Sunday, March 1, will be retained for [answer choice]
A. 30 days
B. 10 weeks
C. 36 months
D. 10 years

The backup that occurs on SUnday, November 1, will be retianed for [answer choice]
A. 30 days
B. 10 weeks
C. 36 months
D. 10 years
DC

QUESTION 58
You have an Azure subscription that contains 10 virtual machines. You need to ensure that you receive an email message when any virtual machines are powered off, restarted, or deallocated.
What is the minimum number of rules and action groups that you require?
A. three rules and three action groups
B. one rule and one action group
C. three rules and one action group
D. one rule and three action groups
C

You have an Azure subscription that contains two resource groups named RG1 and RG2. RG2 does not contain any resources. RG1 contains the resources in the following table.
NAME—TYPE—Description—Lock
VNET1—Virtual Network—Virtual network—ReadOnly
VNET3—Virtual Network—Classic Virtual network—None
W10—Virtual Machine—VM runs Windows 10, stopped—Delete
W10_OsDisk—Disk—Managed SSD disk on W10—None

Which resource can you move to RG2?
A. W10_OsDisk
B. VNet1
C. VNet3
D. W10
B

QUESTION 60
You have 100 Azure subscriptions. All the subscriptions are associated to the same Azure Active Directory (Azure AD) tenant named contoso.com.
You are a global administrator.
You plan to create a report that lists all the resources across all the subscriptions.
You need to ensure that you can view all the resources in all the subscriptions.
What should you do?
A. From the Azure portal, modify the profile settings of your account.
B. From Windows PowerShell, run the Add-AzureADAdministrativeUnitMember cmdlet.
C. From Windows PowerShell, run the New-AzureADUserAppRoleAssignment cmdlet.
D. From the Azure portal, modify the properties of the Azure AD tenant.
D

QUESTION 61
Note: This question is part of a series of questions
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1.
Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 62
Note: This question is part of a series of questions
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Deployments.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 63
Note: This question is part of a series of questions
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1.
Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 64
You have the Azure virtual machines shown in the following table.
NAME—Azure Region
VM1—West Europe
VM2—West Europe
VM3—North Europe
VM4—North Europe

You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?
A. Configure the extensions for VM3 and VM4.
B. Create a new Recovery Services vault.
C. Create a storage account.
D. Create a new backup policy.
B

QUESTION 65
You have an Azure subscription that contains the resources in the following table.
NAME—TYPE
RG1—Resource Group
Store1—Azure Storage account
Sync1—Azure File Sync

Store1 contains a file share named Data. Data contains 5,000 files.
You need to synchronize the files in Data to an on-premises server named Server1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Download an automation script.
B. Create a container instance.
C. Create a sync group.
D. Register Server1.
E. Install the Azure File Sync agent on Server1.
CDE

Question 66
You plan to use the Azure Import/Export service to copy files to a storage account.
Which two files should you create before you prepare the drives for the import job? Each correct
answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. an XML manifest file
B. a driveset CSV file
C. a dataset CSV file
D. a PowerShell PS1 file
E. a JSON configuration file
BC

QUESTION 67
You have a Recovery Service vault that you use to test backups. The test backups contain two
protected virtual machines.
You need to delete the Recovery Services vault.
What should you do first?
A. From the Recovery Service vault, stop the backup of each backup item.
B. From the Recovery Service vault, delete the backup data.
C. Modify the disaster recovery properties of each virtual machine.
D. Modify the locks of each virtual machine.
A

QUESTION 68
You have an Azure subscription that contains 100 virtual machines.
You regularly create and delete virtual machines.
You need to identify unused disks that can be deleted.
What should you do?
A. From Microsoft Azure Storage Explorer, view the Account Management properties.
B. From the Azure portal, configure the Advisor recommendations.
C. From Cloudyn, open the Optimizer tab and create a report.
D. From Cloudyn, create a Cost Management report.
C

QUESTION 69
You have an Azure subscription named Subscription1.
You deploy a Linux virtual machine named VM1 to Subscription1.
You need to monitor the metrics and the logs of VM1.
What should you use?
A. Linux Diagnostic Extension (LAD) 3.0
B. Azure Analysis Services
C. The AzurePerformanceDiagnostics extension
D. Azure HDInsight
A

QUESTION 70
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.
You add a network interface named Interface1 to VM1 as shown in the exhibit (see pdf)
From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.
You need to establish a Remote Desktop connection to VM1.
What should you do first?
A. Start VM1.
B. Attach a network interface.
C. Delete the DenyAllOutBound outbound port rule.
D. Delete the DenyAllInBound inbound port rule.
A

QUESTION 71
You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image.
You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE Each correct selection is worth one point.
A. Modify the extensionProfile section of the Azure Resource Manager template.
B. Create a new virtual machine scale set in the Azure portal.
C. Create an Azure policy.
D. Create an automation account.
E. Upload a configuration script.
AE

QUESTION 72
You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-ofbusiness application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1:
Change the size to D8s v3.
Add a 500-GB managed disk.
Add the Puppet Agent extension.
Attach an additional network interface.
Which change will cause downtime for VM1?
A. Add a 500-GB managed disk.
B. Attach an additional network interface.
C. Add the Puppet Agent extension.
D. Change the size to D8s v3.
D

QUESTION 73
Note: This question is part of a series
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure
Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a
different host immediately.
Solution: From the Redeploy blade, you click Redeploy.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 74
Note: This question is part of a series
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure
Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a
different host immediately.
Solution: From the Overview blade, you move the virtual machine to a different resource group.
A. Yes
B. No
B

QUESTION 75
You have an Azure subscription that contains the resources in the following table.
NAME—TYPE
ASG1—Application Security group
NSG1—Network Security Group (NSG)
Subnet1—Subnet
VNET1—Virtual Network
NIC1—Network Interface
VM1—Virtual machine

Subnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1.
You need to apply ASG1 to VM1.
What should you do?
A. Modify the properties of NSG1.
B. Modify the properties of ASG1.
C. Associate NIC1 to ASG1.
C

QUESTION 76
You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant.
Subscription1 contains a virtual network named VNet1.VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2.
What should you do first?
A. Move VNet1 to Subscription2.
B. Modify the IP address space of VNet2.
C. Provision virtual network gateways.
D. Move VM1 to Subscription2.
C

QUESTION 77
Your company has an Azure subscription named Subscription1. The company also has two onpremises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com.
Adatum.com contains 1,000 DNS records.
You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed:

The DNS Manager console
Azure PowerShell
Azure CLI 2.0
You need to move the adatum.com zone to Subscription1. The solution must minimize administrative effort. What should you use?
A. Azure PowerShell
B. Azure CLI
C. the Azure portal
D. the DNS Manager console
B

QUESTION 78
You have an Azure subscription that contains the resources in the following table.
NAME—TYPE—DETAILS
VNET1—Virtual network—not applicable
Subnet1—Subnet—Hosted on VNET1
VM1—Virtual machine—On SUbnet1
VM2—Virtual machine—On SUbnet1

VM1 and VM2 are deployed from the same template and host line-of-business applications accessed by using Remote Desktop. You configure the network security group (NSG) shown in the exhibit. (see pdf)
You need to prevent users of VM1 and VM2 from accessing websites on the Internet. What should you do?
A. Associate the NSG to Subnet1.
B. Disassociate the NSG from a network interface.
C. Change the DenyWebSites outbound security rule.
D. Change the Port_80 inbound security rule.
A

QUESTION 79
You have an Azure subscription that contains the resources in the following table.
Name—Type—Azure Region—Resource Group
Vnet1—Virtual network—West US—RG2
Vnet2—Virtual network—West US—RG1
Vnet3—virtual network—East US—RG1
NSG1—Network security group—East US—RG2
To which subnets can you apply NSG1?
A. the subnets on VNet2 only
B. the subnets on VNet1 only
C. the subnets on VNet2 and VNet3 only
D. the subnets on VNet1, VNet2, and VNet3
E. the subnets on VNet3 only
E

QUESTION 80
You create an Azure Storage account named contosostorage.
You plan to create a file share named data.
Users need to map a drive to the data file share from home computers that run Windows 10.
Which port should be open between the home computers and the data file share?
A. 80
B. 443
C. 445
D. 3389
C

QUESTION 81
You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.
Your company has a public DNS zone for contoso.com.
You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure
can verify the domain name.
Which type of DNS record should you create?
A. RRSIG
B. PTR
C. DNSKEY
D. TXT
D

QUESTION 82
Note: This question is part of a series
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
the virtual networks.
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork
provider.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 83
Note: This question is part of a series
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
the virtual networks.
Solution: You configure a custom policy definition, and then you assign the policy to the subscription.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 84
Note: This question is part of a series
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
the virtual networks.
Solution: You create a resource lock, and then you assign the lock to the subscription..
Does this meet the goal?
A. Yes
B. No
B

QUESTION 85
You have an Azure Active Directory (Azure AD) domain that contains 5,000 user accounts.
You create a new user account named AdminUser1.
You need to assign the User administrator administrative role to AdminUser1.
What should you do from the user account properties?
A. From the Directory role blade, modify the directory role.
B. From the Groups blade, invite the user account to a new group.
C. From the Licenses blade, assign a new license.
A

QUESTION 86
You have an Active Directory forest named contoso.com.
You install and configure Azure AD Connect to use password hash synchronization as the single sign-on (SSO) method. Staging mode is enabled.
You review the synchronization results and discover that the Synchronization Service Manager does not display any sync jobs.
You need to ensure that the synchronization completes successfully.
What should you do?
A. From Synchronization Service Manager, run a full import.
B. Run Azure AD Connect and set the SSO method to Pass-through Authentication.
C. From Azure PowerShell, run Start-AdSyncSyncCycle -PolicyType Initial.
D. Run Azure AD Connect and disable staging mode.
D

QUESTION 87
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts.
You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10 users can use all the Azure AD Premium features.
What should you do?
A. From the Groups blade of each user, invite the users to a group.
B. From the Licenses blade of Azure AD, assign a license.
C. From the Directory role blade of each user, modify the directory role.
D. From the Azure AD domain, add an enterprise application.
B

QUESTION 88
You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines. You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text.
What should you create to store the password?
A. Azure Active Directory (AD) Identity Protection and an Azure policy
B. a Recovery Services vault and a backup policy
C. an Azure Key Vault and an access policy
D. an Azure Storage account and an access policy
C

QUESTION 89
Note: This question is part of a series
Your company registers a domain name of contoso.com.
You create an Azure DNS named contoso.com and then you add an A record to the zone for ahost named www that has an IP address of 131.107.1.10.
You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.
You need to resolve the name resolution issue.
Solution: You modify the name server at the domain register.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 90
Note: This question is part of a series
Your company registers a domain name of contoso.com.
You create an Azure DNS named contoso.com and then you add an A record to the zone for ahost named www that has an IP address of 131.107.1.10.
You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.
You need to resolve the name resolution issue.
Solution: You add an NS record to the contoso.com Azure DNS zone.
A. Yes
B. No
B

QUESTION 91
Note: This question is part of a series
Your company registers a domain name of contoso.com.
You create an Azure DNS named contoso.com and then you add an A record to the zone for ahost named www that has an IP address of 131.107.1.10.
You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.
You need to resolve the name resolution issue.
Solution: You modify the SOA record in the contoso.com zone.
A. Yes
B. No

QUESTION 92
Note: This question is part of a series
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view
the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Automation script.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 93
Note: This question is part of a series
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately.
Solution: From the Overview blade, you move the virtual machine to a different resource group.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 94
Note: This question is part of a series
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately.
Solution: From the Update management blade, you click enable.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 95
You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com. Your company has a public DNS zone for contoso.com. You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name.
Which type of DNS record should you create?
A. PTR
B. MX
C. NSEC3
D. RRSIG
B

QUESTION 96
You manage an Azure Windows Server virtual machine (VM) that hosts several SQL Server databases.
You need to configure backup and retention policies for the VM. The backup policy must include transaction log backups.
What should you do?
A. Configure point-in-time and long-term retention policies from the SQL Servers Azure portal blade.
B. Configure a SQL Server in Azure VM backup policy from the Recovery Services Azure portal blade.
C. Configure a continuous delivery deployment group from the Virtual Machine Azure portal blade.
D. Configure a point-in-time snapshot from the Disks Azure portal blade.
B

QUESTION 97
The development team asks you to provision an Azure storage account for their use. To remain in compliance with IT security policy, you need to ensure that the new Azure storage account meets the following requirements:

Data must be encrypted at rest.
Access keys must facilitate automatic rotation.
The company must manage the access keys.
What should you do?
A. Create a service endpoint between the storage account and a virtual network (VNet).
B. Require secure transfer for the storage account.
C. Enable Storage Service Encryption (SSE) on the storage account.
D. Configure the storage account to store its keys in Azure Key Vault.
D

QUESTION 98
You have several Windows Server and Ubuntu Linux virtual machines (VMs) distributed across
two virtual networks (VNets):

prod-vnet-west (West US region)
prod-vnet-east (East US region)
You need to allow VMs in either VNet to connect and to share resources by using only the Azure backbone network.
Your solution must minimize cost, complexity, and deployment time.
What should you do?
A. Add a service endpoint to each VNet.
B. Configure peering between prod-vnet-west and prod-vnet-west.
C. Create a private zone in Azure DNS.
D. Deploy a VNet-to-VNet virtual private network (VPN).
B

QUESTION 99
Your company’s local environment consists of a single Active Directory Domain Services (AD DS) domain.
You plan to offer your users single sign-on (SSO) access to Azure-hosted software-as-a-service (SaaS) applications that use Azure Active Directory (Azure AD) authentication.
The tenant’s current domain name is companycom.onmicrosoft.com.
You need to configure Azure AD to use company.com, the organization’s owned public domain name.
What should you do?
A. Add a company.com user principal name (UPN) suffix to the AD DS domain.
B. Run Azure AD Connect from a domain member server and specify the custom installation option.
C. Remove the companycom.onmicrosoft.com domain name from the Azure AD tenant.
D. Add a DNS verification record at the domain registrar.
D

QUESTION 100
Drag and Drop Question
You have an Azure subscription that contains a storage account.
You have an on-premises server named Server1 that runs Window Server 2016.
Server1 has 2 TB of data.
You need to transfer the data to the storage account by using the Azure Import/Export service.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Actions
A. Attach an external disk to Server1, and then run waimportexport.exe
B. From Azure portal, create an import job.
C. Detach the external disks from Server1 and ship the disks to an Azure data center
D. From Azure portal, update the import job.
ABCD

QUESTION 101
Hotspot Question
You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure file share named share1.
You create a shared access signature (SAS) named SAS1 as shown in the following exhibit. (see pdf)

To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

If on Sept. 2, 2018, you ran Microsoft Azure Storage Explorer on a computer that has an IP address of 193.77.134.1, and you use SAS1 to connect to the storage account, you [answer choice]
A. will be prompted for credentials
B. will have no access
C. Will have read, write, and list access
D. will have read-only access

If on Sept 10, 2018, you run the net use command on a computer that has an IP address of 193.77.134.50, and you use SAS1 as the password to connect to share1, you [answer choice]
A. will be prompted for credentials
B. will have no access
C. Will have read, write, and list access
D. will have read-only access
BC

QUESTION 102
Drag and Drop Question
You have an on-premises file server named Server1 that runs Windows Server 2016.
You have an Azure subscription that contains an Azure file share.
You deploy an Azure File Sync Storage Sync Service, and you create a sync group.
You need to synchronize files from Server1 to Azure.
Which three actions should you perform in sequence? To answer, move the appropriate actions
from the list of actions to the answer area and arrange them in the correct order.

A. Create an Azure on-prem data gateway
B. Install the Azure File Sync agent on Server1
C. Create a Recovery Services vault
D. Register server1
E. Install the DFS Replication server role on Server1
F. Add a server endpoint
BDF

QUESTION 103
Hotspot Question
You plan to create an Azure Storage account in the Azure region of East US 2.
You need to create a storage account that meets the following requirements:

Replicates synchronously
Remains available if a single data center in the region fails.
How should you configure the storage account? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.

Replication:
A. Geo-redundant storage (GRS)
B. Locally-redundant storage (LRS)
C. Read-access geo-redundant storage (RA GRS)
D. Zone-redundant storage (ZRS)

Account kind:
A. Blob storage
B. Storage (general purpose v1)
C. StorageV2 (general purpose v2)
DC

Question 104
Drag and Drop Question
You have an Azure subscription named Subscription1.
You create an Azure Storage account named contosostorage, and then you create a file sharenamed data.
Which UNC path should you include in a script that references files from the data file share?
To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Answer area \ [VALUE] . [VALUE] \ [VALUE]

Values
A. blob
B. blob.core.windows.net
C. contosostorage
D. data
E. file
F. file.core.windows.net
G. portal.azure.com
H. subscription1
CFD

QUESTION 105
Hotspot Question
You have an Azure Storage accounts as shown in the following exhibit. (see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

You can use [answer choice] for Azure Table Storage
A. storageaccount1 only
B. storageaccount2 only
C. storageaccount3 only
D. storageaccount1 and storageaccount2 only
E. storageaccount2 and storageaccount3 only

You can use [answer choice] for Azure Blob storage
A. storageaccount3
B. storageaccount2 and storageaccount3
C. storageaccount1 and storageaccount2
D. all storage accounts
DD

QUESTION 106
Drag and Drop Question
You have an Azure subscription that contains an Azure virtual machine named VM1.
VM1 runs Windows Server 2016 and is part of an availability set.
VM1 has virtual machine-level backup enabled.
VM1 is deleted.
You need to restore VM1 from the backup. VM1 must be part of the availability set.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

A. From the Restore configuration blade, set Restore type to Create Virtual Machine
B. From the VM1 blade, edit the disk settings of the OS disk
C. From the Restore configuration blate, set Restore type to Restore disks
D. From the Recovery Services vault, deploy a template
E. From the VM1 blade, add a disk
F. From the Recovery Services vault, select a restore point for the VM
FCD

QUESTION 107
Hotspot Question
You have an Azure subscription named Subscription1.
You plan to deploy an Ubuntu Server virtual machine named VM1 to Subscription1.
You need to perform a custom deployment of the virtual machine.
A specific trusted root certification authority (CA) must be added during the deployment.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

File to create:
A. Answer.ini
B. Autounattend.conf
C. Cloud-init.txt
D. Unattend.xml

Tool to use to deploy the virtual machine:
A. The az vm create command
B. The Azure Portal
C. The New-AzureRmVM cmdlet
CA

QUESTION 108
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines named VM1 and VM2.
VM1 and VM2 run Windows Server 2016. VM1 is backed up daily by Azure Backup without using the Azure Backup agent.
VM1 is affected by ransomware that encrypts data.
You need to restore the latest backup of VM1.
To which location can you restore the backup? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You can perform a file recovery of VM1 to:
A. VM1 only
B. VM2 only
C. VM1 and VM2 only
D. A new Azure virtual machine only
E. Any Windows computer that has internet connectivity

You can restore VM1 to:
A. VM1 only
B. VM2 only
C. VM1 and VM2 only
D. A new Azure virtual machine only
E. Any Windows computer that has internet connectivity
AD

QUESTION 109
Hotspot Question
You purchase a new Azure subscription named Subscription1.
You create a virtual machine named VM1 in Subscription1.
VM1 is not protected by Azure Backup.
You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored for 30 days.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Location in which to store the backups:
A. a blob container
B. a file share
C. a Recovery services Vault
D. a storage account

Object to use to configure the protection for VM1
A. a backup policy
B. a batch job
C. a batch schedule
D. a recovery plan
CA

QUESTION 110
Drag and Drop Question
You have an availability set named AS1 that contains three virtual machines named VM1, VM2, and VM3.
You attempt to reconfigure VM1 to use a larger size. The operation fails and you receive an allocation failure message.
You need to ensure that the resize operation succeeds.
Which three actions should you perform in sequence? To answer, move the appropriate actions
from the list of actions to the answer area and arrange them in the correct order.

A. Start VM1, VM2, and VM3
B. Stop VM1, VM2, and VM3
C. Start VM2 and VM3
D. Resize VM1
E. Stop VM2 and VM3
F. Start VM1
BDA

QUESTION 111
Drag and Drop Question
You have an Azure subscription. The subscription includes a virtual network named VNet1.
Currently, VNet1 does not contain any subnets.
You plan to create subnets on VNet1 and to use application security groups to restrict the traffic between the subnets.
You need to create the application security groups and to assign them to the subnets.
Which four cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

A. New-AzureRmVirtualNetwork
B. New-AzureRmNetworkSecurityGroup
C. New-AzureRmApplicationSecurityGroup
D. New-AzureRmNetworkSecurityRuleConfig
E. Add-AzureRmVirtualNetworkSubnetConfig
CDBE

QUESTION 112
Hotspot Question
You have an Azure subscription named Subscription1.
Subscription1 contains the virtual machines in the following table.
(see pdf)
Subscription1 contains a virtual network named VNet1 that has the subnets in the following table.
(see pdf)
VM3 has a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3.
You create a route table named RT1. RT1 is associated to Subnet1 and Subnet2 and contains the routes in the following table.
(see pdf)
You apply RT1 to Subnet1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
Network traffic from VM3 can reach VM1
If VM3 is turned off, network traffic from VM2 can reach VM1
Network traffic from VM1 can reach VM2

A. No Yes No
B. Yes to all
C. No to all
D. Yes No Yes
D

QUESTION 113
Hotspot Question
You plan to deploy five virtual machines to a virtual network subnet. Each virtual machine will have a public IP address and a private IP address.
Each virtual machine requires the same inbound and outbound security rules.
What is the minimum number of network interfaces and network security groups that you require?
To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Minimum number of network interfaces:
A. 5
B. 10
C. 15
D. 20

Minimum number of network security groups:
A. 1
B. 2
C. 5
D. 10
AA

QUESTION 114
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains the resources in
the following table.
(see pdf)
In Azure, you create a private DNS zone named adatum.com.
You set the registration virtual network to VNet2. The adatum.com zone is configured as shown in
the following exhibit.
(see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
The A record for VM5 will be registered automatically in the adatum.com.zone
VM5 can resolve VM9.adatum.com
VM6 can resolve VM9.adatum.com

A. No No Yes
B. Yes Yes No
C. No Yes No
D. Yes No Yes
A

QUESTION 115
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
You install and configure a web server and a DNS server on VM1.
VM1 has the effective network security rules shown in the following exhibit.
(see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Internet users [answer choice]
A. can connect to only the DNS server on VM1
B. can connect to only the web server on VM1
C. can connect to the web server and the DNS server on VM1
D. cannot connect to the web server and the DNS server on VM1

If you delete Rule2, Internet users [answer choice]
A. can connect to only the DNS server on VM1
B. can connect to only the web server on VM1
C. can connect to the web server and the DNS server on VM1
D. cannot connect to the web server and the DNS server on VM1
BC

QUESTION 116
Hotspot Question
You have peering configured as shown in the following exhibit.
(see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Hosts on vNET6 can communicate with hosts on [answer choice]
A. vNET6 only
B. vNET6 and vNET1 only
C. vNET6, vNET1, and vNET2 only
D. all the virtual networks in the subscription

To change the status of the peering connection to vNET1 to Connected, you must first [answer choice]
A. add a service endpoint
B. add a subnet
C. delete peering1
D. modify the address space
AC

QUESTION 117
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains the virtual networks in the following table.
(see pdf)
Subscription1 contains the virtual machines in the following table:
(see pdf)
The firewalls on all the virtual machines are configured to allow all ICMP traffic. You add the peerings in the following table.
(see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
VM1 can ping VM3
VM2 can ping VM3
VM2 can ping VM1

A. No No Yes
B. Yes to all
C. Yes No No
D. No Yes No
C

QUESTION 118
Drag and Drop Question
You have an Azure Active Directory (Azure AD) tenant that has the initial domain name.
You have a domain name of contoso.com registered at a third-party registrar. You need to ensure that you can create Azure AD users that have names containing a suffix of @contoso.com.
Which three actions should you perform in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

A. Configure company branding
B. Add an Azure AD tenant
C. Verify the domain
D. Create an Azure DNS zone
E. Add a custom domain name
F. Add a record to the public contoso.com DNS zone
EFC

QUESTION 119
Hotspot Question
You have an Azure subscription named Subscription1.
Subscription1 contains the resources in the following table.
NAME—TYPE
RG1—Resource Group
RG2—Resource Group
VNet1—Virtual network
VNet2—Virtual network

VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and Vnet2.
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1.
M1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.
You need to move the custom application to Vnet2.
The solution must minimize administrative effort.
Which two actions should you perform? To answer, select the appropriate options in the answer area.

First Action
A. Create a network interface in RG2
B. Detach a network interface
C. Delete VM1
D. Move a network interface to RG2

Second Action
A. Attach a network interface
B. Create a network interface in RG2
C. Create a new virtual machine
D. Move VM1 to RG2
CC

QUESTION 120
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains the groups in the following table.
(see pdf)
You create two user accounts that are configured as shown in the following table.
(see pdf)
To which groups do User1 and User2 belong? To answer. select the appropriate options in the answer area.

User1
A. Group1 only
B. Group2 only
C. Group3 only
D. Group 1 and Group2 only
E. Group1 and Group3 only
F. Group2 and Group3 only
G. Group1, Group2, and Group3

User2
A. Group1 only
B. Group2 only
C. Group3 only
D. Group 1 and Group2 only
E. Group1 and Group3 only
F. Group2 and Group3 only
G. Group1, Group2, and Group3
DD

QUESTION 121
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Idle Time-out (minutes) to 20
B. Floating IP (direct server return) to Disabled
C. Floating IP (direct server return) to Enabled
D. Session persistence to Client IP and protocol
D

QUESTION 122
You are the global administrator for an Azure Active Directory (Azure AD) tenant named adatum.com.
You need to enable two-step verification for Azure users.
What should you do?
A. Configure a playbook in Azure AD conditional access policy.
B. Create an Azure AD conditional access policy.
C. Create and configure the Identify Hub.
D. Install and configure Azure AD Connect.
B

QUESTION 123
From the MFA Server blade, you open the Block/unblock users blade as shown in the exhibit.
Block/unblock users
A blocked user will not receive Multi-Factor Authentication requests. Authentication attempts for that user will be automatically denied. A user will remain blocked for 90 days from the time they are blocked. To manually unblock a user, click the “Unblock” action.
(see pdf)
What caused AlexW to be blocked?
A. The user entered an incorrect PIN four times within 10 minutes.
B. The user account password expired.
C. An administrator manually blocked the user.
D. The user reported a fraud alert when prompted for additional authentication.
C

QUESTION 124
You have the Azure virtual networks shown in the following table.
NAME—Address space—Subnet—Resource group Azure region
VNet1—10.11.0.0/16—10.11.0.0/17—West US
Vnet2—10.11.0.0/17—10.11.0.0/25—West US
Vnet3—10.10.0.0/22—10.10.1.0/24—East US
Vnet4—192.168.16.0/22—192.168.16.0/24—North Europe
To which virtual networks can you establish a peering connection from VNet1?
A. VNet2 and VNet3 only
B. VNet2 only
C. VNet3 and VNet4 only
D. VNet2, VNet3, and VNet4
C

QUESTION 125
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1.
VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual.
You need to view the average round-trip time (RTT) of the packets from VM1 to VM2.
Which Azure Network Watcher feature should you use?
A. NSG flow logs
B. Connection troubleshoot
C. IP flow verify
D. Connection monitor
D

QUESTION 126
You are troubleshooting a performance issue for an Azure Application Gateway.
You need to compare the total requests to the failed requests during the past six hours.
What should you use?
A. Metrics in Application Gateway
B. Diagnostics logs in Application Gateway
C. NSG flow logs in Azure Network Watcher
D. Connection monitor in Azure Network Watcher
A

QUESTION 127
Drag and Drop Question
You have two Azure virtual machines named VM1 and VM2. VM1 has a single data disk named Disk1.
You need to attach Disk1 to VM2. The solution must minimize downtime for both virtual machines.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

A. Start VM2
B. Stop VM1
C. Start VM1
D. Detach Disk1 from VM1
E. Attach Disk1 to VM2
F. Stop VM2
BDCE

QUESTION 128
Drag and Drop Question
You have an Azure subscription that is used by four departments in your company. The subscription contains 10 resource groups. Each department uses resources in several resource groups.
You need to send a report to the finance department.
The report must detail the costs for each department.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

A. Assign a tag to each resource group
B. Open the Resource costs blade of each resource group
C. Download the usage report
D. Assign a tag to each resource
E. From the cost analysis blade, filter the view by tag
AEC

QUESTION 129
Hotspot Question
You have a virtual network named VNet1 that has the configuration shown in the following exhibit. (see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Before a virtual machine on VNet1 can receive an IP addres from 192.168.1.0/24, you must first
A. add a network interface
B. add a subnet
C. add an address space
D. delete a subnet
E. delete an address space

Before a virtual machine on VNet1 can receive an IP addres from 10.2.1.0/24, you must first
A. add a network interface
B. add a subnet
C. add an address space
D. delete a subnet
E. delete an address space
CB

QUESTION 130
Hotspot Question
You have an Azure subscription named Subscrption1 that is associated to an Azure Active Directory (Azure AD) tenant named AAD1.
(see pdf)
You plan to create a single backup policy for Vault1. To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You can create an Azure backup policy for:
A. AAD1 only
B. Account1 only
C. RG1 only
D. Share1 only
E. AAD1 and Share1 only
F. AAD1, Share1, and Account1 only
G. AAD1, Share1, Account1, and RG1

In the backup policy that you create, you can configure the backups to be retained for up to:
A. 7 days
B. 31 days
C. 90 days
D. 120 days
E. 365 days
F. 99 years
DF

QUESTION 131
Drag and Drop Question
You have an Azure Linux virtual machine that is protected by Azure Backup.
One week ago, two files were deleted from the virtual machine.
You need to restore the deleted files to an on-premises computer as quickly as possible.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

A. Mount a VHD
B. Copy the files by using File Explorer
C. Download and run a script
D. Select a restore point
E. Copy the files using AZCopy
F. From the Azure portal, click Restore VM from the vault
G. From the Azure portal, click File Recovery from the vault
GDCE

QUESTION 132
Hotspot Question
You have an Azure Migrate project that has the following assessment properties:
Target location: East US
Storage redundancy: Locally redundant.
Comfort factor: 2.0
Performance history: 1 month
Percentile utilization: 95th
Pricing tier: Standard
Offer: Pay as you go
You discover the following two virtual machines:
A virtual machine named VM1 that runs Windows Server 2016 and has 10 CPU cores at 20 percent utilization
A virtual machine named VM2 that runs Windows Server 2012 and has four CPU cores at 50 percent utilization
How many CPU cores will Azure Migrate recommend for each virtual machine? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

VM1:
A. 1
B. 2
C. 3
D. 4

VM2:
A. 1
B. 2
C. 3
D. 4
DD

QUESTION 133
Hotspot Question
You have an Azure subscription named Subscroption1.
In Subscription1, you create an alert rule named Alert1. The Alert1 action group is configured as shown in the following exhibit.
(see pdf)
Alert1 alert criteria is triggered every minute.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

The number of email messages that Alert1 will send in an hour is [answer choice]
A. 0
B. 4
C. 6
D. 12
E. 60

The number of SMS messages that ALert1 will send in an hour is [answer choice]
A. 0
B. 4
C. 6
D. 12
E. 60
ED

QUESTION 134
Hotspot Question
You have an Azure subscription named Subscription1.
You have a virtualization environment that contains the virtualization servers in the following table.
(see pdf)
The virtual machines are configured as shown in the following table.
(see pdf)
All the virtual machines use basic disks. VM1 is protected by using BitLocker Drive Encryption (BitLocker).
You plan to use Azure Site Recovery to migrate the virtual machines to Azure. Which virtual machines can you migrate? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Virtual machines that can be migrated from Server1:
A. VM1
B. VM2
C. VM3
D. VM1 and VM2 only
E. VM1 and VM3 only
F. VM1, VM2, and VM3

Virtual machines that can be migrated from Server2:
A. VMA only
B. VMB only
C. VMC only
D. VMA and VMB only
E. VMA and VMC only
F. VMA and VMB and VMC
CD

QUESTION 135
Drag and Drop Question
Your network is configured as shown in the following exhibit.
(see pdf)
The firewalls are configured as shown in the following table.
(see pdf)
Prod1 contains a vCenter server.
You install an Azure Migrate Collector on Test1.
You need to discover the virtual machines.
Which TCP port should be allowed on each firewall? To answer, drag the appropriate ports to the correct firewalls. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

TCP Ports
A. Inbound 80
B. Inbound 995
C. Outbound 3389
D. Outbound 443
DD

QUESTION 136
Drag and Drop Question
You have an on-premises network that includes a Microsoft SQL Server instance named SQL1.
You create an Azure Logic App named App1.
You need to ensure that App1 can query a database on SQL1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

A. From the Azure portal, create an on-prem data gateway
B. From an on-prem computer, install an on-prem data gateway
C. Create an Azure virtual machine that runs Windows Server 2016
D. From an Azure virtual machine, install an on-prem data gateway
E. From the Logic Apps Designer in the Azure portal, add a connector
BAE

QUESTION 137
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant.
You need to create a conditional access policy that requires all users to use multi-factor authentication when they access the Azure portal.
Which three settings should you configure? To answer, select the appropriate settings in the answer area. (see pdf helpful)
Name: Policy1

Assignments and Access Controls
A. Users and Groups
B. Cloud Apps
C. Conditions
D. Grant
E. Session
ACD

QUESTION 138
Hotspot Question
You plan to use Azure Network Watcher to perform the following tasks:
Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine.
Task2: Validate outbound connectivity from an Azure virtual machine to an external host.
Which feature should you use for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Task1:
A. IP flow verify
B. Next hop
C. Packet capture
D. Security Group view
E. Traffic Analytics

Task2:
A. Connection troubleshoot
B. IP flow verify
C. Next hop
D. NSG flow logs
E. Traffic Analytics
AA

QUESTION 139
You have an Azure tenant that contains two subscriptions named Subscription1 and Subscription2.
In Subscription1, you deploy a virtual machine named Server1 that runs Windows Server 2016.
Server1 uses managed disks.
You need to move Server1 to Subscription2. The solution must minimize administration effort.
What should you do first?
A. In Subscription2, create a copy of the virtual disk.
B. From Azure PowerShell, run the Move-AzureRmResource cmdlet.
C. Create a snapshot of the virtual disk.
D. Create a new virtual machine in Subscription2.
B

QUESTION 140
You have an Azure subscription that contains a resource group named RG1. RG1 contains 100 virtual machines.
Your company has three cost centers named Manufacturing, Sales, and Finance.
You need to associate each virtual machine to a specific cost center.
What should you do?
A. Add an extension to the virtual machines.
B. Modify the inventory settings of the virtual machine.
C. Assign tags to the virtual machines.
D. Configure locks for the virtual machine.
C

QUESTION 141
You have an Azure policy as shown in the following exhibit.
(see pdf)
Which of the following statements are true?
A. You can create Azure SQL servers in ContosoRG1.
B. You are prevented from creating Azure SQL servers anywhere in Subscription 1.
C. You are prevented from creating Azure SQL Servers in ContosoRG1 only.
D. You can create Azure SQL servers in any resource group within Subscription 1.
A

QUESTION 143
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. Azure SQL Database
B. Azure Data Factory
C. A virtual machine
D. Azure Blob storage
D

QUESTION 147
You have an Azure subscription that contains 100 virtual machines.
You regularly create and delete virtual machines.
You need to identify unattached disks that can be deleted.
What should you do?
A. From Microsoft Azure Storage Explorer, view the Account Management properties.
B. From the Azure portal, configure the Advisor recommendations.
C. From Azure Cost Management, open the Optimizer tab and create a report.
D. From Azure Cost Management, create a Cost Management report.
C

QUESTION 148
Note: This question is part of a series
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
Solution: From the Overview blade, you move the virtual machine to a different subscription.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 149
You plan to back up an Azure virtual machine named VM1.
You discover that the Backup Pre-Check status displays a status of Warning.
What is a possible cause of the Warning status?
A. VM1 does not have the latest version of WaAppAgent.exe installed.
B. VM1 has an unmanaged disk.
C. VM1 is stopped.
D. A Recovery Services vault is unavailable.
A

QUESTION 150
You have two Azure virtual machines named VM1 and VM2.
You have two Recovery Services vaults named RSV1 and RSV2.
VM2 is protected by RSV1.
You need to use RSV2 to protect VM2.
What should you do first?
A. From the RSV1 blade, click Backup items and stop the VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the VM2 backup.
C. From the RSV1 blade, click Backup. From the Backup blade, select the backup for the virtual
machine, and then click Backup.
D. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as
the Recovery Services vault.
A

QUESTION 151
You have an Azure virtual machine named VM1 that you use for testing.
VM1 is protected by Azure Backup.
You delete VM1.
You need to remove the backup data stored for VM1.
What should you do first?
A. Modify the backup policy.
B. Delete the Recovery Services vault.
C. Stop the backup.
D. Delete the storage account.
C

QUESTION 152
You have an Azure subscription.
You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit.
(see pdf)
You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines.
What should you modify on VM1?
A. Integration Services
B. the network adapters
C. the memory
D. the hard drive
E. the processor
D

QUESTION 157
Hotspot Question
You plan to create an Azure Storage account in the Azure region of East US 2.
You need to create a storage account that meets the following requirements:

Replicates synchronously
Remains available if a single data center in the region fails
How should you configure the storage account? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Replication:
A. Geo-redundant storage (GRS)
B. Locally redundant storage (LRS)
C. Read-access geo-redundant storage (RA GRS)
D. Zone-redundant storage (ZRS)

Account Kind
A. Blob storage
B. Storage (general purpose V1)
C. StorageV2 (general purpose V2)
DC

QUESTION 158
Hotspot Question
You plan to deploy 20 Azure virtual machines by using an Azure Resource Manager template.
The virtual machines will run the latest version of Windows Server 2016 Datacenter by using an Azure Marketplace image.
You need to complete the storageProfile section of the template.
How should you complete the storageProfile section? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
“storageProfile”: {
“imageReference”: {
“publisher”: “MicrosoftWindowsServer”,
“offer”: [ANSWER CHOICE]
A. “2016-Datacenter”,
B. “WindowsClient”,
C. “Windows-Hub”‘
D. “WindowsServer”,
E. “WindowsServerEssentials”,
F. “WindowsServerSemiAnnual”,

“sku”: [ANSWER CHOICE]
“version”: “latest”
},
…
A. “2016-Datacenter”,
B. “WindowsClient”,
C. “Windows-Hub”‘
D. “WindowsServer”,
E. “WindowsServerEssentials”,
F. “WindowsServerSemiAnnual”,
DA

QUESTION 159
Hotspot Question
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the
following exhibit.
(see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

If Scale1 is utilized at 85 % for six minutes, Scale 1 will be running…
A. 2 vms
B. 4 vms
C. 6 vms
D. 10 vms
E. 20 vms

If Scale1 is first utilized at 25% for six minutes, and then utilized at 50 % for six minutes, Scale1 will be running…
A. 2 vms
B. 4 vms
C. 6 vms
D. 10 vms
E. 20 vms
CA

QUESTION 160
Hotspot Question
You have an Azure subscription.
You need to implement a custom policy that meet the following requirements:

Ensures that each new resource group in the subscription has a tag
named organization set to a value of Contoso.
Ensures that resource group can be created from the Azure portal.
Ensures that compliance reports in the Azure portal are accurate.
How should you complete the policy? To answer, select the appropriate options in the answers area.

(see pdf for policy context)
[ANSWER CHOICE1]
A. “Microsoft.Resources./deplopyments”
B. “Microsoft.Resources./subscriptions”
C. “Microsoft.Resources./subscriptions/resourceGroups”

[ANSWER CHOICE2]
A. “Append”,
B. “Deny”,
C. “DeployifNotExists”,
CC

QUESTION 161
Note: This question is part of a series
You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.
You discover that App1 stops each day after running continuously for 60 minutes.
You need to ensure that App1 can run continuously for the entire day.
Solution: You change the pricing tier of Plan1 to Basic.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 162
Note: This question is part of a series
You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.
You discover that App1 stops each day after running continuously for 60 minutes.
You need to ensure that App1 can run continuously for the entire day.
Solution: You add a triggered WebJob to App1.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 163
Note: This question is part of a series
You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.
You discover that App1 stops each day after running continuously for 60 minutes.
You need to ensure that App1 can run continuously for the entire day.
Solution: You change the pricing tier of Plan1 to Shared.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 164
Note: This question is part of a series
You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.
You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.
Solution: On Dev, you assign the Logic App Contributor role to the Developers group.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 165
Note: This question is part of a series
You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.
You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.
Solution: On Subscription1, you assign the Logic App Operator role to the Developers group.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 166
Note: This question is part of a series
You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a
resource group named Dev.
You need to provide the Developers group with the ability to create Azure logic apps in the Devresource group.
Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 167
Note: This question is part of a series
You manage a virtual network named VNet1 that is hosted in the West US Azure region.
VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Performance Monitor, you create a Data Collector Set (DCS).
Does this meet the goal?
A. Yes
B. No
B

QUESTION 168
Note: This question is part of a series
You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Azure Network Watcher, you create a packet capture.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 169
Note: This question is part of a series
You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Azure Monitor, you create a metric on Network In and Network Out.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 170
A web developer creates a web application that you plan to deploy as an Azure web app.
Users must enter credentials to access the web application.
You create a new web app named WebApp1 and deploy the web application to WebApp1.
You need to disable anonymous access to WebApp1.
What should you configure?
A. Advanced Tools
B. Authentication/Authorization
C. Access control (IAM)
D. Deployment credentials
B

QUESTION 171
You are building a custom Azure function app to connect to Azure Event Grid.
You need to ensure that resources are allocated dynamically to the function app. Billing must be based on the executions of the app.
What should you configure when you create the function app?
A. the Windows operating system and the Consumption plan hosting plan
B. the Windows operating system and the App Service plan hosting plan
C. the Docker container and an App Service plan that uses the B1 pricing tier
D. the Docker container and an App Service plan that uses the S1 pricing tier
A

QUESTION 172
You have an Azure App Service plan named AdatumASP1 that uses the P2v2 pricing tier.
AdatunASP1 hosts an Azure web app named adatumwebapp1.
You need to delegate the management of adatumwebapp1 to a group named Devs. Devs must be able to perform the following tasks:

Add deployment slots.
View the configuration of AdatunASP1.
Modify the role assignment for adatumwebapp1.
Which role should you assign to the Devs group?
A. Owner
B. Contributor
C. Web Plan Contributor
D. Website Contributor
A

QUESTION 173
You have an Azure App Service plan that hosts an Azure App Service named App1.
You configure one production slot and four staging slots for App1.
You need to allocate 10 percent of the traffic to each staging slot and 60 percent of the traffic to the production slot.
What should you add to App1?
A. slots to the Testing in production blade
B. a performance test
C. a WebJob
D. templates to the Automation script blade
A

QUESTION 174
You have an Azure Service Bus.
You need to implement a Service Bus queue that guarantees first-in-first-out (FIFO) delivery of messages.
What should you do?
A. Set the Lock Duration setting to 10 seconds.
B. Enable duplicate detection.
C. Set the Max Size setting of the queue to 5 GB.
D. Enable partitioning.
E. Enable sessions.
E

QUESTION 175
You have a Microsoft SQL Server Always On availability group on Azure virtual machines.
You need to configure an Azure internal load balancer as a listener for the availability group.
What should you do?
A. Enable Floating IP.
B. Set Session persistence to Client IP and protocol.
C. Set Session persistence to Client IP.
D. Create an HTTP health probe on port 1433.
A

QUESTION 176
Hotspot Question
Your network contains an Active Directory domain named adatum.com and an Azure Active
Directory (Azure AD) tenant named adatum.onmicrosoft.com.
Adatum.com contains the user accounts in the following table.
(see pdf)
Adatum.onmicrosoft.com contains the user accounts in the following table.
(see pdf)
You need to implement Azure AD Connect. The solution must follow the principle of least privilege.
Which user accounts should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Adatum.com:
A. User1
B. User2
C. User3
D. User4
E. User5

Adatum.onmicrosoft.com:
A. UserA
B. UserB
C. UserC
D. UserD
EA

QUESTION 177
You have an Azure subscription named Subscription1 that is used be several departments at your company. Subscription1 contains the resources in the following table:
NAME—TYPE
Storage1—Storage account
RG1—Resource group
Container1—Blob storage
Share1—File share
Another administrator deploys a virtual machine named VM1 and an Azure Storage account named Storage2 by using a single Azure Resource Manager template. You need to view the template used for the deployment. From which blade can you view the template that was used for the deployment?
A. RG1
B. VM1
C. Storage1
D. Container1
A

QUESTION 178
You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.
NAME—Azure Region—Policy
RG1—West Europe—Policy1
RG2—North Europe—Policy2
RG3—France Central—POlicy3

RG1 has a web app named WebApp1. WebApp1 is located in West Europe. You move WebApp1 to RG2. What is the effect of the move?
A. The App Service plan to WebApp1 moves to North Europe. Policy2 applies to WebApp1.
B. The App Service plan to WebApp1 moves to North Europe. Policy1 applies to WebApp1.
C. The App Service plan to WebApp1 remains to West Europe. Policy2 applies to WebApp1.
D. The App Service plan to WebApp1 remains to West Europe. Policy1 applies to WebApp1.
C

QUESTION 179
You have a resource group named RG1. RG1 contains an Azure Storage account named storageaccount1 and a virtual machine named VM1 that runs Windows Server 2016.
Storageaccount1 contains the disk files for VM1. You apply a ReadOnly lock to RG1.
What can you do from the Azure portal?
A. Generate an automation script for RG1.
B. View the keys of storageaccount1.
C. Upload a blob to storageaccount1.
D. Start VM1.
A

QUESTION 180
You configure Azure AD Connect for Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) for an on-premises network. Users report that when they attempt to access
myapps.microsoft.com, they are prompted multiple times to sign in and are forced to use an account name that ends with onmicrosoft.com.
You discover that there is a UPN mismatch between Azure AD and the on-premises Active Directory. You need to ensure that the users can use single-sign on (SSO) to access Azure resources.
What should you do first?
A. From the on-premises network, deploy Active Directory Federation Services (AD FS).
B. From Azure AD, add and verify a custom domain name.
C. From the on-premises network, request a new certificate that contains the Active Directory
domain name.
D. From the server that runs Azure AD Connect, modify the filtering options.
B

QUESTION 181
You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com.
You have a Microsoft account that you use to sign in to both tenants.
You need to configure the default sign-in tenant for the Azure portal.
What should you do?
A. From the Azure portal, configure the portal settings.
B. From the Azure portal, change the directory.
C. From Azure Cloud Shell, run Set-AzureRmContext.
D. From Azure Cloud Shell, run Set-AzureRmSubscription.
B

QUESTION 182
You sign up for Azure Active Directory (Azure AD) Premium.
You need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain.
What should you configure in Azure AD?
A. Device settings from the Devices blade.
B. General settings from the Groups blade.
C. User settings from the Users blade.
D. Providers from the MFA Server blade.
A

QUESTION 183
Note: This question is part of a series
Your company registers a domain name of contoso.com.
You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.
You need to resolve the name resolution issue.
Solution: You create a PTR record for www in the contoso.com zone.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 184
Note: This question is part of a series
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
Solution: You assign a built-in policy definition to the subscription.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 185
You have an Azure DNS zone named adatum.com.
You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure.
What should you do?
A. Create an PTR record named research in the adatum.com zone.
B. Create an NS record named research in the adatum.com zone.
C. Modify the SOA record of adatum.com.
D. Create an A record named “.research in the adatum.com zone.
B

QUESTION 186
Note: This question is part of a series
You manage a virtual network named Vnet1 that is hosted in the West US Azure region. VNet hosts two virtual machines named VM1 and VM2 run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Azure Network Watcher, you create a connection monitor.
Does this meet the goal?
A. YES
B. NO
B

QUESTION 187
You have a virtual network named VNet1 as shown in the exhibit.
(see pdf)
No devices are connected to VNet1.
You plan to peer VNet1 to another virtual network named Vnet2 in the same region. VNet2 has an address space of 10.2.0.0/16.
You need to create the peering.
What should you do first?
A. Modify the address space of VNet1.
B. Configure a service endpoint on VNet2
C. Add a gateway subnet to VNet1.
D. Create a subnet on VNet1 and VNet2.
A

QUESTION 188
You have an Azure subscription that contains three virtual networks named VNet1, VNet2, VNet3.
VNet2 contains a virtual appliance named VM2 that operates as a router. You are configuring the virtual networks in a hub and spoke topology that uses VNet2 as the hub network.
You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3.
You need to provide connectivity between VNet1 and VNet3 through VNet2.
Which two configurations should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. On the peering connections, allow forwarded traffic.
B. On the peering connections, allow gateway transit.
C. Create route tables and assign the table to subnets.
D. Create a route filter.
E. On the peering connections, use remote gateways.
AC

QUESTION 189
Note: This question is part of a series
You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.
You discover that App1 stops each day after running continuously for 60 minutes.
You need to ensure that App1 can run continuously for the entire day.
Solution: You add a continuous WebJob to App1.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 190
Note: This question is part of a series
You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.
You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.
Solution: On Dev, you assign the Contributor role to the Developers group.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 191
You have an Azure Logic App named App1. App1 provides a response when an HTTP POST
request or an HTTP GET request is received.
During peak periods, App1 is expected to receive up to 200,000 requests in a five-minute period.
You need to ensure that App1 can handle the expected load.
What should you configure?
A. Access control (IAM)
B. API connections
C. Workflow settings
D. Access keys
C

QUESTION 192
You have a Basic App Service plan named ASP1 that hosts an Azure App Service named App1.
You need to configure a custom domain and enable backups for App1.
What should you do first?
A. Configure a WebJob for App1.
B. Scale up ASP1.
C. Scale out ASP1.
D. Configure the application settings for App1.
D

QUESTION 193
You have an Azure App Service plan named AdatumASP1 that hosts several Azure web apps. You discover that the web apps respond slowly.
You need to provide additional memory and CPU resources to each instance of the web app.
What should you do?
A. Scale out AdatumASP1.
B. Add continuous WebJobs that use the multi-instance scale.
C. Scale up AdatumASP1.
D. Add a virtual machine scale set.
C

QUESTION 194
You have an Azure web app named App1 that streams video content to users. App1 is located in the East US Azure region.
Users in North America stream the video content without any interruption.
Users in Asia and Europe report that the video buffer often and do not play back smoothly.
You need to recommend a solution to improve video streaming to the European and Asian users.
What should you recommend?
A. Scale out the App Service plan.
B. Scale up the App Service plan.
C. Configure an Azure Content Delivery Network (CDN) endpoint.
D. Configure Azure File Sync.
C

QUESTION 195
Note: This question is part of a series
You manage a virtual network named VNet1 that is hosted in the West US Azure region.
VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Azure Network Watcher, you create a connection monitor.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 196
You have an Azure subscription.
Users access the resources in the subscription from either home or from customer sites. From home, users must establish a point-to-site VPN to access the Azure resources. The users on the customer sites access the Azure resources by using site-to-site VPNs.
You have a line-of-business app named App1 that runs on several Azure virtual machine.
The virtual machines run Windows Server 2016.
You need to ensure that the connections to App1 are spread across all the virtual machines.
What are two possible Azure services that you can use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. a public load balancer
B. Traffic Manager
C. an Azure Content Delivery Network (CDN)
D. an internal load balancer
E. an Azure Application Gateway
DE

QUESTION 197
You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute.
You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Create a local site VPN gateway.
B. Create a VPN gateway that uses the VpnGw1 SKU.
C. Create a VPN gateway that uses the Basic SKU.
D. Create a gateway subnet.
E. Create a connection.
ABE

QUESTION 198
You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows10, you configure a point-to-site VPN connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.
You need to ensure that you can connect Client1 to VNet2.
What should you do?
A. Select Allow gateway transit on VNet2.
B. Enable BGP on VPNGW1.
C. Select Allow gateway transit on VNet1.
D. Download and re-install the VPN client configuration package on Client1.
D

QUESTION 199
You are troubleshooting a performance issue for an Azure Application Gateway.
You need to compare the total requests to the failed requests during the past six hours.
What should you use?
A. Connection monitor in Azure Network Watcher.
B. Metrics in Application Gateway
C. Diagnostics logs in Application Gateway
D. NSG flow logs in Azure Network Watcher
B

QUESTION 200
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2.
VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual.
You need to view the average round-trip time (RTT) of the packets from VM1 to VM2.
Which Azure Network Watcher feature should you use?
A. IP flow verify
B. Connection monitor
C. Connection troubleshoot
D. NSG flow logs
B

QUESTION 201
You deploy an Azure Application Gateway. You need to ensure that all the traffic requesting https://adatum.com/internal resources is directed to an internal server pool and all the traffic requesting https://adatum.com/external resources is directed to an external server pool.
What should you configure on the Application Gateway?
A. URL path-based routing
B. multi-site listeners
C. basic routing
D. SSL termination
A

QUESTION 202
You have the Azure virtual networks shown in the following table.
NAME—Address Space—Subnet—Resource Group Azure Region
VNET1—10.11.0.0/16—10.11.0.0/17—West US
VNET2—10.11.0.0/17—10.11.0.0/25—West US
VNET3—10.10.0.0/22—10.10.1.0/24—East US
VNET4—192.168.16.0/22—192.168.16.0/24—North Europe
To which virtual networks can you establish a peering connection from VNet1?
A. VNet3 and VNet4 only
B. VNet2 and VNet3 only
C. VNet2 only
D. VNet2, VNet3, and VNet4
A

QUESTION 203
You have an Azure Active Directory (Azure AD) tenant that has Azure AD Privileged Identity Management configured.
You have 10 users who are assigned the Security Administrator role for the tenant.
You need the users to verify whether they still require the Security Administrator role.
What should you do?
A. From Azure AD Identity Protection, configure a user risk policy.
B. From Azure AD Privileged Identity Management, create an access review.
C. From Azure AD Identity Protection, configure the Weekly Digest.
D. From Azure AD Privileged Identity Management, create a conditional access policy.
B

QUESTION 204
You are the global administrator for an Azure Active Directory (Azure AD) tenant named adatum.com.
You need to enable two-step verification for Azure users.
What should you do?
A. Create an Azure AD conditional access policy.
B. Enable Azure AD Privileged Identity Management.
C. Install and configure Azure AD Connect.
D. Configure a playbook in Azure Security Center.
A

QUESTION 233
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:

Reader
Security Admin
Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User 1 from the Security Reader role for Subscription1. Assign User1 the Contributor role
for RG1.
B. Assign User1 the Owner role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1.
D. Assign User1 the Network Contributor role for RG1.
B

QUESTION 234
You have an Azure subscription that contains the storage accounts shown in the following table.
Name—Kind—Performance—Replication—Access tier
storage1—v1—premium—GRS—NONE
storage2—v2—standard—LRS—Cool
storage3—v2—premium—RA-GRS—Hot
storage4—blob—standard—LRS—Hot

You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by requesting a live migration from Azure support.
What should you identify?
A. storage1
B. storage2
C. storage3
D. storage4
B

QUESTION 235
You have an Azure subscription that contains a storage account named account1. You plan to upload the disk files of a virtual machine to account1 from your on-premises network.
The on- premises network uses a public IP address space of 131.107.1.0/24. You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
You need to configure account1 to meet the following requirements:

Ensure that you can upload the disk files to account1.
Ensure that you can attach the disks to VM1.
Prevent all other access to account1.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. From the Firewalls and virtual networks blade of account1, select Selected networks.
B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services
to access this storage account.
C. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address
range.
D. From the Firewalls and virtual networks blade of account1, add VNet1.
E. From the Service endpoints blade of VNet1, add a service endpoint.
AE

QUESTION 236
Note: This question is part of a series
You have an Azure virtual machine named VM1 that runs Windows Server 2016.
You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and
specify the Log Analytics workspace as the source.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 237
Note: This question is part of a series
You have an Azure virtual machine named VM1 that runs Windows Server 2016.
You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify
the Log Analytics workspace as the source.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 238
Note: This question is part of a series
You have an Azure virtual machine named VM1 that runs Windows Server 2016.
You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.
Solution: You create an Azure storage account and configure shared access signatures (SASs).
You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 239
Note: This question is part of a
You have an Azure subscription that contains the resources shown in the following table.
NAME—Type—Region
RG1—resource group—West US
RG2—resource group—East Asia
storage1—storage account—West US
storage2—storage account—East Asia
VM1—virtual machine—West US
VNET1—virtual network—West US
VNET2—virtual network—East Asia

VM1 connects to VNET1.
You need to connect VM1 to VNET2.
Solution: You move VM1 to RG2, and then you add a new network interface to VM1.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 240
Note: This question is part of a
You have an Azure subscription that contains the resources shown in the following table.
NAME—Type—Region
RG1—resource group—West US
RG2—resource group—East Asia
storage1—storage account—West US
storage2—storage account—East Asia
VM1—virtual machine—West US
VNET1—virtual network—West US
VNET2—virtual network—East Asia

VM1 connects to VNET1.
You need to connect VM1 to VNET2.
Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and connect it to VNET2.
Does this meet the goal?
A. Yes
B. No
A

QUESTION 241
Note: This question is part of a
You have an Azure subscription that contains the resources shown in the following table.
NAME—Type—Region
RG1—resource group—West US
RG2—resource group—East Asia
storage1—storage account—West US
storage2—storage account—East Asia
VM1—virtual machine—West US
VNET1—virtual network—West US
VNET2—virtual network—East Asia

VM1 connects to VNET1.
You need to connect VM1 to VNET2.
Solution: You turn off VM1, and then you add a new network interface to VM1.
Does this meet the goal?
A. Yes
B. No
B

QUESTION 242
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in the following table.
IP address—Assigned to
131.107.2.1—Load balancer front end
192.168.10.2—Kubernetes DNS service
172.17.7.1—Docket bridge address
10.0.10.11—Kubernetes cluster node
You need to provide internet users with access to the applications that run in Cluster1.
Which IP address should you include in the DNS record for Cluster1?
A. 131.107.2.1
B. 10.0.10.11
C. 172.17.7.1
D. 192.168.10.2
A

QUESTION 243
You have a deployment template named Template1 that is used to deploy 10 Azure web apps.
You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.
What should you identify?
A. five Azure Application Gateways
B. one App Service plan
C. 10 App Service plans
D. one Azure Traffic Manager
E. one Azure Application Gateway
B

QUESTION 244
You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.
You plan to make the following changes to VM1:

Change the size to D8s v3.
Add a 500-GB managed disk.
Add the Puppet Agent extension.
Enable Desired State Configuration Management.
Which change will cause downtime for VM1?
A. Enable Desired State Configuration Management
B. Add a 500-GB managed disk
C. Change the size to D8s v3
D. Add the Puppet Agent extension
C

QUESTION 245
You have an app named App1 that runs on an Azure web app named webapp1. The developers at your company upload an update of App1 to a Git repository named Git1.
Webapp1 has the deployment slots shown in the following table.
Name—–Function
webapp1-prod—-Production
webapp1-test—-Staging
You need to ensure that the App1 update is tested before the update is made available to users.
Which two actions should you perform? Each correct answer presents part of the solution.
A. Swap the slots
B. Deploy the App1 update to webapp1-prod, and then test the update
C. Stop webapp1-prod
D. Deploy the App1 update to webapp1-test, and then test the update
E. Stop webapp1-test
AD

QUESTION 246
You have an Azure subscription named Subscription1 that has the following providers registered:
Authorization
Automation
Resources
Compute
KeyVault
Network
Storage
Billing
Web
Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:
Private IP address: 10.0.0.4 (dynamic)
Network security group (NSG): NSG1
Public IP address: None
Availability set: AVSet
Subnet: 10.0.0.0/24
Managed disks: No
Location: East US
You need to record all the successful and failed connection attempts to VM1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Enable Azure Network Watcher in the East US Azure region.
B. Add an Azure Network Watcher connection monitor.
C. Register the MicrosoftLogAnalytics provider.
D. Create an Azure Storage account.
E. Register the Microsoft.Insights resource provider.
F. Enable Azure Network Watcher flow logs.
ACD

QUESTION 247
You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible.
What should you do?
A. Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine.
B. Deploy five virtual machines. Modify the Size setting for each virtual machine.
C. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.
D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.
D

QUESTION 248
You plan to create the Azure web apps shown in the following table.
Name—-Runtime stack
WebApp1—-.NET Core 3.0
WebApp2—-ASP.NET V4.7
WebApp3—-PHP 7.3
WebApp4—-Ruby 2.6
What is the minimum number of App Service plans you should create for the web apps?
A. 1
B. 2
C. 3
D. 4
A

QUESTION 249
Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters.
What should you create?
A. three Azure Application Gateways and one On-premises data gateway
B. three virtual hubs and one virtual WAN
C. three virtual WANs and one virtual hub
D. three On-premises data gateways and one Azure Application Gateway
C

QUESTION 251
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named Gateway, Perimeter, NVA, and Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection between the Perimeter subnet and the Production subnet.
You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:

The NVAs must run in an active-active configuration that uses
automatic failover.
The NVA must load balance traffic to two services on the Production
subnet. The services have different IP addresses.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Deploy a basic load balancer
B. Deploy a standard load balancer
C. Add two load balancing rules that have HA Ports and Floating IP enabled
D. Add two load balancing rules that have HA Ports enabled and Floating IP disabled
E. Add a frontend IP configuration, a backend pool, and a health probe
F. Add a frontend IP configuration, two backend pools, and a health probe
BCF

QUESTION 252
You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.
You need to ensure that you can connect Client1 to VNet2.
What should you do?
A. Download and re-install the VPN client configuration package on Client1.
B. Select Allow gateway transit on VNet1.
C. Select Allow gateway transit on VNet2.
D. Enable BGP on VPNGW1
A

QUESTION 253
You have an Azure subscription that contains the resources in the following table.
NAME—TYPE—AZURE REGION—RESOURCE GROUP
VNet1—Virtual network—West US—RG2
VNet2—Virtual network—West US—RG1
VNet3—virtual network—East US—RG1
NSG1—network security group—East US—RG2

To which subnets can you apply NSG1?
A. the subnets on VNet1 only
B. the subnets on VNet2 and VNet3 only
C. the subnets on VNet2 only
D. the subnets on VNet3 only
E. the subnets on VNet1, VNet2, and VNet3
D

QUESTION 254
Hotspot Question
You have Azure Active Directory tenant named Contoso.com that includes following users:
(see pdf)
Contoso.com includes following Windows 10 devices:
(see pdf)
You create following security groups in Contoso.com:
(see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
User1 can add Device2 to Group1
User2 can add Device1 to Group1
User2 can add Device2 to Group2

A. Yes No No
B. Yes to all
C. Yes No Yes
D. No to all
C

QUESTION 255
Hotspot Question
You have an Azure subscription that contains an Azure Storage account.
You plan to copy an on-premises virtual machine image to a container named vmimages.
You need to create the container for the planned image.
Which command should you run? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

azcopy [answer choice]
A. make
B. sync
C. copy

‘https://mystorageaccount.[ANSWER CHOICE].core.windows.net/vmimages
A. blob
B. dfs
C. queue
D. table
E. images
F. file
AA

QUESTION 256
Hotspot Question
You have an Azure File sync group that has the endpoints shown in the following table.
NAME—-TYPE
Endpoint1—Cloud endpoint
Endpoint2—Server endpoint
Endpoint3—Server endpoint
Cloud tiering is enabled for Endpoint3.
You add a file named File1 to Endpoint1 and a file named File2 to Endpoint2.
On which endpoints will File1 and File2 be available within 24 hours of adding the files? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

File1:
A. Endpoint1 only
B. Endpoint3 only
C. Endpoint2 and Endpoint3 only
D. Endpoint1, Endpoint2, and Endpoint3

File2:
A. Endpoint2 only
B. Endpoint3 only
C. Endpoint2 and Endpoint3 only
D. Endpoint1, Endpoint2, and Endpoint3
BD

QUESTION 257
Hotspot Question
You have several Azure virtual machines on a virtual network named VNet1. You configure an Azure Storage account as shown in the following exhibit.
(see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

The virtual machines on the 10.2.9.0/24 subnet will have network connectivity to the file shares in the storage account [answer choice]
A. always
B. during a backup
C. never

Azure Backup will be able to back up the unmanaged hard disks of the virtual machines in the storage account [answer choice]
A. always
B. during a backup
C. never
AC

QUESTION 258
Hotspot Question
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are configured as shown in the following table.
NAME—-Share—Share contents
Server1—Share1—File1.txt, File2.txt
Server2—Share2—File2.txt, File3.txt
You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for Sync1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
On the cloud endpoint, File1.txt is overwritten by File1.txt from Share1
On Server1, File1.txt from the cloud endpoint.
File1.txt from Share1 replicates to Share2

A. Yes Yes No
B. No No Yes
C. Yes to All
D. Yes No Yes
D

QUESTION 259
Hotspot Question
You have an Azure subscription named Subscription1 that contains the quotas shown in the following table.
(see pdf)
You deploy virtual machine to Subscription1 as shown in the following table.
(see pdf)
You plan to deploy the virtual machines shown in the following table.
(see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
You can deploy VM3 to West US
You can deploy VM4 to West US
You can deploy VM5 to West US

A. Yes No Yes
B. No No Yes
C. No to all
D. Yes No No
D

QUESTION 260
Hotspot Question
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-ASUSE2 as shown in the following exhibit.
(see pdf)
You add 14 virtual machines to WEBPROD-AS-USE2.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

When Microsoft performs planned maintenance in East US 2, the maximum number of unavailable virtual machines will be [answer choice]
A. 2
B. 7
C. 10
D. 14

If the server rack in the Azure datacenter that hosts WEBPROD-AS-USE2 experiences a power failure, the maximum number of unavailable machines will be [answer choice]
A. 2
B. 7
C. 10
D. 14
AB

QUESTION 261
Hotspot Question
You plan to deploy an Azure container instance by using the following Azure Resource Manager template.
(see pdf)
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the template.

Internet users [answer choice]
A. can connect to the container from any device
B. cannot connect to the container
C. can only connect to the container from devices that run Windows

If Internet Information Services in the container fail [answer choice]
A. the container will restart automatically
B. the container will only restart manually
C. the container must be redeployed
AA

QUESTION 262
Hotspot Question
You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table.
(see pdf)
You create the budget shown in the following exhibit.
(see pdf)
The AG1 action group contains a user named admin@contoso.com only.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

When the maximum amount in Budget1 is reached [answer choice]
A. VM1 and VM2 are turned off
B. VM1 and VM2 continue to run
C. VM1 is turned off and VM2 continues to run

Based on the current usage costs of the virtual machines
A. no email notifications will be sent each month
B. one email notification will be sent each month
C. two email notifications will be sent each month
D. three email notifications will be sent each month
CB

QUESTION 263
Hotspot Question
You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.
(see pdf)
You need to recommend a networking solution to meet the following requirements:

Ensure that communication between the web servers and the business
logic tier spreads equally across the virtual machines.
Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point

Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines:
A. an application gateway that uses the Standard tier
B. an application gateway that uses the WAF tier
C. an internal load balancer
D. a network security group (NSG)
E. a public load balancer

Protect the web servers from SQL injection attacks:
A. an application gateway that uses the Standard tier
B. an application gateway that uses the WAF tier
C. an internal load balancer
D. a network security group (NSG)
E. a public load balancer
CB

QUESTION 264
Hotspot Question
You plan to deploy five virtual machines to a virtual network subnet.
Each virtual machine will have a public IP address and a private IP address.
Each virtual machine requires the same inbound and outbound security rules.
What is the minimum number of network interfaces and network security groups that you require?
To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Minimum number of network interfaces:
A. 5
B. 10
C. 15
D. 20

Minimum number of network security groups:
A. 1
B. 2
C. 5
D. 10
AA

QUESTION 265
Hotspot Question
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.
NAME—Private IP—Public IP—Virtual network name—DNS suffix
VM1—10.1.0.4—52.186.85.63—VNET1—adatum.com
VM2—10.1.0.5—13.92.168.13—VNET1—contoso.com
You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

A records for VM1:
A. None
B. Private IP address only
C. Public IP address only
D. Private and Public IP address

A records for VM2:
A. None
B. Private IP address only
C. Public IP address only
D. Private and Public IP address
BB

QUESTION 266
Hotspot Question
You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one subnet named Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend
pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run
interactive queries from the Azure portal against the collected data.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Resource to create:
A. An Azure Event Grid
B. An Azure Log Analytics workspace
C. An Azure Storage account

Resource on which to enable diagnostics:
A. ILB1
B. NSG1
C. The Azure virtual machines
BA

QUESTION 267
Hotspot Question
You have an Azure subscription. The subscription contains virtual machines that run Windows
Server 2016 and are configured as shown in the following table.
(see pdf)
You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com.
You create a virtual network link for contoso.com as shown in the following exhibit.
(see pdf)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
When VM1 starts, a record for VM1 is added to the contoso.com DNS zone
When VM2 starts, a record for VM2 is added to the contoso.com DNS zone
When VM3 starts, a record for VM3 is added to the adatum.com DNS zone

A. Yes Yes No
B. No No Yes
C. Yes to all
D. No to all
A

QUESTION 268
Drag and Drop Question
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.
Virtual machines connect to the virtual networks.
The virtual networks have the address spaces and the subnets configured as shown in the following table.
(see pdf)
You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

A. Remove Vnet1
B. Add the 10.33.0.0/16 address space to Vnet1
C. Create a new virtual network named Vnet1
D. On the peering connection in Vnet2, allow gateway transit
E. Recreate peering between Vnet1 and Vnet2
F. On the peering connection in Vnet1, allow gateway transit
G. Remove peering between VNet1 and VNet2
GBE

QUESTION 269
Hotspot Question
You have an Azure subscription that contains the resource groups shown in the following table.
(see pdf)
RG1 contains the resources shown in the following table.
(see pdf)
VM1 is running and connects to NIC1 and Disk1. NIC1 connects to VNET1.
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual machine.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Statements
You can move storage1 to RG2
You can move NIC1 to RG2
If you move IP2 to RG1, the location of IP2 will change

A. No No Yes
B. Yes No Yes
C. Yes No No
D. No to all
C

QUESTION 270
Hotspot Question
You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown in the following table.
(see pdf)
You plan to monitor storage1 and to configure email notifications for the signals shown in the following table.
(see pdf)
You need to identify the minimum number of alert rules and action groups required for the planned monitoring.
How many alert rules and action groups should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Alert rules:
A. 1
B. 2
C. 3
D. 4

Action groups:
A. 1
B. 2
C. 3
D. 4
DC

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.

An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.

You need to ensure that access to AKS1 can be granted to the contoso.com users.

What should you do first?

A. From contoso.com, modify the Organization relationships settings.

B. From contoso.com, create an OAuth 2.0 authorization endpoint.

C. Recreate AKS1.

D. From AKS1, create a namespace.
B. From contoso.com, create an OAuth 2.0 authorization endpoint.

You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.

You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.

You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.

Which two groups should you create?

A. an Office 365 group that uses the Assigned membership type

B. a Security group that uses the Assigned membership type

C. an Office 365 group that uses the Dynamic User membership type

D. a Security group that uses the Dynamic User membership type

E. a Security group that uses the Dynamic Device membership type
A. an Office 365 group that uses the Assigned membership type

C. an Office 365 group that uses the Dynamic User membership type

You recently created a new Azure subscription that contains a user named Admin1.

Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using AzurePowerShell and receives the following error message: “User failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.

“You need to ensure that Admin1 can deploy the Marketplace resource successfully.”

What should you do?

A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet

B. From the Azure portal, register the Microsoft.Marketplace resource provider

C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

D. From the Azure portal, assign the Billing administrator role to Admin1
C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts.

You create a new user account named AdminUser1.

You need to assign the User administrator administrative role to AdminUser1.

What should you do from the user account properties?

A. From the Licenses blade, assign a new license

B. From the Directory role blade, modify the directory role

C. From the Groups blade, invite the user account to a new group
B. From the Directory role blade, modify the directory role

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts.

You purchase 10 Azure AD Premium P2 licenses for the tenant.

You need to ensure that 10 users can use all the Azure AD Premium features.

What should you do?

A. From the Licenses blade of Azure AD, assign a license

B. From the Groups blade of each user, invite the users to a group

C. From the Azure AD domain, add an enterprise application

D. From the Directory role blade of each user, modify the directory role
A. From the Licenses blade of Azure AD, assign a license

You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System Center Service Manager.

Subscription1 contains a virtual machine named VM1.

You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent.

What should you do first?

A. Create an automation runbook

B. Deploy a function app

C. Deploy the IT Service Management Connector (ITSM)

D. Create a notification
C. Deploy the IT Service Management Connector (ITSM)

You sign up for Azure Active Directory (Azure AD) Premium.

You need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain.

What should you configure in Azure AD?

A. Device settings from the Devices blade

B. Providers from the MFA Server blade

C. User settings from the Users blade

D. General settings from the Groups blade
A. Device settings from the Devices blade

✑ Reader

✑ Security Admin

Security Reader –

You need to ensure that User1 can assign the Reader role for VNet1 to other users.What should you do?

A. Remove User 1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.

B. Assign User1 the Owner role for VNet1.

C. Remove User1 from the Security Reader and Reader roles for Subscription1.

D. Assign User1 the Network Contributor role for RG1.
B. Assign User1 the Owner role for VNet1.

You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.

Your company has a public DNS zone for contoso.com.

You add contoso.com as a custom domain name to Azure AD.

You need to ensure that Azure can verify the domain name.

Which type of DNS record should you create?

A. MX

B. NSEC

C. SRV

D. NSEC3
A. MX

You have an Azure Storage account named storage1.

You plan to use AzCopy to copy data to storage1.

You need to identify the storage services in storage1 to which you can copy the data.

What should you identify?

A. blob, file, table, and queue

B. blob and file only

C. file and table only

D. file only

E. blob, table, and queue only
B. blob and file only

You have an Azure subscription that contains an Azure Storage account.

You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent storage.

You need to configure a storage service for Container1.

What should you use?

A. Azure Files

B. Azure Blob storage

C. Azure Queue storage

D. Azure Table storage
D. Azure Table storage

You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.

You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hostingVM1 and VM2.

What should you include in the Availability Set?

A. one update domain

B. two fault domains

C. one fault domain

D. two update domains
D. two update domains

You have an on-premises server that contains a folder named D:\Folder1.

You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata.

Which command should you run?

A. https://contosodata.blob.core.windows.net/public

B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public –snapshot

C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public –recursive

D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public –recursive

You have an Azure subscription that contains a storage account named account1.

You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of131.107.1.0/24.

You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.

You need to configure account1 to meet the following requirements:

✑ Ensure that you can upload the disk files to account1.

✑ Ensure that you can attach the disks to VM1.

✑ Prevent all other access to account1.

Which two actions should you perform?

A. From the Firewalls and virtual networks blade of account1, select Selected networks.

B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to access this storage account.

C. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.

D. From the Firewalls and virtual networks blade of account1, add VNet1.

E. From the Service endpoints blade of VNet1, add a service endpoint.
A. From the Firewalls and virtual networks blade of account1, select Selected networks.

E. From the Service endpoints blade of VNet1, add a service endpoint.

You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.

You need to view the date and time when the resources were created in RG1.

Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.

Does this meet the goal?

A. Yes

B. No
B. No

You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.

You need to view the date and time when the resources were created in RG1.

Solution: From the RG1 blade, you click Automation script.

Does this meet the goal?

A. Yes

B. No
B. No

You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.

You need to view the date and time when the resources were created in RG1.

Solution: From the RG1 blade, you click Deployments.

Does this meet the goal?

A. Yes

B. No
A. Yes

You have an Azure subscription named Subscription1.

You deploy a Linux virtual machine named VM1 to Subscription1.

You need to monitor the metrics and the logs of VM1.

What should you use?

A. Azure HDInsight

B. Linux Diagnostic Extension (LAD) 3.0

C. the AzurePerformanceDiagnostics extension

D. Azure Analysis Services
C. the AzurePerformanceDiagnostics extension

You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1.

You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable.

What should you deploy?

A. all three virtual machines in a single Availability Zone

B. all virtual machines in a single Availability Set

C. each virtual machine in a separate Availability Zone

D. each virtual machine in a separate Availability Set
B. all virtual machines in a single Availability Set

You have an Azure virtual machine named VM1 that runs Windows Server 2019.

You save VM1 as a template named Template1 to the Azure Resource Manager library.

You plan to deploy a virtual machine named VM2 from Template1.

What can you configure during the deployment of VM2?

A. operating system

B. administrator username

C. virtual machine size

D. resource group
B. administrator username

You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not support multiple active instances.

At the end of each month, CPU usage for VM1 peaks when App1 runs.

You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.What task should you include in the runbook?

A. Add the Azure Performance Diagnostics agent to VM1.

B. Modify the VM size property of VM1.

C. Add VM1 to a scale set.

D. Increase the vCPU quota for the subscription.

E. Add a Desired State Configuration (DSC) extension to VM1.
E. Add a Desired State Configuration (DSC) extension to VM1.

You have an Azure virtual machine named VM1 that runs Windows Server 2019.

You sign in to VM1 as a user named User1 and perform the following actions:

✑ Create files on drive C.

✑ Create files on drive D.

✑ Modify the screen saver timeout.

✑ Change the desktop background.

You plan to redeploy VM1.

Which changes will be lost after you redeploy VM1?

A. the modified screen saver timeout

B. the new desktop background

C. the new files on drive D

D. the new files on drive C
A. the modified screen saver timeout

You have an Azure virtual machine named VM1 that runs Windows Server 2016.

You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

Does this meet the goal?

A. Yes

B. No
B. No

You have an Azure virtual machine named VM1 that runs Windows Server 2016.

You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

Solution: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

Does this meet the goal?

A. Yes

B. No
A. Yes

You have an Azure virtual machine named VM1 that runs Windows Server 2016.

You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source.

Does this meet the goal?

A. Yes

B. No
B. No

You have a deployment template named Template1 that is used to deploy 10 Azure web apps.

You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.

What should you identify?

A. five Azure Application Gateways

B. one App Service plan

C. 10 App Service plans

D. one Azure Traffic Manager

E. one Azure Application Gateway
B. one App Service plan

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.

You plan to make the following changes to VM1:

✑ Change the size to D8s v3.

✑ Add a 500-GB managed disk.

✑ Add the Puppet Agent extension.

✑ Enable Desired State Configuration Management.

Which change will cause downtime for VM1?

A. Enable Desired State Configuration Management

B. Add a 500-GB managed disk

C. Change the size to D8s v3

D. Add the Puppet Agent extension
C. Change the size to D8s v3

You have an Azure subscription named Subscription1 that has the following providers registered:

✑ Authorization

✑ Automation

✑ Resources

✑ Compute

✑ KeyVault

✑ Network

✑ Storage

✑ Billing

✑ Web

Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:

✑ Private IP address: 10.0.0.4 (dynamic)

✑ Network security group (NSG): NSG1

✑ Public IP address: None

✑ Availability set: AVSet

✑ Subnet: 10.0.0.0/24

✑ Managed disks: No

Location: East US –

You need to record all the successful and failed connection attempts to VM1.

Which three actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A. Enable Azure Network Watcher in the East US Azure region.

B. Add an Azure Network Watcher connection monitor.

C. Register the MicrosoftLogAnalytics provider.

D. Create an Azure Storage account.

E. Register the Microsoft.Insights resource provider.

F. Enable Azure Network Watcher flow logs.
A. Enable Azure Network Watcher in the East US Azure region.

C. Register the MicrosoftLogAnalytics provider.

D. Create an Azure Storage account.

You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible.What should you do?

A. Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine.

B. Deploy five virtual machines. Modify the Size setting for each virtual machine.

C. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.

D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.
D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.

You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

Another administrator plans to create several network security groups (NSGs) in the subscription.

You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider.

Does this meet the goal?

A. Yes

B. No
B. No

You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

Another administrator plans to create several network security groups (NSGs) in the subscription.

You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

Solution: You assign a built-in policy definition to the subscription.

Does this meet the goal?

A. Yes

B. No
B. No

You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

Another administrator plans to create several network security groups (NSGs) in the subscription.

You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

Solution: You configure a custom policy definition, and then you assign the policy to the subscription.

Does this meet the goal?

A. Yes

B. No
A. Yes

You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2.

VM1 hosts a frontend application that connects to VM2 to retrieve data.Users report that the frontend application is slower than usual.

You need to view the average round-trip time (RTT) of the packets from VM1 to VM2.

Which Azure Network Watcher feature should you use?

A. IP flow verify

B. Connection troubleshoot

C. Connection monitor

D. NSG flow logs
C. Connection monitor

You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1.

You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1.

Which two actions should you perform?

A. Add a service endpoint to VNet1

B. Reset GW1

C. Create a route-based virtual network gateway

D. Add a connection to GW1

E. Delete GW1

F. Add a public IP address space to VNet1
C. Create a route-based virtual network gateway

E. Delete GW1

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

You need to ensure that visitors are serviced by the same web server for each request.

What should you configure?

A. Floating IP (direct server return) to Enabled

B. Idle Time-out (minutes) to 20

C. Protocol to UDP

D. Session persistence to Client IP and Protocol
D. Session persistence to Client IP and Protocol

Your on-premises network contains an SMB share named Share1.

You have an Azure subscription that contains the following resources:

✑ A web app named webapp1

✑ A virtual network named VNET1

You need to ensure that webapp1 can connect to Share1.

What should you deploy?

A. an Azure Application Gateway

B. an Azure Active Directory (Azure AD) Application Proxy

C. an Azure Virtual Network Gateway
C. an Azure Virtual Network Gateway

You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template.

You need to ensure that NGINX is available on all the virtual machines after they are deployed.

What should you use?

A. Azure Active Directory (Azure AD) Application Proxy

B. Azure Application Insights

C. Azure Custom Script Extension

D. the New-AzConfigurationAssignement cmdlet
C. Azure Custom Script Extension

Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains datacenter.

You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered.

You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters.

What should you create?

A. three Azure Application Gateways and one On-premises data gateway

B. three virtual hubs and one virtual WAN

C. three virtual WANs and one virtual hub

D. three On-premises data gateways and one Azure Application Gateway
C. three virtual WANs and one virtual hub

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named Gateway, Perimeter, NVA, and Production.

The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection between the Perimeter subnet and the Production subnet.

You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:

✑ The NVAs must run in an active-active configuration that uses automatic failover.

✑ The NVA must load balance traffic to two services on the Production subnet. The services have different IP addresses.

Which three actions should you perform?

A. Deploy a basic load balancer

B. Deploy a standard load balancer

C. Add two load balancing rules that have HA Ports and Floating IP enabled

D. Add two load balancing rules that have HA Ports enabled and Floating IP disabled

E. Add a frontend IP configuration, a backend pool, and a health probe

F. Add a frontend IP configuration, two backend pools, and a health probe
B. Deploy a standard load balancer

C. Add two load balancing rules that have HA Ports and Floating IP enabled

F. Add a frontend IP configuration, two backend pools, and a health probe

On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.

You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.

You need to ensure that you can connect Client1 to VNet2.What should you do?

A. Download and re-install the VPN client configuration package on Client1.

B. Select Allow gateway transit on VNet1.

C. Select Allow gateway transit on VNet2.

D. Enable BGP on VPNGW1
A. Download and re-install the VPN client configuration package on Client1.

You have an Azure web app named webapp1.

Users report that they often experience HTTP 500 errors when they connect to webapp1.

You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details.

What should you do first?

A. From webapp1, enable Web server logging

B. From Azure Monitor, create a workbook

C. From Azure Monitor, create a Service Health alert

D. From webapp1, turn on Application Logging
A. From webapp1, enable Web server logging

Overview –

Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.

Contoso products are manufactured by using blueprint files that the company authors and maintains.

Existing Environment –

Currently, Contoso uses multiple types of servers for business operations, including the following:

File servers

Domain controllers

Microsoft SQL Server servers

Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.

You have a public-facing application named App1. App1 is comprised of the following three tiers:

A SQL database -A web front end

A processing middle tier

Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

Requirements

-Planned Changes

-Contoso plans to implement the following changes to the infrastructure:

Move all the tiers of App1 to Azure.

Move the existing product blueprint files to Azure Blob storage.

Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.

Technical Requirements –

Contoso must meet the following technical requirements:

Move all the virtual machines for App1 to Azure.

Minimize the number of open ports between the App1 tiers.

Ensure that all the virtual machines for App1 are protected by backups.

Copy the blueprint files to Azure over the Internet.

Ensure that the blueprint files are stored in the archive storage tier.

Ensure that partner access to the blueprint files is secured and temporary.

Prevent user passwords or hashes of passwords from being stored in Azure.

Use unmanaged standard storage for the hard disks of the virtual machines.

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

Minimize administrative effort whenever possible.

User Requirements –

Contoso identifies the following requirements for users:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD.

Designate a new user named Admin1 as the service admin for the Azure subscription.

Admin1 must receive email alerts regarding service outages.

Ensure that a new user named User3 can create network objects for the Azure subscription.

Question

You need to implement a backup solution for App1 after the application is moved.

What should you create first?

A. a recovery plan

B. an Azure Backup Server

C. a backup policy

D. a Recovery Services vault
D. a Recovery Services vault

Overview –

Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.

Contoso products are manufactured by using blueprint files that the company authors and maintains.

Existing Environment –

Currently, Contoso uses multiple types of servers for business operations, including the following:

File servers

Domain controllers

Microsoft SQL Server servers

Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.

You have a public-facing application named App1. App1 is comprised of the following three tiers:

A SQL database
-A web front end
A processing middle tier

Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

Requirements –

Planned Changes –

Contoso plans to implement the following changes to the infrastructure:

Move all the tiers of App1 to Azure.

Move the existing product blueprint files to Azure Blob storage.

Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.

Technical Requirements –

Contoso must meet the following technical requirements:

Move all the virtual machines for App1 to Azure.

Minimize the number of open ports between the App1 tiers.

Ensure that all the virtual machines for App1 are protected by backups.

Copy the blueprint files to Azure over the Internet.

Ensure that the blueprint files are stored in the archive storage tier.

Ensure that partner access to the blueprint files is secured and temporary.

Prevent user passwords or hashes of passwords from being stored in Azure.

Use unmanaged standard storage for the hard disks of the virtual machines.

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

Minimize administrative effort whenever possible.

User Requirements –

Contoso identifies the following requirements for users:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD.

Designate a new user named Admin1 as the service admin for the Azure subscription.

Admin1 must receive email alerts regarding service outages.

Ensure that a new user named User3 can create network objects for the Azure subscription.

Question

You need to move the blueprint files to Azure.

What should you do?

A. Generate an access key. Map a drive, and then copy the files by using File Explorer.

B. Use Azure Storage Explorer to copy the files.

C. Use the Azure Import/Export service.

D. Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.
Reveal Solution Discussion
B. Use Azure Storage Explorer to copy the files.

The status of VM1 is Running.You assign an Azure policy as shown in the exhibit. (Click the Exhibit tab.) You assign the policy by using the following parameters:Microsoft.ClassicNetwork/virtualNetworksMicrosoft.Network/virtualNetworksMicrosoft.Compute/virtualMachines
1) An administrator can move VNET1 to RG2
2)the state of vm1 changed to deallocated
3) an administrator can modify the address space of vnet2
1)no
2)yes
3)no

You have an Azure subscription named Subscription1 that contains a resource group named RG1.In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege. Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.
To add a backend pool to LB1:
Network contributor to LB1
To add a health probe to LB2:
Network contributor to LB2

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.You need to ensure that access to AKS1 can be granted to the contoso.com users.What should you do first?
From contoso.com, create an OAuth 2.0 authorization endpoint.

You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.Which two groups should you create? Each correct answer presents a complete solution
an Office 365 group that uses the Assigned membership type

an Office 365 group that uses the Dynamic User membership type

1) User3 can perform an access review of user1
2) User3 can perform an access review of UserA
3) User3 can perform an access review of UserB
1) No
2) No
3) Yes
Overall: User3 is a member and can only review guest accounts

Management groups, subscriptions, and virtual networks allow
Box 1: No -Virtual networks are not allowed at the root and is inherited. Deny overrides allowed.Box 2: Yes -Virtual Machines can be created on a Management Group provided the user has the required RBAC permissions.Box 3: Yes -Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions.

What does the scope subscription do?
You can create Azure SQL servers in contosoRG1 only

To RG6, you apply the tag: RGroup: RG6.You deploy a virtual network named VNET2 to RG6.Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.
VNET1: Department: D1, and Label:Value1 only.Tags applied to the resource group or subscription are not inherited by the resources.Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign them to either a specific resource group or across a wholeAzure subscription.VNET2: Label:Value1 only.Incorrect Answers:RGROUP: RG6 -Tags applied to the resource group or subscription are not inherited by the resources.

You have an Azure subscription named AZPT1 that contains the resources shown in the following table:
You create a new Azure subscription named AZPT2.You need to identify which resources can be moved to AZPT2.Which resources should you identify?
VM1, storage1, VNET1, VM1Managed, and RVAULT1

You recently created a new Azure subscription that contains a user named Admin1.Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using AzurePowerShell and receives the following error message: “User failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.”You need to ensure that Admin1 can deploy the Marketplace resource successfully.What should you do?
From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts.You create a new user account named AdminUser1.You need to assign the User administrator administrative role to AdminUser1.What should you do from the user account properties?
From the Directory role blade, modify the directory role

You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System Center Service Manager.Subscription1 contains a virtual machine named VM1.You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent. What should you do first?
Deploy the IT Service Management Connector (ITSM)

You sign up for Azure Active Directory (Azure AD) Premium.You need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain.What should you configure in Azure AD?
Device settings from the Devices blade

1) User1 can add device2 to group1
2) User2 can add device1 to group1
3) User2 can add device2 to group2
1) yes
2) no
3) Yes

SQLDB01 is backed up to RGV1.When the project is complete, you attempt to delete RG26 from the Azure portal. The deletion fails.You need to delete RG26.
Stop the backup of SQLDB01

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.Subscription1 has a user named User1. User1 has the following roles:✑ Reader✑ Security AdminSecurity Reader -You need to ensure that User1 can assign the Reader role for VNet1 to other users.What should you do?
Assign User1 the Owner role for VNet1.

You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers.Subscription1 contains a resource group named Dev.You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.Does this meet the goal?
No DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure DevTest Labs.

You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers.Subscription1 contains a resource group named Dev.You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.Solution: On Subscription1, you assign the Logic App Operator role to the Developers group.Does this meet the goal?
No

You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers.Subscription1 contains a resource group named Dev.You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.Solution: On Dev, you assign the Contributor role to the Developers group.Does this meet the goal?
Yes

You have an Azure subscription that is used by four departments in your company. The subscription contains 10 resource groups. Each department uses resources in several resource groups.You need to send a report to the finance department. The report must detail the costs for each department.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
1) Assign a tag to each resource 2) From the cost analysis blade, filter the view by tag 3) Download the usage report

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.You need to view the error from a table named Event.Which query should you run in Workspace1?
Event | search “error”

You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region.You have the following resources in an Azure Resource Manager template.
Big ass code regarding 2 VMs.
1) VM1 and VM2 can connect to VNet1
2) IF an azure datacenter becomes unavailable, VM1 or VM2 will be available
3) If the East US 2 region becomes unavailable, VM1 or VM2 will be available
1) Yes
2) Yes
3) No

RG1 has a web app named WebApp1. WebApp1 is located in West Europe.You move WebApp1 to RG2.What is the effect of the move?
The App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1.

You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-9cd4-44c9-99a7-4fd71546436e.You need to create a custom RBAC role named CR1 that meets the following requirements:✑ Can be assigned only to the resource groups in Subscription1✑ Prevents the management of the access permissions for the resource groups✑ Allows the viewing, creating, modifying, and deleting of resources within the resource groupsWhat should you specify in the assignable scopes and the permission elements of the definition of CR1? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point. then theres 2 dropdowns in code
/subscriptions/key/resource groups

microsoft.authorization

Users access the resources in the subscription from either home or from customer sites. From home, users must establish a point-to-site VPN to access the Azure resources. The users on the customer sites access the Azure resources by using site-to-site VPNs.You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines run Windows Server 2016.You need to ensure that the connections to App1 are spread across all the virtual machines.What are two possible Azure services that you can use?
an internal load balancer

You have an Azure subscription.You have 100 Azure virtual machines.You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering.Which blade should you use?
Advisor

You have an Azure Active Directory (Azure AD) tenant.You need to create a conditional access policy that requires all users to use multi-factor authentication when they access the Azure portal.Which three settings should you configure? To answer, select the appropriate settings in the answer area.NOTE: Each correct selection is worth one point.
Assignments:
Users and groups
Cloud Apps

Access controls:
Grant

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.The User administrator role is assigned to a user named Admin1.An external partner has a Microsoft account that uses the user1@outlook.com sign in.Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: “Unable to invite user user1@outlook.com “” Generic authorization exception.”You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.What should you do?
From the Users blade, modify the External collaboration settings.

You have an Azure subscription that contains a user account named User1.You need to ensure that User1 can assign a policy to the tenant root management group.What should you do?
Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.

You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains the groups in the following table.
Tables with user.city -startswith “m”
To which groups do User1 and User2 belong? To answer, select the appropriate options in the answer area.
User1: Group1 only
User2: Group 1 and 2 only

You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table. You need to modify the JobTitle and UsageLocation attributes for the users.For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area.
JobTitle:
User1 and User3 only

UsageLocation:
User1, User2, and user3

You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.Solution: You assign the Network Contributor role at the subscription level to Admin1.Does this meet the goal?
Yes

You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.Solution: You assign the Owner role at the subscription level to Admin1.Does this meet the goal?
No

You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.Solution: You assign the Reader role at the subscription level to Admin1.Does this meet the goal?
No

You have an Azure subscription that contains a user named User1.You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege.Which role-based access control (RBAC) role should you assign to User1?
Virtual Machine Contributor

Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they’re connected to.

You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage.You need to use AzCopy to copy data to the blob storage and file storage in storage1.Which authentication method should you use for each type of storage? To answer, select the appropriate options in the answer area.
Blob Storage: Azure AD and SAS only

FIle Storage: SAS only

You have an Azure subscription that contains an Azure Storage account.You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent storage.You need to configure a storage service for Container1.What should you use?
Azure Table storage

You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hostingVM1 and VM2.What should you include in the Availability Set?
two update domains

You have an Azure subscription named Subscription1 that contains the resources shown in the following table:
You plan to configure Azure Backup reports for Vault1.You are configuring the Diagnostics settings for the AzureBackupReports log.Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of Vault1? To answer, select the appropriate options in the answer area.
Storage Accounts:
Storage3 only

Log analytics workspaces:
Analytics3 only

You have an Azure subscription named Subscription1.In Subscription1, you create an Azure file share named share1.You create a shared access signature (SAS) named SAS1 as shown in the following exhibit:
Big ass table
if on sept 2, 2018, you run microsoft azure….193.77.134.1 what will happen? you will have no access because that IP is out of range

If on sept 10th… you run net command 192.77.134.50 and you will? have read, write and list access

You have an on-premises server that contains a folder named D:\Folder1.You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata.Which command should you run?
azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public –recursive

You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table:You plan to use the Azure Import/Export service to export data from Subscription1.You need to identify which storage account can be used to export the data.What should you identify?
storage4

You plan to export data by using Azure import/export job named Export1.You need to identify the data that can be exported by using Export1.Which data should you identify?
container1

You have an Azure Storage account named storage1.You have an Azure Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following requirements:✑ Minimize the number of secrets used.✑ Ensure that App2 can only read from storage1 for the next 30 days.What should you configure in storage1 for each app? To answer, select the appropriate options in the answer area.
App1: Access keys
App2: SAS

You need to create an Azure Storage account that meets the following requirements:✑ Minimizes costs✑ Supports hot, cool, and archive blob tiers✑ Provides fault tolerance if a disaster affects the Azure region where the account residesHow should you complete the command? To answer, select the appropriate options in the answer area.
–kind StorageV2 –sku Standard_GRS

Store1 contains a file share named data. Data contains 5,000 files.You need to synchronize the files in the file share named data to an on-premises server named Server1.Which three actions should you perform? Each correct answer presents part of the solution.
Register Server1
Install the Azure File Sync agent on Server1
Create a sync group

You have an Azure subscription that contains a storage account.You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of data.You need to transfer the data to the storage account by using the Azure Import/Export service.In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
attach an external disk to server1 and run waimport

From az portal create an import job

Detach the external disks from serv1 and ship them to az data center

from the az portal update the import job

You have Azure subscription that includes following Azure file shares: You have the following on-premises servers: You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses share1 as a cloud endpoint. You register Server1 and Server2 in Sync1. You add D:\Folder1 on Server1 as a server endpoint of Group1.For each of the following statements, select Yes if the statement is true. Otherwise, select No.
1) share2 can be added as a cloud endpoint for group1
2) e:\folder2 on server1 can be added as a server endpoint for group1
3) D:\data on server2 can be added as a server endpoint for group1
1) no
2) yes
3) yes

You have an Azure subscription named Subscription1.You create an Azure Storage account named contosostorage, and then you create a file share named data.Which UNC path should you include in a script that references files from the data file share?
3 boxes:
\contosostorage. file.core.windows.net \ data

You have an Azure subscription that contains an Azure Storage account.You plan to copy an on-premises virtual machine image to a container named vmimages.You need to create the container for the planned image.Which command should you run?
azcopy MAKE http…. BLOB.core

You have an Azure File sync group that has the endpoints shown in the following table. Cloud tiering is enabled for Endpoint3.You add a file named File1 to Endpoint1 and a file named File2 to Endpoint2.On which endpoints will File1 and File2 be available within 24 hours of adding the files? To answer, select the appropriate options in the answer area.
File1: endpoint3 only
file2: endpoint1, endpoint2, and endpoint3

You have several Azure virtual machines on a virtual network named VNet1.You configure an Azure Storage account as shown in the following exhibit.
Allows access from selected networks
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
1) the virtual machine on 10.2.9.2/24 will have network access
2) Azure backup will be able to back up the unmanaged hard disks
1) always
2) Never

You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named File1.txt.Your on-premises network contains servers that run Windows Server 2016. The servers are configured as shown in the following table.You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for Sync1.
1) on cloud endpoint, file1.txt is overrwitten by file1.txt from share1
2) on server1, file1.txt is overwritten by file1.txt from the cloud endpoint
3) File1.txt from share1 replicates to share2
1) Yes
2) No
3) yes

You have an Azure subscription that contains the storage accounts shown in the following table.You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by requesting a live migration from Azure support.What should you identify?
storage2

You have an Azure subscription that contains a storage account named account1.You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of131.107.1.0/24.You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.You need to configure account1 to meet the following requirements:✑ Ensure that you can upload the disk files to account1.✑ Ensure that you can attach the disks to VM1.✑ Prevent all other access to account1.Which two actions should you perform?
From the Firewalls and virtual networks blade of account1, select Selected networks.

From the Service endpoints blade of VNet1, add a service endpoint.

You have an on-premises file server named Server1 that runs Windows Server 2016.You have an Azure subscription that contains an Azure file share.You deploy an Azure File Sync Storage Sync Service, and you create a sync group.You need to synchronize files from Server1 to Azure.Which three actions should you perform in sequence?
install the azure file sync agent on server1

Add a server endpoint

You plan to create an Azure Storage account in the Azure region of East US 2.You need to create a storage account that meets the following requirements:✑ Replicates synchronously.✑ Remains available if a single data center in the region fails.How should you configure the storage account? To answer, select the appropriate options in the answer area.
Replication: Geo-redundant storage

Account type: StorageV2

a driveset CSV file

You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines.You need to delete the Recovery Services vault.What should you do first?
From the Recovery Service vault, stop the backup of each backup item.

Can blobs be backed up to service vaults?
NO

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.In storage1, you create a blob container named blob1 and a file share named share1.Which resources can be backed up to Vault1 and Vault2?
Can use Vault1 for backups: VM1 only

Can use Vault2 for backups: share1 only

You have an Azure subscription.You create the Azure Storage account shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
1) The minimum number of copies of the storage account will be
2) To reduce the cost of infrequently accessed data in the storage account, you must modify the__ setting
1) 3
2) Access tier (default)

You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.You need to view the date and time when the resources were created in RG1.Solution: From the RG1 blade, you click Automation script.Does this meet the goal?
No

You have an Azure subscription named Subscription1.You deploy a Linux virtual machine named VM1 to Subscription1.You need to monitor the metrics and the logs of VM1.What should you use?
the AzurePerformanceDiagnostics extension

You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.You install and configure a web server and a DNS server on VM1.VM1 has the effective network security rules shown in the following exhibit:

Inbound and outbound rules with a Rule2 entry
1) internet users
2) if you delete the “rule2” entry internet users can
1) can connect to the web server only
2) can connect to web server and DNS server on VM1

You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1.You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable.What should you deploy?
all virtual machines in a single Availability Set

You have an Azure virtual machine named VM1 that runs Windows Server 2019.You save VM1 as a template named Template1 to the Azure Resource Manager library.You plan to deploy a virtual machine named VM2 from Template1.What can you configure during the deployment of VM2?
administrator username

You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not support multiple active instances.At the end of each month, CPU usage for VM1 peaks when App1 runs.You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.What task should you include in the runbook?
Add a Desired State Configuration (DSC) extension to VM1.

You have an Azure virtual machine named VM1 that runs Windows Server 2019.You sign in to VM1 as a user named User1 and perform the following actions:✑ Create files on drive C.✑ Create files on drive D.✑ Modify the screen saver timeout.✑ Change the desktop background.You plan to redeploy VM1.Which changes will be lost after you redeploy VM1
the files on the C drive

You have an Azure subscription.You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click the Exhibit tab.) You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines.What should you modify on VM1?
the hard drive

You have an Azure subscription that contains a virtual machine scale set. The scale set contains four instances that have the following configurations:✑ Operating system: Windows Server 2016✑ Size: Standard_D1_v2You run the get-azvmss cmdlet as shown in the following exhibit: Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
0 and 4

ou have an Azure subscription named Subscription1 that is used by several departments at your company. Subscription1 contains the resources in the following table: Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2 by using a single Azure Resource Manager template.You need to view the template used for the deployment.From which blade can you view the template that was used for the deployment?
RG1

What Steps are involved in shipping data to Azure
1 – Prepare Hard drives
2 – Create import Job
3 – Ship drives to Az Dc
4 – Update Tracking
5 – Verify the data upload.

Is IPV6 to IPV6 communication is supported without load balancer?

True or False
True, to have ipv6 communitication between vnets you need and internal load balancer

What effect is evaluated first in Azure Policy

A- Append
B- Disabled
C- Deny
D – Audit
B – Disabled

How do you enable auto scale on basic web app
Change to standard
Enable autscale
create Scale rule

When using az ad user create, what parameters are needed
UPN, DisplayName and Password

What is the restore period of an Azure AD user?

A- 30
B- 60
c – 90
d – Can’t restore
A – 30 days

What are actions and not actions
actions = allowable permissions on Role definition

Not acctions = Denied permissions

How are NotActions used in a role definition?

A – NotActions are subtracted from the Actions to define the list of permissible operations.

B- NotActions are consulted after Actions to deny access to a specific operation.

C – NotActions allow you to specify a single operation that is not allowed.
A – NotActions are subtracted from the Actions to define the list of permissible operations.

What tool would you use to monitor Subnets?
Network security group (NSG) flow logging

What Role is needed to manage access to Azure Resources?

A – Co-administrator
B – Owner
C – User Access Administrator
D – Contributor
User Access Administrator

Pubilc IP assigned to the Nic will take precedence over one on the Load balancer?

True or False
True

How many SNAT ports allocated to a Load public IP address
1024

How is outbound Public traffic used on basic load balancers?
All IPs took into consideration but one used.

standard all are used at the same time

What steps are involved in creating an Azure Bastion?
1) Create Subnet named Azure bastion subnet /27?
2)Create Bastion
3) Connect to VM1 using azure portal

In Kubernetes can a POD share Managed Disks?

Yes or No
Yes

Azure Files

Main steps involved in Registering DNS with Azure
Purchase from Registrar
Configure Forward Lookup zone
Point NS records to Azure DNS

5 steps to create Azure File Share in powershell
New-StorageAccount – Create storage account
Get-StorageAccountKeys – grab keys
New-AzureStorageContext – login keys etc
New-AzureStorageShare – create share
CMDKEY – stores access keys
New-PSDrive – maps drive

When creating an Azure Bastion, What are the 3 main requirements?
Subnet must be called AzureBastionSubnet and created first

CIDR min /27 or larger

Standard SKU static IP

What are the minimum permissions for an Azure Bastion?
Reader role on the VM

Reader role on the NIC with private IP of the VM

Reader role on Azure Bastion resource

What can Azure AD role, User Administrator do?
Manage all aspects of users and groups, including support tickets

Monitoring service tickers

resetting passwords

What can Azure AD role, Billing Administrator do?
make purchases

manage subscriptions

support ticket

monitor service health.

What command would you use to list permissions of a role?
az role definition list –name

Get-AzRoleDefinition

A Basic IP SKU can support availability zones

True or False
False

Name several services that don’t work over Global vent peering
VM behind Load balancers
VMSS behind basic load balancers
Redis cache
Application gateway
Logic Apps

What security features does Azure DNS provide?
RBAC

Activity logs

Resource locking

We need to set up and DNS record to point to an Azure load-balancer which record will need to be created.

A) Record Set
B) A Record
C) CNAME
D) AAA
A) Record Set

Commands to create DNS record in AZ and PowerShell
az network dns record-set

New-AzDnsRecordSet -Name www -RecordType A -ZoneName contoso.xyz -ResourceGroupName MyResourceGroup -Ttl 3600 -DnsRecords

(New-AzDnsRecordConfig -IPv4Address “10.10.10.10”)

What are the main Services tags (7)

v a i a s s a
Virtual Network
AzureLoadBalancer
Internet
Azure Traffic Manager
Storage
SQL
AppService

How would you troubleshoot VPN connectivity?

enabled network watcher
Start VPN Logging
Check Security associations
Check on premise VPN External Devices

What cmdlets are used to test network connectivity?
Ge-AzEffectiveNetworksecgroup
Test-AzNetworkWatcherIPFlow

What cmdlet should you run if you are having issues with validation on purchases in the Azure portal?
Set-AzMarketplaceTerms cmdlet

With AZ Copy what access methods can you use to copy data into File Storage?
SAS Keys only

With AZ Copy what access methods can you use to copy data into Blob Storage?
Azure AD and SAS keys

What needs to be installed on a Virtual machine to be able to capture all network traffic?
Network Watcher Agent VM Extension

When using Network Performance Monitor (NPM) why is the OMS agent needed?
Service Connection reliability

Performance monitor

Express Route Monitor

What is IP Flow used for and the power shell command to run?
Check if packets are allowed or denied on a NSG

Test-AzNetworkWatcherIPFlow

What is Connection Monitor used for and what PowerShell command is used?
Check two VMs can communicate
Latency
Can probe at regular intervals
Can monitor IP or FQDN

New-AzNetworkWatcherConnectionMonitor

How many email messages can an action group send in 1 Hour?
60

1 per minute

How many SMS messages can an action group send in 1 Hour?
12
1 per 5 minutes

How often can a voice call be used in an action group?
1 voice every 5 mins

What files is used to customise Linux on first boot?

A- Answer.ini
B- cloudinit.txt
C – unattended.conf
D- unattended.xml
Cloudinit.txt

What tool can be used to import Azure DNS and the command?
AZ CLI

az network DNS zone import

How many minutes can a basic web app run for?
240 minutes

How many minutes can a shared web app run for?
60 minutes

What are the 5 steps needed to create Azure File Sync?

Allow port 4443 outbound
Create file sync service
Install agen on server and register
Create Sync Group and cloud endpoint
Register server and share

What is the max quota for vCPU on a subscription and if I have a VM is deallocated, does this count towards my quota?
20

both allocated and deallocated machines count

Do free space policies for azure file sync apply to each server individually?
No

Most restrictive applied

How do you configure a report to be sent to individuals for resources consuming more than expected?
Configure report in the Cost Management portal

JSON or CSV

When would you use WaImportV2 over WaImportV1 when using the Azure Import/Export Service?
If you need to import into Azure Files v2 is needed.

What happens with duplicate files on Azure File sync
-servername is appended onto the filename

Azure Export Job Steps
Create Export Job specify containers

Check the number of Drive with WAImportExport

Ship empty drives to MS with tracking

Update Tracking

Receive and unlock with BitLocker keys

What App Service Plan supports webjobs?
Basic App Plan

Which mode in JSON templates for Azure Policy checked the features are supported?
Indexed

What is the minimum App Service Plan needed to use deployment slots?
Standard App Service Plan

I have a web app that needs to run for 240 per day what is the best Dev Test plan for me?
D1 App Service Plan

I have a basic app service plan, can I do cloning? if not what plan is needed?
Standard App Service Plan

What is the SLA for 2x VMs across 2x Av Zones in same region?
99.99%

What is the SLA for 2x VMs across 1 x Av Set?
99.95%

What is the SLA for 1x VM across SSD for OS and Data?
99.9%

What is the maximum amount of fault domains?
3

What is the maximum update domains?
20

azure Private DNS be linked to multiple VNETS

True or False
True

What command is used to update VPN Gateway with Subnet?

A) Set-AzLocalNetworkGateway
B) Set-AzNetworkInterface
c) Add-AzVirtualNetworkSubnetConfig
Set-AzLocalNetworkGateway

Which two features are not supported on Azure File Sync Service?
Deduplication

Scale-out File server (has to be General)

What are the 4 steps involved in troubleshooting VPN Issues?
Enable Network Watcher

Start VPN Logging

Check sec assoications

Check onpremise VPN external interfaces

What DNS records is needed to verify a custom domain on APP service?
TXT for applicationcs.azurewebsites.net

What is the maximum recovery period for Azure File Shares

A – 10 Years
B – 365 Days
C – 31 Days
D – 120 Days
A) 10 Years retention

Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution.

A. a drive set CSV file
B. a JSON configuration file
C. a PowerShell PS1 file
D. an XML manifest file
E. a dataset CSV file
A. a driveset CSV file
E. a dataset CSV file

You need to define a custom domain name for Azure AD to support the planned infrastructure. Which domain name should you use?

A. ad.humongousinsurance.com
B. humongousinsurance.onmicrosoft.com
C. humongousinsurance.local
D. humongousinsurance.com
Answer: D

Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com.
The initial domain name cannot be changed of deleted, but you can add your corporate domain name to AAD as well. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as ‘alice@contoso.com.’ instead of ‘alice@domain name.onmicrosoft.com’.

You need to prepare the environment to meet the authentication requirements. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Allow inbound TCP port 8080 to the domain controllers in the Miami office.

B. Add http://autogon.microsoftazuread-sso.com to the intranet zone of each client computer in the Miami office.

C. Join the client computers in the Miami office to Azure AD.

D. Install the Active Directory Federation Services (AD FS) role on a domain controller in the Miami Questions & Answers PDF P-16 www.dumpskey.com office.

E. Install Azure AD Connect on a server in the Miami office and enable Pass-through Authentication.
Answer: BE

B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users’ Intranet zone settings by using Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com

E: Seamless SSO works with any method of cloud authentication – Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

Scenario: Licensing Issue

You attempt to assign a license in Azure to several users and receive the following error message: “Licenses not assigned. License agreement failed for one user.”
You verify that the Azure subscription has the available licenses.

You need to resolve the licensing issue before you attempt to assign the license again. What should you do?
A. From the Groups blade, invite the user accounts to a new group.
B. From the Profile blade, modify the usage location.
C. From the Directory role blade, modify the directory role.
Answer: B

Explanation: Some Microsoft services aren’t available in all locations because of local laws and regulations. Before you can assign a license to a user, you must specify the Usage location property for the user. You can specify the location under the User > Profile > Settings section in the Azure portal.

You have an azure subscription named Subscription that contains the resource groups shown in the following table.

RG1 – East Asia
RG2 – East US

In RG1, you create a virtual machine named VM1 in the East Asia location. You plan to create a virtual network named VNET1. You need to create VNET, and then connect VM1 to VNET1. What are two possible ways to achieve this goal? Each correct answer presents a complete a solution. NOTE: Each correct selection is worth one point.

A. Create VNET1 in RG2, and then set East Asia as the location.
B. Create VNET1 in a new resource group in the West US location, and then set West US as the location.
C. Create VNET1 in RG1, and then set East Asia as the location
D. Create VNET1 in RG1, and then set East US as the location.
E. Create VNET1 in RG2, and then set East US as the location.
Answer: AC

A network interface can exist in the same, or different resource group, than the virtual machine you attach it to, or the virtual network you connect it to. The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, also referred to as a region. Note, Resource groups can span multiple Regions, but VNets only can hold resources (VMs, Network Adapters) that exists in the same region. So in this scenario, you need to create VNET1 in any RG and set location as East Asia.

You have an Azure subscription that contains a storage account named account1. You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24. You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You need to configure account1 to meet the following requirements: Ensure that you can upload the disk files to account1. Ensure that you can attach the disks to VM1. Prevent all other access to account1. Which two actions should you perform? Each correct selection presents part of the solution. NOTE: Each correct selection is worth one point.

A. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.
B. From the Firewalls and virtual networks blade of account1, select Selected networks.
C. From the Firewalls and virtual networks blade of acount1, add VNet1.
D. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to access this storage account.
E. From the Service endpoints blade of VNet1, add a service endpoint.
Answer: AB

By default, storage accounts accept connections from clients on any network. To limit access to selected networks, you must first change the default action. Azure portal

Navigate to the storage account you want to secure. 2. Click on the settings menu called Firewalls and virtual networks.
To deny access by default, choose to allow access from ‘Selected networks’. To allow traffic from all networks, choose to allow access from ‘All networks’.
Click Save to apply your changes. Grant access from a Virtual Network Storage accounts can be configured to allow access only from specific Azure Virtual Networks. By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an optimal route to the Azure Storage service. The identities of the virtual network and the subnet are also transmitted with each request.

You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com. Your company has a public DNS zone for contoso.com. You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name. Which type of DNS record should you create?

A. PTR
B. MX
C. NSEC3
D. RRSIG
Answer: B

TXT or MX : Correct You can use either a TXT or MX record to verify the custom domain in the Azure AD. MX records can serve the purpose of TXT records Questions & Answers PDF P-56 www.dumpskey.com

SRV : Incorrect SRV records are used by various services to specify server locations. When specifying an SRV record in Azure DNS
DNSKEY : Incorrect Choice This will verify that the records are originating from an authorized sender. NSEC : Incorrect Choice This is Part of DNSSEC. This is used for explicit denial-of-existence of a DNS record. It is used to prove a name does not exist.

You have an Azure virtual machine named VM1. Azure collects events from VM1. You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1. You need to specify which resource type to monitor. What should you specify?

A. metric alert
B. Azure Log Analytics workspace
C. virtual machine
D. virtual machine extension
Answer: B

Explanation: Azure Monitor can collect data directly from your Azure virtual machines into a Log Analytics workspace for analysis of details and correlations. Installing the Log Analytics VM extension for Windows and Linux allows Azure Monitor to collect data from your Azure VMs. Azure Log Analytics workspace is also used for on-premises computers monitored by System Center Operations Manager.

You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2. VM2 is protected by RSV1. You need to use RSV2 to protect VM2. What should you do first?

A. From the RSV1 blade, click Backup items and stop the VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the VM2 backup.
C. From the RSV1 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup.
D. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault
Answer: D

The Azure Site Recovery service contributes to your disaster recovery strategy by managing and orchestrating replication, failover, and failback of on-premises machines and Azure virtual machines (VMs).

You have an Azure subscription that contains a web app named webapp1. You need to add a custom domain named www.contoso.com to webapp1. What should you do first?

A. Upload a certificate.
B. Add a connection string.
C. Stop webapp1.
D. Create a DNS record.
Answer: B

You create an App Service plan named App1 and an Azure web app named webapp1. You discover that the option to create a staging slot is unavailable. You need to create a staging slot for App1. What should you do first?

A. From webapp1, modify the Application settings.
B. From webapp1, add a custom domain.
C. From App1, scale up the App Service plan.
D. From App1, scale out the App Service plan.
Answer: C

Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs), custom domains and certificates, staging slots, autoscaling, and more. You scale up by changing the pricing tier of the App Service plan that your app belongs to.

You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines. You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text. What should you create to store the password? Questions & Answers PDF P-73 www.dumpskey.com

A. Azure Active Directory (AD) Identity Protection and an Azure policy
B. a Recovery Services vault and a backup policy
C. an Azure Key Vault and an access policy
D. an Azure Storage account and an access policy
Answer: C

Explanation: You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore the password is never put in plain text in the template parameter file

You plan to use the Azure Import/Export service to copy files to a storage account. Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. an XML manifest file
B. a driveset CSV file
C. a dataset CSV file
D. a PowerShell PS1 file
E. a JSON configuration file
Answer: BC

Explanation: B: Modify the driveset.csv file in the root folder where the tool resides. C: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you want to import a file or folder or both, add entries in the dataset.csv file

You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data?
A. Azure Data Lake Store
B. a virtual machine
C. the Azure File Sync Storage Sync Service
D. Azure Blob storage
Answer: D

Explanation: Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter. The maximum size of an Azure Files Resource of a file share is 5 TB.

You have an Azure subscription that contains the following resources: 100 Azure virtual machines 20 Azure SQL databases 50 Azure file shares You need to create a daily backup of all the resources by using Azure Backup. What is the minimum number of backup policies that you must create?
A. 1
B. 2
C. 3
D. 150
E. 170
Answer: C

Explanation: There is a limit of 100 VMs that can be associated to the same backup policy from portal. We recommend that for more than 100 VMs, create multiple backup policies with same schedule or different schedule. One policy for VMS, one for SQL databases, and one for the file shares.

You have an Azure virtual machine named VM1. You use Azure Backup to create a backup of VM1 named Backup1. After creating Backup1, you perform the following changes to VM1: Modify the size of VM1. Copy a file named Budget.xls to a folder named Data. Reset the password for the built-in administrator account. Questions & Answers PDF P-110 www.dumpskey.com Add a data disk to VM1. An administrator uses the Replace existing option to restore VM1 from Backup1. You need to ensure that all the changes to VM1 are restored. Which change should you perform again?

A. Modify the size of VM1.
B. Add a data disk.
C. Reset the password for the built-in administrator account.
D. Copy Budget.xls to Data.
Answer: D

The scenario mentioned in the question, we are using the replace option. So in this case we would lose the existing data written to the disk after the backup was taken. The file was copied to the disk after the backup was taken. Hence, we would need to copy the file once again.

You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1. You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days. Which two groups should you create? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A. a Security group that uses the Assigned membership type
B. an Office 365 group that uses the Assigned membership type
C. an Office 365 group that uses the Dynamic User membership type D. a Security group that uses the Dynamic User membership type
E. a Security group that uses the Dynamic Device membership type
Answer: BC

Explanation: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD). Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner. When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also deleted. You can set up a rule for dynamic membership on security groups or Office 365 groups. Incorrect Answers: A, D, E: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).

You have an Azure Active Directory (Azure AD) tenant named contoso.com. Multi-factor authentication (MFA) is enabled for all users. You need to provide users with the ability to bypass MFA for 10 days on devices to which they have successfully signed in by using MFA. What should you do?

A. From the multi-factor authentication page, configure the users’ settings.
B. From Azure AD, create a conditional access policy.
C. From the multi-factor authentication page, configure the service settings.
D. From the MFA blade in Azure AD, configure the MFA Server settings
Answer: C

Explanation: Enable remember Multi-Factor Authentication Sign in to the Azure portal. On the left, select Azure Active Directory > Users. Select Multi-Factor Authentication. Under Multi-Factor Authentication, select service settings. On the Service Settings page, manage remember multi-factor authentication, select the Allow users to remember multi-factor authentication on devices they trust option. Set the number of days to allow trusted devices to bypass two-step verification. The default is 14 days. Select Save.

You have an Azure virtual machine named VM1 that runs Windows Server 2019. You sign in to VM1 as a user named User 1 and perform the following actions: Create files on drive C. Create files on drive 0. Modify the screen saver timeout. Change the desktop background. You plan to redeploy VM1. Which changes will be lost after you redeploy VM1?

A. the modified screen saver timeout
B. the new desktop background
C. the new files on drive
D. The new files on drive C
Answer: D

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: A virtual network that has a subnet named Subnet1 Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: Priority: 100 Source: Any Source port range: Destination: Destination port range: 3389 Protocol: UDP Action: Allow VM1 connects to Subnet1. NSG1-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1. You need to be able to establish Remote Desktop connections from the internet to VM1. Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol. Does this meet the goal?

A. Yes
B. No
Answer: B

The default port for RDP is TCP port 3389 not UDP. NSGs deny all inbound traffic except from virtual network or load balancers. For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, and then the rules in a network security group associated to the network interface. By default NSG rule to allow traffic through RDP port 3389 is not created automatically during the creation of VM , unless you change the setting during creation. Here in the solution UDP traffic is allowed at virtual network level which is not tcp/rdp protocol. So this will not work to achieve the goal.

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant contains 500 user accounts. You deploy Microsoft Office 365. You configure Office 365 to use the user accounts in adatum.com. You configure 60 users to connect to mailboxes in Microsoft Exchange Online. You need to ensure that the 60 users use Azure Multi-Factor Authentication (MFA) to connect to the Exchange Online mailboxes. The solution must only affect connections to the Exchange Online mailboxes. What should you do?

A. From the multi-factor authentication page, configure the Multi-Factor Auth status for each user
B. From Azure Active Directory admin center, create a conditional access policy
C. From the multi-factor authentication page, modify the verification options
D. From the Azure Active Directory admin center, configure an authentication method
Answer: A

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1. An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com. You need to ensure that access to AKS1 can be granted to the contoso.com users. What should you do first?

A. From contoso.com, modify the Organization relationships settings.
B. From contoso.com, create an OAuth 2.0 authorization endpoint.
C. Recreate AKS1.
D. From AKS1, create a namespace.
Answer: B

With Azure AD-integrated AKS clusters, you can grant users or groups access to Kubernetes resources within a namespace or across the cluster. To obtain a kubectl configuration context, a user can run the az aks get-credentials command. When a user then interacts with the AKS cluster with kubectl, they’re prompted to sign in with their Azure AD credentials. This approach provides a single source for user account management and password credentials. The user can only access the resources as defined by the cluster administrator. Azure AD authentication is provided to AKS clusters with OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol. For more information on OpenID Connect, see the Open ID connect documentation. From inside of the Kubernetes cluster, Webhook Token Authentication is used to verify authentication tokens. Webhook token authentication is configured and managed as part of the AKS cluster

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1. You need to view the error events from a table named Event. Which query should you run in Workspace1?

A. Event | where EventType is “error”
B. Event | search “error”
C. select * from Event where EventType == “error”
D. Get-Event Event | where {$_.EventType -eq “error”}
Answer: B

To search a term in a specific table, add in (table-name) just after the search operator

You have an Azure virtual machine named VM1 that runs Windows Server 2019. You save VM1 as a template named Template1 to the Azure Resource Manager library. You plan to deploy a virtual machine named VM2 from Template1. What can you configure during the deployment of VM2?

A. virtual machine size
B. operating system
C. administrator username
D. resource group
Answer: D

Explanation: When deploying a virtual machine from a template, you must specify: the Resource Group name and location for the VM the administrator username and password an unique DNS name for the public IP

Explanation: Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source

You have an Azure Active Directory (Azure AD) domain that contains 5,000 user accounts. You create a new user account named AdminUser1. You need to assign the User administrator administrative role to AdminUser1. What should you do from the user account properties?

A. From the Directory role blade, modify the directory role.
B. From the Groups blade, invite the user account to a new group.
C. From the Licenses blade, assign a new license.
Answer: A

Explanation: Assign a role to a user Sign in to the Azure portal with an account that’s a global admin or privileged role admin for the directory. Select Azure Active Directory, select Users, and then select a specific user from the list. For the selected user, select Directory role, select Add role, and then pick the appropriate admin roles from the Directory roles list, such as Conditional access administrator. Press Select to save.

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10 users can use all the Azure AD Premium features. What should you do?
A. From the Groups blade of each user, invite the users to a group.
B. From the Licenses blade of Azure AD, assign a license.
C. From the Directory role blade of each user, modify the directory role.
D. From the Azure AD domain, add an enterprise application.
Answer: B

Many Azure Active Directory (Azure AD) services require you to license each of your users or groups (and associated members) for that service. Only users with active licenses will be able to access and use the licensed Azure AD services for which that’s true. Licenses are applied per tenant and do not transfer to other tenants. Not all Microsoft services are available in all locations. Before a license can be assigned to a group, you must specify the Usage location for all members. You can set this value in the Azure Active Directory > Users > Profile > Settings area in Azure AD. Any user whose usage location is not specified inherits the location of the Azure AD organization. You can add the licensing rights to users or to an entire group.

You have an Azure subscription named Subscription 1 and an on-premises deployment of Microsoft System Center Service Manager Subscription! contains a virtual machine named VM1. You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent. What should you do first?

A. Create a notification.
B. Create an automation runbook.
C. Deploy the IT Service Management Connector (ITSM).
D. Deploy a function app.
Answer: C

Explanation: The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service Management (ITSM) product/service, such as the Microsoft System Center Service Manager. With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log alerts and Log Analytics alerts).

You have an on-premises server that contains a folder named D:\Folder1. You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contoso data. Which command should you run?

A. https://contosodata.blob.core.windows.net/public
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public –snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public –recursive
D. az storage blob copy start-batch D:\Folder1 https:// contosodata.blob.core.windows.net/public
Answer: C

Explanation:
The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The result is a directory in the container by the same name. Incorrect Answers: B: The azcopy sync command replicates the source location to the destination location. However, the file is skipped if the last modified time in the destination is more recent. D: The az storage blob copy start-batch command copies multiple blobs to a blob container.

You have an Azure Storage account named storage1. You plan to use AzCopy to copy data to storage1. You need to identify the storage services in storage1 to which you can copy the data. What should you identify?
A. blob, file, table, and queue
B. blob and file only
C. file and table only
D. file only
E. blob, table, and queue only
Answer: B

Explanation: AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account. Incorrect Answers: A, C, E: AzCopy does not support table and queue storage services. D: AzCopy supports file storage services, as well as blob storage services.

You have an Azure subscription that contains an Azure Storage account. You plan to create an Azure container instance named container1 that will use a Docker image namedImage1. Image1 contains a Microsoft SQL Server instance that requires persistent storage. You need to configure a storage service for Container1. What should you use?

A. Azure Files
B. Azure Blob storage
C. Azure Queue storage
D. Azure Table storage
Answer: A

Explanation:
Microsoft have Docker Volume Plugin for Azure file storage which provides exactly this and it is used for Azure file shares. Azure File Storage volume plugin is not limited to ease of container migration. It also allows a file share to be shared among multiple containers (even though they are on different hosts) to collaborate on workloads, share configuration or secrets of an application running on multiple hosts. Another use case is uploading metrics and diagnostics data such as logs from applications to a file share for further processing.

You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2. You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hosting VM1 and VM2. What should you include in the Availability Set?

A. one update domain
B. two fault domains
C. one fault domain
D. two update domains
Answer: D

Explanation: Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require that VMs be rebooted to complete the update. To reduce the impact on VMs, the Azure fabric is divided into update domains to ensure that not all VMs are rebooted at the same time. Incorrect Answers: A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at the same time. B, C: A fault domain shares common storage as well as a common power source and network switch. It is used to protect against unplanned system failure.

A. Yes
B. No
Answer: B

Explanation: From the RG1 blade, click Deployments. You see a history of deployment for the resource group. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorialcreate-first-template?tabs=azure-powershell Through activity logs, you can determine: § what operations were taken on the resources in your subscription § who started the operation § when the operation occurred § the status of the operation § the values of other properties that might help you research the operation

On the Azure portal menu, select Monitor, or search for and select Monitor from any page
Select Activity Log.
You see a summary of recent operations. A default set of filters is applied to the operations. Notice the information on the summary includes who started the action and when it happened

Explanation:

Select the resource group (Here RG1) you want to examine.
Select the link under Deployments.
Select one of the deployments from the deployment history.
You will see a history of deployment for the resource group, including the correlation ID.

You have an Azure subscription named Subscription1. You deploy a Linux virtual machine named VM1 to Subscription1. You need to monitor the metrics and the logs of VM1. What should you use?

A. Linux Diagnostic Extension (LAD) 3.0
B. Azure Analysis Services
C. the AzurePerformanceDiagnostics extension
D. Azure HDInsight
Answer: A

You can use extensions to configure diagnostics on your VMs to collect additional metric data. The basic host metrics are available, but to see more granular and VM-specific metrics, you need to install the Azure diagnostics extension on the VM. The Azure diagnostics extension allows additional monitoring and diagnostics data to be retrieved from the VM.

You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1. You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable. What should you deploy?

A. all three virtual machines in a single Availability Zone
B. all virtual machines in a single Availability Set
C. each virtual machine in a separate Availability Zone
D. each virtual machine in a separate Availability Set
Answer: B

Explanation: Availability sets are a datacenter configuration to provide VM redundancy and availability. This configuration within a datacenter ensures that during either a planned or unplanned maintenance event, at least one virtual machine is available.

You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not support multiple active instances. At the end of each month, CPU usage for VM1 peaks when App1 runs. You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month. What task should you include in the runbook?

A. Add the Azure Performance Diagnostics agent to VM1.
B. Modify the VM size property of VM1.
C. Add VM1 to a scale set.
D. Increase the vCPU quota for the subscription.
E. Add a Desired State Configuration (DSC) extension to VM1.
Answer: B

If you have a CPU/performance issue then the solution is to scale up (increase VM size) or to scale out (scale set) given that the App does not support multiple instances then scale up is the obvious choice.

You recently created a new Azure subscription that contains a user named Admin1. Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: “User failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.” You need to ensure that Admin1 can deploy the Marketplace resource successfully. What should you do?

A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet
B. From the Azure portal, register the Microsoft.Marketplace resource provider
C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet D. From the Azure portal, assign the Billing administrator role to Admin1
Answer: C

The Set-AzMarketplaceTerms cmdlet saves the terms object for given publisher id(Publisher), offer id(Product) and plan id(Name) tuple.

You have an Azure virtual machine named VM1 that runs Windows Server 2019. You sign in to VM1 as a user named User 1 and perform the following actions:

Create files on drive C.
Create files on drive D.
Modify the screen saver timeout.
Change the desktop background.
You plan to redeploy VM1. Which changes will be lost after you redeploy VM1?

A. the modified screen saver timeout
B. the new desktop background
C. the new files on drive D
D. The new files on drive C
Answer: C

As D drive is temporary storage so new files on D drive will be lost. The screensaver, wall paper, new files on C drive are available after Redeploy.

Explanation: You should use a policy definition.

A. Yes
B. No
Answer: A

Explanation: Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources.

A. Yes
B. No
Answer: B

Explanation: How can I freeze or lock my production/critical Azure resources from accidental deletion? There is way to do this with both ASM and ARM resources using Azure resource lock.

Explanation: Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. However, there are no built-in policy definitions. Though there are sample policy defintions.

You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual. You need to view the average round-trip time (RTT) of the packets from VM1 to VM2. Which Azure Network Watcher feature should you use?

A. NSG flow logs
B. Connection troubleshoot
C. IP flow verify
D. Connection monitor
Answer: D

Explanation: The Connection Monitor feature in Azure Network Watcher is now generally available in all public regions. Connection Monitor provides you RTT values on a per-minute granularity. You can monitor a direct TCP connection from a virtual machine to a virtual machine, FQDN, URI, or IPv4 address.

You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1. You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Add a service endpoint to VNet1
B. Reset GW1
C. Create a route-based virtual network gateway
D. Add a connection to GW1
E. Delete GW1
F. Add a public IP address space to VNet1
Answer: CE

C: A VPN gateway is used when creating a VPN connection to your on-premises network. Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface). E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet filtering. IPsec tunnel encryption and decryption are added to the packet filtering and processing engine

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure?

A. Floating IP (direct server return) to Enabled
B. Idle Time-out (minutes) to 20
C. Protocol to UDP
D. Session persistence to Client IP and Protocol
Answer: D

With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure Load-Balancer For Sticky Sessions set Session persistence to Client IP or to Client IP and protocol. On the following image you can see sticky session configuration: Note: § Client IP and protocol specifies that successive requests from the same client IP address and protocol combination will be handled by the same virtual machine. § Client IP specifies that successive requests from the same client IP address will be handled by the same virtual machine

Your on-premises network contains an SMB share named Share1. You have an Azure subscription that contains the following resources: A web app named webapp1 A virtual network named VNET1 You need to ensure that webapp1 can connect to Share1. What should you deploy?

A. an Azure Application Gateway
B. an Azure Active Directory (Azure AD) Application Proxy
C. an Azure Virtual Network Gateway
Answer: C

A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to it.

You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use?

A. Azure Active Directory (Azure AD) Application Proxy
B. Azure Application Insights
C. Azure Custom Script Extension
D. the New-AzConfigurationAssignement cmdlet
Answer: C

The Custom Script Extension downloads and executes scripts on Azure VMs. This extension is useful for post deployment configuration, software installation, or any other configuration / management task. Scripts can be downloaded from Azure storage or GitHub, or provided to the Azure portal at extension run time. The Custom Script extension integrates with Azure Resource Manager templates, and can also be run using the Azure CLI, PowerShell, Azure portal, or the Azure Virtual Machine REST API. You can use the Custom Script Extension with both Windows and Linux VMs.

You have an Azure web app named webapp1. Users report that they often experience HTTP 500 errors when they connect to webapp1. You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details. What should you do first?

A. From webapp1, enable Web server logging
B. From Azure Monitor, create a workbook
C. From Azure Monitor, create a Service Health alert
D. From webapp1, turn on Application Logging
Answer: A

To resolve this you need to catch connection error. When the connection fails for webapp, it happens on web server, not within application. You can find out the web server log by below steps: Open the web application –> Go to Application Service logs –> Go to Web server logging (there are multiple switches there) You can also see the errors live going to “Log stream” pane. To ensure that you will get web server log, you have to enable it.

Explanation: The Logic App Operator role only lets you read, enable and disable logic app. With it you can view the logic app and run history, and enable/disable. Cannot edit or update the definition. You would need the Logic App Contributor role.

You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do?

A. Create a new management group and delegate User1 as the owner of the new management group.
B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.
C. Assign the Owner role for the Azure subscription to User1, and then modify the default conditional access policies.
D. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
Answer: B

Each directory is given a single top-level management group called the “Root” management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This root management group allows for global policies and Azure role assignments to be applied at the directory level. The Azure AD Global Administrator needs to elevate themselves to the User Access Administrator role of this root group initially. After elevating access, the administrator can assign any Azure role to other directory users or groups to manage the hierarchy. As administrator, you can assign your own account as owner of the root management group.

You have an Azure web app named webapp1. You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1. You need to ensure that webapp1 can access the data hosted on VM1. What should you do?

A. Connect webapp1 to VNET1.
B. Peer VNET1 to another virtual network.
C. Deploy an Azure Application Gateway.
D. Deploy an internal load balancer
Answer: C

Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains a datacenter. You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered. You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters. What should you create?

A. three virtual WANs and one virtual hub
B. three virtual hubs and one virtual WAN
C. three On-premises data gateways and one Azure Application Gateway
D. three Azure Application Gateways and one On-premises data gateway
Answer: A

Virtual WAN offers the following advantages: Integrated connectivity solutions in hub and spoke: Automate site-to-site configuration and connectivity between on-premises sites and an Azure hub. Automated spoke setup and configuration: Connect your virtual networks and workloads to the Azure hub seamlessly. Intuitive troubleshooting: You can see the end-to-end flow within Azure, and then use this information to take required actions

You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines. You need to delete the Recovery Services vault. What should you do first?

A. From the Recovery Service vault, stop the backup of each backup item.
B. From the Recovery Service vault, delete the backup data.
C. Modify the disaster recovery properties of each virtual machine.
D. Modify the locks of each virtual machine.
Answer: A

Explanation:
You can’t delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can’t, the vault is still configured to receive backup data. Remove vault dependencies and delete vault In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In this menu, you can stop and delete Azure File Servers, SQL Servers in Azure VM, and Azure virtual machines.

A. a Desired State Configuration (DSC) extension
B. thePublish-AzVMDscConfigurationCmdlet
C. a Microsoft Intune device configuration profile
D. Deployment Center in Azure App Service
Answer: A

The primary use case for the Azure Desired State Configuration (DSC) extension is to bootstrap a VM to the Azure Automation State Configuration (DSC) service. The service provides benefits that include ongoing management of the VM configuration and integration with other operational tools, such as Azure Monitoring. Using the extension to register VM’s to the service provides a flexible solution that even works across Azure subscriptions. You can use the DSC extension independently of the Automation DSC service.

You have an Azure subscription named Subscription1 that has the following providers registered: Authorization Automation Resources Compute KeyVault Network Storage Billing Web Subscription1 contains an Azure virtual machine named VM1 that has the following con figurations:

Private IP address: 10.0.0.4 (dynamic)
Network security group (NSG): NSG1
Public IP address: None
Availability set: AVSet
Subnet: 10.0.0.0/24
Managed disks: No
Location: East US
You need to record all the successful and failed connection attempts to VM1. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Register the Microsoft.Insights resource provider
B. Add an Azure Network Watcher connection monitor
C. Register the Microsoft.LogAnalytics provider
D. Enable Azure Network Watcher in the East US Azure region
E. Create an Azure Storage account
F. Enable Azure Network Watcher flow logs
Answer: CDE

NSG flow log data is written to an Azure Storage account. You need to create an Azure Storage account, With an Azure Storage account NSG flow logs can be enabled. Enable network watcher in the East US region. NSG flow logging requires the Microsoft.Insights provider.

You create the following resources in an subscription: • An Azure Container Registry instance named Registry1 • An Azure Kubernetes Service (AKS) cluster named Cluster1 You create a container image named App 1 on your administrative workstation. You need to deploy App1 to cluster 1. What should you do first?

A. Create a host pool on Cluster1
B. Run the docker push command.
C. Run the kubect1 apply command.
D. Run the az aks create command.
Answer: B

An Azure container registry stores and manages private Docker container images, similar to the way Docker Hub stores public Docker images. You can use the Docker command-line interface (Docker CLI) for login, push, pull, and other operations on your container registry. After you login to the registry you can run push command to upload the image. Below is an sample of that command docker push myregistry.azurecr.io/samples/nginx

You have an Azure Kubernetes Service (AKS) cluster named AKS1. You need to configure cluster autoscaler for AKS1. Which two tools should you use? Each correct answer presents a complete solution, NOTE: Each correct selection is worth one point

A. the set-AzAKs cmdlet
B. the Azure portal
C. The az aks command
D. the kubect1 command
E. the set Azvm cmdlet
Answer: CD

With cluster auto-scaling, the actual load of your worker-nodes will be monitored actively. By adding and removing worker-nodes from the cluster, it ensures that enough resources are available to keep your application healthy and responsive. In contrast, it removes worker-nodes from the AKS cluster, to optimize resource utilization and be as cost-effective as possible

You have an Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines host several applications that are accessible over port 443 to user on the Internet. Your on-premises network has a site-to-site VPN connection to VNet1. You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network. You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accesses by the Internet users. What should you do?

A. Modify the address space of the local network gateway.
B. Remove the public IP addresses from the virtual machines.
C. Modify the address space of Subnet1.
D. Create a deny rule in a network security group (NSG) that is linked to Subnet1.
Answer: D

Explanation: You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don’t have to allow direct RDP or SSH access over the internet. And this can be achieved by configuring a deny rule in a network security group (NSG) that is linked to Subnet1 for RDP / SSH protocol coming from internet. Modify the address space of Subnet1 : Incorrect choice Modifying the address space of Subnet1 will have no impact on RDP traffic flow to the virtual network. Modify the address space of the local network gateway : Incorrect choice Modifying the address space of the local network gateway will have no impact on RDP traffic flow to the virtual network. Remove the public IP addresses from the virtual machines : Incorrect choice If you remove the public IP addresses from the virtual machines, none of the applications be accessible publicly by the Internet users.

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute. You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Create a local site VPN gateway.
B. Create a VPN gateway that uses the VpnGw1 SKU.
C. Create a VPN gateway that uses the Basic SKU.
D. Create a gateway subnet.
E. Create a connection.
Answer: ABE

Create a Connection: You need to link the ExpressRoute gateway to the ExpressRoute circuit. After this step has been completed, the connection between your on-premises network and Azure through ExpressRoute will be established. Hence this is correct option. Create a local site VPN gateway : This will allow you to provide the local gateway settings, for example public IP and the on-premises address space, so that the Azure VPN gateway can connect to it. Hence this is correct option. Create a VPN gateway that uses the VpnGw1 SKU : The GatewaySku is only supported for VpnGw1, VpnGw2, VpnGw3, Standard, and HighPerformance VPN gateways. ExpressRoute-VPN Gateway coexist configurations are not supported on the Basic SKU. The VpnType must be RouteBased. Hence this is correct option.

You have a public load balancer that balances ports 80 and 443 across three virtual machines. You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only. What should you configure?

A. a load balancing rule
B. a new public load balancer for VM3
C. an inbound NAT rule
D. a frontend IP configuration
Answer: C

To port forward traffic to a specific port on specific VMs use an inbound network address translation (NAT) rule. https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview an inbound NAT rule : Create a load balancer inbound network address translation (NAT) rule to forward traffic from a specific port of the front-end IP address to a specific port of a back-end VM. Hence this option is Correct a load balancing rule : Incorrect Choice A load balancer rule defines how traffic is distributed to the VMs. The rule defines the front-end IP configuration for incoming traffic, the back-end IP pool to receive the traffic, and the required source and destination ports. a new public load balancer for VM3 : Incorrect Choice This option will not help you since this will route all traffic to VM3 only. a frontend IP configuration : Incorrect Choice When you define an Azure Load Balancer, a frontend and a backend pool configuration are connected with rules. The health probe referenced by the rule is used to determine how new flows are sent to a node in the backend pool. The frontend (aka VIP) is defined by a 3-tuple comprised of an IP address (public or internal), a transport protocol (UDP or TCP), and a port number from the load balancing rule. The backend pool is a collection of Virtual Machine IP configurations (part of the NIC resource) which reference the Load Balancer backend pool.

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1.VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first?

A. Move VNet1 to Subscription2.
B. Modify the IP address space of VNet2.
C. Provision virtual network gateways.
D. Move VM1 to Subscription2.
Answer: C

Explanation: The virtual networks can be in the same or different regions, and from the same or different subscriptions. When connecting VNets from different subscriptions, the subscriptions do not need to be associated with the same Active Directory tenant. Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual network to another virtual network using the VNet-to-VNet connection type (VNet2VNet) is similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same way when communicating. The local network gateway for each VNet treats the other VNet as a local site. This lets you specify additional address space for the local network gateway in order to route traffic.

A. Yes
B. No
Answer: A

Installing Azure CLI doesn’t mean that Azure Kubernates client is installed. So before running kubectl client command, you have install kubectl, the Kubernetes command-line client. First need to run az aks install-cli to install Kubernetes CLI, which is kubectl

A. Yes
B. No
Answer: A

A. Yes
B. No
Answer: B

Kubectl is not installed by installing AZ ClI. As stated Azure CLI is already available but installing Azure CLI doesn’t mean that Azure Kubernates client is also installed. So before running any aks command, we have to install kubectl, the Kubernetes command-line client. az aks install-cli

A. Azure SQL Database
B. Azure File Storage
C. An Azure Cosmos DB database
D. The Azure File Sync Storage Sync Service
E. Azure Data Factory
F. A virtual machine
Answer: B

Explanation: Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter.

A. an Azure Cosmos DB database
B. Azure File Storage
C. the Azure File Sync Storage Sync Service
D. Azure Data Factory
Answer: B

You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image. You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed. Which two actions should you perform? Each correct answer presents part of the solution. NOTE Each correct selection is worth one point.

A. Modify the extensionProfile section of the Azure Resource Manager template.
B. Create a new virtual machine scale set in the Azure portal.
C. Create an Azure policy.
D. Create an automation account.
E. Upload a configuration script.
Answer: AE

Virtual Machine Scale Sets can be used with the Azure Desired State Configuration (DSC) extension handler. Virtual machine scale sets provide a way to deploy and manage large numbers of virtual machines, and can elastically scale in and out in response to load. DSC is used to configure the VMs as they come online so they are running the production software

You have a deployment template named Template1 that is used to deploy 10 Azure web apps. You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs. What should you identify?

A. 10 App Service plans
B. one Azure Traffic Manager
C. five Azure Application Gateways
D. one App Service plan
E. one Azure Application Gateway
Answer: D

You create Azure web apps in an App Service plan.

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-ofbusiness application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1: Change the size to D8s v3. Add a 500-GB managed disk. Add the Puppet Agent extension. Attach an additional network interface. Which change will cause downtime for VM1?

A. Add a 500-GB managed disk.
B. Attach an additional network interface.
C. Add the Puppet Agent extension.
D. Change the size to D8s v3.
Answer: D

Explanation: While resizing the VM it must be in a stopped state.

You have an Azure subscription that contains 100 virtual machines. You regularly create and delete virtual machines. You need to identify unused disks that can be deleted. What should you do?

A. From Azure Advisor, modify the Advisor configuration.
B. From Azure Cost Management view Cost Analysis.
C. From Azure Cost Management view Advisor Recommendations.
D. From Microsoft Azure Storage Explorer, view the Account Management properties.
Answer: D

You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com. You have a Microsoft account that you use to sign in to both tenants. You need to configure the default sign-in tenant for the Azure portal. What should you do?

A. From the Azure portal, configure the portal settings.
B. From the Azure portal, change the directory.
C. From Azure Cloud Shell, run Set-AzureRmContext.
D. From Azure Cloud Shell, run Set-AzureRmSubscription.
Answer: B

Explanation: The Set-AzureRmContext cmdlet sets authentication information for cmdlets that you run in the current session. The context includes tenant, subscription, and environment information.

A. From the Azure portal, change the directory.
B. From Azure Cloud Shell, run Set-AzContext.
C. From the Azure portal, configure the portal settings.
D. From Azure Cloud Shell, run Select- AzSubscription.
Answer: B

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VM1. VM1 is in a resource group named RG1. VM1 runs services that will be used to deploy resources to RG1. You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1. What should you do first?

A. From the Azure portal modify the Access control (1AM) settings of VM1.
B. From the Azure portal, modify the Policies settings of RG1.
C. From the Azure portal, modify the value of the Managed Service Identity option for VM1.
D. From the Azure portal, modify the Access control (IAM) settings of RG1.
Answer: C

Explanation: A managed identity from Azure Active Directory allows your app to easily access other AADprotected resources such as Azure Key Vault. The identity is managed by the Azure platform and does not require you to provision or rotate any secrets. User assigned managed identities can be used on Virtual Machines and Virtual Machine Scale Sets.

You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do?

A. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
B. Assign the Global administrator role to User1, and then modify the default conditional access policies.
C. Assign the Owner role to User1. and then modify the default conditional access policies.
D. Assign the Owner role to User1. and then instruct User1 to configure access management for Azure resources.
Answer: B

You have a computer named Computer! that has a point-to site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You join Computer2 to Azure Active Directory (Azure AD). Q Does this meet the goal?

A. Yes
B. No
Answer: B

Explanation: A client computer that connects to a VNet using Point-to-Site must have a client certificate installed.

You create the following resources in an Azure subscription: • An Azure Container Registry instance named Registry1. • An Azure Kubernetes Service (AKS) cluster named Cluster1. You create a container image named App1 on your administrative workstation. You need to deploy App1 to Cluster1. What should you do first?

A. Create a host pool on Cluster1.
B. Run the az acr build command.
C. Run the docker build command.
D. Run the docker push command.
Answer: B

Run the az acr build command : Correct Choice az acr build command queues a quick build, providing streaming logs for an Azure Container Registry az acr build –registry [–agent-pool] [–auth-mode {Default, None}] [–build-arg] [–file] [–image] [–no-format] [–no-logs] [–no-push] [–no-wait] [–platform] [–resource-group] [–secret-build-arg] [–subscription] [–target] [–timeout] [] Create a host pool on Cluster1 : Incorrect Choice Host pools are a collection of one or more identical virtual machines (VMs) within Windows Virtual Desktop environments. It won’t deploy the app to the cluster. Run the docker push command : Incorrect Choice Use docker push to share your images to the Docker Hub registry or to a self-hosted one. It won’t deploy the app to the cluster. Run the docker build command : Incorrect Choice This command will build an image from a Dockerfile. But in the question it has been said that image file is already built and need to deploy. This command will not deploy the image

You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do?

A. Create an PTR record named research in the adatum.com zone.
B. Create an NS record named research in the adatum.com zone.
C. Modify the SOA record of adatum.com.
D. Create an A record named “.research in the adatum.com zone.
Answer: B

Explanation: You need to create a name server (NS) record for the zone.

Your company has a main office in London that contains 100 client computers. Three years ago, you migrated to Azure Active Directory (Azure AD). The company’s security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD. A remote user named User1 is unable to join a personal device to Azure AD from a home network. You verify that other users can join their devices to Azure AD. You need to ensure that User1 can join the device to Azure AD. What should you do?

A. From the Device settings blade, modify the Users may join devices to Azure AD setting.
B. From the Device settings blade, modify the Maximum number of devices per user setting.
C. Create a point-to-site VPN from the home network of User1 to Azure.
D. Assign the User administrator role to User1.
Answer: B

Explanation: The Maximum number of devices setting enables you to select the maximum number of devices that a user can have in Azure AD. If a user reaches this quota, they will not be able to add additional devices until one or more of the existing devices are removed. Incorrect Answers: A: The Users may join devices to Azure AD setting enables you to select the users who can join devices to Azure AD. Options are All, Selected and None. The default is All. C: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as they have connectivity with the Internet.

You have an Azure subscription that contains a user named User1. You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege. Which role-based access control (RBAC) role should you assign to User1?

A. Owner
B. Virtual Machine Administrator Login
C. Contributor
D. Virtual Machine Contributor
Answer: C

Reader
Security Admin
Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

A. Assign User1 the Contributor role for VNet1.
B. Remove User from the Security Reader and Reader roles tot Subscription1.
C. Assign User1 the Network Contributor role for VNet1.
D. Assign User1 the User Access Administrator role for VNet1
Answer: D

The User Access Administrator role allows you to manage user access to Azure resources.

You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible. What should you do?

A. Deploy five virtual machines. Modify the Size setting for each virtual machine.
B. Deploy live virtual machines. Modify the Availability Zones setting for each virtual machine.
C. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.
D. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.
Answer: B

You have an Azure subscription named Subscription 1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1. On a computer named Client1 that runs Windows 10, you configure a point to site VPN connection to VNet1. You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on premises network. Client1 is unable to connect to VNet2. You need to ensure that you can connect Client1 to VNet2. What should you do?

A. Select Allow gateway transit on VNet2.
B. Select Allow gateway transit on VNet1.
C. Download and te-install the VPN client configuration package on Client1.
D. Enable BGP on VPNGW1
Answer: C

You have an Azure subscription that contains a resource group named RG1. RG1 contains 100 virtual machines. Your company has three cost centers named Manufacturing, Sales, and Finance. You need to associate each virtual machine to a specific cost center. What should you do?

A. Add an extension to the virtual machines.
B. Modify the inventory settings of the virtual machine.
C. Assign tags to the virtual machines.
D. Configure locks for the virtual machine.
Answer: C

You apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the name “Environment” and the value “Production” to all the resources in production

A. Yes
B. No
Answer: B

Through activity logs, you can determine: § what operations were taken on the resources in your subscription § who started the operation § when the operation occurred § the status of the operation § the values of other properties that might help you research the operation — question 270

You have a resource group named RG1. RG1 contains an Azure Storage account named storageaccount1 and a virtual machine named VM1 that runs Windows Server 2016. Storageaccount1 contains the disk files for VM1. You apply a ReadOnly lock to RG1. What can you do from the Azure portal?

A. Generate an automation script for RG1.
B. View the keys of storageaccount1.
C. Upload a blob to storageaccount1.
D. Start VM1.
Answer: C

Applying locks can lead to unexpected results because some operations that don’t seem to modify the resource actually require actions that are blocked by the lock. Locks are inherited to all of its resources if it applies on resource group level. Upload a blob to storageaccount1 is possible if we have readonly lock on RG1 since we are trying to modify the data not resource properties. When a R/O lock is put on a resource, you lock it’s properties not the resource. So while a read only lock is present on a storage account(inherited from a resource group), a file can still be uploaded to the already existing container of a storage account.

Incorrect Answers: Generate an automation script for RG1 is NOT possible in read only mode. A read-only lock on a storage account prevents all users from listing the keys. The list keys operation is handled through a POST request because the returned keys are available for write operations. When we tried to read the Access Key of the Storage Account , get the below message. Access blocked The resource is locked Cannot access the data plane because of a read lock on the resource or its parent. A read-only lock on a resource group that contains a virtual machine prevents all users from starting or restarting the virtual machine. These operations require a POST request.

You have an Azure subscription. You have 100 Azure virtual machines. You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering. Which blade should you use?

A. Metrics
B. Customer insights
C. Monitor
D. Advisor
Answer: D

Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized resources. You can get cost recommendations from the Cost tab on the Advisor dashboard.

You are the global administrator for an Azure Active Directory (Azure AD) tenet named adatum.com. You need to enable two-step verification for Azure users. What should you do?

A. Create a sign-in risk policy in Azure AD Identity Protection
B. Enable Azure AD Privileged Identity Management.
C. Create and configure the Identity Hub.
D. Configure a security policy in Azure Security Center
Answer: A

Identity Protection analyzes signals from each sign-in, both real-time and offline, and calculates a risk score based on the probability that the sign-in wasn’t performed by the user. Administrators can make a decision based on this risk score signal to enforce organizational requirements. Administrators can choose to block access, allow access, or allow access but require multi-factor authentication. If risk is detected, users can perform multi-factor authentication to self-remediate and close the risky sign-in event to prevent unnecessary noise for administrators. With Azure Active Directory Identity Protection, you can: require users to register for multi-factor authentication handle risky sign-ins and compromised users

You have a Basic App Service plan named ASP1 that hosts an Azure App Service named App1. You need to configure a custom domain and enable backups for App1. What should you do first?

A. Configure a WebJob for App1.
B. Scale up ASP1.
C. Scale out ASP1.
D. Configure the application settings for App1.
Answer: B

Scale up ASP1 : Correct Basic App service plan does not support backup/restore.

You create an Azure Storage account named contosostorage. You plan to create a file share named data. Users need to map a drive to the data file share from home computers that run Windows 10. Which port should be open between the home computers and the data file share?

A. 80
B. 443
C. 445
D. 3389
Answer: C

Explanation: Ensure port 445 is open: The SMB protocol requires TCP port 445 to be open; connections will fail if port 445 is blocked.

You have an Azure virtual machine named VM1 that you use for testing. VM1 is protected by Azure Backup. You delete VM1. You need to remove the backup data stored for VM1. What should you do first?

A. Modify the backup policy.
B. Delete the Recovery Services vault.
C. Stop the backup.
D. Delete the storage account.
Answer: C

Azure Backup provides backup for virtual machines — created through both the classic deployment model and the Azure Resource Manager deployment model — by using custom-defined backup policies in a Recovery Services vault. With the release of backup policy management, customers can manage backup policies and model them to meet their changing requirements from a single window. Customers can edit a policy, associate more virtual machines to a policy, and delete unnecessary policies to meet their compliance requirements. Incorrect Answers: You can’t delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can’t, the vault is still configured to receive backup data.

You have an Azure subscription that contains 100 virtual machines. You regularly create and delete virtual machines. You need to identify unattached disks that can be deleted. What should you do?

A. From Microsoft Azure Storage Explorer, view the Account Management properties.
B. From Azure Cost Management, create a Cost Management report.
C. From the Azure portal, configure the Advisor recommendations.
Answer: A

Explanation You can find unused disks in the Azure Storage Explorer console.Once you drill down to the Blob containers under a storage account, you can see the lease state of the residing VHD (the lease state determines if the VHD is being used by any resource) and the VM to which it is leased out. If you find that the lease state and the VM fields are blank, it means that the VHD in question is unused. The screenshot below shows two active VHDs being used by VMs as data and OS disks. The name of the VM and lease state are shown in the “VM Name” and “Lease State” columns, respectively.

You have an Azure tenant that contains two subscriptions named Subscription1 and Subscription2. In Subscription1, you deploy a virtual machine named Server1 that runs Windows Server 2016. Server1 uses managed disks. You need to move Server1 to Subscription2. The solution must minimize administration effort. What should you do first?

A. In Subscription2, create a copy of the virtual disk.
B. From Azure PowerShell, run the Move-AzureRmResource cmdlet.
C. Create a snapshot of the virtual disk.
D. Create a new virtual machine in Subscription2.
Answer: B

Explanation: To move existing resources to another resource group or subscription, use the MoveAzureRmResource cmdlet.

You have an Azure Active Directory (Azure AD) tenant named Tenant1 and an Azure subscription named You enable Azure AD Privileged Identity Management. You need to secure the members of the Lab Creator role. The solution must ensure that the lab creators request access when they create labs. What should you do first?

A. From Azure AD Privileged Identity Management, edit the role settings for Lab Creator.
B. From Subscription1 edit the members of the Lab Creator role.
C. From Azure AD Identity Protection, creates a user risk policy.
D. From Azure AD Privileged Identity Management, discover the Azure resources of Conscription.
Answer: A

Explanation: As a Privileged Role Administrator you can: Enable approval for specific roles Specify approver users and/or groups to approve requests View request and approval history for all privileged roles

You have an Azure Active Directory (Azure AD) tenant that has Azure AD Privileged Identity Management configured. You have 10 users who are assigned the Security Administrator role for the tenant. You need the users to verify whether they still require the Security Administrator role. What should you do?

A. From Azure AD Identity Protection, configure a user risk policy.
B. From Azure AD Privileged Identity Management, create an access review.
C. From Azure AD Identity Protection, configure the Weekly Digest.
D. From Azure AD Privileged Identity Management, create a conditional access policy.
Answer: B

To reduce the risk associated with stale role assignments, you should regularly review access. You can use Azure AD Privileged Identity Management (PIM) to create access reviews for privileged Azure AD roles. You can also configure recurring access reviews that occur automatically. Steps: 1. Sign in to Azure portal with a user that is a member of the Privileged role administrator role. 2. Open Azure AD Privileged Identity Management. 3. Select Azure AD roles. 4. Under Manage, select Access reviews, and then select New.

You have an Azure App Service plan that hosts an Azure App Service named App1. You configure one production slot and four staging slots for App1. You need to allocate 10 percent of the traffic to each staging slot and 60 percent of the traffic to the production slot. What should you add to Appl1?

A. slots to the Testing in production blade
B. a performance test
C. a WebJob
D. templates to the Automation script blade
Answer: A

Explanation: Besides swapping, deployment slots offer another killer feature: testing in production. Just like the name suggests, using this, you can actually test in production. This means that you can route a specific percentage of user traffic to one or more of your deployment slots.

You create an Azure subscription that is associated to a basic Azure Active Directory (Azure AD) tenant. You need to receive an email notification when any user activates an administrative role. What should you do?

A. Purchase Azure AD Premium 92 and configure Azure AD Privileged Identity Management,
B. Purchase Enterprise Mobility + Security E3 and configure conditional access policies.
C. Purchase Enterprise Mobility + Security E5 and create a custom alert rule in Azure Security Center.
D. Purchase Azure AD Premium PI and enable Azure AD Identity Protection.
Answer: A

Explanation: When key events occur in Azure AD Privileged Identity Management (PIM), email notifications are sent. For example, PIM sends emails for the following events: When a privileged role activation is pending approval When a privileged role activation request is completed When a privileged role is activated When a privileged role is assigned When Azure AD PIM is enabled

You have an Azure subscription that contains 10 virtual machines. You need to ensure that you receive an email message when any virtual machines are powered off, restarted, or deallocated. What is the minimum number of rules and action groups that you require?

A. three rules and three action groups
B. one rule and one action group
C. three rules and one action group
D. one rule and three action groups
Answer: C

Explanation: An action group is a collection of notification preferences defined by the user. Azure Monitor and Service Health alerts are configured to use a specific action group when the alert is triggered. Various alerts may use the same action group or different action groups depending on the user’s requirements.

Does this meet the goal?

A. Yes
B. No
Answer: A

Explanation: When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then powers it back on, retaining all your configuration options and associated resources.

A. Yes
B. No
Answer: B

Explanation: You should redeploy the VM

A. Yes
B. No
Answer: B

Explanation: You would need to Redeploy the VM.

Note This question is part of a series of questions that present the same seer Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Performance Monitor, you create a Data Collector Set (DCS) Does this meet the goal?

A. Yes
B. No
Answer: B

Network performance monitor allows you to monitor connectivity and latencies across hybrid network architectures, Expressroute circuits, and service/application endpoints. With an data collector set we can count specified network traffic, but we cannot inspect it. For this we would need a network watcher Packet Capture.

A. Yes
B. No
Answer: B

Explanation: Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. Capture packets to and from a VM Advanced filtering options and fine-tuned controls, such as the ability to set time and size limitations, provide versatility. The capture can be stored in Azure Storage, on the VM’s disk, or both. You can then analyze the capture file using several standard network capture analysis tools.

A. Yes
B. No
Answer: B

A. Yes
B. No
Answer: A

A. Yes
B. No
Answer: B

Explanation: You should use Azure Network Watcher.

A. Yes
B. No
Answer: B

Explanation: You should use Azure Network Watcher.

A. Yes
B. No
Answer: B

Explanation: Modify the Name Server (NS) record. A NS record would be created automatically and you cannot modify it (but you can add to it to support co-hosting domains). You can add additional name servers to this NS record set, to support co-hosting domains with more than one DNS provider. You can also modify the TTL and metadata for this record set. However, you cannot remove or modify the pre-populated Azure DNS name servers.

You have an Azure subscription that contains three virtual networks named VNet1, VNet2, VNet3. VNet2 contains a virtual appliance named VM2 that operates as a router. You are configuring the virtual networks in a hub and spoke topology that uses VNet2 as the hub network. You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3. You need to provide connectivity between VNet1 and VNet3 through VNet2. Which two configurations should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. On the peering connections, allow forwarded traffic.
B. On the peering connections, allow gateway transit.
C. Create route tables and assign the table to subnets.
D. Create a route filter.
Answer: AC

Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway. The peered virtual network must have the Use remote gateways checkbox checked when setting up the peering from the other virtual network to this virtual network.

You are the global administrator for an Azure Active Directory (Azure AD) tenant named adatum.com. You need to enable two-step verification for Azure users. What should you do?

A. Configure a playbook in Azure AD conditional access policy.
B. Create an Azure AD conditional access policy.
C. Create and configure the Identify Hub.
D. Install and configure Azure AD Connect.
Answer: B

Conditional Access policies enforce registration, requiring unregistered users to complete registration at first sign-in, an important security consideration.

Note: This question is part of a series of questions that present the same scenario goals. Some question sets might have more than one correct solution, while others ion in the series contains a unique solution that might meet the stated not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure web app named Appl. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier. You discover that App1 stops each day after running continuously for 60 minutes. You need to ensure that App1 can run continuously for the entire day. Solution: You add a triggered WebJob to App1. Does this meet the goal?

A. Yes
B. No
Answer: B

Explanation: You need to change to Basic pricing Tier. Note: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap.

You have an Azure Service Bus. You need to implement a Service Bus queue that guarantees first in first-out (FIFO) delivery of messages. What should you do?

A. Set the Lock Duration setting to 10 seconds.
B. Enable duplicate detection.
C. Set the Max Size setting of the queue to 5 GB.
D. Enable partitioning.
E. Enable sessions.
Answer: E

Explanation: Through the use of messaging sessions you can guarantee ordering of messages, that is first-in-firstout (FIFO) delivery of messages.

You have an Azure subscription. You activate Enterprise Mobility + Security E5 licenses for all users. You need the users to request approval before they can create virtual machines. What should you configure first?

A. Azure Active Directory (Azure AD) conditional access policies
B. Azure Active Directory (Azure AD) Authentication methods
C. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure resource roles
D. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure AD directory roles
Answer: C

Your company registers a domain name of contoso.com. You create an Azure DNS named contoso.com and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address. You need to resolve the name resolution issue. Solution: You modify the name server at the domain registrar. Does this meet the goal?

A. Yes
B. No
Answer: B

You have an on-premises network that contains a Hyper-V host named Host1. Host1 runs Windows Server 2016 and hosts 10 virtual machines that run Windows Server 2016. You plan to replicate the virtual machines to Azure by using Azure Site Recovery. You create a Recovery Services vault named ASR1 and a Hyper-V site named Site1. You need to add Host1 to ASR1. What should you do?

A. Download the installation file for the Azure Site Recovery Provider. Download the vault registration key. Install the Azure Site Recovery Provider on Host1 and register the server.

B. Download the installation file for the Azure Site Recovery Provider. Download the storage account key. Install the Azure Site Recovery Provider on Host1 and register the server.

C. Download the installation file for the Azure Site Recovery Provider. Download the vault registration key. Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.

D. Download the installation file for the Azure Site Recovery Provider. Download the storage account key. Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.
Answer: A

Your VMware vSphere on-premises infrastructure hosts 600 virtual machines (VMs). Your company is planning to move all of these VMs to Azure. You are asked to provide information about the resources that will be needed in Azure to host all of the VMs. All VMs hosted in your on-premise infrastructure are based on Windows Server 2012 R2 or newer and RedHat Enterprise Linux 7.0 or newer. You conduct the initial migration assessment and get a message that some virtual machines are conditionally ready for Azure. You need to find the cause of this message. What are two reasons why are you might get this message on some VMs? (Choose two) Each correct answer presents part of the solution.

A. The vCenter user does not have enough permissions on affected VMs.
B. The operating system is configured as Windows Server 2003 in vCenter Server.
C. The operating system is configured as Others in vCenter Server.
D. The VMs are configured with the BIOS boot type.
E. The VMs are configured with the UEFI boot type.
Answer: BE

To prepare for VMware VM assessment, you need to: Verify VMware settings. Make sure that the vCenter Server and VMs you want to migrate meet requirements. Set up permissions for assessment. Azure Migrate uses a vCenter account to access the vCenter Server, to discover and assess VMs. Verify appliance requirements. Verify deployment requirements for the Azure Migrate appliance, before you deploy it in the next tutorial.

You have an Azure Active Directory (Azure AD) tenant. All administrators must enter a verification code to access the Azure portal. You need to ensure that the administrators can access the Azure portal only from your on-premises network. What should you configure?

A. an Azure AD Identity Protection user risk policy.
B. the multi-factor authentication service settings.
C. the default for all the roles in Azure AD Privileged Identity Management
D. an Azure AD Identity Protection sign-in risk policy
Answer: B

the multi-factor authentication service settings – Correct choice There are two criterias mentioned in the question. 1. MFA required 2. Access from only a specific geographic region/IP range. To satisfy both the requirements you need MFA with location conditional access. Please note to achieve this configuration you need to have AD Premium account for Conditional Access policy. Navigate to Active Directory –> Security –> Conditional Access –> Named Location. Here you can create a policy with location (on-premise IP range) and enable MFA. This will satisfy the requirements.

You have an Azure subscription. You enable multi-factor authentication for all users. Some users report that the email applications on their mobile device cannot connect to their Microsoft Exchange Online mailbox. The users can access Exchange Online by using a web browser and from Microsoft Outlook 2016 on their computer. You need to ensure that the users can use the email applications on their mobile device. What should you instruct the users to do?

A. Create an app password
B. Reset the Azure Active Directory (Azure AD) password
C. Enable self-service password reset
D. Reinstall the Microsoft Authenticator app
Answer: A

If you’re enabled for multi-factor authentication, make sure that you have set up app passwords. Note: During your initial two-factor verification registration process, you’re provided with a single app password. If you require more than one, you’ll have to create them yourself. Go to the Additional security verification page.

You are deploying a containerized web application in Azure. When deploying the web app, which of the following are valid container image sources?

A. Virtual machine
B. Docker hub
C. ACR
D. On-premises
Answer: BC

When you create a web app from a Docker image, you configure the following properties: · The registry that contains the image. The registry can be Docker Hub, Azure Container Registry (ACR), or some other private registry. · The image :This item is the name of the repository. · The tag : This item indicates which version of the image to use from the repository. By convention, the most recent version is given the tag latest when it’s built. · Startup File :This item is the name of an executable file or a command to be run when the image is loaded. It’s equivalent to the command that you can supply to Docker when running an image from the command line by using docker run. If you’re deploying a ready-to-run, containerized app that already has the ENTRYPOINT and/or COMMAND values configured, you don’t need to fill this in.

A. Yes
B. No
Answer: B

You have an Active Directory forest named contoso.com. You install and configure Azure AD Connect to use password hash synchronization as the single signon (SSO) method. Staging mode is enabled. You review the synchronization results and discover that the Synchronization Service Manager does not display any sync jobs. You need to ensure that the synchronization completes successfully. What should you do?

A. From Synchronization Service Manager, run a full import.
B. Run Azure AD Connect and set the SSO method to Pass-through Authentication.
C. From Azure PowerShell, run Start-AdSyncSyncCycle -PolicyType Initial.
D. Run Azure AD Connect and disable staging mode.
Answer: D

Explanation: Staging mode must be disabled. If the Azure AD Connect server is in staging mode, password hash synchronization is temporarily disabled.

You sign up for Azure Active Directory (Azure AD) Premium. You need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain. What should you configure in Azure AD?

A. Device settings from the Devices blade.
B. General settings from the Groups blade.
C. User settings from the Users blade.
D. Providers from the MFA Server blade.
Answer: A

When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local administrators group on the device: The Azure AD global administrator role The Azure AD device administrator role The user performing the Azure AD join In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page: 1. Sign in to your Azure portal as a global administrator or device administrator. 2. On the left navbar, click Azure Active Directory. 3. In the Manage section, click Devices. 4. On the Devices page, click Device settings. 5. To modify the device administrator role, configure Additional local administrators on Azure AD joined

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You hire a temporary vendor. The vendor uses a Microsoft account that has a sign-in of user1@outlook.com. You need to ensure that the vendor can authenticate to the tenant by using user1@outlook.com. What should you do?

A. From Windows PowerShell, run the New-AzureADUser cmdlet and specify the – UserPrincipalName user1@outlook.com parameter.
B. From the Azure portal, add a custom domain name, create a new Azure AD user, and then specify user1@outlook.com as the username.
C. From Azure Cloud Shell, run the New-AzureADUser cmdlet and specify the -UserPrincipalName user1@outlook.com parameter.
D. From the Azure portal, add a new guest user, and then specify user1@outlook.com as the email address.
Answer: D

UserPrincipalName – contains the UserPrincipalName (UPN) of this user. The UPN is what the user will use when they sign in into Azure AD. The common structure is @, so for Abby Brown in Contoso.com, the UPN would be AbbyB@contoso.com Example: To create the user, call the New-AzureADUser cmdlet with the parameter values: powershell New-AzureADUser -AccountEnabled $True -DisplayName “Abby Brown” – PasswordProfile$PasswordProfile -MailNickName “AbbyB” -UserPrincipalName “AbbyB@contoso.com”

You have an Azure resource manager template that will be used to deploy 10 Azure Web Apps. You have to ensure to deploy the pre-requisites before the deployment of the template. You have to minimize the costs associated with the implementation. Which of the following would you deploy as pre-requisites?

A. An Azure Load Balancer
B. An Application Gateway
C. 10 Azure App Service Plans
D. One App Service Plan
Answer: D

In App Service (Web Apps, API Apps, or Mobile Apps), an app always runs in an App Service plan. An App Service plan defines a set of compute resources for a web app to run. One App Service Plan : Correct Choice

You configure Azure AD Connect for Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) for an on-premises network. Users report that when they attempt to access myapps.microsoft.com, they are prompted multiple times to sign in and are forced to use an account name that ends with onmicrosoft.com. You discover that there is a UPN mismatch between Azure AD and the on-premises Active Directory. You need to ensure that the users can use single-sign on (SSO) to access Azure resources. What should you do first?

A. From the on-premises network, deploy Active Directory Federation Services (AD FS).
B. From Azure AD, add and verify a custom domain name.
C. From the on-premises network, request a new certificate that contains the Active Directory domain name.
D. From the server that runs Azure AD Connect, modify the filtering options.
Answer: B

Explanation: Azure AD Connect lists the UPN suffixes that are defined for the domains and tries to match them with a custom domain in Azure AD. Then it helps you with the appropriate action that needs to be taken. The Azure AD sign-in page lists the UPN suffixes that are defined for on-premises Active Directory and displays the corresponding status against each suffix. The status values can be one of the following: State: Verified Azure AD Connect found a matching verified domain in Azure AD. All users for this domain can sign in Questions & Answers PDF P-349 www.dumpskey.com by using their on-premises credentials. State: Not verified Azure AD Connect found a matching custom domain in Azure AD, but it isn’t verified. The UPN suffix of the users of this domain will be changed to the default .onmicrosoft.com suffix after synchronization if the domain isn’t verified. Action Required: Verify the custom domain in Azure AD.

You have an Azure Kubernetes cluster in place. You have to deploy an application using an Azure Container registry image. Which of the following command can be used for this requirement?

A. az kubernetes deploy
B. kubectl apply
C. New-AzKubernetes set
D. docker run
Answer: B

kubectl apply : Correct Choice The kubectl command can be used to deploy applications to a Kubernetes cluster. az kubernetes deploy : Incorrect Choice This command is used to manage Azure Kubernetes Services. This is not used to deploy applications to a Kubernetes cluster. New-AzKubernetes set : Incorrect Choice This command is used to create a new managed Kubernetes cluster. This is not used to deploy applications to a Kubernetes cluster. docker run : Incorrect Choice This is run command in a new container. This is not used to deploy applications to a Kubernetes cluster

A. Yes
B. No
Answer: A

Explanation With Traffic Manager Contributor role you can manage Traffic Manager profiles, do traffic analysis but does not let you control who has access to them.

You have a service deployed to a Kubernetes cluster. Another application needs to access the service via the private IP address of the pod. Which of the following would you define as the networking type for the cluster to meet this requirement?

A. Kubenet
B. Azure container networking plugin
C. Service Endpoints
D. Network security groups
Answer: B

Azure container networking plugin : Correct Choice With the Azure container networking plugin , every pod gets an IP address allocated. With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space, and must be planned in advance. Each node has a configuration parameter for the maximum number of pods that it supports. The equivalent number of IP addresses per node are then reserved up front for that node. This approach requires more planning, as can otherwise lead to IP address exhaustion or the need to rebuild clusters in a larger subnet as your application demands grow.

A. Yes
B. No
Answer: A

Explanation Modify the Name Server (NS) record.

A. Yes
B. No
Answer: B

Modify the NS record, not the SOA record. Note: The SOA record stores information about the name of the server that supplied the data for the zone; the administrator of the zone; the current version of the data file; the number of seconds a secondary name server should wait before checking for updates; the number of seconds a secondary name server should wait before retrying a failed zone transfer; the maximum number of seconds that a secondary name server can use data before it must either be refreshed or expire; and a default number of seconds for the time-to live file on resource records.

A. Yes
B. No
Answer: B

Before you can delegate your DNS zone to Azure DNS, you need to know the name servers for your zone. The NS record set contains the names of the Azure DNS name servers assigned to the zone.

You are troubleshooting a performance issue for an Azure Application Gateway. You need to compare the total requests to the failed requests during the past six hours. What should you use?

A. Metrics in Application Gateway
B. Diagnostics logs in Application Gateway
C. NSG flow logs in Azure Network Watcher
D. Connection monitor in Azure Network Watcher
Answer: A

Explanation: Application Gateway currently has seven metrics to view performance counters. Metrics are a feature for certain Azure resources where you can view performance counters in the portal. For Application Gateway, the following metrics are available: Total Requests Failed Requests Current Connections Healthy Host Count Response Status Throughput

You have an Azure App Service plan named AdatumASP1 that uses the P2v2 pricing tier. AdatumASP1 hosts Ml Azure web app named adatumwebapp1. You need to delegate the management of adatumwebapp1 to a group named Devs. Devs must be able to perform the following tasks: • Add deployment slots. • View the configuration of AdatumASP1. • Modify the role assignment for adatumwebapp1. Which role should you assign to the Devs group?

A. Owner
B. Contributor
C. Web Plan Contributor
D. Website Contributor
Answer: A

Owner : Correct Choice The Owner role lets you manage everything, including access to resources. Contributor : Incorrect Choice With contributor role you can Add deployment slots and View the configuration of App service plan but you can’t Modify the role assignment. For this you need User Access Administrator or Owner role. So this is incorrect. Web Plan Contributor : Incorrect Choice The Web Plan Contributor role lets you manage the web plans for websites, but not access to them. So this option is incorrect. Website Contributor : Incorrect Choice The Website Contributor role lets you manage websites (not web plans), but not access to them. So this is incorrect option. Note: As per least privilege principle it is not advisable to provide owner role to any group, rather you should create custom RBAC role with custom policy and use that role for this operation. However as this option is not available here so only option to go with owner role.

A. Yes
B. No
Answer: A

Explanation: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap

You have 100 Azure subscriptions. All the subscriptions are associated to the same Azure Active Directory (Azure AD) tenant named contoso.com. You are a global administrator. You plan to create a report that lists all the resources across all the subscriptions. You need to ensure that you can view all the resources in all the subscriptions. What should you do?

A. From the Azure portal, modify the profile settings of your account.
B. From Windows PowerShell, run the Add-AzureADAdministrativeUnitMember cmdlet.
C. From Windows PowerShell, run the New-AzureADUserAppRoleAssignment cmdlet.
D. From the Azure portal, modify the properties of the Azure AD tenant.
Answer: C

Explanation: The New-AzureADUserAppRoleAssignment cmdlet assigns a user to an application role in Azure Active Directory (AD). Use it for the application report.

You have a Microsoft SQL Server Always On availability group on Azure virtual machines. You need to configure an Azure internal load balancer as a listener for the availability group. What should you do?

A. Enable Floating IP.
B. Set Session persistence to Client IP and protocol.
C. Set Session persistence to Client IP.
D. Create an HTTP health probe on port 1433.
Answer: A

You deploy an Azure Application Gateway. You need to ensure that all the traffic requesting https://adatum.com/internal resources is directed to an internal server pool and all the traffic requesting https://adatum.com/external resources is directed to an external server pool. What should you configure on the Application Gateway?

A. URL path-based routing
B. multi-site listeners
C. basic routing
D. SSL termination
Answer: A

URL Path Based Routing allows you to route traffic to back-end server pools based on URL Paths of the request. In the question there are two different path from where the traffic is getting generated as below https://adatum.com/internal https://adatum.com/external So in this case we can use URL path-based routing feature of Application Gateway.

You are building a custom Azure function app to connect to Azure Event Grid. You need to ensure that resources are allocated dynamically to the function app. Billing must be based on the executions of the app. What should you configure when you create the function app?

A. the Windows operating system and the Consumption plan hosting plan
B. the Windows operating system and the App Service plan hosting plan
C. the Docker container and an App Service plan that uses the Bl1 pricing tier
D. the Docker container and an App Service plan that uses the SI pricing
Answer: A

Explanation: Azure Functions runs in two different modes: Consumption plan and Azure App Service plan. The Consumption plan automatically allocates compute power when your code is running. Your app is scaled out when needed to handle load, and scaled down when code is not running. Incorrect Answers: B: When you run in an App Service plan, you must manage the scaling of your function app.

You have an Azure web app named App1 that streams video content to users. App1 is located in the East US Azure region. Users in North America stream the video content without any interruption. Users in Asia and Europe report that the video buffer often and do not play back smoothly. You need to recommend a solution to improve video streaming to the European and Asian users. What should you recommend?

A. Scale out the App Service plan.
B. Scale up the App Service plan.
C. Configure an Azure Content Delivery Network (CDN) endpoint.
D. Configure Azure File Sync.
Answer: C

A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs’ store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency. Azure Content Delivery Network (CDN) offers developers a global solution for rapidly delivering highbandwidth content to users by caching their content at strategically placed physical nodes across the world.

A web developer creates a web application that you plan to deploy as an Azure web app. Users must enter credentials to access the web application. You create a new web app named WebApp1 and deploy the web application to WebApp1. You need to disable anonymous access to WebApp1. What should you configure?

A. Access control (IAM)
B. Advanced Tools
C. Deployment credentials
D. Authentication/Authorization
Answer: D

Anonymous access is an authentication method. It allows users to establish an anonymous connection.

Your company has a main office in Australia and several branch offices in Asia. The company’s data center uses a VMware virtualization infrastructure to host several virtualized servers. You purchase an Azure subscription and plan to move all virtual machines to Azure to a resource group in the Australia Southeast location. You need to create an Azure Migrate migration project. Which geography should you select?

A. Central India
B. Australia Central
C. Australia Southeast
D. United States
Answer: C

In Project Details, specify the project name, and geography in which you want to create the project. Review supported geographies for public and government clouds.

You are configuring Azure Active Directory (AD) Privileged Identity Management. You need to provide a user named Admm1 with read access to a resource group named RG1 for only one month. The user role must be assigned immediately. What should you do?

A. Assign an active role.
B. Assign an eligible role.
C. Assign a permanently active role.
D. Create a custom role and a conditional access policy.
Answer: B

Explanation: Azure AD Privileged Identity Management introduces the concept of an eligible admin. Eligible admins should be users that need privileged access now and then, but not all-day, every day. The role is inactive until the user needs access, then they complete an activation process and become an active admin for a predetermined amount of time.

You have an Azure App Service plan named AdatumASP1 that hosts several Azure web apps. You discover that the web apps respond slowly. You need to provide additional memory and CPU resources to each instance of the web apps. What should you do?

A. Add continues WebJob that use the multi-instance scale
B. Scale out AdatumASP1
C. Add a virtual machine scale set
D. Scale up AdatumASP1
Answer: D

A. Yes
B. No
Answer: B

You plan to move a distributed on-premises app named App1 to an Azure subscription. After the planned move, App1 will be hosted on several Azure virtual machines. You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance. What should you create?

A. one virtual machine scale set that has 10 virtual machines instances
B. one Availability Set that has three fault domains and one update domain
C. one Availability Set that has 10 update domains and one fault domain
D. one virtual machine scale set that has 12 virtual machines instances
Answer: C

Explanation: An update domain is a logical group of underlying hardware that can undergo maintenance or be rebooted at the same time. As you create VMs within an availability set, the Azure platform automatically distributes your VMs across these update domains. This approach ensures that at least one instance of your application always remains running as the Azure platform undergoes periodic maintenance.

You deploy a load balancer that has the following configurations:

Name: LB1
Type internal
SKU: Standard
Virtual network VNET1
You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1. Does this meet the goal?

A. Yes
B. No
Answer: B

Explanation: A Backend Pool configured by IP address has the following limitations: Standard load balancer only

You deploy a load balancer that has the following configurations:

NameLB1
Type: internal
SKU: Standard
Virtual network: VNET1
You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You disassociate the public IP address from the network interface of VM2. Does this meet the goal?

A. Yes
B. No
Answer: B

You have an Azure subscription. You plan to deploy an Azure Kubernetes Services (AKS) cluster to support an app named APP1. Onpremises clients connect to App1 by using the IP address of the pod. For the AKS cluster, you need to choose a network type that will support App1. What should you choose?

A. Azure Private Link
B. Hybrid Connection endpoints
C. Kubened
D. Azure Container Networking Interface (CNI)
Answer: C

You have an Azure virtual machine named VM1. The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.) You deploy a web server on VM1, and then created a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only. You need to ensure that users can connect to the website from the internet. What should you do?

A. Modify the action of Rule1.
B. Change the priority of Rule6 to 100.
C. For Rule4, change the protocol from UDP to Any.
D./ For Rule5, change the Action to Allow and change the priority to 401.
Answer: D

A. Yes
B. No
Answer: A

Explanation: Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

A. Yes
B. No
Answer: A

You have an existing Azure subscription that contains 10 virtual machines. You need to monitor the latency between your on-premises network and the virtual machines. What should you use?

A. Service Map
B. Connection troubleshoot
C. Network Performance Monitor
D. Effective routes
Answer: C

Explanation: Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between various points in your network infrastructure. It also helps you monitor network connectivity to service and application endpoints and monitor the performance of Azure ExpressRoute. You can monitor network connectivity across cloud deployments and on-premises locations, multiple data centers, and branch offices and mission-critical multitier applications or microservices. With Performance Monitor, you can detect network issues before users complain.

A. Yes
B. No
Answer: B

Related Posts

Leave a Comment Cancel Reply