Q1.Four Azure virtual networks are configured within the same subscription, as shown in the table below.
Starting from VNet1, with which virtual networks can you establish a peering connection?
| Name | Address space | Subnet | Azure region of the resource group |
|---|---|---|---|
| VNet1 | 10.11.0.0/16 | 10.11.0.0/17 | West US |
| VNet2 | 10.11.0.0/17 | 10.11.0.0/25 | West US |
| VNet3 | 10.10.0.0/22 | 10.10.1.0/24 | East US |
| VNet4 | 192.168.16.0/22 | 192.168.16.0/24 | North Europe |
Show answer
In Azure virtual network peering, it is a mandatory condition that the address spaces do not overlap between the virtual networks being connected.
Because VNet1 (10.11.0.0/16) and VNet2 (10.11.0.0/17) have overlapping address ranges, peering cannot be created.
On the other hand, VNet3 (10.10.0.0/22) and VNet4 (192.168.16.0/22) do not overlap with VNet1’s address space, so they can be connected via global virtual network peering even though the regions differ.
Therefore, only VNet3 and VNet4 can be connected.
Azure virtual network peering
Q2.You are managing an Azure subscription.
You need to receive an email alert when a resource lock is deleted from any resource in the subscription.
Which components should you use to create this activity log alert in Azure Monitor?
Show answer
An Azure Monitor activity log alert is composed of the three elements “target resource (scope),” “condition,” and “action group”.
Deleting a resource lock is a management operation that is recorded in the activity log, and you define that event as the condition and specify an action group (such as email) as the notification target.
A Log Analytics workspace or a data collection endpoint is for log collection and analysis and is not a required component of an activity log alert.
A Microsoft 365 group is also not a direct component.
Create or edit an activity log, service health, or resource health alert rule
Q3.Before reassigning licenses to users, you need to resolve the licensing problem that is occurring.
What should you do?
Show answer
In Azure Active Directory (now renamed Microsoft Entra ID), you must set a “usage location” for a user before you can assign a license.
If the usage location is not set, errors such as “The license agreement failed” occur and the license cannot be assigned.
This is a requirement based on national laws and regulations and service availability.
Therefore, after correctly setting the usage location from the user’s [Profile], reassign the license.
Adding to a group or changing a directory role does not resolve this problem.
Identify and resolve license assignment problems for a group in the Microsoft 365 admin center
Q4.You operate an Azure virtual machine named VM1.
VM1 was deployed by using a custom Azure Resource Manager template named ARMIjson.
One day, you receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
As a solution, from the “Redeploy + reapply” blade of VM1, you select Redeploy.
Does this method meet the goal?
Show answer
The “Redeploy” feature of an Azure virtual machine stops the VM and then relocates it to a new physical host.
This lets you avoid the impact of maintenance or hardware failure of the underlying host.
When you perform a redeploy, the VM is moved to a different host and the contents of the temporary disk are lost, but the OS disk and data disks are preserved.
Therefore, it meets the requirement of moving to a different host before being affected by maintenance.
Note that Azure Resource Manager is still the current official name and has no former name.
Redeploy a virtual machine to a new Azure node
Q5.An Azure subscription contains a storage account named storage1.
The storage1 account contains a container named container1.
You need to configure access to container1, and the solution must meet the following requirements.
Allow read access only.
Allow both the HTTP and HTTPS protocols.
Apply the access permissions to all content in the container.
What should you use?
Show answer
A shared access signature (SAS) is a mechanism for delegating restricted access to Azure Storage resources.
With a SAS, you can specify granular permissions such as read-only, and you can also choose HTTP and HTTPS as the allowed protocols.
Also, by issuing it at the container level, you can apply the specified access rights to all blobs in that container.
An access key grants full access to the entire account, so it does not meet the requirements.
CDN is a delivery-optimization service, not an access-control mechanism.
Grant restricted access to Azure Storage resources using shared access signatures (SAS)
Q6.You are using an Azure subscription named Subscription1.
You create an Azure storage account named contosostorage and then create a file share named data.
Which UNC path should you specify in a script that references files in the data file share?
Drag each option to the matching requirement’s drop zone, or tap to place it. Click a filled zone to send it back. (The same option may be used more than once.)
blob.core.windows.net
contosostorage
data
file
file.core.windows.net
portal.azure.com
subscription1
Show answer
When accessing an Azure Files file share, the UNC path has the form “\\storage-account-name.file.core.windows.net\file-share-name”.
This is because Azure Files is provided as a network share using the SMB protocol.
In this question, the storage account name is contosostorage and the created file share is data, so the correct UNC path is \\contosostorage.file.core.windows.net\data.
blob.core.windows.net is the endpoint for Azure Blob Storage and is not used with Azure Files.
Also, subscription1 and portal.azure.com are not part of the UNC path.
What is Azure Files?
Q7.You have an Azure subscription that contains the storage accounts shown in the table below.
You need to deploy an application named App1 that requires Blob storage in the hot access tier.
Which storage accounts can you use for App1?
| Name | Performance | Premium account type |
|---|---|---|
| storage1 | Standard | N/A |
| storage2 | Premium | Block blobs |
| storage3 | Premium | File shares |
| storage4 | Premium | Page blobs |
Show answer
The Azure Blob Storage access tiers (Hot, Cool, Archive) can be used with a Standard storage account or with Premium storage that supports Block blobs.
storage1 is a Standard account, so it can use the hot tier of Blob Storage.
storage2 is a Premium account for Block blobs, and because it can handle blob data, it can be used.
storage3 is Premium for File shares (for Azure Files) and is not Blob Storage, so it cannot be used.
storage4 is Premium for Page blobs (mainly for virtual machine disks), but it can be used as Blob Storage.
Therefore, the three that can be used for App1 are storage1, storage2, and storage4.
Access tiers for blob data
Q8.You need to resolve the problem with the on-premises Active Directory.
What should you do?
Show answer
When synchronizing on-premises Active Directory with Azure Active Directory (whose current official name is Microsoft Entra ID), synchronization errors occur if user attributes contain values or characters that are not supported on the Azure side.
The IdFix tool is Microsoft’s official tool for detecting and correcting invalid characters and duplicate values in Active Directory attributes (such as UPN and ProxyAddress) before directory synchronization by Azure AD Connect.
If the UPN may contain special characters, it is appropriate to run IdFix and fix the detected problems with the Edit action.
Editing user attributes directly, changing suffixes, or changing synchronization rules cannot reliably detect and correct invalid values.
Prepare directory attributes for synchronization with IdFix
Q9.You have an Azure subscription named Sub1 that contains the resources shown in the table below.
Sub1 has the following alert rule configured.
Name: Alert1.
Scope: All resource groups in Sub1 (including all future resources).
Condition: All administrative operations.
Action: Action1.
In addition, Sub1 has the following alert processing rule configured.
Name: Rule1.
Scope: Sub1.
Rule type: Suppress notifications.
Rule application: A specific time range (start date August 10, 2022; end date August 13, 2022).
For each of the following statements, select Yes if it is true; otherwise, select No.
| Name | Description |
|---|---|
| RG1 | Resource group |
| Action1 | An action group that sends an email message to admin1@contoso.com |
| Statement | Yes | No | |
|---|---|---|---|
| If you create a new resource group in Sub1 on August 11, 2022, Alert1 appears in the Azure portal. | |||
| If you create a new resource group in Sub1 on August 12, 2022, an email is sent to admin1@contoso.com. | |||
| If you add a tag to RG1 on August 15, 2022, an email is sent to admin1@contoso.com. |
Show answer
An Azure Monitor alert processing rule is a feature that suppresses or modifies alert notifications during a specified period.
In this question, notifications are suppressed from August 10 to August 13, 2022.
However, the alerts themselves are still generated, so they appear in the Azure portal.
Therefore, if you create a resource group on August 11, the alert appears but no notification is sent.
August 12 is within the suppression period, so no email is sent.
On the other hand, August 15 is outside the suppression period, so when a management operation (adding a tag) occurs, the action group runs and an email is sent to admin1@contoso.com.
Alert processing rules
Q10.You need to configure a new Azure App Service app named WebApp1.
The solution must meet the following requirements.
WebApp1 must be able to validate the custom domain name app.contoso.com.
WebApp1 must be able to automatically scale up to a maximum of 8 instances.
Minimize cost and administrative effort.
Which pricing plan should you select, and which type of record should you use to validate the domain?
To answer, select the appropriate options in the answer area.
Show answer
The auto-scale feature of Azure App Service is available on the Standard plan and higher.
Because the Basic, Free, and Shared plans do not support auto-scale, the Standard plan is required to meet the requirement of automatically scaling up to a maximum of 8 instances.
Also, to securely validate a custom domain in App Service, using a DNS TXT record is recommended.
A TXT record is used to verify domain ownership and can confirm the domain more securely than an A record and similar options.
The combination that meets the requirements at the lowest cost is the Standard plan and a TXT record.
Map an existing custom domain in Azure App Service
Scale up an app in Azure App Service