AZ 104 Exam

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a packet capture. Does this meet the goal? A. Yes B. No

Answer: A

You have a Microsoft SQL Server Always On availability group on Azure virtual machines. You need to configure an Azure internal load balancer as a listener for the availability group. What should you do? A. Enable Floating IP. B. Set Session persistence to Client IP and protocol. C. Set Session persistence to Client IP. D. Create an HTTP health probe on port 1433.

Answer: A

You have an on-premises network that contains a Hyper-V host named Host1. Host1 runs Windows Server 2016 and hosts 10 virtual machines that run Windows Server 2016. You plan to replicate the virtual machines to Azure by using Azure Site Recovery. You create a Recovery Services vault named ASR1 and a Hyper-V site named Site1. You need to add Host1 to ASR1. What should you do? A. Download the installation file for the Azure Site Recovery Provider. Download the vault registration key. Install the Azure Site Recovery Provider on Host1 and register the server. B. Download the installation file for the Azure Site Recovery Provider. Download the storage account key. Install the Azure Site Recovery Provider on Host1 and register the server. C. Download the installation file for the Azure Site Recovery Provider. Download the vault registration key. Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines. D. Download the installation file for the Azure Site Recovery Provider. Download the storage account key. Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.

Answer: A

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company registers a domain name of contoso.com. You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address. You need to resolve the name resolution issue. Solution: You modify the name servers at the domain registrar. Does this meet the goal? A. Yes B. No

Answer: A Explanation Modify the Name Server (NS) record.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1. A. Yes B. No

Answer: A Explanation With Traffic Manager Contributor role you can manage Traffic Manager profiles, do traffic analysis but does not let you control who has access to them.

You are troubleshooting a performance issue for an Azure Application Gateway. You need to compare the total requests to the failed requests during the past six hours. What should you use? A. Metrics in Application Gateway B. Diagnostics logs in Application Gateway C. NSG flow logs in Azure Network Watcher D. Connection monitor in Azure Network Watcher

Answer: A Explanation: Application Gateway currently has seven metrics to view performance counters. Metrics are a feature for certain Azure resources where you can view performance counters in the portal. For Application Gateway, the following metrics are available: Total Requests Failed Requests Current Connections Healthy Host Count Response Status Throughput

You are building a custom Azure function app to connect to Azure Event Grid. You need to ensure that resources are allocated dynamically to the function app. Billing must be based on the executions of the app. What should you configure when you create the function app? A. the Windows operating system and the Consumption plan hosting plan B. the Windows operating system and the App Service plan hosting plan C. the Docker container and an App Service plan that uses the Bl1 pricing tier D. the Docker container and an App Service plan that uses the SI pricing

Answer: A Explanation: Azure Functions runs in two different modes: Consumption plan and Azure App Service plan. The Consumption plan automatically allocates compute power when your code is running. Your app is scaled out when needed to handle load, and scaled down when code is not running. Incorrect Answers: B: When you run in an App Service plan, you must manage the scaling of your function app.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure web app named Appl. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier. You discover that App1 stops each day after running continuously for 60 minutes. You need to ensure that App1 can run continuously for the entire day. Solution: You change the pricing tier of Plan1 to Basic. Does this meet the goal? A. Yes B. No

Answer: A Explanation: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Network Contributor role at the subscription level to Admin1. Does this meet the goal? A. Yes B. No

Answer: A Explanation: Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Owner role at the subscription level to Admin1. Does this meet the goal? A. Yes B. No

Answer: A Explanation: Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Reader role at the subscription level to Admin1. Does this meet the goal? A. Yes B. No

Answer: A Explanation: Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

You have an Azure subscription. You enable multi-factor authentication for all users. Some users report that the email applications on their mobile device cannot connect to their Microsoft Exchange Online mailbox. The users can access Exchange Online by using a web browser and from Microsoft Outlook 2016 on their computer. You need to ensure that the users can use the email applications on their mobile device. What should you instruct the users to do? A. Create an app password B. Reset the Azure Active Directory (Azure AD) password C. Enable self-service password reset D. Reinstall the Microsoft Authenticator app

Answer: A If you're enabled for multi-factor authentication, make sure that you have set up app passwords. Note: During your initial two-factor verification registration process, you're provided with a single app password. If you require more than one, you'll have to create them yourself. Go to the Additional security verification page.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From Azure Cloud Shell, you run az aks. Does this meet the goal? A. Yes B. No

Answer: A Installing Azure CLI doesn't mean that Azure Kubernates client is installed. So before running kubectl client command, you have install kubectl, the Kubernetes command-line client. First need to run az aks install-cli to install Kubernetes CLI, which is kubectl

You have an Azure App Service plan named AdatumASP1 that uses the P2v2 pricing tier. AdatumASP1 hosts Ml Azure web app named adatumwebapp1. You need to delegate the management of adatumwebapp1 to a group named Devs. Devs must be able to perform the following tasks: • Add deployment slots. • View the configuration of AdatumASP1. • Modify the role assignment for adatumwebapp1. Which role should you assign to the Devs group? A. Owner B. Contributor C. Web Plan Contributor D. Website Contributor

Answer: A Owner : Correct Choice The Owner role lets you manage everything, including access to resources. Contributor : Incorrect Choice With contributor role you can Add deployment slots and View the configuration of App service plan but you can't Modify the role assignment. For this you need User Access Administrator or Owner role. So this is incorrect. Web Plan Contributor : Incorrect Choice The Web Plan Contributor role lets you manage the web plans for websites, but not access to them. So this option is incorrect. Website Contributor : Incorrect Choice The Website Contributor role lets you manage websites (not web plans), but not access to them. So this is incorrect option. Note: As per least privilege principle it is not advisable to provide owner role to any group, rather you should create custom RBAC role with custom policy and use that role for this operation. However as this option is not available here so only option to go with owner role.

You deploy an Azure Application Gateway. You need to ensure that all the traffic requesting https://adatum.com/internal resources is directed to an internal server pool and all the traffic requesting https://adatum.com/external resources is directed to an external server pool. What should you configure on the Application Gateway? A. URL path-based routing B. multi-site listeners C. basic routing D. SSL termination

Answer: A URL Path Based Routing allows you to route traffic to back-end server pools based on URL Paths of the request. In the question there are two different path from where the traffic is getting generated as below https://adatum.com/internal https://adatum.com/external So in this case we can use URL path-based routing feature of Application Gateway.

You sign up for Azure Active Directory (Azure AD) Premium. You need to add a user named [email protected] as an administrator on all the computers that will be joined to the Azure AD domain. What should you configure in Azure AD? A. Device settings from the Devices blade. B. General settings from the Groups blade. C. User settings from the Users blade. D. Providers from the MFA Server blade.

Answer: A When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local administrators group on the device: The Azure AD global administrator role The Azure AD device administrator role The user performing the Azure AD join In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page: 1. Sign in to your Azure portal as a global administrator or device administrator. 2. On the left navbar, click Azure Active Directory. 3. In the Manage section, click Devices. 4. On the Devices page, click Device settings. 5. To modify the device administrator role, configure Additional local administrators on Azure AD joined

You have an Azure subscription that contains three virtual networks named VNet1, VNet2, VNet3. VNet2 contains a virtual appliance named VM2 that operates as a router. You are configuring the virtual networks in a hub and spoke topology that uses VNet2 as the hub network. You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3. You need to provide connectivity between VNet1 and VNet3 through VNet2. Which two configurations should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. On the peering connections, allow forwarded traffic. B. On the peering connections, allow gateway transit. C. Create route tables and assign the table to subnets. D. Create a route filter.

Answer: AC Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway. The peered virtual network must have the Use remote gateways checkbox checked when setting up the peering from the other virtual network to this virtual network.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment. Does this meet the goal? A. Yes B. No

Answer: B

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier. You discover that App1 stops each day after running continuously for 60 minutes. You need to ensure that App1 can run continuously for the entire day. Solution: You add a continuous WebJob to App1. Does this meet the goal? A. Yes B. No

Answer: B

You deploy a load balancer that has the following configurations: • NameLB1 • Type: internal • SKU: Standard • Virtual network: VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You disassociate the public IP address from the network interface of VM2. Does this meet the goal? A. Yes B. No

Answer: B

Your company registers a domain name of contoso.com. You create an Azure DNS named contoso.com and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address. You need to resolve the name resolution issue. Solution: You modify the name server at the domain registrar. Does this meet the goal? A. Yes B. No

Answer: B

You have a service deployed to a Kubernetes cluster. Another application needs to access the service via the private IP address of the pod. Which of the following would you define as the networking type for the cluster to meet this requirement? A. Kubenet B. Azure container networking plugin C. Service Endpoints D. Network security groups

Answer: B Azure container networking plugin : Correct Choice With the Azure container networking plugin , every pod gets an IP address allocated. With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space, and must be planned in advance. Each node has a configuration parameter for the maximum number of pods that it supports. The equivalent number of IP addresses per node are then reserved up front for that node. This approach requires more planning, as can otherwise lead to IP address exhaustion or the need to rebuild clusters in a larger subnet as your application demands grow.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company registers a domain name of contoso.com. You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address. You need to resolve the name resolution issue. Solution: You add an NS record to the contoso.com Azure DNS zone. A. Yes B. No

Answer: B Before you can delegate your DNS zone to Azure DNS, you need to know the name servers for your zone. The NS record set contains the names of the Azure DNS name servers assigned to the zone.

You are the global administrator for an Azure Active Directory (Azure AD) tenant named adatum.com. You need to enable two-step verification for Azure users. What should you do? A. Configure a playbook in Azure AD conditional access policy. B. Create an Azure AD conditional access policy. C. Create and configure the Identify Hub. D. Install and configure Azure AD Connect.

Answer: B Conditional Access policies enforce registration, requiring unregistered users to complete registration at first sign-in, an important security consideration.

You configure Azure AD Connect for Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) for an on-premises network. Users report that when they attempt to access myapps.microsoft.com, they are prompted multiple times to sign in and are forced to use an account name that ends with onmicrosoft.com. You discover that there is a UPN mismatch between Azure AD and the on-premises Active Directory. You need to ensure that the users can use single-sign on (SSO) to access Azure resources. What should you do first? A. From the on-premises network, deploy Active Directory Federation Services (AD FS). B. From Azure AD, add and verify a custom domain name. C. From the on-premises network, request a new certificate that contains the Active Directory domain name. D. From the server that runs Azure AD Connect, modify the filtering options.

Answer: B Explanation: Azure AD Connect lists the UPN suffixes that are defined for the domains and tries to match them with a custom domain in Azure AD. Then it helps you with the appropriate action that needs to be taken. The Azure AD sign-in page lists the UPN suffixes that are defined for on-premises Active Directory and displays the corresponding status against each suffix. The status values can be one of the following: State: Verified Azure AD Connect found a matching verified domain in Azure AD. All users for this domain can sign in Questions & Answers PDF P-349 www.dumpskey.com by using their on-premises credentials. State: Not verified Azure AD Connect found a matching custom domain in Azure AD, but it isn't verified. The UPN suffix of the users of this domain will be changed to the default .onmicrosoft.com suffix after synchronization if the domain isn't verified. Action Required: Verify the custom domain in Azure AD.

You are configuring Azure Active Directory (AD) Privileged Identity Management. You need to provide a user named Admm1 with read access to a resource group named RG1 for only one month. The user role must be assigned immediately. What should you do? A. Assign an active role. B. Assign an eligible role. C. Assign a permanently active role. D. Create a custom role and a conditional access policy.

Answer: B Explanation: Azure AD Privileged Identity Management introduces the concept of an eligible admin. Eligible admins should be users that need privileged access now and then, but not all-day, every day. The role is inactive until the user needs access, then they complete an activation process and become an active admin for a predetermined amount of time.

You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data? A. Azure SQL Database B. Azure File Storage C. An Azure Cosmos DB database D. The Azure File Sync Storage Sync Service E. Azure Data Factory F. A virtual machine

Answer: B Explanation: Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter.

You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data? A. an Azure Cosmos DB database B. Azure File Storage C. the Azure File Sync Storage Sync Service D. Azure Data Factory

Answer: B Explanation: Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter. The maximum size of an Azure Files Resource of a file share is 5 TB.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to these questions will not appear m the review screen. You manage a virtual network named VNetl1 that is hosted in the West US Azure region. VNetl1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a packet capture. Does this meet the goal? A. Yes B. No

Answer: B Explanation: Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. Capture packets to and from a VM Advanced filtering options and fine-tuned controls, such as the ability to set time and size limitations, provide versatility. The capture can be stored in Azure Storage, on the VM's disk, or both. You can then analyze the capture file using several standard network capture analysis tools.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System log on VM1 within an hour. Solution: You create an Azure Log Analytics workspace and configure the data settings. You add an extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source. Does this meet the goal? A. Yes B. No

Answer: B Explanation: Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source. Does this meet the goal? A. Yes B. No

Answer: B Explanation: Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company registers a domain name of contoso.com. You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address. You need to resolve the name resolution issue. Solution: You create a PTR record for www in the contoso.com zone. Does this meet the goal? A. Yes B. No

Answer: B Explanation: Modify the Name Server (NS) record. A NS record would be created automatically and you cannot modify it (but you can add to it to support co-hosting domains). You can add additional name servers to this NS record set, to support co-hosting domains with more than one DNS provider. You can also modify the TTL and metadata for this record set. However, you cannot remove or modify the pre-populated Azure DNS name servers.

You have an Azure tenant that contains two subscriptions named Subscription1 and Subscription2. In Subscription1, you deploy a virtual machine named Server1 that runs Windows Server 2016. Server1 uses managed disks. You need to move Server1 to Subscription2. The solution must minimize administration effort. What should you do first? A. In Subscription2, create a copy of the virtual disk. B. From Azure PowerShell, run the Move-AzureRmResource cmdlet. C. Create a snapshot of the virtual disk. D. Create a new virtual machine in Subscription2.

Answer: B Explanation: To move existing resources to another resource group or subscription, use the MoveAzureRmResource cmdlet.

Note: This question is part of a series of questions that present the same scenario goals. Some question sets might have more than one correct solution, while others ion in the series contains a unique solution that might meet the stated not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure web app named Appl. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier. You discover that App1 stops each day after running continuously for 60 minutes. You need to ensure that App1 can run continuously for the entire day. Solution: You add a triggered WebJob to App1. Does this meet the goal? A. Yes B. No

Answer: B Explanation: You need to change to Basic pricing Tier. Note: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap.

You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do? A. Create an PTR record named research in the adatum.com zone. B. Create an NS record named research in the adatum.com zone. C. Modify the SOA record of adatum.com. D. Create an A record named ".research in the adatum.com zone.

Answer: B Explanation: You need to create a name server (NS) record for the zone.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Monitor, you create a metric on Network in and Network Out. Does this meet the goal? A. Yes B. No

Answer: B Explanation: You should use Azure Network Watcher.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Performance Monitor, you create a Data Collector Set (DCS). Does this meet the goal? A. Yes B. No

Answer: B Explanation: You should use Azure Network Watcher.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company registers a domain name of contoso.com. You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address. You need to resolve the name resolution issue. Solution: You modify the SOA record in the contoso.com zone. A. Yes B. No

Answer: B Modify the NS record, not the SOA record. Note: The SOA record stores information about the name of the server that supplied the data for the zone; the administrator of the zone; the current version of the data file; the number of seconds a secondary name server should wait before checking for updates; the number of seconds a secondary name server should wait before retrying a failed zone transfer; the maximum number of seconds that a secondary name server can use data before it must either be refreshed or expire; and a default number of seconds for the time-to live file on resource records.

Note This question is part of a series of questions that present the same seer Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Performance Monitor, you create a Data Collector Set (DCS) Does this meet the goal? A. Yes B. No

Answer: B Network performance monitor allows you to monitor connectivity and latencies across hybrid network architectures, Expressroute circuits, and service/application endpoints. With an data collector set we can count specified network traffic, but we cannot inspect it. For this we would need a network watcher Packet Capture.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a connection monitor. Does this meet the goal? A. Yes B. No

Answer: B Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a connection monitor. Does this meet the goal? A. Yes B. No

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers. Does this meet the goal? A. Yes B. No

Answer: B Through activity logs, you can determine: § what operations were taken on the resources in your subscription § who started the operation § when the operation occurred § the status of the operation § the values of other properties that might help you research the operation -- question 270

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: A virtual network that has a subnet named Subnet1 Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: Priority: 100 Source: Any Source port range: * Destination: * Destination port range: 3389 Protocol: UDP Action: Allow VM1 connects to Subnet1. NSG1-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1. You need to be able to establish Remote Desktop connections from the internet to VM1. Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol. Does this meet the goal? A. Yes B. No

Answer: B The default port for RDP is TCP port 3389 not UDP. NSGs deny all inbound traffic except from virtual network or load balancers. For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, and then the rules in a network security group associated to the network interface. By default NSG rule to allow traffic through RDP port 3389 is not created automatically during the creation of VM , unless you change the setting during creation. Here in the solution UDP traffic is allowed at virtual network level which is not tcp/rdp protocol. So this will not work to achieve the goal.

You have an Azure Kubernetes cluster in place. You have to deploy an application using an Azure Container registry image. Which of the following command can be used for this requirement? A. az kubernetes deploy B. kubectl apply C. New-AzKubernetes set D. docker run

Answer: B kubectl apply : Correct Choice The kubectl command can be used to deploy applications to a Kubernetes cluster. az kubernetes deploy : Incorrect Choice This command is used to manage Azure Kubernetes Services. This is not used to deploy applications to a Kubernetes cluster. New-AzKubernetes set : Incorrect Choice This command is used to create a new managed Kubernetes cluster. This is not used to deploy applications to a Kubernetes cluster. docker run : Incorrect Choice This is run command in a new container. This is not used to deploy applications to a Kubernetes cluster

You have an Azure Active Directory (Azure AD) tenant. All administrators must enter a verification code to access the Azure portal. You need to ensure that the administrators can access the Azure portal only from your on-premises network. What should you configure? A. an Azure AD Identity Protection user risk policy. B. the multi-factor authentication service settings. C. the default for all the roles in Azure AD Privileged Identity Management D. an Azure AD Identity Protection sign-in risk policy

Answer: B the multi-factor authentication service settings - Correct choice There are two criterias mentioned in the question. 1. MFA required 2. Access from only a specific geographic region/IP range. To satisfy both the requirements you need MFA with location conditional access. Please note to achieve this configuration you need to have AD Premium account for Conditional Access policy. Navigate to Active Directory --> Security --> Conditional Access --> Named Location. Here you can create a policy with location (on-premise IP range) and enable MFA. This will satisfy the requirements.

You deploy a load balancer that has the following configurations: • Name: LB1 • Type internal • SKU: Standard • Virtual network VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1. Does this meet the goal? A. Yes B. No

Answer: B Explanation: A Backend Pool configured by IP address has the following limitations: Standard load balancer only

You are deploying a containerized web application in Azure. When deploying the web app, which of the following are valid container image sources? A. Virtual machine B. Docker hub C. ACR D. On-premises

Answer: BC When you create a web app from a Docker image, you configure the following properties: · The registry that contains the image. The registry can be Docker Hub, Azure Container Registry (ACR), or some other private registry. · The image :This item is the name of the repository. · The tag : This item indicates which version of the image to use from the repository. By convention, the most recent version is given the tag latest when it's built. · Startup File :This item is the name of an executable file or a command to be run when the image is loaded. It's equivalent to the command that you can supply to Docker when running an image from the command line by using docker run. If you're deploying a ready-to-run, containerized app that already has the ENTRYPOINT and/or COMMAND values configured, you don't need to fill this in.

Your VMware vSphere on-premises infrastructure hosts 600 virtual machines (VMs). Your company is planning to move all of these VMs to Azure. You are asked to provide information about the resources that will be needed in Azure to host all of the VMs. All VMs hosted in your on-premise infrastructure are based on Windows Server 2012 R2 or newer and RedHat Enterprise Linux 7.0 or newer. You conduct the initial migration assessment and get a message that some virtual machines are conditionally ready for Azure. You need to find the cause of this message. What are two reasons why are you might get this message on some VMs? (Choose two) Each correct answer presents part of the solution. A. The vCenter user does not have enough permissions on affected VMs. B. The operating system is configured as Windows Server 2003 in vCenter Server. C. The operating system is configured as Others in vCenter Server. D. The VMs are configured with the BIOS boot type. E. The VMs are configured with the UEFI boot type.

Answer: BE To prepare for VMware VM assessment, you need to: Verify VMware settings. Make sure that the vCenter Server and VMs you want to migrate meet requirements. Set up permissions for assessment. Azure Migrate uses a vCenter account to access the vCenter Server, to discover and assess VMs. Verify appliance requirements. Verify deployment requirements for the Azure Migrate appliance, before you deploy it in the next tutorial.

You have an Azure subscription. You activate Enterprise Mobility + Security E5 licenses for all users. You need the users to request approval before they can create virtual machines. What should you configure first? A. Azure Active Directory (Azure AD) conditional access policies B. Azure Active Directory (Azure AD) Authentication methods C. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure resource roles D. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure AD directory roles

Answer: C

You have an Azure subscription. You plan to deploy an Azure Kubernetes Services (AKS) cluster to support an app named APP1. Onpremises clients connect to App1 by using the IP address of the pod. For the AKS cluster, you need to choose a network type that will support App1. What should you choose? A. Azure Private Link B. Hybrid Connection endpoints C. Kubened D. Azure Container Networking Interface (CNI)

Answer: C

You have an Azure web app named webapp1. You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1. You need to ensure that webapp1 can access the data hosted on VM1. What should you do? A. Connect webapp1 to VNET1. B. Peer VNET1 to another virtual network. C. Deploy an Azure Application Gateway. D. Deploy an internal load balancer

Answer: C

You have an Azure web app named App1 that streams video content to users. App1 is located in the East US Azure region. Users in North America stream the video content without any interruption. Users in Asia and Europe report that the video buffer often and do not play back smoothly. You need to recommend a solution to improve video streaming to the European and Asian users. What should you recommend? A. Scale out the App Service plan. B. Scale up the App Service plan. C. Configure an Azure Content Delivery Network (CDN) endpoint. D. Configure Azure File Sync.

Answer: C A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs' store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency. Azure Content Delivery Network (CDN) offers developers a global solution for rapidly delivering highbandwidth content to users by caching their content at strategically placed physical nodes across the world.

You have a resource group named RG1. RG1 contains an Azure Storage account named storageaccount1 and a virtual machine named VM1 that runs Windows Server 2016. Storageaccount1 contains the disk files for VM1. You apply a ReadOnly lock to RG1. What can you do from the Azure portal? A. Generate an automation script for RG1. B. View the keys of storageaccount1. C. Upload a blob to storageaccount1. D. Start VM1.

Answer: C Applying locks can lead to unexpected results because some operations that don't seem to modify the resource actually require actions that are blocked by the lock. Locks are inherited to all of its resources if it applies on resource group level. Upload a blob to storageaccount1 is possible if we have readonly lock on RG1 since we are trying to modify the data not resource properties. When a R/O lock is put on a resource, you lock it's properties not the resource. So while a read only lock is present on a storage account(inherited from a resource group), a file can still be uploaded to the already existing container of a storage account. Incorrect Answers: Generate an automation script for RG1 is NOT possible in read only mode. A read-only lock on a storage account prevents all users from listing the keys. The list keys operation is handled through a POST request because the returned keys are available for write operations. When we tried to read the Access Key of the Storage Account , get the below message. Access blocked The resource is locked Cannot access the data plane because of a read lock on the resource or its parent. A read-only lock on a resource group that contains a virtual machine prevents all users from starting or restarting the virtual machine. These operations require a POST request.

You have an Azure virtual machine named VM1 that runs Windows Server 2019. You sign in to VM1 as a user named User 1 and perform the following actions: * Create files on drive C. * Create files on drive D. * Modify the screen saver timeout. * Change the desktop background. You plan to redeploy VM1. Which changes will be lost after you redeploy VM1? A. the modified screen saver timeout B. the new desktop background C. the new files on drive D D. The new files on drive C

Answer: C As D drive is temporary storage so new files on D drive will be lost. The screensaver, wall paper, new files on C drive are available after Redeploy.

You plan to move a distributed on-premises app named App1 to an Azure subscription. After the planned move, App1 will be hosted on several Azure virtual machines. You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance. What should you create? A. one virtual machine scale set that has 10 virtual machines instances B. one Availability Set that has three fault domains and one update domain C. one Availability Set that has 10 update domains and one fault domain D. one virtual machine scale set that has 12 virtual machines instances

Answer: C Explanation: An update domain is a logical group of underlying hardware that can undergo maintenance or be rebooted at the same time. As you create VMs within an availability set, the Azure platform automatically distributes your VMs across these update domains. This approach ensures that at least one instance of your application always remains running as the Azure platform undergoes periodic maintenance.

You have an existing Azure subscription that contains 10 virtual machines. You need to monitor the latency between your on-premises network and the virtual machines. What should you use? A. Service Map B. Connection troubleshoot C. Network Performance Monitor D. Effective routes

Answer: C Explanation: Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between various points in your network infrastructure. It also helps you monitor network connectivity to service and application endpoints and monitor the performance of Azure ExpressRoute. You can monitor network connectivity across cloud deployments and on-premises locations, multiple data centers, and branch offices and mission-critical multitier applications or microservices. With Performance Monitor, you can detect network issues before users complain.

You have 100 Azure subscriptions. All the subscriptions are associated to the same Azure Active Directory (Azure AD) tenant named contoso.com. You are a global administrator. You plan to create a report that lists all the resources across all the subscriptions. You need to ensure that you can view all the resources in all the subscriptions. What should you do? A. From the Azure portal, modify the profile settings of your account. B. From Windows PowerShell, run the Add-AzureADAdministrativeUnitMember cmdlet. C. From Windows PowerShell, run the New-AzureADUserAppRoleAssignment cmdlet. D. From the Azure portal, modify the properties of the Azure AD tenant.

Answer: C Explanation: The New-AzureADUserAppRoleAssignment cmdlet assigns a user to an application role in Azure Active Directory (AD). Use it for the application report.

Your company has a main office in Australia and several branch offices in Asia. The company's data center uses a VMware virtualization infrastructure to host several virtualized servers. You purchase an Azure subscription and plan to move all virtual machines to Azure to a resource group in the Australia Southeast location. You need to create an Azure Migrate migration project. Which geography should you select? A. Central India B. Australia Central C. Australia Southeast D. United States

Answer: C In Project Details, specify the project name, and geography in which you want to create the project. Review supported geographies for public and government clouds.

You have an Azure App Service plan named AdatumASP1 that hosts several Azure web apps. You discover that the web apps respond slowly. You need to provide additional memory and CPU resources to each instance of the web apps. What should you do? A. Add continues WebJob that use the multi-instance scale B. Scale out AdatumASP1 C. Add a virtual machine scale set D. Scale up AdatumASP1

Answer: D

You have an Azure virtual machine named VM1. The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.) You deploy a web server on VM1, and then created a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only. You need to ensure that users can connect to the website from the internet. What should you do? A. Modify the action of Rule1. B. Change the priority of Rule6 to 100. C. For Rule4, change the protocol from UDP to Any. D./ For Rule5, change the Action to Allow and change the priority to 401.

Answer: D

A web developer creates a web application that you plan to deploy as an Azure web app. Users must enter credentials to access the web application. You create a new web app named WebApp1 and deploy the web application to WebApp1. You need to disable anonymous access to WebApp1. What should you configure? A. Access control (IAM) B. Advanced Tools C. Deployment credentials D. Authentication/Authorization

Answer: D Anonymous access is an authentication method. It allows users to establish an anonymous connection.

You have an Active Directory forest named contoso.com. You install and configure Azure AD Connect to use password hash synchronization as the single signon (SSO) method. Staging mode is enabled. You review the synchronization results and discover that the Synchronization Service Manager does not display any sync jobs. You need to ensure that the synchronization completes successfully. What should you do? A. From Synchronization Service Manager, run a full import. B. Run Azure AD Connect and set the SSO method to Pass-through Authentication. C. From Azure PowerShell, run Start-AdSyncSyncCycle -PolicyType Initial. D. Run Azure AD Connect and disable staging mode.

Answer: D Explanation: Staging mode must be disabled. If the Azure AD Connect server is in staging mode, password hash synchronization is temporarily disabled.

You have an Azure resource manager template that will be used to deploy 10 Azure Web Apps. You have to ensure to deploy the pre-requisites before the deployment of the template. You have to minimize the costs associated with the implementation. Which of the following would you deploy as pre-requisites? A. An Azure Load Balancer B. An Application Gateway C. 10 Azure App Service Plans D. One App Service Plan

Answer: D In App Service (Web Apps, API Apps, or Mobile Apps), an app always runs in an App Service plan. An App Service plan defines a set of compute resources for a web app to run. One App Service Plan : Correct Choice

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. You hire a temporary vendor. The vendor uses a Microsoft account that has a sign-in of [email protected]. You need to ensure that the vendor can authenticate to the tenant by using [email protected]. What should you do? A. From Windows PowerShell, run the New-AzureADUser cmdlet and specify the - UserPrincipalName [email protected] parameter. B. From the Azure portal, add a custom domain name, create a new Azure AD user, and then specify [email protected] as the username. C. From Azure Cloud Shell, run the New-AzureADUser cmdlet and specify the -UserPrincipalName [email protected] parameter. D. From the Azure portal, add a new guest user, and then specify [email protected] as the email address.

Answer: D UserPrincipalName - contains the UserPrincipalName (UPN) of this user. The UPN is what the user will use when they sign in into Azure AD. The common structure is @, so for Abby Brown in Contoso.com, the UPN would be [email protected] Example: To create the user, call the New-AzureADUser cmdlet with the parameter values: powershell New-AzureADUser -AccountEnabled $True -DisplayName "Abby Brown" - PasswordProfile$PasswordProfile -MailNickName "AbbyB" -UserPrincipalName "[email protected]"

You have an Azure Service Bus. You need to implement a Service Bus queue that guarantees first in first-out (FIFO) delivery of messages. What should you do? A. Set the Lock Duration setting to 10 seconds. B. Enable duplicate detection. C. Set the Max Size setting of the queue to 5 GB. D. Enable partitioning. E. Enable sessions.

Answer: E Explanation: Through the use of messaging sessions you can guarantee ordering of messages, that is first-in-firstout (FIFO) delivery of messages.

You have an Azure subscription that contains 100 virtual machines. You regularly create and delete virtual machines. You need to identify unattached disks that can be deleted. What should you do? A. From Microsoft Azure Storage Explorer, view the Account Management properties. B. From Azure Cost Management, create a Cost Management report. C. From the Azure portal, configure the Advisor recommendations.

Answer: A Explanation You can find unused disks in the Azure Storage Explorer console.Once you drill down to the Blob containers under a storage account, you can see the lease state of the residing VHD (the lease state determines if the VHD is being used by any resource) and the VM to which it is leased out. If you find that the lease state and the VM fields are blank, it means that the VHD in question is unused. The screenshot below shows two active VHDs being used by VMs as data and OS disks. The name of the VM and lease state are shown in the "VM Name" and "Lease State" columns, respectively.

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure? A. Floating IP (direct server return) to Enabled B. Idle Time-out (minutes) to 20 C. Protocol to UDP D. Session persistence to Client IP and Protocol

Answer: D With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure Load-Balancer For Sticky Sessions set Session persistence to Client IP or to Client IP and protocol. On the following image you can see sticky session configuration: Note: § Client IP and protocol specifies that successive requests from the same client IP address and protocol combination will be handled by the same virtual machine. § Client IP specifies that successive requests from the same client IP address will be handled by the same virtual machine

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-ofbusiness application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1: Change the size to D8s v3. Add a 500-GB managed disk. Add the Puppet Agent extension. Attach an additional network interface. Which change will cause downtime for VM1? A. Add a 500-GB managed disk. B. Attach an additional network interface. C. Add the Puppet Agent extension. D. Change the size to D8s v3.

Answer: D Explanation: While resizing the VM it must be in a stopped state.

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles; • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do? A. Assign User1 the Contributor role for VNet1. B. Remove User from the Security Reader and Reader roles tot Subscription1. C. Assign User1 the Network Contributor role for VNet1. D. Assign User1 the User Access Administrator role for VNet1

Answer: D The User Access Administrator role allows you to manage user access to Azure resources.

You have a deployment template named Template1 that is used to deploy 10 Azure web apps. You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs. What should you identify? A. 10 App Service plans B. one Azure Traffic Manager C. five Azure Application Gateways D. one App Service plan E. one Azure Application Gateway

Answer: D You create Azure web apps in an App Service plan.

You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible. What should you do? A. Deploy five virtual machines. Modify the Size setting for each virtual machine. B. Deploy live virtual machines. Modify the Availability Zones setting for each virtual machine. C. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode. D. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.

Answer: B

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant contains 500 user accounts. You deploy Microsoft Office 365. You configure Office 365 to use the user accounts in adatum.com. You configure 60 users to connect to mailboxes in Microsoft Exchange Online. You need to ensure that the 60 users use Azure Multi-Factor Authentication (MFA) to connect to the Exchange Online mailboxes. The solution must only affect connections to the Exchange Online mailboxes. What should you do? A. From the multi-factor authentication page, configure the Multi-Factor Auth status for each user B. From Azure Active Directory admin center, create a conditional access policy C. From the multi-factor authentication page, modify the verification options D. From the Azure Active Directory admin center, configure an authentication method

Answer: A

You have an Azure subscription that contains an Azure Storage account. You plan to create an Azure container instance named container1 that will use a Docker image namedImage1. Image1 contains a Microsoft SQL Server instance that requires persistent storage. You need to configure a storage service for Container1. What should you use? A. Azure Files B. Azure Blob storage C. Azure Queue storage D. Azure Table storage

Answer: A Explanation: Microsoft have Docker Volume Plugin for Azure file storage which provides exactly this and it is used for Azure file shares. Azure File Storage volume plugin is not limited to ease of container migration. It also allows a file share to be shared among multiple containers (even though they are on different hosts) to collaborate on workloads, share configuration or secrets of an application running on multiple hosts. Another use case is uploading metrics and diagnostics data such as logs from applications to a file share for further processing.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the RG1 blade, you click Deployments. Does this meet the goal? A. Yes B. No

Answer: A Explanation: 1. Select the resource group (Here RG1) you want to examine. 2. Select the link under Deployments. 3. Select one of the deployments from the deployment history. 4. You will see a history of deployment for the resource group, including the correlation ID.

You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines. You need to delete the Recovery Services vault. What should you do first? A. From the Recovery Service vault, stop the backup of each backup item. B. From the Recovery Service vault, delete the backup data. C. Modify the disaster recovery properties of each virtual machine. D. Modify the locks of each virtual machine.

Answer: A Explanation: You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can't, the vault is still configured to receive backup data. Remove vault dependencies and delete vault In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In this menu, you can stop and delete Azure File Servers, SQL Servers in Azure VM, and Azure virtual machines.

You have an Azure Active Directory (Azure AD) tenant named Tenant1 and an Azure subscription named You enable Azure AD Privileged Identity Management. You need to secure the members of the Lab Creator role. The solution must ensure that the lab creators request access when they create labs. What should you do first? A. From Azure AD Privileged Identity Management, edit the role settings for Lab Creator. B. From Subscription1 edit the members of the Lab Creator role. C. From Azure AD Identity Protection, creates a user risk policy. D. From Azure AD Privileged Identity Management, discover the Azure resources of Conscription.

Answer: A Explanation: As a Privileged Role Administrator you can: Enable approval for specific roles Specify approver users and/or groups to approve requests View request and approval history for all privileged roles

You have an Azure Active Directory (Azure AD) domain that contains 5,000 user accounts. You create a new user account named AdminUser1. You need to assign the User administrator administrative role to AdminUser1. What should you do from the user account properties? A. From the Directory role blade, modify the directory role. B. From the Groups blade, invite the user account to a new group. C. From the Licenses blade, assign a new license.

Answer: A Explanation: Assign a role to a user Sign in to the Azure portal with an account that's a global admin or privileged role admin for the directory. Select Azure Active Directory, select Users, and then select a specific user from the list. For the selected user, select Directory role, select Add role, and then pick the appropriate admin roles from the Directory roles list, such as Conditional access administrator. Press Select to save.

You have an Azure App Service plan that hosts an Azure App Service named App1. You configure one production slot and four staging slots for App1. You need to allocate 10 percent of the traffic to each staging slot and 60 percent of the traffic to the production slot. What should you add to Appl1? A. slots to the Testing in production blade B. a performance test C. a WebJob D. templates to the Automation script blade

Answer: A Explanation: Besides swapping, deployment slots offer another killer feature: testing in production. Just like the name suggests, using this, you can actually test in production. This means that you can route a specific percentage of user traffic to one or more of your deployment slots.

Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains a datacenter. You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered. You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters. What should you create? A. three virtual WANs and one virtual hub B. three virtual hubs and one virtual WAN C. three On-premises data gateways and one Azure Application Gateway D. three Azure Application Gateways and one On-premises data gateway

Answer: A Virtual WAN offers the following advantages: Integrated connectivity solutions in hub and spoke: Automate site-to-site configuration and connectivity between on-premises sites and an Azure hub. Automated spoke setup and configuration: Connect your virtual networks and workloads to the Azure hub seamlessly. Intuitive troubleshooting: You can see the end-to-end flow within Azure, and then use this information to take required actions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You configure a custom policy definition, and then you assign the policy to the subscription. Does this meet the goal? A. Yes B. No

Answer: A Explanation: Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources.

You create an Azure subscription that is associated to a basic Azure Active Directory (Azure AD) tenant. You need to receive an email notification when any user activates an administrative role. What should you do? A. Purchase Azure AD Premium 92 and configure Azure AD Privileged Identity Management, B. Purchase Enterprise Mobility + Security E3 and configure conditional access policies. C. Purchase Enterprise Mobility + Security E5 and create a custom alert rule in Azure Security Center. D. Purchase Azure AD Premium PI and enable Azure AD Identity Protection.

Answer: A Explanation: When key events occur in Azure AD Privileged Identity Management (PIM), email notifications are sent. For example, PIM sends emails for the following events: When a privileged role activation is pending approval When a privileged role activation request is completed When a privileged role is activated When a privileged role is assigned When Azure AD PIM is enabled

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the Redeploy blade, you click Redeploy. Does this meet the goal? A. Yes B. No

Answer: A Explanation: When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then powers it back on, retaining all your configuration options and associated resources.

You are the global administrator for an Azure Active Directory (Azure AD) tenet named adatum.com. You need to enable two-step verification for Azure users. What should you do? A. Create a sign-in risk policy in Azure AD Identity Protection B. Enable Azure AD Privileged Identity Management. C. Create and configure the Identity Hub. D. Configure a security policy in Azure Security Center

Answer: A Identity Protection analyzes signals from each sign-in, both real-time and offline, and calculates a risk score based on the probability that the sign-in wasn't performed by the user. Administrators can make a decision based on this risk score signal to enforce organizational requirements. Administrators can choose to block access, allow access, or allow access but require multi-factor authentication. If risk is detected, users can perform multi-factor authentication to self-remediate and close the risky sign-in event to prevent unnecessary noise for administrators. With Azure Active Directory Identity Protection, you can: require users to register for multi-factor authentication handle risky sign-ins and compromised users

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From the Azure CLI, you run the kubectl client. Does this meet the goal? A. Yes B. No

Answer: A Installing Azure CLI doesn't mean that Azure Kubernates client is installed. So before running kubectl client command, you have install kubectl, the Kubernetes command-line client. First need to run az aks install-cli to install Kubernetes CLI, which is kubectl

You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use? A. a Desired State Configuration (DSC) extension B. thePublish-AzVMDscConfigurationCmdlet C. a Microsoft Intune device configuration profile D. Deployment Center in Azure App Service

Answer: A The primary use case for the Azure Desired State Configuration (DSC) extension is to bootstrap a VM to the Azure Automation State Configuration (DSC) service. The service provides benefits that include ongoing management of the VM configuration and integration with other operational tools, such as Azure Monitoring. Using the extension to register VM's to the service provides a flexible solution that even works across Azure subscriptions. You can use the DSC extension independently of the Automation DSC service.

You have an Azure web app named webapp1. Users report that they often experience HTTP 500 errors when they connect to webapp1. You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details. What should you do first? A. From webapp1, enable Web server logging B. From Azure Monitor, create a workbook C. From Azure Monitor, create a Service Health alert D. From webapp1, turn on Application Logging

Answer: A To resolve this you need to catch connection error. When the connection fails for webapp, it happens on web server, not within application. You can find out the web server log by below steps: Open the web application --> Go to Application Service logs --> Go to Web server logging (there are multiple switches there) You can also see the errors live going to "Log stream" pane. To ensure that you will get web server log, you have to enable it.

You have an Azure subscription named Subscription1. You deploy a Linux virtual machine named VM1 to Subscription1. You need to monitor the metrics and the logs of VM1. What should you use? A. Linux Diagnostic Extension (LAD) 3.0 B. Azure Analysis Services C. the AzurePerformanceDiagnostics extension D. Azure HDInsight

Answer: A You can use extensions to configure diagnostics on your VMs to collect additional metric data. The basic host metrics are available, but to see more granular and VM-specific metrics, you need to install the Azure diagnostics extension on the VM. The Azure diagnostics extension allows additional monitoring and diagnostics data to be retrieved from the VM.

You have an Azure subscription that contains a storage account named account1. You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24. You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You need to configure account1 to meet the following requirements: Ensure that you can upload the disk files to account1. Ensure that you can attach the disks to VM1. Prevent all other access to account1. Which two actions should you perform? Each correct selection presents part of the solution. NOTE: Each correct selection is worth one point. A. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range. B. From the Firewalls and virtual networks blade of account1, select Selected networks. C. From the Firewalls and virtual networks blade of acount1, add VNet1. D. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to access this storage account. E. From the Service endpoints blade of VNet1, add a service endpoint.

Answer: AB By default, storage accounts accept connections from clients on any network. To limit access to selected networks, you must first change the default action. Azure portal 1. Navigate to the storage account you want to secure. 2. Click on the settings menu called Firewalls and virtual networks. 3. To deny access by default, choose to allow access from 'Selected networks'. To allow traffic from all networks, choose to allow access from 'All networks'. 4. Click Save to apply your changes. Grant access from a Virtual Network Storage accounts can be configured to allow access only from specific Azure Virtual Networks. By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an optimal route to the Azure Storage service. The identities of the virtual network and the subnet are also transmitted with each request.

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute. You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. Create a local site VPN gateway. B. Create a VPN gateway that uses the VpnGw1 SKU. C. Create a VPN gateway that uses the Basic SKU. D. Create a gateway subnet. E. Create a connection.

Answer: ABE Create a Connection: You need to link the ExpressRoute gateway to the ExpressRoute circuit. After this step has been completed, the connection between your on-premises network and Azure through ExpressRoute will be established. Hence this is correct option. Create a local site VPN gateway : This will allow you to provide the local gateway settings, for example public IP and the on-premises address space, so that the Azure VPN gateway can connect to it. Hence this is correct option. Create a VPN gateway that uses the VpnGw1 SKU : The GatewaySku is only supported for VpnGw1, VpnGw2, VpnGw3, Standard, and HighPerformance VPN gateways. ExpressRoute-VPN Gateway coexist configurations are not supported on the Basic SKU. The VpnType must be RouteBased. Hence this is correct option.

You have an azure subscription named Subscription that contains the resource groups shown in the following table. RG1 - East Asia RG2 - East US In RG1, you create a virtual machine named VM1 in the East Asia location. You plan to create a virtual network named VNET1. You need to create VNET, and then connect VM1 to VNET1. What are two possible ways to achieve this goal? Each correct answer presents a complete a solution. NOTE: Each correct selection is worth one point. A. Create VNET1 in RG2, and then set East Asia as the location. B. Create VNET1 in a new resource group in the West US location, and then set West US as the location. C. Create VNET1 in RG1, and then set East Asia as the location D. Create VNET1 in RG1, and then set East US as the location. E. Create VNET1 in RG2, and then set East US as the location.

Answer: AC A network interface can exist in the same, or different resource group, than the virtual machine you attach it to, or the virtual network you connect it to. The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, also referred to as a region. Note, Resource groups can span multiple Regions, but VNets only can hold resources (VMs, Network Adapters) that exists in the same region. So in this scenario, you need to create VNET1 in any RG and set location as East Asia.

You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image. You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed. Which two actions should you perform? Each correct answer presents part of the solution. NOTE Each correct selection is worth one point. A. Modify the extensionProfile section of the Azure Resource Manager template. B. Create a new virtual machine scale set in the Azure portal. C. Create an Azure policy. D. Create an automation account. E. Upload a configuration script.

Answer: AE Virtual Machine Scale Sets can be used with the Azure Desired State Configuration (DSC) extension handler. Virtual machine scale sets provide a way to deploy and manage large numbers of virtual machines, and can elastically scale in and out in response to load. DSC is used to configure the VMs as they come online so they are running the production software

You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do? A. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources. B. Assign the Global administrator role to User1, and then modify the default conditional access policies. C. Assign the Owner role to User1. and then modify the default conditional access policies. D. Assign the Owner role to User1. and then instruct User1 to configure access management for Azure resources.

Answer: B

You have an Azure subscription that contains a web app named webapp1. You need to add a custom domain named www.contoso.com to webapp1. What should you do first? A. Upload a certificate. B. Add a connection string. C. Stop webapp1. D. Create a DNS record.

Answer: B

You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com. You have a Microsoft account that you use to sign in to both tenants. You need to configure the default sign-in tenant for the Azure portal. What should you do? A. From the Azure portal, change the directory. B. From Azure Cloud Shell, run Set-AzContext. C. From the Azure portal, configure the portal settings. D. From Azure Cloud Shell, run Select- AzSubscription.

Answer: B

You create the following resources in an subscription: • An Azure Container Registry instance named Registry1 • An Azure Kubernetes Service (AKS) cluster named Cluster1 You create a container image named App 1 on your administrative workstation. You need to deploy App1 to cluster 1. What should you do first? A. Create a host pool on Cluster1 B. Run the docker push command. C. Run the kubect1 apply command. D. Run the az aks create command.

Answer: B An Azure container registry stores and manages private Docker container images, similar to the way Docker Hub stores public Docker images. You can use the Docker command-line interface (Docker CLI) for login, push, pull, and other operations on your container registry. After you login to the registry you can run push command to upload the image. Below is an sample of that command docker push myregistry.azurecr.io/samples/nginx

You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do? A. Create a new management group and delegate User1 as the owner of the new management group. B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources. C. Assign the Owner role for the Azure subscription to User1, and then modify the default conditional access policies. D. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

Answer: B Each directory is given a single top-level management group called the "Root" management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This root management group allows for global policies and Azure role assignments to be applied at the directory level. The Azure AD Global Administrator needs to elevate themselves to the User Access Administrator role of this root group initially. After elevating access, the administrator can assign any Azure role to other directory users or groups to manage the hierarchy. As administrator, you can assign your own account as owner of the root management group.

You have a computer named Computer! that has a point-to site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You join Computer2 to Azure Active Directory (Azure AD). Q Does this meet the goal? A. Yes B. No

Answer: B Explanation: A client computer that connects to a VNet using Point-to-Site must have a client certificate installed.

You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1. You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable. What should you deploy? A. all three virtual machines in a single Availability Zone B. all virtual machines in a single Availability Set C. each virtual machine in a separate Availability Zone D. each virtual machine in a separate Availability Set

Answer: B Explanation: Availability sets are a datacenter configuration to provide VM redundancy and availability. This configuration within a datacenter ensures that during either a planned or unplanned maintenance event, at least one virtual machine is available.

You have an Azure Storage account named storage1. You plan to use AzCopy to copy data to storage1. You need to identify the storage services in storage1 to which you can copy the data. What should you identify? A. blob, file, table, and queue B. blob and file only C. file and table only D. file only E. blob, table, and queue only

Answer: B Explanation: AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account. Incorrect Answers: A, C, E: AzCopy does not support table and queue storage services. D: AzCopy supports file storage services, as well as blob storage services.

You have an Azure virtual machine named VM1. Azure collects events from VM1. You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1. You need to specify which resource type to monitor. What should you specify? A. metric alert B. Azure Log Analytics workspace C. virtual machine D. virtual machine extension

Answer: B Explanation: Azure Monitor can collect data directly from your Azure virtual machines into a Log Analytics workspace for analysis of details and correlations. Installing the Log Analytics VM extension for Windows and Linux allows Azure Monitor to collect data from your Azure VMs. Azure Log Analytics workspace is also used for on-premises computers monitored by System Center Operations Manager.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the RG1 blade, you click Automation script. Does this meet the goal? A. Yes B. No

Answer: B Explanation: From the RG1 blade, click Deployments. You see a history of deployment for the resource group. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorialcreate-first-template?tabs=azure-powershell Through activity logs, you can determine: § what operations were taken on the resources in your subscription § who started the operation § when the operation occurred § the status of the operation § the values of other properties that might help you research the operation 1. On the Azure portal menu, select Monitor, or search for and select Monitor from any page 2. Select Activity Log. 3. You see a summary of recent operations. A default set of filters is applied to the operations. Notice the information on the summary includes who started the action and when it happened

You need to define a custom domain name for Azure AD to support the planned infrastructure. Which domain name should you use? A. ad.humongousinsurance.com B. humongousinsurance.onmicrosoft.com C. humongousinsurance.local D. humongousinsurance.com

Answer: D Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com. The initial domain name cannot be changed of deleted, but you can add your corporate domain name to AAD as well. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as '[email protected].' instead of 'alice@domain name.onmicrosoft.com'.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You create a resource lock, and then you assign the lock to the subscription. Does this meet the goal? A. Yes B. No

Answer: B Explanation: How can I freeze or lock my production/critical Azure resources from accidental deletion? There is way to do this with both ASM and ARM resources using Azure resource lock.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You assign a built-in policy definition to the subscription. Does this meet the goal? A. Yes B. No

Answer: B Explanation: Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. However, there are no built-in policy definitions. Though there are sample policy defintions.

Scenario: Licensing Issue 1. You attempt to assign a license in Azure to several users and receive the following error message: "Licenses not assigned. License agreement failed for one user." 2. You verify that the Azure subscription has the available licenses. You need to resolve the licensing issue before you attempt to assign the license again. What should you do? A. From the Groups blade, invite the user accounts to a new group. B. From the Profile blade, modify the usage location. C. From the Directory role blade, modify the directory role.

Answer: B Explanation: Some Microsoft services aren't available in all locations because of local laws and regulations. Before you can assign a license to a user, you must specify the Usage location property for the user. You can specify the location under the User > Profile > Settings section in the Azure portal.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev. You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Subscription1, you assign the Logic App Operator role to the Developers group. Does this meet the goal? A. Yes B. No

Answer: B Explanation: The Logic App Operator role only lets you read, enable and disable logic app. With it you can view the logic app and run history, and enable/disable. Cannot edit or update the definition. You would need the Logic App Contributor role.

Your company has a main office in London that contains 100 client computers. Three years ago, you migrated to Azure Active Directory (Azure AD). The company's security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD. A remote user named User1 is unable to join a personal device to Azure AD from a home network. You verify that other users can join their devices to Azure AD. You need to ensure that User1 can join the device to Azure AD. What should you do? A. From the Device settings blade, modify the Users may join devices to Azure AD setting. B. From the Device settings blade, modify the Maximum number of devices per user setting. C. Create a point-to-site VPN from the home network of User1 to Azure. D. Assign the User administrator role to User1.

Answer: B Explanation: The Maximum number of devices setting enables you to select the maximum number of devices that a user can have in Azure AD. If a user reaches this quota, they will not be able to add additional devices until one or more of the existing devices are removed. Incorrect Answers: A: The Users may join devices to Azure AD setting enables you to select the users who can join devices to Azure AD. Options are All, Selected and None. The default is All. C: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as they have connectivity with the Internet.

You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com. You have a Microsoft account that you use to sign in to both tenants. You need to configure the default sign-in tenant for the Azure portal. What should you do? A. From the Azure portal, configure the portal settings. B. From the Azure portal, change the directory. C. From Azure Cloud Shell, run Set-AzureRmContext. D. From Azure Cloud Shell, run Set-AzureRmSubscription.

Answer: B Explanation: The Set-AzureRmContext cmdlet sets authentication information for cmdlets that you run in the current session. The context includes tenant, subscription, and environment information.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the Overview blade, you move the virtual machine to a different resource group. Does this meet the goal? A. Yes B. No

Answer: B Explanation: You should redeploy the VM

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider. Does this meet the goal? A. Yes B. No

Answer: B Explanation: You should use a policy definition.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: Solution: From the Overview blade, you move the virtual machine to a different subscription. Does this meet the goal? A. Yes B. No

Answer: B Explanation: You would need to Redeploy the VM.

You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not support multiple active instances. At the end of each month, CPU usage for VM1 peaks when App1 runs. You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month. What task should you include in the runbook? A. Add the Azure Performance Diagnostics agent to VM1. B. Modify the VM size property of VM1. C. Add VM1 to a scale set. D. Increase the vCPU quota for the subscription. E. Add a Desired State Configuration (DSC) extension to VM1.

Answer: B If you have a CPU/performance issue then the solution is to scale up (increase VM size) or to scale out (scale set) given that the App does not support multiple instances then scale up is the obvious choice.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From the Azure CLI, you run azcopy. Does this meet the goal? A. Yes B. No

Answer: B Kubectl is not installed by installing AZ ClI. As stated Azure CLI is already available but installing Azure CLI doesn't mean that Azure Kubernates client is also installed. So before running any aks command, we have to install kubectl, the Kubernetes command-line client. az aks install-cli

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10 users can use all the Azure AD Premium features. What should you do? A. From the Groups blade of each user, invite the users to a group. B. From the Licenses blade of Azure AD, assign a license. C. From the Directory role blade of each user, modify the directory role. D. From the Azure AD domain, add an enterprise application.

Answer: B Many Azure Active Directory (Azure AD) services require you to license each of your users or groups (and associated members) for that service. Only users with active licenses will be able to access and use the licensed Azure AD services for which that's true. Licenses are applied per tenant and do not transfer to other tenants. Not all Microsoft services are available in all locations. Before a license can be assigned to a group, you must specify the Usage location for all members. You can set this value in the Azure Active Directory > Users > Profile > Settings area in Azure AD. Any user whose usage location is not specified inherits the location of the Azure AD organization. You can add the licensing rights to users or to an entire group.

You create the following resources in an Azure subscription: • An Azure Container Registry instance named Registry1. • An Azure Kubernetes Service (AKS) cluster named Cluster1. You create a container image named App1 on your administrative workstation. You need to deploy App1 to Cluster1. What should you do first? A. Create a host pool on Cluster1. B. Run the az acr build command. C. Run the docker build command. D. Run the docker push command.

Answer: B Run the az acr build command : Correct Choice az acr build command queues a quick build, providing streaming logs for an Azure Container Registry az acr build --registry [--agent-pool] [--auth-mode {Default, None}] [--build-arg] [--file] [--image] [--no-format] [--no-logs] [--no-push] [--no-wait] [--platform] [--resource-group] [--secret-build-arg] [--subscription] [--target] [--timeout] [] Create a host pool on Cluster1 : Incorrect Choice Host pools are a collection of one or more identical virtual machines (VMs) within Windows Virtual Desktop environments. It won't deploy the app to the cluster. Run the docker push command : Incorrect Choice Use docker push to share your images to the Docker Hub registry or to a self-hosted one. It won't deploy the app to the cluster. Run the docker build command : Incorrect Choice This command will build an image from a Dockerfile. But in the question it has been said that image file is already built and need to deploy. This command will not deploy the image

You have a Basic App Service plan named ASP1 that hosts an Azure App Service named App1. You need to configure a custom domain and enable backups for App1. What should you do first? A. Configure a WebJob for App1. B. Scale up ASP1. C. Scale out ASP1. D. Configure the application settings for App1.

Answer: B Scale up ASP1 : Correct Basic App service plan does not support backup/restore.

You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data? A. Azure Data Lake Store B. a virtual machine C. the Azure File Sync Storage Sync Service D. Azure Blob storage

Answer: D Explanation: Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter. The maximum size of an Azure Files Resource of a file share is 5 TB.

You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com. Your company has a public DNS zone for contoso.com. You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name. Which type of DNS record should you create? A. PTR B. MX C. NSEC3 D. RRSIG

Answer: B TXT or MX : Correct You can use either a TXT or MX record to verify the custom domain in the Azure AD. MX records can serve the purpose of TXT records Questions & Answers PDF P-56 www.dumpskey.com SRV : Incorrect SRV records are used by various services to specify server locations. When specifying an SRV record in Azure DNS DNSKEY : Incorrect Choice This will verify that the records are originating from an authorized sender. NSEC : Incorrect Choice This is Part of DNSSEC. This is used for explicit denial-of-existence of a DNS record. It is used to prove a name does not exist.

You have an Azure Active Directory (Azure AD) tenant that has Azure AD Privileged Identity Management configured. You have 10 users who are assigned the Security Administrator role for the tenant. You need the users to verify whether they still require the Security Administrator role. What should you do? A. From Azure AD Identity Protection, configure a user risk policy. B. From Azure AD Privileged Identity Management, create an access review. C. From Azure AD Identity Protection, configure the Weekly Digest. D. From Azure AD Privileged Identity Management, create a conditional access policy.

Answer: B To reduce the risk associated with stale role assignments, you should regularly review access. You can use Azure AD Privileged Identity Management (PIM) to create access reviews for privileged Azure AD roles. You can also configure recurring access reviews that occur automatically. Steps: 1. Sign in to Azure portal with a user that is a member of the Privileged role administrator role. 2. Open Azure AD Privileged Identity Management. 3. Select Azure AD roles. 4. Under Manage, select Access reviews, and then select New.

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1. You need to view the error events from a table named Event. Which query should you run in Workspace1? A. Event | where EventType is "error" B. Event | search "error" C. select * from Event where EventType == "error" D. Get-Event Event | where {$_.EventType -eq "error"}

Answer: B To search a term in a specific table, add in (table-name) just after the search operator

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1. An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com. You need to ensure that access to AKS1 can be granted to the contoso.com users. What should you do first? A. From contoso.com, modify the Organization relationships settings. B. From contoso.com, create an OAuth 2.0 authorization endpoint. C. Recreate AKS1. D. From AKS1, create a namespace.

Answer: B With Azure AD-integrated AKS clusters, you can grant users or groups access to Kubernetes resources within a namespace or across the cluster. To obtain a kubectl configuration context, a user can run the az aks get-credentials command. When a user then interacts with the AKS cluster with kubectl, they're prompted to sign in with their Azure AD credentials. This approach provides a single source for user account management and password credentials. The user can only access the resources as defined by the cluster administrator. Azure AD authentication is provided to AKS clusters with OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol. For more information on OpenID Connect, see the Open ID connect documentation. From inside of the Kubernetes cluster, Webhook Token Authentication is used to verify authentication tokens. Webhook token authentication is configured and managed as part of the AKS cluster

You plan to use the Azure Import/Export service to copy files to a storage account. Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. an XML manifest file B. a driveset CSV file C. a dataset CSV file D. a PowerShell PS1 file E. a JSON configuration file

Answer: BC Explanation: B: Modify the driveset.csv file in the root folder where the tool resides. C: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you want to import a file or folder or both, add entries in the dataset.csv file

You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1. You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days. Which two groups should you create? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. A. a Security group that uses the Assigned membership type B. an Office 365 group that uses the Assigned membership type C. an Office 365 group that uses the Dynamic User membership type D. a Security group that uses the Dynamic User membership type E. a Security group that uses the Dynamic Device membership type

Answer: BC Explanation: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD). Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner. When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also deleted. You can set up a rule for dynamic membership on security groups or Office 365 groups. Incorrect Answers: A, D, E: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).

You need to prepare the environment to meet the authentication requirements. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. Allow inbound TCP port 8080 to the domain controllers in the Miami office. B. Add http://autogon.microsoftazuread-sso.com to the intranet zone of each client computer in the Miami office. C. Join the client computers in the Miami office to Azure AD. D. Install the Active Directory Federation Services (AD FS) role on a domain controller in the Miami Questions & Answers PDF P-16 www.dumpskey.com office. E. Install Azure AD Connect on a server in the Miami office and enable Pass-through Authentication.

Answer: BE B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com E: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

You have an Azure subscription named Subscription 1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1. On a computer named Client1 that runs Windows 10, you configure a point to site VPN connection to VNet1. You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on premises network. Client1 is unable to connect to VNet2. You need to ensure that you can connect Client1 to VNet2. What should you do? A. Select Allow gateway transit on VNet2. B. Select Allow gateway transit on VNet1. C. Download and te-install the VPN client configuration package on Client1. D. Enable BGP on VPNGW1

Answer: C

You have an Azure subscription that contains a user named User1. You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege. Which role-based access control (RBAC) role should you assign to User1? A. Owner B. Virtual Machine Administrator Login C. Contributor D. Virtual Machine Contributor

Answer: C

Your on-premises network contains an SMB share named Share1. You have an Azure subscription that contains the following resources: A web app named webapp1 A virtual network named VNET1 You need to ensure that webapp1 can connect to Share1. What should you deploy? A. an Azure Application Gateway B. an Azure Active Directory (Azure AD) Application Proxy C. an Azure Virtual Network Gateway

Answer: C A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to it.

You have an Azure virtual machine named VM1 that you use for testing. VM1 is protected by Azure Backup. You delete VM1. You need to remove the backup data stored for VM1. What should you do first? A. Modify the backup policy. B. Delete the Recovery Services vault. C. Stop the backup. D. Delete the storage account.

Answer: C Azure Backup provides backup for virtual machines — created through both the classic deployment model and the Azure Resource Manager deployment model — by using custom-defined backup policies in a Recovery Services vault. With the release of backup policy management, customers can manage backup policies and model them to meet their changing requirements from a single window. Customers can edit a policy, associate more virtual machines to a policy, and delete unnecessary policies to meet their compliance requirements. Incorrect Answers: You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can't, the vault is still configured to receive backup data.

You have an on-premises server that contains a folder named D:\Folder1. You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contoso data. Which command should you run? A. https://contosodata.blob.core.windows.net/public B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive D. az storage blob copy start-batch D:\Folder1 https:// contosodata.blob.core.windows.net/public

Answer: C Explanation: The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The result is a directory in the container by the same name. Incorrect Answers: B: The azcopy sync command replicates the source location to the destination location. However, the file is skipped if the last modified time in the destination is more recent. D: The az storage blob copy start-batch command copies multiple blobs to a blob container.

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VM1. VM1 is in a resource group named RG1. VM1 runs services that will be used to deploy resources to RG1. You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1. What should you do first? A. From the Azure portal modify the Access control (1AM) settings of VM1. B. From the Azure portal, modify the Policies settings of RG1. C. From the Azure portal, modify the value of the Managed Service Identity option for VM1. D. From the Azure portal, modify the Access control (IAM) settings of RG1.

Answer: C Explanation: A managed identity from Azure Active Directory allows your app to easily access other AADprotected resources such as Azure Key Vault. The identity is managed by the Azure platform and does not require you to provision or rotate any secrets. User assigned managed identities can be used on Virtual Machines and Virtual Machine Scale Sets.

You have an Azure subscription that contains 10 virtual machines. You need to ensure that you receive an email message when any virtual machines are powered off, restarted, or deallocated. What is the minimum number of rules and action groups that you require? A. three rules and three action groups B. one rule and one action group C. three rules and one action group D. one rule and three action groups

Answer: C Explanation: An action group is a collection of notification preferences defined by the user. Azure Monitor and Service Health alerts are configured to use a specific action group when the alert is triggered. Various alerts may use the same action group or different action groups depending on the user's requirements.

You have an Azure Active Directory (Azure AD) tenant named contoso.com. Multi-factor authentication (MFA) is enabled for all users. You need to provide users with the ability to bypass MFA for 10 days on devices to which they have successfully signed in by using MFA. What should you do? A. From the multi-factor authentication page, configure the users' settings. B. From Azure AD, create a conditional access policy. C. From the multi-factor authentication page, configure the service settings. D. From the MFA blade in Azure AD, configure the MFA Server settings

Answer: C Explanation: Enable remember Multi-Factor Authentication Sign in to the Azure portal. On the left, select Azure Active Directory > Users. Select Multi-Factor Authentication. Under Multi-Factor Authentication, select service settings. On the Service Settings page, manage remember multi-factor authentication, select the Allow users to remember multi-factor authentication on devices they trust option. Set the number of days to allow trusted devices to bypass two-step verification. The default is 14 days. Select Save.

You create an Azure Storage account named contosostorage. You plan to create a file share named data. Users need to map a drive to the data file share from home computers that run Windows 10. Which port should be open between the home computers and the data file share? A. 80 B. 443 C. 445 D. 3389

Answer: C Explanation: Ensure port 445 is open: The SMB protocol requires TCP port 445 to be open; connections will fail if port 445 is blocked.

You have an Azure subscription named Subscription 1 and an on-premises deployment of Microsoft System Center Service Manager Subscription! contains a virtual machine named VM1. You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent. What should you do first? A. Create a notification. B. Create an automation runbook. C. Deploy the IT Service Management Connector (ITSM). D. Deploy a function app.

Answer: C Explanation: The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service Management (ITSM) product/service, such as the Microsoft System Center Service Manager. With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log alerts and Log Analytics alerts).

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1.VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first? A. Move VNet1 to Subscription2. B. Modify the IP address space of VNet2. C. Provision virtual network gateways. D. Move VM1 to Subscription2.

Answer: C Explanation: The virtual networks can be in the same or different regions, and from the same or different subscriptions. When connecting VNets from different subscriptions, the subscriptions do not need to be associated with the same Active Directory tenant. Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual network to another virtual network using the VNet-to-VNet connection type (VNet2VNet) is similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same way when communicating. The local network gateway for each VNet treats the other VNet as a local site. This lets you specify additional address space for the local network gateway in order to route traffic.

You have an Azure subscription that contains the following resources: 100 Azure virtual machines 20 Azure SQL databases 50 Azure file shares You need to create a daily backup of all the resources by using Azure Backup. What is the minimum number of backup policies that you must create? A. 1 B. 2 C. 3 D. 150 E. 170

Answer: C Explanation: There is a limit of 100 VMs that can be associated to the same backup policy from portal. We recommend that for more than 100 VMs, create multiple backup policies with same schedule or different schedule. One policy for VMS, one for SQL databases, and one for the file shares.

You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines. You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text. What should you create to store the password? Questions & Answers PDF P-73 www.dumpskey.com A. Azure Active Directory (AD) Identity Protection and an Azure policy B. a Recovery Services vault and a backup policy C. an Azure Key Vault and an access policy D. an Azure Storage account and an access policy

Answer: C Explanation: You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore the password is never put in plain text in the template parameter file

You create an App Service plan named App1 and an Azure web app named webapp1. You discover that the option to create a staging slot is unavailable. You need to create a staging slot for App1. What should you do first? A. From webapp1, modify the Application settings. B. From webapp1, add a custom domain. C. From App1, scale up the App Service plan. D. From App1, scale out the App Service plan.

Answer: C Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs), custom domains and certificates, staging slots, autoscaling, and more. You scale up by changing the pricing tier of the App Service plan that your app belongs to.

You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use? A. Azure Active Directory (Azure AD) Application Proxy B. Azure Application Insights C. Azure Custom Script Extension D. the New-AzConfigurationAssignement cmdlet

Answer: C The Custom Script Extension downloads and executes scripts on Azure VMs. This extension is useful for post deployment configuration, software installation, or any other configuration / management task. Scripts can be downloaded from Azure storage or GitHub, or provided to the Azure portal at extension run time. The Custom Script extension integrates with Azure Resource Manager templates, and can also be run using the Azure CLI, PowerShell, Azure portal, or the Azure Virtual Machine REST API. You can use the Custom Script Extension with both Windows and Linux VMs.

You recently created a new Azure subscription that contains a user named Admin1. Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: "User failed validation to purchase resources. Error message: "Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time." You need to ensure that Admin1 can deploy the Marketplace resource successfully. What should you do? A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet B. From the Azure portal, register the Microsoft.Marketplace resource provider C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet D. From the Azure portal, assign the Billing administrator role to Admin1

Answer: C The Set-AzMarketplaceTerms cmdlet saves the terms object for given publisher id(Publisher), offer id(Product) and plan id(Name) tuple.

You have a public load balancer that balances ports 80 and 443 across three virtual machines. You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only. What should you configure? A. a load balancing rule B. a new public load balancer for VM3 C. an inbound NAT rule D. a frontend IP configuration

Answer: C To port forward traffic to a specific port on specific VMs use an inbound network address translation (NAT) rule. https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview an inbound NAT rule : Create a load balancer inbound network address translation (NAT) rule to forward traffic from a specific port of the front-end IP address to a specific port of a back-end VM. Hence this option is Correct a load balancing rule : Incorrect Choice A load balancer rule defines how traffic is distributed to the VMs. The rule defines the front-end IP configuration for incoming traffic, the back-end IP pool to receive the traffic, and the required source and destination ports. a new public load balancer for VM3 : Incorrect Choice This option will not help you since this will route all traffic to VM3 only. a frontend IP configuration : Incorrect Choice When you define an Azure Load Balancer, a frontend and a backend pool configuration are connected with rules. The health probe referenced by the rule is used to determine how new flows are sent to a node in the backend pool. The frontend (aka VIP) is defined by a 3-tuple comprised of an IP address (public or internal), a transport protocol (UDP or TCP), and a port number from the load balancing rule. The backend pool is a collection of Virtual Machine IP configurations (part of the NIC resource) which reference the Load Balancer backend pool.

You have an Azure subscription that contains a resource group named RG1. RG1 contains 100 virtual machines. Your company has three cost centers named Manufacturing, Sales, and Finance. You need to associate each virtual machine to a specific cost center. What should you do? A. Add an extension to the virtual machines. B. Modify the inventory settings of the virtual machine. C. Assign tags to the virtual machines. D. Configure locks for the virtual machine.

Answer: C You apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the name "Environment" and the value "Production" to all the resources in production

You have an Azure Kubernetes Service (AKS) cluster named AKS1. You need to configure cluster autoscaler for AKS1. Which two tools should you use? Each correct answer presents a complete solution, NOTE: Each correct selection is worth one point A. the set-AzAKs cmdlet B. the Azure portal C. The az aks command D. the kubect1 command E. the set Azvm cmdlet

Answer: CD With cluster auto-scaling, the actual load of your worker-nodes will be monitored actively. By adding and removing worker-nodes from the cluster, it ensures that enough resources are available to keep your application healthy and responsive. In contrast, it removes worker-nodes from the AKS cluster, to optimize resource utilization and be as cost-effective as possible

You have an Azure subscription named Subscription1 that has the following providers registered: Authorization Automation Resources Compute KeyVault Network Storage Billing Web Subscription1 contains an Azure virtual machine named VM1 that has the following con figurations: * Private IP address: 10.0.0.4 (dynamic) * Network security group (NSG): NSG1 * Public IP address: None * Availability set: AVSet * Subnet: 10.0.0.0/24 * Managed disks: No * Location: East US You need to record all the successful and failed connection attempts to VM1. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. Register the Microsoft.Insights resource provider B. Add an Azure Network Watcher connection monitor C. Register the Microsoft.LogAnalytics provider D. Enable Azure Network Watcher in the East US Azure region E. Create an Azure Storage account F. Enable Azure Network Watcher flow logs

Answer: CDE NSG flow log data is written to an Azure Storage account. You need to create an Azure Storage account, With an Azure Storage account NSG flow logs can be enabled. Enable network watcher in the East US region. NSG flow logging requires the Microsoft.Insights provider.

You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1. You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. Add a service endpoint to VNet1 B. Reset GW1 C. Create a route-based virtual network gateway D. Add a connection to GW1 E. Delete GW1 F. Add a public IP address space to VNet1

Answer: CE C: A VPN gateway is used when creating a VPN connection to your on-premises network. Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface). E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet filtering. IPsec tunnel encryption and decryption are added to the packet filtering and processing engine

You have an Azure subscription that contains 100 virtual machines. You regularly create and delete virtual machines. You need to identify unused disks that can be deleted. What should you do? A. From Azure Advisor, modify the Advisor configuration. B. From Azure Cost Management view Cost Analysis. C. From Azure Cost Management view Advisor Recommendations. D. From Microsoft Azure Storage Explorer, view the Account Management properties.

Answer: D

You have an Azure virtual machine named VM1 that runs Windows Server 2019. You sign in to VM1 as a user named User 1 and perform the following actions: * Create files on drive C. * Create files on drive 0. * Modify the screen saver timeout. * Change the desktop background. You plan to redeploy VM1. Which changes will be lost after you redeploy VM1? A. the modified screen saver timeout B. the new desktop background C. the new files on drive D. The new files on drive C

Answer: D

You have an Azure subscription. You have 100 Azure virtual machines. You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering. Which blade should you use? A. Metrics B. Customer insights C. Monitor D. Advisor

Answer: D Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized resources. You can get cost recommendations from the Cost tab on the Advisor dashboard.

You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2. You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hosting VM1 and VM2. What should you include in the Availability Set? A. one update domain B. two fault domains C. one fault domain D. two update domains

Answer: D Explanation: Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require that VMs be rebooted to complete the update. To reduce the impact on VMs, the Azure fabric is divided into update domains to ensure that not all VMs are rebooted at the same time. Incorrect Answers: A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at the same time. B, C: A fault domain shares common storage as well as a common power source and network switch. It is used to protect against unplanned system failure.

You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual. You need to view the average round-trip time (RTT) of the packets from VM1 to VM2. Which Azure Network Watcher feature should you use? A. NSG flow logs B. Connection troubleshoot C. IP flow verify D. Connection monitor

Answer: D Explanation: The Connection Monitor feature in Azure Network Watcher is now generally available in all public regions. Connection Monitor provides you RTT values on a per-minute granularity. You can monitor a direct TCP connection from a virtual machine to a virtual machine, FQDN, URI, or IPv4 address.

You have an Azure virtual machine named VM1 that runs Windows Server 2019. You save VM1 as a template named Template1 to the Azure Resource Manager library. You plan to deploy a virtual machine named VM2 from Template1. What can you configure during the deployment of VM2? A. virtual machine size B. operating system C. administrator username D. resource group

Answer: D Explanation: When deploying a virtual machine from a template, you must specify: the Resource Group name and location for the VM the administrator username and password an unique DNS name for the public IP

You have an Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines host several applications that are accessible over port 443 to user on the Internet. Your on-premises network has a site-to-site VPN connection to VNet1. You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network. You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accesses by the Internet users. What should you do? A. Modify the address space of the local network gateway. B. Remove the public IP addresses from the virtual machines. C. Modify the address space of Subnet1. D. Create a deny rule in a network security group (NSG) that is linked to Subnet1.

Answer: D Explanation: You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet. And this can be achieved by configuring a deny rule in a network security group (NSG) that is linked to Subnet1 for RDP / SSH protocol coming from internet. Modify the address space of Subnet1 : Incorrect choice Modifying the address space of Subnet1 will have no impact on RDP traffic flow to the virtual network. Modify the address space of the local network gateway : Incorrect choice Modifying the address space of the local network gateway will have no impact on RDP traffic flow to the virtual network. Remove the public IP addresses from the virtual machines : Incorrect choice If you remove the public IP addresses from the virtual machines, none of the applications be accessible publicly by the Internet users.

You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2. VM2 is protected by RSV1. You need to use RSV2 to protect VM2. What should you do first? A. From the RSV1 blade, click Backup items and stop the VM2 backup. B. From the RSV1 blade, click Backup Jobs and export the VM2 backup. C. From the RSV1 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup. D. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault

Answer: D The Azure Site Recovery service contributes to your disaster recovery strategy by managing and orchestrating replication, failover, and failback of on-premises machines and Azure virtual machines (VMs).

You have an Azure virtual machine named VM1. You use Azure Backup to create a backup of VM1 named Backup1. After creating Backup1, you perform the following changes to VM1: Modify the size of VM1. Copy a file named Budget.xls to a folder named Data. Reset the password for the built-in administrator account. Questions & Answers PDF P-110 www.dumpskey.com Add a data disk to VM1. An administrator uses the Replace existing option to restore VM1 from Backup1. You need to ensure that all the changes to VM1 are restored. Which change should you perform again? A. Modify the size of VM1. B. Add a data disk. C. Reset the password for the built-in administrator account. D. Copy Budget.xls to Data.

Answer: D The scenario mentioned in the question, we are using the replace option. So in this case we would lose the existing data written to the disk after the backup was taken. The file was copied to the disk after the backup was taken. Hence, we would need to copy the file once again.